1 /* 2 * hostapd / EAP Authenticator state machine internal structures (RFC 4137) 3 * Copyright (c) 2004-2007, Jouni Malinen <j@w1.fi> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 * Alternatively, this software may be distributed under the terms of BSD 10 * license. 11 * 12 * See README and COPYING for more details. 13 */ 14 15 #ifndef EAP_I_H 16 #define EAP_I_H 17 18 #include "wpabuf.h" 19 #include "eap_server/eap.h" 20 #include "eap_common/eap_common.h" 21 22 /* RFC 4137 - EAP Standalone Authenticator */ 23 24 /** 25 * struct eap_method - EAP method interface 26 * This structure defines the EAP method interface. Each method will need to 27 * register its own EAP type, EAP name, and set of function pointers for method 28 * specific operations. This interface is based on section 5.4 of RFC 4137. 29 */ 30 struct eap_method { 31 int vendor; 32 EapType method; 33 const char *name; 34 35 void * (*init)(struct eap_sm *sm); 36 void * (*initPickUp)(struct eap_sm *sm); 37 void (*reset)(struct eap_sm *sm, void *priv); 38 39 struct wpabuf * (*buildReq)(struct eap_sm *sm, void *priv, u8 id); 40 int (*getTimeout)(struct eap_sm *sm, void *priv); 41 Boolean (*check)(struct eap_sm *sm, void *priv, 42 struct wpabuf *respData); 43 void (*process)(struct eap_sm *sm, void *priv, 44 struct wpabuf *respData); 45 Boolean (*isDone)(struct eap_sm *sm, void *priv); 46 u8 * (*getKey)(struct eap_sm *sm, void *priv, size_t *len); 47 /* isSuccess is not specified in draft-ietf-eap-statemachine-05.txt, 48 * but it is useful in implementing Policy.getDecision() */ 49 Boolean (*isSuccess)(struct eap_sm *sm, void *priv); 50 51 /** 52 * free - Free EAP method data 53 * @method: Pointer to the method data registered with 54 * eap_server_method_register(). 55 * 56 * This function will be called when the EAP method is being 57 * unregistered. If the EAP method allocated resources during 58 * registration (e.g., allocated struct eap_method), they should be 59 * freed in this function. No other method functions will be called 60 * after this call. If this function is not defined (i.e., function 61 * pointer is %NULL), a default handler is used to release the method 62 * data with free(method). This is suitable for most cases. 63 */ 64 void (*free)(struct eap_method *method); 65 66 #define EAP_SERVER_METHOD_INTERFACE_VERSION 1 67 /** 68 * version - Version of the EAP server method interface 69 * 70 * The EAP server method implementation should set this variable to 71 * EAP_SERVER_METHOD_INTERFACE_VERSION. This is used to verify that the 72 * EAP method is using supported API version when using dynamically 73 * loadable EAP methods. 74 */ 75 int version; 76 77 /** 78 * next - Pointer to the next EAP method 79 * 80 * This variable is used internally in the EAP method registration code 81 * to create a linked list of registered EAP methods. 82 */ 83 struct eap_method *next; 84 85 /** 86 * get_emsk - Get EAP method specific keying extended material (EMSK) 87 * @sm: Pointer to EAP state machine allocated with eap_sm_init() 88 * @priv: Pointer to private EAP method data from eap_method::init() 89 * @len: Pointer to a variable to store EMSK length 90 * Returns: EMSK or %NULL if not available 91 * 92 * This function can be used to get the extended keying material from 93 * the EAP method. The key may already be stored in the method-specific 94 * private data or this function may derive the key. 95 */ 96 u8 * (*get_emsk)(struct eap_sm *sm, void *priv, size_t *len); 97 }; 98 99 /** 100 * struct eap_sm - EAP server state machine data 101 */ 102 struct eap_sm { 103 enum { 104 EAP_DISABLED, EAP_INITIALIZE, EAP_IDLE, EAP_RECEIVED, 105 EAP_INTEGRITY_CHECK, EAP_METHOD_RESPONSE, EAP_METHOD_REQUEST, 106 EAP_PROPOSE_METHOD, EAP_SELECT_ACTION, EAP_SEND_REQUEST, 107 EAP_DISCARD, EAP_NAK, EAP_RETRANSMIT, EAP_SUCCESS, EAP_FAILURE, 108 EAP_TIMEOUT_FAILURE, EAP_PICK_UP_METHOD, 109 EAP_INITIALIZE_PASSTHROUGH, EAP_IDLE2, EAP_RETRANSMIT2, 110 EAP_RECEIVED2, EAP_DISCARD2, EAP_SEND_REQUEST2, 111 EAP_AAA_REQUEST, EAP_AAA_RESPONSE, EAP_AAA_IDLE, 112 EAP_TIMEOUT_FAILURE2, EAP_FAILURE2, EAP_SUCCESS2 113 } EAP_state; 114 115 /* Constants */ 116 int MaxRetrans; 117 118 struct eap_eapol_interface eap_if; 119 120 /* Full authenticator state machine local variables */ 121 122 /* Long-term (maintained betwen packets) */ 123 EapType currentMethod; 124 int currentId; 125 enum { 126 METHOD_PROPOSED, METHOD_CONTINUE, METHOD_END 127 } methodState; 128 int retransCount; 129 struct wpabuf *lastReqData; 130 int methodTimeout; 131 132 /* Short-term (not maintained between packets) */ 133 Boolean rxResp; 134 int respId; 135 EapType respMethod; 136 int respVendor; 137 u32 respVendorMethod; 138 Boolean ignore; 139 enum { 140 DECISION_SUCCESS, DECISION_FAILURE, DECISION_CONTINUE, 141 DECISION_PASSTHROUGH 142 } decision; 143 144 /* Miscellaneous variables */ 145 const struct eap_method *m; /* selected EAP method */ 146 /* not defined in RFC 4137 */ 147 Boolean changed; 148 void *eapol_ctx, *msg_ctx; 149 struct eapol_callbacks *eapol_cb; 150 void *eap_method_priv; 151 u8 *identity; 152 size_t identity_len; 153 /* Whether Phase 2 method should validate identity match */ 154 int require_identity_match; 155 int lastId; /* Identifier used in the last EAP-Packet */ 156 struct eap_user *user; 157 int user_eap_method_index; 158 int init_phase2; 159 void *ssl_ctx; 160 void *eap_sim_db_priv; 161 Boolean backend_auth; 162 Boolean update_user; 163 int eap_server; 164 165 int num_rounds; 166 enum { 167 METHOD_PENDING_NONE, METHOD_PENDING_WAIT, METHOD_PENDING_CONT 168 } method_pending; 169 170 u8 *auth_challenge; 171 u8 *peer_challenge; 172 173 u8 *pac_opaque_encr_key; 174 u8 *eap_fast_a_id; 175 size_t eap_fast_a_id_len; 176 char *eap_fast_a_id_info; 177 enum { 178 NO_PROV, ANON_PROV, AUTH_PROV, BOTH_PROV 179 } eap_fast_prov; 180 int pac_key_lifetime; 181 int pac_key_refresh_time; 182 int eap_sim_aka_result_ind; 183 int tnc; 184 struct wps_context *wps; 185 struct wpabuf *assoc_wps_ie; 186 187 Boolean start_reauth; 188 189 u8 peer_addr[ETH_ALEN]; 190 }; 191 192 int eap_user_get(struct eap_sm *sm, const u8 *identity, size_t identity_len, 193 int phase2); 194 void eap_sm_process_nak(struct eap_sm *sm, const u8 *nak_list, size_t len); 195 196 #endif /* EAP_I_H */ 197