From: Tobias Brunner <tobias@strongswan.org>
Date: Wed, 8 Jul 2026 16:36:56 +0000 (+0200)
Subject: tnccs-dynamic: Add missing checks for underlying TNCCS instance
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f1c70a04d5f145e2600a6eb310f9ea54eedf4d98;p=thirdparty%2Fstrongswan.git

tnccs-dynamic: Add missing checks for underlying TNCCS instance

In order for the TNCCS instance to get created, `process()` has to be
called first.  However, if the client responds to the initial request
with an empty EAP packet, `tls_eap_t` interprets that as acknowledgement
and directly calls `build_pkt()`, which attempts to call `build()` here
and triggers a NULL-pointer dereference.  Similarly, `process()` is
skipped if the client sends an EAP packet that has the EAP_TLS|PT_START
flag set.

The `get_pdp_server()` method is called when the EAP-TNC method that
owns this instance is destroyed and would likewise trigger a crash if
e.g. the client never responded and the EAP-TNC instance is destroyed
without `process()` ever being called.

Fixes: f652995b2123 ("implemented dynamic detection of TNCCS protocol")
---

diff --git a/src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic.c b/src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic.c
index 269fde3b69..c4796039af 100644
--- a/src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic.c
+++ b/src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic.c
@@ -124,7 +124,7 @@ METHOD(tls_t, process, status_t,
 							this->peer_ip, this->transport,	this->callback);
 		if (!tnccs)
 		{
-			DBG1(DBG_TNC, "N% protocol not supported", tnccs_type_names, type);
+			DBG1(DBG_TNC, "%N protocol not supported", tnccs_type_names, type);
 			return FAILED;
 		}
 		tnccs->set_auth_type(tnccs, this->auth_type);
@@ -136,6 +136,11 @@ METHOD(tls_t, process, status_t,
 METHOD(tls_t, build, status_t,
 	private_tnccs_dynamic_t *this, void *buf, size_t *buflen, size_t *msglen)
 {
+	if (!this->tls)
+	{
+		DBG1(DBG_TNC, "no TNCCS protocol detected, unable to respond");
+		return FAILED;
+	}
 	return this->tls->build(this->tls, buf, buflen, msglen);
 }
 
@@ -241,6 +246,11 @@ METHOD(tnccs_t, get_pdp_server, chunk_t,
 {
 	tnccs_t *tnccs = (tnccs_t*)this->tls;
 
+	if (!tnccs)
+	{
+		*port = 0;
+		return chunk_empty;
+	}
 	return tnccs->get_pdp_server(tnccs, port);
 }