eap_i.h revision 87fd279308af3f806848c8f2ab65ef18c6ac4c30 
1/*
2 * hostapd / EAP Authenticator state machine internal structures (RFC 4137)
3 * Copyright (c) 2004-2007, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 */
14
15#ifndef EAP_I_H
16#define EAP_I_H
17
18#include "wpabuf.h"
19#include "eap_server/eap.h"
20#include "eap_common/eap_common.h"
21
22/* RFC 4137 - EAP Standalone Authenticator */
23
24/**
25 * struct eap_method - EAP method interface
26 * This structure defines the EAP method interface. Each method will need to
27 * register its own EAP type, EAP name, and set of function pointers for method
28 * specific operations. This interface is based on section 5.4 of RFC 4137.
29 */
30struct eap_method {
31	int vendor;
32	EapType method;
33	const char *name;
34
35	void * (*init)(struct eap_sm *sm);
36	void * (*initPickUp)(struct eap_sm *sm);
37	void (*reset)(struct eap_sm *sm, void *priv);
38
39	struct wpabuf * (*buildReq)(struct eap_sm *sm, void *priv, u8 id);
40	int (*getTimeout)(struct eap_sm *sm, void *priv);
41	Boolean (*check)(struct eap_sm *sm, void *priv,
42			 struct wpabuf *respData);
43	void (*process)(struct eap_sm *sm, void *priv,
44			struct wpabuf *respData);
45	Boolean (*isDone)(struct eap_sm *sm, void *priv);
46	u8 * (*getKey)(struct eap_sm *sm, void *priv, size_t *len);
47	/* isSuccess is not specified in draft-ietf-eap-statemachine-05.txt,
48	 * but it is useful in implementing Policy.getDecision() */
49	Boolean (*isSuccess)(struct eap_sm *sm, void *priv);
50
51	/**
52	 * free - Free EAP method data
53	 * @method: Pointer to the method data registered with
54	 * eap_server_method_register().
55	 *
56	 * This function will be called when the EAP method is being
57	 * unregistered. If the EAP method allocated resources during
58	 * registration (e.g., allocated struct eap_method), they should be
59	 * freed in this function. No other method functions will be called
60	 * after this call. If this function is not defined (i.e., function
61	 * pointer is %NULL), a default handler is used to release the method
62	 * data with free(method). This is suitable for most cases.
63	 */
64	void (*free)(struct eap_method *method);
65
66#define EAP_SERVER_METHOD_INTERFACE_VERSION 1
67	/**
68	 * version - Version of the EAP server method interface
69	 *
70	 * The EAP server method implementation should set this variable to
71	 * EAP_SERVER_METHOD_INTERFACE_VERSION. This is used to verify that the
72	 * EAP method is using supported API version when using dynamically
73	 * loadable EAP methods.
74	 */
75	int version;
76
77	/**
78	 * next - Pointer to the next EAP method
79	 *
80	 * This variable is used internally in the EAP method registration code
81	 * to create a linked list of registered EAP methods.
82	 */
83	struct eap_method *next;
84
85	/**
86	 * get_emsk - Get EAP method specific keying extended material (EMSK)
87	 * @sm: Pointer to EAP state machine allocated with eap_sm_init()
88	 * @priv: Pointer to private EAP method data from eap_method::init()
89	 * @len: Pointer to a variable to store EMSK length
90	 * Returns: EMSK or %NULL if not available
91	 *
92	 * This function can be used to get the extended keying material from
93	 * the EAP method. The key may already be stored in the method-specific
94	 * private data or this function may derive the key.
95	 */
96	u8 * (*get_emsk)(struct eap_sm *sm, void *priv, size_t *len);
97};
98
99/**
100 * struct eap_sm - EAP server state machine data
101 */
102struct eap_sm {
103	enum {
104		EAP_DISABLED, EAP_INITIALIZE, EAP_IDLE, EAP_RECEIVED,
105		EAP_INTEGRITY_CHECK, EAP_METHOD_RESPONSE, EAP_METHOD_REQUEST,
106		EAP_PROPOSE_METHOD, EAP_SELECT_ACTION, EAP_SEND_REQUEST,
107		EAP_DISCARD, EAP_NAK, EAP_RETRANSMIT, EAP_SUCCESS, EAP_FAILURE,
108		EAP_TIMEOUT_FAILURE, EAP_PICK_UP_METHOD,
109		EAP_INITIALIZE_PASSTHROUGH, EAP_IDLE2, EAP_RETRANSMIT2,
110		EAP_RECEIVED2, EAP_DISCARD2, EAP_SEND_REQUEST2,
111		EAP_AAA_REQUEST, EAP_AAA_RESPONSE, EAP_AAA_IDLE,
112		EAP_TIMEOUT_FAILURE2, EAP_FAILURE2, EAP_SUCCESS2
113	} EAP_state;
114
115	/* Constants */
116	int MaxRetrans;
117
118	struct eap_eapol_interface eap_if;
119
120	/* Full authenticator state machine local variables */
121
122	/* Long-term (maintained betwen packets) */
123	EapType currentMethod;
124	int currentId;
125	enum {
126		METHOD_PROPOSED, METHOD_CONTINUE, METHOD_END
127	} methodState;
128	int retransCount;
129	struct wpabuf *lastReqData;
130	int methodTimeout;
131
132	/* Short-term (not maintained between packets) */
133	Boolean rxResp;
134	int respId;
135	EapType respMethod;
136	int respVendor;
137	u32 respVendorMethod;
138	Boolean ignore;
139	enum {
140		DECISION_SUCCESS, DECISION_FAILURE, DECISION_CONTINUE,
141		DECISION_PASSTHROUGH
142	} decision;
143
144	/* Miscellaneous variables */
145	const struct eap_method *m; /* selected EAP method */
146	/* not defined in RFC 4137 */
147	Boolean changed;
148	void *eapol_ctx, *msg_ctx;
149	struct eapol_callbacks *eapol_cb;
150	void *eap_method_priv;
151	u8 *identity;
152	size_t identity_len;
153	/* Whether Phase 2 method should validate identity match */
154	int require_identity_match;
155	int lastId; /* Identifier used in the last EAP-Packet */
156	struct eap_user *user;
157	int user_eap_method_index;
158	int init_phase2;
159	void *ssl_ctx;
160	void *eap_sim_db_priv;
161	Boolean backend_auth;
162	Boolean update_user;
163	int eap_server;
164
165	int num_rounds;
166	enum {
167		METHOD_PENDING_NONE, METHOD_PENDING_WAIT, METHOD_PENDING_CONT
168	} method_pending;
169
170	u8 *auth_challenge;
171	u8 *peer_challenge;
172
173	u8 *pac_opaque_encr_key;
174	u8 *eap_fast_a_id;
175	size_t eap_fast_a_id_len;
176	char *eap_fast_a_id_info;
177	enum {
178		NO_PROV, ANON_PROV, AUTH_PROV, BOTH_PROV
179	} eap_fast_prov;
180	int pac_key_lifetime;
181	int pac_key_refresh_time;
182	int eap_sim_aka_result_ind;
183	int tnc;
184	u16 pwd_group;
185	struct wps_context *wps;
186	struct wpabuf *assoc_wps_ie;
187	struct wpabuf *assoc_p2p_ie;
188
189	Boolean start_reauth;
190
191	u8 peer_addr[ETH_ALEN];
192
193	/* Fragmentation size for EAP method init() handler */
194	int fragment_size;
195
196	int pbc_in_m1;
197};
198
199int eap_user_get(struct eap_sm *sm, const u8 *identity, size_t identity_len,
200		 int phase2);
201void eap_sm_process_nak(struct eap_sm *sm, const u8 *nak_list, size_t len);
202
203#endif /* EAP_I_H */
204