1/* 2 * EAPOL supplicant state machines 3 * Copyright (c) 2004-2012, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9#ifndef EAPOL_SUPP_SM_H 10#define EAPOL_SUPP_SM_H 11 12#include "common/defs.h" 13 14typedef enum { Unauthorized, Authorized } PortStatus; 15typedef enum { Auto, ForceUnauthorized, ForceAuthorized } PortControl; 16 17/** 18 * struct eapol_config - Per network configuration for EAPOL state machines 19 */ 20struct eapol_config { 21 /** 22 * accept_802_1x_keys - Accept IEEE 802.1X (non-WPA) EAPOL-Key frames 23 * 24 * This variable should be set to 1 when using EAPOL state machines 25 * with non-WPA security policy to generate dynamic WEP keys. When 26 * using WPA, this should be set to 0 so that WPA state machine can 27 * process the EAPOL-Key frames. 28 */ 29 int accept_802_1x_keys; 30 31#define EAPOL_REQUIRE_KEY_UNICAST BIT(0) 32#define EAPOL_REQUIRE_KEY_BROADCAST BIT(1) 33 /** 34 * required_keys - Which EAPOL-Key packets are required 35 * 36 * This variable determines which EAPOL-Key packets are required before 37 * marking connection authenticated. This is a bit field of 38 * EAPOL_REQUIRE_KEY_UNICAST and EAPOL_REQUIRE_KEY_BROADCAST flags. 39 */ 40 int required_keys; 41 42 /** 43 * fast_reauth - Whether fast EAP reauthentication is enabled 44 */ 45 int fast_reauth; 46 47 /** 48 * workaround - Whether EAP workarounds are enabled 49 */ 50 unsigned int workaround; 51 52 /** 53 * eap_disabled - Whether EAP is disabled 54 */ 55 int eap_disabled; 56 57 /** 58 * external_sim - Use external processing for SIM/USIM operations 59 */ 60 int external_sim; 61 62 /** 63 * wps - Whether this connection is used for WPS 64 */ 65 int wps; 66}; 67 68struct eapol_sm; 69struct wpa_config_blob; 70 71enum eapol_supp_result { 72 EAPOL_SUPP_RESULT_FAILURE, 73 EAPOL_SUPP_RESULT_SUCCESS, 74 EAPOL_SUPP_RESULT_EXPECTED_FAILURE 75}; 76 77/** 78 * struct eapol_ctx - Global (for all networks) EAPOL state machine context 79 */ 80struct eapol_ctx { 81 /** 82 * ctx - Pointer to arbitrary upper level context 83 */ 84 void *ctx; 85 86 /** 87 * preauth - IEEE 802.11i/RSN pre-authentication 88 * 89 * This EAPOL state machine is used for IEEE 802.11i/RSN 90 * pre-authentication 91 */ 92 int preauth; 93 94 /** 95 * cb - Function to be called when EAPOL negotiation has been completed 96 * @eapol: Pointer to EAPOL state machine data 97 * @result: Whether the authentication was completed successfully 98 * @ctx: Pointer to context data (cb_ctx) 99 * 100 * This optional callback function will be called when the EAPOL 101 * authentication has been completed. This allows the owner of the 102 * EAPOL state machine to process the key and terminate the EAPOL state 103 * machine. Currently, this is used only in RSN pre-authentication. 104 */ 105 void (*cb)(struct eapol_sm *eapol, enum eapol_supp_result result, 106 void *ctx); 107 108 /** 109 * cb_ctx - Callback context for cb() 110 */ 111 void *cb_ctx; 112 113 /** 114 * msg_ctx - Callback context for wpa_msg() calls 115 */ 116 void *msg_ctx; 117 118 /** 119 * scard_ctx - Callback context for PC/SC scard_*() function calls 120 * 121 * This context can be updated with eapol_sm_register_scard_ctx(). 122 */ 123 void *scard_ctx; 124 125 /** 126 * eapol_send_ctx - Callback context for eapol_send() calls 127 */ 128 void *eapol_send_ctx; 129 130 /** 131 * eapol_done_cb - Function to be called at successful completion 132 * @ctx: Callback context (ctx) 133 * 134 * This function is called at the successful completion of EAPOL 135 * authentication. If dynamic WEP keys are used, this is called only 136 * after all the expected keys have been received. 137 */ 138 void (*eapol_done_cb)(void *ctx); 139 140 /** 141 * eapol_send - Send EAPOL packets 142 * @ctx: Callback context (eapol_send_ctx) 143 * @type: EAPOL type (IEEE802_1X_TYPE_*) 144 * @buf: Pointer to EAPOL payload 145 * @len: Length of the EAPOL payload 146 * Returns: 0 on success, -1 on failure 147 */ 148 int (*eapol_send)(void *ctx, int type, const u8 *buf, size_t len); 149 150 /** 151 * set_wep_key - Configure WEP keys 152 * @ctx: Callback context (ctx) 153 * @unicast: Non-zero = unicast, 0 = multicast/broadcast key 154 * @keyidx: Key index (0..3) 155 * @key: WEP key 156 * @keylen: Length of the WEP key 157 * Returns: 0 on success, -1 on failure 158 */ 159 int (*set_wep_key)(void *ctx, int unicast, int keyidx, 160 const u8 *key, size_t keylen); 161 162 /** 163 * set_config_blob - Set or add a named configuration blob 164 * @ctx: Callback context (ctx) 165 * @blob: New value for the blob 166 * 167 * Adds a new configuration blob or replaces the current value of an 168 * existing blob. 169 */ 170 void (*set_config_blob)(void *ctx, struct wpa_config_blob *blob); 171 172 /** 173 * get_config_blob - Get a named configuration blob 174 * @ctx: Callback context (ctx) 175 * @name: Name of the blob 176 * Returns: Pointer to blob data or %NULL if not found 177 */ 178 const struct wpa_config_blob * (*get_config_blob)(void *ctx, 179 const char *name); 180 181 /** 182 * aborted_cached - Notify that cached PMK attempt was aborted 183 * @ctx: Callback context (ctx) 184 */ 185 void (*aborted_cached)(void *ctx); 186 187 /** 188 * opensc_engine_path - Path to the OpenSSL engine for opensc 189 * 190 * This is an OpenSSL specific configuration option for loading OpenSC 191 * engine (engine_opensc.so); if %NULL, this engine is not loaded. 192 */ 193 const char *opensc_engine_path; 194 195 /** 196 * pkcs11_engine_path - Path to the OpenSSL engine for PKCS#11 197 * 198 * This is an OpenSSL specific configuration option for loading PKCS#11 199 * engine (engine_pkcs11.so); if %NULL, this engine is not loaded. 200 */ 201 const char *pkcs11_engine_path; 202 203 /** 204 * pkcs11_module_path - Path to the OpenSSL OpenSC/PKCS#11 module 205 * 206 * This is an OpenSSL specific configuration option for configuring 207 * path to OpenSC/PKCS#11 engine (opensc-pkcs11.so); if %NULL, this 208 * module is not loaded. 209 */ 210 const char *pkcs11_module_path; 211 212 /** 213 * wps - WPS context data 214 * 215 * This is only used by EAP-WSC and can be left %NULL if not available. 216 */ 217 struct wps_context *wps; 218 219 /** 220 * eap_param_needed - Notify that EAP parameter is needed 221 * @ctx: Callback context (ctx) 222 * @field: Field indicator (e.g., WPA_CTRL_REQ_EAP_IDENTITY) 223 * @txt: User readable text describing the required parameter 224 */ 225 void (*eap_param_needed)(void *ctx, enum wpa_ctrl_req_type field, 226 const char *txt); 227 228 /** 229 * port_cb - Set port authorized/unauthorized callback (optional) 230 * @ctx: Callback context (ctx) 231 * @authorized: Whether the supplicant port is now in authorized state 232 */ 233 void (*port_cb)(void *ctx, int authorized); 234 235 /** 236 * cert_cb - Notification of a peer certificate 237 * @ctx: Callback context (ctx) 238 * @depth: Depth in certificate chain (0 = server) 239 * @subject: Subject of the peer certificate 240 * @cert_hash: SHA-256 hash of the certificate 241 * @cert: Peer certificate 242 */ 243 void (*cert_cb)(void *ctx, int depth, const char *subject, 244 const char *cert_hash, const struct wpabuf *cert); 245 246 /** 247 * cert_in_cb - Include server certificates in callback 248 */ 249 int cert_in_cb; 250 251 /** 252 * status_cb - Notification of a change in EAP status 253 * @ctx: Callback context (ctx) 254 * @status: Step in the process of EAP authentication 255 * @parameter: Step-specific parameter, e.g., EAP method name 256 */ 257 void (*status_cb)(void *ctx, const char *status, 258 const char *parameter); 259 260 /** 261 * set_anon_id - Set or add anonymous identity 262 * @ctx: eapol_ctx from eap_peer_sm_init() call 263 * @id: Anonymous identity (e.g., EAP-SIM pseudonym) 264 * @len: Length of anonymous identity in octets 265 */ 266 void (*set_anon_id)(void *ctx, const u8 *id, size_t len); 267}; 268 269 270struct eap_peer_config; 271struct ext_password_data; 272 273#ifdef IEEE8021X_EAPOL 274struct eapol_sm *eapol_sm_init(struct eapol_ctx *ctx); 275void eapol_sm_deinit(struct eapol_sm *sm); 276void eapol_sm_step(struct eapol_sm *sm); 277int eapol_sm_get_status(struct eapol_sm *sm, char *buf, size_t buflen, 278 int verbose); 279int eapol_sm_get_mib(struct eapol_sm *sm, char *buf, size_t buflen); 280void eapol_sm_configure(struct eapol_sm *sm, int heldPeriod, int authPeriod, 281 int startPeriod, int maxStart); 282int eapol_sm_rx_eapol(struct eapol_sm *sm, const u8 *src, const u8 *buf, 283 size_t len); 284void eapol_sm_notify_tx_eapol_key(struct eapol_sm *sm); 285void eapol_sm_notify_portEnabled(struct eapol_sm *sm, Boolean enabled); 286void eapol_sm_notify_portValid(struct eapol_sm *sm, Boolean valid); 287void eapol_sm_notify_eap_success(struct eapol_sm *sm, Boolean success); 288void eapol_sm_notify_eap_fail(struct eapol_sm *sm, Boolean fail); 289void eapol_sm_notify_config(struct eapol_sm *sm, 290 struct eap_peer_config *config, 291 const struct eapol_config *conf); 292int eapol_sm_get_key(struct eapol_sm *sm, u8 *key, size_t len); 293const u8 * eapol_sm_get_session_id(struct eapol_sm *sm, size_t *len); 294void eapol_sm_notify_logoff(struct eapol_sm *sm, Boolean logoff); 295void eapol_sm_notify_cached(struct eapol_sm *sm); 296void eapol_sm_notify_pmkid_attempt(struct eapol_sm *sm, int attempt); 297void eapol_sm_register_scard_ctx(struct eapol_sm *sm, void *ctx); 298void eapol_sm_notify_portControl(struct eapol_sm *sm, PortControl portControl); 299void eapol_sm_notify_ctrl_attached(struct eapol_sm *sm); 300void eapol_sm_notify_ctrl_response(struct eapol_sm *sm); 301void eapol_sm_request_reauth(struct eapol_sm *sm); 302void eapol_sm_notify_lower_layer_success(struct eapol_sm *sm, int in_eapol_sm); 303void eapol_sm_invalidate_cached_session(struct eapol_sm *sm); 304const char * eapol_sm_get_method_name(struct eapol_sm *sm); 305void eapol_sm_set_ext_pw_ctx(struct eapol_sm *sm, 306 struct ext_password_data *ext); 307int eapol_sm_failed(struct eapol_sm *sm); 308int eapol_sm_get_eap_proxy_imsi(struct eapol_sm *sm, char *imsi, size_t *len); 309#else /* IEEE8021X_EAPOL */ 310static inline struct eapol_sm *eapol_sm_init(struct eapol_ctx *ctx) 311{ 312 free(ctx); 313 return (struct eapol_sm *) 1; 314} 315static inline void eapol_sm_deinit(struct eapol_sm *sm) 316{ 317} 318static inline void eapol_sm_step(struct eapol_sm *sm) 319{ 320} 321static inline int eapol_sm_get_status(struct eapol_sm *sm, char *buf, 322 size_t buflen, int verbose) 323{ 324 return 0; 325} 326static inline int eapol_sm_get_mib(struct eapol_sm *sm, char *buf, 327 size_t buflen) 328{ 329 return 0; 330} 331static inline void eapol_sm_configure(struct eapol_sm *sm, int heldPeriod, 332 int authPeriod, int startPeriod, 333 int maxStart) 334{ 335} 336static inline int eapol_sm_rx_eapol(struct eapol_sm *sm, const u8 *src, 337 const u8 *buf, size_t len) 338{ 339 return 0; 340} 341static inline void eapol_sm_notify_tx_eapol_key(struct eapol_sm *sm) 342{ 343} 344static inline void eapol_sm_notify_portEnabled(struct eapol_sm *sm, 345 Boolean enabled) 346{ 347} 348static inline void eapol_sm_notify_portValid(struct eapol_sm *sm, 349 Boolean valid) 350{ 351} 352static inline void eapol_sm_notify_eap_success(struct eapol_sm *sm, 353 Boolean success) 354{ 355} 356static inline void eapol_sm_notify_eap_fail(struct eapol_sm *sm, Boolean fail) 357{ 358} 359static inline void eapol_sm_notify_config(struct eapol_sm *sm, 360 struct eap_peer_config *config, 361 struct eapol_config *conf) 362{ 363} 364static inline int eapol_sm_get_key(struct eapol_sm *sm, u8 *key, size_t len) 365{ 366 return -1; 367} 368static inline void eapol_sm_notify_logoff(struct eapol_sm *sm, Boolean logoff) 369{ 370} 371static inline void eapol_sm_notify_cached(struct eapol_sm *sm) 372{ 373} 374#define eapol_sm_notify_pmkid_attempt(sm, attempt) do { } while (0) 375#define eapol_sm_register_scard_ctx(sm, ctx) do { } while (0) 376static inline void eapol_sm_notify_portControl(struct eapol_sm *sm, 377 PortControl portControl) 378{ 379} 380static inline void eapol_sm_notify_ctrl_attached(struct eapol_sm *sm) 381{ 382} 383static inline void eapol_sm_notify_ctrl_response(struct eapol_sm *sm) 384{ 385} 386static inline void eapol_sm_request_reauth(struct eapol_sm *sm) 387{ 388} 389static inline void eapol_sm_notify_lower_layer_success(struct eapol_sm *sm, 390 int in_eapol_sm) 391{ 392} 393static inline void eapol_sm_invalidate_cached_session(struct eapol_sm *sm) 394{ 395} 396static inline const char * eapol_sm_get_method_name(struct eapol_sm *sm) 397{ 398 return NULL; 399} 400static inline void eapol_sm_set_ext_pw_ctx(struct eapol_sm *sm, 401 struct ext_password_data *ext) 402{ 403} 404static inline int eapol_sm_failed(struct eapol_sm *sm) 405{ 406 return 0; 407} 408#endif /* IEEE8021X_EAPOL */ 409 410#endif /* EAPOL_SUPP_SM_H */ 411