generalized tls_eap_t to support EAP_TNC wrapping the TNC_IF_TNCCS protocol
[strongswan.git] / src / libcharon / plugins / eap_tnc / eap_tnc.c
1 /*
2 * Copyright (C) 2010 Andreas Steffen
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "eap_tnc.h"
17 #include "tnc_if_tnccs.h"
18
19 #include <tls_eap.h>
20
21 #include <daemon.h>
22 #include <library.h>
23
24 typedef struct private_eap_tnc_t private_eap_tnc_t;
25
26 /**
27 * Private data of an eap_tnc_t object.
28 */
29 struct private_eap_tnc_t {
30
31 /**
32 * Public authenticator_t interface.
33 */
34 eap_tnc_t public;
35
36 /**
37 * Number of EAP-TNC messages processed so far
38 */
39 int processed;
40
41 /**
42 * TLS stack, wrapped by EAP helper
43 */
44 tls_eap_t *tls_eap;
45 };
46
47
48 /** Maximum number of EAP-TNC messages/fragments allowed */
49 #define MAX_MESSAGE_COUNT 2
50 /** Default size of a EAP-TNC fragment */
51 #define MAX_FRAGMENT_LEN 50000
52
53 METHOD(eap_method_t, initiate, status_t,
54 private_eap_tnc_t *this, eap_payload_t **out)
55 {
56 chunk_t data;
57
58 if (this->tls_eap->initiate(this->tls_eap, &data) == NEED_MORE)
59 {
60 *out = eap_payload_create_data(data);
61 free(data.ptr);
62 return NEED_MORE;
63 }
64 return FAILED;
65 }
66
67 METHOD(eap_method_t, process, status_t,
68 private_eap_tnc_t *this, eap_payload_t *in, eap_payload_t **out)
69 {
70 status_t status;
71 chunk_t data;
72
73 if (++this->processed > MAX_MESSAGE_COUNT)
74 {
75 DBG1(DBG_IKE, "EAP-TNC packet count exceeded (%d > %d)",
76 this->processed, MAX_MESSAGE_COUNT);
77 return FAILED;
78 }
79 data = in->get_data(in);
80 status = this->tls_eap->process(this->tls_eap, data, &data);
81 if (status == NEED_MORE)
82 {
83 *out = eap_payload_create_data(data);
84 free(data.ptr);
85 }
86 return status;
87 }
88
89 METHOD(eap_method_t, get_type, eap_type_t,
90 private_eap_tnc_t *this, u_int32_t *vendor)
91 {
92 *vendor = 0;
93 return EAP_TNC;
94 }
95
96 METHOD(eap_method_t, get_msk, status_t,
97 private_eap_tnc_t *this, chunk_t *msk)
98 {
99 *msk = this->tls_eap->get_msk(this->tls_eap);
100 if (msk->len)
101 {
102 return SUCCESS;
103 }
104 return FAILED;
105 }
106
107 METHOD(eap_method_t, is_mutual, bool,
108 private_eap_tnc_t *this)
109 {
110 return FALSE;
111 }
112
113 METHOD(eap_method_t, destroy, void,
114 private_eap_tnc_t *this)
115 {
116 this->tls_eap->destroy(this->tls_eap);
117 free(this);
118 }
119
120 /**
121 * Generic private constructor
122 */
123 static eap_tnc_t *eap_tnc_create(identification_t *server,
124 identification_t *peer, bool is_server)
125 {
126 private_eap_tnc_t *this;
127 size_t frag_size;
128 tls_t *tnc_if_tnccs;
129
130 INIT(this,
131 .public = {
132 .eap_method = {
133 .initiate = _initiate,
134 .process = _process,
135 .get_type = _get_type,
136 .is_mutual = _is_mutual,
137 .get_msk = _get_msk,
138 .destroy = _destroy,
139 },
140 },
141 );
142
143 frag_size = lib->settings->get_int(lib->settings,
144 "charon.plugins.eap-tnc.fragment_size", MAX_FRAGMENT_LEN);
145 tnc_if_tnccs = tnc_if_tnccs_create(is_server, TLS_PURPOSE_EAP_TNC);
146 if (!tnc_if_tnccs)
147 {
148 free(this);
149 return NULL;
150 }
151 this->tls_eap = tls_eap_create(EAP_TNC, tnc_if_tnccs, frag_size);
152 if (!this->tls_eap)
153 {
154 free(this);
155 return NULL;
156 }
157 return &this->public;
158 }
159
160 eap_tnc_t *eap_tnc_create_server(identification_t *server,
161 identification_t *peer)
162 {
163 return eap_tnc_create(server, peer, TRUE);
164 }
165
166 eap_tnc_t *eap_tnc_create_peer(identification_t *server,
167 identification_t *peer)
168 {
169 return eap_tnc_create(server, peer, FALSE);
170 }