eap.c revision 1f69aa52ea2e0a73ac502565df8c666ee49cab6a
1/* 2 * EAP peer state machines (RFC 4137) 3 * Copyright (c) 2004-2010, Jouni Malinen <j@w1.fi> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 * Alternatively, this software may be distributed under the terms of BSD 10 * license. 11 * 12 * See README and COPYING for more details. 13 * 14 * This file implements the Peer State Machine as defined in RFC 4137. The used 15 * states and state transitions match mostly with the RFC. However, there are 16 * couple of additional transitions for working around small issues noticed 17 * during testing. These exceptions are explained in comments within the 18 * functions in this file. The method functions, m.func(), are similar to the 19 * ones used in RFC 4137, but some small changes have used here to optimize 20 * operations and to add functionality needed for fast re-authentication 21 * (session resumption). 22 */ 23 24#include "includes.h" 25 26#include "common.h" 27#include "pcsc_funcs.h" 28#include "state_machine.h" 29#include "crypto/crypto.h" 30#include "crypto/tls.h" 31#include "common/wpa_ctrl.h" 32#include "eap_common/eap_wsc_common.h" 33#include "eap_i.h" 34#include "eap_config.h" 35 36#define STATE_MACHINE_DATA struct eap_sm 37#define STATE_MACHINE_DEBUG_PREFIX "EAP" 38 39#define EAP_MAX_AUTH_ROUNDS 50 40#define EAP_CLIENT_TIMEOUT_DEFAULT 60 41 42 43static Boolean eap_sm_allowMethod(struct eap_sm *sm, int vendor, 44 EapType method); 45static struct wpabuf * eap_sm_buildNak(struct eap_sm *sm, int id); 46static void eap_sm_processIdentity(struct eap_sm *sm, 47 const struct wpabuf *req); 48static void eap_sm_processNotify(struct eap_sm *sm, const struct wpabuf *req); 49static struct wpabuf * eap_sm_buildNotify(int id); 50static void eap_sm_parseEapReq(struct eap_sm *sm, const struct wpabuf *req); 51#if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG) 52static const char * eap_sm_method_state_txt(EapMethodState state); 53static const char * eap_sm_decision_txt(EapDecision decision); 54#endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */ 55 56 57 58static Boolean eapol_get_bool(struct eap_sm *sm, enum eapol_bool_var var) 59{ 60 return sm->eapol_cb->get_bool(sm->eapol_ctx, var); 61} 62 63 64static void eapol_set_bool(struct eap_sm *sm, enum eapol_bool_var var, 65 Boolean value) 66{ 67 sm->eapol_cb->set_bool(sm->eapol_ctx, var, value); 68} 69 70 71static unsigned int eapol_get_int(struct eap_sm *sm, enum eapol_int_var var) 72{ 73 return sm->eapol_cb->get_int(sm->eapol_ctx, var); 74} 75 76 77static void eapol_set_int(struct eap_sm *sm, enum eapol_int_var var, 78 unsigned int value) 79{ 80 sm->eapol_cb->set_int(sm->eapol_ctx, var, value); 81} 82 83 84static struct wpabuf * eapol_get_eapReqData(struct eap_sm *sm) 85{ 86 return sm->eapol_cb->get_eapReqData(sm->eapol_ctx); 87} 88 89 90static void eap_deinit_prev_method(struct eap_sm *sm, const char *txt) 91{ 92 if (sm->m == NULL || sm->eap_method_priv == NULL) 93 return; 94 95 wpa_printf(MSG_DEBUG, "EAP: deinitialize previously used EAP method " 96 "(%d, %s) at %s", sm->selectedMethod, sm->m->name, txt); 97 sm->m->deinit(sm, sm->eap_method_priv); 98 sm->eap_method_priv = NULL; 99 sm->m = NULL; 100} 101 102 103/** 104 * eap_allowed_method - Check whether EAP method is allowed 105 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 106 * @vendor: Vendor-Id for expanded types or 0 = IETF for legacy types 107 * @method: EAP type 108 * Returns: 1 = allowed EAP method, 0 = not allowed 109 */ 110int eap_allowed_method(struct eap_sm *sm, int vendor, u32 method) 111{ 112 struct eap_peer_config *config = eap_get_config(sm); 113 int i; 114 struct eap_method_type *m; 115 116 if (config == NULL || config->eap_methods == NULL) 117 return 1; 118 119 m = config->eap_methods; 120 for (i = 0; m[i].vendor != EAP_VENDOR_IETF || 121 m[i].method != EAP_TYPE_NONE; i++) { 122 if (m[i].vendor == vendor && m[i].method == method) 123 return 1; 124 } 125 return 0; 126} 127 128 129/* 130 * This state initializes state machine variables when the machine is 131 * activated (portEnabled = TRUE). This is also used when re-starting 132 * authentication (eapRestart == TRUE). 133 */ 134SM_STATE(EAP, INITIALIZE) 135{ 136 SM_ENTRY(EAP, INITIALIZE); 137 if (sm->fast_reauth && sm->m && sm->m->has_reauth_data && 138 sm->m->has_reauth_data(sm, sm->eap_method_priv) && 139 !sm->prev_failure) { 140 wpa_printf(MSG_DEBUG, "EAP: maintaining EAP method data for " 141 "fast reauthentication"); 142 sm->m->deinit_for_reauth(sm, sm->eap_method_priv); 143 } else { 144 eap_deinit_prev_method(sm, "INITIALIZE"); 145 } 146 sm->selectedMethod = EAP_TYPE_NONE; 147 sm->methodState = METHOD_NONE; 148 sm->allowNotifications = TRUE; 149 sm->decision = DECISION_FAIL; 150 sm->ClientTimeout = EAP_CLIENT_TIMEOUT_DEFAULT; 151 eapol_set_int(sm, EAPOL_idleWhile, sm->ClientTimeout); 152 eapol_set_bool(sm, EAPOL_eapSuccess, FALSE); 153 eapol_set_bool(sm, EAPOL_eapFail, FALSE); 154 os_free(sm->eapKeyData); 155 sm->eapKeyData = NULL; 156 sm->eapKeyAvailable = FALSE; 157 eapol_set_bool(sm, EAPOL_eapRestart, FALSE); 158 sm->lastId = -1; /* new session - make sure this does not match with 159 * the first EAP-Packet */ 160 /* 161 * RFC 4137 does not reset eapResp and eapNoResp here. However, this 162 * seemed to be able to trigger cases where both were set and if EAPOL 163 * state machine uses eapNoResp first, it may end up not sending a real 164 * reply correctly. This occurred when the workaround in FAIL state set 165 * eapNoResp = TRUE.. Maybe that workaround needs to be fixed to do 166 * something else(?) 167 */ 168 eapol_set_bool(sm, EAPOL_eapResp, FALSE); 169 eapol_set_bool(sm, EAPOL_eapNoResp, FALSE); 170 sm->num_rounds = 0; 171 sm->prev_failure = 0; 172} 173 174 175/* 176 * This state is reached whenever service from the lower layer is interrupted 177 * or unavailable (portEnabled == FALSE). Immediate transition to INITIALIZE 178 * occurs when the port becomes enabled. 179 */ 180SM_STATE(EAP, DISABLED) 181{ 182 SM_ENTRY(EAP, DISABLED); 183 sm->num_rounds = 0; 184} 185 186 187/* 188 * The state machine spends most of its time here, waiting for something to 189 * happen. This state is entered unconditionally from INITIALIZE, DISCARD, and 190 * SEND_RESPONSE states. 191 */ 192SM_STATE(EAP, IDLE) 193{ 194 SM_ENTRY(EAP, IDLE); 195} 196 197 198/* 199 * This state is entered when an EAP packet is received (eapReq == TRUE) to 200 * parse the packet header. 201 */ 202SM_STATE(EAP, RECEIVED) 203{ 204 const struct wpabuf *eapReqData; 205 206 SM_ENTRY(EAP, RECEIVED); 207 eapReqData = eapol_get_eapReqData(sm); 208 /* parse rxReq, rxSuccess, rxFailure, reqId, reqMethod */ 209 eap_sm_parseEapReq(sm, eapReqData); 210 sm->num_rounds++; 211} 212 213 214/* 215 * This state is entered when a request for a new type comes in. Either the 216 * correct method is started, or a Nak response is built. 217 */ 218SM_STATE(EAP, GET_METHOD) 219{ 220 int reinit; 221 EapType method; 222 223 SM_ENTRY(EAP, GET_METHOD); 224 225 if (sm->reqMethod == EAP_TYPE_EXPANDED) 226 method = sm->reqVendorMethod; 227 else 228 method = sm->reqMethod; 229 230 if (!eap_sm_allowMethod(sm, sm->reqVendor, method)) { 231 wpa_printf(MSG_DEBUG, "EAP: vendor %u method %u not allowed", 232 sm->reqVendor, method); 233 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_PROPOSED_METHOD 234 "vendor=%u method=%u -> NAK", 235 sm->reqVendor, method); 236 goto nak; 237 } 238 239 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_PROPOSED_METHOD 240 "vendor=%u method=%u", sm->reqVendor, method); 241 242 /* 243 * RFC 4137 does not define specific operation for fast 244 * re-authentication (session resumption). The design here is to allow 245 * the previously used method data to be maintained for 246 * re-authentication if the method support session resumption. 247 * Otherwise, the previously used method data is freed and a new method 248 * is allocated here. 249 */ 250 if (sm->fast_reauth && 251 sm->m && sm->m->vendor == sm->reqVendor && 252 sm->m->method == method && 253 sm->m->has_reauth_data && 254 sm->m->has_reauth_data(sm, sm->eap_method_priv)) { 255 wpa_printf(MSG_DEBUG, "EAP: Using previous method data" 256 " for fast re-authentication"); 257 reinit = 1; 258 } else { 259 eap_deinit_prev_method(sm, "GET_METHOD"); 260 reinit = 0; 261 } 262 263 sm->selectedMethod = sm->reqMethod; 264 if (sm->m == NULL) 265 sm->m = eap_peer_get_eap_method(sm->reqVendor, method); 266 if (!sm->m) { 267 wpa_printf(MSG_DEBUG, "EAP: Could not find selected method: " 268 "vendor %d method %d", 269 sm->reqVendor, method); 270 goto nak; 271 } 272 273 sm->ClientTimeout = EAP_CLIENT_TIMEOUT_DEFAULT; 274 275 wpa_printf(MSG_DEBUG, "EAP: Initialize selected EAP method: " 276 "vendor %u method %u (%s)", 277 sm->reqVendor, method, sm->m->name); 278 if (reinit) 279 sm->eap_method_priv = sm->m->init_for_reauth( 280 sm, sm->eap_method_priv); 281 else 282 sm->eap_method_priv = sm->m->init(sm); 283 284 if (sm->eap_method_priv == NULL) { 285 struct eap_peer_config *config = eap_get_config(sm); 286 wpa_msg(sm->msg_ctx, MSG_INFO, 287 "EAP: Failed to initialize EAP method: vendor %u " 288 "method %u (%s)", 289 sm->reqVendor, method, sm->m->name); 290 sm->m = NULL; 291 sm->methodState = METHOD_NONE; 292 sm->selectedMethod = EAP_TYPE_NONE; 293 if (sm->reqMethod == EAP_TYPE_TLS && config && 294 (config->pending_req_pin || 295 config->pending_req_passphrase)) { 296 /* 297 * Return without generating Nak in order to allow 298 * entering of PIN code or passphrase to retry the 299 * current EAP packet. 300 */ 301 wpa_printf(MSG_DEBUG, "EAP: Pending PIN/passphrase " 302 "request - skip Nak"); 303 return; 304 } 305 306 goto nak; 307 } 308 309 sm->methodState = METHOD_INIT; 310 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_METHOD 311 "EAP vendor %u method %u (%s) selected", 312 sm->reqVendor, method, sm->m->name); 313 return; 314 315nak: 316 wpabuf_free(sm->eapRespData); 317 sm->eapRespData = NULL; 318 sm->eapRespData = eap_sm_buildNak(sm, sm->reqId); 319} 320 321 322/* 323 * The method processing happens here. The request from the authenticator is 324 * processed, and an appropriate response packet is built. 325 */ 326SM_STATE(EAP, METHOD) 327{ 328 struct wpabuf *eapReqData; 329 struct eap_method_ret ret; 330 331 SM_ENTRY(EAP, METHOD); 332 if (sm->m == NULL) { 333 wpa_printf(MSG_WARNING, "EAP::METHOD - method not selected"); 334 return; 335 } 336 337 eapReqData = eapol_get_eapReqData(sm); 338 339 /* 340 * Get ignore, methodState, decision, allowNotifications, and 341 * eapRespData. RFC 4137 uses three separate method procedure (check, 342 * process, and buildResp) in this state. These have been combined into 343 * a single function call to m->process() in order to optimize EAP 344 * method implementation interface a bit. These procedures are only 345 * used from within this METHOD state, so there is no need to keep 346 * these as separate C functions. 347 * 348 * The RFC 4137 procedures return values as follows: 349 * ignore = m.check(eapReqData) 350 * (methodState, decision, allowNotifications) = m.process(eapReqData) 351 * eapRespData = m.buildResp(reqId) 352 */ 353 os_memset(&ret, 0, sizeof(ret)); 354 ret.ignore = sm->ignore; 355 ret.methodState = sm->methodState; 356 ret.decision = sm->decision; 357 ret.allowNotifications = sm->allowNotifications; 358 wpabuf_free(sm->eapRespData); 359 sm->eapRespData = NULL; 360 sm->eapRespData = sm->m->process(sm, sm->eap_method_priv, &ret, 361 eapReqData); 362 wpa_printf(MSG_DEBUG, "EAP: method process -> ignore=%s " 363 "methodState=%s decision=%s", 364 ret.ignore ? "TRUE" : "FALSE", 365 eap_sm_method_state_txt(ret.methodState), 366 eap_sm_decision_txt(ret.decision)); 367 368 sm->ignore = ret.ignore; 369 if (sm->ignore) 370 return; 371 sm->methodState = ret.methodState; 372 sm->decision = ret.decision; 373 sm->allowNotifications = ret.allowNotifications; 374 375 if (sm->m->isKeyAvailable && sm->m->getKey && 376 sm->m->isKeyAvailable(sm, sm->eap_method_priv)) { 377 os_free(sm->eapKeyData); 378 sm->eapKeyData = sm->m->getKey(sm, sm->eap_method_priv, 379 &sm->eapKeyDataLen); 380 } 381} 382 383 384/* 385 * This state signals the lower layer that a response packet is ready to be 386 * sent. 387 */ 388SM_STATE(EAP, SEND_RESPONSE) 389{ 390 SM_ENTRY(EAP, SEND_RESPONSE); 391 wpabuf_free(sm->lastRespData); 392 if (sm->eapRespData) { 393 if (sm->workaround) 394 os_memcpy(sm->last_md5, sm->req_md5, 16); 395 sm->lastId = sm->reqId; 396 sm->lastRespData = wpabuf_dup(sm->eapRespData); 397 eapol_set_bool(sm, EAPOL_eapResp, TRUE); 398 } else 399 sm->lastRespData = NULL; 400 eapol_set_bool(sm, EAPOL_eapReq, FALSE); 401 eapol_set_int(sm, EAPOL_idleWhile, sm->ClientTimeout); 402} 403 404 405/* 406 * This state signals the lower layer that the request was discarded, and no 407 * response packet will be sent at this time. 408 */ 409SM_STATE(EAP, DISCARD) 410{ 411 SM_ENTRY(EAP, DISCARD); 412 eapol_set_bool(sm, EAPOL_eapReq, FALSE); 413 eapol_set_bool(sm, EAPOL_eapNoResp, TRUE); 414} 415 416 417/* 418 * Handles requests for Identity method and builds a response. 419 */ 420SM_STATE(EAP, IDENTITY) 421{ 422 const struct wpabuf *eapReqData; 423 424 SM_ENTRY(EAP, IDENTITY); 425 eapReqData = eapol_get_eapReqData(sm); 426 eap_sm_processIdentity(sm, eapReqData); 427 wpabuf_free(sm->eapRespData); 428 sm->eapRespData = NULL; 429 sm->eapRespData = eap_sm_buildIdentity(sm, sm->reqId, 0); 430} 431 432 433/* 434 * Handles requests for Notification method and builds a response. 435 */ 436SM_STATE(EAP, NOTIFICATION) 437{ 438 const struct wpabuf *eapReqData; 439 440 SM_ENTRY(EAP, NOTIFICATION); 441 eapReqData = eapol_get_eapReqData(sm); 442 eap_sm_processNotify(sm, eapReqData); 443 wpabuf_free(sm->eapRespData); 444 sm->eapRespData = NULL; 445 sm->eapRespData = eap_sm_buildNotify(sm->reqId); 446} 447 448 449/* 450 * This state retransmits the previous response packet. 451 */ 452SM_STATE(EAP, RETRANSMIT) 453{ 454 SM_ENTRY(EAP, RETRANSMIT); 455 wpabuf_free(sm->eapRespData); 456 if (sm->lastRespData) 457 sm->eapRespData = wpabuf_dup(sm->lastRespData); 458 else 459 sm->eapRespData = NULL; 460} 461 462 463/* 464 * This state is entered in case of a successful completion of authentication 465 * and state machine waits here until port is disabled or EAP authentication is 466 * restarted. 467 */ 468SM_STATE(EAP, SUCCESS) 469{ 470 SM_ENTRY(EAP, SUCCESS); 471 if (sm->eapKeyData != NULL) 472 sm->eapKeyAvailable = TRUE; 473 eapol_set_bool(sm, EAPOL_eapSuccess, TRUE); 474 475 /* 476 * RFC 4137 does not clear eapReq here, but this seems to be required 477 * to avoid processing the same request twice when state machine is 478 * initialized. 479 */ 480 eapol_set_bool(sm, EAPOL_eapReq, FALSE); 481 482 /* 483 * RFC 4137 does not set eapNoResp here, but this seems to be required 484 * to get EAPOL Supplicant backend state machine into SUCCESS state. In 485 * addition, either eapResp or eapNoResp is required to be set after 486 * processing the received EAP frame. 487 */ 488 eapol_set_bool(sm, EAPOL_eapNoResp, TRUE); 489 490 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_SUCCESS 491 "EAP authentication completed successfully"); 492} 493 494 495/* 496 * This state is entered in case of a failure and state machine waits here 497 * until port is disabled or EAP authentication is restarted. 498 */ 499SM_STATE(EAP, FAILURE) 500{ 501 SM_ENTRY(EAP, FAILURE); 502 eapol_set_bool(sm, EAPOL_eapFail, TRUE); 503 504 /* 505 * RFC 4137 does not clear eapReq here, but this seems to be required 506 * to avoid processing the same request twice when state machine is 507 * initialized. 508 */ 509 eapol_set_bool(sm, EAPOL_eapReq, FALSE); 510 511 /* 512 * RFC 4137 does not set eapNoResp here. However, either eapResp or 513 * eapNoResp is required to be set after processing the received EAP 514 * frame. 515 */ 516 eapol_set_bool(sm, EAPOL_eapNoResp, TRUE); 517 518 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_FAILURE 519 "EAP authentication failed"); 520 521 sm->prev_failure = 1; 522} 523 524 525static int eap_success_workaround(struct eap_sm *sm, int reqId, int lastId) 526{ 527 /* 528 * At least Microsoft IAS and Meetinghouse Aegis seem to be sending 529 * EAP-Success/Failure with lastId + 1 even though RFC 3748 and 530 * RFC 4137 require that reqId == lastId. In addition, it looks like 531 * Ringmaster v2.1.2.0 would be using lastId + 2 in EAP-Success. 532 * 533 * Accept this kind of Id if EAP workarounds are enabled. These are 534 * unauthenticated plaintext messages, so this should have minimal 535 * security implications (bit easier to fake EAP-Success/Failure). 536 */ 537 if (sm->workaround && (reqId == ((lastId + 1) & 0xff) || 538 reqId == ((lastId + 2) & 0xff))) { 539 wpa_printf(MSG_DEBUG, "EAP: Workaround for unexpected " 540 "identifier field in EAP Success: " 541 "reqId=%d lastId=%d (these are supposed to be " 542 "same)", reqId, lastId); 543 return 1; 544 } 545 wpa_printf(MSG_DEBUG, "EAP: EAP-Success Id mismatch - reqId=%d " 546 "lastId=%d", reqId, lastId); 547 return 0; 548} 549 550 551/* 552 * RFC 4137 - Appendix A.1: EAP Peer State Machine - State transitions 553 */ 554 555static void eap_peer_sm_step_idle(struct eap_sm *sm) 556{ 557 /* 558 * The first three transitions are from RFC 4137. The last two are 559 * local additions to handle special cases with LEAP and PEAP server 560 * not sending EAP-Success in some cases. 561 */ 562 if (eapol_get_bool(sm, EAPOL_eapReq)) 563 SM_ENTER(EAP, RECEIVED); 564 else if ((eapol_get_bool(sm, EAPOL_altAccept) && 565 sm->decision != DECISION_FAIL) || 566 (eapol_get_int(sm, EAPOL_idleWhile) == 0 && 567 sm->decision == DECISION_UNCOND_SUCC)) 568 SM_ENTER(EAP, SUCCESS); 569 else if (eapol_get_bool(sm, EAPOL_altReject) || 570 (eapol_get_int(sm, EAPOL_idleWhile) == 0 && 571 sm->decision != DECISION_UNCOND_SUCC) || 572 (eapol_get_bool(sm, EAPOL_altAccept) && 573 sm->methodState != METHOD_CONT && 574 sm->decision == DECISION_FAIL)) 575 SM_ENTER(EAP, FAILURE); 576 else if (sm->selectedMethod == EAP_TYPE_LEAP && 577 sm->leap_done && sm->decision != DECISION_FAIL && 578 sm->methodState == METHOD_DONE) 579 SM_ENTER(EAP, SUCCESS); 580 else if (sm->selectedMethod == EAP_TYPE_PEAP && 581 sm->peap_done && sm->decision != DECISION_FAIL && 582 sm->methodState == METHOD_DONE) 583 SM_ENTER(EAP, SUCCESS); 584} 585 586 587static int eap_peer_req_is_duplicate(struct eap_sm *sm) 588{ 589 int duplicate; 590 591 duplicate = (sm->reqId == sm->lastId) && sm->rxReq; 592 if (sm->workaround && duplicate && 593 os_memcmp(sm->req_md5, sm->last_md5, 16) != 0) { 594 /* 595 * RFC 4137 uses (reqId == lastId) as the only verification for 596 * duplicate EAP requests. However, this misses cases where the 597 * AS is incorrectly using the same id again; and 598 * unfortunately, such implementations exist. Use MD5 hash as 599 * an extra verification for the packets being duplicate to 600 * workaround these issues. 601 */ 602 wpa_printf(MSG_DEBUG, "EAP: AS used the same Id again, but " 603 "EAP packets were not identical"); 604 wpa_printf(MSG_DEBUG, "EAP: workaround - assume this is not a " 605 "duplicate packet"); 606 duplicate = 0; 607 } 608 609 return duplicate; 610} 611 612 613static void eap_peer_sm_step_received(struct eap_sm *sm) 614{ 615 int duplicate = eap_peer_req_is_duplicate(sm); 616 617 /* 618 * Two special cases below for LEAP are local additions to work around 619 * odd LEAP behavior (EAP-Success in the middle of authentication and 620 * then swapped roles). Other transitions are based on RFC 4137. 621 */ 622 if (sm->rxSuccess && sm->decision != DECISION_FAIL && 623 (sm->reqId == sm->lastId || 624 eap_success_workaround(sm, sm->reqId, sm->lastId))) 625 SM_ENTER(EAP, SUCCESS); 626 else if (sm->methodState != METHOD_CONT && 627 ((sm->rxFailure && 628 sm->decision != DECISION_UNCOND_SUCC) || 629 (sm->rxSuccess && sm->decision == DECISION_FAIL && 630 (sm->selectedMethod != EAP_TYPE_LEAP || 631 sm->methodState != METHOD_MAY_CONT))) && 632 (sm->reqId == sm->lastId || 633 eap_success_workaround(sm, sm->reqId, sm->lastId))) 634 SM_ENTER(EAP, FAILURE); 635 else if (sm->rxReq && duplicate) 636 SM_ENTER(EAP, RETRANSMIT); 637 else if (sm->rxReq && !duplicate && 638 sm->reqMethod == EAP_TYPE_NOTIFICATION && 639 sm->allowNotifications) 640 SM_ENTER(EAP, NOTIFICATION); 641 else if (sm->rxReq && !duplicate && 642 sm->selectedMethod == EAP_TYPE_NONE && 643 sm->reqMethod == EAP_TYPE_IDENTITY) 644 SM_ENTER(EAP, IDENTITY); 645 else if (sm->rxReq && !duplicate && 646 sm->selectedMethod == EAP_TYPE_NONE && 647 sm->reqMethod != EAP_TYPE_IDENTITY && 648 sm->reqMethod != EAP_TYPE_NOTIFICATION) 649 SM_ENTER(EAP, GET_METHOD); 650 else if (sm->rxReq && !duplicate && 651 sm->reqMethod == sm->selectedMethod && 652 sm->methodState != METHOD_DONE) 653 SM_ENTER(EAP, METHOD); 654 else if (sm->selectedMethod == EAP_TYPE_LEAP && 655 (sm->rxSuccess || sm->rxResp)) 656 SM_ENTER(EAP, METHOD); 657 else 658 SM_ENTER(EAP, DISCARD); 659} 660 661 662static void eap_peer_sm_step_local(struct eap_sm *sm) 663{ 664 switch (sm->EAP_state) { 665 case EAP_INITIALIZE: 666 SM_ENTER(EAP, IDLE); 667 break; 668 case EAP_DISABLED: 669 if (eapol_get_bool(sm, EAPOL_portEnabled) && 670 !sm->force_disabled) 671 SM_ENTER(EAP, INITIALIZE); 672 break; 673 case EAP_IDLE: 674 eap_peer_sm_step_idle(sm); 675 break; 676 case EAP_RECEIVED: 677 eap_peer_sm_step_received(sm); 678 break; 679 case EAP_GET_METHOD: 680 if (sm->selectedMethod == sm->reqMethod) 681 SM_ENTER(EAP, METHOD); 682 else 683 SM_ENTER(EAP, SEND_RESPONSE); 684 break; 685 case EAP_METHOD: 686 if (sm->ignore) 687 SM_ENTER(EAP, DISCARD); 688 else 689 SM_ENTER(EAP, SEND_RESPONSE); 690 break; 691 case EAP_SEND_RESPONSE: 692 SM_ENTER(EAP, IDLE); 693 break; 694 case EAP_DISCARD: 695 SM_ENTER(EAP, IDLE); 696 break; 697 case EAP_IDENTITY: 698 SM_ENTER(EAP, SEND_RESPONSE); 699 break; 700 case EAP_NOTIFICATION: 701 SM_ENTER(EAP, SEND_RESPONSE); 702 break; 703 case EAP_RETRANSMIT: 704 SM_ENTER(EAP, SEND_RESPONSE); 705 break; 706 case EAP_SUCCESS: 707 break; 708 case EAP_FAILURE: 709 break; 710 } 711} 712 713 714SM_STEP(EAP) 715{ 716 /* Global transitions */ 717 if (eapol_get_bool(sm, EAPOL_eapRestart) && 718 eapol_get_bool(sm, EAPOL_portEnabled)) 719 SM_ENTER_GLOBAL(EAP, INITIALIZE); 720 else if (!eapol_get_bool(sm, EAPOL_portEnabled) || sm->force_disabled) 721 SM_ENTER_GLOBAL(EAP, DISABLED); 722 else if (sm->num_rounds > EAP_MAX_AUTH_ROUNDS) { 723 /* RFC 4137 does not place any limit on number of EAP messages 724 * in an authentication session. However, some error cases have 725 * ended up in a state were EAP messages were sent between the 726 * peer and server in a loop (e.g., TLS ACK frame in both 727 * direction). Since this is quite undesired outcome, limit the 728 * total number of EAP round-trips and abort authentication if 729 * this limit is exceeded. 730 */ 731 if (sm->num_rounds == EAP_MAX_AUTH_ROUNDS + 1) { 732 wpa_msg(sm->msg_ctx, MSG_INFO, "EAP: more than %d " 733 "authentication rounds - abort", 734 EAP_MAX_AUTH_ROUNDS); 735 sm->num_rounds++; 736 SM_ENTER_GLOBAL(EAP, FAILURE); 737 } 738 } else { 739 /* Local transitions */ 740 eap_peer_sm_step_local(sm); 741 } 742} 743 744 745static Boolean eap_sm_allowMethod(struct eap_sm *sm, int vendor, 746 EapType method) 747{ 748 if (!eap_allowed_method(sm, vendor, method)) { 749 wpa_printf(MSG_DEBUG, "EAP: configuration does not allow: " 750 "vendor %u method %u", vendor, method); 751 return FALSE; 752 } 753 if (eap_peer_get_eap_method(vendor, method)) 754 return TRUE; 755 wpa_printf(MSG_DEBUG, "EAP: not included in build: " 756 "vendor %u method %u", vendor, method); 757 return FALSE; 758} 759 760 761static struct wpabuf * eap_sm_build_expanded_nak( 762 struct eap_sm *sm, int id, const struct eap_method *methods, 763 size_t count) 764{ 765 struct wpabuf *resp; 766 int found = 0; 767 const struct eap_method *m; 768 769 wpa_printf(MSG_DEBUG, "EAP: Building expanded EAP-Nak"); 770 771 /* RFC 3748 - 5.3.2: Expanded Nak */ 772 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_EXPANDED, 773 8 + 8 * (count + 1), EAP_CODE_RESPONSE, id); 774 if (resp == NULL) 775 return NULL; 776 777 wpabuf_put_be24(resp, EAP_VENDOR_IETF); 778 wpabuf_put_be32(resp, EAP_TYPE_NAK); 779 780 for (m = methods; m; m = m->next) { 781 if (sm->reqVendor == m->vendor && 782 sm->reqVendorMethod == m->method) 783 continue; /* do not allow the current method again */ 784 if (eap_allowed_method(sm, m->vendor, m->method)) { 785 wpa_printf(MSG_DEBUG, "EAP: allowed type: " 786 "vendor=%u method=%u", 787 m->vendor, m->method); 788 wpabuf_put_u8(resp, EAP_TYPE_EXPANDED); 789 wpabuf_put_be24(resp, m->vendor); 790 wpabuf_put_be32(resp, m->method); 791 792 found++; 793 } 794 } 795 if (!found) { 796 wpa_printf(MSG_DEBUG, "EAP: no more allowed methods"); 797 wpabuf_put_u8(resp, EAP_TYPE_EXPANDED); 798 wpabuf_put_be24(resp, EAP_VENDOR_IETF); 799 wpabuf_put_be32(resp, EAP_TYPE_NONE); 800 } 801 802 eap_update_len(resp); 803 804 return resp; 805} 806 807 808static struct wpabuf * eap_sm_buildNak(struct eap_sm *sm, int id) 809{ 810 struct wpabuf *resp; 811 u8 *start; 812 int found = 0, expanded_found = 0; 813 size_t count; 814 const struct eap_method *methods, *m; 815 816 wpa_printf(MSG_DEBUG, "EAP: Building EAP-Nak (requested type %u " 817 "vendor=%u method=%u not allowed)", sm->reqMethod, 818 sm->reqVendor, sm->reqVendorMethod); 819 methods = eap_peer_get_methods(&count); 820 if (methods == NULL) 821 return NULL; 822 if (sm->reqMethod == EAP_TYPE_EXPANDED) 823 return eap_sm_build_expanded_nak(sm, id, methods, count); 824 825 /* RFC 3748 - 5.3.1: Legacy Nak */ 826 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_NAK, 827 sizeof(struct eap_hdr) + 1 + count + 1, 828 EAP_CODE_RESPONSE, id); 829 if (resp == NULL) 830 return NULL; 831 832 start = wpabuf_put(resp, 0); 833 for (m = methods; m; m = m->next) { 834 if (m->vendor == EAP_VENDOR_IETF && m->method == sm->reqMethod) 835 continue; /* do not allow the current method again */ 836 if (eap_allowed_method(sm, m->vendor, m->method)) { 837 if (m->vendor != EAP_VENDOR_IETF) { 838 if (expanded_found) 839 continue; 840 expanded_found = 1; 841 wpabuf_put_u8(resp, EAP_TYPE_EXPANDED); 842 } else 843 wpabuf_put_u8(resp, m->method); 844 found++; 845 } 846 } 847 if (!found) 848 wpabuf_put_u8(resp, EAP_TYPE_NONE); 849 wpa_hexdump(MSG_DEBUG, "EAP: allowed methods", start, found); 850 851 eap_update_len(resp); 852 853 return resp; 854} 855 856 857static void eap_sm_processIdentity(struct eap_sm *sm, const struct wpabuf *req) 858{ 859 const struct eap_hdr *hdr = wpabuf_head(req); 860 const u8 *pos = (const u8 *) (hdr + 1); 861 pos++; 862 863 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_STARTED 864 "EAP authentication started"); 865 866 /* 867 * RFC 3748 - 5.1: Identity 868 * Data field may contain a displayable message in UTF-8. If this 869 * includes NUL-character, only the data before that should be 870 * displayed. Some EAP implementasitons may piggy-back additional 871 * options after the NUL. 872 */ 873 /* TODO: could save displayable message so that it can be shown to the 874 * user in case of interaction is required */ 875 wpa_hexdump_ascii(MSG_DEBUG, "EAP: EAP-Request Identity data", 876 pos, be_to_host16(hdr->length) - 5); 877} 878 879 880#ifdef PCSC_FUNCS 881static int eap_sm_imsi_identity(struct eap_sm *sm, 882 struct eap_peer_config *conf) 883{ 884 int aka = 0; 885 char imsi[100]; 886 size_t imsi_len; 887 struct eap_method_type *m = conf->eap_methods; 888 int i; 889 890 imsi_len = sizeof(imsi); 891 if (scard_get_imsi(sm->scard_ctx, imsi, &imsi_len)) { 892 wpa_printf(MSG_WARNING, "Failed to get IMSI from SIM"); 893 return -1; 894 } 895 896 wpa_hexdump_ascii(MSG_DEBUG, "IMSI", (u8 *) imsi, imsi_len); 897 898 for (i = 0; m && (m[i].vendor != EAP_VENDOR_IETF || 899 m[i].method != EAP_TYPE_NONE); i++) { 900 if (m[i].vendor == EAP_VENDOR_IETF && 901 m[i].method == EAP_TYPE_AKA) { 902 aka = 1; 903 break; 904 } 905 } 906 907 os_free(conf->identity); 908 conf->identity = os_malloc(1 + imsi_len); 909 if (conf->identity == NULL) { 910 wpa_printf(MSG_WARNING, "Failed to allocate buffer for " 911 "IMSI-based identity"); 912 return -1; 913 } 914 915 conf->identity[0] = aka ? '0' : '1'; 916 os_memcpy(conf->identity + 1, imsi, imsi_len); 917 conf->identity_len = 1 + imsi_len; 918 919 return 0; 920} 921#endif /* PCSC_FUNCS */ 922 923 924static int eap_sm_set_scard_pin(struct eap_sm *sm, 925 struct eap_peer_config *conf) 926{ 927#ifdef PCSC_FUNCS 928 if (scard_set_pin(sm->scard_ctx, conf->pin)) { 929 /* 930 * Make sure the same PIN is not tried again in order to avoid 931 * blocking SIM. 932 */ 933 os_free(conf->pin); 934 conf->pin = NULL; 935 936 wpa_printf(MSG_WARNING, "PIN validation failed"); 937 eap_sm_request_pin(sm); 938 return -1; 939 } 940 return 0; 941#else /* PCSC_FUNCS */ 942 return -1; 943#endif /* PCSC_FUNCS */ 944} 945 946static int eap_sm_get_scard_identity(struct eap_sm *sm, 947 struct eap_peer_config *conf) 948{ 949#ifdef PCSC_FUNCS 950 if (eap_sm_set_scard_pin(sm, conf)) 951 return -1; 952 953 return eap_sm_imsi_identity(sm, conf); 954#else /* PCSC_FUNCS */ 955 return -1; 956#endif /* PCSC_FUNCS */ 957} 958 959 960/** 961 * eap_sm_buildIdentity - Build EAP-Identity/Response for the current network 962 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 963 * @id: EAP identifier for the packet 964 * @encrypted: Whether the packet is for encrypted tunnel (EAP phase 2) 965 * Returns: Pointer to the allocated EAP-Identity/Response packet or %NULL on 966 * failure 967 * 968 * This function allocates and builds an EAP-Identity/Response packet for the 969 * current network. The caller is responsible for freeing the returned data. 970 */ 971struct wpabuf * eap_sm_buildIdentity(struct eap_sm *sm, int id, int encrypted) 972{ 973 struct eap_peer_config *config = eap_get_config(sm); 974 struct wpabuf *resp; 975 const u8 *identity; 976 size_t identity_len; 977 978 if (config == NULL) { 979 wpa_printf(MSG_WARNING, "EAP: buildIdentity: configuration " 980 "was not available"); 981 return NULL; 982 } 983 984 if (sm->m && sm->m->get_identity && 985 (identity = sm->m->get_identity(sm, sm->eap_method_priv, 986 &identity_len)) != NULL) { 987 wpa_hexdump_ascii(MSG_DEBUG, "EAP: using method re-auth " 988 "identity", identity, identity_len); 989 } else if (!encrypted && config->anonymous_identity) { 990 identity = config->anonymous_identity; 991 identity_len = config->anonymous_identity_len; 992 wpa_hexdump_ascii(MSG_DEBUG, "EAP: using anonymous identity", 993 identity, identity_len); 994 } else { 995 identity = config->identity; 996 identity_len = config->identity_len; 997 wpa_hexdump_ascii(MSG_DEBUG, "EAP: using real identity", 998 identity, identity_len); 999 } 1000 1001 if (identity == NULL) { 1002 wpa_printf(MSG_WARNING, "EAP: buildIdentity: identity " 1003 "configuration was not available"); 1004 if (config->pcsc) { 1005 if (eap_sm_get_scard_identity(sm, config) < 0) 1006 return NULL; 1007 identity = config->identity; 1008 identity_len = config->identity_len; 1009 wpa_hexdump_ascii(MSG_DEBUG, "permanent identity from " 1010 "IMSI", identity, identity_len); 1011 } else { 1012 eap_sm_request_identity(sm); 1013 return NULL; 1014 } 1015 } else if (config->pcsc) { 1016 if (eap_sm_set_scard_pin(sm, config) < 0) 1017 return NULL; 1018 } 1019 1020 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_IDENTITY, identity_len, 1021 EAP_CODE_RESPONSE, id); 1022 if (resp == NULL) 1023 return NULL; 1024 1025 wpabuf_put_data(resp, identity, identity_len); 1026 1027 return resp; 1028} 1029 1030 1031static void eap_sm_processNotify(struct eap_sm *sm, const struct wpabuf *req) 1032{ 1033 const u8 *pos; 1034 char *msg; 1035 size_t i, msg_len; 1036 1037 pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_NOTIFICATION, req, 1038 &msg_len); 1039 if (pos == NULL) 1040 return; 1041 wpa_hexdump_ascii(MSG_DEBUG, "EAP: EAP-Request Notification data", 1042 pos, msg_len); 1043 1044 msg = os_malloc(msg_len + 1); 1045 if (msg == NULL) 1046 return; 1047 for (i = 0; i < msg_len; i++) 1048 msg[i] = isprint(pos[i]) ? (char) pos[i] : '_'; 1049 msg[msg_len] = '\0'; 1050 wpa_msg(sm->msg_ctx, MSG_INFO, "%s%s", 1051 WPA_EVENT_EAP_NOTIFICATION, msg); 1052 os_free(msg); 1053} 1054 1055 1056static struct wpabuf * eap_sm_buildNotify(int id) 1057{ 1058 struct wpabuf *resp; 1059 1060 wpa_printf(MSG_DEBUG, "EAP: Generating EAP-Response Notification"); 1061 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_NOTIFICATION, 0, 1062 EAP_CODE_RESPONSE, id); 1063 if (resp == NULL) 1064 return NULL; 1065 1066 return resp; 1067} 1068 1069 1070static void eap_sm_parseEapReq(struct eap_sm *sm, const struct wpabuf *req) 1071{ 1072 const struct eap_hdr *hdr; 1073 size_t plen; 1074 const u8 *pos; 1075 1076 sm->rxReq = sm->rxResp = sm->rxSuccess = sm->rxFailure = FALSE; 1077 sm->reqId = 0; 1078 sm->reqMethod = EAP_TYPE_NONE; 1079 sm->reqVendor = EAP_VENDOR_IETF; 1080 sm->reqVendorMethod = EAP_TYPE_NONE; 1081 1082 if (req == NULL || wpabuf_len(req) < sizeof(*hdr)) 1083 return; 1084 1085 hdr = wpabuf_head(req); 1086 plen = be_to_host16(hdr->length); 1087 if (plen > wpabuf_len(req)) { 1088 wpa_printf(MSG_DEBUG, "EAP: Ignored truncated EAP-Packet " 1089 "(len=%lu plen=%lu)", 1090 (unsigned long) wpabuf_len(req), 1091 (unsigned long) plen); 1092 return; 1093 } 1094 1095 sm->reqId = hdr->identifier; 1096 1097 if (sm->workaround) { 1098 const u8 *addr[1]; 1099 addr[0] = wpabuf_head(req); 1100 md5_vector(1, addr, &plen, sm->req_md5); 1101 } 1102 1103 switch (hdr->code) { 1104 case EAP_CODE_REQUEST: 1105 if (plen < sizeof(*hdr) + 1) { 1106 wpa_printf(MSG_DEBUG, "EAP: Too short EAP-Request - " 1107 "no Type field"); 1108 return; 1109 } 1110 sm->rxReq = TRUE; 1111 pos = (const u8 *) (hdr + 1); 1112 sm->reqMethod = *pos++; 1113 if (sm->reqMethod == EAP_TYPE_EXPANDED) { 1114 if (plen < sizeof(*hdr) + 8) { 1115 wpa_printf(MSG_DEBUG, "EAP: Ignored truncated " 1116 "expanded EAP-Packet (plen=%lu)", 1117 (unsigned long) plen); 1118 return; 1119 } 1120 sm->reqVendor = WPA_GET_BE24(pos); 1121 pos += 3; 1122 sm->reqVendorMethod = WPA_GET_BE32(pos); 1123 } 1124 wpa_printf(MSG_DEBUG, "EAP: Received EAP-Request id=%d " 1125 "method=%u vendor=%u vendorMethod=%u", 1126 sm->reqId, sm->reqMethod, sm->reqVendor, 1127 sm->reqVendorMethod); 1128 break; 1129 case EAP_CODE_RESPONSE: 1130 if (sm->selectedMethod == EAP_TYPE_LEAP) { 1131 /* 1132 * LEAP differs from RFC 4137 by using reversed roles 1133 * for mutual authentication and because of this, we 1134 * need to accept EAP-Response frames if LEAP is used. 1135 */ 1136 if (plen < sizeof(*hdr) + 1) { 1137 wpa_printf(MSG_DEBUG, "EAP: Too short " 1138 "EAP-Response - no Type field"); 1139 return; 1140 } 1141 sm->rxResp = TRUE; 1142 pos = (const u8 *) (hdr + 1); 1143 sm->reqMethod = *pos; 1144 wpa_printf(MSG_DEBUG, "EAP: Received EAP-Response for " 1145 "LEAP method=%d id=%d", 1146 sm->reqMethod, sm->reqId); 1147 break; 1148 } 1149 wpa_printf(MSG_DEBUG, "EAP: Ignored EAP-Response"); 1150 break; 1151 case EAP_CODE_SUCCESS: 1152 wpa_printf(MSG_DEBUG, "EAP: Received EAP-Success"); 1153 sm->rxSuccess = TRUE; 1154 break; 1155 case EAP_CODE_FAILURE: 1156 wpa_printf(MSG_DEBUG, "EAP: Received EAP-Failure"); 1157 sm->rxFailure = TRUE; 1158 break; 1159 default: 1160 wpa_printf(MSG_DEBUG, "EAP: Ignored EAP-Packet with unknown " 1161 "code %d", hdr->code); 1162 break; 1163 } 1164} 1165 1166 1167static void eap_peer_sm_tls_event(void *ctx, enum tls_event ev, 1168 union tls_event_data *data) 1169{ 1170 struct eap_sm *sm = ctx; 1171 char *hash_hex = NULL; 1172 1173 switch (ev) { 1174 case TLS_CERT_CHAIN_FAILURE: 1175 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_TLS_CERT_ERROR 1176 "reason=%d depth=%d subject='%s' err='%s'", 1177 data->cert_fail.reason, 1178 data->cert_fail.depth, 1179 data->cert_fail.subject, 1180 data->cert_fail.reason_txt); 1181 break; 1182 case TLS_PEER_CERTIFICATE: 1183 if (!sm->eapol_cb->notify_cert) 1184 break; 1185 1186 if (data->peer_cert.hash) { 1187 size_t len = data->peer_cert.hash_len * 2 + 1; 1188 hash_hex = os_malloc(len); 1189 if (hash_hex) { 1190 wpa_snprintf_hex(hash_hex, len, 1191 data->peer_cert.hash, 1192 data->peer_cert.hash_len); 1193 } 1194 } 1195 1196 sm->eapol_cb->notify_cert(sm->eapol_ctx, 1197 data->peer_cert.depth, 1198 data->peer_cert.subject, 1199 hash_hex, data->peer_cert.cert); 1200 break; 1201 } 1202 1203 os_free(hash_hex); 1204} 1205 1206 1207/** 1208 * eap_peer_sm_init - Allocate and initialize EAP peer state machine 1209 * @eapol_ctx: Context data to be used with eapol_cb calls 1210 * @eapol_cb: Pointer to EAPOL callback functions 1211 * @msg_ctx: Context data for wpa_msg() calls 1212 * @conf: EAP configuration 1213 * Returns: Pointer to the allocated EAP state machine or %NULL on failure 1214 * 1215 * This function allocates and initializes an EAP state machine. In addition, 1216 * this initializes TLS library for the new EAP state machine. eapol_cb pointer 1217 * will be in use until eap_peer_sm_deinit() is used to deinitialize this EAP 1218 * state machine. Consequently, the caller must make sure that this data 1219 * structure remains alive while the EAP state machine is active. 1220 */ 1221struct eap_sm * eap_peer_sm_init(void *eapol_ctx, 1222 struct eapol_callbacks *eapol_cb, 1223 void *msg_ctx, struct eap_config *conf) 1224{ 1225 struct eap_sm *sm; 1226 struct tls_config tlsconf; 1227 1228 sm = os_zalloc(sizeof(*sm)); 1229 if (sm == NULL) 1230 return NULL; 1231 sm->eapol_ctx = eapol_ctx; 1232 sm->eapol_cb = eapol_cb; 1233 sm->msg_ctx = msg_ctx; 1234 sm->ClientTimeout = EAP_CLIENT_TIMEOUT_DEFAULT; 1235 sm->wps = conf->wps; 1236 1237 os_memset(&tlsconf, 0, sizeof(tlsconf)); 1238 tlsconf.opensc_engine_path = conf->opensc_engine_path; 1239 tlsconf.pkcs11_engine_path = conf->pkcs11_engine_path; 1240 tlsconf.pkcs11_module_path = conf->pkcs11_module_path; 1241#ifdef CONFIG_FIPS 1242 tlsconf.fips_mode = 1; 1243#endif /* CONFIG_FIPS */ 1244 tlsconf.event_cb = eap_peer_sm_tls_event; 1245 tlsconf.cb_ctx = sm; 1246 tlsconf.cert_in_cb = conf->cert_in_cb; 1247 sm->ssl_ctx = tls_init(&tlsconf); 1248 if (sm->ssl_ctx == NULL) { 1249 wpa_printf(MSG_WARNING, "SSL: Failed to initialize TLS " 1250 "context."); 1251 os_free(sm); 1252 return NULL; 1253 } 1254 1255 return sm; 1256} 1257 1258 1259/** 1260 * eap_peer_sm_deinit - Deinitialize and free an EAP peer state machine 1261 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1262 * 1263 * This function deinitializes EAP state machine and frees all allocated 1264 * resources. 1265 */ 1266void eap_peer_sm_deinit(struct eap_sm *sm) 1267{ 1268 if (sm == NULL) 1269 return; 1270 eap_deinit_prev_method(sm, "EAP deinit"); 1271 eap_sm_abort(sm); 1272 tls_deinit(sm->ssl_ctx); 1273 os_free(sm); 1274} 1275 1276 1277/** 1278 * eap_peer_sm_step - Step EAP peer state machine 1279 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1280 * Returns: 1 if EAP state was changed or 0 if not 1281 * 1282 * This function advances EAP state machine to a new state to match with the 1283 * current variables. This should be called whenever variables used by the EAP 1284 * state machine have changed. 1285 */ 1286int eap_peer_sm_step(struct eap_sm *sm) 1287{ 1288 int res = 0; 1289 do { 1290 sm->changed = FALSE; 1291 SM_STEP_RUN(EAP); 1292 if (sm->changed) 1293 res = 1; 1294 } while (sm->changed); 1295 return res; 1296} 1297 1298 1299/** 1300 * eap_sm_abort - Abort EAP authentication 1301 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1302 * 1303 * Release system resources that have been allocated for the authentication 1304 * session without fully deinitializing the EAP state machine. 1305 */ 1306void eap_sm_abort(struct eap_sm *sm) 1307{ 1308 wpabuf_free(sm->lastRespData); 1309 sm->lastRespData = NULL; 1310 wpabuf_free(sm->eapRespData); 1311 sm->eapRespData = NULL; 1312 os_free(sm->eapKeyData); 1313 sm->eapKeyData = NULL; 1314 1315 /* This is not clearly specified in the EAP statemachines draft, but 1316 * it seems necessary to make sure that some of the EAPOL variables get 1317 * cleared for the next authentication. */ 1318 eapol_set_bool(sm, EAPOL_eapSuccess, FALSE); 1319} 1320 1321 1322#ifdef CONFIG_CTRL_IFACE 1323static const char * eap_sm_state_txt(int state) 1324{ 1325 switch (state) { 1326 case EAP_INITIALIZE: 1327 return "INITIALIZE"; 1328 case EAP_DISABLED: 1329 return "DISABLED"; 1330 case EAP_IDLE: 1331 return "IDLE"; 1332 case EAP_RECEIVED: 1333 return "RECEIVED"; 1334 case EAP_GET_METHOD: 1335 return "GET_METHOD"; 1336 case EAP_METHOD: 1337 return "METHOD"; 1338 case EAP_SEND_RESPONSE: 1339 return "SEND_RESPONSE"; 1340 case EAP_DISCARD: 1341 return "DISCARD"; 1342 case EAP_IDENTITY: 1343 return "IDENTITY"; 1344 case EAP_NOTIFICATION: 1345 return "NOTIFICATION"; 1346 case EAP_RETRANSMIT: 1347 return "RETRANSMIT"; 1348 case EAP_SUCCESS: 1349 return "SUCCESS"; 1350 case EAP_FAILURE: 1351 return "FAILURE"; 1352 default: 1353 return "UNKNOWN"; 1354 } 1355} 1356#endif /* CONFIG_CTRL_IFACE */ 1357 1358 1359#if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG) 1360static const char * eap_sm_method_state_txt(EapMethodState state) 1361{ 1362 switch (state) { 1363 case METHOD_NONE: 1364 return "NONE"; 1365 case METHOD_INIT: 1366 return "INIT"; 1367 case METHOD_CONT: 1368 return "CONT"; 1369 case METHOD_MAY_CONT: 1370 return "MAY_CONT"; 1371 case METHOD_DONE: 1372 return "DONE"; 1373 default: 1374 return "UNKNOWN"; 1375 } 1376} 1377 1378 1379static const char * eap_sm_decision_txt(EapDecision decision) 1380{ 1381 switch (decision) { 1382 case DECISION_FAIL: 1383 return "FAIL"; 1384 case DECISION_COND_SUCC: 1385 return "COND_SUCC"; 1386 case DECISION_UNCOND_SUCC: 1387 return "UNCOND_SUCC"; 1388 default: 1389 return "UNKNOWN"; 1390 } 1391} 1392#endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */ 1393 1394 1395#ifdef CONFIG_CTRL_IFACE 1396 1397/** 1398 * eap_sm_get_status - Get EAP state machine status 1399 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1400 * @buf: Buffer for status information 1401 * @buflen: Maximum buffer length 1402 * @verbose: Whether to include verbose status information 1403 * Returns: Number of bytes written to buf. 1404 * 1405 * Query EAP state machine for status information. This function fills in a 1406 * text area with current status information from the EAPOL state machine. If 1407 * the buffer (buf) is not large enough, status information will be truncated 1408 * to fit the buffer. 1409 */ 1410int eap_sm_get_status(struct eap_sm *sm, char *buf, size_t buflen, int verbose) 1411{ 1412 int len, ret; 1413 1414 if (sm == NULL) 1415 return 0; 1416 1417 len = os_snprintf(buf, buflen, 1418 "EAP state=%s\n", 1419 eap_sm_state_txt(sm->EAP_state)); 1420 if (len < 0 || (size_t) len >= buflen) 1421 return 0; 1422 1423 if (sm->selectedMethod != EAP_TYPE_NONE) { 1424 const char *name; 1425 if (sm->m) { 1426 name = sm->m->name; 1427 } else { 1428 const struct eap_method *m = 1429 eap_peer_get_eap_method(EAP_VENDOR_IETF, 1430 sm->selectedMethod); 1431 if (m) 1432 name = m->name; 1433 else 1434 name = "?"; 1435 } 1436 ret = os_snprintf(buf + len, buflen - len, 1437 "selectedMethod=%d (EAP-%s)\n", 1438 sm->selectedMethod, name); 1439 if (ret < 0 || (size_t) ret >= buflen - len) 1440 return len; 1441 len += ret; 1442 1443 if (sm->m && sm->m->get_status) { 1444 len += sm->m->get_status(sm, sm->eap_method_priv, 1445 buf + len, buflen - len, 1446 verbose); 1447 } 1448 } 1449 1450 if (verbose) { 1451 ret = os_snprintf(buf + len, buflen - len, 1452 "reqMethod=%d\n" 1453 "methodState=%s\n" 1454 "decision=%s\n" 1455 "ClientTimeout=%d\n", 1456 sm->reqMethod, 1457 eap_sm_method_state_txt(sm->methodState), 1458 eap_sm_decision_txt(sm->decision), 1459 sm->ClientTimeout); 1460 if (ret < 0 || (size_t) ret >= buflen - len) 1461 return len; 1462 len += ret; 1463 } 1464 1465 return len; 1466} 1467#endif /* CONFIG_CTRL_IFACE */ 1468 1469 1470#if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG) 1471static void eap_sm_request(struct eap_sm *sm, enum wpa_ctrl_req_type field, 1472 const char *msg, size_t msglen) 1473{ 1474 struct eap_peer_config *config; 1475 char *txt = NULL, *tmp; 1476 1477 if (sm == NULL) 1478 return; 1479 config = eap_get_config(sm); 1480 if (config == NULL) 1481 return; 1482 1483 switch (field) { 1484 case WPA_CTRL_REQ_EAP_IDENTITY: 1485 config->pending_req_identity++; 1486 break; 1487 case WPA_CTRL_REQ_EAP_PASSWORD: 1488 config->pending_req_password++; 1489 break; 1490 case WPA_CTRL_REQ_EAP_NEW_PASSWORD: 1491 config->pending_req_new_password++; 1492 break; 1493 case WPA_CTRL_REQ_EAP_PIN: 1494 config->pending_req_pin++; 1495 break; 1496 case WPA_CTRL_REQ_EAP_OTP: 1497 if (msg) { 1498 tmp = os_malloc(msglen + 3); 1499 if (tmp == NULL) 1500 return; 1501 tmp[0] = '['; 1502 os_memcpy(tmp + 1, msg, msglen); 1503 tmp[msglen + 1] = ']'; 1504 tmp[msglen + 2] = '\0'; 1505 txt = tmp; 1506 os_free(config->pending_req_otp); 1507 config->pending_req_otp = tmp; 1508 config->pending_req_otp_len = msglen + 3; 1509 } else { 1510 if (config->pending_req_otp == NULL) 1511 return; 1512 txt = config->pending_req_otp; 1513 } 1514 break; 1515 case WPA_CTRL_REQ_EAP_PASSPHRASE: 1516 config->pending_req_passphrase++; 1517 break; 1518 default: 1519 return; 1520 } 1521 1522 if (sm->eapol_cb->eap_param_needed) 1523 sm->eapol_cb->eap_param_needed(sm->eapol_ctx, field, txt); 1524} 1525#else /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */ 1526#define eap_sm_request(sm, type, msg, msglen) do { } while (0) 1527#endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */ 1528 1529const char * eap_sm_get_method_name(struct eap_sm *sm) 1530{ 1531 if (sm->m == NULL) 1532 return "UNKNOWN"; 1533 return sm->m->name; 1534} 1535 1536 1537/** 1538 * eap_sm_request_identity - Request identity from user (ctrl_iface) 1539 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1540 * 1541 * EAP methods can call this function to request identity information for the 1542 * current network. This is normally called when the identity is not included 1543 * in the network configuration. The request will be sent to monitor programs 1544 * through the control interface. 1545 */ 1546void eap_sm_request_identity(struct eap_sm *sm) 1547{ 1548 eap_sm_request(sm, WPA_CTRL_REQ_EAP_IDENTITY, NULL, 0); 1549} 1550 1551 1552/** 1553 * eap_sm_request_password - Request password from user (ctrl_iface) 1554 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1555 * 1556 * EAP methods can call this function to request password information for the 1557 * current network. This is normally called when the password is not included 1558 * in the network configuration. The request will be sent to monitor programs 1559 * through the control interface. 1560 */ 1561void eap_sm_request_password(struct eap_sm *sm) 1562{ 1563 eap_sm_request(sm, WPA_CTRL_REQ_EAP_PASSWORD, NULL, 0); 1564} 1565 1566 1567/** 1568 * eap_sm_request_new_password - Request new password from user (ctrl_iface) 1569 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1570 * 1571 * EAP methods can call this function to request new password information for 1572 * the current network. This is normally called when the EAP method indicates 1573 * that the current password has expired and password change is required. The 1574 * request will be sent to monitor programs through the control interface. 1575 */ 1576void eap_sm_request_new_password(struct eap_sm *sm) 1577{ 1578 eap_sm_request(sm, WPA_CTRL_REQ_EAP_NEW_PASSWORD, NULL, 0); 1579} 1580 1581 1582/** 1583 * eap_sm_request_pin - Request SIM or smart card PIN from user (ctrl_iface) 1584 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1585 * 1586 * EAP methods can call this function to request SIM or smart card PIN 1587 * information for the current network. This is normally called when the PIN is 1588 * not included in the network configuration. The request will be sent to 1589 * monitor programs through the control interface. 1590 */ 1591void eap_sm_request_pin(struct eap_sm *sm) 1592{ 1593 eap_sm_request(sm, WPA_CTRL_REQ_EAP_PIN, NULL, 0); 1594} 1595 1596 1597/** 1598 * eap_sm_request_otp - Request one time password from user (ctrl_iface) 1599 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1600 * @msg: Message to be displayed to the user when asking for OTP 1601 * @msg_len: Length of the user displayable message 1602 * 1603 * EAP methods can call this function to request open time password (OTP) for 1604 * the current network. The request will be sent to monitor programs through 1605 * the control interface. 1606 */ 1607void eap_sm_request_otp(struct eap_sm *sm, const char *msg, size_t msg_len) 1608{ 1609 eap_sm_request(sm, WPA_CTRL_REQ_EAP_OTP, msg, msg_len); 1610} 1611 1612 1613/** 1614 * eap_sm_request_passphrase - Request passphrase from user (ctrl_iface) 1615 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1616 * 1617 * EAP methods can call this function to request passphrase for a private key 1618 * for the current network. This is normally called when the passphrase is not 1619 * included in the network configuration. The request will be sent to monitor 1620 * programs through the control interface. 1621 */ 1622void eap_sm_request_passphrase(struct eap_sm *sm) 1623{ 1624 eap_sm_request(sm, WPA_CTRL_REQ_EAP_PASSPHRASE, NULL, 0); 1625} 1626 1627 1628/** 1629 * eap_sm_notify_ctrl_attached - Notification of attached monitor 1630 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1631 * 1632 * Notify EAP state machines that a monitor was attached to the control 1633 * interface to trigger re-sending of pending requests for user input. 1634 */ 1635void eap_sm_notify_ctrl_attached(struct eap_sm *sm) 1636{ 1637 struct eap_peer_config *config = eap_get_config(sm); 1638 1639 if (config == NULL) 1640 return; 1641 1642 /* Re-send any pending requests for user data since a new control 1643 * interface was added. This handles cases where the EAP authentication 1644 * starts immediately after system startup when the user interface is 1645 * not yet running. */ 1646 if (config->pending_req_identity) 1647 eap_sm_request_identity(sm); 1648 if (config->pending_req_password) 1649 eap_sm_request_password(sm); 1650 if (config->pending_req_new_password) 1651 eap_sm_request_new_password(sm); 1652 if (config->pending_req_otp) 1653 eap_sm_request_otp(sm, NULL, 0); 1654 if (config->pending_req_pin) 1655 eap_sm_request_pin(sm); 1656 if (config->pending_req_passphrase) 1657 eap_sm_request_passphrase(sm); 1658} 1659 1660 1661static int eap_allowed_phase2_type(int vendor, int type) 1662{ 1663 if (vendor != EAP_VENDOR_IETF) 1664 return 0; 1665 return type != EAP_TYPE_PEAP && type != EAP_TYPE_TTLS && 1666 type != EAP_TYPE_FAST; 1667} 1668 1669 1670/** 1671 * eap_get_phase2_type - Get EAP type for the given EAP phase 2 method name 1672 * @name: EAP method name, e.g., MD5 1673 * @vendor: Buffer for returning EAP Vendor-Id 1674 * Returns: EAP method type or %EAP_TYPE_NONE if not found 1675 * 1676 * This function maps EAP type names into EAP type numbers that are allowed for 1677 * Phase 2, i.e., for tunneled authentication. Phase 2 is used, e.g., with 1678 * EAP-PEAP, EAP-TTLS, and EAP-FAST. 1679 */ 1680u32 eap_get_phase2_type(const char *name, int *vendor) 1681{ 1682 int v; 1683 u8 type = eap_peer_get_type(name, &v); 1684 if (eap_allowed_phase2_type(v, type)) { 1685 *vendor = v; 1686 return type; 1687 } 1688 *vendor = EAP_VENDOR_IETF; 1689 return EAP_TYPE_NONE; 1690} 1691 1692 1693/** 1694 * eap_get_phase2_types - Get list of allowed EAP phase 2 types 1695 * @config: Pointer to a network configuration 1696 * @count: Pointer to a variable to be filled with number of returned EAP types 1697 * Returns: Pointer to allocated type list or %NULL on failure 1698 * 1699 * This function generates an array of allowed EAP phase 2 (tunneled) types for 1700 * the given network configuration. 1701 */ 1702struct eap_method_type * eap_get_phase2_types(struct eap_peer_config *config, 1703 size_t *count) 1704{ 1705 struct eap_method_type *buf; 1706 u32 method; 1707 int vendor; 1708 size_t mcount; 1709 const struct eap_method *methods, *m; 1710 1711 methods = eap_peer_get_methods(&mcount); 1712 if (methods == NULL) 1713 return NULL; 1714 *count = 0; 1715 buf = os_malloc(mcount * sizeof(struct eap_method_type)); 1716 if (buf == NULL) 1717 return NULL; 1718 1719 for (m = methods; m; m = m->next) { 1720 vendor = m->vendor; 1721 method = m->method; 1722 if (eap_allowed_phase2_type(vendor, method)) { 1723 if (vendor == EAP_VENDOR_IETF && 1724 method == EAP_TYPE_TLS && config && 1725 config->private_key2 == NULL) 1726 continue; 1727 buf[*count].vendor = vendor; 1728 buf[*count].method = method; 1729 (*count)++; 1730 } 1731 } 1732 1733 return buf; 1734} 1735 1736 1737/** 1738 * eap_set_fast_reauth - Update fast_reauth setting 1739 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1740 * @enabled: 1 = Fast reauthentication is enabled, 0 = Disabled 1741 */ 1742void eap_set_fast_reauth(struct eap_sm *sm, int enabled) 1743{ 1744 sm->fast_reauth = enabled; 1745} 1746 1747 1748/** 1749 * eap_set_workaround - Update EAP workarounds setting 1750 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1751 * @workaround: 1 = Enable EAP workarounds, 0 = Disable EAP workarounds 1752 */ 1753void eap_set_workaround(struct eap_sm *sm, unsigned int workaround) 1754{ 1755 sm->workaround = workaround; 1756} 1757 1758 1759/** 1760 * eap_get_config - Get current network configuration 1761 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1762 * Returns: Pointer to the current network configuration or %NULL if not found 1763 * 1764 * EAP peer methods should avoid using this function if they can use other 1765 * access functions, like eap_get_config_identity() and 1766 * eap_get_config_password(), that do not require direct access to 1767 * struct eap_peer_config. 1768 */ 1769struct eap_peer_config * eap_get_config(struct eap_sm *sm) 1770{ 1771 return sm->eapol_cb->get_config(sm->eapol_ctx); 1772} 1773 1774 1775/** 1776 * eap_get_config_identity - Get identity from the network configuration 1777 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1778 * @len: Buffer for the length of the identity 1779 * Returns: Pointer to the identity or %NULL if not found 1780 */ 1781const u8 * eap_get_config_identity(struct eap_sm *sm, size_t *len) 1782{ 1783 struct eap_peer_config *config = eap_get_config(sm); 1784 if (config == NULL) 1785 return NULL; 1786 *len = config->identity_len; 1787 return config->identity; 1788} 1789 1790 1791/** 1792 * eap_get_config_password - Get password from the network configuration 1793 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1794 * @len: Buffer for the length of the password 1795 * Returns: Pointer to the password or %NULL if not found 1796 */ 1797const u8 * eap_get_config_password(struct eap_sm *sm, size_t *len) 1798{ 1799 struct eap_peer_config *config = eap_get_config(sm); 1800 if (config == NULL) 1801 return NULL; 1802 *len = config->password_len; 1803 return config->password; 1804} 1805 1806 1807/** 1808 * eap_get_config_password2 - Get password from the network configuration 1809 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1810 * @len: Buffer for the length of the password 1811 * @hash: Buffer for returning whether the password is stored as a 1812 * NtPasswordHash instead of plaintext password; can be %NULL if this 1813 * information is not needed 1814 * Returns: Pointer to the password or %NULL if not found 1815 */ 1816const u8 * eap_get_config_password2(struct eap_sm *sm, size_t *len, int *hash) 1817{ 1818 struct eap_peer_config *config = eap_get_config(sm); 1819 if (config == NULL) 1820 return NULL; 1821 *len = config->password_len; 1822 if (hash) 1823 *hash = !!(config->flags & EAP_CONFIG_FLAGS_PASSWORD_NTHASH); 1824 return config->password; 1825} 1826 1827 1828/** 1829 * eap_get_config_new_password - Get new password from network configuration 1830 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1831 * @len: Buffer for the length of the new password 1832 * Returns: Pointer to the new password or %NULL if not found 1833 */ 1834const u8 * eap_get_config_new_password(struct eap_sm *sm, size_t *len) 1835{ 1836 struct eap_peer_config *config = eap_get_config(sm); 1837 if (config == NULL) 1838 return NULL; 1839 *len = config->new_password_len; 1840 return config->new_password; 1841} 1842 1843 1844/** 1845 * eap_get_config_otp - Get one-time password from the network configuration 1846 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1847 * @len: Buffer for the length of the one-time password 1848 * Returns: Pointer to the one-time password or %NULL if not found 1849 */ 1850const u8 * eap_get_config_otp(struct eap_sm *sm, size_t *len) 1851{ 1852 struct eap_peer_config *config = eap_get_config(sm); 1853 if (config == NULL) 1854 return NULL; 1855 *len = config->otp_len; 1856 return config->otp; 1857} 1858 1859 1860/** 1861 * eap_clear_config_otp - Clear used one-time password 1862 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1863 * 1864 * This function clears a used one-time password (OTP) from the current network 1865 * configuration. This should be called when the OTP has been used and is not 1866 * needed anymore. 1867 */ 1868void eap_clear_config_otp(struct eap_sm *sm) 1869{ 1870 struct eap_peer_config *config = eap_get_config(sm); 1871 if (config == NULL) 1872 return; 1873 os_memset(config->otp, 0, config->otp_len); 1874 os_free(config->otp); 1875 config->otp = NULL; 1876 config->otp_len = 0; 1877} 1878 1879 1880/** 1881 * eap_get_config_phase1 - Get phase1 data from the network configuration 1882 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1883 * Returns: Pointer to the phase1 data or %NULL if not found 1884 */ 1885const char * eap_get_config_phase1(struct eap_sm *sm) 1886{ 1887 struct eap_peer_config *config = eap_get_config(sm); 1888 if (config == NULL) 1889 return NULL; 1890 return config->phase1; 1891} 1892 1893 1894/** 1895 * eap_get_config_phase2 - Get phase2 data from the network configuration 1896 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1897 * Returns: Pointer to the phase1 data or %NULL if not found 1898 */ 1899const char * eap_get_config_phase2(struct eap_sm *sm) 1900{ 1901 struct eap_peer_config *config = eap_get_config(sm); 1902 if (config == NULL) 1903 return NULL; 1904 return config->phase2; 1905} 1906 1907 1908int eap_get_config_fragment_size(struct eap_sm *sm) 1909{ 1910 struct eap_peer_config *config = eap_get_config(sm); 1911 if (config == NULL) 1912 return -1; 1913 return config->fragment_size; 1914} 1915 1916 1917/** 1918 * eap_key_available - Get key availability (eapKeyAvailable variable) 1919 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1920 * Returns: 1 if EAP keying material is available, 0 if not 1921 */ 1922int eap_key_available(struct eap_sm *sm) 1923{ 1924 return sm ? sm->eapKeyAvailable : 0; 1925} 1926 1927 1928/** 1929 * eap_notify_success - Notify EAP state machine about external success trigger 1930 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1931 * 1932 * This function is called when external event, e.g., successful completion of 1933 * WPA-PSK key handshake, is indicating that EAP state machine should move to 1934 * success state. This is mainly used with security modes that do not use EAP 1935 * state machine (e.g., WPA-PSK). 1936 */ 1937void eap_notify_success(struct eap_sm *sm) 1938{ 1939 if (sm) { 1940 sm->decision = DECISION_COND_SUCC; 1941 sm->EAP_state = EAP_SUCCESS; 1942 } 1943} 1944 1945 1946/** 1947 * eap_notify_lower_layer_success - Notification of lower layer success 1948 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1949 * 1950 * Notify EAP state machines that a lower layer has detected a successful 1951 * authentication. This is used to recover from dropped EAP-Success messages. 1952 */ 1953void eap_notify_lower_layer_success(struct eap_sm *sm) 1954{ 1955 if (sm == NULL) 1956 return; 1957 1958 if (eapol_get_bool(sm, EAPOL_eapSuccess) || 1959 sm->decision == DECISION_FAIL || 1960 (sm->methodState != METHOD_MAY_CONT && 1961 sm->methodState != METHOD_DONE)) 1962 return; 1963 1964 if (sm->eapKeyData != NULL) 1965 sm->eapKeyAvailable = TRUE; 1966 eapol_set_bool(sm, EAPOL_eapSuccess, TRUE); 1967 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_SUCCESS 1968 "EAP authentication completed successfully (based on lower " 1969 "layer success)"); 1970} 1971 1972 1973/** 1974 * eap_get_eapKeyData - Get master session key (MSK) from EAP state machine 1975 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1976 * @len: Pointer to variable that will be set to number of bytes in the key 1977 * Returns: Pointer to the EAP keying data or %NULL on failure 1978 * 1979 * Fetch EAP keying material (MSK, eapKeyData) from the EAP state machine. The 1980 * key is available only after a successful authentication. EAP state machine 1981 * continues to manage the key data and the caller must not change or free the 1982 * returned data. 1983 */ 1984const u8 * eap_get_eapKeyData(struct eap_sm *sm, size_t *len) 1985{ 1986 if (sm == NULL || sm->eapKeyData == NULL) { 1987 *len = 0; 1988 return NULL; 1989 } 1990 1991 *len = sm->eapKeyDataLen; 1992 return sm->eapKeyData; 1993} 1994 1995 1996/** 1997 * eap_get_eapKeyData - Get EAP response data 1998 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1999 * Returns: Pointer to the EAP response (eapRespData) or %NULL on failure 2000 * 2001 * Fetch EAP response (eapRespData) from the EAP state machine. This data is 2002 * available when EAP state machine has processed an incoming EAP request. The 2003 * EAP state machine does not maintain a reference to the response after this 2004 * function is called and the caller is responsible for freeing the data. 2005 */ 2006struct wpabuf * eap_get_eapRespData(struct eap_sm *sm) 2007{ 2008 struct wpabuf *resp; 2009 2010 if (sm == NULL || sm->eapRespData == NULL) 2011 return NULL; 2012 2013 resp = sm->eapRespData; 2014 sm->eapRespData = NULL; 2015 2016 return resp; 2017} 2018 2019 2020/** 2021 * eap_sm_register_scard_ctx - Notification of smart card context 2022 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2023 * @ctx: Context data for smart card operations 2024 * 2025 * Notify EAP state machines of context data for smart card operations. This 2026 * context data will be used as a parameter for scard_*() functions. 2027 */ 2028void eap_register_scard_ctx(struct eap_sm *sm, void *ctx) 2029{ 2030 if (sm) 2031 sm->scard_ctx = ctx; 2032} 2033 2034 2035/** 2036 * eap_set_config_blob - Set or add a named configuration blob 2037 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2038 * @blob: New value for the blob 2039 * 2040 * Adds a new configuration blob or replaces the current value of an existing 2041 * blob. 2042 */ 2043void eap_set_config_blob(struct eap_sm *sm, struct wpa_config_blob *blob) 2044{ 2045#ifndef CONFIG_NO_CONFIG_BLOBS 2046 sm->eapol_cb->set_config_blob(sm->eapol_ctx, blob); 2047#endif /* CONFIG_NO_CONFIG_BLOBS */ 2048} 2049 2050 2051/** 2052 * eap_get_config_blob - Get a named configuration blob 2053 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2054 * @name: Name of the blob 2055 * Returns: Pointer to blob data or %NULL if not found 2056 */ 2057const struct wpa_config_blob * eap_get_config_blob(struct eap_sm *sm, 2058 const char *name) 2059{ 2060#ifndef CONFIG_NO_CONFIG_BLOBS 2061 return sm->eapol_cb->get_config_blob(sm->eapol_ctx, name); 2062#else /* CONFIG_NO_CONFIG_BLOBS */ 2063 return NULL; 2064#endif /* CONFIG_NO_CONFIG_BLOBS */ 2065} 2066 2067 2068/** 2069 * eap_set_force_disabled - Set force_disabled flag 2070 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2071 * @disabled: 1 = EAP disabled, 0 = EAP enabled 2072 * 2073 * This function is used to force EAP state machine to be disabled when it is 2074 * not in use (e.g., with WPA-PSK or plaintext connections). 2075 */ 2076void eap_set_force_disabled(struct eap_sm *sm, int disabled) 2077{ 2078 sm->force_disabled = disabled; 2079} 2080 2081 2082 /** 2083 * eap_notify_pending - Notify that EAP method is ready to re-process a request 2084 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2085 * 2086 * An EAP method can perform a pending operation (e.g., to get a response from 2087 * an external process). Once the response is available, this function can be 2088 * used to request EAPOL state machine to retry delivering the previously 2089 * received (and still unanswered) EAP request to EAP state machine. 2090 */ 2091void eap_notify_pending(struct eap_sm *sm) 2092{ 2093 sm->eapol_cb->notify_pending(sm->eapol_ctx); 2094} 2095 2096 2097/** 2098 * eap_invalidate_cached_session - Mark cached session data invalid 2099 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2100 */ 2101void eap_invalidate_cached_session(struct eap_sm *sm) 2102{ 2103 if (sm) 2104 eap_deinit_prev_method(sm, "invalidate"); 2105} 2106 2107 2108int eap_is_wps_pbc_enrollee(struct eap_peer_config *conf) 2109{ 2110 if (conf->identity_len != WSC_ID_ENROLLEE_LEN || 2111 os_memcmp(conf->identity, WSC_ID_ENROLLEE, WSC_ID_ENROLLEE_LEN)) 2112 return 0; /* Not a WPS Enrollee */ 2113 2114 if (conf->phase1 == NULL || os_strstr(conf->phase1, "pbc=1") == NULL) 2115 return 0; /* Not using PBC */ 2116 2117 return 1; 2118} 2119 2120 2121int eap_is_wps_pin_enrollee(struct eap_peer_config *conf) 2122{ 2123 if (conf->identity_len != WSC_ID_ENROLLEE_LEN || 2124 os_memcmp(conf->identity, WSC_ID_ENROLLEE, WSC_ID_ENROLLEE_LEN)) 2125 return 0; /* Not a WPS Enrollee */ 2126 2127 if (conf->phase1 == NULL || os_strstr(conf->phase1, "pin=") == NULL) 2128 return 0; /* Not using PIN */ 2129 2130 return 1; 2131} 2132