tnccs-dynamic: Add missing checks for underlying TNCCS instance

In order for the TNCCS instance to get created, `process()` has to be
called first.  However, if the client responds to the initial request
with an empty EAP packet, `tls_eap_t` interprets that as acknowledgement
and directly calls `build_pkt()`, which attempts to call `build()` here
and triggers a NULL-pointer dereference.  Similarly, `process()` is
skipped if the client sends an EAP packet that has the EAP_TLS|PT_START
flag set.

The `get_pdp_server()` method is called when the EAP-TNC method that
owns this instance is destroyed and would likewise trigger a crash if
e.g. the client never responded and the EAP-TNC instance is destroyed
without `process()` ever being called.

Fixes: f652995b21 ("implemented dynamic detection of TNCCS protocol")
This commit is contained in:
Tobias Brunner
2026-07-24 08:47:37 +02:00
parent 313d1ef88a
commit f1c70a04d5
@@ -124,7 +124,7 @@ METHOD(tls_t, process, status_t,
this->peer_ip, this->transport, this->callback);
if (!tnccs)
{
DBG1(DBG_TNC, "N% protocol not supported", tnccs_type_names, type);
DBG1(DBG_TNC, "%N protocol not supported", tnccs_type_names, type);
return FAILED;
}
tnccs->set_auth_type(tnccs, this->auth_type);
@@ -136,6 +136,11 @@ METHOD(tls_t, process, status_t,
METHOD(tls_t, build, status_t,
private_tnccs_dynamic_t *this, void *buf, size_t *buflen, size_t *msglen)
{
if (!this->tls)
{
DBG1(DBG_TNC, "no TNCCS protocol detected, unable to respond");
return FAILED;
}
return this->tls->build(this->tls, buf, buflen, msglen);
}
@@ -241,6 +246,11 @@ METHOD(tnccs_t, get_pdp_server, chunk_t,
{
tnccs_t *tnccs = (tnccs_t*)this->tls;
if (!tnccs)
{
*port = 0;
return chunk_empty;
}
return tnccs->get_pdp_server(tnccs, port);
}