1526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* 2526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * hostapd / EAP Authenticator state machine internal structures (RFC 4137) 3526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * Copyright (c) 2004-2007, Jouni Malinen <j@w1.fi> 4526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * 5526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * This program is free software; you can redistribute it and/or modify 6526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * it under the terms of the GNU General Public License version 2 as 7526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * published by the Free Software Foundation. 8526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * 9526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * Alternatively, this software may be distributed under the terms of BSD 10526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * license. 11526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * 12526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * See README and COPYING for more details. 13526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt */ 14526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 15526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#ifndef EAP_I_H 16526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#define EAP_I_H 17526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 18526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#include "wpabuf.h" 19526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#include "eap_server/eap.h" 20526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#include "eap_common/eap_common.h" 21526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 22526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* RFC 4137 - EAP Standalone Authenticator */ 23526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 24526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/** 25526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * struct eap_method - EAP method interface 26526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * This structure defines the EAP method interface. Each method will need to 27526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * register its own EAP type, EAP name, and set of function pointers for method 28526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * specific operations. This interface is based on section 5.4 of RFC 4137. 29526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt */ 30526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtstruct eap_method { 31526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int vendor; 32526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt EapType method; 33526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const char *name; 34526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 35526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt void * (*init)(struct eap_sm *sm); 36526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt void * (*initPickUp)(struct eap_sm *sm); 37526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt void (*reset)(struct eap_sm *sm, void *priv); 38526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 39526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt struct wpabuf * (*buildReq)(struct eap_sm *sm, void *priv, u8 id); 40526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int (*getTimeout)(struct eap_sm *sm, void *priv); 41526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt Boolean (*check)(struct eap_sm *sm, void *priv, 42526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt struct wpabuf *respData); 43526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt void (*process)(struct eap_sm *sm, void *priv, 44526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt struct wpabuf *respData); 45526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt Boolean (*isDone)(struct eap_sm *sm, void *priv); 46526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 * (*getKey)(struct eap_sm *sm, void *priv, size_t *len); 47526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /* isSuccess is not specified in draft-ietf-eap-statemachine-05.txt, 48526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * but it is useful in implementing Policy.getDecision() */ 49526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt Boolean (*isSuccess)(struct eap_sm *sm, void *priv); 50526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 51526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /** 52526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * free - Free EAP method data 53526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * @method: Pointer to the method data registered with 54526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * eap_server_method_register(). 55526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * 56526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * This function will be called when the EAP method is being 57526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * unregistered. If the EAP method allocated resources during 58526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * registration (e.g., allocated struct eap_method), they should be 59526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * freed in this function. No other method functions will be called 60526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * after this call. If this function is not defined (i.e., function 61526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * pointer is %NULL), a default handler is used to release the method 62526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * data with free(method). This is suitable for most cases. 63526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt */ 64526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt void (*free)(struct eap_method *method); 65526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 66526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#define EAP_SERVER_METHOD_INTERFACE_VERSION 1 67526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /** 68526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * version - Version of the EAP server method interface 69526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * 70526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * The EAP server method implementation should set this variable to 71526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * EAP_SERVER_METHOD_INTERFACE_VERSION. This is used to verify that the 72526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * EAP method is using supported API version when using dynamically 73526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * loadable EAP methods. 74526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt */ 75526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int version; 76526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 77526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /** 78526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * next - Pointer to the next EAP method 79526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * 80526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * This variable is used internally in the EAP method registration code 81526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * to create a linked list of registered EAP methods. 82526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt */ 83526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt struct eap_method *next; 84526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 85526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /** 86526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * get_emsk - Get EAP method specific keying extended material (EMSK) 87526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * @sm: Pointer to EAP state machine allocated with eap_sm_init() 88526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * @priv: Pointer to private EAP method data from eap_method::init() 89526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * @len: Pointer to a variable to store EMSK length 90526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * Returns: EMSK or %NULL if not available 91526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * 92526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * This function can be used to get the extended keying material from 93526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * the EAP method. The key may already be stored in the method-specific 94526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * private data or this function may derive the key. 95526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt */ 96526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 * (*get_emsk)(struct eap_sm *sm, void *priv, size_t *len); 97526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt}; 98526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 99526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/** 100526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * struct eap_sm - EAP server state machine data 101526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt */ 102526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtstruct eap_sm { 103526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt enum { 104526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt EAP_DISABLED, EAP_INITIALIZE, EAP_IDLE, EAP_RECEIVED, 105526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt EAP_INTEGRITY_CHECK, EAP_METHOD_RESPONSE, EAP_METHOD_REQUEST, 106526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt EAP_PROPOSE_METHOD, EAP_SELECT_ACTION, EAP_SEND_REQUEST, 107526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt EAP_DISCARD, EAP_NAK, EAP_RETRANSMIT, EAP_SUCCESS, EAP_FAILURE, 108526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt EAP_TIMEOUT_FAILURE, EAP_PICK_UP_METHOD, 109526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt EAP_INITIALIZE_PASSTHROUGH, EAP_IDLE2, EAP_RETRANSMIT2, 110526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt EAP_RECEIVED2, EAP_DISCARD2, EAP_SEND_REQUEST2, 111526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt EAP_AAA_REQUEST, EAP_AAA_RESPONSE, EAP_AAA_IDLE, 112526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt EAP_TIMEOUT_FAILURE2, EAP_FAILURE2, EAP_SUCCESS2 113526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt } EAP_state; 114526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 115526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /* Constants */ 116526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int MaxRetrans; 117526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 118526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt struct eap_eapol_interface eap_if; 119526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 120526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /* Full authenticator state machine local variables */ 121526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 122526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /* Long-term (maintained betwen packets) */ 123526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt EapType currentMethod; 124526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int currentId; 125526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt enum { 126526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt METHOD_PROPOSED, METHOD_CONTINUE, METHOD_END 127526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt } methodState; 128526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int retransCount; 129526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt struct wpabuf *lastReqData; 130526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int methodTimeout; 131526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 132526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /* Short-term (not maintained between packets) */ 133526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt Boolean rxResp; 134526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int respId; 135526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt EapType respMethod; 136526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int respVendor; 137526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u32 respVendorMethod; 138526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt Boolean ignore; 139526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt enum { 140526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt DECISION_SUCCESS, DECISION_FAILURE, DECISION_CONTINUE, 141526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt DECISION_PASSTHROUGH 142526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt } decision; 143526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 144526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /* Miscellaneous variables */ 145526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const struct eap_method *m; /* selected EAP method */ 146526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /* not defined in RFC 4137 */ 147526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt Boolean changed; 148526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt void *eapol_ctx, *msg_ctx; 149526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt struct eapol_callbacks *eapol_cb; 150526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt void *eap_method_priv; 151526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 *identity; 152526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t identity_len; 153526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /* Whether Phase 2 method should validate identity match */ 154526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int require_identity_match; 155526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int lastId; /* Identifier used in the last EAP-Packet */ 156526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt struct eap_user *user; 157526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int user_eap_method_index; 158526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int init_phase2; 159526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt void *ssl_ctx; 160526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt void *eap_sim_db_priv; 161526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt Boolean backend_auth; 162526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt Boolean update_user; 163526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int eap_server; 164526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 165526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int num_rounds; 166526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt enum { 167526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt METHOD_PENDING_NONE, METHOD_PENDING_WAIT, METHOD_PENDING_CONT 168526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt } method_pending; 169526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 170526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 *auth_challenge; 171526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 *peer_challenge; 172526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 173526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 *pac_opaque_encr_key; 174526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 *eap_fast_a_id; 175526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t eap_fast_a_id_len; 176526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt char *eap_fast_a_id_info; 177526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt enum { 178526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt NO_PROV, ANON_PROV, AUTH_PROV, BOTH_PROV 179526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt } eap_fast_prov; 180526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int pac_key_lifetime; 181526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int pac_key_refresh_time; 182526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int eap_sim_aka_result_ind; 183526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int tnc; 184526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt struct wps_context *wps; 185526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt struct wpabuf *assoc_wps_ie; 186526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 187526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt Boolean start_reauth; 188526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt}; 189526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 190526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtint eap_user_get(struct eap_sm *sm, const u8 *identity, size_t identity_len, 191526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int phase2); 192526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtvoid eap_sm_process_nak(struct eap_sm *sm, const u8 *nak_list, size_t len); 193526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 194526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#endif /* EAP_I_H */ 195