src/eap_server/eap_server_tnc.c

   1 /*
   2  * EAP server method: EAP-TNC (Trusted Network Connect)
   3  * Copyright (c) 2007-2010, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "base64.h"
  19 #include "eap_i.h"
  20 #include "tncs.h"
  21
  22
  23 struct eap_tnc_data {
  24         enum { START, CONTINUE, RECOMMENDATION, FRAG_ACK, WAIT_FRAG_ACK, DONE,
  25                FAIL } state;
  26         enum { ALLOW, ISOLATE, NO_ACCESS, NO_RECOMMENDATION } recommendation;
  27         struct tncs_data *tncs;
  28         struct wpabuf *in_buf;
  29         struct wpabuf *out_buf;
  30         size_t out_used;
  31         size_t fragment_size;
  32         unsigned int was_done:1;
  33         unsigned int was_fail:1;
  34 };
  35
  36
  37 /* EAP-TNC Flags */
  38 #define EAP_TNC_FLAGS_LENGTH_INCLUDED 0x80
  39 #define EAP_TNC_FLAGS_MORE_FRAGMENTS 0x40
  40 #define EAP_TNC_FLAGS_START 0x20
  41 #define EAP_TNC_VERSION_MASK 0x07
  42
  43 #define EAP_TNC_VERSION 1
  44
  45
  46 static void * eap_tnc_init(struct eap_sm *sm)
  47 {
  48         struct eap_tnc_data *data;
  49
  50         data = os_zalloc(sizeof(*data));
  51         if (data == NULL)
  52                 return NULL;
  53         data->state = START;
  54         data->tncs = tncs_init();
  55         if (data->tncs == NULL) {
  56                 os_free(data);
  57                 return NULL;
  58         }
  59
  60         data->fragment_size = 1300;
  61
  62         return data;
  63 }
  64
  65
  66 static void eap_tnc_reset(struct eap_sm *sm, void *priv)
  67 {
  68         struct eap_tnc_data *data = priv;
  69         wpabuf_free(data->in_buf);
  70         wpabuf_free(data->out_buf);
  71         tncs_deinit(data->tncs);
  72         os_free(data);
  73 }
  74
  75
  76 static struct wpabuf * eap_tnc_build_start(struct eap_sm *sm,
  77                                            struct eap_tnc_data *data, u8 id)
  78 {
  79         struct wpabuf *req;
  80
  81         req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_TNC, 1, EAP_CODE_REQUEST,
  82                             id);
  83         if (req == NULL) {
  84                 wpa_printf(MSG_ERROR, "EAP-TNC: Failed to allocate memory for "
  85                            "request");
  86                 data->state = FAIL;
  87                 return NULL;
  88         }
  89
  90         wpabuf_put_u8(req, EAP_TNC_FLAGS_START | EAP_TNC_VERSION);
  91
  92         data->state = CONTINUE;
  93
  94         return req;
  95 }
  96
  97
  98 static struct wpabuf * eap_tnc_build(struct eap_sm *sm,
  99                                      struct eap_tnc_data *data)
 100 {
 101         struct wpabuf *req;
 102         u8 *rpos, *rpos1;
 103         size_t rlen;
 104         char *start_buf, *end_buf;
 105         size_t start_len, end_len;
 106         size_t imv_len;
 107
 108         imv_len = tncs_total_send_len(data->tncs);
 109
 110         start_buf = tncs_if_tnccs_start(data->tncs);
 111         if (start_buf == NULL)
 112                 return NULL;
 113         start_len = os_strlen(start_buf);
 114         end_buf = tncs_if_tnccs_end();
 115         if (end_buf == NULL) {
 116                 os_free(start_buf);
 117                 return NULL;
 118         }
 119         end_len = os_strlen(end_buf);
 120
 121         rlen = start_len + imv_len + end_len;
 122         req = wpabuf_alloc(rlen);
 123         if (req == NULL) {
 124                 os_free(start_buf);
 125                 os_free(end_buf);
 126                 return NULL;
 127         }
 128
 129         wpabuf_put_data(req, start_buf, start_len);
 130         os_free(start_buf);
 131
 132         rpos1 = wpabuf_put(req, 0);
 133         rpos = tncs_copy_send_buf(data->tncs, rpos1);
 134         wpabuf_put(req, rpos - rpos1);
 135
 136         wpabuf_put_data(req, end_buf, end_len);
 137         os_free(end_buf);
 138
 139         wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-TNC: Request",
 140                           wpabuf_head(req), wpabuf_len(req));
 141
 142         return req;
 143 }
 144
 145
 146 static struct wpabuf * eap_tnc_build_recommendation(struct eap_sm *sm,
 147                                                     struct eap_tnc_data *data)
 148 {
 149         switch (data->recommendation) {
 150         case ALLOW:
 151                 data->state = DONE;
 152                 break;
 153         case ISOLATE:
 154                 data->state = FAIL;
 155                 /* TODO: support assignment to a different VLAN */
 156                 break;
 157         case NO_ACCESS:
 158                 data->state = FAIL;
 159                 break;
 160         case NO_RECOMMENDATION:
 161                 data->state = DONE;
 162                 break;
 163         default:
 164                 wpa_printf(MSG_DEBUG, "EAP-TNC: Unknown recommendation");
 165                 return NULL;
 166         }
 167
 168         return eap_tnc_build(sm, data);
 169 }
 170
 171
 172 static struct wpabuf * eap_tnc_build_frag_ack(u8 id, u8 code)
 173 {
 174         struct wpabuf *msg;
 175
 176         msg = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_TNC, 1, code, id);
 177         if (msg == NULL) {
 178                 wpa_printf(MSG_ERROR, "EAP-TNC: Failed to allocate memory "
 179                            "for fragment ack");
 180                 return NULL;
 181         }
 182         wpabuf_put_u8(msg, EAP_TNC_VERSION); /* Flags */
 183
 184         wpa_printf(MSG_DEBUG, "EAP-TNC: Send fragment ack");
 185
 186         return msg;
 187 }
 188
 189
 190 static struct wpabuf * eap_tnc_build_msg(struct eap_tnc_data *data, u8 id)
 191 {
 192         struct wpabuf *req;
 193         u8 flags;
 194         size_t send_len, plen;
 195
 196         wpa_printf(MSG_DEBUG, "EAP-TNC: Generating Request");
 197
 198         flags = EAP_TNC_VERSION;
 199         send_len = wpabuf_len(data->out_buf) - data->out_used;
 200         if (1 + send_len > data->fragment_size) {
 201                 send_len = data->fragment_size - 1;
 202                 flags |= EAP_TNC_FLAGS_MORE_FRAGMENTS;
 203                 if (data->out_used == 0) {
 204                         flags |= EAP_TNC_FLAGS_LENGTH_INCLUDED;
 205                         send_len -= 4;
 206                 }
 207         }
 208
 209         plen = 1 + send_len;
 210         if (flags & EAP_TNC_FLAGS_LENGTH_INCLUDED)
 211                 plen += 4;
 212         req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_TNC, plen,
 213                             EAP_CODE_REQUEST, id);
 214         if (req == NULL)
 215                 return NULL;
 216
 217         wpabuf_put_u8(req, flags); /* Flags */
 218         if (flags & EAP_TNC_FLAGS_LENGTH_INCLUDED)
 219                 wpabuf_put_be32(req, wpabuf_len(data->out_buf));
 220
 221         wpabuf_put_data(req, wpabuf_head_u8(data->out_buf) + data->out_used,
 222                         send_len);
 223         data->out_used += send_len;
 224
 225         if (data->out_used == wpabuf_len(data->out_buf)) {
 226                 wpa_printf(MSG_DEBUG, "EAP-TNC: Sending out %lu bytes "
 227                            "(message sent completely)",
 228                            (unsigned long) send_len);
 229                 wpabuf_free(data->out_buf);
 230                 data->out_buf = NULL;
 231                 data->out_used = 0;
 232                 if (data->was_fail)
 233                         data->state = FAIL;
 234                 else if (data->was_done)
 235                         data->state = DONE;
 236         } else {
 237                 wpa_printf(MSG_DEBUG, "EAP-TNC: Sending out %lu bytes "
 238                            "(%lu more to send)", (unsigned long) send_len,
 239                            (unsigned long) wpabuf_len(data->out_buf) -
 240                            data->out_used);
 241                 if (data->state == FAIL)
 242                         data->was_fail = 1;
 243                 else if (data->state == DONE)
 244                         data->was_done = 1;
 245                 data->state = WAIT_FRAG_ACK;
 246         }
 247
 248         return req;
 249 }
 250
 251
 252 static struct wpabuf * eap_tnc_buildReq(struct eap_sm *sm, void *priv, u8 id)
 253 {
 254         struct eap_tnc_data *data = priv;
 255
 256         switch (data->state) {
 257         case START:
 258                 tncs_init_connection(data->tncs);
 259                 return eap_tnc_build_start(sm, data, id);
 260         case CONTINUE:
 261                 if (data->out_buf == NULL) {
 262                         data->out_buf = eap_tnc_build(sm, data);
 263                         if (data->out_buf == NULL) {
 264                                 wpa_printf(MSG_DEBUG, "EAP-TNC: Failed to "
 265                                            "generate message");
 266                                 return NULL;
 267                         }
 268                         data->out_used = 0;
 269                 }
 270                 return eap_tnc_build_msg(data, id);
 271         case RECOMMENDATION:
 272                 if (data->out_buf == NULL) {
 273                         data->out_buf = eap_tnc_build_recommendation(sm, data);
 274                         if (data->out_buf == NULL) {
 275                                 wpa_printf(MSG_DEBUG, "EAP-TNC: Failed to "
 276                                            "generate recommendation message");
 277                                 return NULL;
 278                         }
 279                         data->out_used = 0;
 280                 }
 281                 return eap_tnc_build_msg(data, id);
 282         case WAIT_FRAG_ACK:
 283                 return eap_tnc_build_msg(data, id);
 284         case FRAG_ACK:
 285                 return eap_tnc_build_frag_ack(id, EAP_CODE_REQUEST);
 286         case DONE:
 287         case FAIL:
 288                 return NULL;
 289         }
 290
 291         return NULL;
 292 }
 293
 294
 295 static Boolean eap_tnc_check(struct eap_sm *sm, void *priv,
 296                              struct wpabuf *respData)
 297 {
 298         struct eap_tnc_data *data = priv;
 299         const u8 *pos;
 300         size_t len;
 301
 302         pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_TNC, respData,
 303                                &len);
 304         if (pos == NULL) {
 305                 wpa_printf(MSG_INFO, "EAP-TNC: Invalid frame");
 306                 return TRUE;
 307         }
 308
 309         if (len == 0 && data->state != WAIT_FRAG_ACK) {
 310                 wpa_printf(MSG_INFO, "EAP-TNC: Invalid frame (empty)");
 311                 return TRUE;
 312         }
 313
 314         if (len == 0)
 315                 return FALSE; /* Fragment ACK does not include flags */
 316
 317         if ((*pos & EAP_TNC_VERSION_MASK) != EAP_TNC_VERSION) {
 318                 wpa_printf(MSG_DEBUG, "EAP-TNC: Unsupported version %d",
 319                            *pos & EAP_TNC_VERSION_MASK);
 320                 return TRUE;
 321         }
 322
 323         if (*pos & EAP_TNC_FLAGS_START) {
 324                 wpa_printf(MSG_DEBUG, "EAP-TNC: Peer used Start flag");
 325                 return TRUE;
 326         }
 327
 328         return FALSE;
 329 }
 330
 331
 332 static void tncs_process(struct eap_tnc_data *data, struct wpabuf *inbuf)
 333 {
 334         enum tncs_process_res res;
 335
 336         res = tncs_process_if_tnccs(data->tncs, wpabuf_head(inbuf),
 337                                     wpabuf_len(inbuf));
 338         switch (res) {
 339         case TNCCS_RECOMMENDATION_ALLOW:
 340                 wpa_printf(MSG_DEBUG, "EAP-TNC: TNCS allowed access");
 341                 data->state = RECOMMENDATION;
 342                 data->recommendation = ALLOW;
 343                 break;
 344         case TNCCS_RECOMMENDATION_NO_RECOMMENDATION:
 345                 wpa_printf(MSG_DEBUG, "EAP-TNC: TNCS has no recommendation");
 346                 data->state = RECOMMENDATION;
 347                 data->recommendation = NO_RECOMMENDATION;
 348                 break;
 349         case TNCCS_RECOMMENDATION_ISOLATE:
 350                 wpa_printf(MSG_DEBUG, "EAP-TNC: TNCS requested isolation");
 351                 data->state = RECOMMENDATION;
 352                 data->recommendation = ISOLATE;
 353                 break;
 354         case TNCCS_RECOMMENDATION_NO_ACCESS:
 355                 wpa_printf(MSG_DEBUG, "EAP-TNC: TNCS rejected access");
 356                 data->state = RECOMMENDATION;
 357                 data->recommendation = NO_ACCESS;
 358                 break;
 359         case TNCCS_PROCESS_ERROR:
 360                 wpa_printf(MSG_DEBUG, "EAP-TNC: TNCS processing error");
 361                 data->state = FAIL;
 362                 break;
 363         default:
 364                 break;
 365         }
 366 }
 367
 368
 369 static int eap_tnc_process_cont(struct eap_tnc_data *data,
 370                                 const u8 *buf, size_t len)
 371 {
 372         /* Process continuation of a pending message */
 373         if (len > wpabuf_tailroom(data->in_buf)) {
 374                 wpa_printf(MSG_DEBUG, "EAP-TNC: Fragment overflow");
 375                 data->state = FAIL;
 376                 return -1;
 377         }
 378
 379         wpabuf_put_data(data->in_buf, buf, len);
 380         wpa_printf(MSG_DEBUG, "EAP-TNC: Received %lu bytes, waiting for %lu "
 381                    "bytes more", (unsigned long) len,
 382                    (unsigned long) wpabuf_tailroom(data->in_buf));
 383
 384         return 0;
 385 }
 386
 387
 388 static int eap_tnc_process_fragment(struct eap_tnc_data *data,
 389                                     u8 flags, u32 message_length,
 390                                     const u8 *buf, size_t len)
 391 {
 392         /* Process a fragment that is not the last one of the message */
 393         if (data->in_buf == NULL && !(flags & EAP_TNC_FLAGS_LENGTH_INCLUDED)) {
 394                 wpa_printf(MSG_DEBUG, "EAP-TNC: No Message Length field in a "
 395                            "fragmented packet");
 396                 return -1;
 397         }
 398
 399         if (data->in_buf == NULL) {
 400                 /* First fragment of the message */
 401                 data->in_buf = wpabuf_alloc(message_length);
 402                 if (data->in_buf == NULL) {
 403                         wpa_printf(MSG_DEBUG, "EAP-TNC: No memory for "
 404                                    "message");
 405                         return -1;
 406                 }
 407                 wpabuf_put_data(data->in_buf, buf, len);
 408                 wpa_printf(MSG_DEBUG, "EAP-TNC: Received %lu bytes in first "
 409                            "fragment, waiting for %lu bytes more",
 410                            (unsigned long) len,
 411                            (unsigned long) wpabuf_tailroom(data->in_buf));
 412         }
 413
 414         return 0;
 415 }
 416
 417
 418 static void eap_tnc_process(struct eap_sm *sm, void *priv,
 419                             struct wpabuf *respData)
 420 {
 421         struct eap_tnc_data *data = priv;
 422         const u8 *pos, *end;
 423         size_t len;
 424         u8 flags;
 425         u32 message_length = 0;
 426         struct wpabuf tmpbuf;
 427
 428         pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_TNC, respData, &len);
 429         if (pos == NULL)
 430                 return; /* Should not happen; message already verified */
 431
 432         end = pos + len;
 433
 434         if (len == 1 && (data->state == DONE || data->state == FAIL)) {
 435                 wpa_printf(MSG_DEBUG, "EAP-TNC: Peer acknowledged the last "
 436                            "message");
 437                 return;
 438         }
 439
 440         if (len == 0) {
 441                 /* fragment ack */
 442                 flags = 0;
 443         } else
 444                 flags = *pos++;
 445
 446         if (flags & EAP_TNC_FLAGS_LENGTH_INCLUDED) {
 447                 if (end - pos < 4) {
 448                         wpa_printf(MSG_DEBUG, "EAP-TNC: Message underflow");
 449                         data->state = FAIL;
 450                         return;
 451                 }
 452                 message_length = WPA_GET_BE32(pos);
 453                 pos += 4;
 454
 455                 if (message_length < (u32) (end - pos)) {
 456                         wpa_printf(MSG_DEBUG, "EAP-TNC: Invalid Message "
 457                                    "Length (%d; %ld remaining in this msg)",
 458                                    message_length, (long) (end - pos));
 459                         data->state = FAIL;
 460                         return;
 461                 }
 462         }
 463         wpa_printf(MSG_DEBUG, "EAP-TNC: Received packet: Flags 0x%x "
 464                    "Message Length %u", flags, message_length);
 465
 466         if (data->state == WAIT_FRAG_ACK) {
 467                 if (len > 1) {
 468                         wpa_printf(MSG_DEBUG, "EAP-TNC: Unexpected payload "
 469                                    "in WAIT_FRAG_ACK state");
 470                         data->state = FAIL;
 471                         return;
 472                 }
 473                 wpa_printf(MSG_DEBUG, "EAP-TNC: Fragment acknowledged");
 474                 data->state = CONTINUE;
 475                 return;
 476         }
 477
 478         if (data->in_buf && eap_tnc_process_cont(data, pos, end - pos) < 0) {
 479                 data->state = FAIL;
 480                 return;
 481         }
 482
 483         if (flags & EAP_TNC_FLAGS_MORE_FRAGMENTS) {
 484                 if (eap_tnc_process_fragment(data, flags, message_length,
 485                                              pos, end - pos) < 0)
 486                         data->state = FAIL;
 487                 else
 488                         data->state = FRAG_ACK;
 489                 return;
 490         } else if (data->state == FRAG_ACK) {
 491                 wpa_printf(MSG_DEBUG, "EAP-TNC: All fragments received");
 492                 data->state = CONTINUE;
 493         }
 494
 495         if (data->in_buf == NULL) {
 496                 /* Wrap unfragmented messages as wpabuf without extra copy */
 497                 wpabuf_set(&tmpbuf, pos, end - pos);
 498                 data->in_buf = &tmpbuf;
 499         }
 500
 501         wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-TNC: Received payload",
 502                           wpabuf_head(data->in_buf), wpabuf_len(data->in_buf));
 503         tncs_process(data, data->in_buf);
 504
 505         if (data->in_buf != &tmpbuf)
 506                 wpabuf_free(data->in_buf);
 507         data->in_buf = NULL;
 508 }
 509
 510
 511 static Boolean eap_tnc_isDone(struct eap_sm *sm, void *priv)
 512 {
 513         struct eap_tnc_data *data = priv;
 514         return data->state == DONE || data->state == FAIL;
 515 }
 516
 517
 518 static Boolean eap_tnc_isSuccess(struct eap_sm *sm, void *priv)
 519 {
 520         struct eap_tnc_data *data = priv;
 521         return data->state == DONE;
 522 }
 523
 524
 525 int eap_server_tnc_register(void)
 526 {
 527         struct eap_method *eap;
 528         int ret;
 529
 530         eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION,
 531                                       EAP_VENDOR_IETF, EAP_TYPE_TNC, "TNC");
 532         if (eap == NULL)
 533                 return -1;
 534
 535         eap->init = eap_tnc_init;
 536         eap->reset = eap_tnc_reset;
 537         eap->buildReq = eap_tnc_buildReq;
 538         eap->check = eap_tnc_check;
 539         eap->process = eap_tnc_process;
 540         eap->isDone = eap_tnc_isDone;
 541         eap->isSuccess = eap_tnc_isSuccess;
 542
 543         ret = eap_server_method_register(eap);
 544         if (ret)
 545                 eap_server_method_free(eap);
 546         return ret;
 547 }