contrib/hostapd/src/eap_server/tncs.c

   1 /*
   2  * EAP-TNC - TNCS (IF-IMV, IF-TNCCS, and IF-TNCCS-SOH)
   3  * Copyright (c) 2007-2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16 #include <dlfcn.h>
  17
  18 #include "common.h"
  19 #include "base64.h"
  20 #include "tncs.h"
  21 #include "eap_common/eap_tlv_common.h"
  22 #include "eap_common/eap_defs.h"
  23
  24
  25 /* TODO: TNCS must be thread-safe; review the code and add locking etc. if
  26  * needed.. */
  27
  28 #define TNC_CONFIG_FILE "/etc/tnc_config"
  29 #define IF_TNCCS_START \
  30 "<?xml version=\"1.0\"?>\n" \
  31 "<TNCCS-Batch BatchId=\"%d\" Recipient=\"TNCS\" " \
  32 "xmlns=\"http://www.trustedcomputinggroup.org/IWG/TNC/1_0/IF_TNCCS#\" " \
  33 "xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" " \
  34 "xsi:schemaLocation=\"http://www.trustedcomputinggroup.org/IWG/TNC/1_0/" \
  35 "IF_TNCCS# https://www.trustedcomputinggroup.org/XML/SCHEMA/TNCCS_1.0.xsd\">\n"
  36 #define IF_TNCCS_END "\n</TNCCS-Batch>"
  37
  38 /* TNC IF-IMV */
  39
  40 typedef unsigned long TNC_UInt32;
  41 typedef unsigned char *TNC_BufferReference;
  42
  43 typedef TNC_UInt32 TNC_IMVID;
  44 typedef TNC_UInt32 TNC_ConnectionID;
  45 typedef TNC_UInt32 TNC_ConnectionState;
  46 typedef TNC_UInt32 TNC_RetryReason;
  47 typedef TNC_UInt32 TNC_IMV_Action_Recommendation;
  48 typedef TNC_UInt32 TNC_IMV_Evaluation_Result;
  49 typedef TNC_UInt32 TNC_MessageType;
  50 typedef TNC_MessageType *TNC_MessageTypeList;
  51 typedef TNC_UInt32 TNC_VendorID;
  52 typedef TNC_UInt32 TNC_Subtype;
  53 typedef TNC_UInt32 TNC_Version;
  54 typedef TNC_UInt32 TNC_Result;
  55 typedef TNC_UInt32 TNC_AttributeID;
  56
  57 typedef TNC_Result (*TNC_TNCS_BindFunctionPointer)(
  58         TNC_IMVID imvID,
  59         char *functionName,
  60         void **pOutfunctionPointer);
  61
  62 #define TNC_RESULT_SUCCESS 0
  63 #define TNC_RESULT_NOT_INITIALIZED 1
  64 #define TNC_RESULT_ALREADY_INITIALIZED 2
  65 #define TNC_RESULT_NO_COMMON_VERSION 3
  66 #define TNC_RESULT_CANT_RETRY 4
  67 #define TNC_RESULT_WONT_RETRY 5
  68 #define TNC_RESULT_INVALID_PARAMETER 6
  69 #define TNC_RESULT_CANT_RESPOND 7
  70 #define TNC_RESULT_ILLEGAL_OPERATION 8
  71 #define TNC_RESULT_OTHER 9
  72 #define TNC_RESULT_FATAL 10
  73
  74 #define TNC_CONNECTION_STATE_CREATE 0
  75 #define TNC_CONNECTION_STATE_HANDSHAKE 1
  76 #define TNC_CONNECTION_STATE_ACCESS_ALLOWED 2
  77 #define TNC_CONNECTION_STATE_ACCESS_ISOLATED 3
  78 #define TNC_CONNECTION_STATE_ACCESS_NONE 4
  79 #define TNC_CONNECTION_STATE_DELETE 5
  80
  81 #define TNC_IFIMV_VERSION_1 1
  82
  83 #define TNC_VENDORID_ANY ((TNC_VendorID) 0xffffff)
  84 #define TNC_SUBTYPE_ANY ((TNC_Subtype) 0xff)
  85
  86 /* TNCC-TNCS Message Types */
  87 #define TNC_TNCCS_RECOMMENDATION                0x00000001
  88 #define TNC_TNCCS_ERROR                         0x00000002
  89 #define TNC_TNCCS_PREFERREDLANGUAGE             0x00000003
  90 #define TNC_TNCCS_REASONSTRINGS                 0x00000004
  91
  92 /* Possible TNC_IMV_Action_Recommendation values: */
  93 enum IMV_Action_Recommendation {
  94         TNC_IMV_ACTION_RECOMMENDATION_ALLOW,
  95         TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS,
  96         TNC_IMV_ACTION_RECOMMENDATION_ISOLATE,
  97         TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION
  98 };
  99
 100 /* Possible TNC_IMV_Evaluation_Result values: */
 101 enum IMV_Evaluation_Result {
 102         TNC_IMV_EVALUATION_RESULT_COMPLIANT,
 103         TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR,
 104         TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR,
 105         TNC_IMV_EVALUATION_RESULT_ERROR,
 106         TNC_IMV_EVALUATION_RESULT_DONT_KNOW
 107 };
 108
 109 struct tnc_if_imv {
 110         struct tnc_if_imv *next;
 111         char *name;
 112         char *path;
 113         void *dlhandle; /* from dlopen() */
 114         TNC_IMVID imvID;
 115         TNC_MessageTypeList supported_types;
 116         size_t num_supported_types;
 117
 118         /* Functions implemented by IMVs (with TNC_IMV_ prefix) */
 119         TNC_Result (*Initialize)(
 120                 TNC_IMVID imvID,
 121                 TNC_Version minVersion,
 122                 TNC_Version maxVersion,
 123                 TNC_Version *pOutActualVersion);
 124         TNC_Result (*NotifyConnectionChange)(
 125                 TNC_IMVID imvID,
 126                 TNC_ConnectionID connectionID,
 127                 TNC_ConnectionState newState);
 128         TNC_Result (*ReceiveMessage)(
 129                 TNC_IMVID imvID,
 130                 TNC_ConnectionID connectionID,
 131                 TNC_BufferReference message,
 132                 TNC_UInt32 messageLength,
 133                 TNC_MessageType messageType);
 134         TNC_Result (*SolicitRecommendation)(
 135                 TNC_IMVID imvID,
 136                 TNC_ConnectionID connectionID);
 137         TNC_Result (*BatchEnding)(
 138                 TNC_IMVID imvID,
 139                 TNC_ConnectionID connectionID);
 140         TNC_Result (*Terminate)(TNC_IMVID imvID);
 141         TNC_Result (*ProvideBindFunction)(
 142                 TNC_IMVID imvID,
 143                 TNC_TNCS_BindFunctionPointer bindFunction);
 144 };
 145
 146
 147 #define TNC_MAX_IMV_ID 10
 148
 149 struct tncs_data {
 150         struct tncs_data *next;
 151         struct tnc_if_imv *imv; /* local copy of tncs_global_data->imv */
 152         TNC_ConnectionID connectionID;
 153         unsigned int last_batchid;
 154         enum IMV_Action_Recommendation recommendation;
 155         int done;
 156
 157         struct conn_imv {
 158                 u8 *imv_send;
 159                 size_t imv_send_len;
 160                 enum IMV_Action_Recommendation recommendation;
 161                 int recommendation_set;
 162         } imv_data[TNC_MAX_IMV_ID];
 163
 164         char *tncs_message;
 165 };
 166
 167
 168 struct tncs_global {
 169         struct tnc_if_imv *imv;
 170         TNC_ConnectionID next_conn_id;
 171         struct tncs_data *connections;
 172 };
 173
 174 static struct tncs_global *tncs_global_data = NULL;
 175
 176
 177 static struct tnc_if_imv * tncs_get_imv(TNC_IMVID imvID)
 178 {
 179         struct tnc_if_imv *imv;
 180
 181         if (imvID >= TNC_MAX_IMV_ID || tncs_global_data == NULL)
 182                 return NULL;
 183         imv = tncs_global_data->imv;
 184         while (imv) {
 185                 if (imv->imvID == imvID)
 186                         return imv;
 187                 imv = imv->next;
 188         }
 189         return NULL;
 190 }
 191
 192
 193 static struct tncs_data * tncs_get_conn(TNC_ConnectionID connectionID)
 194 {
 195         struct tncs_data *tncs;
 196
 197         if (tncs_global_data == NULL)
 198                 return NULL;
 199
 200         tncs = tncs_global_data->connections;
 201         while (tncs) {
 202                 if (tncs->connectionID == connectionID)
 203                         return tncs;
 204                 tncs = tncs->next;
 205         }
 206
 207         wpa_printf(MSG_DEBUG, "TNC: Connection ID %lu not found",
 208                    (unsigned long) connectionID);
 209
 210         return NULL;
 211 }
 212
 213
 214 /* TNCS functions that IMVs can call */
 215 TNC_Result TNC_TNCS_ReportMessageTypes(
 216         TNC_IMVID imvID,
 217         TNC_MessageTypeList supportedTypes,
 218         TNC_UInt32 typeCount)
 219 {
 220         TNC_UInt32 i;
 221         struct tnc_if_imv *imv;
 222
 223         wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_ReportMessageTypes(imvID=%lu "
 224                    "typeCount=%lu)",
 225                    (unsigned long) imvID, (unsigned long) typeCount);
 226
 227         for (i = 0; i < typeCount; i++) {
 228                 wpa_printf(MSG_DEBUG, "TNC: supportedTypes[%lu] = %lu",
 229                            i, supportedTypes[i]);
 230         }
 231
 232         imv = tncs_get_imv(imvID);
 233         if (imv == NULL)
 234                 return TNC_RESULT_INVALID_PARAMETER;
 235         os_free(imv->supported_types);
 236         imv->supported_types =
 237                 os_malloc(typeCount * sizeof(TNC_MessageTypeList));
 238         if (imv->supported_types == NULL)
 239                 return TNC_RESULT_FATAL;
 240         os_memcpy(imv->supported_types, supportedTypes,
 241                   typeCount * sizeof(TNC_MessageTypeList));
 242         imv->num_supported_types = typeCount;
 243
 244         return TNC_RESULT_SUCCESS;
 245 }
 246
 247
 248 TNC_Result TNC_TNCS_SendMessage(
 249         TNC_IMVID imvID,
 250         TNC_ConnectionID connectionID,
 251         TNC_BufferReference message,
 252         TNC_UInt32 messageLength,
 253         TNC_MessageType messageType)
 254 {
 255         struct tncs_data *tncs;
 256         unsigned char *b64;
 257         size_t b64len;
 258
 259         wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_SendMessage(imvID=%lu "
 260                    "connectionID=%lu messageType=%lu)",
 261                    imvID, connectionID, messageType);
 262         wpa_hexdump_ascii(MSG_DEBUG, "TNC: TNC_TNCS_SendMessage",
 263                           message, messageLength);
 264
 265         if (tncs_get_imv(imvID) == NULL)
 266                 return TNC_RESULT_INVALID_PARAMETER;
 267
 268         tncs = tncs_get_conn(connectionID);
 269         if (tncs == NULL)
 270                 return TNC_RESULT_INVALID_PARAMETER;
 271
 272         b64 = base64_encode(message, messageLength, &b64len);
 273         if (b64 == NULL)
 274                 return TNC_RESULT_FATAL;
 275
 276         os_free(tncs->imv_data[imvID].imv_send);
 277         tncs->imv_data[imvID].imv_send_len = 0;
 278         tncs->imv_data[imvID].imv_send = os_zalloc(b64len + 100);
 279         if (tncs->imv_data[imvID].imv_send == NULL) {
 280                 os_free(b64);
 281                 return TNC_RESULT_OTHER;
 282         }
 283
 284         tncs->imv_data[imvID].imv_send_len =
 285                 os_snprintf((char *) tncs->imv_data[imvID].imv_send,
 286                             b64len + 100,
 287                             "<IMC-IMV-Message><Type>%08X</Type>"
 288                             "<Base64>%s</Base64></IMC-IMV-Message>",
 289                             (unsigned int) messageType, b64);
 290
 291         os_free(b64);
 292
 293         return TNC_RESULT_SUCCESS;
 294 }
 295
 296
 297 TNC_Result TNC_TNCS_RequestHandshakeRetry(
 298         TNC_IMVID imvID,
 299         TNC_ConnectionID connectionID,
 300         TNC_RetryReason reason)
 301 {
 302         wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_RequestHandshakeRetry");
 303         /* TODO */
 304         return TNC_RESULT_SUCCESS;
 305 }
 306
 307
 308 TNC_Result TNC_TNCS_ProvideRecommendation(
 309         TNC_IMVID imvID,
 310         TNC_ConnectionID connectionID,
 311         TNC_IMV_Action_Recommendation recommendation,
 312         TNC_IMV_Evaluation_Result evaluation)
 313 {
 314         struct tncs_data *tncs;
 315
 316         wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_ProvideRecommendation(imvID=%lu "
 317                    "connectionID=%lu recommendation=%lu evaluation=%lu)",
 318                    (unsigned long) imvID, (unsigned long) connectionID,
 319                    (unsigned long) recommendation, (unsigned long) evaluation);
 320
 321         if (tncs_get_imv(imvID) == NULL)
 322                 return TNC_RESULT_INVALID_PARAMETER;
 323
 324         tncs = tncs_get_conn(connectionID);
 325         if (tncs == NULL)
 326                 return TNC_RESULT_INVALID_PARAMETER;
 327
 328         tncs->imv_data[imvID].recommendation = recommendation;
 329         tncs->imv_data[imvID].recommendation_set = 1;
 330
 331         return TNC_RESULT_SUCCESS;
 332 }
 333
 334
 335 TNC_Result TNC_TNCS_GetAttribute(
 336         TNC_IMVID imvID,
 337         TNC_ConnectionID connectionID,
 338         TNC_AttributeID attribureID,
 339         TNC_UInt32 bufferLength,
 340         TNC_BufferReference buffer,
 341         TNC_UInt32 *pOutValueLength)
 342 {
 343         wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_GetAttribute");
 344         /* TODO */
 345         return TNC_RESULT_SUCCESS;
 346 }
 347
 348
 349 TNC_Result TNC_TNCS_SetAttribute(
 350         TNC_IMVID imvID,
 351         TNC_ConnectionID connectionID,
 352         TNC_AttributeID attribureID,
 353         TNC_UInt32 bufferLength,
 354         TNC_BufferReference buffer)
 355 {
 356         wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_SetAttribute");
 357         /* TODO */
 358         return TNC_RESULT_SUCCESS;
 359 }
 360
 361
 362 TNC_Result TNC_TNCS_BindFunction(
 363         TNC_IMVID imvID,
 364         char *functionName,
 365         void **pOutFunctionPointer)
 366 {
 367         wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_BindFunction(imcID=%lu, "
 368                    "functionName='%s')", (unsigned long) imvID, functionName);
 369
 370         if (tncs_get_imv(imvID) == NULL)
 371                 return TNC_RESULT_INVALID_PARAMETER;
 372
 373         if (pOutFunctionPointer == NULL)
 374                 return TNC_RESULT_INVALID_PARAMETER;
 375
 376         if (os_strcmp(functionName, "TNC_TNCS_ReportMessageTypes") == 0)
 377                 *pOutFunctionPointer = TNC_TNCS_ReportMessageTypes;
 378         else if (os_strcmp(functionName, "TNC_TNCS_SendMessage") == 0)
 379                 *pOutFunctionPointer = TNC_TNCS_SendMessage;
 380         else if (os_strcmp(functionName, "TNC_TNCS_RequestHandshakeRetry") ==
 381                  0)
 382                 *pOutFunctionPointer = TNC_TNCS_RequestHandshakeRetry;
 383         else if (os_strcmp(functionName, "TNC_TNCS_ProvideRecommendation") ==
 384                  0)
 385                 *pOutFunctionPointer = TNC_TNCS_ProvideRecommendation;
 386         else if (os_strcmp(functionName, "TNC_TNCS_GetAttribute") == 0)
 387                 *pOutFunctionPointer = TNC_TNCS_GetAttribute;
 388         else if (os_strcmp(functionName, "TNC_TNCS_SetAttribute") == 0)
 389                 *pOutFunctionPointer = TNC_TNCS_SetAttribute;
 390         else
 391                 *pOutFunctionPointer = NULL;
 392
 393         return TNC_RESULT_SUCCESS;
 394 }
 395
 396
 397 static void * tncs_get_sym(void *handle, char *func)
 398 {
 399         void *fptr;
 400
 401         fptr = dlsym(handle, func);
 402
 403         return fptr;
 404 }
 405
 406
 407 static int tncs_imv_resolve_funcs(struct tnc_if_imv *imv)
 408 {
 409         void *handle = imv->dlhandle;
 410
 411         /* Mandatory IMV functions */
 412         imv->Initialize = tncs_get_sym(handle, "TNC_IMV_Initialize");
 413         if (imv->Initialize == NULL) {
 414                 wpa_printf(MSG_ERROR, "TNC: IMV does not export "
 415                            "TNC_IMV_Initialize");
 416                 return -1;
 417         }
 418
 419         imv->SolicitRecommendation = tncs_get_sym(
 420                 handle, "TNC_IMV_SolicitRecommendation");
 421         if (imv->SolicitRecommendation == NULL) {
 422                 wpa_printf(MSG_ERROR, "TNC: IMV does not export "
 423                            "TNC_IMV_SolicitRecommendation");
 424                 return -1;
 425         }
 426
 427         imv->ProvideBindFunction =
 428                 tncs_get_sym(handle, "TNC_IMV_ProvideBindFunction");
 429         if (imv->ProvideBindFunction == NULL) {
 430                 wpa_printf(MSG_ERROR, "TNC: IMV does not export "
 431                            "TNC_IMV_ProvideBindFunction");
 432                 return -1;
 433         }
 434
 435         /* Optional IMV functions */
 436         imv->NotifyConnectionChange =
 437                 tncs_get_sym(handle, "TNC_IMV_NotifyConnectionChange");
 438         imv->ReceiveMessage = tncs_get_sym(handle, "TNC_IMV_ReceiveMessage");
 439         imv->BatchEnding = tncs_get_sym(handle, "TNC_IMV_BatchEnding");
 440         imv->Terminate = tncs_get_sym(handle, "TNC_IMV_Terminate");
 441
 442         return 0;
 443 }
 444
 445
 446 static int tncs_imv_initialize(struct tnc_if_imv *imv)
 447 {
 448         TNC_Result res;
 449         TNC_Version imv_ver;
 450
 451         wpa_printf(MSG_DEBUG, "TNC: Calling TNC_IMV_Initialize for IMV '%s'",
 452                    imv->name);
 453         res = imv->Initialize(imv->imvID, TNC_IFIMV_VERSION_1,
 454                               TNC_IFIMV_VERSION_1, &imv_ver);
 455         wpa_printf(MSG_DEBUG, "TNC: TNC_IMV_Initialize: res=%lu imv_ver=%lu",
 456                    (unsigned long) res, (unsigned long) imv_ver);
 457
 458         return res == TNC_RESULT_SUCCESS ? 0 : -1;
 459 }
 460
 461
 462 static int tncs_imv_terminate(struct tnc_if_imv *imv)
 463 {
 464         TNC_Result res;
 465
 466         if (imv->Terminate == NULL)
 467                 return 0;
 468
 469         wpa_printf(MSG_DEBUG, "TNC: Calling TNC_IMV_Terminate for IMV '%s'",
 470                    imv->name);
 471         res = imv->Terminate(imv->imvID);
 472         wpa_printf(MSG_DEBUG, "TNC: TNC_IMV_Terminate: %lu",
 473                    (unsigned long) res);
 474
 475         return res == TNC_RESULT_SUCCESS ? 0 : -1;
 476 }
 477
 478
 479 static int tncs_imv_provide_bind_function(struct tnc_if_imv *imv)
 480 {
 481         TNC_Result res;
 482
 483         wpa_printf(MSG_DEBUG, "TNC: Calling TNC_IMV_ProvideBindFunction for "
 484                    "IMV '%s'", imv->name);
 485         res = imv->ProvideBindFunction(imv->imvID, TNC_TNCS_BindFunction);
 486         wpa_printf(MSG_DEBUG, "TNC: TNC_IMV_ProvideBindFunction: res=%lu",
 487                    (unsigned long) res);
 488
 489         return res == TNC_RESULT_SUCCESS ? 0 : -1;
 490 }
 491
 492
 493 static int tncs_imv_notify_connection_change(struct tnc_if_imv *imv,
 494                                              TNC_ConnectionID conn,
 495                                              TNC_ConnectionState state)
 496 {
 497         TNC_Result res;
 498
 499         if (imv->NotifyConnectionChange == NULL)
 500                 return 0;
 501
 502         wpa_printf(MSG_DEBUG, "TNC: Calling TNC_IMV_NotifyConnectionChange(%d)"
 503                    " for IMV '%s'", (int) state, imv->name);
 504         res = imv->NotifyConnectionChange(imv->imvID, conn, state);
 505         wpa_printf(MSG_DEBUG, "TNC: TNC_IMC_NotifyConnectionChange: %lu",
 506                    (unsigned long) res);
 507
 508         return res == TNC_RESULT_SUCCESS ? 0 : -1;
 509 }
 510
 511
 512 static int tncs_load_imv(struct tnc_if_imv *imv)
 513 {
 514         if (imv->path == NULL) {
 515                 wpa_printf(MSG_DEBUG, "TNC: No IMV configured");
 516                 return -1;
 517         }
 518
 519         wpa_printf(MSG_DEBUG, "TNC: Opening IMV: %s (%s)",
 520                    imv->name, imv->path);
 521         imv->dlhandle = dlopen(imv->path, RTLD_LAZY);
 522         if (imv->dlhandle == NULL) {
 523                 wpa_printf(MSG_ERROR, "TNC: Failed to open IMV '%s' (%s): %s",
 524                            imv->name, imv->path, dlerror());
 525                 return -1;
 526         }
 527
 528         if (tncs_imv_resolve_funcs(imv) < 0) {
 529                 wpa_printf(MSG_ERROR, "TNC: Failed to resolve IMV functions");
 530                 return -1;
 531         }
 532
 533         if (tncs_imv_initialize(imv) < 0 ||
 534             tncs_imv_provide_bind_function(imv) < 0) {
 535                 wpa_printf(MSG_ERROR, "TNC: Failed to initialize IMV");
 536                 return -1;
 537         }
 538
 539         return 0;
 540 }
 541
 542
 543 static void tncs_free_imv(struct tnc_if_imv *imv)
 544 {
 545         os_free(imv->name);
 546         os_free(imv->path);
 547         os_free(imv->supported_types);
 548 }
 549
 550 static void tncs_unload_imv(struct tnc_if_imv *imv)
 551 {
 552         tncs_imv_terminate(imv);
 553
 554         if (imv->dlhandle)
 555                 dlclose(imv->dlhandle);
 556
 557         tncs_free_imv(imv);
 558 }
 559
 560
 561 static int tncs_supported_type(struct tnc_if_imv *imv, unsigned int type)
 562 {
 563         size_t i;
 564         unsigned int vendor, subtype;
 565
 566         if (imv == NULL || imv->supported_types == NULL)
 567                 return 0;
 568
 569         vendor = type >> 8;
 570         subtype = type & 0xff;
 571
 572         for (i = 0; i < imv->num_supported_types; i++) {
 573                 unsigned int svendor, ssubtype;
 574                 svendor = imv->supported_types[i] >> 8;
 575                 ssubtype = imv->supported_types[i] & 0xff;
 576                 if ((vendor == svendor || svendor == TNC_VENDORID_ANY) &&
 577                     (subtype == ssubtype || ssubtype == TNC_SUBTYPE_ANY))
 578                         return 1;
 579         }
 580
 581         return 0;
 582 }
 583
 584
 585 static void tncs_send_to_imvs(struct tncs_data *tncs, unsigned int type,
 586                               const u8 *msg, size_t len)
 587 {
 588         struct tnc_if_imv *imv;
 589         TNC_Result res;
 590
 591         wpa_hexdump_ascii(MSG_MSGDUMP, "TNC: Message to IMV(s)", msg, len);
 592
 593         for (imv = tncs->imv; imv; imv = imv->next) {
 594                 if (imv->ReceiveMessage == NULL ||
 595                     !tncs_supported_type(imv, type))
 596                         continue;
 597
 598                 wpa_printf(MSG_DEBUG, "TNC: Call ReceiveMessage for IMV '%s'",
 599                            imv->name);
 600                 res = imv->ReceiveMessage(imv->imvID, tncs->connectionID,
 601                                           (TNC_BufferReference) msg, len,
 602                                           type);
 603                 wpa_printf(MSG_DEBUG, "TNC: ReceiveMessage: %lu",
 604                            (unsigned long) res);
 605         }
 606 }
 607
 608
 609 static void tncs_batch_ending(struct tncs_data *tncs)
 610 {
 611         struct tnc_if_imv *imv;
 612         TNC_Result res;
 613
 614         for (imv = tncs->imv; imv; imv = imv->next) {
 615                 if (imv->BatchEnding == NULL)
 616                         continue;
 617
 618                 wpa_printf(MSG_DEBUG, "TNC: Call BatchEnding for IMV '%s'",
 619                            imv->name);
 620                 res = imv->BatchEnding(imv->imvID, tncs->connectionID);
 621                 wpa_printf(MSG_DEBUG, "TNC: BatchEnding: %lu",
 622                            (unsigned long) res);
 623         }
 624 }
 625
 626
 627 static void tncs_solicit_recommendation(struct tncs_data *tncs)
 628 {
 629         struct tnc_if_imv *imv;
 630         TNC_Result res;
 631
 632         for (imv = tncs->imv; imv; imv = imv->next) {
 633                 if (tncs->imv_data[imv->imvID].recommendation_set)
 634                         continue;
 635
 636                 wpa_printf(MSG_DEBUG, "TNC: Call SolicitRecommendation for "
 637                            "IMV '%s'", imv->name);
 638                 res = imv->SolicitRecommendation(imv->imvID,
 639                                                  tncs->connectionID);
 640                 wpa_printf(MSG_DEBUG, "TNC: SolicitRecommendation: %lu",
 641                            (unsigned long) res);
 642         }
 643 }
 644
 645
 646 void tncs_init_connection(struct tncs_data *tncs)
 647 {
 648         struct tnc_if_imv *imv;
 649         int i;
 650
 651         for (imv = tncs->imv; imv; imv = imv->next) {
 652                 tncs_imv_notify_connection_change(
 653                         imv, tncs->connectionID, TNC_CONNECTION_STATE_CREATE);
 654                 tncs_imv_notify_connection_change(
 655                         imv, tncs->connectionID,
 656                         TNC_CONNECTION_STATE_HANDSHAKE);
 657         }
 658
 659         for (i = 0; i < TNC_MAX_IMV_ID; i++) {
 660                 os_free(tncs->imv_data[i].imv_send);
 661                 tncs->imv_data[i].imv_send = NULL;
 662                 tncs->imv_data[i].imv_send_len = 0;
 663         }
 664 }
 665
 666
 667 size_t tncs_total_send_len(struct tncs_data *tncs)
 668 {
 669         int i;
 670         size_t len = 0;
 671
 672         for (i = 0; i < TNC_MAX_IMV_ID; i++)
 673                 len += tncs->imv_data[i].imv_send_len;
 674         if (tncs->tncs_message)
 675                 len += os_strlen(tncs->tncs_message);
 676         return len;
 677 }
 678
 679
 680 u8 * tncs_copy_send_buf(struct tncs_data *tncs, u8 *pos)
 681 {
 682         int i;
 683
 684         for (i = 0; i < TNC_MAX_IMV_ID; i++) {
 685                 if (tncs->imv_data[i].imv_send == NULL)
 686                         continue;
 687
 688                 os_memcpy(pos, tncs->imv_data[i].imv_send,
 689                           tncs->imv_data[i].imv_send_len);
 690                 pos += tncs->imv_data[i].imv_send_len;
 691                 os_free(tncs->imv_data[i].imv_send);
 692                 tncs->imv_data[i].imv_send = NULL;
 693                 tncs->imv_data[i].imv_send_len = 0;
 694         }
 695
 696         if (tncs->tncs_message) {
 697                 size_t len = os_strlen(tncs->tncs_message);
 698                 os_memcpy(pos, tncs->tncs_message, len);
 699                 pos += len;
 700                 os_free(tncs->tncs_message);
 701                 tncs->tncs_message = NULL;
 702         }
 703
 704         return pos;
 705 }
 706
 707
 708 char * tncs_if_tnccs_start(struct tncs_data *tncs)
 709 {
 710         char *buf = os_malloc(1000);
 711         if (buf == NULL)
 712                 return NULL;
 713         tncs->last_batchid++;
 714         os_snprintf(buf, 1000, IF_TNCCS_START, tncs->last_batchid);
 715         return buf;
 716 }
 717
 718
 719 char * tncs_if_tnccs_end(void)
 720 {
 721         char *buf = os_malloc(100);
 722         if (buf == NULL)
 723                 return NULL;
 724         os_snprintf(buf, 100, IF_TNCCS_END);
 725         return buf;
 726 }
 727
 728
 729 static int tncs_get_type(char *start, unsigned int *type)
 730 {
 731         char *pos = os_strstr(start, "<Type>");
 732         if (pos == NULL)
 733                 return -1;
 734         pos += 6;
 735         *type = strtoul(pos, NULL, 16);
 736         return 0;
 737 }
 738
 739
 740 static unsigned char * tncs_get_base64(char *start, size_t *decoded_len)
 741 {
 742         char *pos, *pos2;
 743         unsigned char *decoded;
 744
 745         pos = os_strstr(start, "<Base64>");
 746         if (pos == NULL)
 747                 return NULL;
 748
 749         pos += 8;
 750         pos2 = os_strstr(pos, "</Base64>");
 751         if (pos2 == NULL)
 752                 return NULL;
 753         *pos2 = '\0';
 754
 755         decoded = base64_decode((unsigned char *) pos, os_strlen(pos),
 756                                 decoded_len);
 757         *pos2 = '<';
 758         if (decoded == NULL) {
 759                 wpa_printf(MSG_DEBUG, "TNC: Failed to decode Base64 data");
 760         }
 761
 762         return decoded;
 763 }
 764
 765
 766 static enum tncs_process_res tncs_derive_recommendation(struct tncs_data *tncs)
 767 {
 768         enum IMV_Action_Recommendation rec;
 769         struct tnc_if_imv *imv;
 770         TNC_ConnectionState state;
 771         char *txt;
 772
 773         wpa_printf(MSG_DEBUG, "TNC: No more messages from IMVs");
 774
 775         if (tncs->done)
 776                 return TNCCS_PROCESS_OK_NO_RECOMMENDATION;
 777
 778         tncs_solicit_recommendation(tncs);
 779
 780         /* Select the most restrictive recommendation */
 781         rec = TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION;
 782         for (imv = tncs->imv; imv; imv = imv->next) {
 783                 TNC_IMV_Action_Recommendation irec;
 784                 irec = tncs->imv_data[imv->imvID].recommendation;
 785                 if (irec == TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS)
 786                         rec = TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS;
 787                 if (irec == TNC_IMV_ACTION_RECOMMENDATION_ISOLATE &&
 788                     rec != TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS)
 789                         rec = TNC_IMV_ACTION_RECOMMENDATION_ISOLATE;
 790                 if (irec == TNC_IMV_ACTION_RECOMMENDATION_ALLOW &&
 791                     rec == TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION)
 792                         rec = TNC_IMV_ACTION_RECOMMENDATION_ALLOW;
 793         }
 794
 795         wpa_printf(MSG_DEBUG, "TNC: Recommendation: %d", rec);
 796         tncs->recommendation = rec;
 797         tncs->done = 1;
 798
 799         txt = NULL;
 800         switch (rec) {
 801         case TNC_IMV_ACTION_RECOMMENDATION_ALLOW:
 802         case TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION:
 803                 txt = "allow";
 804                 state = TNC_CONNECTION_STATE_ACCESS_ALLOWED;
 805                 break;
 806         case TNC_IMV_ACTION_RECOMMENDATION_ISOLATE:
 807                 txt = "isolate";
 808                 state = TNC_CONNECTION_STATE_ACCESS_ISOLATED;
 809                 break;
 810         case TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS:
 811                 txt = "none";
 812                 state = TNC_CONNECTION_STATE_ACCESS_NONE;
 813                 break;
 814         default:
 815                 state = TNC_CONNECTION_STATE_ACCESS_ALLOWED;
 816                 break;
 817         }
 818
 819         if (txt) {
 820                 os_free(tncs->tncs_message);
 821                 tncs->tncs_message = os_zalloc(200);
 822                 if (tncs->tncs_message) {
 823                         os_snprintf(tncs->tncs_message, 199,
 824                                     "<TNCC-TNCS-Message><Type>%08X</Type>"
 825                                     "<XML><TNCCS-Recommendation type=\"%s\">"
 826                                     "</TNCCS-Recommendation></XML>"
 827                                     "</TNCC-TNCS-Message>",
 828                                     TNC_TNCCS_RECOMMENDATION, txt);
 829                 }
 830         }
 831
 832         for (imv = tncs->imv; imv; imv = imv->next) {
 833                 tncs_imv_notify_connection_change(imv, tncs->connectionID,
 834                                                   state);
 835         }
 836
 837         switch (rec) {
 838         case TNC_IMV_ACTION_RECOMMENDATION_ALLOW:
 839                 return TNCCS_RECOMMENDATION_ALLOW;
 840         case TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS:
 841                 return TNCCS_RECOMMENDATION_NO_ACCESS;
 842         case TNC_IMV_ACTION_RECOMMENDATION_ISOLATE:
 843                 return TNCCS_RECOMMENDATION_ISOLATE;
 844         case TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION:
 845                 return TNCCS_RECOMMENDATION_NO_RECOMMENDATION;
 846         default:
 847                 return TNCCS_PROCESS_ERROR;
 848         }
 849 }
 850
 851
 852 enum tncs_process_res tncs_process_if_tnccs(struct tncs_data *tncs,
 853                                             const u8 *msg, size_t len)
 854 {
 855         char *buf, *start, *end, *pos, *pos2, *payload;
 856         unsigned int batch_id;
 857         unsigned char *decoded;
 858         size_t decoded_len;
 859
 860         buf = os_malloc(len + 1);
 861         if (buf == NULL)
 862                 return TNCCS_PROCESS_ERROR;
 863
 864         os_memcpy(buf, msg, len);
 865         buf[len] = '\0';
 866         start = os_strstr(buf, "<TNCCS-Batch ");
 867         end = os_strstr(buf, "</TNCCS-Batch>");
 868         if (start == NULL || end == NULL || start > end) {
 869                 os_free(buf);
 870                 return TNCCS_PROCESS_ERROR;
 871         }
 872
 873         start += 13;
 874         while (*start == ' ')
 875                 start++;
 876         *end = '\0';
 877
 878         pos = os_strstr(start, "BatchId=");
 879         if (pos == NULL) {
 880                 os_free(buf);
 881                 return TNCCS_PROCESS_ERROR;
 882         }
 883
 884         pos += 8;
 885         if (*pos == '"')
 886                 pos++;
 887         batch_id = atoi(pos);
 888         wpa_printf(MSG_DEBUG, "TNC: Received IF-TNCCS BatchId=%u",
 889                    batch_id);
 890         if (batch_id != tncs->last_batchid + 1) {
 891                 wpa_printf(MSG_DEBUG, "TNC: Unexpected IF-TNCCS BatchId "
 892                            "%u (expected %u)",
 893                            batch_id, tncs->last_batchid + 1);
 894                 os_free(buf);
 895                 return TNCCS_PROCESS_ERROR;
 896         }
 897         tncs->last_batchid = batch_id;
 898
 899         while (*pos != '\0' && *pos != '>')
 900                 pos++;
 901         if (*pos == '\0') {
 902                 os_free(buf);
 903                 return TNCCS_PROCESS_ERROR;
 904         }
 905         pos++;
 906         payload = start;
 907
 908         /*
 909          * <IMC-IMV-Message>
 910          * <Type>01234567</Type>
 911          * <Base64>foo==</Base64>
 912          * </IMC-IMV-Message>
 913          */
 914
 915         while (*start) {
 916                 char *endpos;
 917                 unsigned int type;
 918
 919                 pos = os_strstr(start, "<IMC-IMV-Message>");
 920                 if (pos == NULL)
 921                         break;
 922                 start = pos + 17;
 923                 end = os_strstr(start, "</IMC-IMV-Message>");
 924                 if (end == NULL)
 925                         break;
 926                 *end = '\0';
 927                 endpos = end;
 928                 end += 18;
 929
 930                 if (tncs_get_type(start, &type) < 0) {
 931                         *endpos = '<';
 932                         start = end;
 933                         continue;
 934                 }
 935                 wpa_printf(MSG_DEBUG, "TNC: IMC-IMV-Message Type 0x%x", type);
 936
 937                 decoded = tncs_get_base64(start, &decoded_len);
 938                 if (decoded == NULL) {
 939                         *endpos = '<';
 940                         start = end;
 941                         continue;
 942                 }
 943
 944                 tncs_send_to_imvs(tncs, type, decoded, decoded_len);
 945
 946                 os_free(decoded);
 947
 948                 start = end;
 949         }
 950
 951         /*
 952          * <TNCC-TNCS-Message>
 953          * <Type>01234567</Type>
 954          * <XML><TNCCS-Foo type="foo"></TNCCS-Foo></XML>
 955          * <Base64>foo==</Base64>
 956          * </TNCC-TNCS-Message>
 957          */
 958
 959         start = payload;
 960         while (*start) {
 961                 unsigned int type;
 962                 char *xml, *xmlend, *endpos;
 963
 964                 pos = os_strstr(start, "<TNCC-TNCS-Message>");
 965                 if (pos == NULL)
 966                         break;
 967                 start = pos + 19;
 968                 end = os_strstr(start, "</TNCC-TNCS-Message>");
 969                 if (end == NULL)
 970                         break;
 971                 *end = '\0';
 972                 endpos = end;
 973                 end += 20;
 974
 975                 if (tncs_get_type(start, &type) < 0) {
 976                         *endpos = '<';
 977                         start = end;
 978                         continue;
 979                 }
 980                 wpa_printf(MSG_DEBUG, "TNC: TNCC-TNCS-Message Type 0x%x",
 981                            type);
 982
 983                 /* Base64 OR XML */
 984                 decoded = NULL;
 985                 xml = NULL;
 986                 xmlend = NULL;
 987                 pos = os_strstr(start, "<XML>");
 988                 if (pos) {
 989                         pos += 5;
 990                         pos2 = os_strstr(pos, "</XML>");
 991                         if (pos2 == NULL) {
 992                                 *endpos = '<';
 993                                 start = end;
 994                                 continue;
 995                         }
 996                         xmlend = pos2;
 997                         xml = pos;
 998                 } else {
 999                         decoded = tncs_get_base64(start, &decoded_len);
1000                         if (decoded == NULL) {
1001                                 *endpos = '<';
1002                                 start = end;
1003                                 continue;
1004                         }
1005                 }
1006
1007                 if (decoded) {
1008                         wpa_hexdump_ascii(MSG_MSGDUMP,
1009                                           "TNC: TNCC-TNCS-Message Base64",
1010                                           decoded, decoded_len);
1011                         os_free(decoded);
1012                 }
1013
1014                 if (xml) {
1015                         wpa_hexdump_ascii(MSG_MSGDUMP,
1016                                           "TNC: TNCC-TNCS-Message XML",
1017                                           (unsigned char *) xml,
1018                                           xmlend - xml);
1019                 }
1020
1021                 start = end;
1022         }
1023
1024         os_free(buf);
1025
1026         tncs_batch_ending(tncs);
1027
1028         if (tncs_total_send_len(tncs) == 0)
1029                 return tncs_derive_recommendation(tncs);
1030
1031         return TNCCS_PROCESS_OK_NO_RECOMMENDATION;
1032 }
1033
1034
1035 static struct tnc_if_imv * tncs_parse_imv(int id, char *start, char *end,
1036                                           int *error)
1037 {
1038         struct tnc_if_imv *imv;
1039         char *pos, *pos2;
1040
1041         if (id >= TNC_MAX_IMV_ID) {
1042                 wpa_printf(MSG_DEBUG, "TNC: Too many IMVs");
1043                 return NULL;
1044         }
1045
1046         imv = os_zalloc(sizeof(*imv));
1047         if (imv == NULL) {
1048                 *error = 1;
1049                 return NULL;
1050         }
1051
1052         imv->imvID = id;
1053
1054         pos = start;
1055         wpa_printf(MSG_DEBUG, "TNC: Configured IMV: %s", pos);
1056         if (pos + 1 >= end || *pos != '"') {
1057                 wpa_printf(MSG_ERROR, "TNC: Ignoring invalid IMV line '%s' "
1058                            "(no starting quotation mark)", start);
1059                 os_free(imv);
1060                 return NULL;
1061         }
1062
1063         pos++;
1064         pos2 = pos;
1065         while (pos2 < end && *pos2 != '"')
1066                 pos2++;
1067         if (pos2 >= end) {
1068                 wpa_printf(MSG_ERROR, "TNC: Ignoring invalid IMV line '%s' "
1069                            "(no ending quotation mark)", start);
1070                 os_free(imv);
1071                 return NULL;
1072         }
1073         *pos2 = '\0';
1074         wpa_printf(MSG_DEBUG, "TNC: Name: '%s'", pos);
1075         imv->name = os_strdup(pos);
1076
1077         pos = pos2 + 1;
1078         if (pos >= end || *pos != ' ') {
1079                 wpa_printf(MSG_ERROR, "TNC: Ignoring invalid IMV line '%s' "
1080                            "(no space after name)", start);
1081                 os_free(imv);
1082                 return NULL;
1083         }
1084
1085         pos++;
1086         wpa_printf(MSG_DEBUG, "TNC: IMV file: '%s'", pos);
1087         imv->path = os_strdup(pos);
1088
1089         return imv;
1090 }
1091
1092
1093 static int tncs_read_config(struct tncs_global *global)
1094 {
1095         char *config, *end, *pos, *line_end;
1096         size_t config_len;
1097         struct tnc_if_imv *imv, *last;
1098         int id = 0;
1099
1100         last = NULL;
1101
1102         config = os_readfile(TNC_CONFIG_FILE, &config_len);
1103         if (config == NULL) {
1104                 wpa_printf(MSG_ERROR, "TNC: Could not open TNC configuration "
1105                            "file '%s'", TNC_CONFIG_FILE);
1106                 return -1;
1107         }
1108
1109         end = config + config_len;
1110         for (pos = config; pos < end; pos = line_end + 1) {
1111                 line_end = pos;
1112                 while (*line_end != '\n' && *line_end != '\r' &&
1113                        line_end < end)
1114                         line_end++;
1115                 *line_end = '\0';
1116
1117                 if (os_strncmp(pos, "IMV ", 4) == 0) {
1118                         int error = 0;
1119
1120                         imv = tncs_parse_imv(id++, pos + 4, line_end, &error);
1121                         if (error)
1122                                 return -1;
1123                         if (imv) {
1124                                 if (last == NULL)
1125                                         global->imv = imv;
1126                                 else
1127                                         last->next = imv;
1128                                 last = imv;
1129                         }
1130                 }
1131         }
1132
1133         os_free(config);
1134
1135         return 0;
1136 }
1137
1138
1139 struct tncs_data * tncs_init(void)
1140 {
1141         struct tncs_data *tncs;
1142
1143         if (tncs_global_data == NULL)
1144                 return NULL;
1145
1146         tncs = os_zalloc(sizeof(*tncs));
1147         if (tncs == NULL)
1148                 return NULL;
1149         tncs->imv = tncs_global_data->imv;
1150         tncs->connectionID = tncs_global_data->next_conn_id++;
1151         tncs->next = tncs_global_data->connections;
1152         tncs_global_data->connections = tncs;
1153
1154         return tncs;
1155 }
1156
1157
1158 void tncs_deinit(struct tncs_data *tncs)
1159 {
1160         int i;
1161         struct tncs_data *prev, *conn;
1162
1163         if (tncs == NULL)
1164                 return;
1165
1166         for (i = 0; i < TNC_MAX_IMV_ID; i++)
1167                 os_free(tncs->imv_data[i].imv_send);
1168
1169         prev = NULL;
1170         conn = tncs_global_data->connections;
1171         while (conn) {
1172                 if (conn == tncs) {
1173                         if (prev)
1174                                 prev->next = tncs->next;
1175                         else
1176                                 tncs_global_data->connections = tncs->next;
1177                         break;
1178                 }
1179                 prev = conn;
1180                 conn = conn->next;
1181         }
1182
1183         os_free(tncs->tncs_message);
1184         os_free(tncs);
1185 }
1186
1187
1188 int tncs_global_init(void)
1189 {
1190         struct tnc_if_imv *imv;
1191
1192         tncs_global_data = os_zalloc(sizeof(*tncs_global_data));
1193         if (tncs_global_data == NULL)
1194                 return -1;
1195
1196         if (tncs_read_config(tncs_global_data) < 0) {
1197                 wpa_printf(MSG_ERROR, "TNC: Failed to read TNC configuration");
1198                 goto failed;
1199         }
1200
1201         for (imv = tncs_global_data->imv; imv; imv = imv->next) {
1202                 if (tncs_load_imv(imv)) {
1203                         wpa_printf(MSG_ERROR, "TNC: Failed to load IMV '%s'",
1204                                    imv->name);
1205                         goto failed;
1206                 }
1207         }
1208
1209         return 0;
1210
1211 failed:
1212         tncs_global_deinit();
1213         return -1;
1214 }
1215
1216
1217 void tncs_global_deinit(void)
1218 {
1219         struct tnc_if_imv *imv, *prev;
1220
1221         if (tncs_global_data == NULL)
1222                 return;
1223
1224         imv = tncs_global_data->imv;
1225         while (imv) {
1226                 tncs_unload_imv(imv);
1227
1228                 prev = imv;
1229                 imv = imv->next;
1230                 os_free(prev);
1231         }
1232
1233         os_free(tncs_global_data);
1234 }
1235
1236
1237 struct wpabuf * tncs_build_soh_request(void)
1238 {
1239         struct wpabuf *buf;
1240
1241         /*
1242          * Build a SoH Request TLV (to be used inside SoH EAP Extensions
1243          * Method)
1244          */
1245
1246         buf = wpabuf_alloc(8 + 4);
1247         if (buf == NULL)
1248                 return NULL;
1249
1250         /* Vendor-Specific TLV (Microsoft) - SoH Request */
1251         wpabuf_put_be16(buf, EAP_TLV_VENDOR_SPECIFIC_TLV); /* TLV Type */
1252         wpabuf_put_be16(buf, 8); /* Length */
1253
1254         wpabuf_put_be32(buf, EAP_VENDOR_MICROSOFT); /* Vendor_Id */
1255
1256         wpabuf_put_be16(buf, 0x02); /* TLV Type - SoH Request TLV */
1257         wpabuf_put_be16(buf, 0); /* Length */
1258
1259         return buf;
1260 }
1261
1262
1263 struct wpabuf * tncs_process_soh(const u8 *soh_tlv, size_t soh_tlv_len,
1264                                  int *failure)
1265 {
1266         wpa_hexdump(MSG_DEBUG, "TNC: SoH TLV", soh_tlv, soh_tlv_len);
1267         *failure = 0;
1268
1269         /* TODO: return MS-SoH Response TLV */
1270
1271         return NULL;
1272 }