imc-swima: Created SWIMA IMC plugin

10 files changed, 711 insertions, 1 deletions

diff --git a/conf/Makefile.am b/conf/Makefile.am
index 0c48bd0c1..6133a9c51 100644
--- a/conf/Makefile.am
+++ b/conf/Makefile.am
@@ -60,6 +60,7 @@ plugins = \
 	plugins/imc-os.opt \
 	plugins/imc-scanner.opt \
 	plugins/imc-swid.opt \
+	plugins/imc-swima.opt \
 	plugins/imc-test.opt \
 	plugins/imv-attestation.opt \
 	plugins/imv-os.opt \
diff --git a/conf/plugins/imc-swima.opt b/conf/plugins/imc-swima.opt
new file mode 100644
index 000000000..73643f4ba
--- /dev/null
+++ b/conf/plugins/imc-swima.opt
@@ -0,0 +1,19 @@
+libimcv.plugins.imc-swima.swid_database =
+	Path to software collector database containing event timestamps, software
+	creation and deletion events and collected software identifiers.
+
+libimcv.plugins.imc-swima.swid_epoch = 0x11223344
+	Set 32 bit epoch value for event IDs manually if software collector database
+	is not available.
+
+libimcv.plugins.imc-swima.swid_directory = ${prefix}/share
+	Directory where SWID tags are located.
+
+libimcv.plugins.imc-swima.swid_generator = /usr/local/bin/swid_generator
+	SWID generator command to be executed.
+
+libimcv.plugins.imc-swima.swid_pretty = FALSE
+	Generate XML-encoded SWID tags with pretty indentation.
+
+libimcv.plugins.imc-swima.swid_full = FALSE
+	Include file information in the XML-encoded SWID tags.
diff --git a/configure.ac b/configure.ac
index 478cb04f2..6460b2e2c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -247,6 +247,7 @@ ARG_ENABL_SET([imc-attestation],[enable IMC attestation module.])
 ARG_ENABL_SET([imv-attestation],[enable IMV attestation module.])
 ARG_ENABL_SET([imc-swid],       [enable IMC swid module.])
 ARG_ENABL_SET([imv-swid],       [enable IMV swid module.])
+ARG_ENABL_SET([imc-swima],      [enable IMC swima module.])
 ARG_ENABL_SET([imc-hcd],        [enable IMC hcd module.])
 ARG_ENABL_SET([imv-hcd],        [enable IMV hcd module.])
 ARG_ENABL_SET([tnc-ifmap],      [enable TNC IF-MAP module. Requires libxml])
@@ -422,7 +423,7 @@ if test x$eap_tls = xtrue -o x$eap_ttls = xtrue -o x$eap_peap = xtrue -o x$tnc_t
 	tls=true;
 fi
 
-if test x$imc_test = xtrue -o x$imv_test = xtrue -o x$imc_scanner = xtrue -o x$imv_scanner = xtrue -o x$imc_os = xtrue -o x$imv_os = xtrue -o x$imc_attestation = xtrue -o x$imv_attestation = xtrue -o x$imc_swid = xtrue -o x$imv_swid = xtrue -o x$imc_hcd = xtrue -o x$imv_hcd = xtrue; then
+if test x$imc_test = xtrue -o x$imv_test = xtrue -o x$imc_scanner = xtrue -o x$imv_scanner = xtrue -o x$imc_os = xtrue -o x$imv_os = xtrue -o x$imc_attestation = xtrue -o x$imv_attestation = xtrue -o x$imc_swid = xtrue -o x$imv_swid = xtrue -o x$imc_swima = xtrue -o x$imc_hcd = xtrue -o x$imv_hcd = xtrue; then
 	imcv=true;
 fi
 
@@ -1607,6 +1608,7 @@ AM_CONDITIONAL(USE_IMC_ATTESTATION, test x$imc_attestation = xtrue)
 AM_CONDITIONAL(USE_IMV_ATTESTATION, test x$imv_attestation = xtrue)
 AM_CONDITIONAL(USE_IMC_SWID, test x$imc_swid = xtrue)
 AM_CONDITIONAL(USE_IMV_SWID, test x$imv_swid = xtrue)
+AM_CONDITIONAL(USE_IMC_SWIMA, test x$imc_swima = xtrue)
 AM_CONDITIONAL(USE_IMC_HCD, test x$imc_hcd = xtrue)
 AM_CONDITIONAL(USE_IMV_HCD, test x$imv_hcd = xtrue)
 AM_CONDITIONAL(USE_SOCKET_DEFAULT, test x$socket_default = xtrue)
@@ -1833,6 +1835,7 @@ AC_CONFIG_FILES([
 	src/libimcv/plugins/imv_attestation/Makefile
 	src/libimcv/plugins/imc_swid/Makefile
 	src/libimcv/plugins/imv_swid/Makefile
+	src/libimcv/plugins/imc_swima/Makefile
 	src/libimcv/plugins/imc_hcd/Makefile
 	src/libimcv/plugins/imv_hcd/Makefile
 	src/charon/Makefile
diff --git a/src/libimcv/Makefile.am b/src/libimcv/Makefile.am
index 5bf1722a7..9c3462042 100644
--- a/src/libimcv/Makefile.am
+++ b/src/libimcv/Makefile.am
@@ -184,6 +184,10 @@ if USE_IMV_SWID
   SUBDIRS += plugins/imv_swid
 endif
 
+if USE_IMC_SWIMA
+  SUBDIRS += plugins/imc_swima
+endif
+
 if USE_IMC_HCD
   SUBDIRS += plugins/imc_hcd
 endif
diff --git a/src/libimcv/plugins/imc_swima/.gitignore b/src/libimcv/plugins/imc_swima/.gitignore
new file mode 100644
index 000000000..59e5e9977
--- /dev/null
+++ b/src/libimcv/plugins/imc_swima/.gitignore
@@ -0,0 +1 @@
+strongswan.org_*.swidtag
diff --git a/src/libimcv/plugins/imc_swima/Makefile.am b/src/libimcv/plugins/imc_swima/Makefile.am
new file mode 100644
index 000000000..59a133ed0
--- /dev/null
+++ b/src/libimcv/plugins/imc_swima/Makefile.am
@@ -0,0 +1,36 @@
+regid = strongswan.org
+unique_sw_id = strongSwan-$(PACKAGE_VERSION_MAJOR)-$(PACKAGE_VERSION_MINOR)-$(PACKAGE_VERSION_BUILD)$(PACKAGE_VERSION_REVIEW)
+swid_tag = $(regid)_$(unique_sw_id).swidtag
+
+swiddir = $(pkgdatadir)/swidtag
+dist_swid_DATA = $(swid_tag)
+EXTRA_DIST = $(regid)_strongSwan.swidtag.in
+CLEANFILES = $(regid)_strongSwan*.swidtag
+
+$(swid_tag) : $(regid)_strongSwan.swidtag.in
+	$(AM_V_GEN) \
+	sed \
+	-e "s:@VERSION_MAJOR@:$(PACKAGE_VERSION_MAJOR):" \
+	-e "s:@VERSION_MINOR@:$(PACKAGE_VERSION_MINOR):" \
+	-e "s:@VERSION_BUILD@:$(PACKAGE_VERSION_BUILD):" \
+	-e "s:@VERSION_REVIEW@:$(PACKAGE_VERSION_REVIEW):" \
+	$(srcdir)/$(regid)_strongSwan.swidtag.in > $@
+
+AM_CPPFLAGS = \
+	-I$(top_srcdir)/src/libstrongswan \
+	-I$(top_srcdir)/src/libtncif \
+	-I$(top_srcdir)/src/libimcv \
+	-DPLUGINS=\""random openssl sqlite curl"\"
+
+AM_CFLAGS = \
+	$(PLUGIN_CFLAGS)
+
+imcv_LTLIBRARIES = imc-swima.la
+
+imc_swima_la_LIBADD = \
+	$(top_builddir)/src/libimcv/libimcv.la \
+	$(top_builddir)/src/libstrongswan/libstrongswan.la
+
+imc_swima_la_SOURCES = imc_swima.c imc_swima_state.h imc_swima_state.c
+
+imc_swima_la_LDFLAGS = -module -avoid-version -no-undefined
diff --git a/src/libimcv/plugins/imc_swima/imc_swima.c b/src/libimcv/plugins/imc_swima/imc_swima.c
new file mode 100644
index 000000000..e120cf7fc
--- /dev/null
+++ b/src/libimcv/plugins/imc_swima/imc_swima.c
@@ -0,0 +1,407 @@
+/*
+ * Copyright (C) 2017 Andreas Steffen
+ * HSR Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "imc_swima_state.h"
+
+#include <imc/imc_agent.h>
+#include <imc/imc_msg.h>
+#include "ietf/swima/ietf_swima_attr_req.h"
+#include "ietf/swima/ietf_swima_attr_sw_inv.h"
+#include "ietf/swima/ietf_swima_attr_sw_ev.h"
+#include "swima/swima_inventory.h"
+#include "swima/swima_collector.h"
+#include "swima/swima_error.h"
+#include "tcg/seg/tcg_seg_attr_max_size.h"
+#include "tcg/seg/tcg_seg_attr_seg_env.h"
+
+#include <tncif_pa_subtypes.h>
+#include <pen/pen.h>
+#include <utils/debug.h>
+
+/* IMC definitions */
+
+static const char imc_name[] = "SWIMA";
+
+static pen_type_t msg_types[] = {
+	{ PEN_IETF, PA_SUBTYPE_IETF_SW }
+};
+
+static imc_agent_t *imc_swima;
+
+/**
+ * see section 3.8.1 of TCG TNC IF-IMC Specification 1.3
+ */
+TNC_Result TNC_IMC_Initialize(TNC_IMCID imc_id,
+							  TNC_Version min_version,
+							  TNC_Version max_version,
+							  TNC_Version *actual_version)
+{
+	if (imc_swima)
+	{
+		DBG1(DBG_IMC, "IMC \"%s\" has already been initialized", imc_name);
+		return TNC_RESULT_ALREADY_INITIALIZED;
+	}
+	imc_swima = imc_agent_create(imc_name, msg_types, countof(msg_types),
+								 imc_id, actual_version);
+	if (!imc_swima)
+	{
+		return TNC_RESULT_FATAL;
+	}
+	if (min_version > TNC_IFIMC_VERSION_1 || max_version < TNC_IFIMC_VERSION_1)
+	{
+		DBG1(DBG_IMC, "no common IF-IMC version");
+		return TNC_RESULT_NO_COMMON_VERSION;
+	}
+	return TNC_RESULT_SUCCESS;
+}
+
+/**
+ * see section 3.8.2 of TCG TNC IF-IMC Specification 1.3
+ */
+TNC_Result TNC_IMC_NotifyConnectionChange(TNC_IMCID imc_id,
+										  TNC_ConnectionID connection_id,
+										  TNC_ConnectionState new_state)
+{
+	imc_state_t *state;
+
+	if (!imc_swima)
+	{
+		DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name);
+		return TNC_RESULT_NOT_INITIALIZED;
+	}
+	switch (new_state)
+	{
+		case TNC_CONNECTION_STATE_CREATE:
+			state = imc_swima_state_create(connection_id);
+			return imc_swima->create_state(imc_swima, state);
+		case TNC_CONNECTION_STATE_HANDSHAKE:
+			if (imc_swima->change_state(imc_swima, connection_id, new_state,
+				&state) != TNC_RESULT_SUCCESS)
+			{
+				return TNC_RESULT_FATAL;
+			}
+			state->set_result(state, imc_id,
+							  TNC_IMV_EVALUATION_RESULT_DONT_KNOW);
+			return TNC_RESULT_SUCCESS;
+		case TNC_CONNECTION_STATE_DELETE:
+			return imc_swima->delete_state(imc_swima, connection_id);
+		default:
+			return imc_swima->change_state(imc_swima, connection_id,
+										   new_state, NULL);
+	}
+}
+
+/**
+ * see section 3.8.3 of TCG TNC IF-IMC Specification 1.3
+ */
+TNC_Result TNC_IMC_BeginHandshake(TNC_IMCID imc_id,
+								  TNC_ConnectionID connection_id)
+{
+	imc_state_t *state;
+	imc_msg_t *out_msg;
+	pa_tnc_attr_t *attr;
+	seg_contract_t *contract;
+	seg_contract_manager_t *contracts;
+	size_t max_attr_size = SWIMA_MAX_ATTR_SIZE;
+	size_t max_seg_size;
+	char buf[BUF_LEN];
+	TNC_Result result = TNC_RESULT_SUCCESS;
+
+	if (!imc_swima)
+	{
+		DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name);
+		return TNC_RESULT_NOT_INITIALIZED;
+	}
+	if (!imc_swima->get_state(imc_swima, connection_id, &state))
+	{
+		return TNC_RESULT_FATAL;
+	}
+
+	/* Determine maximum PA-TNC attribute segment size */
+	max_seg_size = state->get_max_msg_len(state) - PA_TNC_HEADER_SIZE
+												 - PA_TNC_ATTR_HEADER_SIZE
+												 - TCG_SEG_ATTR_SEG_ENV_HEADER;
+
+	/* Announce support of PA-TNC segmentation to IMV */
+	contract = seg_contract_create(msg_types[0], max_attr_size, max_seg_size,
+								   TRUE, imc_id, TRUE);
+	contract->get_info_string(contract, buf, BUF_LEN, TRUE);
+	DBG2(DBG_IMC, "%s", buf);
+	contracts = state->get_contracts(state);
+	contracts->add_contract(contracts, contract);
+	attr = tcg_seg_attr_max_size_create(max_attr_size, max_seg_size, TRUE);
+
+	/* send PA-TNC message with the excl flag not set */
+	out_msg = imc_msg_create(imc_swima, state, connection_id, imc_id,
+							 TNC_IMVID_ANY, msg_types[0]);
+	out_msg->add_attribute(out_msg, attr);
+	result = out_msg->send(out_msg, FALSE);
+	out_msg->destroy(out_msg);
+
+	return result;
+}
+
+/**
+ * Add SWID Inventory or Event attribute to the send queue
+ */
+static void fulfill_request(imc_state_t *state, imc_msg_t *msg,
+							uint32_t request_id, bool sw_id_only,
+							swima_inventory_t *targets)
+{
+	pa_tnc_attr_t *attr;
+	swima_collector_t  *collector;
+	size_t msg_len = 64;
+	char error_msg[msg_len], *id_str;
+	bool collect_inventory = TRUE;
+	int items;
+
+	collector = swima_collector_create();
+	id_str = sw_id_only ? " ID" : "";
+
+	if (targets->get_eid(targets, NULL) > 0)
+	{
+		swima_events_t *sw_ev;
+		ietf_swima_attr_sw_ev_t *sw_ev_attr;
+
+		sw_ev = collector->collect_events(collector, sw_id_only, targets);
+		if (!sw_ev)
+		{
+			snprintf(error_msg, msg_len, "failed to collect SW%s events, "
+					 "fallback to SW%s inventory", id_str, id_str);
+			attr = swima_error_create(PA_ERROR_SW, request_id, 0, error_msg);
+			msg->add_attribute(msg, attr);
+		}
+		else {
+			items = sw_ev->get_count(sw_ev);
+			DBG1(DBG_IMC, "collected %d SW%s event%s", items, id_str,
+													   items == 1 ? "" : "s");
+
+			/* Send an IETF SW [Identity] Events attribute */
+			attr = ietf_swima_attr_sw_ev_create(IETF_SWIMA_ATTR_SW_INV_FLAG_NONE,
+											 request_id, sw_id_only);
+			sw_ev_attr = (ietf_swima_attr_sw_ev_t*)attr;
+			sw_ev_attr->set_events(sw_ev_attr, sw_ev);
+			collect_inventory = FALSE;
+		}
+	}
+
+	if (collect_inventory)
+	{
+		swima_inventory_t *sw_inv;
+		ietf_swima_attr_sw_inv_t *sw_inv_attr;
+
+		sw_inv = collector->collect_inventory(collector, sw_id_only, targets);
+		if (!sw_inv)
+		{
+			snprintf(error_msg, msg_len, "failed to collect SW%s inventory",
+					 id_str);
+			attr = swima_error_create(PA_ERROR_SW, request_id, 0, error_msg);
+		}
+		else
+		{
+			items = sw_inv->get_count(sw_inv);
+			DBG1(DBG_IMC, "collected %d SW%s record%s", items, id_str,
+														items == 1 ? "" : "s");
+
+			/* Send an IETF SW [Identity] Inventory attribute */
+			attr = ietf_swima_attr_sw_inv_create(IETF_SWIMA_ATTR_SW_INV_FLAG_NONE,
+												 request_id, sw_id_only);
+			sw_inv_attr = (ietf_swima_attr_sw_inv_t*)attr;
+			sw_inv_attr->set_inventory(sw_inv_attr, sw_inv);
+		}
+	}
+	msg->add_attribute(msg, attr);
+	collector->destroy(collector);
+}
+
+static TNC_Result receive_message(imc_state_t *state, imc_msg_t *in_msg)
+{
+	imc_msg_t *out_msg;
+	pa_tnc_attr_t *attr;
+	enumerator_t *enumerator;
+	pen_type_t type;
+	TNC_Result result;
+	bool fatal_error = FALSE;
+
+	/* generate an outgoing PA-TNC message - we might need it */
+	out_msg = imc_msg_create_as_reply(in_msg);
+
+	/* parse received PA-TNC message and handle local and remote errors */
+	result = in_msg->receive(in_msg, out_msg, &fatal_error);
+	if (result != TNC_RESULT_SUCCESS)
+	{
+		out_msg->destroy(out_msg);
+		return result;
+	}
+
+	/* analyze PA-TNC attributes */
+	enumerator = in_msg->create_attribute_enumerator(in_msg);
+	while (enumerator->enumerate(enumerator, &attr))
+	{
+		ietf_swima_attr_req_t *attr_req;
+		uint8_t flags;
+		uint32_t request_id;
+		bool sw_id_only;
+		swima_inventory_t *targets;
+
+		type = attr->get_type(attr);
+
+		if (type.vendor_id != PEN_IETF || type.type != IETF_ATTR_SW_REQUEST)
+		{
+			continue;
+		}
+
+		attr_req = (ietf_swima_attr_req_t*)attr;
+		flags = attr_req->get_flags(attr_req);
+		request_id = attr_req->get_request_id(attr_req);
+		targets = attr_req->get_targets(attr_req);
+
+		if (flags & (IETF_SWIMA_ATTR_REQ_FLAG_S | IETF_SWIMA_ATTR_REQ_FLAG_C))
+		{
+			attr = swima_error_create(PA_ERROR_SW_SUBSCRIPTION_DENIED,
+						request_id, 0, "no subscription available yet");
+			out_msg->add_attribute(out_msg, attr);
+			break;
+		}
+		sw_id_only = (flags & IETF_SWIMA_ATTR_REQ_FLAG_R);
+
+		fulfill_request(state, out_msg, request_id, sw_id_only, targets);
+		break;
+	}
+	enumerator->destroy(enumerator);
+
+	if (fatal_error)
+	{
+		result = TNC_RESULT_FATAL;
+	}
+	else
+	{
+		/* send PA-TNC message with the EXCL flag set */
+		result = out_msg->send(out_msg, TRUE);
+	}
+	out_msg->destroy(out_msg);
+
+	return result;
+}
+
+/**
+ * see section 3.8.4 of TCG TNC IF-IMC Specification 1.3
+
+ */
+TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
+								  TNC_ConnectionID connection_id,
+								  TNC_BufferReference msg,
+								  TNC_UInt32 msg_len,
+								  TNC_MessageType msg_type)
+{
+	imc_state_t *state;
+	imc_msg_t *in_msg;
+	TNC_Result result;
+
+	if (!imc_swima)
+	{
+		DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name);
+		return TNC_RESULT_NOT_INITIALIZED;
+	}
+	if (!imc_swima->get_state(imc_swima, connection_id, &state))
+	{
+		return TNC_RESULT_FATAL;
+	}
+	in_msg = imc_msg_create_from_data(imc_swima, state, connection_id, msg_type,
+									  chunk_create(msg, msg_len));
+	result = receive_message(state, in_msg);
+	in_msg->destroy(in_msg);
+
+	return result;
+}
+
+/**
+ * see section 3.8.6 of TCG TNC IF-IMV Specification 1.3
+ */
+TNC_Result TNC_IMC_ReceiveMessageLong(TNC_IMCID imc_id,
+									  TNC_ConnectionID connection_id,
+									  TNC_UInt32 msg_flags,
+									  TNC_BufferReference msg,
+									  TNC_UInt32 msg_len,
+									  TNC_VendorID msg_vid,
+									  TNC_MessageSubtype msg_subtype,
+									  TNC_UInt32 src_imv_id,
+									  TNC_UInt32 dst_imc_id)
+{
+	imc_state_t *state;
+	imc_msg_t *in_msg;
+	TNC_Result result;
+
+	if (!imc_swima)
+	{
+		DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name);
+		return TNC_RESULT_NOT_INITIALIZED;
+	}
+	if (!imc_swima->get_state(imc_swima, connection_id, &state))
+	{
+		return TNC_RESULT_FATAL;
+	}
+	in_msg = imc_msg_create_from_long_data(imc_swima, state, connection_id,
+								src_imv_id, dst_imc_id,msg_vid, msg_subtype,
+								chunk_create(msg, msg_len));
+	result =receive_message(state, in_msg);
+	in_msg->destroy(in_msg);
+
+	return result;
+}
+
+/**
+ * see section 3.8.7 of TCG TNC IF-IMC Specification 1.3
+ */
+TNC_Result TNC_IMC_BatchEnding(TNC_IMCID imc_id,
+							   TNC_ConnectionID connection_id)
+{
+	if (!imc_swima)
+	{
+		DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name);
+		return TNC_RESULT_NOT_INITIALIZED;
+	}
+	return TNC_RESULT_SUCCESS;
+}
+
+/**
+ * see section 3.8.8 of TCG TNC IF-IMC Specification 1.3
+ */
+TNC_Result TNC_IMC_Terminate(TNC_IMCID imc_id)
+{
+	if (!imc_swima)
+	{
+		DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name);
+		return TNC_RESULT_NOT_INITIALIZED;
+	}
+	imc_swima->destroy(imc_swima);
+	imc_swima = NULL;
+
+	return TNC_RESULT_SUCCESS;
+}
+
+/**
+ * see section 4.2.8.1 of TCG TNC IF-IMC Specification 1.3
+ */
+TNC_Result TNC_IMC_ProvideBindFunction(TNC_IMCID imc_id,
+									   TNC_TNCC_BindFunctionPointer bind_function)
+{
+	if (!imc_swima)
+	{
+		DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name);
+		return TNC_RESULT_NOT_INITIALIZED;
+	}
+	return imc_swima->bind_functions(imc_swima, bind_function);
+}
diff --git a/src/libimcv/plugins/imc_swima/imc_swima_state.c b/src/libimcv/plugins/imc_swima/imc_swima_state.c
new file mode 100644
index 000000000..70b2434a4
--- /dev/null
+++ b/src/libimcv/plugins/imc_swima/imc_swima_state.c
@@ -0,0 +1,176 @@
+/*
+ * Copyright (C) 2017 Andreas Steffen
+ * HSR Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "imc_swima_state.h"
+
+#include <tncif_names.h>
+
+#include <utils/debug.h>
+
+typedef struct private_imc_swima_state_t private_imc_swima_state_t;
+
+/**
+ * Private data of an imc_swima_state_t object.
+ */
+struct private_imc_swima_state_t {
+
+	/**
+	 * Public members of imc_swima_state_t
+	 */
+	imc_swima_state_t public;
+
+	/**
+	 * TNCCS connection ID
+	 */
+	TNC_ConnectionID connection_id;
+
+	/**
+	 * TNCCS connection state
+	 */
+	TNC_ConnectionState state;
+
+	/**
+	 * Assessment/Evaluation Result
+	 */
+	TNC_IMV_Evaluation_Result result;
+
+	/**
+	 * Does the TNCCS connection support long message types?
+	 */
+	bool has_long;
+
+	/**
+	 * Does the TNCCS connection support exclusive delivery?
+	 */
+	bool has_excl;
+
+	/**
+	 * Maximum PA-TNC message size for this TNCCS connection
+	 */
+	uint32_t max_msg_len;
+
+	/**
+	 * PA-TNC attribute segmentation contracts associated with TNCCS connection
+	 */
+	seg_contract_manager_t *contracts;
+};
+
+METHOD(imc_state_t, get_connection_id, TNC_ConnectionID,
+	private_imc_swima_state_t *this)
+{
+	return this->connection_id;
+}
+
+METHOD(imc_state_t, has_long, bool,
+	private_imc_swima_state_t *this)
+{
+	return this->has_long;
+}
+
+METHOD(imc_state_t, has_excl, bool,
+	private_imc_swima_state_t *this)
+{
+	return this->has_excl;
+}
+
+METHOD(imc_state_t, set_flags, void,
+	private_imc_swima_state_t *this, bool has_long, bool has_excl)
+{
+	this->has_long = has_long;
+	this->has_excl = has_excl;
+}
+
+METHOD(imc_state_t, set_max_msg_len, void,
+	private_imc_swima_state_t *this, uint32_t max_msg_len)
+{
+	this->max_msg_len = max_msg_len;
+}
+
+METHOD(imc_state_t, get_max_msg_len, uint32_t,
+	private_imc_swima_state_t *this)
+{
+	return this->max_msg_len;
+}
+
+METHOD(imc_state_t, get_contracts, seg_contract_manager_t*,
+	private_imc_swima_state_t *this)
+{
+	return this->contracts;
+}
+
+METHOD(imc_state_t, change_state, void,
+	private_imc_swima_state_t *this, TNC_ConnectionState new_state)
+{
+	this->state = new_state;
+}
+
+METHOD(imc_state_t, set_result, void,
+	private_imc_swima_state_t *this, TNC_IMCID id,
+	TNC_IMV_Evaluation_Result result)
+{
+	this->result = result;
+}
+
+METHOD(imc_state_t, get_result, bool,
+	private_imc_swima_state_t *this, TNC_IMCID id,
+	TNC_IMV_Evaluation_Result *result)
+{
+	if (result)
+	{
+		*result = this->result;
+	}
+	return this->result != TNC_IMV_EVALUATION_RESULT_DONT_KNOW;
+}
+
+METHOD(imc_state_t, destroy, void,
+	private_imc_swima_state_t *this)
+{
+	this->contracts->destroy(this->contracts);
+	free(this);
+}
+
+/**
+ * Described in header.
+ */
+imc_state_t *imc_swima_state_create(TNC_ConnectionID connection_id)
+{
+	private_imc_swima_state_t *this;
+
+	INIT(this,
+		.public = {
+			.interface = {
+				.get_connection_id = _get_connection_id,
+				.has_long = _has_long,
+				.has_excl = _has_excl,
+				.set_flags = _set_flags,
+				.set_max_msg_len = _set_max_msg_len,
+				.get_max_msg_len = _get_max_msg_len,
+				.get_contracts = _get_contracts,
+				.change_state = _change_state,
+				.set_result = _set_result,
+				.get_result = _get_result,
+				.destroy = _destroy,
+			},
+		},
+		.state = TNC_CONNECTION_STATE_CREATE,
+		.result = TNC_IMV_EVALUATION_RESULT_DONT_KNOW,
+		.connection_id = connection_id,
+		.contracts = seg_contract_manager_create(),
+	);
+	
+	return &this->public.interface;
+}
+
+
diff --git a/src/libimcv/plugins/imc_swima/imc_swima_state.h b/src/libimcv/plugins/imc_swima/imc_swima_state.h
new file mode 100644
index 000000000..4e4e3b1bf
--- /dev/null
+++ b/src/libimcv/plugins/imc_swima/imc_swima_state.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2017 Andreas Steffen
+ * HSR Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup imc_swima imc_swima
+ * @ingroup libimcv_plugins
+ *
+ * @defgroup imc_swima_state_t imc_swima_state
+ * @{ @ingroup imc_swima
+ */
+
+#ifndef IMC_SWIMA_STATE_H_
+#define IMC_SWIMA_STATE_H_
+
+#include <imc/imc_state.h>
+#include <library.h>
+
+typedef struct imc_swima_state_t imc_swima_state_t;
+
+/**
+ * Internal state of an imc_swima_t connection instance
+ */
+struct imc_swima_state_t {
+
+	/**
+	 * imc_state_t interface
+	 */
+	imc_state_t interface;
+
+};
+
+/**
+ * Create an imc_swima_state_t instance
+ *
+ * @param id		connection ID
+ */
+imc_state_t* imc_swima_state_create(TNC_ConnectionID id);
+
+#endif /** IMC_SWIMA_STATE_H_ @}*/
diff --git a/src/libimcv/plugins/imc_swima/strongswan.org_strongSwan.swidtag.in b/src/libimcv/plugins/imc_swima/strongswan.org_strongSwan.swidtag.in
new file mode 100644
index 000000000..4935feab5
--- /dev/null
+++ b/src/libimcv/plugins/imc_swima/strongswan.org_strongSwan.swidtag.in
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<SoftwareIdentity
+  name="strongSwan"
+  tagId="strongSwan-@VERSION_MAJOR@-@VERSION_MINOR@-@VERSION_BUILD@@VERSION_REVIEW@"
+  version="@VERSION_MAJOR@.@VERSION_MINOR@.@VERSION_BUILD@@VERSION_REVIEW@" versionScheme="alphanumeric"
+  xmlns="http://standards.iso.org/iso/19770/-2/2015/schema.xsd">
+  <Entity
+    name="strongSwan Project"
+    regid="strongswan.org"
+    role="softwareCreator licensor tagCreator"/>
+</SoftwareIdentity>