16d49e1aeSJan Lentfer /* 26d49e1aeSJan Lentfer * hostapd / EAP Authenticator state machine internal structures (RFC 4137) 36d49e1aeSJan Lentfer * Copyright (c) 2004-2007, Jouni Malinen <j@w1.fi> 46d49e1aeSJan Lentfer * 53ff40c12SJohn Marino * This software may be distributed under the terms of the BSD license. 63ff40c12SJohn Marino * See README for more details. 76d49e1aeSJan Lentfer */ 86d49e1aeSJan Lentfer 96d49e1aeSJan Lentfer #ifndef EAP_I_H 106d49e1aeSJan Lentfer #define EAP_I_H 116d49e1aeSJan Lentfer 126d49e1aeSJan Lentfer #include "wpabuf.h" 136d49e1aeSJan Lentfer #include "eap_server/eap.h" 146d49e1aeSJan Lentfer #include "eap_common/eap_common.h" 156d49e1aeSJan Lentfer 166d49e1aeSJan Lentfer /* RFC 4137 - EAP Standalone Authenticator */ 176d49e1aeSJan Lentfer 186d49e1aeSJan Lentfer /** 196d49e1aeSJan Lentfer * struct eap_method - EAP method interface 206d49e1aeSJan Lentfer * This structure defines the EAP method interface. Each method will need to 216d49e1aeSJan Lentfer * register its own EAP type, EAP name, and set of function pointers for method 226d49e1aeSJan Lentfer * specific operations. This interface is based on section 5.4 of RFC 4137. 236d49e1aeSJan Lentfer */ 246d49e1aeSJan Lentfer struct eap_method { 256d49e1aeSJan Lentfer int vendor; 266d49e1aeSJan Lentfer EapType method; 276d49e1aeSJan Lentfer const char *name; 286d49e1aeSJan Lentfer 296d49e1aeSJan Lentfer void * (*init)(struct eap_sm *sm); 306d49e1aeSJan Lentfer void * (*initPickUp)(struct eap_sm *sm); 316d49e1aeSJan Lentfer void (*reset)(struct eap_sm *sm, void *priv); 326d49e1aeSJan Lentfer 336d49e1aeSJan Lentfer struct wpabuf * (*buildReq)(struct eap_sm *sm, void *priv, u8 id); 346d49e1aeSJan Lentfer int (*getTimeout)(struct eap_sm *sm, void *priv); 356d49e1aeSJan Lentfer Boolean (*check)(struct eap_sm *sm, void *priv, 366d49e1aeSJan Lentfer struct wpabuf *respData); 376d49e1aeSJan Lentfer void (*process)(struct eap_sm *sm, void *priv, 386d49e1aeSJan Lentfer struct wpabuf *respData); 396d49e1aeSJan Lentfer Boolean (*isDone)(struct eap_sm *sm, void *priv); 406d49e1aeSJan Lentfer u8 * (*getKey)(struct eap_sm *sm, void *priv, size_t *len); 416d49e1aeSJan Lentfer /* isSuccess is not specified in draft-ietf-eap-statemachine-05.txt, 426d49e1aeSJan Lentfer * but it is useful in implementing Policy.getDecision() */ 436d49e1aeSJan Lentfer Boolean (*isSuccess)(struct eap_sm *sm, void *priv); 446d49e1aeSJan Lentfer 456d49e1aeSJan Lentfer /** 466d49e1aeSJan Lentfer * free - Free EAP method data 476d49e1aeSJan Lentfer * @method: Pointer to the method data registered with 486d49e1aeSJan Lentfer * eap_server_method_register(). 496d49e1aeSJan Lentfer * 506d49e1aeSJan Lentfer * This function will be called when the EAP method is being 516d49e1aeSJan Lentfer * unregistered. If the EAP method allocated resources during 526d49e1aeSJan Lentfer * registration (e.g., allocated struct eap_method), they should be 536d49e1aeSJan Lentfer * freed in this function. No other method functions will be called 546d49e1aeSJan Lentfer * after this call. If this function is not defined (i.e., function 556d49e1aeSJan Lentfer * pointer is %NULL), a default handler is used to release the method 566d49e1aeSJan Lentfer * data with free(method). This is suitable for most cases. 576d49e1aeSJan Lentfer */ 586d49e1aeSJan Lentfer void (*free)(struct eap_method *method); 596d49e1aeSJan Lentfer 606d49e1aeSJan Lentfer #define EAP_SERVER_METHOD_INTERFACE_VERSION 1 616d49e1aeSJan Lentfer /** 626d49e1aeSJan Lentfer * version - Version of the EAP server method interface 636d49e1aeSJan Lentfer * 646d49e1aeSJan Lentfer * The EAP server method implementation should set this variable to 656d49e1aeSJan Lentfer * EAP_SERVER_METHOD_INTERFACE_VERSION. This is used to verify that the 666d49e1aeSJan Lentfer * EAP method is using supported API version when using dynamically 676d49e1aeSJan Lentfer * loadable EAP methods. 686d49e1aeSJan Lentfer */ 696d49e1aeSJan Lentfer int version; 706d49e1aeSJan Lentfer 716d49e1aeSJan Lentfer /** 726d49e1aeSJan Lentfer * next - Pointer to the next EAP method 736d49e1aeSJan Lentfer * 746d49e1aeSJan Lentfer * This variable is used internally in the EAP method registration code 756d49e1aeSJan Lentfer * to create a linked list of registered EAP methods. 766d49e1aeSJan Lentfer */ 776d49e1aeSJan Lentfer struct eap_method *next; 786d49e1aeSJan Lentfer 796d49e1aeSJan Lentfer /** 806d49e1aeSJan Lentfer * get_emsk - Get EAP method specific keying extended material (EMSK) 816d49e1aeSJan Lentfer * @sm: Pointer to EAP state machine allocated with eap_sm_init() 826d49e1aeSJan Lentfer * @priv: Pointer to private EAP method data from eap_method::init() 836d49e1aeSJan Lentfer * @len: Pointer to a variable to store EMSK length 846d49e1aeSJan Lentfer * Returns: EMSK or %NULL if not available 856d49e1aeSJan Lentfer * 866d49e1aeSJan Lentfer * This function can be used to get the extended keying material from 876d49e1aeSJan Lentfer * the EAP method. The key may already be stored in the method-specific 886d49e1aeSJan Lentfer * private data or this function may derive the key. 896d49e1aeSJan Lentfer */ 906d49e1aeSJan Lentfer u8 * (*get_emsk)(struct eap_sm *sm, void *priv, size_t *len); 91*a1157835SDaniel Fojt 92*a1157835SDaniel Fojt /** 93*a1157835SDaniel Fojt * getSessionId - Get EAP method specific Session-Id 94*a1157835SDaniel Fojt * @sm: Pointer to EAP state machine allocated with eap_server_sm_init() 95*a1157835SDaniel Fojt * @priv: Pointer to private EAP method data from eap_method::init() 96*a1157835SDaniel Fojt * @len: Pointer to a variable to store Session-Id length 97*a1157835SDaniel Fojt * Returns: Session-Id or %NULL if not available 98*a1157835SDaniel Fojt * 99*a1157835SDaniel Fojt * This function can be used to get the Session-Id from the EAP method. 100*a1157835SDaniel Fojt * The Session-Id may already be stored in the method-specific private 101*a1157835SDaniel Fojt * data or this function may derive the Session-Id. 102*a1157835SDaniel Fojt */ 103*a1157835SDaniel Fojt u8 * (*getSessionId)(struct eap_sm *sm, void *priv, size_t *len); 1046d49e1aeSJan Lentfer }; 1056d49e1aeSJan Lentfer 1066d49e1aeSJan Lentfer /** 1076d49e1aeSJan Lentfer * struct eap_sm - EAP server state machine data 1086d49e1aeSJan Lentfer */ 1096d49e1aeSJan Lentfer struct eap_sm { 1106d49e1aeSJan Lentfer enum { 1116d49e1aeSJan Lentfer EAP_DISABLED, EAP_INITIALIZE, EAP_IDLE, EAP_RECEIVED, 1126d49e1aeSJan Lentfer EAP_INTEGRITY_CHECK, EAP_METHOD_RESPONSE, EAP_METHOD_REQUEST, 1136d49e1aeSJan Lentfer EAP_PROPOSE_METHOD, EAP_SELECT_ACTION, EAP_SEND_REQUEST, 1146d49e1aeSJan Lentfer EAP_DISCARD, EAP_NAK, EAP_RETRANSMIT, EAP_SUCCESS, EAP_FAILURE, 1156d49e1aeSJan Lentfer EAP_TIMEOUT_FAILURE, EAP_PICK_UP_METHOD, 1166d49e1aeSJan Lentfer EAP_INITIALIZE_PASSTHROUGH, EAP_IDLE2, EAP_RETRANSMIT2, 1176d49e1aeSJan Lentfer EAP_RECEIVED2, EAP_DISCARD2, EAP_SEND_REQUEST2, 1186d49e1aeSJan Lentfer EAP_AAA_REQUEST, EAP_AAA_RESPONSE, EAP_AAA_IDLE, 119*a1157835SDaniel Fojt EAP_TIMEOUT_FAILURE2, EAP_FAILURE2, EAP_SUCCESS2, 120*a1157835SDaniel Fojt EAP_INITIATE_REAUTH_START, EAP_INITIATE_RECEIVED 1216d49e1aeSJan Lentfer } EAP_state; 1226d49e1aeSJan Lentfer 1236d49e1aeSJan Lentfer /* Constants */ 1246d49e1aeSJan Lentfer int MaxRetrans; 1256d49e1aeSJan Lentfer 1266d49e1aeSJan Lentfer struct eap_eapol_interface eap_if; 1276d49e1aeSJan Lentfer 1286d49e1aeSJan Lentfer /* Full authenticator state machine local variables */ 1296d49e1aeSJan Lentfer 1303ff40c12SJohn Marino /* Long-term (maintained between packets) */ 1316d49e1aeSJan Lentfer EapType currentMethod; 1326d49e1aeSJan Lentfer int currentId; 1336d49e1aeSJan Lentfer enum { 1346d49e1aeSJan Lentfer METHOD_PROPOSED, METHOD_CONTINUE, METHOD_END 1356d49e1aeSJan Lentfer } methodState; 1366d49e1aeSJan Lentfer int retransCount; 1376d49e1aeSJan Lentfer struct wpabuf *lastReqData; 1386d49e1aeSJan Lentfer int methodTimeout; 1396d49e1aeSJan Lentfer 1406d49e1aeSJan Lentfer /* Short-term (not maintained between packets) */ 1416d49e1aeSJan Lentfer Boolean rxResp; 142*a1157835SDaniel Fojt Boolean rxInitiate; 1436d49e1aeSJan Lentfer int respId; 1446d49e1aeSJan Lentfer EapType respMethod; 1456d49e1aeSJan Lentfer int respVendor; 1466d49e1aeSJan Lentfer u32 respVendorMethod; 1476d49e1aeSJan Lentfer Boolean ignore; 1486d49e1aeSJan Lentfer enum { 1496d49e1aeSJan Lentfer DECISION_SUCCESS, DECISION_FAILURE, DECISION_CONTINUE, 150*a1157835SDaniel Fojt DECISION_PASSTHROUGH, DECISION_INITIATE_REAUTH_START 1516d49e1aeSJan Lentfer } decision; 1526d49e1aeSJan Lentfer 1536d49e1aeSJan Lentfer /* Miscellaneous variables */ 1546d49e1aeSJan Lentfer const struct eap_method *m; /* selected EAP method */ 1556d49e1aeSJan Lentfer /* not defined in RFC 4137 */ 1566d49e1aeSJan Lentfer Boolean changed; 1576d49e1aeSJan Lentfer void *eapol_ctx, *msg_ctx; 158*a1157835SDaniel Fojt const struct eapol_callbacks *eapol_cb; 1596d49e1aeSJan Lentfer void *eap_method_priv; 1606d49e1aeSJan Lentfer u8 *identity; 1616d49e1aeSJan Lentfer size_t identity_len; 162*a1157835SDaniel Fojt char *serial_num; 163*a1157835SDaniel Fojt char imsi[20]; 1646d49e1aeSJan Lentfer /* Whether Phase 2 method should validate identity match */ 1656d49e1aeSJan Lentfer int require_identity_match; 1666d49e1aeSJan Lentfer int lastId; /* Identifier used in the last EAP-Packet */ 1676d49e1aeSJan Lentfer struct eap_user *user; 1686d49e1aeSJan Lentfer int user_eap_method_index; 1696d49e1aeSJan Lentfer int init_phase2; 1706d49e1aeSJan Lentfer void *ssl_ctx; 1713ff40c12SJohn Marino struct eap_sim_db_data *eap_sim_db_priv; 1726d49e1aeSJan Lentfer Boolean backend_auth; 1736d49e1aeSJan Lentfer Boolean update_user; 1746d49e1aeSJan Lentfer int eap_server; 1756d49e1aeSJan Lentfer 1766d49e1aeSJan Lentfer int num_rounds; 1776d49e1aeSJan Lentfer enum { 1786d49e1aeSJan Lentfer METHOD_PENDING_NONE, METHOD_PENDING_WAIT, METHOD_PENDING_CONT 1796d49e1aeSJan Lentfer } method_pending; 1806d49e1aeSJan Lentfer 1816d49e1aeSJan Lentfer u8 *auth_challenge; 1826d49e1aeSJan Lentfer u8 *peer_challenge; 1836d49e1aeSJan Lentfer 1846d49e1aeSJan Lentfer u8 *pac_opaque_encr_key; 1856d49e1aeSJan Lentfer u8 *eap_fast_a_id; 1866d49e1aeSJan Lentfer size_t eap_fast_a_id_len; 1876d49e1aeSJan Lentfer char *eap_fast_a_id_info; 1886d49e1aeSJan Lentfer enum { 1896d49e1aeSJan Lentfer NO_PROV, ANON_PROV, AUTH_PROV, BOTH_PROV 1906d49e1aeSJan Lentfer } eap_fast_prov; 1916d49e1aeSJan Lentfer int pac_key_lifetime; 1926d49e1aeSJan Lentfer int pac_key_refresh_time; 193*a1157835SDaniel Fojt int eap_teap_auth; 194*a1157835SDaniel Fojt int eap_teap_pac_no_inner; 1956d49e1aeSJan Lentfer int eap_sim_aka_result_ind; 196*a1157835SDaniel Fojt int eap_sim_id; 1976d49e1aeSJan Lentfer int tnc; 1983ff40c12SJohn Marino u16 pwd_group; 1996d49e1aeSJan Lentfer struct wps_context *wps; 2006d49e1aeSJan Lentfer struct wpabuf *assoc_wps_ie; 2013ff40c12SJohn Marino struct wpabuf *assoc_p2p_ie; 2026d49e1aeSJan Lentfer 2036d49e1aeSJan Lentfer Boolean start_reauth; 2043ff40c12SJohn Marino 2053ff40c12SJohn Marino u8 peer_addr[ETH_ALEN]; 2063ff40c12SJohn Marino 2073ff40c12SJohn Marino /* Fragmentation size for EAP method init() handler */ 2083ff40c12SJohn Marino int fragment_size; 2093ff40c12SJohn Marino 2103ff40c12SJohn Marino int pbc_in_m1; 2113ff40c12SJohn Marino 2123ff40c12SJohn Marino const u8 *server_id; 2133ff40c12SJohn Marino size_t server_id_len; 214*a1157835SDaniel Fojt 215*a1157835SDaniel Fojt Boolean initiate_reauth_start_sent; 216*a1157835SDaniel Fojt Boolean try_initiate_reauth; 217*a1157835SDaniel Fojt int erp; 218*a1157835SDaniel Fojt unsigned int tls_session_lifetime; 219*a1157835SDaniel Fojt unsigned int tls_flags; 220*a1157835SDaniel Fojt 221*a1157835SDaniel Fojt #ifdef CONFIG_TESTING_OPTIONS 222*a1157835SDaniel Fojt u32 tls_test_flags; 223*a1157835SDaniel Fojt #endif /* CONFIG_TESTING_OPTIONS */ 2246d49e1aeSJan Lentfer }; 2256d49e1aeSJan Lentfer 2266d49e1aeSJan Lentfer int eap_user_get(struct eap_sm *sm, const u8 *identity, size_t identity_len, 2276d49e1aeSJan Lentfer int phase2); 228*a1157835SDaniel Fojt void eap_log_msg(struct eap_sm *sm, const char *fmt, ...) 229*a1157835SDaniel Fojt PRINTF_FORMAT(2, 3); 2306d49e1aeSJan Lentfer void eap_sm_process_nak(struct eap_sm *sm, const u8 *nak_list, size_t len); 2316d49e1aeSJan Lentfer 2326d49e1aeSJan Lentfer #endif /* EAP_I_H */ 233