eap.c revision a54fa5fb807eaeff45464139b5a7759f060cec68
1/* 2 * EAP peer state machines (RFC 4137) 3 * Copyright (c) 2004-2012, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 * 8 * This file implements the Peer State Machine as defined in RFC 4137. The used 9 * states and state transitions match mostly with the RFC. However, there are 10 * couple of additional transitions for working around small issues noticed 11 * during testing. These exceptions are explained in comments within the 12 * functions in this file. The method functions, m.func(), are similar to the 13 * ones used in RFC 4137, but some small changes have used here to optimize 14 * operations and to add functionality needed for fast re-authentication 15 * (session resumption). 16 */ 17 18#include "includes.h" 19 20#include "common.h" 21#include "pcsc_funcs.h" 22#include "state_machine.h" 23#include "ext_password.h" 24#include "crypto/crypto.h" 25#include "crypto/tls.h" 26#include "common/wpa_ctrl.h" 27#include "eap_common/eap_wsc_common.h" 28#include "eap_i.h" 29#include "eap_config.h" 30 31#define STATE_MACHINE_DATA struct eap_sm 32#define STATE_MACHINE_DEBUG_PREFIX "EAP" 33 34#define EAP_MAX_AUTH_ROUNDS 50 35#define EAP_CLIENT_TIMEOUT_DEFAULT 60 36 37 38static Boolean eap_sm_allowMethod(struct eap_sm *sm, int vendor, 39 EapType method); 40static struct wpabuf * eap_sm_buildNak(struct eap_sm *sm, int id); 41static void eap_sm_processIdentity(struct eap_sm *sm, 42 const struct wpabuf *req); 43static void eap_sm_processNotify(struct eap_sm *sm, const struct wpabuf *req); 44static struct wpabuf * eap_sm_buildNotify(int id); 45static void eap_sm_parseEapReq(struct eap_sm *sm, const struct wpabuf *req); 46#if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG) 47static const char * eap_sm_method_state_txt(EapMethodState state); 48static const char * eap_sm_decision_txt(EapDecision decision); 49#endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */ 50 51 52 53static Boolean eapol_get_bool(struct eap_sm *sm, enum eapol_bool_var var) 54{ 55 return sm->eapol_cb->get_bool(sm->eapol_ctx, var); 56} 57 58 59static void eapol_set_bool(struct eap_sm *sm, enum eapol_bool_var var, 60 Boolean value) 61{ 62 sm->eapol_cb->set_bool(sm->eapol_ctx, var, value); 63} 64 65 66static unsigned int eapol_get_int(struct eap_sm *sm, enum eapol_int_var var) 67{ 68 return sm->eapol_cb->get_int(sm->eapol_ctx, var); 69} 70 71 72static void eapol_set_int(struct eap_sm *sm, enum eapol_int_var var, 73 unsigned int value) 74{ 75 sm->eapol_cb->set_int(sm->eapol_ctx, var, value); 76} 77 78 79static struct wpabuf * eapol_get_eapReqData(struct eap_sm *sm) 80{ 81 return sm->eapol_cb->get_eapReqData(sm->eapol_ctx); 82} 83 84 85static void eap_notify_status(struct eap_sm *sm, const char *status, 86 const char *parameter) 87{ 88 wpa_printf(MSG_DEBUG, "EAP: Status notification: %s (param=%s)", 89 status, parameter); 90 if (sm->eapol_cb->notify_status) 91 sm->eapol_cb->notify_status(sm->eapol_ctx, status, parameter); 92} 93 94 95static void eap_deinit_prev_method(struct eap_sm *sm, const char *txt) 96{ 97 ext_password_free(sm->ext_pw_buf); 98 sm->ext_pw_buf = NULL; 99 100 if (sm->m == NULL || sm->eap_method_priv == NULL) 101 return; 102 103 wpa_printf(MSG_DEBUG, "EAP: deinitialize previously used EAP method " 104 "(%d, %s) at %s", sm->selectedMethod, sm->m->name, txt); 105 sm->m->deinit(sm, sm->eap_method_priv); 106 sm->eap_method_priv = NULL; 107 sm->m = NULL; 108} 109 110 111/** 112 * eap_allowed_method - Check whether EAP method is allowed 113 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 114 * @vendor: Vendor-Id for expanded types or 0 = IETF for legacy types 115 * @method: EAP type 116 * Returns: 1 = allowed EAP method, 0 = not allowed 117 */ 118int eap_allowed_method(struct eap_sm *sm, int vendor, u32 method) 119{ 120 struct eap_peer_config *config = eap_get_config(sm); 121 int i; 122 struct eap_method_type *m; 123 124 if (config == NULL || config->eap_methods == NULL) 125 return 1; 126 127 m = config->eap_methods; 128 for (i = 0; m[i].vendor != EAP_VENDOR_IETF || 129 m[i].method != EAP_TYPE_NONE; i++) { 130 if (m[i].vendor == vendor && m[i].method == method) 131 return 1; 132 } 133 return 0; 134} 135 136 137/* 138 * This state initializes state machine variables when the machine is 139 * activated (portEnabled = TRUE). This is also used when re-starting 140 * authentication (eapRestart == TRUE). 141 */ 142SM_STATE(EAP, INITIALIZE) 143{ 144 SM_ENTRY(EAP, INITIALIZE); 145 if (sm->fast_reauth && sm->m && sm->m->has_reauth_data && 146 sm->m->has_reauth_data(sm, sm->eap_method_priv) && 147 !sm->prev_failure) { 148 wpa_printf(MSG_DEBUG, "EAP: maintaining EAP method data for " 149 "fast reauthentication"); 150 sm->m->deinit_for_reauth(sm, sm->eap_method_priv); 151 } else { 152 eap_deinit_prev_method(sm, "INITIALIZE"); 153 } 154 sm->selectedMethod = EAP_TYPE_NONE; 155 sm->methodState = METHOD_NONE; 156 sm->allowNotifications = TRUE; 157 sm->decision = DECISION_FAIL; 158 sm->ClientTimeout = EAP_CLIENT_TIMEOUT_DEFAULT; 159 eapol_set_int(sm, EAPOL_idleWhile, sm->ClientTimeout); 160 eapol_set_bool(sm, EAPOL_eapSuccess, FALSE); 161 eapol_set_bool(sm, EAPOL_eapFail, FALSE); 162 os_free(sm->eapKeyData); 163 sm->eapKeyData = NULL; 164 sm->eapKeyAvailable = FALSE; 165 eapol_set_bool(sm, EAPOL_eapRestart, FALSE); 166 sm->lastId = -1; /* new session - make sure this does not match with 167 * the first EAP-Packet */ 168 /* 169 * RFC 4137 does not reset eapResp and eapNoResp here. However, this 170 * seemed to be able to trigger cases where both were set and if EAPOL 171 * state machine uses eapNoResp first, it may end up not sending a real 172 * reply correctly. This occurred when the workaround in FAIL state set 173 * eapNoResp = TRUE.. Maybe that workaround needs to be fixed to do 174 * something else(?) 175 */ 176 eapol_set_bool(sm, EAPOL_eapResp, FALSE); 177 eapol_set_bool(sm, EAPOL_eapNoResp, FALSE); 178 sm->num_rounds = 0; 179 sm->prev_failure = 0; 180} 181 182 183/* 184 * This state is reached whenever service from the lower layer is interrupted 185 * or unavailable (portEnabled == FALSE). Immediate transition to INITIALIZE 186 * occurs when the port becomes enabled. 187 */ 188SM_STATE(EAP, DISABLED) 189{ 190 SM_ENTRY(EAP, DISABLED); 191 sm->num_rounds = 0; 192 /* 193 * RFC 4137 does not describe clearing of idleWhile here, but doing so 194 * allows the timer tick to be stopped more quickly when EAP is not in 195 * use. 196 */ 197 eapol_set_int(sm, EAPOL_idleWhile, 0); 198} 199 200 201/* 202 * The state machine spends most of its time here, waiting for something to 203 * happen. This state is entered unconditionally from INITIALIZE, DISCARD, and 204 * SEND_RESPONSE states. 205 */ 206SM_STATE(EAP, IDLE) 207{ 208 SM_ENTRY(EAP, IDLE); 209} 210 211 212/* 213 * This state is entered when an EAP packet is received (eapReq == TRUE) to 214 * parse the packet header. 215 */ 216SM_STATE(EAP, RECEIVED) 217{ 218 const struct wpabuf *eapReqData; 219 220 SM_ENTRY(EAP, RECEIVED); 221 eapReqData = eapol_get_eapReqData(sm); 222 /* parse rxReq, rxSuccess, rxFailure, reqId, reqMethod */ 223 eap_sm_parseEapReq(sm, eapReqData); 224 sm->num_rounds++; 225} 226 227 228/* 229 * This state is entered when a request for a new type comes in. Either the 230 * correct method is started, or a Nak response is built. 231 */ 232SM_STATE(EAP, GET_METHOD) 233{ 234 int reinit; 235 EapType method; 236 const struct eap_method *eap_method; 237 238 SM_ENTRY(EAP, GET_METHOD); 239 240 if (sm->reqMethod == EAP_TYPE_EXPANDED) 241 method = sm->reqVendorMethod; 242 else 243 method = sm->reqMethod; 244 245 eap_method = eap_peer_get_eap_method(sm->reqVendor, method); 246 247 if (!eap_sm_allowMethod(sm, sm->reqVendor, method)) { 248 wpa_printf(MSG_DEBUG, "EAP: vendor %u method %u not allowed", 249 sm->reqVendor, method); 250 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_PROPOSED_METHOD 251 "vendor=%u method=%u -> NAK", 252 sm->reqVendor, method); 253 eap_notify_status(sm, "refuse proposed method", 254 eap_method ? eap_method->name : "unknown"); 255 goto nak; 256 } 257 258 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_PROPOSED_METHOD 259 "vendor=%u method=%u", sm->reqVendor, method); 260 261 eap_notify_status(sm, "accept proposed method", 262 eap_method ? eap_method->name : "unknown"); 263 /* 264 * RFC 4137 does not define specific operation for fast 265 * re-authentication (session resumption). The design here is to allow 266 * the previously used method data to be maintained for 267 * re-authentication if the method support session resumption. 268 * Otherwise, the previously used method data is freed and a new method 269 * is allocated here. 270 */ 271 if (sm->fast_reauth && 272 sm->m && sm->m->vendor == sm->reqVendor && 273 sm->m->method == method && 274 sm->m->has_reauth_data && 275 sm->m->has_reauth_data(sm, sm->eap_method_priv)) { 276 wpa_printf(MSG_DEBUG, "EAP: Using previous method data" 277 " for fast re-authentication"); 278 reinit = 1; 279 } else { 280 eap_deinit_prev_method(sm, "GET_METHOD"); 281 reinit = 0; 282 } 283 284 sm->selectedMethod = sm->reqMethod; 285 if (sm->m == NULL) 286 sm->m = eap_method; 287 if (!sm->m) { 288 wpa_printf(MSG_DEBUG, "EAP: Could not find selected method: " 289 "vendor %d method %d", 290 sm->reqVendor, method); 291 goto nak; 292 } 293 294 sm->ClientTimeout = EAP_CLIENT_TIMEOUT_DEFAULT; 295 296 wpa_printf(MSG_DEBUG, "EAP: Initialize selected EAP method: " 297 "vendor %u method %u (%s)", 298 sm->reqVendor, method, sm->m->name); 299 if (reinit) 300 sm->eap_method_priv = sm->m->init_for_reauth( 301 sm, sm->eap_method_priv); 302 else 303 sm->eap_method_priv = sm->m->init(sm); 304 305 if (sm->eap_method_priv == NULL) { 306 struct eap_peer_config *config = eap_get_config(sm); 307 wpa_msg(sm->msg_ctx, MSG_INFO, 308 "EAP: Failed to initialize EAP method: vendor %u " 309 "method %u (%s)", 310 sm->reqVendor, method, sm->m->name); 311 sm->m = NULL; 312 sm->methodState = METHOD_NONE; 313 sm->selectedMethod = EAP_TYPE_NONE; 314 if (sm->reqMethod == EAP_TYPE_TLS && config && 315 (config->pending_req_pin || 316 config->pending_req_passphrase)) { 317 /* 318 * Return without generating Nak in order to allow 319 * entering of PIN code or passphrase to retry the 320 * current EAP packet. 321 */ 322 wpa_printf(MSG_DEBUG, "EAP: Pending PIN/passphrase " 323 "request - skip Nak"); 324 return; 325 } 326 327 goto nak; 328 } 329 330 sm->methodState = METHOD_INIT; 331 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_METHOD 332 "EAP vendor %u method %u (%s) selected", 333 sm->reqVendor, method, sm->m->name); 334 return; 335 336nak: 337 wpabuf_free(sm->eapRespData); 338 sm->eapRespData = NULL; 339 sm->eapRespData = eap_sm_buildNak(sm, sm->reqId); 340} 341 342 343/* 344 * The method processing happens here. The request from the authenticator is 345 * processed, and an appropriate response packet is built. 346 */ 347SM_STATE(EAP, METHOD) 348{ 349 struct wpabuf *eapReqData; 350 struct eap_method_ret ret; 351 int min_len = 1; 352 353 SM_ENTRY(EAP, METHOD); 354 if (sm->m == NULL) { 355 wpa_printf(MSG_WARNING, "EAP::METHOD - method not selected"); 356 return; 357 } 358 359 eapReqData = eapol_get_eapReqData(sm); 360 if (sm->m->vendor == EAP_VENDOR_IETF && sm->m->method == EAP_TYPE_LEAP) 361 min_len = 0; /* LEAP uses EAP-Success without payload */ 362 if (!eap_hdr_len_valid(eapReqData, min_len)) 363 return; 364 365 /* 366 * Get ignore, methodState, decision, allowNotifications, and 367 * eapRespData. RFC 4137 uses three separate method procedure (check, 368 * process, and buildResp) in this state. These have been combined into 369 * a single function call to m->process() in order to optimize EAP 370 * method implementation interface a bit. These procedures are only 371 * used from within this METHOD state, so there is no need to keep 372 * these as separate C functions. 373 * 374 * The RFC 4137 procedures return values as follows: 375 * ignore = m.check(eapReqData) 376 * (methodState, decision, allowNotifications) = m.process(eapReqData) 377 * eapRespData = m.buildResp(reqId) 378 */ 379 os_memset(&ret, 0, sizeof(ret)); 380 ret.ignore = sm->ignore; 381 ret.methodState = sm->methodState; 382 ret.decision = sm->decision; 383 ret.allowNotifications = sm->allowNotifications; 384 wpabuf_free(sm->eapRespData); 385 sm->eapRespData = NULL; 386 sm->eapRespData = sm->m->process(sm, sm->eap_method_priv, &ret, 387 eapReqData); 388 wpa_printf(MSG_DEBUG, "EAP: method process -> ignore=%s " 389 "methodState=%s decision=%s", 390 ret.ignore ? "TRUE" : "FALSE", 391 eap_sm_method_state_txt(ret.methodState), 392 eap_sm_decision_txt(ret.decision)); 393 394 sm->ignore = ret.ignore; 395 if (sm->ignore) 396 return; 397 sm->methodState = ret.methodState; 398 sm->decision = ret.decision; 399 sm->allowNotifications = ret.allowNotifications; 400 401 if (sm->m->isKeyAvailable && sm->m->getKey && 402 sm->m->isKeyAvailable(sm, sm->eap_method_priv)) { 403 os_free(sm->eapKeyData); 404 sm->eapKeyData = sm->m->getKey(sm, sm->eap_method_priv, 405 &sm->eapKeyDataLen); 406 } 407} 408 409 410/* 411 * This state signals the lower layer that a response packet is ready to be 412 * sent. 413 */ 414SM_STATE(EAP, SEND_RESPONSE) 415{ 416 SM_ENTRY(EAP, SEND_RESPONSE); 417 wpabuf_free(sm->lastRespData); 418 if (sm->eapRespData) { 419 if (sm->workaround) 420 os_memcpy(sm->last_md5, sm->req_md5, 16); 421 sm->lastId = sm->reqId; 422 sm->lastRespData = wpabuf_dup(sm->eapRespData); 423 eapol_set_bool(sm, EAPOL_eapResp, TRUE); 424 } else 425 sm->lastRespData = NULL; 426 eapol_set_bool(sm, EAPOL_eapReq, FALSE); 427 eapol_set_int(sm, EAPOL_idleWhile, sm->ClientTimeout); 428} 429 430 431/* 432 * This state signals the lower layer that the request was discarded, and no 433 * response packet will be sent at this time. 434 */ 435SM_STATE(EAP, DISCARD) 436{ 437 SM_ENTRY(EAP, DISCARD); 438 eapol_set_bool(sm, EAPOL_eapReq, FALSE); 439 eapol_set_bool(sm, EAPOL_eapNoResp, TRUE); 440} 441 442 443/* 444 * Handles requests for Identity method and builds a response. 445 */ 446SM_STATE(EAP, IDENTITY) 447{ 448 const struct wpabuf *eapReqData; 449 450 SM_ENTRY(EAP, IDENTITY); 451 eapReqData = eapol_get_eapReqData(sm); 452 if (!eap_hdr_len_valid(eapReqData, 1)) 453 return; 454 eap_sm_processIdentity(sm, eapReqData); 455 wpabuf_free(sm->eapRespData); 456 sm->eapRespData = NULL; 457 sm->eapRespData = eap_sm_buildIdentity(sm, sm->reqId, 0); 458} 459 460 461/* 462 * Handles requests for Notification method and builds a response. 463 */ 464SM_STATE(EAP, NOTIFICATION) 465{ 466 const struct wpabuf *eapReqData; 467 468 SM_ENTRY(EAP, NOTIFICATION); 469 eapReqData = eapol_get_eapReqData(sm); 470 if (!eap_hdr_len_valid(eapReqData, 1)) 471 return; 472 eap_sm_processNotify(sm, eapReqData); 473 wpabuf_free(sm->eapRespData); 474 sm->eapRespData = NULL; 475 sm->eapRespData = eap_sm_buildNotify(sm->reqId); 476} 477 478 479/* 480 * This state retransmits the previous response packet. 481 */ 482SM_STATE(EAP, RETRANSMIT) 483{ 484 SM_ENTRY(EAP, RETRANSMIT); 485 wpabuf_free(sm->eapRespData); 486 if (sm->lastRespData) 487 sm->eapRespData = wpabuf_dup(sm->lastRespData); 488 else 489 sm->eapRespData = NULL; 490} 491 492 493/* 494 * This state is entered in case of a successful completion of authentication 495 * and state machine waits here until port is disabled or EAP authentication is 496 * restarted. 497 */ 498SM_STATE(EAP, SUCCESS) 499{ 500 SM_ENTRY(EAP, SUCCESS); 501 if (sm->eapKeyData != NULL) 502 sm->eapKeyAvailable = TRUE; 503 eapol_set_bool(sm, EAPOL_eapSuccess, TRUE); 504 505 /* 506 * RFC 4137 does not clear eapReq here, but this seems to be required 507 * to avoid processing the same request twice when state machine is 508 * initialized. 509 */ 510 eapol_set_bool(sm, EAPOL_eapReq, FALSE); 511 512 /* 513 * RFC 4137 does not set eapNoResp here, but this seems to be required 514 * to get EAPOL Supplicant backend state machine into SUCCESS state. In 515 * addition, either eapResp or eapNoResp is required to be set after 516 * processing the received EAP frame. 517 */ 518 eapol_set_bool(sm, EAPOL_eapNoResp, TRUE); 519 520 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_SUCCESS 521 "EAP authentication completed successfully"); 522} 523 524 525/* 526 * This state is entered in case of a failure and state machine waits here 527 * until port is disabled or EAP authentication is restarted. 528 */ 529SM_STATE(EAP, FAILURE) 530{ 531 SM_ENTRY(EAP, FAILURE); 532 eapol_set_bool(sm, EAPOL_eapFail, TRUE); 533 534 /* 535 * RFC 4137 does not clear eapReq here, but this seems to be required 536 * to avoid processing the same request twice when state machine is 537 * initialized. 538 */ 539 eapol_set_bool(sm, EAPOL_eapReq, FALSE); 540 541 /* 542 * RFC 4137 does not set eapNoResp here. However, either eapResp or 543 * eapNoResp is required to be set after processing the received EAP 544 * frame. 545 */ 546 eapol_set_bool(sm, EAPOL_eapNoResp, TRUE); 547 548 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_FAILURE 549 "EAP authentication failed"); 550 551 sm->prev_failure = 1; 552} 553 554 555static int eap_success_workaround(struct eap_sm *sm, int reqId, int lastId) 556{ 557 /* 558 * At least Microsoft IAS and Meetinghouse Aegis seem to be sending 559 * EAP-Success/Failure with lastId + 1 even though RFC 3748 and 560 * RFC 4137 require that reqId == lastId. In addition, it looks like 561 * Ringmaster v2.1.2.0 would be using lastId + 2 in EAP-Success. 562 * 563 * Accept this kind of Id if EAP workarounds are enabled. These are 564 * unauthenticated plaintext messages, so this should have minimal 565 * security implications (bit easier to fake EAP-Success/Failure). 566 */ 567 if (sm->workaround && (reqId == ((lastId + 1) & 0xff) || 568 reqId == ((lastId + 2) & 0xff))) { 569 wpa_printf(MSG_DEBUG, "EAP: Workaround for unexpected " 570 "identifier field in EAP Success: " 571 "reqId=%d lastId=%d (these are supposed to be " 572 "same)", reqId, lastId); 573 return 1; 574 } 575 wpa_printf(MSG_DEBUG, "EAP: EAP-Success Id mismatch - reqId=%d " 576 "lastId=%d", reqId, lastId); 577 return 0; 578} 579 580 581/* 582 * RFC 4137 - Appendix A.1: EAP Peer State Machine - State transitions 583 */ 584 585static void eap_peer_sm_step_idle(struct eap_sm *sm) 586{ 587 /* 588 * The first three transitions are from RFC 4137. The last two are 589 * local additions to handle special cases with LEAP and PEAP server 590 * not sending EAP-Success in some cases. 591 */ 592 if (eapol_get_bool(sm, EAPOL_eapReq)) 593 SM_ENTER(EAP, RECEIVED); 594 else if ((eapol_get_bool(sm, EAPOL_altAccept) && 595 sm->decision != DECISION_FAIL) || 596 (eapol_get_int(sm, EAPOL_idleWhile) == 0 && 597 sm->decision == DECISION_UNCOND_SUCC)) 598 SM_ENTER(EAP, SUCCESS); 599 else if (eapol_get_bool(sm, EAPOL_altReject) || 600 (eapol_get_int(sm, EAPOL_idleWhile) == 0 && 601 sm->decision != DECISION_UNCOND_SUCC) || 602 (eapol_get_bool(sm, EAPOL_altAccept) && 603 sm->methodState != METHOD_CONT && 604 sm->decision == DECISION_FAIL)) 605 SM_ENTER(EAP, FAILURE); 606 else if (sm->selectedMethod == EAP_TYPE_LEAP && 607 sm->leap_done && sm->decision != DECISION_FAIL && 608 sm->methodState == METHOD_DONE) 609 SM_ENTER(EAP, SUCCESS); 610 else if (sm->selectedMethod == EAP_TYPE_PEAP && 611 sm->peap_done && sm->decision != DECISION_FAIL && 612 sm->methodState == METHOD_DONE) 613 SM_ENTER(EAP, SUCCESS); 614} 615 616 617static int eap_peer_req_is_duplicate(struct eap_sm *sm) 618{ 619 int duplicate; 620 621 duplicate = (sm->reqId == sm->lastId) && sm->rxReq; 622 if (sm->workaround && duplicate && 623 os_memcmp(sm->req_md5, sm->last_md5, 16) != 0) { 624 /* 625 * RFC 4137 uses (reqId == lastId) as the only verification for 626 * duplicate EAP requests. However, this misses cases where the 627 * AS is incorrectly using the same id again; and 628 * unfortunately, such implementations exist. Use MD5 hash as 629 * an extra verification for the packets being duplicate to 630 * workaround these issues. 631 */ 632 wpa_printf(MSG_DEBUG, "EAP: AS used the same Id again, but " 633 "EAP packets were not identical"); 634 wpa_printf(MSG_DEBUG, "EAP: workaround - assume this is not a " 635 "duplicate packet"); 636 duplicate = 0; 637 } 638 639 return duplicate; 640} 641 642 643static void eap_peer_sm_step_received(struct eap_sm *sm) 644{ 645 int duplicate = eap_peer_req_is_duplicate(sm); 646 647 /* 648 * Two special cases below for LEAP are local additions to work around 649 * odd LEAP behavior (EAP-Success in the middle of authentication and 650 * then swapped roles). Other transitions are based on RFC 4137. 651 */ 652 if (sm->rxSuccess && sm->decision != DECISION_FAIL && 653 (sm->reqId == sm->lastId || 654 eap_success_workaround(sm, sm->reqId, sm->lastId))) 655 SM_ENTER(EAP, SUCCESS); 656 else if (sm->methodState != METHOD_CONT && 657 ((sm->rxFailure && 658 sm->decision != DECISION_UNCOND_SUCC) || 659 (sm->rxSuccess && sm->decision == DECISION_FAIL && 660 (sm->selectedMethod != EAP_TYPE_LEAP || 661 sm->methodState != METHOD_MAY_CONT))) && 662 (sm->reqId == sm->lastId || 663 eap_success_workaround(sm, sm->reqId, sm->lastId))) 664 SM_ENTER(EAP, FAILURE); 665 else if (sm->rxReq && duplicate) 666 SM_ENTER(EAP, RETRANSMIT); 667 else if (sm->rxReq && !duplicate && 668 sm->reqMethod == EAP_TYPE_NOTIFICATION && 669 sm->allowNotifications) 670 SM_ENTER(EAP, NOTIFICATION); 671 else if (sm->rxReq && !duplicate && 672 sm->selectedMethod == EAP_TYPE_NONE && 673 sm->reqMethod == EAP_TYPE_IDENTITY) 674 SM_ENTER(EAP, IDENTITY); 675 else if (sm->rxReq && !duplicate && 676 sm->selectedMethod == EAP_TYPE_NONE && 677 sm->reqMethod != EAP_TYPE_IDENTITY && 678 sm->reqMethod != EAP_TYPE_NOTIFICATION) 679 SM_ENTER(EAP, GET_METHOD); 680 else if (sm->rxReq && !duplicate && 681 sm->reqMethod == sm->selectedMethod && 682 sm->methodState != METHOD_DONE) 683 SM_ENTER(EAP, METHOD); 684 else if (sm->selectedMethod == EAP_TYPE_LEAP && 685 (sm->rxSuccess || sm->rxResp)) 686 SM_ENTER(EAP, METHOD); 687 else 688 SM_ENTER(EAP, DISCARD); 689} 690 691 692static void eap_peer_sm_step_local(struct eap_sm *sm) 693{ 694 switch (sm->EAP_state) { 695 case EAP_INITIALIZE: 696 SM_ENTER(EAP, IDLE); 697 break; 698 case EAP_DISABLED: 699 if (eapol_get_bool(sm, EAPOL_portEnabled) && 700 !sm->force_disabled) 701 SM_ENTER(EAP, INITIALIZE); 702 break; 703 case EAP_IDLE: 704 eap_peer_sm_step_idle(sm); 705 break; 706 case EAP_RECEIVED: 707 eap_peer_sm_step_received(sm); 708 break; 709 case EAP_GET_METHOD: 710 if (sm->selectedMethod == sm->reqMethod) 711 SM_ENTER(EAP, METHOD); 712 else 713 SM_ENTER(EAP, SEND_RESPONSE); 714 break; 715 case EAP_METHOD: 716 if (sm->ignore) 717 SM_ENTER(EAP, DISCARD); 718 else 719 SM_ENTER(EAP, SEND_RESPONSE); 720 break; 721 case EAP_SEND_RESPONSE: 722 SM_ENTER(EAP, IDLE); 723 break; 724 case EAP_DISCARD: 725 SM_ENTER(EAP, IDLE); 726 break; 727 case EAP_IDENTITY: 728 SM_ENTER(EAP, SEND_RESPONSE); 729 break; 730 case EAP_NOTIFICATION: 731 SM_ENTER(EAP, SEND_RESPONSE); 732 break; 733 case EAP_RETRANSMIT: 734 SM_ENTER(EAP, SEND_RESPONSE); 735 break; 736 case EAP_SUCCESS: 737 break; 738 case EAP_FAILURE: 739 break; 740 } 741} 742 743 744SM_STEP(EAP) 745{ 746 /* Global transitions */ 747 if (eapol_get_bool(sm, EAPOL_eapRestart) && 748 eapol_get_bool(sm, EAPOL_portEnabled)) 749 SM_ENTER_GLOBAL(EAP, INITIALIZE); 750 else if (!eapol_get_bool(sm, EAPOL_portEnabled) || sm->force_disabled) 751 SM_ENTER_GLOBAL(EAP, DISABLED); 752 else if (sm->num_rounds > EAP_MAX_AUTH_ROUNDS) { 753 /* RFC 4137 does not place any limit on number of EAP messages 754 * in an authentication session. However, some error cases have 755 * ended up in a state were EAP messages were sent between the 756 * peer and server in a loop (e.g., TLS ACK frame in both 757 * direction). Since this is quite undesired outcome, limit the 758 * total number of EAP round-trips and abort authentication if 759 * this limit is exceeded. 760 */ 761 if (sm->num_rounds == EAP_MAX_AUTH_ROUNDS + 1) { 762 wpa_msg(sm->msg_ctx, MSG_INFO, "EAP: more than %d " 763 "authentication rounds - abort", 764 EAP_MAX_AUTH_ROUNDS); 765 sm->num_rounds++; 766 SM_ENTER_GLOBAL(EAP, FAILURE); 767 } 768 } else { 769 /* Local transitions */ 770 eap_peer_sm_step_local(sm); 771 } 772} 773 774 775static Boolean eap_sm_allowMethod(struct eap_sm *sm, int vendor, 776 EapType method) 777{ 778 if (!eap_allowed_method(sm, vendor, method)) { 779 wpa_printf(MSG_DEBUG, "EAP: configuration does not allow: " 780 "vendor %u method %u", vendor, method); 781 return FALSE; 782 } 783 if (eap_peer_get_eap_method(vendor, method)) 784 return TRUE; 785 wpa_printf(MSG_DEBUG, "EAP: not included in build: " 786 "vendor %u method %u", vendor, method); 787 return FALSE; 788} 789 790 791static struct wpabuf * eap_sm_build_expanded_nak( 792 struct eap_sm *sm, int id, const struct eap_method *methods, 793 size_t count) 794{ 795 struct wpabuf *resp; 796 int found = 0; 797 const struct eap_method *m; 798 799 wpa_printf(MSG_DEBUG, "EAP: Building expanded EAP-Nak"); 800 801 /* RFC 3748 - 5.3.2: Expanded Nak */ 802 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_EXPANDED, 803 8 + 8 * (count + 1), EAP_CODE_RESPONSE, id); 804 if (resp == NULL) 805 return NULL; 806 807 wpabuf_put_be24(resp, EAP_VENDOR_IETF); 808 wpabuf_put_be32(resp, EAP_TYPE_NAK); 809 810 for (m = methods; m; m = m->next) { 811 if (sm->reqVendor == m->vendor && 812 sm->reqVendorMethod == m->method) 813 continue; /* do not allow the current method again */ 814 if (eap_allowed_method(sm, m->vendor, m->method)) { 815 wpa_printf(MSG_DEBUG, "EAP: allowed type: " 816 "vendor=%u method=%u", 817 m->vendor, m->method); 818 wpabuf_put_u8(resp, EAP_TYPE_EXPANDED); 819 wpabuf_put_be24(resp, m->vendor); 820 wpabuf_put_be32(resp, m->method); 821 822 found++; 823 } 824 } 825 if (!found) { 826 wpa_printf(MSG_DEBUG, "EAP: no more allowed methods"); 827 wpabuf_put_u8(resp, EAP_TYPE_EXPANDED); 828 wpabuf_put_be24(resp, EAP_VENDOR_IETF); 829 wpabuf_put_be32(resp, EAP_TYPE_NONE); 830 } 831 832 eap_update_len(resp); 833 834 return resp; 835} 836 837 838static struct wpabuf * eap_sm_buildNak(struct eap_sm *sm, int id) 839{ 840 struct wpabuf *resp; 841 u8 *start; 842 int found = 0, expanded_found = 0; 843 size_t count; 844 const struct eap_method *methods, *m; 845 846 wpa_printf(MSG_DEBUG, "EAP: Building EAP-Nak (requested type %u " 847 "vendor=%u method=%u not allowed)", sm->reqMethod, 848 sm->reqVendor, sm->reqVendorMethod); 849 methods = eap_peer_get_methods(&count); 850 if (methods == NULL) 851 return NULL; 852 if (sm->reqMethod == EAP_TYPE_EXPANDED) 853 return eap_sm_build_expanded_nak(sm, id, methods, count); 854 855 /* RFC 3748 - 5.3.1: Legacy Nak */ 856 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_NAK, 857 sizeof(struct eap_hdr) + 1 + count + 1, 858 EAP_CODE_RESPONSE, id); 859 if (resp == NULL) 860 return NULL; 861 862 start = wpabuf_put(resp, 0); 863 for (m = methods; m; m = m->next) { 864 if (m->vendor == EAP_VENDOR_IETF && m->method == sm->reqMethod) 865 continue; /* do not allow the current method again */ 866 if (eap_allowed_method(sm, m->vendor, m->method)) { 867 if (m->vendor != EAP_VENDOR_IETF) { 868 if (expanded_found) 869 continue; 870 expanded_found = 1; 871 wpabuf_put_u8(resp, EAP_TYPE_EXPANDED); 872 } else 873 wpabuf_put_u8(resp, m->method); 874 found++; 875 } 876 } 877 if (!found) 878 wpabuf_put_u8(resp, EAP_TYPE_NONE); 879 wpa_hexdump(MSG_DEBUG, "EAP: allowed methods", start, found); 880 881 eap_update_len(resp); 882 883 return resp; 884} 885 886 887static void eap_sm_processIdentity(struct eap_sm *sm, const struct wpabuf *req) 888{ 889 const u8 *pos; 890 size_t msg_len; 891 892 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_STARTED 893 "EAP authentication started"); 894 eap_notify_status(sm, "started", ""); 895 896 pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_IDENTITY, req, 897 &msg_len); 898 if (pos == NULL) 899 return; 900 901 /* 902 * RFC 3748 - 5.1: Identity 903 * Data field may contain a displayable message in UTF-8. If this 904 * includes NUL-character, only the data before that should be 905 * displayed. Some EAP implementasitons may piggy-back additional 906 * options after the NUL. 907 */ 908 /* TODO: could save displayable message so that it can be shown to the 909 * user in case of interaction is required */ 910 wpa_hexdump_ascii(MSG_DEBUG, "EAP: EAP-Request Identity data", 911 pos, msg_len); 912} 913 914 915#ifdef PCSC_FUNCS 916 917/* 918 * Rules for figuring out MNC length based on IMSI for SIM cards that do not 919 * include MNC length field. 920 */ 921static int mnc_len_from_imsi(const char *imsi) 922{ 923 char mcc_str[4]; 924 unsigned int mcc; 925 926 os_memcpy(mcc_str, imsi, 3); 927 mcc_str[3] = '\0'; 928 mcc = atoi(mcc_str); 929 930 if (mcc == 244) 931 return 2; /* Networks in Finland use 2-digit MNC */ 932 933 return -1; 934} 935 936 937static int eap_sm_append_3gpp_realm(struct eap_sm *sm, char *imsi, 938 size_t max_len, size_t *imsi_len) 939{ 940 int mnc_len; 941 char *pos, mnc[4]; 942 943 if (*imsi_len + 36 > max_len) { 944 wpa_printf(MSG_WARNING, "No room for realm in IMSI buffer"); 945 return -1; 946 } 947 948 /* MNC (2 or 3 digits) */ 949 mnc_len = scard_get_mnc_len(sm->scard_ctx); 950 if (mnc_len < 0) 951 mnc_len = mnc_len_from_imsi(imsi); 952 if (mnc_len < 0) { 953 wpa_printf(MSG_INFO, "Failed to get MNC length from (U)SIM " 954 "assuming 3"); 955 mnc_len = 3; 956 } 957 958 if (mnc_len == 2) { 959 mnc[0] = '0'; 960 mnc[1] = imsi[3]; 961 mnc[2] = imsi[4]; 962 } else if (mnc_len == 3) { 963 mnc[0] = imsi[3]; 964 mnc[1] = imsi[4]; 965 mnc[2] = imsi[5]; 966 } 967 mnc[3] = '\0'; 968 969 pos = imsi + *imsi_len; 970 pos += os_snprintf(pos, imsi + max_len - pos, 971 "@wlan.mnc%s.mcc%c%c%c.3gppnetwork.org", 972 mnc, imsi[0], imsi[1], imsi[2]); 973 *imsi_len = pos - imsi; 974 975 return 0; 976} 977 978 979static int eap_sm_imsi_identity(struct eap_sm *sm, 980 struct eap_peer_config *conf) 981{ 982 enum { EAP_SM_SIM, EAP_SM_AKA, EAP_SM_AKA_PRIME } method = EAP_SM_SIM; 983 char imsi[100]; 984 size_t imsi_len; 985 struct eap_method_type *m = conf->eap_methods; 986 int i; 987 988 imsi_len = sizeof(imsi); 989 if (scard_get_imsi(sm->scard_ctx, imsi, &imsi_len)) { 990 wpa_printf(MSG_WARNING, "Failed to get IMSI from SIM"); 991 return -1; 992 } 993 994 wpa_hexdump_ascii(MSG_DEBUG, "IMSI", (u8 *) imsi, imsi_len); 995 996 if (imsi_len < 7) { 997 wpa_printf(MSG_WARNING, "Too short IMSI for SIM identity"); 998 return -1; 999 } 1000 1001 if (eap_sm_append_3gpp_realm(sm, imsi, sizeof(imsi), &imsi_len) < 0) { 1002 wpa_printf(MSG_WARNING, "Could not add realm to SIM identity"); 1003 return -1; 1004 } 1005 wpa_hexdump_ascii(MSG_DEBUG, "IMSI + realm", (u8 *) imsi, imsi_len); 1006 1007 for (i = 0; m && (m[i].vendor != EAP_VENDOR_IETF || 1008 m[i].method != EAP_TYPE_NONE); i++) { 1009 if (m[i].vendor == EAP_VENDOR_IETF && 1010 m[i].method == EAP_TYPE_AKA_PRIME) { 1011 method = EAP_SM_AKA_PRIME; 1012 break; 1013 } 1014 1015 if (m[i].vendor == EAP_VENDOR_IETF && 1016 m[i].method == EAP_TYPE_AKA) { 1017 method = EAP_SM_AKA; 1018 break; 1019 } 1020 } 1021 1022 os_free(conf->identity); 1023 conf->identity = os_malloc(1 + imsi_len); 1024 if (conf->identity == NULL) { 1025 wpa_printf(MSG_WARNING, "Failed to allocate buffer for " 1026 "IMSI-based identity"); 1027 return -1; 1028 } 1029 1030 switch (method) { 1031 case EAP_SM_SIM: 1032 conf->identity[0] = '1'; 1033 break; 1034 case EAP_SM_AKA: 1035 conf->identity[0] = '0'; 1036 break; 1037 case EAP_SM_AKA_PRIME: 1038 conf->identity[0] = '6'; 1039 break; 1040 } 1041 os_memcpy(conf->identity + 1, imsi, imsi_len); 1042 conf->identity_len = 1 + imsi_len; 1043 1044 return 0; 1045} 1046 1047#endif /* PCSC_FUNCS */ 1048 1049 1050static int eap_sm_set_scard_pin(struct eap_sm *sm, 1051 struct eap_peer_config *conf) 1052{ 1053#ifdef PCSC_FUNCS 1054 if (scard_set_pin(sm->scard_ctx, conf->pin)) { 1055 /* 1056 * Make sure the same PIN is not tried again in order to avoid 1057 * blocking SIM. 1058 */ 1059 os_free(conf->pin); 1060 conf->pin = NULL; 1061 1062 wpa_printf(MSG_WARNING, "PIN validation failed"); 1063 eap_sm_request_pin(sm); 1064 return -1; 1065 } 1066 return 0; 1067#else /* PCSC_FUNCS */ 1068 return -1; 1069#endif /* PCSC_FUNCS */ 1070} 1071 1072static int eap_sm_get_scard_identity(struct eap_sm *sm, 1073 struct eap_peer_config *conf) 1074{ 1075#ifdef PCSC_FUNCS 1076 if (eap_sm_set_scard_pin(sm, conf)) 1077 return -1; 1078 1079 return eap_sm_imsi_identity(sm, conf); 1080#else /* PCSC_FUNCS */ 1081 return -1; 1082#endif /* PCSC_FUNCS */ 1083} 1084 1085 1086/** 1087 * eap_sm_buildIdentity - Build EAP-Identity/Response for the current network 1088 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1089 * @id: EAP identifier for the packet 1090 * @encrypted: Whether the packet is for encrypted tunnel (EAP phase 2) 1091 * Returns: Pointer to the allocated EAP-Identity/Response packet or %NULL on 1092 * failure 1093 * 1094 * This function allocates and builds an EAP-Identity/Response packet for the 1095 * current network. The caller is responsible for freeing the returned data. 1096 */ 1097struct wpabuf * eap_sm_buildIdentity(struct eap_sm *sm, int id, int encrypted) 1098{ 1099 struct eap_peer_config *config = eap_get_config(sm); 1100 struct wpabuf *resp; 1101 const u8 *identity; 1102 size_t identity_len; 1103 1104 if (config == NULL) { 1105 wpa_printf(MSG_WARNING, "EAP: buildIdentity: configuration " 1106 "was not available"); 1107 return NULL; 1108 } 1109 1110 if (sm->m && sm->m->get_identity && 1111 (identity = sm->m->get_identity(sm, sm->eap_method_priv, 1112 &identity_len)) != NULL) { 1113 wpa_hexdump_ascii(MSG_DEBUG, "EAP: using method re-auth " 1114 "identity", identity, identity_len); 1115 } else if (!encrypted && config->anonymous_identity) { 1116 identity = config->anonymous_identity; 1117 identity_len = config->anonymous_identity_len; 1118 wpa_hexdump_ascii(MSG_DEBUG, "EAP: using anonymous identity", 1119 identity, identity_len); 1120 } else { 1121 identity = config->identity; 1122 identity_len = config->identity_len; 1123 wpa_hexdump_ascii(MSG_DEBUG, "EAP: using real identity", 1124 identity, identity_len); 1125 } 1126 1127 if (identity == NULL) { 1128 wpa_printf(MSG_WARNING, "EAP: buildIdentity: identity " 1129 "configuration was not available"); 1130 if (config->pcsc) { 1131 if (eap_sm_get_scard_identity(sm, config) < 0) 1132 return NULL; 1133 identity = config->identity; 1134 identity_len = config->identity_len; 1135 wpa_hexdump_ascii(MSG_DEBUG, "permanent identity from " 1136 "IMSI", identity, identity_len); 1137 } else { 1138 eap_sm_request_identity(sm); 1139 return NULL; 1140 } 1141 } else if (config->pcsc) { 1142 if (eap_sm_set_scard_pin(sm, config) < 0) 1143 return NULL; 1144 } 1145 1146 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_IDENTITY, identity_len, 1147 EAP_CODE_RESPONSE, id); 1148 if (resp == NULL) 1149 return NULL; 1150 1151 wpabuf_put_data(resp, identity, identity_len); 1152 1153 return resp; 1154} 1155 1156 1157static void eap_sm_processNotify(struct eap_sm *sm, const struct wpabuf *req) 1158{ 1159 const u8 *pos; 1160 char *msg; 1161 size_t i, msg_len; 1162 1163 pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_NOTIFICATION, req, 1164 &msg_len); 1165 if (pos == NULL) 1166 return; 1167 wpa_hexdump_ascii(MSG_DEBUG, "EAP: EAP-Request Notification data", 1168 pos, msg_len); 1169 1170 msg = os_malloc(msg_len + 1); 1171 if (msg == NULL) 1172 return; 1173 for (i = 0; i < msg_len; i++) 1174 msg[i] = isprint(pos[i]) ? (char) pos[i] : '_'; 1175 msg[msg_len] = '\0'; 1176 wpa_msg(sm->msg_ctx, MSG_INFO, "%s%s", 1177 WPA_EVENT_EAP_NOTIFICATION, msg); 1178 os_free(msg); 1179} 1180 1181 1182static struct wpabuf * eap_sm_buildNotify(int id) 1183{ 1184 struct wpabuf *resp; 1185 1186 wpa_printf(MSG_DEBUG, "EAP: Generating EAP-Response Notification"); 1187 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_NOTIFICATION, 0, 1188 EAP_CODE_RESPONSE, id); 1189 if (resp == NULL) 1190 return NULL; 1191 1192 return resp; 1193} 1194 1195 1196static void eap_sm_parseEapReq(struct eap_sm *sm, const struct wpabuf *req) 1197{ 1198 const struct eap_hdr *hdr; 1199 size_t plen; 1200 const u8 *pos; 1201 1202 sm->rxReq = sm->rxResp = sm->rxSuccess = sm->rxFailure = FALSE; 1203 sm->reqId = 0; 1204 sm->reqMethod = EAP_TYPE_NONE; 1205 sm->reqVendor = EAP_VENDOR_IETF; 1206 sm->reqVendorMethod = EAP_TYPE_NONE; 1207 1208 if (req == NULL || wpabuf_len(req) < sizeof(*hdr)) 1209 return; 1210 1211 hdr = wpabuf_head(req); 1212 plen = be_to_host16(hdr->length); 1213 if (plen > wpabuf_len(req)) { 1214 wpa_printf(MSG_DEBUG, "EAP: Ignored truncated EAP-Packet " 1215 "(len=%lu plen=%lu)", 1216 (unsigned long) wpabuf_len(req), 1217 (unsigned long) plen); 1218 return; 1219 } 1220 1221 sm->reqId = hdr->identifier; 1222 1223 if (sm->workaround) { 1224 const u8 *addr[1]; 1225 addr[0] = wpabuf_head(req); 1226 md5_vector(1, addr, &plen, sm->req_md5); 1227 } 1228 1229 switch (hdr->code) { 1230 case EAP_CODE_REQUEST: 1231 if (plen < sizeof(*hdr) + 1) { 1232 wpa_printf(MSG_DEBUG, "EAP: Too short EAP-Request - " 1233 "no Type field"); 1234 return; 1235 } 1236 sm->rxReq = TRUE; 1237 pos = (const u8 *) (hdr + 1); 1238 sm->reqMethod = *pos++; 1239 if (sm->reqMethod == EAP_TYPE_EXPANDED) { 1240 if (plen < sizeof(*hdr) + 8) { 1241 wpa_printf(MSG_DEBUG, "EAP: Ignored truncated " 1242 "expanded EAP-Packet (plen=%lu)", 1243 (unsigned long) plen); 1244 return; 1245 } 1246 sm->reqVendor = WPA_GET_BE24(pos); 1247 pos += 3; 1248 sm->reqVendorMethod = WPA_GET_BE32(pos); 1249 } 1250 wpa_printf(MSG_DEBUG, "EAP: Received EAP-Request id=%d " 1251 "method=%u vendor=%u vendorMethod=%u", 1252 sm->reqId, sm->reqMethod, sm->reqVendor, 1253 sm->reqVendorMethod); 1254 break; 1255 case EAP_CODE_RESPONSE: 1256 if (sm->selectedMethod == EAP_TYPE_LEAP) { 1257 /* 1258 * LEAP differs from RFC 4137 by using reversed roles 1259 * for mutual authentication and because of this, we 1260 * need to accept EAP-Response frames if LEAP is used. 1261 */ 1262 if (plen < sizeof(*hdr) + 1) { 1263 wpa_printf(MSG_DEBUG, "EAP: Too short " 1264 "EAP-Response - no Type field"); 1265 return; 1266 } 1267 sm->rxResp = TRUE; 1268 pos = (const u8 *) (hdr + 1); 1269 sm->reqMethod = *pos; 1270 wpa_printf(MSG_DEBUG, "EAP: Received EAP-Response for " 1271 "LEAP method=%d id=%d", 1272 sm->reqMethod, sm->reqId); 1273 break; 1274 } 1275 wpa_printf(MSG_DEBUG, "EAP: Ignored EAP-Response"); 1276 break; 1277 case EAP_CODE_SUCCESS: 1278 wpa_printf(MSG_DEBUG, "EAP: Received EAP-Success"); 1279 eap_notify_status(sm, "completion", "success"); 1280 sm->rxSuccess = TRUE; 1281 break; 1282 case EAP_CODE_FAILURE: 1283 wpa_printf(MSG_DEBUG, "EAP: Received EAP-Failure"); 1284 eap_notify_status(sm, "completion", "failure"); 1285 sm->rxFailure = TRUE; 1286 break; 1287 default: 1288 wpa_printf(MSG_DEBUG, "EAP: Ignored EAP-Packet with unknown " 1289 "code %d", hdr->code); 1290 break; 1291 } 1292} 1293 1294 1295static void eap_peer_sm_tls_event(void *ctx, enum tls_event ev, 1296 union tls_event_data *data) 1297{ 1298 struct eap_sm *sm = ctx; 1299 char *hash_hex = NULL; 1300 1301 switch (ev) { 1302 case TLS_CERT_CHAIN_SUCCESS: 1303 eap_notify_status(sm, "remote certificate verification", 1304 "success"); 1305 break; 1306 case TLS_CERT_CHAIN_FAILURE: 1307 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_TLS_CERT_ERROR 1308 "reason=%d depth=%d subject='%s' err='%s'", 1309 data->cert_fail.reason, 1310 data->cert_fail.depth, 1311 data->cert_fail.subject, 1312 data->cert_fail.reason_txt); 1313 eap_notify_status(sm, "remote certificate verification", 1314 data->cert_fail.reason_txt); 1315 break; 1316 case TLS_PEER_CERTIFICATE: 1317 if (!sm->eapol_cb->notify_cert) 1318 break; 1319 1320 if (data->peer_cert.hash) { 1321 size_t len = data->peer_cert.hash_len * 2 + 1; 1322 hash_hex = os_malloc(len); 1323 if (hash_hex) { 1324 wpa_snprintf_hex(hash_hex, len, 1325 data->peer_cert.hash, 1326 data->peer_cert.hash_len); 1327 } 1328 } 1329 1330 sm->eapol_cb->notify_cert(sm->eapol_ctx, 1331 data->peer_cert.depth, 1332 data->peer_cert.subject, 1333 hash_hex, data->peer_cert.cert); 1334 break; 1335 case TLS_ALERT: 1336 if (data->alert.is_local) 1337 eap_notify_status(sm, "local TLS alert", 1338 data->alert.description); 1339 else 1340 eap_notify_status(sm, "remote TLS alert", 1341 data->alert.description); 1342 break; 1343 } 1344 1345 os_free(hash_hex); 1346} 1347 1348 1349/** 1350 * eap_peer_sm_init - Allocate and initialize EAP peer state machine 1351 * @eapol_ctx: Context data to be used with eapol_cb calls 1352 * @eapol_cb: Pointer to EAPOL callback functions 1353 * @msg_ctx: Context data for wpa_msg() calls 1354 * @conf: EAP configuration 1355 * Returns: Pointer to the allocated EAP state machine or %NULL on failure 1356 * 1357 * This function allocates and initializes an EAP state machine. In addition, 1358 * this initializes TLS library for the new EAP state machine. eapol_cb pointer 1359 * will be in use until eap_peer_sm_deinit() is used to deinitialize this EAP 1360 * state machine. Consequently, the caller must make sure that this data 1361 * structure remains alive while the EAP state machine is active. 1362 */ 1363struct eap_sm * eap_peer_sm_init(void *eapol_ctx, 1364 struct eapol_callbacks *eapol_cb, 1365 void *msg_ctx, struct eap_config *conf) 1366{ 1367 struct eap_sm *sm; 1368 struct tls_config tlsconf; 1369 1370 sm = os_zalloc(sizeof(*sm)); 1371 if (sm == NULL) 1372 return NULL; 1373 sm->eapol_ctx = eapol_ctx; 1374 sm->eapol_cb = eapol_cb; 1375 sm->msg_ctx = msg_ctx; 1376 sm->ClientTimeout = EAP_CLIENT_TIMEOUT_DEFAULT; 1377 sm->wps = conf->wps; 1378 1379 os_memset(&tlsconf, 0, sizeof(tlsconf)); 1380 tlsconf.opensc_engine_path = conf->opensc_engine_path; 1381 tlsconf.pkcs11_engine_path = conf->pkcs11_engine_path; 1382 tlsconf.pkcs11_module_path = conf->pkcs11_module_path; 1383#ifdef CONFIG_FIPS 1384 tlsconf.fips_mode = 1; 1385#endif /* CONFIG_FIPS */ 1386 tlsconf.event_cb = eap_peer_sm_tls_event; 1387 tlsconf.cb_ctx = sm; 1388 tlsconf.cert_in_cb = conf->cert_in_cb; 1389 sm->ssl_ctx = tls_init(&tlsconf); 1390 if (sm->ssl_ctx == NULL) { 1391 wpa_printf(MSG_WARNING, "SSL: Failed to initialize TLS " 1392 "context."); 1393 os_free(sm); 1394 return NULL; 1395 } 1396 1397 sm->ssl_ctx2 = tls_init(&tlsconf); 1398 if (sm->ssl_ctx2 == NULL) { 1399 wpa_printf(MSG_INFO, "SSL: Failed to initialize TLS " 1400 "context (2)."); 1401 /* Run without separate TLS context within TLS tunnel */ 1402 } 1403 1404 return sm; 1405} 1406 1407 1408/** 1409 * eap_peer_sm_deinit - Deinitialize and free an EAP peer state machine 1410 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1411 * 1412 * This function deinitializes EAP state machine and frees all allocated 1413 * resources. 1414 */ 1415void eap_peer_sm_deinit(struct eap_sm *sm) 1416{ 1417 if (sm == NULL) 1418 return; 1419 eap_deinit_prev_method(sm, "EAP deinit"); 1420 eap_sm_abort(sm); 1421 if (sm->ssl_ctx2) 1422 tls_deinit(sm->ssl_ctx2); 1423 tls_deinit(sm->ssl_ctx); 1424 os_free(sm); 1425} 1426 1427 1428/** 1429 * eap_peer_sm_step - Step EAP peer state machine 1430 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1431 * Returns: 1 if EAP state was changed or 0 if not 1432 * 1433 * This function advances EAP state machine to a new state to match with the 1434 * current variables. This should be called whenever variables used by the EAP 1435 * state machine have changed. 1436 */ 1437int eap_peer_sm_step(struct eap_sm *sm) 1438{ 1439 int res = 0; 1440 do { 1441 sm->changed = FALSE; 1442 SM_STEP_RUN(EAP); 1443 if (sm->changed) 1444 res = 1; 1445 } while (sm->changed); 1446 return res; 1447} 1448 1449 1450/** 1451 * eap_sm_abort - Abort EAP authentication 1452 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1453 * 1454 * Release system resources that have been allocated for the authentication 1455 * session without fully deinitializing the EAP state machine. 1456 */ 1457void eap_sm_abort(struct eap_sm *sm) 1458{ 1459 wpabuf_free(sm->lastRespData); 1460 sm->lastRespData = NULL; 1461 wpabuf_free(sm->eapRespData); 1462 sm->eapRespData = NULL; 1463 os_free(sm->eapKeyData); 1464 sm->eapKeyData = NULL; 1465 1466 /* This is not clearly specified in the EAP statemachines draft, but 1467 * it seems necessary to make sure that some of the EAPOL variables get 1468 * cleared for the next authentication. */ 1469 eapol_set_bool(sm, EAPOL_eapSuccess, FALSE); 1470} 1471 1472 1473#ifdef CONFIG_CTRL_IFACE 1474static const char * eap_sm_state_txt(int state) 1475{ 1476 switch (state) { 1477 case EAP_INITIALIZE: 1478 return "INITIALIZE"; 1479 case EAP_DISABLED: 1480 return "DISABLED"; 1481 case EAP_IDLE: 1482 return "IDLE"; 1483 case EAP_RECEIVED: 1484 return "RECEIVED"; 1485 case EAP_GET_METHOD: 1486 return "GET_METHOD"; 1487 case EAP_METHOD: 1488 return "METHOD"; 1489 case EAP_SEND_RESPONSE: 1490 return "SEND_RESPONSE"; 1491 case EAP_DISCARD: 1492 return "DISCARD"; 1493 case EAP_IDENTITY: 1494 return "IDENTITY"; 1495 case EAP_NOTIFICATION: 1496 return "NOTIFICATION"; 1497 case EAP_RETRANSMIT: 1498 return "RETRANSMIT"; 1499 case EAP_SUCCESS: 1500 return "SUCCESS"; 1501 case EAP_FAILURE: 1502 return "FAILURE"; 1503 default: 1504 return "UNKNOWN"; 1505 } 1506} 1507#endif /* CONFIG_CTRL_IFACE */ 1508 1509 1510#if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG) 1511static const char * eap_sm_method_state_txt(EapMethodState state) 1512{ 1513 switch (state) { 1514 case METHOD_NONE: 1515 return "NONE"; 1516 case METHOD_INIT: 1517 return "INIT"; 1518 case METHOD_CONT: 1519 return "CONT"; 1520 case METHOD_MAY_CONT: 1521 return "MAY_CONT"; 1522 case METHOD_DONE: 1523 return "DONE"; 1524 default: 1525 return "UNKNOWN"; 1526 } 1527} 1528 1529 1530static const char * eap_sm_decision_txt(EapDecision decision) 1531{ 1532 switch (decision) { 1533 case DECISION_FAIL: 1534 return "FAIL"; 1535 case DECISION_COND_SUCC: 1536 return "COND_SUCC"; 1537 case DECISION_UNCOND_SUCC: 1538 return "UNCOND_SUCC"; 1539 default: 1540 return "UNKNOWN"; 1541 } 1542} 1543#endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */ 1544 1545 1546#ifdef CONFIG_CTRL_IFACE 1547 1548/** 1549 * eap_sm_get_status - Get EAP state machine status 1550 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1551 * @buf: Buffer for status information 1552 * @buflen: Maximum buffer length 1553 * @verbose: Whether to include verbose status information 1554 * Returns: Number of bytes written to buf. 1555 * 1556 * Query EAP state machine for status information. This function fills in a 1557 * text area with current status information from the EAPOL state machine. If 1558 * the buffer (buf) is not large enough, status information will be truncated 1559 * to fit the buffer. 1560 */ 1561int eap_sm_get_status(struct eap_sm *sm, char *buf, size_t buflen, int verbose) 1562{ 1563 int len, ret; 1564 1565 if (sm == NULL) 1566 return 0; 1567 1568 len = os_snprintf(buf, buflen, 1569 "EAP state=%s\n", 1570 eap_sm_state_txt(sm->EAP_state)); 1571 if (len < 0 || (size_t) len >= buflen) 1572 return 0; 1573 1574 if (sm->selectedMethod != EAP_TYPE_NONE) { 1575 const char *name; 1576 if (sm->m) { 1577 name = sm->m->name; 1578 } else { 1579 const struct eap_method *m = 1580 eap_peer_get_eap_method(EAP_VENDOR_IETF, 1581 sm->selectedMethod); 1582 if (m) 1583 name = m->name; 1584 else 1585 name = "?"; 1586 } 1587 ret = os_snprintf(buf + len, buflen - len, 1588 "selectedMethod=%d (EAP-%s)\n", 1589 sm->selectedMethod, name); 1590 if (ret < 0 || (size_t) ret >= buflen - len) 1591 return len; 1592 len += ret; 1593 1594 if (sm->m && sm->m->get_status) { 1595 len += sm->m->get_status(sm, sm->eap_method_priv, 1596 buf + len, buflen - len, 1597 verbose); 1598 } 1599 } 1600 1601 if (verbose) { 1602 ret = os_snprintf(buf + len, buflen - len, 1603 "reqMethod=%d\n" 1604 "methodState=%s\n" 1605 "decision=%s\n" 1606 "ClientTimeout=%d\n", 1607 sm->reqMethod, 1608 eap_sm_method_state_txt(sm->methodState), 1609 eap_sm_decision_txt(sm->decision), 1610 sm->ClientTimeout); 1611 if (ret < 0 || (size_t) ret >= buflen - len) 1612 return len; 1613 len += ret; 1614 } 1615 1616 return len; 1617} 1618#endif /* CONFIG_CTRL_IFACE */ 1619 1620 1621#if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG) 1622static void eap_sm_request(struct eap_sm *sm, enum wpa_ctrl_req_type field, 1623 const char *msg, size_t msglen) 1624{ 1625 struct eap_peer_config *config; 1626 char *txt = NULL, *tmp; 1627 1628 if (sm == NULL) 1629 return; 1630 config = eap_get_config(sm); 1631 if (config == NULL) 1632 return; 1633 1634 switch (field) { 1635 case WPA_CTRL_REQ_EAP_IDENTITY: 1636 config->pending_req_identity++; 1637 break; 1638 case WPA_CTRL_REQ_EAP_PASSWORD: 1639 config->pending_req_password++; 1640 break; 1641 case WPA_CTRL_REQ_EAP_NEW_PASSWORD: 1642 config->pending_req_new_password++; 1643 break; 1644 case WPA_CTRL_REQ_EAP_PIN: 1645 config->pending_req_pin++; 1646 break; 1647 case WPA_CTRL_REQ_EAP_OTP: 1648 if (msg) { 1649 tmp = os_malloc(msglen + 3); 1650 if (tmp == NULL) 1651 return; 1652 tmp[0] = '['; 1653 os_memcpy(tmp + 1, msg, msglen); 1654 tmp[msglen + 1] = ']'; 1655 tmp[msglen + 2] = '\0'; 1656 txt = tmp; 1657 os_free(config->pending_req_otp); 1658 config->pending_req_otp = tmp; 1659 config->pending_req_otp_len = msglen + 3; 1660 } else { 1661 if (config->pending_req_otp == NULL) 1662 return; 1663 txt = config->pending_req_otp; 1664 } 1665 break; 1666 case WPA_CTRL_REQ_EAP_PASSPHRASE: 1667 config->pending_req_passphrase++; 1668 break; 1669 default: 1670 return; 1671 } 1672 1673 if (sm->eapol_cb->eap_param_needed) 1674 sm->eapol_cb->eap_param_needed(sm->eapol_ctx, field, txt); 1675} 1676#else /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */ 1677#define eap_sm_request(sm, type, msg, msglen) do { } while (0) 1678#endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */ 1679 1680const char * eap_sm_get_method_name(struct eap_sm *sm) 1681{ 1682 if (sm->m == NULL) 1683 return "UNKNOWN"; 1684 return sm->m->name; 1685} 1686 1687 1688/** 1689 * eap_sm_request_identity - Request identity from user (ctrl_iface) 1690 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1691 * 1692 * EAP methods can call this function to request identity information for the 1693 * current network. This is normally called when the identity is not included 1694 * in the network configuration. The request will be sent to monitor programs 1695 * through the control interface. 1696 */ 1697void eap_sm_request_identity(struct eap_sm *sm) 1698{ 1699 eap_sm_request(sm, WPA_CTRL_REQ_EAP_IDENTITY, NULL, 0); 1700} 1701 1702 1703/** 1704 * eap_sm_request_password - Request password from user (ctrl_iface) 1705 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1706 * 1707 * EAP methods can call this function to request password information for the 1708 * current network. This is normally called when the password is not included 1709 * in the network configuration. The request will be sent to monitor programs 1710 * through the control interface. 1711 */ 1712void eap_sm_request_password(struct eap_sm *sm) 1713{ 1714 eap_sm_request(sm, WPA_CTRL_REQ_EAP_PASSWORD, NULL, 0); 1715} 1716 1717 1718/** 1719 * eap_sm_request_new_password - Request new password from user (ctrl_iface) 1720 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1721 * 1722 * EAP methods can call this function to request new password information for 1723 * the current network. This is normally called when the EAP method indicates 1724 * that the current password has expired and password change is required. The 1725 * request will be sent to monitor programs through the control interface. 1726 */ 1727void eap_sm_request_new_password(struct eap_sm *sm) 1728{ 1729 eap_sm_request(sm, WPA_CTRL_REQ_EAP_NEW_PASSWORD, NULL, 0); 1730} 1731 1732 1733/** 1734 * eap_sm_request_pin - Request SIM or smart card PIN from user (ctrl_iface) 1735 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1736 * 1737 * EAP methods can call this function to request SIM or smart card PIN 1738 * information for the current network. This is normally called when the PIN is 1739 * not included in the network configuration. The request will be sent to 1740 * monitor programs through the control interface. 1741 */ 1742void eap_sm_request_pin(struct eap_sm *sm) 1743{ 1744 eap_sm_request(sm, WPA_CTRL_REQ_EAP_PIN, NULL, 0); 1745} 1746 1747 1748/** 1749 * eap_sm_request_otp - Request one time password from user (ctrl_iface) 1750 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1751 * @msg: Message to be displayed to the user when asking for OTP 1752 * @msg_len: Length of the user displayable message 1753 * 1754 * EAP methods can call this function to request open time password (OTP) for 1755 * the current network. The request will be sent to monitor programs through 1756 * the control interface. 1757 */ 1758void eap_sm_request_otp(struct eap_sm *sm, const char *msg, size_t msg_len) 1759{ 1760 eap_sm_request(sm, WPA_CTRL_REQ_EAP_OTP, msg, msg_len); 1761} 1762 1763 1764/** 1765 * eap_sm_request_passphrase - Request passphrase from user (ctrl_iface) 1766 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1767 * 1768 * EAP methods can call this function to request passphrase for a private key 1769 * for the current network. This is normally called when the passphrase is not 1770 * included in the network configuration. The request will be sent to monitor 1771 * programs through the control interface. 1772 */ 1773void eap_sm_request_passphrase(struct eap_sm *sm) 1774{ 1775 eap_sm_request(sm, WPA_CTRL_REQ_EAP_PASSPHRASE, NULL, 0); 1776} 1777 1778 1779/** 1780 * eap_sm_notify_ctrl_attached - Notification of attached monitor 1781 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1782 * 1783 * Notify EAP state machines that a monitor was attached to the control 1784 * interface to trigger re-sending of pending requests for user input. 1785 */ 1786void eap_sm_notify_ctrl_attached(struct eap_sm *sm) 1787{ 1788 struct eap_peer_config *config = eap_get_config(sm); 1789 1790 if (config == NULL) 1791 return; 1792 1793 /* Re-send any pending requests for user data since a new control 1794 * interface was added. This handles cases where the EAP authentication 1795 * starts immediately after system startup when the user interface is 1796 * not yet running. */ 1797 if (config->pending_req_identity) 1798 eap_sm_request_identity(sm); 1799 if (config->pending_req_password) 1800 eap_sm_request_password(sm); 1801 if (config->pending_req_new_password) 1802 eap_sm_request_new_password(sm); 1803 if (config->pending_req_otp) 1804 eap_sm_request_otp(sm, NULL, 0); 1805 if (config->pending_req_pin) 1806 eap_sm_request_pin(sm); 1807 if (config->pending_req_passphrase) 1808 eap_sm_request_passphrase(sm); 1809} 1810 1811 1812static int eap_allowed_phase2_type(int vendor, int type) 1813{ 1814 if (vendor != EAP_VENDOR_IETF) 1815 return 0; 1816 return type != EAP_TYPE_PEAP && type != EAP_TYPE_TTLS && 1817 type != EAP_TYPE_FAST; 1818} 1819 1820 1821/** 1822 * eap_get_phase2_type - Get EAP type for the given EAP phase 2 method name 1823 * @name: EAP method name, e.g., MD5 1824 * @vendor: Buffer for returning EAP Vendor-Id 1825 * Returns: EAP method type or %EAP_TYPE_NONE if not found 1826 * 1827 * This function maps EAP type names into EAP type numbers that are allowed for 1828 * Phase 2, i.e., for tunneled authentication. Phase 2 is used, e.g., with 1829 * EAP-PEAP, EAP-TTLS, and EAP-FAST. 1830 */ 1831u32 eap_get_phase2_type(const char *name, int *vendor) 1832{ 1833 int v; 1834 u8 type = eap_peer_get_type(name, &v); 1835 if (eap_allowed_phase2_type(v, type)) { 1836 *vendor = v; 1837 return type; 1838 } 1839 *vendor = EAP_VENDOR_IETF; 1840 return EAP_TYPE_NONE; 1841} 1842 1843 1844/** 1845 * eap_get_phase2_types - Get list of allowed EAP phase 2 types 1846 * @config: Pointer to a network configuration 1847 * @count: Pointer to a variable to be filled with number of returned EAP types 1848 * Returns: Pointer to allocated type list or %NULL on failure 1849 * 1850 * This function generates an array of allowed EAP phase 2 (tunneled) types for 1851 * the given network configuration. 1852 */ 1853struct eap_method_type * eap_get_phase2_types(struct eap_peer_config *config, 1854 size_t *count) 1855{ 1856 struct eap_method_type *buf; 1857 u32 method; 1858 int vendor; 1859 size_t mcount; 1860 const struct eap_method *methods, *m; 1861 1862 methods = eap_peer_get_methods(&mcount); 1863 if (methods == NULL) 1864 return NULL; 1865 *count = 0; 1866 buf = os_malloc(mcount * sizeof(struct eap_method_type)); 1867 if (buf == NULL) 1868 return NULL; 1869 1870 for (m = methods; m; m = m->next) { 1871 vendor = m->vendor; 1872 method = m->method; 1873 if (eap_allowed_phase2_type(vendor, method)) { 1874 if (vendor == EAP_VENDOR_IETF && 1875 method == EAP_TYPE_TLS && config && 1876 config->private_key2 == NULL) 1877 continue; 1878 buf[*count].vendor = vendor; 1879 buf[*count].method = method; 1880 (*count)++; 1881 } 1882 } 1883 1884 return buf; 1885} 1886 1887 1888/** 1889 * eap_set_fast_reauth - Update fast_reauth setting 1890 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1891 * @enabled: 1 = Fast reauthentication is enabled, 0 = Disabled 1892 */ 1893void eap_set_fast_reauth(struct eap_sm *sm, int enabled) 1894{ 1895 sm->fast_reauth = enabled; 1896} 1897 1898 1899/** 1900 * eap_set_workaround - Update EAP workarounds setting 1901 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1902 * @workaround: 1 = Enable EAP workarounds, 0 = Disable EAP workarounds 1903 */ 1904void eap_set_workaround(struct eap_sm *sm, unsigned int workaround) 1905{ 1906 sm->workaround = workaround; 1907} 1908 1909 1910/** 1911 * eap_get_config - Get current network configuration 1912 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1913 * Returns: Pointer to the current network configuration or %NULL if not found 1914 * 1915 * EAP peer methods should avoid using this function if they can use other 1916 * access functions, like eap_get_config_identity() and 1917 * eap_get_config_password(), that do not require direct access to 1918 * struct eap_peer_config. 1919 */ 1920struct eap_peer_config * eap_get_config(struct eap_sm *sm) 1921{ 1922 return sm->eapol_cb->get_config(sm->eapol_ctx); 1923} 1924 1925 1926/** 1927 * eap_get_config_identity - Get identity from the network configuration 1928 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1929 * @len: Buffer for the length of the identity 1930 * Returns: Pointer to the identity or %NULL if not found 1931 */ 1932const u8 * eap_get_config_identity(struct eap_sm *sm, size_t *len) 1933{ 1934 struct eap_peer_config *config = eap_get_config(sm); 1935 if (config == NULL) 1936 return NULL; 1937 *len = config->identity_len; 1938 return config->identity; 1939} 1940 1941 1942static int eap_get_ext_password(struct eap_sm *sm, 1943 struct eap_peer_config *config) 1944{ 1945 char *name; 1946 1947 if (config->password == NULL) 1948 return -1; 1949 1950 name = os_zalloc(config->password_len + 1); 1951 if (name == NULL) 1952 return -1; 1953 os_memcpy(name, config->password, config->password_len); 1954 1955 ext_password_free(sm->ext_pw_buf); 1956 sm->ext_pw_buf = ext_password_get(sm->ext_pw, name); 1957 os_free(name); 1958 1959 return sm->ext_pw_buf == NULL ? -1 : 0; 1960} 1961 1962 1963/** 1964 * eap_get_config_password - Get password from the network configuration 1965 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1966 * @len: Buffer for the length of the password 1967 * Returns: Pointer to the password or %NULL if not found 1968 */ 1969const u8 * eap_get_config_password(struct eap_sm *sm, size_t *len) 1970{ 1971 struct eap_peer_config *config = eap_get_config(sm); 1972 if (config == NULL) 1973 return NULL; 1974 1975 if (config->flags & EAP_CONFIG_FLAGS_EXT_PASSWORD) { 1976 if (eap_get_ext_password(sm, config) < 0) 1977 return NULL; 1978 *len = wpabuf_len(sm->ext_pw_buf); 1979 return wpabuf_head(sm->ext_pw_buf); 1980 } 1981 1982 *len = config->password_len; 1983 return config->password; 1984} 1985 1986 1987/** 1988 * eap_get_config_password2 - Get password from the network configuration 1989 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1990 * @len: Buffer for the length of the password 1991 * @hash: Buffer for returning whether the password is stored as a 1992 * NtPasswordHash instead of plaintext password; can be %NULL if this 1993 * information is not needed 1994 * Returns: Pointer to the password or %NULL if not found 1995 */ 1996const u8 * eap_get_config_password2(struct eap_sm *sm, size_t *len, int *hash) 1997{ 1998 struct eap_peer_config *config = eap_get_config(sm); 1999 if (config == NULL) 2000 return NULL; 2001 2002 if (config->flags & EAP_CONFIG_FLAGS_EXT_PASSWORD) { 2003 if (eap_get_ext_password(sm, config) < 0) 2004 return NULL; 2005 *len = wpabuf_len(sm->ext_pw_buf); 2006 return wpabuf_head(sm->ext_pw_buf); 2007 } 2008 2009 *len = config->password_len; 2010 if (hash) 2011 *hash = !!(config->flags & EAP_CONFIG_FLAGS_PASSWORD_NTHASH); 2012 return config->password; 2013} 2014 2015 2016/** 2017 * eap_get_config_new_password - Get new password from network configuration 2018 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2019 * @len: Buffer for the length of the new password 2020 * Returns: Pointer to the new password or %NULL if not found 2021 */ 2022const u8 * eap_get_config_new_password(struct eap_sm *sm, size_t *len) 2023{ 2024 struct eap_peer_config *config = eap_get_config(sm); 2025 if (config == NULL) 2026 return NULL; 2027 *len = config->new_password_len; 2028 return config->new_password; 2029} 2030 2031 2032/** 2033 * eap_get_config_otp - Get one-time password from the network configuration 2034 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2035 * @len: Buffer for the length of the one-time password 2036 * Returns: Pointer to the one-time password or %NULL if not found 2037 */ 2038const u8 * eap_get_config_otp(struct eap_sm *sm, size_t *len) 2039{ 2040 struct eap_peer_config *config = eap_get_config(sm); 2041 if (config == NULL) 2042 return NULL; 2043 *len = config->otp_len; 2044 return config->otp; 2045} 2046 2047 2048/** 2049 * eap_clear_config_otp - Clear used one-time password 2050 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2051 * 2052 * This function clears a used one-time password (OTP) from the current network 2053 * configuration. This should be called when the OTP has been used and is not 2054 * needed anymore. 2055 */ 2056void eap_clear_config_otp(struct eap_sm *sm) 2057{ 2058 struct eap_peer_config *config = eap_get_config(sm); 2059 if (config == NULL) 2060 return; 2061 os_memset(config->otp, 0, config->otp_len); 2062 os_free(config->otp); 2063 config->otp = NULL; 2064 config->otp_len = 0; 2065} 2066 2067 2068/** 2069 * eap_get_config_phase1 - Get phase1 data from the network configuration 2070 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2071 * Returns: Pointer to the phase1 data or %NULL if not found 2072 */ 2073const char * eap_get_config_phase1(struct eap_sm *sm) 2074{ 2075 struct eap_peer_config *config = eap_get_config(sm); 2076 if (config == NULL) 2077 return NULL; 2078 return config->phase1; 2079} 2080 2081 2082/** 2083 * eap_get_config_phase2 - Get phase2 data from the network configuration 2084 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2085 * Returns: Pointer to the phase1 data or %NULL if not found 2086 */ 2087const char * eap_get_config_phase2(struct eap_sm *sm) 2088{ 2089 struct eap_peer_config *config = eap_get_config(sm); 2090 if (config == NULL) 2091 return NULL; 2092 return config->phase2; 2093} 2094 2095 2096int eap_get_config_fragment_size(struct eap_sm *sm) 2097{ 2098 struct eap_peer_config *config = eap_get_config(sm); 2099 if (config == NULL) 2100 return -1; 2101 return config->fragment_size; 2102} 2103 2104 2105/** 2106 * eap_key_available - Get key availability (eapKeyAvailable variable) 2107 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2108 * Returns: 1 if EAP keying material is available, 0 if not 2109 */ 2110int eap_key_available(struct eap_sm *sm) 2111{ 2112 return sm ? sm->eapKeyAvailable : 0; 2113} 2114 2115 2116/** 2117 * eap_notify_success - Notify EAP state machine about external success trigger 2118 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2119 * 2120 * This function is called when external event, e.g., successful completion of 2121 * WPA-PSK key handshake, is indicating that EAP state machine should move to 2122 * success state. This is mainly used with security modes that do not use EAP 2123 * state machine (e.g., WPA-PSK). 2124 */ 2125void eap_notify_success(struct eap_sm *sm) 2126{ 2127 if (sm) { 2128 sm->decision = DECISION_COND_SUCC; 2129 sm->EAP_state = EAP_SUCCESS; 2130 } 2131} 2132 2133 2134/** 2135 * eap_notify_lower_layer_success - Notification of lower layer success 2136 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2137 * 2138 * Notify EAP state machines that a lower layer has detected a successful 2139 * authentication. This is used to recover from dropped EAP-Success messages. 2140 */ 2141void eap_notify_lower_layer_success(struct eap_sm *sm) 2142{ 2143 if (sm == NULL) 2144 return; 2145 2146 if (eapol_get_bool(sm, EAPOL_eapSuccess) || 2147 sm->decision == DECISION_FAIL || 2148 (sm->methodState != METHOD_MAY_CONT && 2149 sm->methodState != METHOD_DONE)) 2150 return; 2151 2152 if (sm->eapKeyData != NULL) 2153 sm->eapKeyAvailable = TRUE; 2154 eapol_set_bool(sm, EAPOL_eapSuccess, TRUE); 2155 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_SUCCESS 2156 "EAP authentication completed successfully (based on lower " 2157 "layer success)"); 2158} 2159 2160 2161/** 2162 * eap_get_eapKeyData - Get master session key (MSK) from EAP state machine 2163 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2164 * @len: Pointer to variable that will be set to number of bytes in the key 2165 * Returns: Pointer to the EAP keying data or %NULL on failure 2166 * 2167 * Fetch EAP keying material (MSK, eapKeyData) from the EAP state machine. The 2168 * key is available only after a successful authentication. EAP state machine 2169 * continues to manage the key data and the caller must not change or free the 2170 * returned data. 2171 */ 2172const u8 * eap_get_eapKeyData(struct eap_sm *sm, size_t *len) 2173{ 2174 if (sm == NULL || sm->eapKeyData == NULL) { 2175 *len = 0; 2176 return NULL; 2177 } 2178 2179 *len = sm->eapKeyDataLen; 2180 return sm->eapKeyData; 2181} 2182 2183 2184/** 2185 * eap_get_eapKeyData - Get EAP response data 2186 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2187 * Returns: Pointer to the EAP response (eapRespData) or %NULL on failure 2188 * 2189 * Fetch EAP response (eapRespData) from the EAP state machine. This data is 2190 * available when EAP state machine has processed an incoming EAP request. The 2191 * EAP state machine does not maintain a reference to the response after this 2192 * function is called and the caller is responsible for freeing the data. 2193 */ 2194struct wpabuf * eap_get_eapRespData(struct eap_sm *sm) 2195{ 2196 struct wpabuf *resp; 2197 2198 if (sm == NULL || sm->eapRespData == NULL) 2199 return NULL; 2200 2201 resp = sm->eapRespData; 2202 sm->eapRespData = NULL; 2203 2204 return resp; 2205} 2206 2207 2208/** 2209 * eap_sm_register_scard_ctx - Notification of smart card context 2210 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2211 * @ctx: Context data for smart card operations 2212 * 2213 * Notify EAP state machines of context data for smart card operations. This 2214 * context data will be used as a parameter for scard_*() functions. 2215 */ 2216void eap_register_scard_ctx(struct eap_sm *sm, void *ctx) 2217{ 2218 if (sm) 2219 sm->scard_ctx = ctx; 2220} 2221 2222 2223/** 2224 * eap_set_config_blob - Set or add a named configuration blob 2225 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2226 * @blob: New value for the blob 2227 * 2228 * Adds a new configuration blob or replaces the current value of an existing 2229 * blob. 2230 */ 2231void eap_set_config_blob(struct eap_sm *sm, struct wpa_config_blob *blob) 2232{ 2233#ifndef CONFIG_NO_CONFIG_BLOBS 2234 sm->eapol_cb->set_config_blob(sm->eapol_ctx, blob); 2235#endif /* CONFIG_NO_CONFIG_BLOBS */ 2236} 2237 2238 2239/** 2240 * eap_get_config_blob - Get a named configuration blob 2241 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2242 * @name: Name of the blob 2243 * Returns: Pointer to blob data or %NULL if not found 2244 */ 2245const struct wpa_config_blob * eap_get_config_blob(struct eap_sm *sm, 2246 const char *name) 2247{ 2248#ifndef CONFIG_NO_CONFIG_BLOBS 2249 return sm->eapol_cb->get_config_blob(sm->eapol_ctx, name); 2250#else /* CONFIG_NO_CONFIG_BLOBS */ 2251 return NULL; 2252#endif /* CONFIG_NO_CONFIG_BLOBS */ 2253} 2254 2255 2256/** 2257 * eap_set_force_disabled - Set force_disabled flag 2258 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2259 * @disabled: 1 = EAP disabled, 0 = EAP enabled 2260 * 2261 * This function is used to force EAP state machine to be disabled when it is 2262 * not in use (e.g., with WPA-PSK or plaintext connections). 2263 */ 2264void eap_set_force_disabled(struct eap_sm *sm, int disabled) 2265{ 2266 sm->force_disabled = disabled; 2267} 2268 2269 2270 /** 2271 * eap_notify_pending - Notify that EAP method is ready to re-process a request 2272 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2273 * 2274 * An EAP method can perform a pending operation (e.g., to get a response from 2275 * an external process). Once the response is available, this function can be 2276 * used to request EAPOL state machine to retry delivering the previously 2277 * received (and still unanswered) EAP request to EAP state machine. 2278 */ 2279void eap_notify_pending(struct eap_sm *sm) 2280{ 2281 sm->eapol_cb->notify_pending(sm->eapol_ctx); 2282} 2283 2284 2285/** 2286 * eap_invalidate_cached_session - Mark cached session data invalid 2287 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2288 */ 2289void eap_invalidate_cached_session(struct eap_sm *sm) 2290{ 2291 if (sm) 2292 eap_deinit_prev_method(sm, "invalidate"); 2293} 2294 2295 2296int eap_is_wps_pbc_enrollee(struct eap_peer_config *conf) 2297{ 2298 if (conf->identity_len != WSC_ID_ENROLLEE_LEN || 2299 os_memcmp(conf->identity, WSC_ID_ENROLLEE, WSC_ID_ENROLLEE_LEN)) 2300 return 0; /* Not a WPS Enrollee */ 2301 2302 if (conf->phase1 == NULL || os_strstr(conf->phase1, "pbc=1") == NULL) 2303 return 0; /* Not using PBC */ 2304 2305 return 1; 2306} 2307 2308 2309int eap_is_wps_pin_enrollee(struct eap_peer_config *conf) 2310{ 2311 if (conf->identity_len != WSC_ID_ENROLLEE_LEN || 2312 os_memcmp(conf->identity, WSC_ID_ENROLLEE, WSC_ID_ENROLLEE_LEN)) 2313 return 0; /* Not a WPS Enrollee */ 2314 2315 if (conf->phase1 == NULL || os_strstr(conf->phase1, "pin=") == NULL) 2316 return 0; /* Not using PIN */ 2317 2318 return 1; 2319} 2320 2321 2322void eap_sm_set_ext_pw_ctx(struct eap_sm *sm, struct ext_password_data *ext) 2323{ 2324 ext_password_free(sm->ext_pw_buf); 2325 sm->ext_pw_buf = NULL; 2326 sm->ext_pw = ext; 2327} 2328 2329 2330/** 2331 * eap_set_anon_id - Set or add anonymous identity 2332 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2333 * @id: Anonymous identity (e.g., EAP-SIM pseudonym) or %NULL to clear 2334 * @len: Length of anonymous identity in octets 2335 */ 2336void eap_set_anon_id(struct eap_sm *sm, const u8 *id, size_t len) 2337{ 2338 if (sm->eapol_cb->set_anon_id) 2339 sm->eapol_cb->set_anon_id(sm->eapol_ctx, id, len); 2340} 2341