1 /* 2 * EAP peer method: EAP-TNC (Trusted Network Connect) 3 * Copyright (c) 2007, Jouni Malinen <j@w1.fi> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 * Alternatively, this software may be distributed under the terms of BSD 10 * license. 11 * 12 * See README and COPYING for more details. 13 */ 14 15 #include "includes.h" 16 17 #include "common.h" 18 #include "base64.h" 19 #include "eap_i.h" 20 #include "tncc.h" 21 22 23 struct eap_tnc_data { 24 enum { WAIT_START, PROC_MSG, WAIT_FRAG_ACK, DONE, FAIL } state; 25 struct tncc_data *tncc; 26 struct wpabuf *in_buf; 27 struct wpabuf *out_buf; 28 size_t out_used; 29 size_t fragment_size; 30 }; 31 32 33 /* EAP-TNC Flags */ 34 #define EAP_TNC_FLAGS_LENGTH_INCLUDED 0x80 35 #define EAP_TNC_FLAGS_MORE_FRAGMENTS 0x40 36 #define EAP_TNC_FLAGS_START 0x20 37 #define EAP_TNC_VERSION_MASK 0x07 38 39 #define EAP_TNC_VERSION 1 40 41 42 static void * eap_tnc_init(struct eap_sm *sm) 43 { 44 struct eap_tnc_data *data; 45 46 data = os_zalloc(sizeof(*data)); 47 if (data == NULL) 48 return NULL; 49 data->state = WAIT_START; 50 data->fragment_size = 1300; 51 data->tncc = tncc_init(); 52 if (data->tncc == NULL) { 53 os_free(data); 54 return NULL; 55 } 56 57 return data; 58 } 59 60 61 static void eap_tnc_deinit(struct eap_sm *sm, void *priv) 62 { 63 struct eap_tnc_data *data = priv; 64 65 wpabuf_free(data->in_buf); 66 wpabuf_free(data->out_buf); 67 tncc_deinit(data->tncc); 68 os_free(data); 69 } 70 71 72 static struct wpabuf * eap_tnc_build_frag_ack(u8 id, u8 code) 73 { 74 struct wpabuf *msg; 75 76 msg = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_TNC, 0, code, id); 77 if (msg == NULL) { 78 wpa_printf(MSG_ERROR, "EAP-TNC: Failed to allocate memory " 79 "for fragment ack"); 80 return NULL; 81 } 82 83 wpa_printf(MSG_DEBUG, "EAP-TNC: Send fragment ack"); 84 85 return msg; 86 } 87 88 89 static struct wpabuf * eap_tnc_build_msg(struct eap_tnc_data *data, 90 struct eap_method_ret *ret, u8 id) 91 { 92 struct wpabuf *resp; 93 u8 flags; 94 size_t send_len, plen; 95 96 ret->ignore = FALSE; 97 wpa_printf(MSG_DEBUG, "EAP-TNC: Generating Response"); 98 ret->allowNotifications = TRUE; 99 100 flags = EAP_TNC_VERSION; 101 send_len = wpabuf_len(data->out_buf) - data->out_used; 102 if (1 + send_len > data->fragment_size) { 103 send_len = data->fragment_size - 1; 104 flags |= EAP_TNC_FLAGS_MORE_FRAGMENTS; 105 if (data->out_used == 0) { 106 flags |= EAP_TNC_FLAGS_LENGTH_INCLUDED; 107 send_len -= 4; 108 } 109 } 110 111 plen = 1 + send_len; 112 if (flags & EAP_TNC_FLAGS_LENGTH_INCLUDED) 113 plen += 4; 114 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_TNC, plen, 115 EAP_CODE_RESPONSE, id); 116 if (resp == NULL) 117 return NULL; 118 119 wpabuf_put_u8(resp, flags); /* Flags */ 120 if (flags & EAP_TNC_FLAGS_LENGTH_INCLUDED) 121 wpabuf_put_be32(resp, wpabuf_len(data->out_buf)); 122 123 wpabuf_put_data(resp, wpabuf_head_u8(data->out_buf) + data->out_used, 124 send_len); 125 data->out_used += send_len; 126 127 ret->methodState = METHOD_MAY_CONT; 128 ret->decision = DECISION_FAIL; 129 130 if (data->out_used == wpabuf_len(data->out_buf)) { 131 wpa_printf(MSG_DEBUG, "EAP-TNC: Sending out %lu bytes " 132 "(message sent completely)", 133 (unsigned long) send_len); 134 wpabuf_free(data->out_buf); 135 data->out_buf = NULL; 136 data->out_used = 0; 137 } else { 138 wpa_printf(MSG_DEBUG, "EAP-TNC: Sending out %lu bytes " 139 "(%lu more to send)", (unsigned long) send_len, 140 (unsigned long) wpabuf_len(data->out_buf) - 141 data->out_used); 142 data->state = WAIT_FRAG_ACK; 143 } 144 145 return resp; 146 } 147 148 149 static int eap_tnc_process_cont(struct eap_tnc_data *data, 150 const u8 *buf, size_t len) 151 { 152 /* Process continuation of a pending message */ 153 if (len > wpabuf_tailroom(data->in_buf)) { 154 wpa_printf(MSG_DEBUG, "EAP-TNC: Fragment overflow"); 155 data->state = FAIL; 156 return -1; 157 } 158 159 wpabuf_put_data(data->in_buf, buf, len); 160 wpa_printf(MSG_DEBUG, "EAP-TNC: Received %lu bytes, waiting for " 161 "%lu bytes more", (unsigned long) len, 162 (unsigned long) wpabuf_tailroom(data->in_buf)); 163 164 return 0; 165 } 166 167 168 static struct wpabuf * eap_tnc_process_fragment(struct eap_tnc_data *data, 169 struct eap_method_ret *ret, 170 u8 id, u8 flags, 171 u32 message_length, 172 const u8 *buf, size_t len) 173 { 174 /* Process a fragment that is not the last one of the message */ 175 if (data->in_buf == NULL && !(flags & EAP_TNC_FLAGS_LENGTH_INCLUDED)) { 176 wpa_printf(MSG_DEBUG, "EAP-TNC: No Message Length field in a " 177 "fragmented packet"); 178 ret->ignore = TRUE; 179 return NULL; 180 } 181 182 if (data->in_buf == NULL) { 183 /* First fragment of the message */ 184 data->in_buf = wpabuf_alloc(message_length); 185 if (data->in_buf == NULL) { 186 wpa_printf(MSG_DEBUG, "EAP-TNC: No memory for " 187 "message"); 188 ret->ignore = TRUE; 189 return NULL; 190 } 191 wpabuf_put_data(data->in_buf, buf, len); 192 wpa_printf(MSG_DEBUG, "EAP-TNC: Received %lu bytes in first " 193 "fragment, waiting for %lu bytes more", 194 (unsigned long) len, 195 (unsigned long) wpabuf_tailroom(data->in_buf)); 196 } 197 198 return eap_tnc_build_frag_ack(id, EAP_CODE_RESPONSE); 199 } 200 201 202 static struct wpabuf * eap_tnc_process(struct eap_sm *sm, void *priv, 203 struct eap_method_ret *ret, 204 const struct wpabuf *reqData) 205 { 206 struct eap_tnc_data *data = priv; 207 struct wpabuf *resp; 208 const u8 *pos, *end; 209 u8 *rpos, *rpos1; 210 size_t len, rlen; 211 size_t imc_len; 212 char *start_buf, *end_buf; 213 size_t start_len, end_len; 214 int tncs_done = 0; 215 u8 flags, id; 216 u32 message_length = 0; 217 struct wpabuf tmpbuf; 218 219 pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_TNC, reqData, &len); 220 if (pos == NULL) { 221 wpa_printf(MSG_INFO, "EAP-TNC: Invalid frame (pos=%p len=%lu)", 222 pos, (unsigned long) len); 223 ret->ignore = TRUE; 224 return NULL; 225 } 226 227 id = eap_get_id(reqData); 228 229 end = pos + len; 230 231 if (len == 0) 232 flags = 0; /* fragment ack */ 233 else 234 flags = *pos++; 235 236 if (len > 0 && (flags & EAP_TNC_VERSION_MASK) != EAP_TNC_VERSION) { 237 wpa_printf(MSG_DEBUG, "EAP-TNC: Unsupported version %d", 238 flags & EAP_TNC_VERSION_MASK); 239 ret->ignore = TRUE; 240 return NULL; 241 } 242 243 if (flags & EAP_TNC_FLAGS_LENGTH_INCLUDED) { 244 if (end - pos < 4) { 245 wpa_printf(MSG_DEBUG, "EAP-TNC: Message underflow"); 246 ret->ignore = TRUE; 247 return NULL; 248 } 249 message_length = WPA_GET_BE32(pos); 250 pos += 4; 251 252 if (message_length < (u32) (end - pos)) { 253 wpa_printf(MSG_DEBUG, "EAP-TNC: Invalid Message " 254 "Length (%d; %ld remaining in this msg)", 255 message_length, (long) (end - pos)); 256 ret->ignore = TRUE; 257 return NULL; 258 } 259 } 260 261 wpa_printf(MSG_DEBUG, "EAP-TNC: Received packet: Flags 0x%x " 262 "Message Length %u", flags, message_length); 263 264 if (data->state == WAIT_FRAG_ACK) { 265 if (len != 0) { 266 wpa_printf(MSG_DEBUG, "EAP-TNC: Unexpected payload in " 267 "WAIT_FRAG_ACK state"); 268 ret->ignore = TRUE; 269 return NULL; 270 } 271 wpa_printf(MSG_DEBUG, "EAP-TNC: Fragment acknowledged"); 272 data->state = PROC_MSG; 273 return eap_tnc_build_msg(data, ret, id); 274 } 275 276 if (data->in_buf && eap_tnc_process_cont(data, pos, end - pos) < 0) { 277 ret->ignore = TRUE; 278 return NULL; 279 } 280 281 if (flags & EAP_TNC_FLAGS_MORE_FRAGMENTS) { 282 return eap_tnc_process_fragment(data, ret, id, flags, 283 message_length, pos, 284 end - pos); 285 } 286 287 if (data->in_buf == NULL) { 288 /* Wrap unfragmented messages as wpabuf without extra copy */ 289 wpabuf_set(&tmpbuf, pos, end - pos); 290 data->in_buf = &tmpbuf; 291 } 292 293 if (data->state == WAIT_START) { 294 if (!(flags & EAP_TNC_FLAGS_START)) { 295 wpa_printf(MSG_DEBUG, "EAP-TNC: Server did not use " 296 "start flag in the first message"); 297 ret->ignore = TRUE; 298 return NULL; 299 } 300 301 tncc_init_connection(data->tncc); 302 303 data->state = PROC_MSG; 304 } else { 305 enum tncc_process_res res; 306 307 if (flags & EAP_TNC_FLAGS_START) { 308 wpa_printf(MSG_DEBUG, "EAP-TNC: Server used start " 309 "flag again"); 310 ret->ignore = TRUE; 311 return NULL; 312 } 313 314 res = tncc_process_if_tnccs(data->tncc, 315 wpabuf_head(data->in_buf), 316 wpabuf_len(data->in_buf)); 317 switch (res) { 318 case TNCCS_PROCESS_ERROR: 319 ret->ignore = TRUE; 320 return NULL; 321 case TNCCS_PROCESS_OK_NO_RECOMMENDATION: 322 case TNCCS_RECOMMENDATION_ERROR: 323 wpa_printf(MSG_DEBUG, "EAP-TNC: No " 324 "TNCCS-Recommendation received"); 325 break; 326 case TNCCS_RECOMMENDATION_ALLOW: 327 wpa_msg(sm->msg_ctx, MSG_INFO, 328 "TNC: Recommendation = allow"); 329 tncs_done = 1; 330 break; 331 case TNCCS_RECOMMENDATION_NONE: 332 wpa_msg(sm->msg_ctx, MSG_INFO, 333 "TNC: Recommendation = none"); 334 tncs_done = 1; 335 break; 336 case TNCCS_RECOMMENDATION_ISOLATE: 337 wpa_msg(sm->msg_ctx, MSG_INFO, 338 "TNC: Recommendation = isolate"); 339 tncs_done = 1; 340 break; 341 } 342 } 343 344 if (data->in_buf != &tmpbuf) 345 wpabuf_free(data->in_buf); 346 data->in_buf = NULL; 347 348 ret->ignore = FALSE; 349 ret->methodState = METHOD_MAY_CONT; 350 ret->decision = DECISION_UNCOND_SUCC; 351 ret->allowNotifications = TRUE; 352 353 if (data->out_buf) { 354 data->state = PROC_MSG; 355 return eap_tnc_build_msg(data, ret, id); 356 } 357 358 if (tncs_done) { 359 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_TNC, 1, 360 EAP_CODE_RESPONSE, eap_get_id(reqData)); 361 if (resp == NULL) 362 return NULL; 363 364 wpabuf_put_u8(resp, EAP_TNC_VERSION); 365 wpa_printf(MSG_DEBUG, "EAP-TNC: TNCS done - reply with an " 366 "empty ACK message"); 367 return resp; 368 } 369 370 imc_len = tncc_total_send_len(data->tncc); 371 372 start_buf = tncc_if_tnccs_start(data->tncc); 373 if (start_buf == NULL) 374 return NULL; 375 start_len = os_strlen(start_buf); 376 end_buf = tncc_if_tnccs_end(); 377 if (end_buf == NULL) { 378 os_free(start_buf); 379 return NULL; 380 } 381 end_len = os_strlen(end_buf); 382 383 rlen = start_len + imc_len + end_len; 384 resp = wpabuf_alloc(rlen); 385 if (resp == NULL) { 386 os_free(start_buf); 387 os_free(end_buf); 388 return NULL; 389 } 390 391 wpabuf_put_data(resp, start_buf, start_len); 392 os_free(start_buf); 393 394 rpos1 = wpabuf_put(resp, 0); 395 rpos = tncc_copy_send_buf(data->tncc, rpos1); 396 wpabuf_put(resp, rpos - rpos1); 397 398 wpabuf_put_data(resp, end_buf, end_len); 399 os_free(end_buf); 400 401 wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-TNC: Response", 402 wpabuf_head(resp), wpabuf_len(resp)); 403 404 data->out_buf = resp; 405 data->state = PROC_MSG; 406 return eap_tnc_build_msg(data, ret, id); 407 } 408 409 410 int eap_peer_tnc_register(void) 411 { 412 struct eap_method *eap; 413 int ret; 414 415 eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION, 416 EAP_VENDOR_IETF, EAP_TYPE_TNC, "TNC"); 417 if (eap == NULL) 418 return -1; 419 420 eap->init = eap_tnc_init; 421 eap->deinit = eap_tnc_deinit; 422 eap->process = eap_tnc_process; 423 424 ret = eap_peer_method_register(eap); 425 if (ret) 426 eap_peer_method_free(eap); 427 return ret; 428 } 429