2 * EAP-TNC - TNCS (IF-IMV, IF-TNCCS, and IF-TNCCS-SOH)
3 * Copyright (c) 2007-2008, Jouni Malinen <j@w1.fi>
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
15 #include "eap_common/eap_tlv_common.h"
16 #include "eap_common/eap_defs.h"
19 /* TODO: TNCS must be thread-safe; review the code and add locking etc. if
22 #define TNC_CONFIG_FILE "/etc/tnc_config"
23 #define IF_TNCCS_START \
24 "<?xml version=\"1.0\"?>\n" \
25 "<TNCCS-Batch BatchId=\"%d\" Recipient=\"TNCS\" " \
26 "xmlns=\"http://www.trustedcomputinggroup.org/IWG/TNC/1_0/IF_TNCCS#\" " \
27 "xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" " \
28 "xsi:schemaLocation=\"http://www.trustedcomputinggroup.org/IWG/TNC/1_0/" \
29 "IF_TNCCS# https://www.trustedcomputinggroup.org/XML/SCHEMA/TNCCS_1.0.xsd\">\n"
30 #define IF_TNCCS_END "\n</TNCCS-Batch>"
34 typedef unsigned long TNC_UInt32;
35 typedef unsigned char *TNC_BufferReference;
37 typedef TNC_UInt32 TNC_IMVID;
38 typedef TNC_UInt32 TNC_ConnectionID;
39 typedef TNC_UInt32 TNC_ConnectionState;
40 typedef TNC_UInt32 TNC_RetryReason;
41 typedef TNC_UInt32 TNC_IMV_Action_Recommendation;
42 typedef TNC_UInt32 TNC_IMV_Evaluation_Result;
43 typedef TNC_UInt32 TNC_MessageType;
44 typedef TNC_MessageType *TNC_MessageTypeList;
45 typedef TNC_UInt32 TNC_VendorID;
46 typedef TNC_UInt32 TNC_Subtype;
47 typedef TNC_UInt32 TNC_Version;
48 typedef TNC_UInt32 TNC_Result;
49 typedef TNC_UInt32 TNC_AttributeID;
51 typedef TNC_Result (*TNC_TNCS_BindFunctionPointer)(
54 void **pOutfunctionPointer);
56 #define TNC_RESULT_SUCCESS 0
57 #define TNC_RESULT_NOT_INITIALIZED 1
58 #define TNC_RESULT_ALREADY_INITIALIZED 2
59 #define TNC_RESULT_NO_COMMON_VERSION 3
60 #define TNC_RESULT_CANT_RETRY 4
61 #define TNC_RESULT_WONT_RETRY 5
62 #define TNC_RESULT_INVALID_PARAMETER 6
63 #define TNC_RESULT_CANT_RESPOND 7
64 #define TNC_RESULT_ILLEGAL_OPERATION 8
65 #define TNC_RESULT_OTHER 9
66 #define TNC_RESULT_FATAL 10
68 #define TNC_CONNECTION_STATE_CREATE 0
69 #define TNC_CONNECTION_STATE_HANDSHAKE 1
70 #define TNC_CONNECTION_STATE_ACCESS_ALLOWED 2
71 #define TNC_CONNECTION_STATE_ACCESS_ISOLATED 3
72 #define TNC_CONNECTION_STATE_ACCESS_NONE 4
73 #define TNC_CONNECTION_STATE_DELETE 5
75 #define TNC_IFIMV_VERSION_1 1
77 #define TNC_VENDORID_ANY ((TNC_VendorID) 0xffffff)
78 #define TNC_SUBTYPE_ANY ((TNC_Subtype) 0xff)
80 /* TNCC-TNCS Message Types */
81 #define TNC_TNCCS_RECOMMENDATION 0x00000001
82 #define TNC_TNCCS_ERROR 0x00000002
83 #define TNC_TNCCS_PREFERREDLANGUAGE 0x00000003
84 #define TNC_TNCCS_REASONSTRINGS 0x00000004
86 /* Possible TNC_IMV_Action_Recommendation values: */
87 enum IMV_Action_Recommendation {
88 TNC_IMV_ACTION_RECOMMENDATION_ALLOW,
89 TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS,
90 TNC_IMV_ACTION_RECOMMENDATION_ISOLATE,
91 TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION
94 /* Possible TNC_IMV_Evaluation_Result values: */
95 enum IMV_Evaluation_Result {
96 TNC_IMV_EVALUATION_RESULT_COMPLIANT,
97 TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR,
98 TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR,
99 TNC_IMV_EVALUATION_RESULT_ERROR,
100 TNC_IMV_EVALUATION_RESULT_DONT_KNOW
104 struct tnc_if_imv *next;
107 void *dlhandle; /* from dlopen() */
109 TNC_MessageTypeList supported_types;
110 size_t num_supported_types;
112 /* Functions implemented by IMVs (with TNC_IMV_ prefix) */
113 TNC_Result (*Initialize)(
115 TNC_Version minVersion,
116 TNC_Version maxVersion,
117 TNC_Version *pOutActualVersion);
118 TNC_Result (*NotifyConnectionChange)(
120 TNC_ConnectionID connectionID,
121 TNC_ConnectionState newState);
122 TNC_Result (*ReceiveMessage)(
124 TNC_ConnectionID connectionID,
125 TNC_BufferReference message,
126 TNC_UInt32 messageLength,
127 TNC_MessageType messageType);
128 TNC_Result (*SolicitRecommendation)(
130 TNC_ConnectionID connectionID);
131 TNC_Result (*BatchEnding)(
133 TNC_ConnectionID connectionID);
134 TNC_Result (*Terminate)(TNC_IMVID imvID);
135 TNC_Result (*ProvideBindFunction)(
137 TNC_TNCS_BindFunctionPointer bindFunction);
141 #define TNC_MAX_IMV_ID 10
144 struct tncs_data *next;
145 struct tnc_if_imv *imv; /* local copy of tncs_global_data->imv */
146 TNC_ConnectionID connectionID;
147 unsigned int last_batchid;
148 enum IMV_Action_Recommendation recommendation;
154 enum IMV_Action_Recommendation recommendation;
155 int recommendation_set;
156 } imv_data[TNC_MAX_IMV_ID];
163 struct tnc_if_imv *imv;
164 TNC_ConnectionID next_conn_id;
165 struct tncs_data *connections;
168 static struct tncs_global *tncs_global_data = NULL;
171 static struct tnc_if_imv * tncs_get_imv(TNC_IMVID imvID)
173 struct tnc_if_imv *imv;
175 if (imvID >= TNC_MAX_IMV_ID || tncs_global_data == NULL)
177 imv = tncs_global_data->imv;
179 if (imv->imvID == imvID)
187 static struct tncs_data * tncs_get_conn(TNC_ConnectionID connectionID)
189 struct tncs_data *tncs;
191 if (tncs_global_data == NULL)
194 tncs = tncs_global_data->connections;
196 if (tncs->connectionID == connectionID)
201 wpa_printf(MSG_DEBUG, "TNC: Connection ID %lu not found",
202 (unsigned long) connectionID);
208 /* TNCS functions that IMVs can call */
209 TNC_Result TNC_TNCS_ReportMessageTypes(
211 TNC_MessageTypeList supportedTypes,
212 TNC_UInt32 typeCount)
215 struct tnc_if_imv *imv;
217 wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_ReportMessageTypes(imvID=%lu "
219 (unsigned long) imvID, (unsigned long) typeCount);
221 for (i = 0; i < typeCount; i++) {
222 wpa_printf(MSG_DEBUG, "TNC: supportedTypes[%lu] = %lu",
223 i, supportedTypes[i]);
226 imv = tncs_get_imv(imvID);
228 return TNC_RESULT_INVALID_PARAMETER;
229 os_free(imv->supported_types);
230 imv->supported_types =
231 os_malloc(typeCount * sizeof(TNC_MessageType));
232 if (imv->supported_types == NULL)
233 return TNC_RESULT_FATAL;
234 os_memcpy(imv->supported_types, supportedTypes,
235 typeCount * sizeof(TNC_MessageType));
236 imv->num_supported_types = typeCount;
238 return TNC_RESULT_SUCCESS;
242 TNC_Result TNC_TNCS_SendMessage(
244 TNC_ConnectionID connectionID,
245 TNC_BufferReference message,
246 TNC_UInt32 messageLength,
247 TNC_MessageType messageType)
249 struct tncs_data *tncs;
253 wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_SendMessage(imvID=%lu "
254 "connectionID=%lu messageType=%lu)",
255 imvID, connectionID, messageType);
256 wpa_hexdump_ascii(MSG_DEBUG, "TNC: TNC_TNCS_SendMessage",
257 message, messageLength);
259 if (tncs_get_imv(imvID) == NULL)
260 return TNC_RESULT_INVALID_PARAMETER;
262 tncs = tncs_get_conn(connectionID);
264 return TNC_RESULT_INVALID_PARAMETER;
266 b64 = base64_encode(message, messageLength, &b64len);
268 return TNC_RESULT_FATAL;
270 os_free(tncs->imv_data[imvID].imv_send);
271 tncs->imv_data[imvID].imv_send_len = 0;
272 tncs->imv_data[imvID].imv_send = os_zalloc(b64len + 100);
273 if (tncs->imv_data[imvID].imv_send == NULL) {
275 return TNC_RESULT_OTHER;
278 tncs->imv_data[imvID].imv_send_len =
279 os_snprintf((char *) tncs->imv_data[imvID].imv_send,
281 "<IMC-IMV-Message><Type>%08X</Type>"
282 "<Base64>%s</Base64></IMC-IMV-Message>",
283 (unsigned int) messageType, b64);
287 return TNC_RESULT_SUCCESS;
291 TNC_Result TNC_TNCS_RequestHandshakeRetry(
293 TNC_ConnectionID connectionID,
294 TNC_RetryReason reason)
296 wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_RequestHandshakeRetry");
298 return TNC_RESULT_SUCCESS;
302 TNC_Result TNC_TNCS_ProvideRecommendation(
304 TNC_ConnectionID connectionID,
305 TNC_IMV_Action_Recommendation recommendation,
306 TNC_IMV_Evaluation_Result evaluation)
308 struct tncs_data *tncs;
310 wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_ProvideRecommendation(imvID=%lu "
311 "connectionID=%lu recommendation=%lu evaluation=%lu)",
312 (unsigned long) imvID, (unsigned long) connectionID,
313 (unsigned long) recommendation, (unsigned long) evaluation);
315 if (tncs_get_imv(imvID) == NULL)
316 return TNC_RESULT_INVALID_PARAMETER;
318 tncs = tncs_get_conn(connectionID);
320 return TNC_RESULT_INVALID_PARAMETER;
322 tncs->imv_data[imvID].recommendation = recommendation;
323 tncs->imv_data[imvID].recommendation_set = 1;
325 return TNC_RESULT_SUCCESS;
329 TNC_Result TNC_TNCS_GetAttribute(
331 TNC_ConnectionID connectionID,
332 TNC_AttributeID attribureID,
333 TNC_UInt32 bufferLength,
334 TNC_BufferReference buffer,
335 TNC_UInt32 *pOutValueLength)
337 wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_GetAttribute");
339 return TNC_RESULT_SUCCESS;
343 TNC_Result TNC_TNCS_SetAttribute(
345 TNC_ConnectionID connectionID,
346 TNC_AttributeID attribureID,
347 TNC_UInt32 bufferLength,
348 TNC_BufferReference buffer)
350 wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_SetAttribute");
352 return TNC_RESULT_SUCCESS;
356 TNC_Result TNC_TNCS_BindFunction(
359 void **pOutFunctionPointer)
361 wpa_printf(MSG_DEBUG, "TNC: TNC_TNCS_BindFunction(imcID=%lu, "
362 "functionName='%s')", (unsigned long) imvID, functionName);
364 if (tncs_get_imv(imvID) == NULL)
365 return TNC_RESULT_INVALID_PARAMETER;
367 if (pOutFunctionPointer == NULL)
368 return TNC_RESULT_INVALID_PARAMETER;
370 if (os_strcmp(functionName, "TNC_TNCS_ReportMessageTypes") == 0)
371 *pOutFunctionPointer = TNC_TNCS_ReportMessageTypes;
372 else if (os_strcmp(functionName, "TNC_TNCS_SendMessage") == 0)
373 *pOutFunctionPointer = TNC_TNCS_SendMessage;
374 else if (os_strcmp(functionName, "TNC_TNCS_RequestHandshakeRetry") ==
376 *pOutFunctionPointer = TNC_TNCS_RequestHandshakeRetry;
377 else if (os_strcmp(functionName, "TNC_TNCS_ProvideRecommendation") ==
379 *pOutFunctionPointer = TNC_TNCS_ProvideRecommendation;
380 else if (os_strcmp(functionName, "TNC_TNCS_GetAttribute") == 0)
381 *pOutFunctionPointer = TNC_TNCS_GetAttribute;
382 else if (os_strcmp(functionName, "TNC_TNCS_SetAttribute") == 0)
383 *pOutFunctionPointer = TNC_TNCS_SetAttribute;
385 *pOutFunctionPointer = NULL;
387 return TNC_RESULT_SUCCESS;
391 static void * tncs_get_sym(void *handle, char *func)
395 fptr = dlsym(handle, func);
401 static int tncs_imv_resolve_funcs(struct tnc_if_imv *imv)
403 void *handle = imv->dlhandle;
405 /* Mandatory IMV functions */
406 imv->Initialize = tncs_get_sym(handle, "TNC_IMV_Initialize");
407 if (imv->Initialize == NULL) {
408 wpa_printf(MSG_ERROR, "TNC: IMV does not export "
409 "TNC_IMV_Initialize");
413 imv->SolicitRecommendation = tncs_get_sym(
414 handle, "TNC_IMV_SolicitRecommendation");
415 if (imv->SolicitRecommendation == NULL) {
416 wpa_printf(MSG_ERROR, "TNC: IMV does not export "
417 "TNC_IMV_SolicitRecommendation");
421 imv->ProvideBindFunction =
422 tncs_get_sym(handle, "TNC_IMV_ProvideBindFunction");
423 if (imv->ProvideBindFunction == NULL) {
424 wpa_printf(MSG_ERROR, "TNC: IMV does not export "
425 "TNC_IMV_ProvideBindFunction");
429 /* Optional IMV functions */
430 imv->NotifyConnectionChange =
431 tncs_get_sym(handle, "TNC_IMV_NotifyConnectionChange");
432 imv->ReceiveMessage = tncs_get_sym(handle, "TNC_IMV_ReceiveMessage");
433 imv->BatchEnding = tncs_get_sym(handle, "TNC_IMV_BatchEnding");
434 imv->Terminate = tncs_get_sym(handle, "TNC_IMV_Terminate");
440 static int tncs_imv_initialize(struct tnc_if_imv *imv)
445 wpa_printf(MSG_DEBUG, "TNC: Calling TNC_IMV_Initialize for IMV '%s'",
447 res = imv->Initialize(imv->imvID, TNC_IFIMV_VERSION_1,
448 TNC_IFIMV_VERSION_1, &imv_ver);
449 wpa_printf(MSG_DEBUG, "TNC: TNC_IMV_Initialize: res=%lu imv_ver=%lu",
450 (unsigned long) res, (unsigned long) imv_ver);
452 return res == TNC_RESULT_SUCCESS ? 0 : -1;
456 static int tncs_imv_terminate(struct tnc_if_imv *imv)
460 if (imv->Terminate == NULL)
463 wpa_printf(MSG_DEBUG, "TNC: Calling TNC_IMV_Terminate for IMV '%s'",
465 res = imv->Terminate(imv->imvID);
466 wpa_printf(MSG_DEBUG, "TNC: TNC_IMV_Terminate: %lu",
467 (unsigned long) res);
469 return res == TNC_RESULT_SUCCESS ? 0 : -1;
473 static int tncs_imv_provide_bind_function(struct tnc_if_imv *imv)
477 wpa_printf(MSG_DEBUG, "TNC: Calling TNC_IMV_ProvideBindFunction for "
478 "IMV '%s'", imv->name);
479 res = imv->ProvideBindFunction(imv->imvID, TNC_TNCS_BindFunction);
480 wpa_printf(MSG_DEBUG, "TNC: TNC_IMV_ProvideBindFunction: res=%lu",
481 (unsigned long) res);
483 return res == TNC_RESULT_SUCCESS ? 0 : -1;
487 static int tncs_imv_notify_connection_change(struct tnc_if_imv *imv,
488 TNC_ConnectionID conn,
489 TNC_ConnectionState state)
493 if (imv->NotifyConnectionChange == NULL)
496 wpa_printf(MSG_DEBUG, "TNC: Calling TNC_IMV_NotifyConnectionChange(%d)"
497 " for IMV '%s'", (int) state, imv->name);
498 res = imv->NotifyConnectionChange(imv->imvID, conn, state);
499 wpa_printf(MSG_DEBUG, "TNC: TNC_IMC_NotifyConnectionChange: %lu",
500 (unsigned long) res);
502 return res == TNC_RESULT_SUCCESS ? 0 : -1;
506 static int tncs_load_imv(struct tnc_if_imv *imv)
508 if (imv->path == NULL) {
509 wpa_printf(MSG_DEBUG, "TNC: No IMV configured");
513 wpa_printf(MSG_DEBUG, "TNC: Opening IMV: %s (%s)",
514 imv->name, imv->path);
515 imv->dlhandle = dlopen(imv->path, RTLD_LAZY);
516 if (imv->dlhandle == NULL) {
517 wpa_printf(MSG_ERROR, "TNC: Failed to open IMV '%s' (%s): %s",
518 imv->name, imv->path, dlerror());
522 if (tncs_imv_resolve_funcs(imv) < 0) {
523 wpa_printf(MSG_ERROR, "TNC: Failed to resolve IMV functions");
527 if (tncs_imv_initialize(imv) < 0 ||
528 tncs_imv_provide_bind_function(imv) < 0) {
529 wpa_printf(MSG_ERROR, "TNC: Failed to initialize IMV");
537 static void tncs_free_imv(struct tnc_if_imv *imv)
541 os_free(imv->supported_types);
544 static void tncs_unload_imv(struct tnc_if_imv *imv)
546 tncs_imv_terminate(imv);
549 dlclose(imv->dlhandle);
555 static int tncs_supported_type(struct tnc_if_imv *imv, unsigned int type)
558 unsigned int vendor, subtype;
560 if (imv == NULL || imv->supported_types == NULL)
564 subtype = type & 0xff;
566 for (i = 0; i < imv->num_supported_types; i++) {
567 unsigned int svendor, ssubtype;
568 svendor = imv->supported_types[i] >> 8;
569 ssubtype = imv->supported_types[i] & 0xff;
570 if ((vendor == svendor || svendor == TNC_VENDORID_ANY) &&
571 (subtype == ssubtype || ssubtype == TNC_SUBTYPE_ANY))
579 static void tncs_send_to_imvs(struct tncs_data *tncs, unsigned int type,
580 const u8 *msg, size_t len)
582 struct tnc_if_imv *imv;
585 wpa_hexdump_ascii(MSG_MSGDUMP, "TNC: Message to IMV(s)", msg, len);
587 for (imv = tncs->imv; imv; imv = imv->next) {
588 if (imv->ReceiveMessage == NULL ||
589 !tncs_supported_type(imv, type))
592 wpa_printf(MSG_DEBUG, "TNC: Call ReceiveMessage for IMV '%s'",
594 res = imv->ReceiveMessage(imv->imvID, tncs->connectionID,
595 (TNC_BufferReference) msg, len,
597 wpa_printf(MSG_DEBUG, "TNC: ReceiveMessage: %lu",
598 (unsigned long) res);
603 static void tncs_batch_ending(struct tncs_data *tncs)
605 struct tnc_if_imv *imv;
608 for (imv = tncs->imv; imv; imv = imv->next) {
609 if (imv->BatchEnding == NULL)
612 wpa_printf(MSG_DEBUG, "TNC: Call BatchEnding for IMV '%s'",
614 res = imv->BatchEnding(imv->imvID, tncs->connectionID);
615 wpa_printf(MSG_DEBUG, "TNC: BatchEnding: %lu",
616 (unsigned long) res);
621 static void tncs_solicit_recommendation(struct tncs_data *tncs)
623 struct tnc_if_imv *imv;
626 for (imv = tncs->imv; imv; imv = imv->next) {
627 if (tncs->imv_data[imv->imvID].recommendation_set)
630 wpa_printf(MSG_DEBUG, "TNC: Call SolicitRecommendation for "
631 "IMV '%s'", imv->name);
632 res = imv->SolicitRecommendation(imv->imvID,
634 wpa_printf(MSG_DEBUG, "TNC: SolicitRecommendation: %lu",
635 (unsigned long) res);
640 void tncs_init_connection(struct tncs_data *tncs)
642 struct tnc_if_imv *imv;
645 for (imv = tncs->imv; imv; imv = imv->next) {
646 tncs_imv_notify_connection_change(
647 imv, tncs->connectionID, TNC_CONNECTION_STATE_CREATE);
648 tncs_imv_notify_connection_change(
649 imv, tncs->connectionID,
650 TNC_CONNECTION_STATE_HANDSHAKE);
653 for (i = 0; i < TNC_MAX_IMV_ID; i++) {
654 os_free(tncs->imv_data[i].imv_send);
655 tncs->imv_data[i].imv_send = NULL;
656 tncs->imv_data[i].imv_send_len = 0;
661 size_t tncs_total_send_len(struct tncs_data *tncs)
666 for (i = 0; i < TNC_MAX_IMV_ID; i++)
667 len += tncs->imv_data[i].imv_send_len;
668 if (tncs->tncs_message)
669 len += os_strlen(tncs->tncs_message);
674 u8 * tncs_copy_send_buf(struct tncs_data *tncs, u8 *pos)
678 for (i = 0; i < TNC_MAX_IMV_ID; i++) {
679 if (tncs->imv_data[i].imv_send == NULL)
682 os_memcpy(pos, tncs->imv_data[i].imv_send,
683 tncs->imv_data[i].imv_send_len);
684 pos += tncs->imv_data[i].imv_send_len;
685 os_free(tncs->imv_data[i].imv_send);
686 tncs->imv_data[i].imv_send = NULL;
687 tncs->imv_data[i].imv_send_len = 0;
690 if (tncs->tncs_message) {
691 size_t len = os_strlen(tncs->tncs_message);
692 os_memcpy(pos, tncs->tncs_message, len);
694 os_free(tncs->tncs_message);
695 tncs->tncs_message = NULL;
702 char * tncs_if_tnccs_start(struct tncs_data *tncs)
704 char *buf = os_malloc(1000);
707 tncs->last_batchid++;
708 os_snprintf(buf, 1000, IF_TNCCS_START, tncs->last_batchid);
713 char * tncs_if_tnccs_end(void)
715 char *buf = os_malloc(100);
718 os_snprintf(buf, 100, IF_TNCCS_END);
723 static int tncs_get_type(char *start, unsigned int *type)
725 char *pos = os_strstr(start, "<Type>");
729 *type = strtoul(pos, NULL, 16);
734 static unsigned char * tncs_get_base64(char *start, size_t *decoded_len)
737 unsigned char *decoded;
739 pos = os_strstr(start, "<Base64>");
744 pos2 = os_strstr(pos, "</Base64>");
749 decoded = base64_decode((unsigned char *) pos, os_strlen(pos),
752 if (decoded == NULL) {
753 wpa_printf(MSG_DEBUG, "TNC: Failed to decode Base64 data");
760 static enum tncs_process_res tncs_derive_recommendation(struct tncs_data *tncs)
762 enum IMV_Action_Recommendation rec;
763 struct tnc_if_imv *imv;
764 TNC_ConnectionState state;
767 wpa_printf(MSG_DEBUG, "TNC: No more messages from IMVs");
770 return TNCCS_PROCESS_OK_NO_RECOMMENDATION;
772 tncs_solicit_recommendation(tncs);
774 /* Select the most restrictive recommendation */
775 rec = TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION;
776 for (imv = tncs->imv; imv; imv = imv->next) {
777 TNC_IMV_Action_Recommendation irec;
778 irec = tncs->imv_data[imv->imvID].recommendation;
779 if (irec == TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS)
780 rec = TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS;
781 if (irec == TNC_IMV_ACTION_RECOMMENDATION_ISOLATE &&
782 rec != TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS)
783 rec = TNC_IMV_ACTION_RECOMMENDATION_ISOLATE;
784 if (irec == TNC_IMV_ACTION_RECOMMENDATION_ALLOW &&
785 rec == TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION)
786 rec = TNC_IMV_ACTION_RECOMMENDATION_ALLOW;
789 wpa_printf(MSG_DEBUG, "TNC: Recommendation: %d", rec);
790 tncs->recommendation = rec;
795 case TNC_IMV_ACTION_RECOMMENDATION_ALLOW:
796 case TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION:
798 state = TNC_CONNECTION_STATE_ACCESS_ALLOWED;
800 case TNC_IMV_ACTION_RECOMMENDATION_ISOLATE:
802 state = TNC_CONNECTION_STATE_ACCESS_ISOLATED;
804 case TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS:
806 state = TNC_CONNECTION_STATE_ACCESS_NONE;
809 state = TNC_CONNECTION_STATE_ACCESS_ALLOWED;
814 os_free(tncs->tncs_message);
815 tncs->tncs_message = os_zalloc(200);
816 if (tncs->tncs_message) {
817 os_snprintf(tncs->tncs_message, 199,
818 "<TNCC-TNCS-Message><Type>%08X</Type>"
819 "<XML><TNCCS-Recommendation type=\"%s\">"
820 "</TNCCS-Recommendation></XML>"
821 "</TNCC-TNCS-Message>",
822 TNC_TNCCS_RECOMMENDATION, txt);
826 for (imv = tncs->imv; imv; imv = imv->next) {
827 tncs_imv_notify_connection_change(imv, tncs->connectionID,
832 case TNC_IMV_ACTION_RECOMMENDATION_ALLOW:
833 return TNCCS_RECOMMENDATION_ALLOW;
834 case TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS:
835 return TNCCS_RECOMMENDATION_NO_ACCESS;
836 case TNC_IMV_ACTION_RECOMMENDATION_ISOLATE:
837 return TNCCS_RECOMMENDATION_ISOLATE;
838 case TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION:
839 return TNCCS_RECOMMENDATION_NO_RECOMMENDATION;
841 return TNCCS_PROCESS_ERROR;
846 enum tncs_process_res tncs_process_if_tnccs(struct tncs_data *tncs,
847 const u8 *msg, size_t len)
849 char *buf, *start, *end, *pos, *pos2, *payload;
850 unsigned int batch_id;
851 unsigned char *decoded;
854 buf = dup_binstr(msg, len);
856 return TNCCS_PROCESS_ERROR;
858 start = os_strstr(buf, "<TNCCS-Batch ");
859 end = os_strstr(buf, "</TNCCS-Batch>");
860 if (start == NULL || end == NULL || start > end) {
862 return TNCCS_PROCESS_ERROR;
866 while (*start == ' ')
870 pos = os_strstr(start, "BatchId=");
873 return TNCCS_PROCESS_ERROR;
879 batch_id = atoi(pos);
880 wpa_printf(MSG_DEBUG, "TNC: Received IF-TNCCS BatchId=%u",
882 if (batch_id != tncs->last_batchid + 1) {
883 wpa_printf(MSG_DEBUG, "TNC: Unexpected IF-TNCCS BatchId "
885 batch_id, tncs->last_batchid + 1);
887 return TNCCS_PROCESS_ERROR;
889 tncs->last_batchid = batch_id;
891 while (*pos != '\0' && *pos != '>')
895 return TNCCS_PROCESS_ERROR;
902 * <Type>01234567</Type>
903 * <Base64>foo==</Base64>
911 pos = os_strstr(start, "<IMC-IMV-Message>");
915 end = os_strstr(start, "</IMC-IMV-Message>");
922 if (tncs_get_type(start, &type) < 0) {
927 wpa_printf(MSG_DEBUG, "TNC: IMC-IMV-Message Type 0x%x", type);
929 decoded = tncs_get_base64(start, &decoded_len);
930 if (decoded == NULL) {
936 tncs_send_to_imvs(tncs, type, decoded, decoded_len);
944 * <TNCC-TNCS-Message>
945 * <Type>01234567</Type>
946 * <XML><TNCCS-Foo type="foo"></TNCCS-Foo></XML>
947 * <Base64>foo==</Base64>
948 * </TNCC-TNCS-Message>
954 char *xml, *xmlend, *endpos;
956 pos = os_strstr(start, "<TNCC-TNCS-Message>");
960 end = os_strstr(start, "</TNCC-TNCS-Message>");
967 if (tncs_get_type(start, &type) < 0) {
972 wpa_printf(MSG_DEBUG, "TNC: TNCC-TNCS-Message Type 0x%x",
979 pos = os_strstr(start, "<XML>");
982 pos2 = os_strstr(pos, "</XML>");
991 decoded = tncs_get_base64(start, &decoded_len);
992 if (decoded == NULL) {
1000 wpa_hexdump_ascii(MSG_MSGDUMP,
1001 "TNC: TNCC-TNCS-Message Base64",
1002 decoded, decoded_len);
1007 wpa_hexdump_ascii(MSG_MSGDUMP,
1008 "TNC: TNCC-TNCS-Message XML",
1009 (unsigned char *) xml,
1018 tncs_batch_ending(tncs);
1020 if (tncs_total_send_len(tncs) == 0)
1021 return tncs_derive_recommendation(tncs);
1023 return TNCCS_PROCESS_OK_NO_RECOMMENDATION;
1027 static struct tnc_if_imv * tncs_parse_imv(int id, char *start, char *end,
1030 struct tnc_if_imv *imv;
1033 if (id >= TNC_MAX_IMV_ID) {
1034 wpa_printf(MSG_DEBUG, "TNC: Too many IMVs");
1038 imv = os_zalloc(sizeof(*imv));
1047 wpa_printf(MSG_DEBUG, "TNC: Configured IMV: %s", pos);
1048 if (pos + 1 >= end || *pos != '"') {
1049 wpa_printf(MSG_ERROR, "TNC: Ignoring invalid IMV line '%s' "
1050 "(no starting quotation mark)", start);
1057 while (pos2 < end && *pos2 != '"')
1060 wpa_printf(MSG_ERROR, "TNC: Ignoring invalid IMV line '%s' "
1061 "(no ending quotation mark)", start);
1066 wpa_printf(MSG_DEBUG, "TNC: Name: '%s'", pos);
1067 imv->name = os_strdup(pos);
1070 if (pos >= end || *pos != ' ') {
1071 wpa_printf(MSG_ERROR, "TNC: Ignoring invalid IMV line '%s' "
1072 "(no space after name)", start);
1078 wpa_printf(MSG_DEBUG, "TNC: IMV file: '%s'", pos);
1079 imv->path = os_strdup(pos);
1085 static int tncs_read_config(struct tncs_global *global)
1087 char *config, *end, *pos, *line_end;
1089 struct tnc_if_imv *imv, *last;
1094 config = os_readfile(TNC_CONFIG_FILE, &config_len);
1095 if (config == NULL) {
1096 wpa_printf(MSG_ERROR, "TNC: Could not open TNC configuration "
1097 "file '%s'", TNC_CONFIG_FILE);
1101 end = config + config_len;
1102 for (pos = config; pos < end; pos = line_end + 1) {
1104 while (*line_end != '\n' && *line_end != '\r' &&
1109 if (os_strncmp(pos, "IMV ", 4) == 0) {
1112 imv = tncs_parse_imv(id++, pos + 4, line_end, &error);
1131 struct tncs_data * tncs_init(void)
1133 struct tncs_data *tncs;
1135 if (tncs_global_data == NULL)
1138 tncs = os_zalloc(sizeof(*tncs));
1141 tncs->imv = tncs_global_data->imv;
1142 tncs->connectionID = tncs_global_data->next_conn_id++;
1143 tncs->next = tncs_global_data->connections;
1144 tncs_global_data->connections = tncs;
1150 void tncs_deinit(struct tncs_data *tncs)
1153 struct tncs_data *prev, *conn;
1158 for (i = 0; i < TNC_MAX_IMV_ID; i++)
1159 os_free(tncs->imv_data[i].imv_send);
1162 conn = tncs_global_data->connections;
1166 prev->next = tncs->next;
1168 tncs_global_data->connections = tncs->next;
1175 os_free(tncs->tncs_message);
1180 int tncs_global_init(void)
1182 struct tnc_if_imv *imv;
1184 tncs_global_data = os_zalloc(sizeof(*tncs_global_data));
1185 if (tncs_global_data == NULL)
1188 if (tncs_read_config(tncs_global_data) < 0) {
1189 wpa_printf(MSG_ERROR, "TNC: Failed to read TNC configuration");
1193 for (imv = tncs_global_data->imv; imv; imv = imv->next) {
1194 if (tncs_load_imv(imv)) {
1195 wpa_printf(MSG_ERROR, "TNC: Failed to load IMV '%s'",
1204 tncs_global_deinit();
1209 void tncs_global_deinit(void)
1211 struct tnc_if_imv *imv, *prev;
1213 if (tncs_global_data == NULL)
1216 imv = tncs_global_data->imv;
1218 tncs_unload_imv(imv);
1225 os_free(tncs_global_data);
1226 tncs_global_data = NULL;
1230 struct wpabuf * tncs_build_soh_request(void)
1235 * Build a SoH Request TLV (to be used inside SoH EAP Extensions
1239 buf = wpabuf_alloc(8 + 4);
1243 /* Vendor-Specific TLV (Microsoft) - SoH Request */
1244 wpabuf_put_be16(buf, EAP_TLV_VENDOR_SPECIFIC_TLV); /* TLV Type */
1245 wpabuf_put_be16(buf, 8); /* Length */
1247 wpabuf_put_be32(buf, EAP_VENDOR_MICROSOFT); /* Vendor_Id */
1249 wpabuf_put_be16(buf, 0x02); /* TLV Type - SoH Request TLV */
1250 wpabuf_put_be16(buf, 0); /* Length */
1256 struct wpabuf * tncs_process_soh(const u8 *soh_tlv, size_t soh_tlv_len,
1259 wpa_hexdump(MSG_DEBUG, "TNC: SoH TLV", soh_tlv, soh_tlv_len);
1262 /* TODO: return MS-SoH Response TLV */