tnccs-dynamic: Add missing checks for underlying TNCCS instance

In order for the TNCCS instance to get created, `process()` has to be
called first.  However, if the client responds to the initial request
with an empty EAP packet, `tls_eap_t` interprets that as acknowledgement
and directly calls `build_pkt()`, which attempts to call `build()` here
and triggers a NULL-pointer dereference.  Similarly, `process()` is
skipped if the client sends an EAP packet that has the EAP_TLS|PT_START
flag set.

The `get_pdp_server()` method is called when the EAP-TNC method that
owns this instance is destroyed and would likewise trigger a crash if
e.g. the client never responded and the EAP-TNC instance is destroyed
without `process()` ever being called.

Fixes: f652995b2123 ("implemented dynamic detection of TNCCS protocol")

diff --git a/src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic.c b/src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic.c
index 269fde3b69e5395db08d66b114c09c3db44cbc1f..c4796039af566306ed5dd957b6d088f334ecbde3 100644 (file)
--- a/src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic.c
+++ b/src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic.c
@@ -124,7 +124,7 @@ METHOD(tls_t, process, status_t,
                                                        this->peer_ip, this->transport, this->callback);
                if (!tnccs)
                {
-                       DBG1(DBG_TNC, "N% protocol not supported", tnccs_type_names, type);
+                       DBG1(DBG_TNC, "%N protocol not supported", tnccs_type_names, type);
                        return FAILED;
                }
                tnccs->set_auth_type(tnccs, this->auth_type);
@@ -136,6 +136,11 @@ METHOD(tls_t, process, status_t,
 METHOD(tls_t, build, status_t,
        private_tnccs_dynamic_t *this, void *buf, size_t *buflen, size_t *msglen)
 {
+       if (!this->tls)
+       {
+               DBG1(DBG_TNC, "no TNCCS protocol detected, unable to respond");
+               return FAILED;
+       }
        return this->tls->build(this->tls, buf, buflen, msglen);
 }
 
@@ -241,6 +246,11 @@ METHOD(tnccs_t, get_pdp_server, chunk_t,
 {
        tnccs_t *tnccs = (tnccs_t*)this->tls;
 
+       if (!tnccs)
+       {
+               *port = 0;
+               return chunk_empty;
+       }
        return tnccs->get_pdp_server(tnccs, port);
 }