eap_i.h revision 189261
11541Srgrimes/* 21541Srgrimes * EAP peer state machines internal structures (RFC 4137) 31541Srgrimes * Copyright (c) 2004-2007, Jouni Malinen <j@w1.fi> 41541Srgrimes * 51541Srgrimes * This program is free software; you can redistribute it and/or modify 61541Srgrimes * it under the terms of the GNU General Public License version 2 as 71541Srgrimes * published by the Free Software Foundation. 81541Srgrimes * 91541Srgrimes * Alternatively, this software may be distributed under the terms of BSD 101541Srgrimes * license. 111541Srgrimes * 121541Srgrimes * See README and COPYING for more details. 131541Srgrimes */ 141541Srgrimes 151541Srgrimes#ifndef EAP_I_H 161541Srgrimes#define EAP_I_H 171541Srgrimes 181541Srgrimes#include "wpabuf.h" 191541Srgrimes#include "eap_peer/eap.h" 201541Srgrimes#include "eap_common/eap_common.h" 211541Srgrimes 221541Srgrimes/* RFC 4137 - EAP Peer state machine */ 231541Srgrimes 241541Srgrimestypedef enum { 251541Srgrimes DECISION_FAIL, DECISION_COND_SUCC, DECISION_UNCOND_SUCC 261541Srgrimes} EapDecision; 271541Srgrimes 281541Srgrimestypedef enum { 2914505Shsu METHOD_NONE, METHOD_INIT, METHOD_CONT, METHOD_MAY_CONT, METHOD_DONE 3050477Speter} EapMethodState; 311541Srgrimes 321541Srgrimes/** 332165Spaul * struct eap_method_ret - EAP return values from struct eap_method::process() 342165Spaul * 352165Spaul * These structure contains OUT variables for the interface between peer state 3615492Sbde * machine and methods (RFC 4137, Sect. 4.2). eapRespData will be returned as 3770834Swollman * the return value of struct eap_method::process() so it is not included in 38130380Srwatson * this structure. 39130380Srwatson */ 401541Srgrimesstruct eap_method_ret { 411541Srgrimes /** 421541Srgrimes * ignore - Whether method decided to drop the current packed (OUT) 431541Srgrimes */ 441541Srgrimes Boolean ignore; 451541Srgrimes 461541Srgrimes /** 4736079Swollman * methodState - Method-specific state (IN/OUT) 4836079Swollman */ 49129958Srwatson EapMethodState methodState; 50129958Srwatson 51129958Srwatson /** 52129958Srwatson * decision - Authentication decision (OUT) 53129958Srwatson */ 54129958Srwatson EapDecision decision; 55129958Srwatson 56129958Srwatson /** 57129958Srwatson * allowNotifications - Whether method allows notifications (OUT) 5895552Stanimura */ 591541Srgrimes Boolean allowNotifications; 6097658Stanimura}; 61129958Srwatson 6297658Stanimura 6397658Stanimura/** 64129958Srwatson * struct eap_method - EAP method interface 65129979Srwatson * This structure defines the EAP method interface. Each method will need to 6698993Salfred * register its own EAP type, EAP name, and set of function pointers for method 67129958Srwatson * specific operations. This interface is based on section 4.4 of RFC 4137. 681541Srgrimes */ 6913765Smppstruct eap_method { 701541Srgrimes /** 711541Srgrimes * vendor - EAP Vendor-ID (EAP_VENDOR_*) (0 = IETF) 7278913Sjlemon */ 7378913Sjlemon int vendor; 741541Srgrimes 7578913Sjlemon /** 761541Srgrimes * method - EAP type number (EAP_TYPE_*) 771541Srgrimes */ 781541Srgrimes EapType method; 79129979Srwatson 80129979Srwatson /** 81129979Srwatson * name - Name of the method (e.g., "TLS") 82129979Srwatson */ 83129979Srwatson const char *name; 84129979Srwatson 8518787Spst /** 86129979Srwatson * init - Initialize an EAP method 8797658Stanimura * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 8897658Stanimura * Returns: Pointer to allocated private data, or %NULL on failure 8997658Stanimura * 9041087Struckman * This function is used to initialize the EAP method explicitly 9197658Stanimura * instead of using METHOD_INIT state as specific in RFC 4137. The 9297658Stanimura * method is expected to initialize it method-specific state and return 931541Srgrimes * a pointer that will be used as the priv argument to other calls. 941541Srgrimes */ 951541Srgrimes void * (*init)(struct eap_sm *sm); 9683421Sobrien 97100591Sjdp /** 98130380Srwatson * deinit - Deinitialize an EAP method 99117708Srobert * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 10097658Stanimura * @priv: Pointer to private EAP method data from eap_method::init() 101121628Ssam * 102121628Ssam * Deinitialize the EAP method and free any allocated private data. 103121628Ssam */ 104100591Sjdp void (*deinit)(struct eap_sm *sm, void *priv); 105100591Sjdp 106100591Sjdp /** 107100591Sjdp * process - Process an EAP request 108106313Skbyanc * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 109100591Sjdp * @priv: Pointer to private EAP method data from eap_method::init() 110100591Sjdp * @ret: Return values from EAP request validation and processing 11197658Stanimura * @reqData: EAP request to be processed (eapReqData) 1121541Srgrimes * Returns: Pointer to allocated EAP response packet (eapRespData) 1131541Srgrimes * 1141541Srgrimes * This function is a combination of m.check(), m.process(), and 1151541Srgrimes * m.buildResp() procedures defined in section 4.4 of RFC 4137 In other 1161541Srgrimes * words, this function validates the incoming request, processes it, 1171541Srgrimes * and build a response packet. m.check() and m.process() return values 1181541Srgrimes * are returned through struct eap_method_ret *ret variable. Caller is 11936527Speter * responsible for freeing the returned EAP response packet. 1201541Srgrimes */ 12155943Sjasone struct wpabuf * (*process)(struct eap_sm *sm, void *priv, 12259288Sjlemon struct eap_method_ret *ret, 1231541Srgrimes const struct wpabuf *reqData); 12497658Stanimura 12597658Stanimura /** 12697658Stanimura * isKeyAvailable - Find out whether EAP method has keying material 127122524Srwatson * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 128122524Srwatson * @priv: Pointer to private EAP method data from eap_method::init() 12938482Swollman * Returns: %TRUE if key material (eapKeyData) is available 13097658Stanimura */ 13197658Stanimura Boolean (*isKeyAvailable)(struct eap_sm *sm, void *priv); 13297658Stanimura 13397658Stanimura /** 13497658Stanimura * getKey - Get EAP method specific keying material (eapKeyData) 13597658Stanimura * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 13697658Stanimura * @priv: Pointer to private EAP method data from eap_method::init() 1371541Srgrimes * @len: Pointer to variable to store key length (eapKeyDataLen) 1381541Srgrimes * Returns: Keying material (eapKeyData) or %NULL if not available 139121628Ssam * 140121628Ssam * This function can be used to get the keying material from the EAP 141121628Ssam * method. The key may already be stored in the method-specific private 142121628Ssam * data or this function may derive the key. 143121628Ssam */ 144121628Ssam u8 * (*getKey)(struct eap_sm *sm, void *priv, size_t *len); 145121628Ssam 1461541Srgrimes /** 147129979Srwatson * get_status - Get EAP method status 148129979Srwatson * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 149129979Srwatson * @priv: Pointer to private EAP method data from eap_method::init() 150129979Srwatson * @buf: Buffer for status information 151129979Srwatson * @buflen: Maximum buffer length 152129979Srwatson * @verbose: Whether to include verbose status information 153130364Srwatson * Returns: Number of bytes written to buf 154130364Srwatson * 155129979Srwatson * Query EAP method for status information. This function fills in a 156129979Srwatson * text area with current status information from the EAP method. If 157130380Srwatson * the buffer (buf) is not large enough, status information will be 158130380Srwatson * truncated to fit the buffer. 159130380Srwatson */ 160130380Srwatson int (*get_status)(struct eap_sm *sm, void *priv, char *buf, 161130380Srwatson size_t buflen, int verbose); 162130380Srwatson 163130380Srwatson /** 164130380Srwatson * has_reauth_data - Whether method is ready for fast reauthentication 165130380Srwatson * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 166130380Srwatson * @priv: Pointer to private EAP method data from eap_method::init() 167130380Srwatson * Returns: %TRUE or %FALSE based on whether fast reauthentication is 168130380Srwatson * possible 169130380Srwatson * 170130380Srwatson * This function is an optional handler that only EAP methods 171130380Srwatson * supporting fast re-authentication need to implement. 172130380Srwatson */ 173130380Srwatson Boolean (*has_reauth_data)(struct eap_sm *sm, void *priv); 174130380Srwatson 175130380Srwatson /** 176130380Srwatson * deinit_for_reauth - Release data that is not needed for fast re-auth 177130380Srwatson * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 178130380Srwatson * @priv: Pointer to private EAP method data from eap_method::init() 179130380Srwatson * 180130380Srwatson * This function is an optional handler that only EAP methods 1811541Srgrimes * supporting fast re-authentication need to implement. This is called 1821541Srgrimes * when authentication has been completed and EAP state machine is 18314547Sdg * requesting that enough state information is maintained for fast 18414547Sdg * re-authentication 18514547Sdg */ 18614547Sdg void (*deinit_for_reauth)(struct eap_sm *sm, void *priv); 18714547Sdg 18814547Sdg /** 18914547Sdg * init_for_reauth - Prepare for start of fast re-authentication 1901541Srgrimes * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 19114547Sdg * @priv: Pointer to private EAP method data from eap_method::init() 19214547Sdg * 19314547Sdg * This function is an optional handler that only EAP methods 1941541Srgrimes * supporting fast re-authentication need to implement. This is called 19543196Sfenner * when EAP authentication is started and EAP state machine is 1961541Srgrimes * requesting fast re-authentication to be used. 19736079Swollman */ 198129916Srwatson void * (*init_for_reauth)(struct eap_sm *sm, void *priv); 199129916Srwatson 200129916Srwatson /** 201129916Srwatson * get_identity - Get method specific identity for re-authentication 202129916Srwatson * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 203129916Srwatson * @priv: Pointer to private EAP method data from eap_method::init() 20436079Swollman * @len: Length of the returned identity 20536079Swollman * Returns: Pointer to the method specific identity or %NULL if default 20683045Sobrien * identity is to be used 20736079Swollman * 20836079Swollman * This function is an optional handler that only EAP methods 20936079Swollman * that use method specific identity need to implement. 21036079Swollman */ 21136079Swollman const u8 * (*get_identity)(struct eap_sm *sm, void *priv, size_t *len); 21236079Swollman 21336079Swollman /** 21436079Swollman * free - Free EAP method data 21536079Swollman * @method: Pointer to the method data registered with 21636079Swollman * eap_peer_method_register(). 21736079Swollman * 21836079Swollman * This function will be called when the EAP method is being 21936079Swollman * unregistered. If the EAP method allocated resources during 22036079Swollman * registration (e.g., allocated struct eap_method), they should be 22136079Swollman * freed in this function. No other method functions will be called 22236079Swollman * after this call. If this function is not defined (i.e., function 22383421Sobrien * pointer is %NULL), a default handler is used to release the method 224100591Sjdp * data with free(method). This is suitable for most cases. 225100591Sjdp */ 226100591Sjdp void (*free)(struct eap_method *method); 227100591Sjdp 228100591Sjdp#define EAP_PEER_METHOD_INTERFACE_VERSION 1 229100591Sjdp /** 23036079Swollman * version - Version of the EAP peer method interface 23136079Swollman * 23236079Swollman * The EAP peer method implementation should set this variable to 23336079Swollman * EAP_PEER_METHOD_INTERFACE_VERSION. This is used to verify that the 23414547Sdg * EAP method is using supported API version when using dynamically 2351541Srgrimes * loadable EAP methods. 2361541Srgrimes */ 2371541Srgrimes int version; 2381541Srgrimes 2391541Srgrimes /** 24036527Speter * next - Pointer to the next EAP method 24136527Speter * 24255943Sjasone * This variable is used internally in the EAP method registration code 24359288Sjlemon * to create a linked list of registered EAP methods. 24436527Speter */ 24536527Speter struct eap_method *next; 2461541Srgrimes 2471541Srgrimes#ifdef CONFIG_DYNAMIC_EAP_METHODS 2481541Srgrimes /** 2491541Srgrimes * dl_handle - Handle for the dynamic library 2501541Srgrimes * 2511541Srgrimes * This variable is used internally in the EAP method registration code 2521541Srgrimes * to store a handle for the dynamic library. If the method is linked 2531541Srgrimes * in statically, this is %NULL. 2541541Srgrimes */ 2551541Srgrimes void *dl_handle; 2561541Srgrimes#endif /* CONFIG_DYNAMIC_EAP_METHODS */ 2571541Srgrimes 2581541Srgrimes /** 2591541Srgrimes * get_emsk - Get EAP method specific keying extended material (EMSK) 2601541Srgrimes * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 2611541Srgrimes * @priv: Pointer to private EAP method data from eap_method::init() 2621541Srgrimes * @len: Pointer to a variable to store EMSK length 26370536Sphk * Returns: EMSK or %NULL if not available 2641541Srgrimes * 2651541Srgrimes * This function can be used to get the extended keying material from 2661541Srgrimes * the EAP method. The key may already be stored in the method-specific 2673304Sphk * private data or this function may derive the key. 2681541Srgrimes */ 2693304Sphk u8 * (*get_emsk)(struct eap_sm *sm, void *priv, size_t *len); 2701541Srgrimes}; 2711541Srgrimes 2721541Srgrimes 2731541Srgrimes/** 2741541Srgrimes * struct eap_sm - EAP state machine data 2751541Srgrimes */ 276109098Stjrstruct eap_sm { 277109098Stjr enum { 278106313Skbyanc EAP_INITIALIZE, EAP_DISABLED, EAP_IDLE, EAP_RECEIVED, 2791541Srgrimes EAP_GET_METHOD, EAP_METHOD, EAP_SEND_RESPONSE, EAP_DISCARD, 2801541Srgrimes EAP_IDENTITY, EAP_NOTIFICATION, EAP_RETRANSMIT, EAP_SUCCESS, 2811541Srgrimes EAP_FAILURE 2821541Srgrimes } EAP_state; 2831541Srgrimes /* Long-term local variables */ 2841541Srgrimes EapType selectedMethod; 2851541Srgrimes EapMethodState methodState; 2861541Srgrimes int lastId; 287109098Stjr struct wpabuf *lastRespData; 288109098Stjr EapDecision decision; 289106313Skbyanc /* Short-term local variables */ 2901541Srgrimes Boolean rxReq; 2911541Srgrimes Boolean rxSuccess; 2921541Srgrimes Boolean rxFailure; 2931541Srgrimes int reqId; 2941541Srgrimes EapType reqMethod; 2951541Srgrimes int reqVendor; 2961541Srgrimes u32 reqVendorMethod; 2971541Srgrimes Boolean ignore; 2981541Srgrimes /* Constants */ 2991541Srgrimes int ClientTimeout; 3001541Srgrimes 301111119Simp /* Miscellaneous variables */ 3021541Srgrimes Boolean allowNotifications; /* peer state machine <-> methods */ 3031541Srgrimes struct wpabuf *eapRespData; /* peer to lower layer */ 3041541Srgrimes Boolean eapKeyAvailable; /* peer to lower layer */ 3051541Srgrimes u8 *eapKeyData; /* peer to lower layer */ 3061541Srgrimes size_t eapKeyDataLen; /* peer to lower layer */ 3071541Srgrimes const struct eap_method *m; /* selected EAP method */ 3081541Srgrimes /* not defined in RFC 4137 */ 309111748Sdes Boolean changed; 3101541Srgrimes void *eapol_ctx; 3111541Srgrimes struct eapol_callbacks *eapol_cb; 3121541Srgrimes void *eap_method_priv; 31386487Sdillon int init_phase2; 31486487Sdillon int fast_reauth; 31586487Sdillon 31686487Sdillon Boolean rxResp /* LEAP only */; 31786487Sdillon Boolean leap_done; 31897658Stanimura Boolean peap_done; 31997658Stanimura u8 req_md5[16]; /* MD5() of the current EAP packet */ 32086487Sdillon u8 last_md5[16]; /* MD5() of the previously received EAP packet; used 32186487Sdillon * in duplicate request detection. */ 32297658Stanimura 32389318Salfred void *msg_ctx; 32497658Stanimura void *scard_ctx; 32597658Stanimura void *ssl_ctx; 32697658Stanimura 32786487Sdillon unsigned int workaround; 32886487Sdillon 32997658Stanimura /* Optional challenges generated in Phase 1 (EAP-FAST) */ 33089318Salfred u8 *peer_challenge, *auth_challenge; 33197658Stanimura 33286487Sdillon int num_rounds; 33386487Sdillon int force_disabled; 33498385Stanimura 33598385Stanimura struct wps_context *wps; 33698385Stanimura 33798385Stanimura int prev_failure; 3381541Srgrimes}; 33998385Stanimura 34098385Stanimuraconst u8 * eap_get_config_identity(struct eap_sm *sm, size_t *len); 34198385Stanimuraconst u8 * eap_get_config_password(struct eap_sm *sm, size_t *len); 34298385Stanimuraconst u8 * eap_get_config_password2(struct eap_sm *sm, size_t *len, int *hash); 3431541Srgrimesconst u8 * eap_get_config_new_password(struct eap_sm *sm, size_t *len); 34455205Speterconst u8 * eap_get_config_otp(struct eap_sm *sm, size_t *len); 34531927Sbdevoid eap_clear_config_otp(struct eap_sm *sm); 34638482Swollmanconst char * eap_get_config_phase1(struct eap_sm *sm); 34738482Swollmanconst char * eap_get_config_phase2(struct eap_sm *sm); 34838482Swollmanstruct eap_peer_config * eap_get_config(struct eap_sm *sm); 34938482Swollmanvoid eap_set_config_blob(struct eap_sm *sm, struct wpa_config_blob *blob); 35038482Swollmanconst struct wpa_config_blob * 35138482Swollmaneap_get_config_blob(struct eap_sm *sm, const char *name); 35238482Swollmanvoid eap_notify_pending(struct eap_sm *sm); 35338482Swollmanint eap_allowed_method(struct eap_sm *sm, int vendor, u32 method); 35438482Swollman 35538482Swollman#endif /* EAP_I_H */ 35638482Swollman