1 /* 2 * EAP-TNC - TNCS (IF-IMV, IF-TNCCS, and IF-TNCCS-SOH) 3 * Copyright (c) 2007-2008, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 #include <dlfcn.h> 11 12 #include "common.h" 13 #include "base64.h" 14 #include "common/tnc.h" 15 #include "tncs.h" 16 #include "eap_common/eap_tlv_common.h" 17 #include "eap_common/eap_defs.h" 18 19 20 /* TODO: TNCS must be thread-safe; review the code and add locking etc. if 21 * needed.. */ 22 23 #ifndef TNC_CONFIG_FILE 24 #define TNC_CONFIG_FILE "/etc/tnc_config" 25 #endif /* TNC_CONFIG_FILE */ 26 #define IF_TNCCS_START \ 27 "<?xml version=\"1.0\"?>\n" \ 28 "<TNCCS-Batch BatchId=\"%d\" Recipient=\"TNCS\" " \ 29 "xmlns=\"http://www.trustedcomputinggroup.org/IWG/TNC/1_0/IF_TNCCS#\" " \ 30 "xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" " \ 31 "xsi:schemaLocation=\"http://www.trustedcomputinggroup.org/IWG/TNC/1_0/" \ 32 "IF_TNCCS# https://www.trustedcomputinggroup.org/XML/SCHEMA/TNCCS_1.0.xsd\">\n" 33 #define IF_TNCCS_END "\n</TNCCS-Batch>" 34 35 /* TNC IF-IMV */ 36 37 struct tnc_if_imv { 38 struct tnc_if_imv *next; 39 char *name; 40 char *path; 41 void *dlhandle; /* from dlopen() */ 42 TNC_IMVID imvID; 43 TNC_MessageTypeList supported_types; 44 size_t num_supported_types; 45 46 /* Functions implemented by IMVs (with TNC_IMV_ prefix) */ 47 TNC_Result (*Initialize)( 48 TNC_IMVID imvID, 49 TNC_Version minVersion, 50 TNC_Version maxVersion, 51 TNC_Version *pOutActualVersion); 52 TNC_Result (*NotifyConnectionChange)( 53 TNC_IMVID imvID, 54 TNC_ConnectionID connectionID, 55 TNC_ConnectionState newState); 56 TNC_Result (*ReceiveMessage)( 57 TNC_IMVID imvID, 58 TNC_ConnectionID connectionID, 59 TNC_BufferReference message, 60 TNC_UInt32 messageLength, 61 TNC_MessageType messageType); 62 TNC_Result (*SolicitRecommendation)( 63 TNC_IMVID imvID, 64 TNC_ConnectionID connectionID); 65 TNC_Result (*BatchEnding)( 66 TNC_IMVID imvID, 67 TNC_ConnectionID connectionID); 68 TNC_Result (*Terminate)(TNC_IMVID imvID); 69 TNC_Result (*ProvideBindFunction)( 70 TNC_IMVID imvID, 71 TNC_TNCS_BindFunctionPointer bindFunction); 72 }; 73 74 75 #define TNC_MAX_IMV_ID 10 76 77 struct tncs_data { 78 struct tncs_data *next; 79 struct tnc_if_imv *imv; /* local copy of tncs_global_data->imv */ 80 TNC_ConnectionID connectionID; 81 unsigned int last_batchid; 82 enum IMV_Action_Recommendation recommendation; 83 int done; 84 85 struct conn_imv { 86 u8 *imv_send; 87 size_t imv_send_len; 88 enum IMV_Action_Recommendation recommendation; 89 int recommendation_set; 90 } imv_data[TNC_MAX_IMV_ID]; 91 92 char *tncs_message; 93 }; 94 95 96 struct tncs_global { 97 struct tnc_if_imv *imv; 98 TNC_ConnectionID next_conn_id; 99 struct tncs_data *connections; 100 }; 101 102 static struct tncs_global *tncs_global_data = NULL; 103 104 tncs_get_imv(TNC_IMVID imvID)105 static struct tnc_if_imv * tncs_get_imv(TNC_IMVID imvID) 106 { 107 struct tnc_if_imv *imv; 108 109 if (imvID >= TNC_MAX_IMV_ID || tncs_global_data == NULL) 110 return NULL; 111 imv = tncs_global_data->imv; 112 while (imv) { 113 if (imv->imvID == imvID) 114 return imv; 115 imv = imv->next; 116 } 117 return NULL; 118 } 119 120 tncs_get_conn(TNC_ConnectionID connectionID)121 static struct tncs_data * tncs_get_conn(TNC_ConnectionID connectionID) 122 { 123 struct tncs_data *tncs; 124 125 if (tncs_global_data == NULL) 126 return NULL; 127 128 tncs = tncs_global_data->connections; 129 while (tncs) { 130 if (tncs->connectionID == connectionID) 131 return tncs; 132 tncs = tncs->next; 133 } 134 135 wpa_printf(MSG_DEBUG, "TNC: Connection ID %lu not found", 136 (unsigned long) connectionID); 137 138 return NULL; 139 } 140 141 142 /* TNCS functions that IMVs can call */ TNC_TNCS_ReportMessageTypes(TNC_IMVID imvID,TNC_MessageTypeList supportedTypes,TNC_UInt32 typeCount)143 static TNC_Result TNC_TNCS_ReportMessageTypes( 144 TNC_IMVID imvID, 145 TNC_MessageTypeList supportedTypes, 146 TNC_UInt32 typeCount) 147 { 148 TNC_UInt32 i; 149 struct tnc_if_imv *imv; 150 151 wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_ReportMessageTypes(imvID=%lu " 152 "typeCount=%lu)", 153 (unsigned long) imvID, (unsigned long) typeCount); 154 155 for (i = 0; i < typeCount; i++) { 156 wpa_printf(MSG_DEBUG, "TNC: supportedTypes[%lu] = %lu", 157 i, supportedTypes[i]); 158 } 159 160 imv = tncs_get_imv(imvID); 161 if (imv == NULL) 162 return TNC_RESULT_INVALID_PARAMETER; 163 os_free(imv->supported_types); 164 imv->supported_types = os_memdup(supportedTypes, 165 typeCount * sizeof(TNC_MessageType)); 166 if (imv->supported_types == NULL) 167 return TNC_RESULT_FATAL; 168 imv->num_supported_types = typeCount; 169 170 return TNC_RESULT_SUCCESS; 171 } 172 173 TNC_TNCS_SendMessage(TNC_IMVID imvID,TNC_ConnectionID connectionID,TNC_BufferReference message,TNC_UInt32 messageLength,TNC_MessageType messageType)174 static TNC_Result TNC_TNCS_SendMessage( 175 TNC_IMVID imvID, 176 TNC_ConnectionID connectionID, 177 TNC_BufferReference message, 178 TNC_UInt32 messageLength, 179 TNC_MessageType messageType) 180 { 181 struct tncs_data *tncs; 182 char *b64; 183 size_t b64len; 184 185 wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_SendMessage(imvID=%lu " 186 "connectionID=%lu messageType=%lu)", 187 imvID, connectionID, messageType); 188 wpa_hexdump_ascii(MSG_DEBUG, "TNC: TNC_TNCS_SendMessage", 189 message, messageLength); 190 191 if (tncs_get_imv(imvID) == NULL) 192 return TNC_RESULT_INVALID_PARAMETER; 193 194 tncs = tncs_get_conn(connectionID); 195 if (tncs == NULL) 196 return TNC_RESULT_INVALID_PARAMETER; 197 198 b64 = base64_encode(message, messageLength, &b64len); 199 if (b64 == NULL) 200 return TNC_RESULT_FATAL; 201 202 os_free(tncs->imv_data[imvID].imv_send); 203 tncs->imv_data[imvID].imv_send_len = 0; 204 tncs->imv_data[imvID].imv_send = os_zalloc(b64len + 100); 205 if (tncs->imv_data[imvID].imv_send == NULL) { 206 os_free(b64); 207 return TNC_RESULT_OTHER; 208 } 209 210 tncs->imv_data[imvID].imv_send_len = 211 os_snprintf((char *) tncs->imv_data[imvID].imv_send, 212 b64len + 100, 213 "<IMC-IMV-Message><Type>%08X</Type>" 214 "<Base64>%s</Base64></IMC-IMV-Message>", 215 (unsigned int) messageType, b64); 216 217 os_free(b64); 218 219 return TNC_RESULT_SUCCESS; 220 } 221 222 TNC_TNCS_RequestHandshakeRetry(TNC_IMVID imvID,TNC_ConnectionID connectionID,TNC_RetryReason reason)223 static TNC_Result TNC_TNCS_RequestHandshakeRetry( 224 TNC_IMVID imvID, 225 TNC_ConnectionID connectionID, 226 TNC_RetryReason reason) 227 { 228 wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_RequestHandshakeRetry"); 229 /* TODO */ 230 return TNC_RESULT_SUCCESS; 231 } 232 233 TNC_TNCS_ProvideRecommendation(TNC_IMVID imvID,TNC_ConnectionID connectionID,TNC_IMV_Action_Recommendation recommendation,TNC_IMV_Evaluation_Result evaluation)234 static TNC_Result TNC_TNCS_ProvideRecommendation( 235 TNC_IMVID imvID, 236 TNC_ConnectionID connectionID, 237 TNC_IMV_Action_Recommendation recommendation, 238 TNC_IMV_Evaluation_Result evaluation) 239 { 240 struct tncs_data *tncs; 241 242 wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_ProvideRecommendation(imvID=%lu " 243 "connectionID=%lu recommendation=%lu evaluation=%lu)", 244 (unsigned long) imvID, (unsigned long) connectionID, 245 (unsigned long) recommendation, (unsigned long) evaluation); 246 247 if (tncs_get_imv(imvID) == NULL) 248 return TNC_RESULT_INVALID_PARAMETER; 249 250 tncs = tncs_get_conn(connectionID); 251 if (tncs == NULL) 252 return TNC_RESULT_INVALID_PARAMETER; 253 254 tncs->imv_data[imvID].recommendation = recommendation; 255 tncs->imv_data[imvID].recommendation_set = 1; 256 257 return TNC_RESULT_SUCCESS; 258 } 259 260 TNC_TNCS_GetAttribute(TNC_IMVID imvID,TNC_ConnectionID connectionID,TNC_AttributeID attribureID,TNC_UInt32 bufferLength,TNC_BufferReference buffer,TNC_UInt32 * pOutValueLength)261 static TNC_Result TNC_TNCS_GetAttribute( 262 TNC_IMVID imvID, 263 TNC_ConnectionID connectionID, 264 TNC_AttributeID attribureID, 265 TNC_UInt32 bufferLength, 266 TNC_BufferReference buffer, 267 TNC_UInt32 *pOutValueLength) 268 { 269 wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_GetAttribute"); 270 /* TODO */ 271 return TNC_RESULT_SUCCESS; 272 } 273 274 TNC_TNCS_SetAttribute(TNC_IMVID imvID,TNC_ConnectionID connectionID,TNC_AttributeID attribureID,TNC_UInt32 bufferLength,TNC_BufferReference buffer)275 static TNC_Result TNC_TNCS_SetAttribute( 276 TNC_IMVID imvID, 277 TNC_ConnectionID connectionID, 278 TNC_AttributeID attribureID, 279 TNC_UInt32 bufferLength, 280 TNC_BufferReference buffer) 281 { 282 wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_SetAttribute"); 283 /* TODO */ 284 return TNC_RESULT_SUCCESS; 285 } 286 287 TNC_TNCS_BindFunction(TNC_IMVID imvID,char * functionName,void ** pOutFunctionPointer)288 static TNC_Result TNC_TNCS_BindFunction( 289 TNC_IMVID imvID, 290 char *functionName, 291 void **pOutFunctionPointer) 292 { 293 wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_BindFunction(imcID=%lu, " 294 "functionName='%s')", (unsigned long) imvID, functionName); 295 296 if (tncs_get_imv(imvID) == NULL) 297 return TNC_RESULT_INVALID_PARAMETER; 298 299 if (pOutFunctionPointer == NULL) 300 return TNC_RESULT_INVALID_PARAMETER; 301 302 if (os_strcmp(functionName, "TNC_TNCS_ReportMessageTypes") == 0) 303 *pOutFunctionPointer = TNC_TNCS_ReportMessageTypes; 304 else if (os_strcmp(functionName, "TNC_TNCS_SendMessage") == 0) 305 *pOutFunctionPointer = TNC_TNCS_SendMessage; 306 else if (os_strcmp(functionName, "TNC_TNCS_RequestHandshakeRetry") == 307 0) 308 *pOutFunctionPointer = TNC_TNCS_RequestHandshakeRetry; 309 else if (os_strcmp(functionName, "TNC_TNCS_ProvideRecommendation") == 310 0) 311 *pOutFunctionPointer = TNC_TNCS_ProvideRecommendation; 312 else if (os_strcmp(functionName, "TNC_TNCS_GetAttribute") == 0) 313 *pOutFunctionPointer = TNC_TNCS_GetAttribute; 314 else if (os_strcmp(functionName, "TNC_TNCS_SetAttribute") == 0) 315 *pOutFunctionPointer = TNC_TNCS_SetAttribute; 316 else 317 *pOutFunctionPointer = NULL; 318 319 return TNC_RESULT_SUCCESS; 320 } 321 322 tncs_get_sym(void * handle,char * func)323 static void * tncs_get_sym(void *handle, char *func) 324 { 325 void *fptr; 326 327 fptr = dlsym(handle, func); 328 329 return fptr; 330 } 331 332 tncs_imv_resolve_funcs(struct tnc_if_imv * imv)333 static int tncs_imv_resolve_funcs(struct tnc_if_imv *imv) 334 { 335 void *handle = imv->dlhandle; 336 337 /* Mandatory IMV functions */ 338 imv->Initialize = tncs_get_sym(handle, "TNC_IMV_Initialize"); 339 if (imv->Initialize == NULL) { 340 wpa_printf(MSG_ERROR, "TNC: IMV does not export " 341 "TNC_IMV_Initialize"); 342 return -1; 343 } 344 345 imv->SolicitRecommendation = tncs_get_sym( 346 handle, "TNC_IMV_SolicitRecommendation"); 347 if (imv->SolicitRecommendation == NULL) { 348 wpa_printf(MSG_ERROR, "TNC: IMV does not export " 349 "TNC_IMV_SolicitRecommendation"); 350 return -1; 351 } 352 353 imv->ProvideBindFunction = 354 tncs_get_sym(handle, "TNC_IMV_ProvideBindFunction"); 355 if (imv->ProvideBindFunction == NULL) { 356 wpa_printf(MSG_ERROR, "TNC: IMV does not export " 357 "TNC_IMV_ProvideBindFunction"); 358 return -1; 359 } 360 361 /* Optional IMV functions */ 362 imv->NotifyConnectionChange = 363 tncs_get_sym(handle, "TNC_IMV_NotifyConnectionChange"); 364 imv->ReceiveMessage = tncs_get_sym(handle, "TNC_IMV_ReceiveMessage"); 365 imv->BatchEnding = tncs_get_sym(handle, "TNC_IMV_BatchEnding"); 366 imv->Terminate = tncs_get_sym(handle, "TNC_IMV_Terminate"); 367 368 return 0; 369 } 370 371 tncs_imv_initialize(struct tnc_if_imv * imv)372 static int tncs_imv_initialize(struct tnc_if_imv *imv) 373 { 374 TNC_Result res; 375 TNC_Version imv_ver; 376 377 wpa_printf(MSG_DEBUG, "TNC: Calling TNC_IMV_Initialize for IMV '%s'", 378 imv->name); 379 res = imv->Initialize(imv->imvID, TNC_IFIMV_VERSION_1, 380 TNC_IFIMV_VERSION_1, &imv_ver); 381 wpa_printf(MSG_DEBUG, "TNC: TNC_IMV_Initialize: res=%lu imv_ver=%lu", 382 (unsigned long) res, (unsigned long) imv_ver); 383 384 return res == TNC_RESULT_SUCCESS ? 0 : -1; 385 } 386 387 tncs_imv_terminate(struct tnc_if_imv * imv)388 static int tncs_imv_terminate(struct tnc_if_imv *imv) 389 { 390 TNC_Result res; 391 392 if (imv->Terminate == NULL) 393 return 0; 394 395 wpa_printf(MSG_DEBUG, "TNC: Calling TNC_IMV_Terminate for IMV '%s'", 396 imv->name); 397 res = imv->Terminate(imv->imvID); 398 wpa_printf(MSG_DEBUG, "TNC: TNC_IMV_Terminate: %lu", 399 (unsigned long) res); 400 401 return res == TNC_RESULT_SUCCESS ? 0 : -1; 402 } 403 404 tncs_imv_provide_bind_function(struct tnc_if_imv * imv)405 static int tncs_imv_provide_bind_function(struct tnc_if_imv *imv) 406 { 407 TNC_Result res; 408 409 wpa_printf(MSG_DEBUG, "TNC: Calling TNC_IMV_ProvideBindFunction for " 410 "IMV '%s'", imv->name); 411 res = imv->ProvideBindFunction(imv->imvID, TNC_TNCS_BindFunction); 412 wpa_printf(MSG_DEBUG, "TNC: TNC_IMV_ProvideBindFunction: res=%lu", 413 (unsigned long) res); 414 415 return res == TNC_RESULT_SUCCESS ? 0 : -1; 416 } 417 418 tncs_imv_notify_connection_change(struct tnc_if_imv * imv,TNC_ConnectionID conn,TNC_ConnectionState state)419 static int tncs_imv_notify_connection_change(struct tnc_if_imv *imv, 420 TNC_ConnectionID conn, 421 TNC_ConnectionState state) 422 { 423 TNC_Result res; 424 425 if (imv->NotifyConnectionChange == NULL) 426 return 0; 427 428 wpa_printf(MSG_DEBUG, "TNC: Calling TNC_IMV_NotifyConnectionChange(%d)" 429 " for IMV '%s'", (int) state, imv->name); 430 res = imv->NotifyConnectionChange(imv->imvID, conn, state); 431 wpa_printf(MSG_DEBUG, "TNC: TNC_IMC_NotifyConnectionChange: %lu", 432 (unsigned long) res); 433 434 return res == TNC_RESULT_SUCCESS ? 0 : -1; 435 } 436 437 tncs_load_imv(struct tnc_if_imv * imv)438 static int tncs_load_imv(struct tnc_if_imv *imv) 439 { 440 if (imv->path == NULL) { 441 wpa_printf(MSG_DEBUG, "TNC: No IMV configured"); 442 return -1; 443 } 444 445 wpa_printf(MSG_DEBUG, "TNC: Opening IMV: %s (%s)", 446 imv->name, imv->path); 447 imv->dlhandle = dlopen(imv->path, RTLD_LAZY); 448 if (imv->dlhandle == NULL) { 449 wpa_printf(MSG_ERROR, "TNC: Failed to open IMV '%s' (%s): %s", 450 imv->name, imv->path, dlerror()); 451 return -1; 452 } 453 454 if (tncs_imv_resolve_funcs(imv) < 0) { 455 wpa_printf(MSG_ERROR, "TNC: Failed to resolve IMV functions"); 456 return -1; 457 } 458 459 if (tncs_imv_initialize(imv) < 0 || 460 tncs_imv_provide_bind_function(imv) < 0) { 461 wpa_printf(MSG_ERROR, "TNC: Failed to initialize IMV"); 462 return -1; 463 } 464 465 return 0; 466 } 467 468 tncs_free_imv(struct tnc_if_imv * imv)469 static void tncs_free_imv(struct tnc_if_imv *imv) 470 { 471 os_free(imv->name); 472 os_free(imv->path); 473 os_free(imv->supported_types); 474 } 475 tncs_unload_imv(struct tnc_if_imv * imv)476 static void tncs_unload_imv(struct tnc_if_imv *imv) 477 { 478 tncs_imv_terminate(imv); 479 480 if (imv->dlhandle) 481 dlclose(imv->dlhandle); 482 483 tncs_free_imv(imv); 484 } 485 486 tncs_supported_type(struct tnc_if_imv * imv,unsigned int type)487 static int tncs_supported_type(struct tnc_if_imv *imv, unsigned int type) 488 { 489 size_t i; 490 unsigned int vendor, subtype; 491 492 if (imv == NULL || imv->supported_types == NULL) 493 return 0; 494 495 vendor = type >> 8; 496 subtype = type & 0xff; 497 498 for (i = 0; i < imv->num_supported_types; i++) { 499 unsigned int svendor, ssubtype; 500 svendor = imv->supported_types[i] >> 8; 501 ssubtype = imv->supported_types[i] & 0xff; 502 if ((vendor == svendor || svendor == TNC_VENDORID_ANY) && 503 (subtype == ssubtype || ssubtype == TNC_SUBTYPE_ANY)) 504 return 1; 505 } 506 507 return 0; 508 } 509 510 tncs_send_to_imvs(struct tncs_data * tncs,unsigned int type,const u8 * msg,size_t len)511 static void tncs_send_to_imvs(struct tncs_data *tncs, unsigned int type, 512 const u8 *msg, size_t len) 513 { 514 struct tnc_if_imv *imv; 515 TNC_Result res; 516 517 wpa_hexdump_ascii(MSG_MSGDUMP, "TNC: Message to IMV(s)", msg, len); 518 519 for (imv = tncs->imv; imv; imv = imv->next) { 520 if (imv->ReceiveMessage == NULL || 521 !tncs_supported_type(imv, type)) 522 continue; 523 524 wpa_printf(MSG_DEBUG, "TNC: Call ReceiveMessage for IMV '%s'", 525 imv->name); 526 res = imv->ReceiveMessage(imv->imvID, tncs->connectionID, 527 (TNC_BufferReference) msg, len, 528 type); 529 wpa_printf(MSG_DEBUG, "TNC: ReceiveMessage: %lu", 530 (unsigned long) res); 531 } 532 } 533 534 tncs_batch_ending(struct tncs_data * tncs)535 static void tncs_batch_ending(struct tncs_data *tncs) 536 { 537 struct tnc_if_imv *imv; 538 TNC_Result res; 539 540 for (imv = tncs->imv; imv; imv = imv->next) { 541 if (imv->BatchEnding == NULL) 542 continue; 543 544 wpa_printf(MSG_DEBUG, "TNC: Call BatchEnding for IMV '%s'", 545 imv->name); 546 res = imv->BatchEnding(imv->imvID, tncs->connectionID); 547 wpa_printf(MSG_DEBUG, "TNC: BatchEnding: %lu", 548 (unsigned long) res); 549 } 550 } 551 552 tncs_solicit_recommendation(struct tncs_data * tncs)553 static void tncs_solicit_recommendation(struct tncs_data *tncs) 554 { 555 struct tnc_if_imv *imv; 556 TNC_Result res; 557 558 for (imv = tncs->imv; imv; imv = imv->next) { 559 if (tncs->imv_data[imv->imvID].recommendation_set) 560 continue; 561 562 wpa_printf(MSG_DEBUG, "TNC: Call SolicitRecommendation for " 563 "IMV '%s'", imv->name); 564 res = imv->SolicitRecommendation(imv->imvID, 565 tncs->connectionID); 566 wpa_printf(MSG_DEBUG, "TNC: SolicitRecommendation: %lu", 567 (unsigned long) res); 568 } 569 } 570 571 tncs_init_connection(struct tncs_data * tncs)572 void tncs_init_connection(struct tncs_data *tncs) 573 { 574 struct tnc_if_imv *imv; 575 int i; 576 577 for (imv = tncs->imv; imv; imv = imv->next) { 578 tncs_imv_notify_connection_change( 579 imv, tncs->connectionID, TNC_CONNECTION_STATE_CREATE); 580 tncs_imv_notify_connection_change( 581 imv, tncs->connectionID, 582 TNC_CONNECTION_STATE_HANDSHAKE); 583 } 584 585 for (i = 0; i < TNC_MAX_IMV_ID; i++) { 586 os_free(tncs->imv_data[i].imv_send); 587 tncs->imv_data[i].imv_send = NULL; 588 tncs->imv_data[i].imv_send_len = 0; 589 } 590 } 591 592 tncs_total_send_len(struct tncs_data * tncs)593 size_t tncs_total_send_len(struct tncs_data *tncs) 594 { 595 int i; 596 size_t len = 0; 597 598 for (i = 0; i < TNC_MAX_IMV_ID; i++) 599 len += tncs->imv_data[i].imv_send_len; 600 if (tncs->tncs_message) 601 len += os_strlen(tncs->tncs_message); 602 return len; 603 } 604 605 tncs_copy_send_buf(struct tncs_data * tncs,u8 * pos)606 u8 * tncs_copy_send_buf(struct tncs_data *tncs, u8 *pos) 607 { 608 int i; 609 610 for (i = 0; i < TNC_MAX_IMV_ID; i++) { 611 if (tncs->imv_data[i].imv_send == NULL) 612 continue; 613 614 os_memcpy(pos, tncs->imv_data[i].imv_send, 615 tncs->imv_data[i].imv_send_len); 616 pos += tncs->imv_data[i].imv_send_len; 617 os_free(tncs->imv_data[i].imv_send); 618 tncs->imv_data[i].imv_send = NULL; 619 tncs->imv_data[i].imv_send_len = 0; 620 } 621 622 if (tncs->tncs_message) { 623 size_t len = os_strlen(tncs->tncs_message); 624 os_memcpy(pos, tncs->tncs_message, len); 625 pos += len; 626 os_free(tncs->tncs_message); 627 tncs->tncs_message = NULL; 628 } 629 630 return pos; 631 } 632 633 tncs_if_tnccs_start(struct tncs_data * tncs)634 char * tncs_if_tnccs_start(struct tncs_data *tncs) 635 { 636 char *buf = os_malloc(1000); 637 if (buf == NULL) 638 return NULL; 639 tncs->last_batchid++; 640 os_snprintf(buf, 1000, IF_TNCCS_START, tncs->last_batchid); 641 return buf; 642 } 643 644 tncs_if_tnccs_end(void)645 char * tncs_if_tnccs_end(void) 646 { 647 char *buf = os_malloc(100); 648 if (buf == NULL) 649 return NULL; 650 os_snprintf(buf, 100, IF_TNCCS_END); 651 return buf; 652 } 653 654 tncs_get_type(char * start,unsigned int * type)655 static int tncs_get_type(char *start, unsigned int *type) 656 { 657 char *pos = os_strstr(start, "<Type>"); 658 if (pos == NULL) 659 return -1; 660 pos += 6; 661 *type = strtoul(pos, NULL, 16); 662 return 0; 663 } 664 665 tncs_get_base64(char * start,size_t * decoded_len)666 static unsigned char * tncs_get_base64(char *start, size_t *decoded_len) 667 { 668 char *pos, *pos2; 669 unsigned char *decoded; 670 671 pos = os_strstr(start, "<Base64>"); 672 if (pos == NULL) 673 return NULL; 674 675 pos += 8; 676 pos2 = os_strstr(pos, "</Base64>"); 677 if (pos2 == NULL) 678 return NULL; 679 *pos2 = '\0'; 680 681 decoded = base64_decode(pos, os_strlen(pos), decoded_len); 682 *pos2 = '<'; 683 if (decoded == NULL) { 684 wpa_printf(MSG_DEBUG, "TNC: Failed to decode Base64 data"); 685 } 686 687 return decoded; 688 } 689 690 tncs_derive_recommendation(struct tncs_data * tncs)691 static enum tncs_process_res tncs_derive_recommendation(struct tncs_data *tncs) 692 { 693 enum IMV_Action_Recommendation rec; 694 struct tnc_if_imv *imv; 695 TNC_ConnectionState state; 696 char *txt; 697 698 wpa_printf(MSG_DEBUG, "TNC: No more messages from IMVs"); 699 700 if (tncs->done) 701 return TNCCS_PROCESS_OK_NO_RECOMMENDATION; 702 703 tncs_solicit_recommendation(tncs); 704 705 /* Select the most restrictive recommendation */ 706 rec = TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION; 707 for (imv = tncs->imv; imv; imv = imv->next) { 708 TNC_IMV_Action_Recommendation irec; 709 irec = tncs->imv_data[imv->imvID].recommendation; 710 if (irec == TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS) 711 rec = TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS; 712 if (irec == TNC_IMV_ACTION_RECOMMENDATION_ISOLATE && 713 rec != TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS) 714 rec = TNC_IMV_ACTION_RECOMMENDATION_ISOLATE; 715 if (irec == TNC_IMV_ACTION_RECOMMENDATION_ALLOW && 716 rec == TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION) 717 rec = TNC_IMV_ACTION_RECOMMENDATION_ALLOW; 718 } 719 720 wpa_printf(MSG_DEBUG, "TNC: Recommendation: %d", rec); 721 tncs->recommendation = rec; 722 tncs->done = 1; 723 724 txt = NULL; 725 switch (rec) { 726 case TNC_IMV_ACTION_RECOMMENDATION_ALLOW: 727 case TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION: 728 txt = "allow"; 729 state = TNC_CONNECTION_STATE_ACCESS_ALLOWED; 730 break; 731 case TNC_IMV_ACTION_RECOMMENDATION_ISOLATE: 732 txt = "isolate"; 733 state = TNC_CONNECTION_STATE_ACCESS_ISOLATED; 734 break; 735 case TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS: 736 txt = "none"; 737 state = TNC_CONNECTION_STATE_ACCESS_NONE; 738 break; 739 default: 740 state = TNC_CONNECTION_STATE_ACCESS_ALLOWED; 741 break; 742 } 743 744 if (txt) { 745 os_free(tncs->tncs_message); 746 tncs->tncs_message = os_zalloc(200); 747 if (tncs->tncs_message) { 748 os_snprintf(tncs->tncs_message, 199, 749 "<TNCC-TNCS-Message><Type>%08X</Type>" 750 "<XML><TNCCS-Recommendation type=\"%s\">" 751 "</TNCCS-Recommendation></XML>" 752 "</TNCC-TNCS-Message>", 753 TNC_TNCCS_RECOMMENDATION, txt); 754 } 755 } 756 757 for (imv = tncs->imv; imv; imv = imv->next) { 758 tncs_imv_notify_connection_change(imv, tncs->connectionID, 759 state); 760 } 761 762 switch (rec) { 763 case TNC_IMV_ACTION_RECOMMENDATION_ALLOW: 764 return TNCCS_RECOMMENDATION_ALLOW; 765 case TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS: 766 return TNCCS_RECOMMENDATION_NO_ACCESS; 767 case TNC_IMV_ACTION_RECOMMENDATION_ISOLATE: 768 return TNCCS_RECOMMENDATION_ISOLATE; 769 case TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION: 770 return TNCCS_RECOMMENDATION_NO_RECOMMENDATION; 771 default: 772 return TNCCS_PROCESS_ERROR; 773 } 774 } 775 776 tncs_process_if_tnccs(struct tncs_data * tncs,const u8 * msg,size_t len)777 enum tncs_process_res tncs_process_if_tnccs(struct tncs_data *tncs, 778 const u8 *msg, size_t len) 779 { 780 char *buf, *start, *end, *pos, *pos2, *payload; 781 unsigned int batch_id; 782 unsigned char *decoded; 783 size_t decoded_len; 784 785 buf = dup_binstr(msg, len); 786 if (buf == NULL) 787 return TNCCS_PROCESS_ERROR; 788 789 start = os_strstr(buf, "<TNCCS-Batch "); 790 end = os_strstr(buf, "</TNCCS-Batch>"); 791 if (start == NULL || end == NULL || start > end) { 792 os_free(buf); 793 return TNCCS_PROCESS_ERROR; 794 } 795 796 start += 13; 797 while (*start == ' ') 798 start++; 799 *end = '\0'; 800 801 pos = os_strstr(start, "BatchId="); 802 if (pos == NULL) { 803 os_free(buf); 804 return TNCCS_PROCESS_ERROR; 805 } 806 807 pos += 8; 808 if (*pos == '"') 809 pos++; 810 batch_id = atoi(pos); 811 wpa_printf(MSG_DEBUG, "TNC: Received IF-TNCCS BatchId=%u", 812 batch_id); 813 if (batch_id != tncs->last_batchid + 1) { 814 wpa_printf(MSG_DEBUG, "TNC: Unexpected IF-TNCCS BatchId " 815 "%u (expected %u)", 816 batch_id, tncs->last_batchid + 1); 817 os_free(buf); 818 return TNCCS_PROCESS_ERROR; 819 } 820 tncs->last_batchid = batch_id; 821 822 while (*pos != '\0' && *pos != '>') 823 pos++; 824 if (*pos == '\0') { 825 os_free(buf); 826 return TNCCS_PROCESS_ERROR; 827 } 828 pos++; 829 payload = start; 830 831 /* 832 * <IMC-IMV-Message> 833 * <Type>01234567</Type> 834 * <Base64>foo==</Base64> 835 * </IMC-IMV-Message> 836 */ 837 838 while (*start) { 839 char *endpos; 840 unsigned int type; 841 842 pos = os_strstr(start, "<IMC-IMV-Message>"); 843 if (pos == NULL) 844 break; 845 start = pos + 17; 846 end = os_strstr(start, "</IMC-IMV-Message>"); 847 if (end == NULL) 848 break; 849 *end = '\0'; 850 endpos = end; 851 end += 18; 852 853 if (tncs_get_type(start, &type) < 0) { 854 *endpos = '<'; 855 start = end; 856 continue; 857 } 858 wpa_printf(MSG_DEBUG, "TNC: IMC-IMV-Message Type 0x%x", type); 859 860 decoded = tncs_get_base64(start, &decoded_len); 861 if (decoded == NULL) { 862 *endpos = '<'; 863 start = end; 864 continue; 865 } 866 867 tncs_send_to_imvs(tncs, type, decoded, decoded_len); 868 869 os_free(decoded); 870 871 start = end; 872 } 873 874 /* 875 * <TNCC-TNCS-Message> 876 * <Type>01234567</Type> 877 * <XML><TNCCS-Foo type="foo"></TNCCS-Foo></XML> 878 * <Base64>foo==</Base64> 879 * </TNCC-TNCS-Message> 880 */ 881 882 start = payload; 883 while (*start) { 884 unsigned int type; 885 char *xml, *xmlend, *endpos; 886 887 pos = os_strstr(start, "<TNCC-TNCS-Message>"); 888 if (pos == NULL) 889 break; 890 start = pos + 19; 891 end = os_strstr(start, "</TNCC-TNCS-Message>"); 892 if (end == NULL) 893 break; 894 *end = '\0'; 895 endpos = end; 896 end += 20; 897 898 if (tncs_get_type(start, &type) < 0) { 899 *endpos = '<'; 900 start = end; 901 continue; 902 } 903 wpa_printf(MSG_DEBUG, "TNC: TNCC-TNCS-Message Type 0x%x", 904 type); 905 906 /* Base64 OR XML */ 907 decoded = NULL; 908 xml = NULL; 909 xmlend = NULL; 910 pos = os_strstr(start, "<XML>"); 911 if (pos) { 912 pos += 5; 913 pos2 = os_strstr(pos, "</XML>"); 914 if (pos2 == NULL) { 915 *endpos = '<'; 916 start = end; 917 continue; 918 } 919 xmlend = pos2; 920 xml = pos; 921 } else { 922 decoded = tncs_get_base64(start, &decoded_len); 923 if (decoded == NULL) { 924 *endpos = '<'; 925 start = end; 926 continue; 927 } 928 } 929 930 if (decoded) { 931 wpa_hexdump_ascii(MSG_MSGDUMP, 932 "TNC: TNCC-TNCS-Message Base64", 933 decoded, decoded_len); 934 os_free(decoded); 935 } 936 937 if (xml) { 938 wpa_hexdump_ascii(MSG_MSGDUMP, 939 "TNC: TNCC-TNCS-Message XML", 940 (unsigned char *) xml, 941 xmlend - xml); 942 } 943 944 start = end; 945 } 946 947 os_free(buf); 948 949 tncs_batch_ending(tncs); 950 951 if (tncs_total_send_len(tncs) == 0) 952 return tncs_derive_recommendation(tncs); 953 954 return TNCCS_PROCESS_OK_NO_RECOMMENDATION; 955 } 956 957 tncs_parse_imv(int id,char * start,char * end,int * error)958 static struct tnc_if_imv * tncs_parse_imv(int id, char *start, char *end, 959 int *error) 960 { 961 struct tnc_if_imv *imv; 962 char *pos, *pos2; 963 964 if (id >= TNC_MAX_IMV_ID) { 965 wpa_printf(MSG_DEBUG, "TNC: Too many IMVs"); 966 return NULL; 967 } 968 969 imv = os_zalloc(sizeof(*imv)); 970 if (imv == NULL) { 971 *error = 1; 972 return NULL; 973 } 974 975 imv->imvID = id; 976 977 pos = start; 978 wpa_printf(MSG_DEBUG, "TNC: Configured IMV: %s", pos); 979 if (pos + 1 >= end || *pos != '"') { 980 wpa_printf(MSG_ERROR, "TNC: Ignoring invalid IMV line '%s' " 981 "(no starting quotation mark)", start); 982 os_free(imv); 983 return NULL; 984 } 985 986 pos++; 987 pos2 = pos; 988 while (pos2 < end && *pos2 != '"') 989 pos2++; 990 if (pos2 >= end) { 991 wpa_printf(MSG_ERROR, "TNC: Ignoring invalid IMV line '%s' " 992 "(no ending quotation mark)", start); 993 os_free(imv); 994 return NULL; 995 } 996 *pos2 = '\0'; 997 wpa_printf(MSG_DEBUG, "TNC: Name: '%s'", pos); 998 imv->name = os_strdup(pos); 999 1000 pos = pos2 + 1; 1001 if (pos >= end || *pos != ' ') { 1002 wpa_printf(MSG_ERROR, "TNC: Ignoring invalid IMV line '%s' " 1003 "(no space after name)", start); 1004 os_free(imv); 1005 return NULL; 1006 } 1007 1008 pos++; 1009 wpa_printf(MSG_DEBUG, "TNC: IMV file: '%s'", pos); 1010 imv->path = os_strdup(pos); 1011 1012 return imv; 1013 } 1014 1015 tncs_read_config(struct tncs_global * global)1016 static int tncs_read_config(struct tncs_global *global) 1017 { 1018 char *config, *end, *pos, *line_end; 1019 size_t config_len; 1020 struct tnc_if_imv *imv, *last; 1021 int id = 0; 1022 1023 last = NULL; 1024 1025 config = os_readfile(TNC_CONFIG_FILE, &config_len); 1026 if (config == NULL) { 1027 wpa_printf(MSG_ERROR, "TNC: Could not open TNC configuration " 1028 "file '%s'", TNC_CONFIG_FILE); 1029 return -1; 1030 } 1031 1032 end = config + config_len; 1033 for (pos = config; pos < end; pos = line_end + 1) { 1034 line_end = pos; 1035 while (*line_end != '\n' && *line_end != '\r' && 1036 line_end < end) 1037 line_end++; 1038 *line_end = '\0'; 1039 1040 if (os_strncmp(pos, "IMV ", 4) == 0) { 1041 int error = 0; 1042 1043 imv = tncs_parse_imv(id++, pos + 4, line_end, &error); 1044 if (error) 1045 return -1; 1046 if (imv) { 1047 if (last == NULL) 1048 global->imv = imv; 1049 else 1050 last->next = imv; 1051 last = imv; 1052 } 1053 } 1054 } 1055 1056 os_free(config); 1057 1058 return 0; 1059 } 1060 1061 tncs_init(void)1062 struct tncs_data * tncs_init(void) 1063 { 1064 struct tncs_data *tncs; 1065 1066 if (tncs_global_data == NULL) 1067 return NULL; 1068 1069 tncs = os_zalloc(sizeof(*tncs)); 1070 if (tncs == NULL) 1071 return NULL; 1072 tncs->imv = tncs_global_data->imv; 1073 tncs->connectionID = tncs_global_data->next_conn_id++; 1074 tncs->next = tncs_global_data->connections; 1075 tncs_global_data->connections = tncs; 1076 1077 return tncs; 1078 } 1079 1080 tncs_deinit(struct tncs_data * tncs)1081 void tncs_deinit(struct tncs_data *tncs) 1082 { 1083 int i; 1084 struct tncs_data *prev, *conn; 1085 1086 if (tncs == NULL) 1087 return; 1088 1089 for (i = 0; i < TNC_MAX_IMV_ID; i++) 1090 os_free(tncs->imv_data[i].imv_send); 1091 1092 prev = NULL; 1093 conn = tncs_global_data->connections; 1094 while (conn) { 1095 if (conn == tncs) { 1096 if (prev) 1097 prev->next = tncs->next; 1098 else 1099 tncs_global_data->connections = tncs->next; 1100 break; 1101 } 1102 prev = conn; 1103 conn = conn->next; 1104 } 1105 1106 os_free(tncs->tncs_message); 1107 os_free(tncs); 1108 } 1109 1110 tncs_global_init(void)1111 int tncs_global_init(void) 1112 { 1113 struct tnc_if_imv *imv; 1114 1115 if (tncs_global_data) 1116 return 0; 1117 1118 tncs_global_data = os_zalloc(sizeof(*tncs_global_data)); 1119 if (tncs_global_data == NULL) 1120 return -1; 1121 1122 if (tncs_read_config(tncs_global_data) < 0) { 1123 wpa_printf(MSG_ERROR, "TNC: Failed to read TNC configuration"); 1124 goto failed; 1125 } 1126 1127 for (imv = tncs_global_data->imv; imv; imv = imv->next) { 1128 if (tncs_load_imv(imv)) { 1129 wpa_printf(MSG_ERROR, "TNC: Failed to load IMV '%s'", 1130 imv->name); 1131 goto failed; 1132 } 1133 } 1134 1135 return 0; 1136 1137 failed: 1138 tncs_global_deinit(); 1139 return -1; 1140 } 1141 1142 tncs_global_deinit(void)1143 void tncs_global_deinit(void) 1144 { 1145 struct tnc_if_imv *imv, *prev; 1146 1147 if (tncs_global_data == NULL) 1148 return; 1149 1150 imv = tncs_global_data->imv; 1151 while (imv) { 1152 tncs_unload_imv(imv); 1153 1154 prev = imv; 1155 imv = imv->next; 1156 os_free(prev); 1157 } 1158 1159 os_free(tncs_global_data); 1160 tncs_global_data = NULL; 1161 } 1162 1163 tncs_build_soh_request(void)1164 struct wpabuf * tncs_build_soh_request(void) 1165 { 1166 struct wpabuf *buf; 1167 1168 /* 1169 * Build a SoH Request TLV (to be used inside SoH EAP Extensions 1170 * Method) 1171 */ 1172 1173 buf = wpabuf_alloc(8 + 4); 1174 if (buf == NULL) 1175 return NULL; 1176 1177 /* Vendor-Specific TLV (Microsoft) - SoH Request */ 1178 wpabuf_put_be16(buf, EAP_TLV_VENDOR_SPECIFIC_TLV); /* TLV Type */ 1179 wpabuf_put_be16(buf, 8); /* Length */ 1180 1181 wpabuf_put_be32(buf, EAP_VENDOR_MICROSOFT); /* Vendor_Id */ 1182 1183 wpabuf_put_be16(buf, 0x02); /* TLV Type - SoH Request TLV */ 1184 wpabuf_put_be16(buf, 0); /* Length */ 1185 1186 return buf; 1187 } 1188 1189 tncs_process_soh(const u8 * soh_tlv,size_t soh_tlv_len,int * failure)1190 struct wpabuf * tncs_process_soh(const u8 *soh_tlv, size_t soh_tlv_len, 1191 int *failure) 1192 { 1193 wpa_hexdump(MSG_DEBUG, "TNC: SoH TLV", soh_tlv, soh_tlv_len); 1194 *failure = 0; 1195 1196 /* TODO: return MS-SoH Response TLV */ 1197 1198 return NULL; 1199 } 1200