src/eap_server/eap_i.h

   1 /*
   2  * hostapd / EAP Authenticator state machine internal structures (RFC 4137)
   3  * Copyright (c) 2004-2007, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #ifndef EAP_I_H
  16 #define EAP_I_H
  17
  18 #include "wpabuf.h"
  19 #include "eap_server/eap.h"
  20 #include "eap_common/eap_common.h"
  21
  22 /* RFC 4137 - EAP Standalone Authenticator */
  23
  24 /**
  25  * struct eap_method - EAP method interface
  26  * This structure defines the EAP method interface. Each method will need to
  27  * register its own EAP type, EAP name, and set of function pointers for method
  28  * specific operations. This interface is based on section 5.4 of RFC 4137.
  29  */
  30 struct eap_method {
  31         int vendor;
  32         EapType method;
  33         const char *name;
  34
  35         void * (*init)(struct eap_sm *sm);
  36         void * (*initPickUp)(struct eap_sm *sm);
  37         void (*reset)(struct eap_sm *sm, void *priv);
  38
  39         struct wpabuf * (*buildReq)(struct eap_sm *sm, void *priv, u8 id);
  40         int (*getTimeout)(struct eap_sm *sm, void *priv);
  41         Boolean (*check)(struct eap_sm *sm, void *priv,
  42                          struct wpabuf *respData);
  43         void (*process)(struct eap_sm *sm, void *priv,
  44                         struct wpabuf *respData);
  45         Boolean (*isDone)(struct eap_sm *sm, void *priv);
  46         u8 * (*getKey)(struct eap_sm *sm, void *priv, size_t *len);
  47         /* isSuccess is not specified in draft-ietf-eap-statemachine-05.txt,
  48          * but it is useful in implementing Policy.getDecision() */
  49         Boolean (*isSuccess)(struct eap_sm *sm, void *priv);
  50
  51         /**
  52          * free - Free EAP method data
  53          * @method: Pointer to the method data registered with
  54          * eap_server_method_register().
  55          *
  56          * This function will be called when the EAP method is being
  57          * unregistered. If the EAP method allocated resources during
  58          * registration (e.g., allocated struct eap_method), they should be
  59          * freed in this function. No other method functions will be called
  60          * after this call. If this function is not defined (i.e., function
  61          * pointer is %NULL), a default handler is used to release the method
  62          * data with free(method). This is suitable for most cases.
  63          */
  64         void (*free)(struct eap_method *method);
  65
  66 #define EAP_SERVER_METHOD_INTERFACE_VERSION 1
  67         /**
  68          * version - Version of the EAP server method interface
  69          *
  70          * The EAP server method implementation should set this variable to
  71          * EAP_SERVER_METHOD_INTERFACE_VERSION. This is used to verify that the
  72          * EAP method is using supported API version when using dynamically
  73          * loadable EAP methods.
  74          */
  75         int version;
  76
  77         /**
  78          * next - Pointer to the next EAP method
  79          *
  80          * This variable is used internally in the EAP method registration code
  81          * to create a linked list of registered EAP methods.
  82          */
  83         struct eap_method *next;
  84
  85         /**
  86          * get_emsk - Get EAP method specific keying extended material (EMSK)
  87          * @sm: Pointer to EAP state machine allocated with eap_sm_init()
  88          * @priv: Pointer to private EAP method data from eap_method::init()
  89          * @len: Pointer to a variable to store EMSK length
  90          * Returns: EMSK or %NULL if not available
  91          *
  92          * This function can be used to get the extended keying material from
  93          * the EAP method. The key may already be stored in the method-specific
  94          * private data or this function may derive the key.
  95          */
  96         u8 * (*get_emsk)(struct eap_sm *sm, void *priv, size_t *len);
  97 };
  98
  99 /**
 100  * struct eap_sm - EAP server state machine data
 101  */
 102 struct eap_sm {
 103         enum {
 104                 EAP_DISABLED, EAP_INITIALIZE, EAP_IDLE, EAP_RECEIVED,
 105                 EAP_INTEGRITY_CHECK, EAP_METHOD_RESPONSE, EAP_METHOD_REQUEST,
 106                 EAP_PROPOSE_METHOD, EAP_SELECT_ACTION, EAP_SEND_REQUEST,
 107                 EAP_DISCARD, EAP_NAK, EAP_RETRANSMIT, EAP_SUCCESS, EAP_FAILURE,
 108                 EAP_TIMEOUT_FAILURE, EAP_PICK_UP_METHOD,
 109                 EAP_INITIALIZE_PASSTHROUGH, EAP_IDLE2, EAP_RETRANSMIT2,
 110                 EAP_RECEIVED2, EAP_DISCARD2, EAP_SEND_REQUEST2,
 111                 EAP_AAA_REQUEST, EAP_AAA_RESPONSE, EAP_AAA_IDLE,
 112                 EAP_TIMEOUT_FAILURE2, EAP_FAILURE2, EAP_SUCCESS2
 113         } EAP_state;
 114
 115         /* Constants */
 116         int MaxRetrans;
 117
 118         struct eap_eapol_interface eap_if;
 119
 120         /* Full authenticator state machine local variables */
 121
 122         /* Long-term (maintained betwen packets) */
 123         EapType currentMethod;
 124         int currentId;
 125         enum {
 126                 METHOD_PROPOSED, METHOD_CONTINUE, METHOD_END
 127         } methodState;
 128         int retransCount;
 129         struct wpabuf *lastReqData;
 130         int methodTimeout;
 131
 132         /* Short-term (not maintained between packets) */
 133         Boolean rxResp;
 134         int respId;
 135         EapType respMethod;
 136         int respVendor;
 137         u32 respVendorMethod;
 138         Boolean ignore;
 139         enum {
 140                 DECISION_SUCCESS, DECISION_FAILURE, DECISION_CONTINUE,
 141                 DECISION_PASSTHROUGH
 142         } decision;
 143
 144         /* Miscellaneous variables */
 145         const struct eap_method *m; /* selected EAP method */
 146         /* not defined in RFC 4137 */
 147         Boolean changed;
 148         void *eapol_ctx, *msg_ctx;
 149         struct eapol_callbacks *eapol_cb;
 150         void *eap_method_priv;
 151         u8 *identity;
 152         size_t identity_len;
 153         /* Whether Phase 2 method should validate identity match */
 154         int require_identity_match;
 155         int lastId; /* Identifier used in the last EAP-Packet */
 156         struct eap_user *user;
 157         int user_eap_method_index;
 158         int init_phase2;
 159         void *ssl_ctx;
 160         void *eap_sim_db_priv;
 161         Boolean backend_auth;
 162         Boolean update_user;
 163         int eap_server;
 164
 165         int num_rounds;
 166         enum {
 167                 METHOD_PENDING_NONE, METHOD_PENDING_WAIT, METHOD_PENDING_CONT
 168         } method_pending;
 169
 170         u8 *auth_challenge;
 171         u8 *peer_challenge;
 172
 173         u8 *pac_opaque_encr_key;
 174         u8 *eap_fast_a_id;
 175         size_t eap_fast_a_id_len;
 176         char *eap_fast_a_id_info;
 177         enum {
 178                 NO_PROV, ANON_PROV, AUTH_PROV, BOTH_PROV
 179         } eap_fast_prov;
 180         int pac_key_lifetime;
 181         int pac_key_refresh_time;
 182         int eap_sim_aka_result_ind;
 183         int tnc;
 184         struct wps_context *wps;
 185 };
 186
 187 int eap_user_get(struct eap_sm *sm, const u8 *identity, size_t identity_len,
 188                  int phase2);
 189 void eap_sm_process_nak(struct eap_sm *sm, const u8 *nak_list, size_t len);
 190
 191 #endif /* EAP_I_H */