diff --git a/conf/plugins/eap-tnc.opt b/conf/plugins/eap-tnc.opt index 559315240..e556d402a 100644 --- a/conf/plugins/eap-tnc.opt +++ b/conf/plugins/eap-tnc.opt @@ -2,5 +2,4 @@ charon.plugins.eap-tnc.max_message_count = 10 Maximum number of processed EAP-TNC packets (0 = no limit). charon.plugins.eap-tnc.protocol = tnccs-2.0 - IF-TNCCS protocol version to be used (_tnccs-1.1_, _tnccs-2.0_, - _tnccs-dynamic_). + IF-TNCCS protocol version to be used (_tnccs-2.0_ is the only option). diff --git a/configure.ac b/configure.ac index abcf7f5fe..32b277094 100644 --- a/configure.ac +++ b/configure.ac @@ -253,7 +253,6 @@ ARG_ENABL_SET([tnc-imc], [enable TNC IMC module.]) ARG_ENABL_SET([tnc-imv], [enable TNC IMV module.]) ARG_ENABL_SET([tnc-pdp], [enable TNC policy decision point module.]) ARG_ENABL_SET([tnccs-20], [enable TNCCS 2.0 protocol module.]) -ARG_ENABL_SET([tnccs-dynamic], [enable dynamic TNCCS protocol discovery module.]) # misc plugins ARG_ENABL_SET([android-log], [enable Android specific logger plugin.]) ARG_ENABL_SET([bypass-lan], [enable plugin to install bypass policies for local subnets.]) @@ -429,7 +428,7 @@ if test x$eap_radius = xtrue -o x$radattr = xtrue -o x$tnc_pdp = xtrue; then radius=true; fi -if test x$tnc_imc = xtrue -o x$tnc_imv = xtrue -o x$tnccs_20 = xtrue -o x$tnccs_dynamic = xtrue -o x$eap_tnc = xtrue; then +if test x$tnc_imc = xtrue -o x$tnc_imv = xtrue -o x$tnccs_20 = xtrue -o x$eap_tnc = xtrue; then tnc_tnccs=true; fi @@ -1557,7 +1556,6 @@ ADD_PLUGIN([tnc-imc], [t charon]) ADD_PLUGIN([tnc-imv], [t charon]) ADD_PLUGIN([tnc-tnccs], [t charon]) ADD_PLUGIN([tnccs-20], [t charon]) -ADD_PLUGIN([tnccs-dynamic], [t charon]) ADD_PLUGIN([dhcp], [c charon]) ADD_PLUGIN([osx-attr], [c charon cmd]) ADD_PLUGIN([p-cscf], [c charon cmd]) @@ -1709,7 +1707,6 @@ AM_CONDITIONAL(USE_TNC_IMC, test x$tnc_imc = xtrue) AM_CONDITIONAL(USE_TNC_IMV, test x$tnc_imv = xtrue) AM_CONDITIONAL(USE_TNC_TNCCS, test x$tnc_tnccs = xtrue) AM_CONDITIONAL(USE_TNCCS_20, test x$tnccs_20 = xtrue) -AM_CONDITIONAL(USE_TNCCS_DYNAMIC, test x$tnccs_dynamic = xtrue) AM_CONDITIONAL(USE_IMC_TEST, test x$imc_test = xtrue) AM_CONDITIONAL(USE_IMV_TEST, test x$imv_test = xtrue) AM_CONDITIONAL(USE_IMC_SCANNER, test x$imc_scanner = xtrue) @@ -1943,7 +1940,6 @@ AC_CONFIG_FILES([ src/libtnccs/plugins/tnc_imc/Makefile src/libtnccs/plugins/tnc_imv/Makefile src/libtnccs/plugins/tnccs_20/Makefile - src/libtnccs/plugins/tnccs_dynamic/Makefile src/libpttls/Makefile src/libimcv/Makefile src/libimcv/plugins/imc_test/Makefile diff --git a/src/libcharon/plugins/eap_tnc/eap_tnc.c b/src/libcharon/plugins/eap_tnc/eap_tnc.c index b8dae2e55..bcb0b43d8 100644 --- a/src/libcharon/plugins/eap_tnc/eap_tnc.c +++ b/src/libcharon/plugins/eap_tnc/eap_tnc.c @@ -291,14 +291,6 @@ static eap_tnc_t *eap_tnc_create(identification_t *server, { tnccs_type = TNCCS_2_0; } - else if (strcaseeq(protocol, "tnccs-1.1")) - { - tnccs_type = TNCCS_1_1; - } - else if (strcaseeq(protocol, "tnccs-dynamic") && is_server) - { - tnccs_type = TNCCS_DYNAMIC; - } else { DBG1(DBG_TNC, "TNCCS protocol '%s' not supported", protocol); diff --git a/src/libtnccs/Makefile.am b/src/libtnccs/Makefile.am index 83066f209..00b064a39 100644 --- a/src/libtnccs/Makefile.am +++ b/src/libtnccs/Makefile.am @@ -71,10 +71,3 @@ if MONOLITHIC libtnccs_la_LIBADD += plugins/tnccs_20/libstrongswan-tnccs-20.la endif endif - -if USE_TNCCS_DYNAMIC - SUBDIRS += plugins/tnccs_dynamic -if MONOLITHIC - libtnccs_la_LIBADD += plugins/tnccs_dynamic/libstrongswan-tnccs-dynamic.la -endif -endif diff --git a/src/libtnccs/plugins/tnccs_dynamic/Makefile.am b/src/libtnccs/plugins/tnccs_dynamic/Makefile.am deleted file mode 100644 index 23eb7f17a..000000000 --- a/src/libtnccs/plugins/tnccs_dynamic/Makefile.am +++ /dev/null @@ -1,22 +0,0 @@ -AM_CPPFLAGS = \ - -I$(top_srcdir)/src/libstrongswan \ - -I$(top_srcdir)/src/libtls \ - -I$(top_srcdir)/src/libtncif \ - -I$(top_srcdir)/src/libtnccs - -AM_CFLAGS = \ - $(PLUGIN_CFLAGS) - -if MONOLITHIC -noinst_LTLIBRARIES = libstrongswan-tnccs-dynamic.la -else -plugin_LTLIBRARIES = libstrongswan-tnccs-dynamic.la -libstrongswan_tnccs_dynamic_la_LIBADD = \ - $(top_builddir)/src/libtncif/libtncif.la \ - $(top_builddir)/src/libtnccs/libtnccs.la -endif - -libstrongswan_tnccs_dynamic_la_SOURCES = \ - tnccs_dynamic_plugin.h tnccs_dynamic_plugin.c tnccs_dynamic.h tnccs_dynamic.c - -libstrongswan_tnccs_dynamic_la_LDFLAGS = -module -avoid-version diff --git a/src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic.c b/src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic.c deleted file mode 100644 index c4796039a..000000000 --- a/src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic.c +++ /dev/null @@ -1,307 +0,0 @@ -/* - * Copyright (C) 2011-2015 Andreas Steffen - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -#include "tnccs_dynamic.h" - -#include - -#include - -typedef struct private_tnccs_dynamic_t private_tnccs_dynamic_t; - -/** - * Private data of a tnccs_dynamic_t object. - */ -struct private_tnccs_dynamic_t { - - /** - * Public tnccs_t interface. - */ - tnccs_t public; - - /** - * Server identity - */ - identification_t *server_id; - - /** - * Client identity - */ - identification_t *peer_id; - - /** - * Server IP address - */ - host_t *server_ip; - - /** - * Client IP address - */ - host_t *peer_ip; - - /** - * Detected TNC IF-TNCCS stack - */ - tls_t *tls; - - /** - * Underlying TNC IF-T transport protocol - */ - tnc_ift_type_t transport; - - /** - * Type of TNC client authentication - */ - uint32_t auth_type; - - /** - * Callback function to communicate recommendation (TNC Server only) - */ - tnccs_cb_t callback; - - /** - * reference count - */ - refcount_t ref; - -}; - -/** - * Determine the version of the IF-TNCCS protocol used by analyzing the first - * byte of the TNCCS batch received from a TNC Client according to the rules - * defined by section 3.5 "Interoperability with older IF-TNCCS versions" of - * the TCG TNC IF-TNCCS TLV Bindings Version 2.0 standard. - */ -static tnccs_type_t determine_tnccs_protocol(char version) -{ - switch (version) - { - case '\t': - case '\n': - case '\r': - case ' ': - case '<': - return TNCCS_1_1; - case 0x00: - return TNCCS_SOH; - case 0x02: - return TNCCS_2_0; - default: - return TNCCS_UNKNOWN; - } -} - -METHOD(tls_t, process, status_t, - private_tnccs_dynamic_t *this, void *buf, size_t buflen) -{ - tnccs_type_t type; - tnccs_t *tnccs; - - if (!this->tls) - { - if (buflen == 0) - { - return FAILED; - } - type = determine_tnccs_protocol(*(char*)buf); - DBG1(DBG_TNC, "%N protocol detected dynamically", - tnccs_type_names, type); - tnccs = tnc->tnccs->create_instance(tnc->tnccs, type, TRUE, - this->server_id, this->peer_id, this->server_ip, - this->peer_ip, this->transport, this->callback); - if (!tnccs) - { - DBG1(DBG_TNC, "%N protocol not supported", tnccs_type_names, type); - return FAILED; - } - tnccs->set_auth_type(tnccs, this->auth_type); - this->tls = &tnccs->tls; - } - return this->tls->process(this->tls, buf, buflen); -} - -METHOD(tls_t, build, status_t, - private_tnccs_dynamic_t *this, void *buf, size_t *buflen, size_t *msglen) -{ - if (!this->tls) - { - DBG1(DBG_TNC, "no TNCCS protocol detected, unable to respond"); - return FAILED; - } - return this->tls->build(this->tls, buf, buflen, msglen); -} - -METHOD(tls_t, is_server, bool, - private_tnccs_dynamic_t *this) -{ - return TRUE; -} - -METHOD(tls_t, get_server_id, identification_t*, - private_tnccs_dynamic_t *this) -{ - return this->server_id; -} - -METHOD(tls_t, set_peer_id, void, - private_tnccs_dynamic_t *this, identification_t *id) -{ - DESTROY_IF(this->peer_id); - this->peer_id = id->clone(id); - if (this->tls) - { - this->tls->set_peer_id(this->tls, id); - } -} - -METHOD(tls_t, get_peer_id, identification_t*, - private_tnccs_dynamic_t *this) -{ - return this->peer_id; -} - -METHOD(tls_t, get_purpose, tls_purpose_t, - private_tnccs_dynamic_t *this) -{ - return TLS_PURPOSE_EAP_TNC; -} - -METHOD(tls_t, is_complete, bool, - private_tnccs_dynamic_t *this) -{ - return this->tls ? this->tls->is_complete(this->tls) : FALSE; -} - -METHOD(tls_t, get_eap_msk, chunk_t, - private_tnccs_dynamic_t *this) -{ - return chunk_empty; -} - -METHOD(tls_t, destroy, void, - private_tnccs_dynamic_t *this) -{ - if (ref_put(&this->ref)) - { - DESTROY_IF(this->tls); - this->server_id->destroy(this->server_id); - this->peer_id->destroy(this->peer_id); - this->server_ip->destroy(this->server_ip); - this->peer_ip->destroy(this->peer_ip); - free(this); - } -} - -METHOD(tnccs_t, get_server_ip, host_t*, - private_tnccs_dynamic_t *this) -{ - return this->server_ip; -} - -METHOD(tnccs_t, get_peer_ip, host_t*, - private_tnccs_dynamic_t *this) -{ - return this->peer_ip; -} - -METHOD(tnccs_t, get_transport, tnc_ift_type_t, - private_tnccs_dynamic_t *this) -{ - return this->transport; -} - -METHOD(tnccs_t, set_transport, void, - private_tnccs_dynamic_t *this, tnc_ift_type_t transport) -{ - this->transport = transport; -} - -METHOD(tnccs_t, get_auth_type, uint32_t, - private_tnccs_dynamic_t *this) -{ - return this->auth_type; -} - -METHOD(tnccs_t, set_auth_type, void, - private_tnccs_dynamic_t *this, uint32_t auth_type) -{ - this->auth_type = auth_type; -} - -METHOD(tnccs_t, get_pdp_server, chunk_t, - private_tnccs_dynamic_t *this, uint16_t *port) -{ - tnccs_t *tnccs = (tnccs_t*)this->tls; - - if (!tnccs) - { - *port = 0; - return chunk_empty; - } - return tnccs->get_pdp_server(tnccs, port); -} - -METHOD(tnccs_t, get_ref, tnccs_t*, - private_tnccs_dynamic_t *this) -{ - ref_get(&this->ref); - return &this->public; -} - -/** - * See header - */ -tnccs_t* tnccs_dynamic_create(bool is_server, identification_t *server_id, - identification_t *peer_id, host_t *server_ip, - host_t *peer_ip, tnc_ift_type_t transport, - tnccs_cb_t cb) -{ - private_tnccs_dynamic_t *this; - - INIT(this, - .public = { - .tls = { - .process = _process, - .build = _build, - .is_server = _is_server, - .get_server_id = _get_server_id, - .set_peer_id = _set_peer_id, - .get_peer_id = _get_peer_id, - .get_purpose = _get_purpose, - .is_complete = _is_complete, - .get_eap_msk = _get_eap_msk, - .destroy = _destroy, - }, - .get_server_ip = _get_server_ip, - .get_peer_ip = _get_peer_ip, - .get_transport = _get_transport, - .set_transport = _set_transport, - .get_auth_type = _get_auth_type, - .set_auth_type = _set_auth_type, - .get_pdp_server = _get_pdp_server, - .get_ref = _get_ref, - }, - .server_id = server_id->clone(server_id), - .peer_id = peer_id->clone(peer_id), - .server_ip = server_ip->clone(server_ip), - .peer_ip = peer_ip->clone(peer_ip), - .transport = transport, - .callback = cb, - .ref = 1, - ); - - return &this->public; -} diff --git a/src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic.h b/src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic.h deleted file mode 100644 index 0c416f1ad..000000000 --- a/src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic.h +++ /dev/null @@ -1,46 +0,0 @@ -/* - * Copyright (C) 2011-2015 Andreas Steffen - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -/** - * @defgroup tnccs_dynamic_h tnccs_dynamic - * @{ @ingroup tnccs_dynamic - */ - -#ifndef TNCCS_DYNAMIC_H_ -#define TNCCS_DYNAMIC_H_ - -#include - -#include - -/** - * Create an instance of a dynamic TNC IF-TNCCS protocol handler. - * - * @param is_server TRUE to act as TNC Server, FALSE for TNC Client - * @param server_id Server identity - * @param peer_id Client identity - * @param server_ip Server IP address - * @param peer_ip Client IP address - * @param transport Underlying IF-T transport protocol - * @param cb Callback function if TNC Server, NULL if TNC Client - * @return dynamic TNC IF-TNCCS protocol stack - */ -tnccs_t* tnccs_dynamic_create(bool is_server, identification_t *server_id, - identification_t *peer_id, host_t *server_ip, - host_t *peer_ip, tnc_ift_type_t transport, - tnccs_cb_t cb); - -#endif /** TNCCS_DYNAMIC_H_ @}*/ diff --git a/src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic_plugin.c b/src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic_plugin.c deleted file mode 100644 index 2b044f6c6..000000000 --- a/src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic_plugin.c +++ /dev/null @@ -1,63 +0,0 @@ -/* - * Copyright (C) 2011 Andreas Steffen - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -#include "tnccs_dynamic_plugin.h" -#include "tnccs_dynamic.h" - -#include - -METHOD(plugin_t, get_name, char*, - tnccs_dynamic_plugin_t *this) -{ - return "tnccs-dynamic"; -} - -METHOD(plugin_t, get_features, int, - tnccs_dynamic_plugin_t *this, plugin_feature_t *features[]) -{ - static plugin_feature_t f[] = { - PLUGIN_CALLBACK(tnccs_method_register, tnccs_dynamic_create), - PLUGIN_PROVIDE(CUSTOM, "tnccs-dynamic"), - PLUGIN_DEPENDS(CUSTOM, "tnccs-1.1"), - PLUGIN_DEPENDS(CUSTOM, "tnccs-2.0"), - }; - *features = f; - return countof(f); -} - -METHOD(plugin_t, destroy, void, - tnccs_dynamic_plugin_t *this) -{ - free(this); -} - -/* - * see header file - */ -PLUGIN_DEFINE(tnccs_dynamic) -{ - tnccs_dynamic_plugin_t *this; - - INIT(this, - .plugin = { - .get_name = _get_name, - .get_features = _get_features, - .destroy = _destroy, - }, - ); - - return &this->plugin; -} diff --git a/src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic_plugin.h b/src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic_plugin.h deleted file mode 100644 index 0bec41279..000000000 --- a/src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic_plugin.h +++ /dev/null @@ -1,43 +0,0 @@ -/* - * Copyright (C) 2011 Andreas Steffen - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -/** - * @defgroup tnccs_dynamic tnccs_dynamic - * @ingroup tplugins - * - * @defgroup tnccs_dynamic_plugin tnccs_dynamic_plugin - * @{ @ingroup tnccs_dynamic - */ - -#ifndef TNCCS_DYNAMIC_PLUGIN_H_ -#define TNCCS_DYNAMIC_PLUGIN_H_ - -#include - -typedef struct tnccs_dynamic_plugin_t tnccs_dynamic_plugin_t; - -/** - * EAP-TNC plugin - */ -struct tnccs_dynamic_plugin_t { - - /** - * implements plugin interface - */ - plugin_t plugin; -}; - -#endif /** TNCCS_DYNAMIC_PLUGIN_H_ @}*/ diff --git a/src/libtnccs/tnc/tnccs/tnccs_manager.c b/src/libtnccs/tnc/tnccs/tnccs_manager.c index f94a17d3f..ee19732b4 100644 --- a/src/libtnccs/tnc/tnccs/tnccs_manager.c +++ b/src/libtnccs/tnc/tnccs/tnccs_manager.c @@ -41,14 +41,6 @@ bool tnccs_method_register(plugin_t *plugin, plugin_feature_t *feature, { type = TNCCS_2_0; } - else if (streq(feature->arg.custom, "tnccs-1.1")) - { - type = TNCCS_1_1; - } - else if (streq(feature->arg.custom, "tnccs-dynamic")) - { - type = TNCCS_DYNAMIC; - } else { return FALSE; diff --git a/testing/scripts/recipes/013_strongswan.mk b/testing/scripts/recipes/013_strongswan.mk index 198b478c3..b53164ece 100644 --- a/testing/scripts/recipes/013_strongswan.mk +++ b/testing/scripts/recipes/013_strongswan.mk @@ -43,7 +43,6 @@ CONFIG_OPTS = \ --enable-tnc-imc \ --enable-tnc-imv \ --enable-tnccs-20 \ - --enable-tnccs-dynamic \ --enable-imc-test \ --enable-imv-test \ --enable-imc-scanner \