contrib/hostapd/src/eap_server/tncs.c

   1 /*
   2  * EAP-TNC - TNCS (IF-IMV, IF-TNCCS, and IF-TNCCS-SOH)
   3  * Copyright (c) 2007-2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10 #include <dlfcn.h>
  11
  12 #include "common.h"
  13 #include "base64.h"
  14 #include "tncs.h"
  15 #include "eap_common/eap_tlv_common.h"
  16 #include "eap_common/eap_defs.h"
  17
  18
  19 /* TODO: TNCS must be thread-safe; review the code and add locking etc. if
  20  * needed.. */
  21
  22 #define TNC_CONFIG_FILE "/etc/tnc_config"
  23 #define IF_TNCCS_START \
  24 "<?xml version=\"1.0\"?>\n" \
  25 "<TNCCS-Batch BatchId=\"%d\" Recipient=\"TNCS\" " \
  26 "xmlns=\"http://www.trustedcomputinggroup.org/IWG/TNC/1_0/IF_TNCCS#\" " \
  27 "xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" " \
  28 "xsi:schemaLocation=\"http://www.trustedcomputinggroup.org/IWG/TNC/1_0/" \
  29 "IF_TNCCS# https://www.trustedcomputinggroup.org/XML/SCHEMA/TNCCS_1.0.xsd\">\n"
  30 #define IF_TNCCS_END "\n</TNCCS-Batch>"
  31
  32 /* TNC IF-IMV */
  33
  34 typedef unsigned long TNC_UInt32;
  35 typedef unsigned char *TNC_BufferReference;
  36
  37 typedef TNC_UInt32 TNC_IMVID;
  38 typedef TNC_UInt32 TNC_ConnectionID;
  39 typedef TNC_UInt32 TNC_ConnectionState;
  40 typedef TNC_UInt32 TNC_RetryReason;
  41 typedef TNC_UInt32 TNC_IMV_Action_Recommendation;
  42 typedef TNC_UInt32 TNC_IMV_Evaluation_Result;
  43 typedef TNC_UInt32 TNC_MessageType;
  44 typedef TNC_MessageType *TNC_MessageTypeList;
  45 typedef TNC_UInt32 TNC_VendorID;
  46 typedef TNC_UInt32 TNC_Subtype;
  47 typedef TNC_UInt32 TNC_Version;
  48 typedef TNC_UInt32 TNC_Result;
  49 typedef TNC_UInt32 TNC_AttributeID;
  50
  51 typedef TNC_Result (*TNC_TNCS_BindFunctionPointer)(
  52         TNC_IMVID imvID,
  53         char *functionName,
  54         void **pOutfunctionPointer);
  55
  56 #define TNC_RESULT_SUCCESS 0
  57 #define TNC_RESULT_NOT_INITIALIZED 1
  58 #define TNC_RESULT_ALREADY_INITIALIZED 2
  59 #define TNC_RESULT_NO_COMMON_VERSION 3
  60 #define TNC_RESULT_CANT_RETRY 4
  61 #define TNC_RESULT_WONT_RETRY 5
  62 #define TNC_RESULT_INVALID_PARAMETER 6
  63 #define TNC_RESULT_CANT_RESPOND 7
  64 #define TNC_RESULT_ILLEGAL_OPERATION 8
  65 #define TNC_RESULT_OTHER 9
  66 #define TNC_RESULT_FATAL 10
  67
  68 #define TNC_CONNECTION_STATE_CREATE 0
  69 #define TNC_CONNECTION_STATE_HANDSHAKE 1
  70 #define TNC_CONNECTION_STATE_ACCESS_ALLOWED 2
  71 #define TNC_CONNECTION_STATE_ACCESS_ISOLATED 3
  72 #define TNC_CONNECTION_STATE_ACCESS_NONE 4
  73 #define TNC_CONNECTION_STATE_DELETE 5
  74
  75 #define TNC_IFIMV_VERSION_1 1
  76
  77 #define TNC_VENDORID_ANY ((TNC_VendorID) 0xffffff)
  78 #define TNC_SUBTYPE_ANY ((TNC_Subtype) 0xff)
  79
  80 /* TNCC-TNCS Message Types */
  81 #define TNC_TNCCS_RECOMMENDATION                0x00000001
  82 #define TNC_TNCCS_ERROR                         0x00000002
  83 #define TNC_TNCCS_PREFERREDLANGUAGE             0x00000003
  84 #define TNC_TNCCS_REASONSTRINGS                 0x00000004
  85
  86 /* Possible TNC_IMV_Action_Recommendation values: */
  87 enum IMV_Action_Recommendation {
  88         TNC_IMV_ACTION_RECOMMENDATION_ALLOW,
  89         TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS,
  90         TNC_IMV_ACTION_RECOMMENDATION_ISOLATE,
  91         TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION
  92 };
  93
  94 /* Possible TNC_IMV_Evaluation_Result values: */
  95 enum IMV_Evaluation_Result {
  96         TNC_IMV_EVALUATION_RESULT_COMPLIANT,
  97         TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR,
  98         TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR,
  99         TNC_IMV_EVALUATION_RESULT_ERROR,
 100         TNC_IMV_EVALUATION_RESULT_DONT_KNOW
 101 };
 102
 103 struct tnc_if_imv {
 104         struct tnc_if_imv *next;
 105         char *name;
 106         char *path;
 107         void *dlhandle; /* from dlopen() */
 108         TNC_IMVID imvID;
 109         TNC_MessageTypeList supported_types;
 110         size_t num_supported_types;
 111
 112         /* Functions implemented by IMVs (with TNC_IMV_ prefix) */
 113         TNC_Result (*Initialize)(
 114                 TNC_IMVID imvID,
 115                 TNC_Version minVersion,
 116                 TNC_Version maxVersion,
 117                 TNC_Version *pOutActualVersion);
 118         TNC_Result (*NotifyConnectionChange)(
 119                 TNC_IMVID imvID,
 120                 TNC_ConnectionID connectionID,
 121                 TNC_ConnectionState newState);
 122         TNC_Result (*ReceiveMessage)(
 123                 TNC_IMVID imvID,
 124                 TNC_ConnectionID connectionID,
 125                 TNC_BufferReference message,
 126                 TNC_UInt32 messageLength,
 127                 TNC_MessageType messageType);
 128         TNC_Result (*SolicitRecommendation)(
 129                 TNC_IMVID imvID,
 130                 TNC_ConnectionID connectionID);
 131         TNC_Result (*BatchEnding)(
 132                 TNC_IMVID imvID,
 133                 TNC_ConnectionID connectionID);
 134         TNC_Result (*Terminate)(TNC_IMVID imvID);
 135         TNC_Result (*ProvideBindFunction)(
 136                 TNC_IMVID imvID,
 137                 TNC_TNCS_BindFunctionPointer bindFunction);
 138 };
 139
 140
 141 #define TNC_MAX_IMV_ID 10
 142
 143 struct tncs_data {
 144         struct tncs_data *next;
 145         struct tnc_if_imv *imv; /* local copy of tncs_global_data->imv */
 146         TNC_ConnectionID connectionID;
 147         unsigned int last_batchid;
 148         enum IMV_Action_Recommendation recommendation;
 149         int done;
 150
 151         struct conn_imv {
 152                 u8 *imv_send;
 153                 size_t imv_send_len;
 154                 enum IMV_Action_Recommendation recommendation;
 155                 int recommendation_set;
 156         } imv_data[TNC_MAX_IMV_ID];
 157
 158         char *tncs_message;
 159 };
 160
 161
 162 struct tncs_global {
 163         struct tnc_if_imv *imv;
 164         TNC_ConnectionID next_conn_id;
 165         struct tncs_data *connections;
 166 };
 167
 168 static struct tncs_global *tncs_global_data = NULL;
 169
 170
 171 static struct tnc_if_imv * tncs_get_imv(TNC_IMVID imvID)
 172 {
 173         struct tnc_if_imv *imv;
 174
 175         if (imvID >= TNC_MAX_IMV_ID || tncs_global_data == NULL)
 176                 return NULL;
 177         imv = tncs_global_data->imv;
 178         while (imv) {
 179                 if (imv->imvID == imvID)
 180                         return imv;
 181                 imv = imv->next;
 182         }
 183         return NULL;
 184 }
 185
 186
 187 static struct tncs_data * tncs_get_conn(TNC_ConnectionID connectionID)
 188 {
 189         struct tncs_data *tncs;
 190
 191         if (tncs_global_data == NULL)
 192                 return NULL;
 193
 194         tncs = tncs_global_data->connections;
 195         while (tncs) {
 196                 if (tncs->connectionID == connectionID)
 197                         return tncs;
 198                 tncs = tncs->next;
 199         }
 200
 201         wpa_printf(MSG_DEBUG, "TNC: Connection ID %lu not found",
 202                    (unsigned long) connectionID);
 203
 204         return NULL;
 205 }
 206
 207
 208 /* TNCS functions that IMVs can call */
 209 TNC_Result TNC_TNCS_ReportMessageTypes(
 210         TNC_IMVID imvID,
 211         TNC_MessageTypeList supportedTypes,
 212         TNC_UInt32 typeCount)
 213 {
 214         TNC_UInt32 i;
 215         struct tnc_if_imv *imv;
 216
 217         wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_ReportMessageTypes(imvID=%lu "
 218                    "typeCount=%lu)",
 219                    (unsigned long) imvID, (unsigned long) typeCount);
 220
 221         for (i = 0; i < typeCount; i++) {
 222                 wpa_printf(MSG_DEBUG, "TNC: supportedTypes[%lu] = %lu",
 223                            i, supportedTypes[i]);
 224         }
 225
 226         imv = tncs_get_imv(imvID);
 227         if (imv == NULL)
 228                 return TNC_RESULT_INVALID_PARAMETER;
 229         os_free(imv->supported_types);
 230         imv->supported_types =
 231                 os_malloc(typeCount * sizeof(TNC_MessageType));
 232         if (imv->supported_types == NULL)
 233                 return TNC_RESULT_FATAL;
 234         os_memcpy(imv->supported_types, supportedTypes,
 235                   typeCount * sizeof(TNC_MessageType));
 236         imv->num_supported_types = typeCount;
 237
 238         return TNC_RESULT_SUCCESS;
 239 }
 240
 241
 242 TNC_Result TNC_TNCS_SendMessage(
 243         TNC_IMVID imvID,
 244         TNC_ConnectionID connectionID,
 245         TNC_BufferReference message,
 246         TNC_UInt32 messageLength,
 247         TNC_MessageType messageType)
 248 {
 249         struct tncs_data *tncs;
 250         unsigned char *b64;
 251         size_t b64len;
 252
 253         wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_SendMessage(imvID=%lu "
 254                    "connectionID=%lu messageType=%lu)",
 255                    imvID, connectionID, messageType);
 256         wpa_hexdump_ascii(MSG_DEBUG, "TNC: TNC_TNCS_SendMessage",
 257                           message, messageLength);
 258
 259         if (tncs_get_imv(imvID) == NULL)
 260                 return TNC_RESULT_INVALID_PARAMETER;
 261
 262         tncs = tncs_get_conn(connectionID);
 263         if (tncs == NULL)
 264                 return TNC_RESULT_INVALID_PARAMETER;
 265
 266         b64 = base64_encode(message, messageLength, &b64len);
 267         if (b64 == NULL)
 268                 return TNC_RESULT_FATAL;
 269
 270         os_free(tncs->imv_data[imvID].imv_send);
 271         tncs->imv_data[imvID].imv_send_len = 0;
 272         tncs->imv_data[imvID].imv_send = os_zalloc(b64len + 100);
 273         if (tncs->imv_data[imvID].imv_send == NULL) {
 274                 os_free(b64);
 275                 return TNC_RESULT_OTHER;
 276         }
 277
 278         tncs->imv_data[imvID].imv_send_len =
 279                 os_snprintf((char *) tncs->imv_data[imvID].imv_send,
 280                             b64len + 100,
 281                             "<IMC-IMV-Message><Type>%08X</Type>"
 282                             "<Base64>%s</Base64></IMC-IMV-Message>",
 283                             (unsigned int) messageType, b64);
 284
 285         os_free(b64);
 286
 287         return TNC_RESULT_SUCCESS;
 288 }
 289
 290
 291 TNC_Result TNC_TNCS_RequestHandshakeRetry(
 292         TNC_IMVID imvID,
 293         TNC_ConnectionID connectionID,
 294         TNC_RetryReason reason)
 295 {
 296         wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_RequestHandshakeRetry");
 297         /* TODO */
 298         return TNC_RESULT_SUCCESS;
 299 }
 300
 301
 302 TNC_Result TNC_TNCS_ProvideRecommendation(
 303         TNC_IMVID imvID,
 304         TNC_ConnectionID connectionID,
 305         TNC_IMV_Action_Recommendation recommendation,
 306         TNC_IMV_Evaluation_Result evaluation)
 307 {
 308         struct tncs_data *tncs;
 309
 310         wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_ProvideRecommendation(imvID=%lu "
 311                    "connectionID=%lu recommendation=%lu evaluation=%lu)",
 312                    (unsigned long) imvID, (unsigned long) connectionID,
 313                    (unsigned long) recommendation, (unsigned long) evaluation);
 314
 315         if (tncs_get_imv(imvID) == NULL)
 316                 return TNC_RESULT_INVALID_PARAMETER;
 317
 318         tncs = tncs_get_conn(connectionID);
 319         if (tncs == NULL)
 320                 return TNC_RESULT_INVALID_PARAMETER;
 321
 322         tncs->imv_data[imvID].recommendation = recommendation;
 323         tncs->imv_data[imvID].recommendation_set = 1;
 324
 325         return TNC_RESULT_SUCCESS;
 326 }
 327
 328
 329 TNC_Result TNC_TNCS_GetAttribute(
 330         TNC_IMVID imvID,
 331         TNC_ConnectionID connectionID,
 332         TNC_AttributeID attribureID,
 333         TNC_UInt32 bufferLength,
 334         TNC_BufferReference buffer,
 335         TNC_UInt32 *pOutValueLength)
 336 {
 337         wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_GetAttribute");
 338         /* TODO */
 339         return TNC_RESULT_SUCCESS;
 340 }
 341
 342
 343 TNC_Result TNC_TNCS_SetAttribute(
 344         TNC_IMVID imvID,
 345         TNC_ConnectionID connectionID,
 346         TNC_AttributeID attribureID,
 347         TNC_UInt32 bufferLength,
 348         TNC_BufferReference buffer)
 349 {
 350         wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_SetAttribute");
 351         /* TODO */
 352         return TNC_RESULT_SUCCESS;
 353 }
 354
 355
 356 TNC_Result TNC_TNCS_BindFunction(
 357         TNC_IMVID imvID,
 358         char *functionName,
 359         void **pOutFunctionPointer)
 360 {
 361         wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_BindFunction(imcID=%lu, "
 362                    "functionName='%s')", (unsigned long) imvID, functionName);
 363
 364         if (tncs_get_imv(imvID) == NULL)
 365                 return TNC_RESULT_INVALID_PARAMETER;
 366
 367         if (pOutFunctionPointer == NULL)
 368                 return TNC_RESULT_INVALID_PARAMETER;
 369
 370         if (os_strcmp(functionName, "TNC_TNCS_ReportMessageTypes") == 0)
 371                 *pOutFunctionPointer = TNC_TNCS_ReportMessageTypes;
 372         else if (os_strcmp(functionName, "TNC_TNCS_SendMessage") == 0)
 373                 *pOutFunctionPointer = TNC_TNCS_SendMessage;
 374         else if (os_strcmp(functionName, "TNC_TNCS_RequestHandshakeRetry") ==
 375                  0)
 376                 *pOutFunctionPointer = TNC_TNCS_RequestHandshakeRetry;
 377         else if (os_strcmp(functionName, "TNC_TNCS_ProvideRecommendation") ==
 378                  0)
 379                 *pOutFunctionPointer = TNC_TNCS_ProvideRecommendation;
 380         else if (os_strcmp(functionName, "TNC_TNCS_GetAttribute") == 0)
 381                 *pOutFunctionPointer = TNC_TNCS_GetAttribute;
 382         else if (os_strcmp(functionName, "TNC_TNCS_SetAttribute") == 0)
 383                 *pOutFunctionPointer = TNC_TNCS_SetAttribute;
 384         else
 385                 *pOutFunctionPointer = NULL;
 386
 387         return TNC_RESULT_SUCCESS;
 388 }
 389
 390
 391 static void * tncs_get_sym(void *handle, char *func)
 392 {
 393         void *fptr;
 394
 395         fptr = dlsym(handle, func);
 396
 397         return fptr;
 398 }
 399
 400
 401 static int tncs_imv_resolve_funcs(struct tnc_if_imv *imv)
 402 {
 403         void *handle = imv->dlhandle;
 404
 405         /* Mandatory IMV functions */
 406         imv->Initialize = tncs_get_sym(handle, "TNC_IMV_Initialize");
 407         if (imv->Initialize == NULL) {
 408                 wpa_printf(MSG_ERROR, "TNC: IMV does not export "
 409                            "TNC_IMV_Initialize");
 410                 return -1;
 411         }
 412
 413         imv->SolicitRecommendation = tncs_get_sym(
 414                 handle, "TNC_IMV_SolicitRecommendation");
 415         if (imv->SolicitRecommendation == NULL) {
 416                 wpa_printf(MSG_ERROR, "TNC: IMV does not export "
 417                            "TNC_IMV_SolicitRecommendation");
 418                 return -1;
 419         }
 420
 421         imv->ProvideBindFunction =
 422                 tncs_get_sym(handle, "TNC_IMV_ProvideBindFunction");
 423         if (imv->ProvideBindFunction == NULL) {
 424                 wpa_printf(MSG_ERROR, "TNC: IMV does not export "
 425                            "TNC_IMV_ProvideBindFunction");
 426                 return -1;
 427         }
 428
 429         /* Optional IMV functions */
 430         imv->NotifyConnectionChange =
 431                 tncs_get_sym(handle, "TNC_IMV_NotifyConnectionChange");
 432         imv->ReceiveMessage = tncs_get_sym(handle, "TNC_IMV_ReceiveMessage");
 433         imv->BatchEnding = tncs_get_sym(handle, "TNC_IMV_BatchEnding");
 434         imv->Terminate = tncs_get_sym(handle, "TNC_IMV_Terminate");
 435
 436         return 0;
 437 }
 438
 439
 440 static int tncs_imv_initialize(struct tnc_if_imv *imv)
 441 {
 442         TNC_Result res;
 443         TNC_Version imv_ver;
 444
 445         wpa_printf(MSG_DEBUG, "TNC: Calling TNC_IMV_Initialize for IMV '%s'",
 446                    imv->name);
 447         res = imv->Initialize(imv->imvID, TNC_IFIMV_VERSION_1,
 448                               TNC_IFIMV_VERSION_1, &imv_ver);
 449         wpa_printf(MSG_DEBUG, "TNC: TNC_IMV_Initialize: res=%lu imv_ver=%lu",
 450                    (unsigned long) res, (unsigned long) imv_ver);
 451
 452         return res == TNC_RESULT_SUCCESS ? 0 : -1;
 453 }
 454
 455
 456 static int tncs_imv_terminate(struct tnc_if_imv *imv)
 457 {
 458         TNC_Result res;
 459
 460         if (imv->Terminate == NULL)
 461                 return 0;
 462
 463         wpa_printf(MSG_DEBUG, "TNC: Calling TNC_IMV_Terminate for IMV '%s'",
 464                    imv->name);
 465         res = imv->Terminate(imv->imvID);
 466         wpa_printf(MSG_DEBUG, "TNC: TNC_IMV_Terminate: %lu",
 467                    (unsigned long) res);
 468
 469         return res == TNC_RESULT_SUCCESS ? 0 : -1;
 470 }
 471
 472
 473 static int tncs_imv_provide_bind_function(struct tnc_if_imv *imv)
 474 {
 475         TNC_Result res;
 476
 477         wpa_printf(MSG_DEBUG, "TNC: Calling TNC_IMV_ProvideBindFunction for "
 478                    "IMV '%s'", imv->name);
 479         res = imv->ProvideBindFunction(imv->imvID, TNC_TNCS_BindFunction);
 480         wpa_printf(MSG_DEBUG, "TNC: TNC_IMV_ProvideBindFunction: res=%lu",
 481                    (unsigned long) res);
 482
 483         return res == TNC_RESULT_SUCCESS ? 0 : -1;
 484 }
 485
 486
 487 static int tncs_imv_notify_connection_change(struct tnc_if_imv *imv,
 488                                              TNC_ConnectionID conn,
 489                                              TNC_ConnectionState state)
 490 {
 491         TNC_Result res;
 492
 493         if (imv->NotifyConnectionChange == NULL)
 494                 return 0;
 495
 496         wpa_printf(MSG_DEBUG, "TNC: Calling TNC_IMV_NotifyConnectionChange(%d)"
 497                    " for IMV '%s'", (int) state, imv->name);
 498         res = imv->NotifyConnectionChange(imv->imvID, conn, state);
 499         wpa_printf(MSG_DEBUG, "TNC: TNC_IMC_NotifyConnectionChange: %lu",
 500                    (unsigned long) res);
 501
 502         return res == TNC_RESULT_SUCCESS ? 0 : -1;
 503 }
 504
 505
 506 static int tncs_load_imv(struct tnc_if_imv *imv)
 507 {
 508         if (imv->path == NULL) {
 509                 wpa_printf(MSG_DEBUG, "TNC: No IMV configured");
 510                 return -1;
 511         }
 512
 513         wpa_printf(MSG_DEBUG, "TNC: Opening IMV: %s (%s)",
 514                    imv->name, imv->path);
 515         imv->dlhandle = dlopen(imv->path, RTLD_LAZY);
 516         if (imv->dlhandle == NULL) {
 517                 wpa_printf(MSG_ERROR, "TNC: Failed to open IMV '%s' (%s): %s",
 518                            imv->name, imv->path, dlerror());
 519                 return -1;
 520         }
 521
 522         if (tncs_imv_resolve_funcs(imv) < 0) {
 523                 wpa_printf(MSG_ERROR, "TNC: Failed to resolve IMV functions");
 524                 return -1;
 525         }
 526
 527         if (tncs_imv_initialize(imv) < 0 ||
 528             tncs_imv_provide_bind_function(imv) < 0) {
 529                 wpa_printf(MSG_ERROR, "TNC: Failed to initialize IMV");
 530                 return -1;
 531         }
 532
 533         return 0;
 534 }
 535
 536
 537 static void tncs_free_imv(struct tnc_if_imv *imv)
 538 {
 539         os_free(imv->name);
 540         os_free(imv->path);
 541         os_free(imv->supported_types);
 542 }
 543
 544 static void tncs_unload_imv(struct tnc_if_imv *imv)
 545 {
 546         tncs_imv_terminate(imv);
 547
 548         if (imv->dlhandle)
 549                 dlclose(imv->dlhandle);
 550
 551         tncs_free_imv(imv);
 552 }
 553
 554
 555 static int tncs_supported_type(struct tnc_if_imv *imv, unsigned int type)
 556 {
 557         size_t i;
 558         unsigned int vendor, subtype;
 559
 560         if (imv == NULL || imv->supported_types == NULL)
 561                 return 0;
 562
 563         vendor = type >> 8;
 564         subtype = type & 0xff;
 565
 566         for (i = 0; i < imv->num_supported_types; i++) {
 567                 unsigned int svendor, ssubtype;
 568                 svendor = imv->supported_types[i] >> 8;
 569                 ssubtype = imv->supported_types[i] & 0xff;
 570                 if ((vendor == svendor || svendor == TNC_VENDORID_ANY) &&
 571                     (subtype == ssubtype || ssubtype == TNC_SUBTYPE_ANY))
 572                         return 1;
 573         }
 574
 575         return 0;
 576 }
 577
 578
 579 static void tncs_send_to_imvs(struct tncs_data *tncs, unsigned int type,
 580                               const u8 *msg, size_t len)
 581 {
 582         struct tnc_if_imv *imv;
 583         TNC_Result res;
 584
 585         wpa_hexdump_ascii(MSG_MSGDUMP, "TNC: Message to IMV(s)", msg, len);
 586
 587         for (imv = tncs->imv; imv; imv = imv->next) {
 588                 if (imv->ReceiveMessage == NULL ||
 589                     !tncs_supported_type(imv, type))
 590                         continue;
 591
 592                 wpa_printf(MSG_DEBUG, "TNC: Call ReceiveMessage for IMV '%s'",
 593                            imv->name);
 594                 res = imv->ReceiveMessage(imv->imvID, tncs->connectionID,
 595                                           (TNC_BufferReference) msg, len,
 596                                           type);
 597                 wpa_printf(MSG_DEBUG, "TNC: ReceiveMessage: %lu",
 598                            (unsigned long) res);
 599         }
 600 }
 601
 602
 603 static void tncs_batch_ending(struct tncs_data *tncs)
 604 {
 605         struct tnc_if_imv *imv;
 606         TNC_Result res;
 607
 608         for (imv = tncs->imv; imv; imv = imv->next) {
 609                 if (imv->BatchEnding == NULL)
 610                         continue;
 611
 612                 wpa_printf(MSG_DEBUG, "TNC: Call BatchEnding for IMV '%s'",
 613                            imv->name);
 614                 res = imv->BatchEnding(imv->imvID, tncs->connectionID);
 615                 wpa_printf(MSG_DEBUG, "TNC: BatchEnding: %lu",
 616                            (unsigned long) res);
 617         }
 618 }
 619
 620
 621 static void tncs_solicit_recommendation(struct tncs_data *tncs)
 622 {
 623         struct tnc_if_imv *imv;
 624         TNC_Result res;
 625
 626         for (imv = tncs->imv; imv; imv = imv->next) {
 627                 if (tncs->imv_data[imv->imvID].recommendation_set)
 628                         continue;
 629
 630                 wpa_printf(MSG_DEBUG, "TNC: Call SolicitRecommendation for "
 631                            "IMV '%s'", imv->name);
 632                 res = imv->SolicitRecommendation(imv->imvID,
 633                                                  tncs->connectionID);
 634                 wpa_printf(MSG_DEBUG, "TNC: SolicitRecommendation: %lu",
 635                            (unsigned long) res);
 636         }
 637 }
 638
 639
 640 void tncs_init_connection(struct tncs_data *tncs)
 641 {
 642         struct tnc_if_imv *imv;
 643         int i;
 644
 645         for (imv = tncs->imv; imv; imv = imv->next) {
 646                 tncs_imv_notify_connection_change(
 647                         imv, tncs->connectionID, TNC_CONNECTION_STATE_CREATE);
 648                 tncs_imv_notify_connection_change(
 649                         imv, tncs->connectionID,
 650                         TNC_CONNECTION_STATE_HANDSHAKE);
 651         }
 652
 653         for (i = 0; i < TNC_MAX_IMV_ID; i++) {
 654                 os_free(tncs->imv_data[i].imv_send);
 655                 tncs->imv_data[i].imv_send = NULL;
 656                 tncs->imv_data[i].imv_send_len = 0;
 657         }
 658 }
 659
 660
 661 size_t tncs_total_send_len(struct tncs_data *tncs)
 662 {
 663         int i;
 664         size_t len = 0;
 665
 666         for (i = 0; i < TNC_MAX_IMV_ID; i++)
 667                 len += tncs->imv_data[i].imv_send_len;
 668         if (tncs->tncs_message)
 669                 len += os_strlen(tncs->tncs_message);
 670         return len;
 671 }
 672
 673
 674 u8 * tncs_copy_send_buf(struct tncs_data *tncs, u8 *pos)
 675 {
 676         int i;
 677
 678         for (i = 0; i < TNC_MAX_IMV_ID; i++) {
 679                 if (tncs->imv_data[i].imv_send == NULL)
 680                         continue;
 681
 682                 os_memcpy(pos, tncs->imv_data[i].imv_send,
 683                           tncs->imv_data[i].imv_send_len);
 684                 pos += tncs->imv_data[i].imv_send_len;
 685                 os_free(tncs->imv_data[i].imv_send);
 686                 tncs->imv_data[i].imv_send = NULL;
 687                 tncs->imv_data[i].imv_send_len = 0;
 688         }
 689
 690         if (tncs->tncs_message) {
 691                 size_t len = os_strlen(tncs->tncs_message);
 692                 os_memcpy(pos, tncs->tncs_message, len);
 693                 pos += len;
 694                 os_free(tncs->tncs_message);
 695                 tncs->tncs_message = NULL;
 696         }
 697
 698         return pos;
 699 }
 700
 701
 702 char * tncs_if_tnccs_start(struct tncs_data *tncs)
 703 {
 704         char *buf = os_malloc(1000);
 705         if (buf == NULL)
 706                 return NULL;
 707         tncs->last_batchid++;
 708         os_snprintf(buf, 1000, IF_TNCCS_START, tncs->last_batchid);
 709         return buf;
 710 }
 711
 712
 713 char * tncs_if_tnccs_end(void)
 714 {
 715         char *buf = os_malloc(100);
 716         if (buf == NULL)
 717                 return NULL;
 718         os_snprintf(buf, 100, IF_TNCCS_END);
 719         return buf;
 720 }
 721
 722
 723 static int tncs_get_type(char *start, unsigned int *type)
 724 {
 725         char *pos = os_strstr(start, "<Type>");
 726         if (pos == NULL)
 727                 return -1;
 728         pos += 6;
 729         *type = strtoul(pos, NULL, 16);
 730         return 0;
 731 }
 732
 733
 734 static unsigned char * tncs_get_base64(char *start, size_t *decoded_len)
 735 {
 736         char *pos, *pos2;
 737         unsigned char *decoded;
 738
 739         pos = os_strstr(start, "<Base64>");
 740         if (pos == NULL)
 741                 return NULL;
 742
 743         pos += 8;
 744         pos2 = os_strstr(pos, "</Base64>");
 745         if (pos2 == NULL)
 746                 return NULL;
 747         *pos2 = '\0';
 748
 749         decoded = base64_decode((unsigned char *) pos, os_strlen(pos),
 750                                 decoded_len);
 751         *pos2 = '<';
 752         if (decoded == NULL) {
 753                 wpa_printf(MSG_DEBUG, "TNC: Failed to decode Base64 data");
 754         }
 755
 756         return decoded;
 757 }
 758
 759
 760 static enum tncs_process_res tncs_derive_recommendation(struct tncs_data *tncs)
 761 {
 762         enum IMV_Action_Recommendation rec;
 763         struct tnc_if_imv *imv;
 764         TNC_ConnectionState state;
 765         char *txt;
 766
 767         wpa_printf(MSG_DEBUG, "TNC: No more messages from IMVs");
 768
 769         if (tncs->done)
 770                 return TNCCS_PROCESS_OK_NO_RECOMMENDATION;
 771
 772         tncs_solicit_recommendation(tncs);
 773
 774         /* Select the most restrictive recommendation */
 775         rec = TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION;
 776         for (imv = tncs->imv; imv; imv = imv->next) {
 777                 TNC_IMV_Action_Recommendation irec;
 778                 irec = tncs->imv_data[imv->imvID].recommendation;
 779                 if (irec == TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS)
 780                         rec = TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS;
 781                 if (irec == TNC_IMV_ACTION_RECOMMENDATION_ISOLATE &&
 782                     rec != TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS)
 783                         rec = TNC_IMV_ACTION_RECOMMENDATION_ISOLATE;
 784                 if (irec == TNC_IMV_ACTION_RECOMMENDATION_ALLOW &&
 785                     rec == TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION)
 786                         rec = TNC_IMV_ACTION_RECOMMENDATION_ALLOW;
 787         }
 788
 789         wpa_printf(MSG_DEBUG, "TNC: Recommendation: %d", rec);
 790         tncs->recommendation = rec;
 791         tncs->done = 1;
 792
 793         txt = NULL;
 794         switch (rec) {
 795         case TNC_IMV_ACTION_RECOMMENDATION_ALLOW:
 796         case TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION:
 797                 txt = "allow";
 798                 state = TNC_CONNECTION_STATE_ACCESS_ALLOWED;
 799                 break;
 800         case TNC_IMV_ACTION_RECOMMENDATION_ISOLATE:
 801                 txt = "isolate";
 802                 state = TNC_CONNECTION_STATE_ACCESS_ISOLATED;
 803                 break;
 804         case TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS:
 805                 txt = "none";
 806                 state = TNC_CONNECTION_STATE_ACCESS_NONE;
 807                 break;
 808         default:
 809                 state = TNC_CONNECTION_STATE_ACCESS_ALLOWED;
 810                 break;
 811         }
 812
 813         if (txt) {
 814                 os_free(tncs->tncs_message);
 815                 tncs->tncs_message = os_zalloc(200);
 816                 if (tncs->tncs_message) {
 817                         os_snprintf(tncs->tncs_message, 199,
 818                                     "<TNCC-TNCS-Message><Type>%08X</Type>"
 819                                     "<XML><TNCCS-Recommendation type=\"%s\">"
 820                                     "</TNCCS-Recommendation></XML>"
 821                                     "</TNCC-TNCS-Message>",
 822                                     TNC_TNCCS_RECOMMENDATION, txt);
 823                 }
 824         }
 825
 826         for (imv = tncs->imv; imv; imv = imv->next) {
 827                 tncs_imv_notify_connection_change(imv, tncs->connectionID,
 828                                                   state);
 829         }
 830
 831         switch (rec) {
 832         case TNC_IMV_ACTION_RECOMMENDATION_ALLOW:
 833                 return TNCCS_RECOMMENDATION_ALLOW;
 834         case TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS:
 835                 return TNCCS_RECOMMENDATION_NO_ACCESS;
 836         case TNC_IMV_ACTION_RECOMMENDATION_ISOLATE:
 837                 return TNCCS_RECOMMENDATION_ISOLATE;
 838         case TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION:
 839                 return TNCCS_RECOMMENDATION_NO_RECOMMENDATION;
 840         default:
 841                 return TNCCS_PROCESS_ERROR;
 842         }
 843 }
 844
 845
 846 enum tncs_process_res tncs_process_if_tnccs(struct tncs_data *tncs,
 847                                             const u8 *msg, size_t len)
 848 {
 849         char *buf, *start, *end, *pos, *pos2, *payload;
 850         unsigned int batch_id;
 851         unsigned char *decoded;
 852         size_t decoded_len;
 853
 854         buf = dup_binstr(msg, len);
 855         if (buf == NULL)
 856                 return TNCCS_PROCESS_ERROR;
 857
 858         start = os_strstr(buf, "<TNCCS-Batch ");
 859         end = os_strstr(buf, "</TNCCS-Batch>");
 860         if (start == NULL || end == NULL || start > end) {
 861                 os_free(buf);
 862                 return TNCCS_PROCESS_ERROR;
 863         }
 864
 865         start += 13;
 866         while (*start == ' ')
 867                 start++;
 868         *end = '\0';
 869
 870         pos = os_strstr(start, "BatchId=");
 871         if (pos == NULL) {
 872                 os_free(buf);
 873                 return TNCCS_PROCESS_ERROR;
 874         }
 875
 876         pos += 8;
 877         if (*pos == '"')
 878                 pos++;
 879         batch_id = atoi(pos);
 880         wpa_printf(MSG_DEBUG, "TNC: Received IF-TNCCS BatchId=%u",
 881                    batch_id);
 882         if (batch_id != tncs->last_batchid + 1) {
 883                 wpa_printf(MSG_DEBUG, "TNC: Unexpected IF-TNCCS BatchId "
 884                            "%u (expected %u)",
 885                            batch_id, tncs->last_batchid + 1);
 886                 os_free(buf);
 887                 return TNCCS_PROCESS_ERROR;
 888         }
 889         tncs->last_batchid = batch_id;
 890
 891         while (*pos != '\0' && *pos != '>')
 892                 pos++;
 893         if (*pos == '\0') {
 894                 os_free(buf);
 895                 return TNCCS_PROCESS_ERROR;
 896         }
 897         pos++;
 898         payload = start;
 899
 900         /*
 901          * <IMC-IMV-Message>
 902          * <Type>01234567</Type>
 903          * <Base64>foo==</Base64>
 904          * </IMC-IMV-Message>
 905          */
 906
 907         while (*start) {
 908                 char *endpos;
 909                 unsigned int type;
 910
 911                 pos = os_strstr(start, "<IMC-IMV-Message>");
 912                 if (pos == NULL)
 913                         break;
 914                 start = pos + 17;
 915                 end = os_strstr(start, "</IMC-IMV-Message>");
 916                 if (end == NULL)
 917                         break;
 918                 *end = '\0';
 919                 endpos = end;
 920                 end += 18;
 921
 922                 if (tncs_get_type(start, &type) < 0) {
 923                         *endpos = '<';
 924                         start = end;
 925                         continue;
 926                 }
 927                 wpa_printf(MSG_DEBUG, "TNC: IMC-IMV-Message Type 0x%x", type);
 928
 929                 decoded = tncs_get_base64(start, &decoded_len);
 930                 if (decoded == NULL) {
 931                         *endpos = '<';
 932                         start = end;
 933                         continue;
 934                 }
 935
 936                 tncs_send_to_imvs(tncs, type, decoded, decoded_len);
 937
 938                 os_free(decoded);
 939
 940                 start = end;
 941         }
 942
 943         /*
 944          * <TNCC-TNCS-Message>
 945          * <Type>01234567</Type>
 946          * <XML><TNCCS-Foo type="foo"></TNCCS-Foo></XML>
 947          * <Base64>foo==</Base64>
 948          * </TNCC-TNCS-Message>
 949          */
 950
 951         start = payload;
 952         while (*start) {
 953                 unsigned int type;
 954                 char *xml, *xmlend, *endpos;
 955
 956                 pos = os_strstr(start, "<TNCC-TNCS-Message>");
 957                 if (pos == NULL)
 958                         break;
 959                 start = pos + 19;
 960                 end = os_strstr(start, "</TNCC-TNCS-Message>");
 961                 if (end == NULL)
 962                         break;
 963                 *end = '\0';
 964                 endpos = end;
 965                 end += 20;
 966
 967                 if (tncs_get_type(start, &type) < 0) {
 968                         *endpos = '<';
 969                         start = end;
 970                         continue;
 971                 }
 972                 wpa_printf(MSG_DEBUG, "TNC: TNCC-TNCS-Message Type 0x%x",
 973                            type);
 974
 975                 /* Base64 OR XML */
 976                 decoded = NULL;
 977                 xml = NULL;
 978                 xmlend = NULL;
 979                 pos = os_strstr(start, "<XML>");
 980                 if (pos) {
 981                         pos += 5;
 982                         pos2 = os_strstr(pos, "</XML>");
 983                         if (pos2 == NULL) {
 984                                 *endpos = '<';
 985                                 start = end;
 986                                 continue;
 987                         }
 988                         xmlend = pos2;
 989                         xml = pos;
 990                 } else {
 991                         decoded = tncs_get_base64(start, &decoded_len);
 992                         if (decoded == NULL) {
 993                                 *endpos = '<';
 994                                 start = end;
 995                                 continue;
 996                         }
 997                 }
 998
 999                 if (decoded) {
1000                         wpa_hexdump_ascii(MSG_MSGDUMP,
1001                                           "TNC: TNCC-TNCS-Message Base64",
1002                                           decoded, decoded_len);
1003                         os_free(decoded);
1004                 }
1005
1006                 if (xml) {
1007                         wpa_hexdump_ascii(MSG_MSGDUMP,
1008                                           "TNC: TNCC-TNCS-Message XML",
1009                                           (unsigned char *) xml,
1010                                           xmlend - xml);
1011                 }
1012
1013                 start = end;
1014         }
1015
1016         os_free(buf);
1017
1018         tncs_batch_ending(tncs);
1019
1020         if (tncs_total_send_len(tncs) == 0)
1021                 return tncs_derive_recommendation(tncs);
1022
1023         return TNCCS_PROCESS_OK_NO_RECOMMENDATION;
1024 }
1025
1026
1027 static struct tnc_if_imv * tncs_parse_imv(int id, char *start, char *end,
1028                                           int *error)
1029 {
1030         struct tnc_if_imv *imv;
1031         char *pos, *pos2;
1032
1033         if (id >= TNC_MAX_IMV_ID) {
1034                 wpa_printf(MSG_DEBUG, "TNC: Too many IMVs");
1035                 return NULL;
1036         }
1037
1038         imv = os_zalloc(sizeof(*imv));
1039         if (imv == NULL) {
1040                 *error = 1;
1041                 return NULL;
1042         }
1043
1044         imv->imvID = id;
1045
1046         pos = start;
1047         wpa_printf(MSG_DEBUG, "TNC: Configured IMV: %s", pos);
1048         if (pos + 1 >= end || *pos != '"') {
1049                 wpa_printf(MSG_ERROR, "TNC: Ignoring invalid IMV line '%s' "
1050                            "(no starting quotation mark)", start);
1051                 os_free(imv);
1052                 return NULL;
1053         }
1054
1055         pos++;
1056         pos2 = pos;
1057         while (pos2 < end && *pos2 != '"')
1058                 pos2++;
1059         if (pos2 >= end) {
1060                 wpa_printf(MSG_ERROR, "TNC: Ignoring invalid IMV line '%s' "
1061                            "(no ending quotation mark)", start);
1062                 os_free(imv);
1063                 return NULL;
1064         }
1065         *pos2 = '\0';
1066         wpa_printf(MSG_DEBUG, "TNC: Name: '%s'", pos);
1067         imv->name = os_strdup(pos);
1068
1069         pos = pos2 + 1;
1070         if (pos >= end || *pos != ' ') {
1071                 wpa_printf(MSG_ERROR, "TNC: Ignoring invalid IMV line '%s' "
1072                            "(no space after name)", start);
1073                 os_free(imv);
1074                 return NULL;
1075         }
1076
1077         pos++;
1078         wpa_printf(MSG_DEBUG, "TNC: IMV file: '%s'", pos);
1079         imv->path = os_strdup(pos);
1080
1081         return imv;
1082 }
1083
1084
1085 static int tncs_read_config(struct tncs_global *global)
1086 {
1087         char *config, *end, *pos, *line_end;
1088         size_t config_len;
1089         struct tnc_if_imv *imv, *last;
1090         int id = 0;
1091
1092         last = NULL;
1093
1094         config = os_readfile(TNC_CONFIG_FILE, &config_len);
1095         if (config == NULL) {
1096                 wpa_printf(MSG_ERROR, "TNC: Could not open TNC configuration "
1097                            "file '%s'", TNC_CONFIG_FILE);
1098                 return -1;
1099         }
1100
1101         end = config + config_len;
1102         for (pos = config; pos < end; pos = line_end + 1) {
1103                 line_end = pos;
1104                 while (*line_end != '\n' && *line_end != '\r' &&
1105                        line_end < end)
1106                         line_end++;
1107                 *line_end = '\0';
1108
1109                 if (os_strncmp(pos, "IMV ", 4) == 0) {
1110                         int error = 0;
1111
1112                         imv = tncs_parse_imv(id++, pos + 4, line_end, &error);
1113                         if (error)
1114                                 return -1;
1115                         if (imv) {
1116                                 if (last == NULL)
1117                                         global->imv = imv;
1118                                 else
1119                                         last->next = imv;
1120                                 last = imv;
1121                         }
1122                 }
1123         }
1124
1125         os_free(config);
1126
1127         return 0;
1128 }
1129
1130
1131 struct tncs_data * tncs_init(void)
1132 {
1133         struct tncs_data *tncs;
1134
1135         if (tncs_global_data == NULL)
1136                 return NULL;
1137
1138         tncs = os_zalloc(sizeof(*tncs));
1139         if (tncs == NULL)
1140                 return NULL;
1141         tncs->imv = tncs_global_data->imv;
1142         tncs->connectionID = tncs_global_data->next_conn_id++;
1143         tncs->next = tncs_global_data->connections;
1144         tncs_global_data->connections = tncs;
1145
1146         return tncs;
1147 }
1148
1149
1150 void tncs_deinit(struct tncs_data *tncs)
1151 {
1152         int i;
1153         struct tncs_data *prev, *conn;
1154
1155         if (tncs == NULL)
1156                 return;
1157
1158         for (i = 0; i < TNC_MAX_IMV_ID; i++)
1159                 os_free(tncs->imv_data[i].imv_send);
1160
1161         prev = NULL;
1162         conn = tncs_global_data->connections;
1163         while (conn) {
1164                 if (conn == tncs) {
1165                         if (prev)
1166                                 prev->next = tncs->next;
1167                         else
1168                                 tncs_global_data->connections = tncs->next;
1169                         break;
1170                 }
1171                 prev = conn;
1172                 conn = conn->next;
1173         }
1174
1175         os_free(tncs->tncs_message);
1176         os_free(tncs);
1177 }
1178
1179
1180 int tncs_global_init(void)
1181 {
1182         struct tnc_if_imv *imv;
1183
1184         tncs_global_data = os_zalloc(sizeof(*tncs_global_data));
1185         if (tncs_global_data == NULL)
1186                 return -1;
1187
1188         if (tncs_read_config(tncs_global_data) < 0) {
1189                 wpa_printf(MSG_ERROR, "TNC: Failed to read TNC configuration");
1190                 goto failed;
1191         }
1192
1193         for (imv = tncs_global_data->imv; imv; imv = imv->next) {
1194                 if (tncs_load_imv(imv)) {
1195                         wpa_printf(MSG_ERROR, "TNC: Failed to load IMV '%s'",
1196                                    imv->name);
1197                         goto failed;
1198                 }
1199         }
1200
1201         return 0;
1202
1203 failed:
1204         tncs_global_deinit();
1205         return -1;
1206 }
1207
1208
1209 void tncs_global_deinit(void)
1210 {
1211         struct tnc_if_imv *imv, *prev;
1212
1213         if (tncs_global_data == NULL)
1214                 return;
1215
1216         imv = tncs_global_data->imv;
1217         while (imv) {
1218                 tncs_unload_imv(imv);
1219
1220                 prev = imv;
1221                 imv = imv->next;
1222                 os_free(prev);
1223         }
1224
1225         os_free(tncs_global_data);
1226         tncs_global_data = NULL;
1227 }
1228
1229
1230 struct wpabuf * tncs_build_soh_request(void)
1231 {
1232         struct wpabuf *buf;
1233
1234         /*
1235          * Build a SoH Request TLV (to be used inside SoH EAP Extensions
1236          * Method)
1237          */
1238
1239         buf = wpabuf_alloc(8 + 4);
1240         if (buf == NULL)
1241                 return NULL;
1242
1243         /* Vendor-Specific TLV (Microsoft) - SoH Request */
1244         wpabuf_put_be16(buf, EAP_TLV_VENDOR_SPECIFIC_TLV); /* TLV Type */
1245         wpabuf_put_be16(buf, 8); /* Length */
1246
1247         wpabuf_put_be32(buf, EAP_VENDOR_MICROSOFT); /* Vendor_Id */
1248
1249         wpabuf_put_be16(buf, 0x02); /* TLV Type - SoH Request TLV */
1250         wpabuf_put_be16(buf, 0); /* Length */
1251
1252         return buf;
1253 }
1254
1255
1256 struct wpabuf * tncs_process_soh(const u8 *soh_tlv, size_t soh_tlv_len,
1257                                  int *failure)
1258 {
1259         wpa_hexdump(MSG_DEBUG, "TNC: SoH TLV", soh_tlv, soh_tlv_len);
1260         *failure = 0;
1261
1262         /* TODO: return MS-SoH Response TLV */
1263
1264         return NULL;
1265 }