[thirdparty/hostap.git] / src / eap_server / eap_i.h

/*
 * hostapd / EAP Authenticator state machine internal structures (RFC 4137)
 * Copyright (c) 2004-2007, Jouni Malinen <j@w1.fi>
 *
 * This software may be distributed under the terms of the BSD license.
 * See README for more details.
 */

#ifndef EAP_I_H
#define EAP_I_H

#include "wpabuf.h"
#include "eap_server/eap.h"
#include "eap_common/eap_common.h"

/* RFC 4137 - EAP Standalone Authenticator */

/**
 * struct eap_method - EAP method interface
 * This structure defines the EAP method interface. Each method will need to
 * register its own EAP type, EAP name, and set of function pointers for method
 * specific operations. This interface is based on section 5.4 of RFC 4137.
 */
struct eap_method {
	int vendor;
	enum eap_type method;
	const char *name;

	void * (*init)(struct eap_sm *sm);
	void * (*initPickUp)(struct eap_sm *sm);
	void (*reset)(struct eap_sm *sm, void *priv);

	struct wpabuf * (*buildReq)(struct eap_sm *sm, void *priv, u8 id);
	int (*getTimeout)(struct eap_sm *sm, void *priv);
	Boolean (*check)(struct eap_sm *sm, void *priv,
			 struct wpabuf *respData);
	void (*process)(struct eap_sm *sm, void *priv,
			struct wpabuf *respData);
	Boolean (*isDone)(struct eap_sm *sm, void *priv);
	u8 * (*getKey)(struct eap_sm *sm, void *priv, size_t *len);
	/* isSuccess is not specified in draft-ietf-eap-statemachine-05.txt,
	 * but it is useful in implementing Policy.getDecision() */
	Boolean (*isSuccess)(struct eap_sm *sm, void *priv);

	/**
	 * free - Free EAP method data
	 * @method: Pointer to the method data registered with
	 * eap_server_method_register().
	 *
	 * This function will be called when the EAP method is being
	 * unregistered. If the EAP method allocated resources during
	 * registration (e.g., allocated struct eap_method), they should be
	 * freed in this function. No other method functions will be called
	 * after this call. If this function is not defined (i.e., function
	 * pointer is %NULL), a default handler is used to release the method
	 * data with free(method). This is suitable for most cases.
	 */
	void (*free)(struct eap_method *method);

#define EAP_SERVER_METHOD_INTERFACE_VERSION 1
	/**
	 * version - Version of the EAP server method interface
	 *
	 * The EAP server method implementation should set this variable to
	 * EAP_SERVER_METHOD_INTERFACE_VERSION. This is used to verify that the
	 * EAP method is using supported API version when using dynamically
	 * loadable EAP methods.
	 */
	int version;

	/**
	 * next - Pointer to the next EAP method
	 *
	 * This variable is used internally in the EAP method registration code
	 * to create a linked list of registered EAP methods.
	 */
	struct eap_method *next;

	/**
	 * get_emsk - Get EAP method specific keying extended material (EMSK)
	 * @sm: Pointer to EAP state machine allocated with eap_sm_init()
	 * @priv: Pointer to private EAP method data from eap_method::init()
	 * @len: Pointer to a variable to store EMSK length
	 * Returns: EMSK or %NULL if not available
	 *
	 * This function can be used to get the extended keying material from
	 * the EAP method. The key may already be stored in the method-specific
	 * private data or this function may derive the key.
	 */
	u8 * (*get_emsk)(struct eap_sm *sm, void *priv, size_t *len);

	/**
	 * getSessionId - Get EAP method specific Session-Id
	 * @sm: Pointer to EAP state machine allocated with eap_server_sm_init()
	 * @priv: Pointer to private EAP method data from eap_method::init()
	 * @len: Pointer to a variable to store Session-Id length
	 * Returns: Session-Id or %NULL if not available
	 *
	 * This function can be used to get the Session-Id from the EAP method.
	 * The Session-Id may already be stored in the method-specific private
	 * data or this function may derive the Session-Id.
	 */
	u8 * (*getSessionId)(struct eap_sm *sm, void *priv, size_t *len);
};

/**
 * struct eap_sm - EAP server state machine data
 */
struct eap_sm {
	enum {
		EAP_DISABLED, EAP_INITIALIZE, EAP_IDLE, EAP_RECEIVED,
		EAP_INTEGRITY_CHECK, EAP_METHOD_RESPONSE, EAP_METHOD_REQUEST,
		EAP_PROPOSE_METHOD, EAP_SELECT_ACTION, EAP_SEND_REQUEST,
		EAP_DISCARD, EAP_NAK, EAP_RETRANSMIT, EAP_SUCCESS, EAP_FAILURE,
		EAP_TIMEOUT_FAILURE, EAP_PICK_UP_METHOD,
		EAP_INITIALIZE_PASSTHROUGH, EAP_IDLE2, EAP_RETRANSMIT2,
		EAP_RECEIVED2, EAP_DISCARD2, EAP_SEND_REQUEST2,
		EAP_AAA_REQUEST, EAP_AAA_RESPONSE, EAP_AAA_IDLE,
		EAP_TIMEOUT_FAILURE2, EAP_FAILURE2, EAP_SUCCESS2,
		EAP_INITIATE_REAUTH_START, EAP_INITIATE_RECEIVED
	} EAP_state;

	/* Constants */
	int MaxRetrans;

	struct eap_eapol_interface eap_if;

	/* Full authenticator state machine local variables */

	/* Long-term (maintained between packets) */
	enum eap_type currentMethod;
	int currentId;
	enum {
		METHOD_PROPOSED, METHOD_CONTINUE, METHOD_END
	} methodState;
	int retransCount;
	struct wpabuf *lastReqData;
	int methodTimeout;

	/* Short-term (not maintained between packets) */
	Boolean rxResp;
	Boolean rxInitiate;
	int respId;
	enum eap_type respMethod;
	int respVendor;
	u32 respVendorMethod;
	Boolean ignore;
	enum {
		DECISION_SUCCESS, DECISION_FAILURE, DECISION_CONTINUE,
		DECISION_PASSTHROUGH, DECISION_INITIATE_REAUTH_START
	} decision;

	/* Miscellaneous variables */
	const struct eap_method *m; /* selected EAP method */
	/* not defined in RFC 4137 */
	Boolean changed;
	void *eapol_ctx, *msg_ctx;
	const struct eapol_callbacks *eapol_cb;
	void *eap_method_priv;
	u8 *identity;
	size_t identity_len;
	char *serial_num;
	char imsi[20];
	/* Whether Phase 2 method should validate identity match */
	int require_identity_match;
	int lastId; /* Identifier used in the last EAP-Packet */
	struct eap_user *user;
	int user_eap_method_index;
	int init_phase2;
	void *ssl_ctx;
	struct eap_sim_db_data *eap_sim_db_priv;
	Boolean backend_auth;
	Boolean update_user;
	int eap_server;

	int num_rounds;
	enum {
		METHOD_PENDING_NONE, METHOD_PENDING_WAIT, METHOD_PENDING_CONT
	} method_pending;

	u8 *auth_challenge;
	u8 *peer_challenge;

	u8 *pac_opaque_encr_key;
	u8 *eap_fast_a_id;
	size_t eap_fast_a_id_len;
	char *eap_fast_a_id_info;
	enum {
		NO_PROV, ANON_PROV, AUTH_PROV, BOTH_PROV
	} eap_fast_prov;
	int pac_key_lifetime;
	int pac_key_refresh_time;
	int eap_teap_auth;
	int eap_teap_pac_no_inner;
	int eap_teap_separate_result;
	int eap_sim_aka_result_ind;
	int eap_sim_id;
	int tnc;
	u16 pwd_group;
	struct wps_context *wps;
	struct wpabuf *assoc_wps_ie;
	struct wpabuf *assoc_p2p_ie;

	Boolean start_reauth;

	u8 peer_addr[ETH_ALEN];

	/* Fragmentation size for EAP method init() handler */
	int fragment_size;

	int pbc_in_m1;

	const u8 *server_id;
	size_t server_id_len;

	Boolean initiate_reauth_start_sent;
	Boolean try_initiate_reauth;
	int erp;
	unsigned int tls_session_lifetime;
	unsigned int tls_flags;

#ifdef CONFIG_TESTING_OPTIONS
	u32 tls_test_flags;
#endif /* CONFIG_TESTING_OPTIONS */
};

int eap_user_get(struct eap_sm *sm, const u8 *identity, size_t identity_len,
		 int phase2);
void eap_log_msg(struct eap_sm *sm, const char *fmt, ...)
PRINTF_FORMAT(2, 3);
void eap_sm_process_nak(struct eap_sm *sm, const u8 *nak_list, size_t len);

#endif /* EAP_I_H */
Commit	Line	Data
6fc6879b JM	1	/*
	2	* hostapd / EAP Authenticator state machine internal structures (RFC 4137)
	3	* Copyright (c) 2004-2007, Jouni Malinen <j@w1.fi>
	4	*
0f3d578e JM	5	* This software may be distributed under the terms of the BSD license.
0f3d578e JM	6	* See README for more details.
6fc6879b JM	7	*/
	8
	9	#ifndef EAP_I_H
	10	#define EAP_I_H
	11
	12	#include "wpabuf.h"
	13	#include "eap_server/eap.h"
	14	#include "eap_common/eap_common.h"
	15
	16	/* RFC 4137 - EAP Standalone Authenticator */
	17
	18	/**
	19	* struct eap_method - EAP method interface
	20	* This structure defines the EAP method interface. Each method will need to
	21	* register its own EAP type, EAP name, and set of function pointers for method
	22	* specific operations. This interface is based on section 5.4 of RFC 4137.
	23	*/
	24	struct eap_method {
	25	int vendor;
5f2301a6	26	enum eap_type method;
6fc6879b JM	27	const char *name;
	28
	29	void * (init)(struct eap_sm sm);
	30	void * (initPickUp)(struct eap_sm sm);
	31	void (reset)(struct eap_sm sm, void *priv);
	32
	33	struct wpabuf * (buildReq)(struct eap_sm sm, void *priv, u8 id);
	34	int (getTimeout)(struct eap_sm sm, void *priv);
	35	Boolean (check)(struct eap_sm sm, void *priv,
	36	struct wpabuf *respData);
	37	void (process)(struct eap_sm sm, void *priv,
	38	struct wpabuf *respData);
	39	Boolean (isDone)(struct eap_sm sm, void *priv);
	40	u8 * (getKey)(struct eap_sm sm, void priv, size_t len);
	41	/* isSuccess is not specified in draft-ietf-eap-statemachine-05.txt,
	42	* but it is useful in implementing Policy.getDecision() */
	43	Boolean (isSuccess)(struct eap_sm sm, void *priv);
	44
	45	/**
	46	* free - Free EAP method data
	47	* @method: Pointer to the method data registered with
	48	* eap_server_method_register().
	49	*
	50	* This function will be called when the EAP method is being
	51	* unregistered. If the EAP method allocated resources during
	52	* registration (e.g., allocated struct eap_method), they should be
	53	* freed in this function. No other method functions will be called
	54	* after this call. If this function is not defined (i.e., function
	55	* pointer is %NULL), a default handler is used to release the method
	56	* data with free(method). This is suitable for most cases.
	57	*/
	58	void (free)(struct eap_method method);
	59
	60	#define EAP_SERVER_METHOD_INTERFACE_VERSION 1
	61	/**
	62	* version - Version of the EAP server method interface
	63	*
	64	* The EAP server method implementation should set this variable to
	65	* EAP_SERVER_METHOD_INTERFACE_VERSION. This is used to verify that the
	66	* EAP method is using supported API version when using dynamically
	67	* loadable EAP methods.
	68	*/
	69	int version;
	70
	71	/**
	72	* next - Pointer to the next EAP method
	73	*
	74	* This variable is used internally in the EAP method registration code
	75	* to create a linked list of registered EAP methods.
	76	*/
	77	struct eap_method *next;
	78
	79	/**
	80	* get_emsk - Get EAP method specific keying extended material (EMSK)
	81	* @sm: Pointer to EAP state machine allocated with eap_sm_init()
	82	* @priv: Pointer to private EAP method data from eap_method::init()
	83	* @len: Pointer to a variable to store EMSK length
	84	* Returns: EMSK or %NULL if not available
	85	*
	86	* This function can be used to get the extended keying material from
	87	* the EAP method. The key may already be stored in the method-specific
	88	* private data or this function may derive the key.
	89	*/
	90	u8 * (get_emsk)(struct eap_sm sm, void priv, size_t len);
d1f89dd7 JM	91
	92	/**
	93	* getSessionId - Get EAP method specific Session-Id
	94	* @sm: Pointer to EAP state machine allocated with eap_server_sm_init()
	95	* @priv: Pointer to private EAP method data from eap_method::init()
	96	* @len: Pointer to a variable to store Session-Id length
	97	* Returns: Session-Id or %NULL if not available
	98	*
	99	* This function can be used to get the Session-Id from the EAP method.
	100	* The Session-Id may already be stored in the method-specific private
	101	* data or this function may derive the Session-Id.
	102	*/
	103	u8 * (getSessionId)(struct eap_sm sm, void priv, size_t len);
6fc6879b JM	104	};
	105
	106	/**
	107	* struct eap_sm - EAP server state machine data
	108	*/
	109	struct eap_sm {
	110	enum {
	111	EAP_DISABLED, EAP_INITIALIZE, EAP_IDLE, EAP_RECEIVED,
	112	EAP_INTEGRITY_CHECK, EAP_METHOD_RESPONSE, EAP_METHOD_REQUEST,
	113	EAP_PROPOSE_METHOD, EAP_SELECT_ACTION, EAP_SEND_REQUEST,
	114	EAP_DISCARD, EAP_NAK, EAP_RETRANSMIT, EAP_SUCCESS, EAP_FAILURE,
	115	EAP_TIMEOUT_FAILURE, EAP_PICK_UP_METHOD,
	116	EAP_INITIALIZE_PASSTHROUGH, EAP_IDLE2, EAP_RETRANSMIT2,
	117	EAP_RECEIVED2, EAP_DISCARD2, EAP_SEND_REQUEST2,
	118	EAP_AAA_REQUEST, EAP_AAA_RESPONSE, EAP_AAA_IDLE,
2a5156a6	119	EAP_TIMEOUT_FAILURE2, EAP_FAILURE2, EAP_SUCCESS2,
d3bddd8b	120	EAP_INITIATE_REAUTH_START, EAP_INITIATE_RECEIVED
6fc6879b JM	121	} EAP_state;
	122
	123	/* Constants */
	124	int MaxRetrans;
	125
	126	struct eap_eapol_interface eap_if;
	127
	128	/* Full authenticator state machine local variables */
	129
ffbf1eaa	130	/* Long-term (maintained between packets) */
5f2301a6	131	enum eap_type currentMethod;
6fc6879b JM	132	int currentId;
	133	enum {
	134	METHOD_PROPOSED, METHOD_CONTINUE, METHOD_END
	135	} methodState;
	136	int retransCount;
	137	struct wpabuf *lastReqData;
	138	int methodTimeout;
	139
	140	/* Short-term (not maintained between packets) */
	141	Boolean rxResp;
d3bddd8b	142	Boolean rxInitiate;
6fc6879b	143	int respId;
5f2301a6	144	enum eap_type respMethod;
6fc6879b JM	145	int respVendor;
	146	u32 respVendorMethod;
	147	Boolean ignore;
	148	enum {
	149	DECISION_SUCCESS, DECISION_FAILURE, DECISION_CONTINUE,
2a5156a6	150	DECISION_PASSTHROUGH, DECISION_INITIATE_REAUTH_START
6fc6879b JM	151	} decision;
	152
	153	/* Miscellaneous variables */
	154	const struct eap_method m; / selected EAP method */
	155	/* not defined in RFC 4137 */
	156	Boolean changed;
	157	void eapol_ctx, msg_ctx;
8b423edb	158	const struct eapol_callbacks *eapol_cb;
6fc6879b JM	159	void *eap_method_priv;
	160	u8 *identity;
	161	size_t identity_len;
063cbb87	162	char *serial_num;
79fec6a9	163	char imsi[20];
13b3f339 JM	164	/* Whether Phase 2 method should validate identity match */
13b3f339 JM	165	int require_identity_match;
6fc6879b JM	166	int lastId; /* Identifier used in the last EAP-Packet */
	167	struct eap_user *user;
	168	int user_eap_method_index;
	169	int init_phase2;
	170	void *ssl_ctx;
f24630d2	171	struct eap_sim_db_data *eap_sim_db_priv;
6fc6879b JM	172	Boolean backend_auth;
	173	Boolean update_user;
	174	int eap_server;
	175
	176	int num_rounds;
	177	enum {
	178	METHOD_PENDING_NONE, METHOD_PENDING_WAIT, METHOD_PENDING_CONT
	179	} method_pending;
	180
	181	u8 *auth_challenge;
	182	u8 *peer_challenge;
	183
	184	u8 *pac_opaque_encr_key;
2d867244 JM	185	u8 *eap_fast_a_id;
	186	size_t eap_fast_a_id_len;
	187	char *eap_fast_a_id_info;
378eae5e JM	188	enum {
	189	NO_PROV, ANON_PROV, AUTH_PROV, BOTH_PROV
	190	} eap_fast_prov;
a11c90a6 JM	191	int pac_key_lifetime;
a11c90a6 JM	192	int pac_key_refresh_time;
0ed57c5e JM	193	int eap_teap_auth;
0ed57c5e JM	194	int eap_teap_pac_no_inner;
76ddfae6	195	int eap_teap_separate_result;
6fc6879b	196	int eap_sim_aka_result_ind;
6bb11c7a	197	int eap_sim_id;
c3e258ae	198	int tnc;
df684d82	199	u16 pwd_group;
ad08c363	200	struct wps_context *wps;
eb76b7e3	201	struct wpabuf *assoc_wps_ie;
f684e608	202	struct wpabuf *assoc_p2p_ie;
1fd4b0db JM	203
1fd4b0db JM	204	Boolean start_reauth;
2678509d JM	205
2678509d JM	206	u8 peer_addr[ETH_ALEN];
7f6ec672 JM	207
	208	/* Fragmentation size for EAP method init() handler */
	209	int fragment_size;
fa516558 JM	210
fa516558 JM	211	int pbc_in_m1;
67fe933d JM	212
	213	const u8 *server_id;
	214	size_t server_id_len;
390b9291	215
2a5156a6 JM	216	Boolean initiate_reauth_start_sent;
2a5156a6 JM	217	Boolean try_initiate_reauth;
d3bddd8b	218	int erp;
681e199d	219	unsigned int tls_session_lifetime;
6418400d	220	unsigned int tls_flags;
2a5156a6	221
390b9291 JM	222	#ifdef CONFIG_TESTING_OPTIONS
	223	u32 tls_test_flags;
	224	#endif /* CONFIG_TESTING_OPTIONS */
6fc6879b JM	225	};
	226
	227	int eap_user_get(struct eap_sm sm, const u8 identity, size_t identity_len,
	228	int phase2);
01f7fe10 JM	229	void eap_log_msg(struct eap_sm sm, const char fmt, ...)
01f7fe10 JM	230	PRINTF_FORMAT(2, 3);
6fc6879b JM	231	void eap_sm_process_nak(struct eap_sm sm, const u8 nak_list, size_t len);
	232
	233	#endif /* EAP_I_H */