2008-02-28 02:34:43 +01:00
|
|
|
/*
|
|
|
|
* EAP peer state machine functions (RFC 4137)
|
2012-09-02 12:04:18 +02:00
|
|
|
* Copyright (c) 2004-2012, Jouni Malinen <j@w1.fi>
|
2008-02-28 02:34:43 +01:00
|
|
|
*
|
2012-02-11 15:46:35 +01:00
|
|
|
* This software may be distributed under the terms of the BSD license.
|
|
|
|
* See README for more details.
|
2008-02-28 02:34:43 +01:00
|
|
|
*/
|
|
|
|
|
|
|
|
#ifndef EAP_H
|
|
|
|
#define EAP_H
|
|
|
|
|
2009-11-29 16:51:55 +01:00
|
|
|
#include "common/defs.h"
|
2008-02-28 02:34:43 +01:00
|
|
|
#include "eap_common/eap_defs.h"
|
|
|
|
#include "eap_peer/eap_methods.h"
|
|
|
|
|
|
|
|
struct eap_sm;
|
|
|
|
struct wpa_config_blob;
|
|
|
|
struct wpabuf;
|
2019-06-11 03:20:18 +02:00
|
|
|
struct tls_cert_data;
|
2008-02-28 02:34:43 +01:00
|
|
|
|
|
|
|
struct eap_method_type {
|
|
|
|
int vendor;
|
|
|
|
u32 method;
|
|
|
|
};
|
|
|
|
|
|
|
|
#ifdef IEEE8021X_EAPOL
|
|
|
|
|
|
|
|
/**
|
|
|
|
* enum eapol_bool_var - EAPOL boolean state variables for EAP state machine
|
|
|
|
*
|
|
|
|
* These variables are used in the interface between EAP peer state machine and
|
|
|
|
* lower layer. These are defined in RFC 4137, Sect. 4.1. Lower layer code is
|
|
|
|
* expected to maintain these variables and register a callback functions for
|
|
|
|
* EAP state machine to get and set the variables.
|
|
|
|
*/
|
|
|
|
enum eapol_bool_var {
|
|
|
|
/**
|
|
|
|
* EAPOL_eapSuccess - EAP SUCCESS state reached
|
|
|
|
*
|
|
|
|
* EAP state machine reads and writes this value.
|
|
|
|
*/
|
|
|
|
EAPOL_eapSuccess,
|
|
|
|
|
|
|
|
/**
|
|
|
|
* EAPOL_eapRestart - Lower layer request to restart authentication
|
|
|
|
*
|
|
|
|
* Set to TRUE in lower layer, FALSE in EAP state machine.
|
|
|
|
*/
|
|
|
|
EAPOL_eapRestart,
|
|
|
|
|
|
|
|
/**
|
|
|
|
* EAPOL_eapFail - EAP FAILURE state reached
|
|
|
|
*
|
|
|
|
* EAP state machine writes this value.
|
|
|
|
*/
|
|
|
|
EAPOL_eapFail,
|
|
|
|
|
|
|
|
/**
|
|
|
|
* EAPOL_eapResp - Response to send
|
|
|
|
*
|
|
|
|
* Set to TRUE in EAP state machine, FALSE in lower layer.
|
|
|
|
*/
|
|
|
|
EAPOL_eapResp,
|
|
|
|
|
|
|
|
/**
|
|
|
|
* EAPOL_eapNoResp - Request has been process; no response to send
|
|
|
|
*
|
|
|
|
* Set to TRUE in EAP state machine, FALSE in lower layer.
|
|
|
|
*/
|
|
|
|
EAPOL_eapNoResp,
|
|
|
|
|
|
|
|
/**
|
|
|
|
* EAPOL_eapReq - EAP request available from lower layer
|
|
|
|
*
|
|
|
|
* Set to TRUE in lower layer, FALSE in EAP state machine.
|
|
|
|
*/
|
|
|
|
EAPOL_eapReq,
|
|
|
|
|
|
|
|
/**
|
|
|
|
* EAPOL_portEnabled - Lower layer is ready for communication
|
|
|
|
*
|
|
|
|
* EAP state machines reads this value.
|
|
|
|
*/
|
|
|
|
EAPOL_portEnabled,
|
|
|
|
|
|
|
|
/**
|
|
|
|
* EAPOL_altAccept - Alternate indication of success (RFC3748)
|
|
|
|
*
|
|
|
|
* EAP state machines reads this value.
|
|
|
|
*/
|
|
|
|
EAPOL_altAccept,
|
|
|
|
|
|
|
|
/**
|
|
|
|
* EAPOL_altReject - Alternate indication of failure (RFC3748)
|
|
|
|
*
|
|
|
|
* EAP state machines reads this value.
|
|
|
|
*/
|
2014-11-29 22:14:40 +01:00
|
|
|
EAPOL_altReject,
|
|
|
|
|
|
|
|
/**
|
|
|
|
* EAPOL_eapTriggerStart - EAP-based trigger to send EAPOL-Start
|
|
|
|
*
|
|
|
|
* EAP state machine writes this value.
|
|
|
|
*/
|
|
|
|
EAPOL_eapTriggerStart
|
2008-02-28 02:34:43 +01:00
|
|
|
};
|
|
|
|
|
|
|
|
/**
|
|
|
|
* enum eapol_int_var - EAPOL integer state variables for EAP state machine
|
|
|
|
*
|
|
|
|
* These variables are used in the interface between EAP peer state machine and
|
|
|
|
* lower layer. These are defined in RFC 4137, Sect. 4.1. Lower layer code is
|
|
|
|
* expected to maintain these variables and register a callback functions for
|
|
|
|
* EAP state machine to get and set the variables.
|
|
|
|
*/
|
|
|
|
enum eapol_int_var {
|
|
|
|
/**
|
|
|
|
* EAPOL_idleWhile - Outside time for EAP peer timeout
|
|
|
|
*
|
|
|
|
* This integer variable is used to provide an outside timer that the
|
|
|
|
* external (to EAP state machine) code must decrement by one every
|
|
|
|
* second until the value reaches zero. This is used in the same way as
|
|
|
|
* EAPOL state machine timers. EAP state machine reads and writes this
|
|
|
|
* value.
|
|
|
|
*/
|
|
|
|
EAPOL_idleWhile
|
|
|
|
};
|
|
|
|
|
|
|
|
/**
|
|
|
|
* struct eapol_callbacks - Callback functions from EAP to lower layer
|
|
|
|
*
|
|
|
|
* This structure defines the callback functions that EAP state machine
|
|
|
|
* requires from the lower layer (usually EAPOL state machine) for updating
|
|
|
|
* state variables and requesting information. eapol_ctx from
|
|
|
|
* eap_peer_sm_init() call will be used as the ctx parameter for these
|
|
|
|
* callback functions.
|
|
|
|
*/
|
|
|
|
struct eapol_callbacks {
|
|
|
|
/**
|
|
|
|
* get_config - Get pointer to the current network configuration
|
|
|
|
* @ctx: eapol_ctx from eap_peer_sm_init() call
|
|
|
|
*/
|
|
|
|
struct eap_peer_config * (*get_config)(void *ctx);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* get_bool - Get a boolean EAPOL state variable
|
|
|
|
* @variable: EAPOL boolean variable to get
|
|
|
|
* Returns: Value of the EAPOL variable
|
|
|
|
*/
|
|
|
|
Boolean (*get_bool)(void *ctx, enum eapol_bool_var variable);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* set_bool - Set a boolean EAPOL state variable
|
|
|
|
* @ctx: eapol_ctx from eap_peer_sm_init() call
|
|
|
|
* @variable: EAPOL boolean variable to set
|
|
|
|
* @value: Value for the EAPOL variable
|
|
|
|
*/
|
|
|
|
void (*set_bool)(void *ctx, enum eapol_bool_var variable,
|
|
|
|
Boolean value);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* get_int - Get an integer EAPOL state variable
|
|
|
|
* @ctx: eapol_ctx from eap_peer_sm_init() call
|
|
|
|
* @variable: EAPOL integer variable to get
|
|
|
|
* Returns: Value of the EAPOL variable
|
|
|
|
*/
|
|
|
|
unsigned int (*get_int)(void *ctx, enum eapol_int_var variable);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* set_int - Set an integer EAPOL state variable
|
|
|
|
* @ctx: eapol_ctx from eap_peer_sm_init() call
|
|
|
|
* @variable: EAPOL integer variable to set
|
|
|
|
* @value: Value for the EAPOL variable
|
|
|
|
*/
|
|
|
|
void (*set_int)(void *ctx, enum eapol_int_var variable,
|
|
|
|
unsigned int value);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* get_eapReqData - Get EAP-Request data
|
|
|
|
* @ctx: eapol_ctx from eap_peer_sm_init() call
|
|
|
|
* @len: Pointer to variable that will be set to eapReqDataLen
|
|
|
|
* Returns: Reference to eapReqData (EAP state machine will not free
|
|
|
|
* this) or %NULL if eapReqData not available.
|
|
|
|
*/
|
|
|
|
struct wpabuf * (*get_eapReqData)(void *ctx);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* set_config_blob - Set named configuration blob
|
|
|
|
* @ctx: eapol_ctx from eap_peer_sm_init() call
|
|
|
|
* @blob: New value for the blob
|
|
|
|
*
|
|
|
|
* Adds a new configuration blob or replaces the current value of an
|
|
|
|
* existing blob.
|
|
|
|
*/
|
|
|
|
void (*set_config_blob)(void *ctx, struct wpa_config_blob *blob);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* get_config_blob - Get a named configuration blob
|
|
|
|
* @ctx: eapol_ctx from eap_peer_sm_init() call
|
|
|
|
* @name: Name of the blob
|
|
|
|
* Returns: Pointer to blob data or %NULL if not found
|
|
|
|
*/
|
|
|
|
const struct wpa_config_blob * (*get_config_blob)(void *ctx,
|
|
|
|
const char *name);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* notify_pending - Notify that a pending request can be retried
|
|
|
|
* @ctx: eapol_ctx from eap_peer_sm_init() call
|
|
|
|
*
|
|
|
|
* An EAP method can perform a pending operation (e.g., to get a
|
|
|
|
* response from an external process). Once the response is available,
|
|
|
|
* this callback function can be used to request EAPOL state machine to
|
|
|
|
* retry delivering the previously received (and still unanswered) EAP
|
|
|
|
* request to EAP state machine.
|
|
|
|
*/
|
|
|
|
void (*notify_pending)(void *ctx);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* eap_param_needed - Notify that EAP parameter is needed
|
|
|
|
* @ctx: eapol_ctx from eap_peer_sm_init() call
|
2011-10-24 18:00:19 +02:00
|
|
|
* @field: Field indicator (e.g., WPA_CTRL_REQ_EAP_IDENTITY)
|
2008-02-28 02:34:43 +01:00
|
|
|
* @txt: User readable text describing the required parameter
|
|
|
|
*/
|
2011-10-24 18:00:19 +02:00
|
|
|
void (*eap_param_needed)(void *ctx, enum wpa_ctrl_req_type field,
|
2008-02-28 02:34:43 +01:00
|
|
|
const char *txt);
|
2011-07-05 11:22:32 +02:00
|
|
|
|
|
|
|
/**
|
|
|
|
* notify_cert - Notification of a peer certificate
|
|
|
|
* @ctx: eapol_ctx from eap_peer_sm_init() call
|
2019-06-11 03:20:18 +02:00
|
|
|
* @cert: Certificate information
|
2011-07-05 11:22:32 +02:00
|
|
|
* @cert_hash: SHA-256 hash of the certificate
|
|
|
|
*/
|
2019-06-11 03:20:18 +02:00
|
|
|
void (*notify_cert)(void *ctx, struct tls_cert_data *cert,
|
|
|
|
const char *cert_hash);
|
2012-06-04 20:10:01 +02:00
|
|
|
|
|
|
|
/**
|
|
|
|
* notify_status - Notification of the current EAP state
|
|
|
|
* @ctx: eapol_ctx from eap_peer_sm_init() call
|
|
|
|
* @status: Step in the process of EAP authentication
|
|
|
|
* @parameter: Step-specific parameter, e.g., EAP method name
|
|
|
|
*/
|
|
|
|
void (*notify_status)(void *ctx, const char *status,
|
|
|
|
const char *parameter);
|
2012-09-02 12:04:18 +02:00
|
|
|
|
2018-03-15 17:00:10 +01:00
|
|
|
/**
|
|
|
|
* notify_eap_error - Report EAP method error code
|
|
|
|
* @ctx: eapol_ctx from eap_peer_sm_init() call
|
|
|
|
* @error_code: Error code from the used EAP method
|
|
|
|
*/
|
|
|
|
void (*notify_eap_error)(void *ctx, int error_code);
|
|
|
|
|
2015-02-26 11:24:37 +01:00
|
|
|
#ifdef CONFIG_EAP_PROXY
|
|
|
|
/**
|
|
|
|
* eap_proxy_cb - Callback signifying any updates from eap_proxy
|
|
|
|
* @ctx: eapol_ctx from eap_peer_sm_init() call
|
|
|
|
*/
|
|
|
|
void (*eap_proxy_cb)(void *ctx);
|
2016-12-13 14:00:21 +01:00
|
|
|
|
|
|
|
/**
|
|
|
|
* eap_proxy_notify_sim_status - Notification of SIM status change
|
|
|
|
* @ctx: eapol_ctx from eap_peer_sm_init() call
|
|
|
|
* @sim_state: One of enum value from sim_state
|
|
|
|
*/
|
|
|
|
void (*eap_proxy_notify_sim_status)(void *ctx,
|
|
|
|
enum eap_proxy_sim_state sim_state);
|
2017-06-02 15:08:20 +02:00
|
|
|
|
|
|
|
/**
|
|
|
|
* get_imsi - Get the IMSI value from eap_proxy
|
|
|
|
* @ctx: eapol_ctx from eap_peer_sm_init() call
|
2017-06-02 15:08:20 +02:00
|
|
|
* @sim_num: SIM/USIM number to get the IMSI value for
|
2017-06-02 15:08:20 +02:00
|
|
|
* @imsi: Buffer for IMSI value
|
|
|
|
* @len: Buffer for returning IMSI length in octets
|
|
|
|
* Returns: MNC length (2 or 3) or -1 on error
|
|
|
|
*/
|
2017-06-02 15:08:20 +02:00
|
|
|
int (*get_imsi)(void *ctx, int sim_num, char *imsi, size_t *len);
|
2015-02-26 11:24:37 +01:00
|
|
|
#endif /* CONFIG_EAP_PROXY */
|
|
|
|
|
2012-09-02 12:04:18 +02:00
|
|
|
/**
|
|
|
|
* set_anon_id - Set or add anonymous identity
|
|
|
|
* @ctx: eapol_ctx from eap_peer_sm_init() call
|
|
|
|
* @id: Anonymous identity (e.g., EAP-SIM pseudonym) or %NULL to clear
|
|
|
|
* @len: Length of anonymous identity in octets
|
|
|
|
*/
|
|
|
|
void (*set_anon_id)(void *ctx, const u8 *id, size_t len);
|
2008-02-28 02:34:43 +01:00
|
|
|
};
|
|
|
|
|
|
|
|
/**
|
|
|
|
* struct eap_config - Configuration for EAP state machine
|
|
|
|
*/
|
|
|
|
struct eap_config {
|
|
|
|
/**
|
|
|
|
* opensc_engine_path - OpenSC engine for OpenSSL engine support
|
|
|
|
*
|
|
|
|
* Usually, path to engine_opensc.so.
|
|
|
|
*/
|
|
|
|
const char *opensc_engine_path;
|
|
|
|
/**
|
|
|
|
* pkcs11_engine_path - PKCS#11 engine for OpenSSL engine support
|
|
|
|
*
|
|
|
|
* Usually, path to engine_pkcs11.so.
|
|
|
|
*/
|
|
|
|
const char *pkcs11_engine_path;
|
|
|
|
/**
|
|
|
|
* pkcs11_module_path - OpenSC PKCS#11 module for OpenSSL engine
|
|
|
|
*
|
|
|
|
* Usually, path to opensc-pkcs11.so.
|
|
|
|
*/
|
|
|
|
const char *pkcs11_module_path;
|
2014-10-12 10:53:51 +02:00
|
|
|
/**
|
|
|
|
* openssl_ciphers - OpenSSL cipher string
|
|
|
|
*
|
|
|
|
* This is an OpenSSL specific configuration option for configuring the
|
|
|
|
* default ciphers. If not set, "DEFAULT:!EXP:!LOW" is used as the
|
|
|
|
* default.
|
|
|
|
*/
|
|
|
|
const char *openssl_ciphers;
|
2008-11-28 19:32:13 +01:00
|
|
|
/**
|
|
|
|
* wps - WPS context data
|
|
|
|
*
|
|
|
|
* This is only used by EAP-WSC and can be left %NULL if not available.
|
|
|
|
*/
|
|
|
|
struct wps_context *wps;
|
2011-09-17 21:42:54 +02:00
|
|
|
|
|
|
|
/**
|
|
|
|
* cert_in_cb - Include server certificates in callback
|
|
|
|
*/
|
|
|
|
int cert_in_cb;
|
2008-02-28 02:34:43 +01:00
|
|
|
};
|
|
|
|
|
|
|
|
struct eap_sm * eap_peer_sm_init(void *eapol_ctx,
|
2015-04-24 09:19:53 +02:00
|
|
|
const struct eapol_callbacks *eapol_cb,
|
2008-02-28 02:34:43 +01:00
|
|
|
void *msg_ctx, struct eap_config *conf);
|
|
|
|
void eap_peer_sm_deinit(struct eap_sm *sm);
|
|
|
|
int eap_peer_sm_step(struct eap_sm *sm);
|
|
|
|
void eap_sm_abort(struct eap_sm *sm);
|
|
|
|
int eap_sm_get_status(struct eap_sm *sm, char *buf, size_t buflen,
|
|
|
|
int verbose);
|
2011-03-15 12:47:33 +01:00
|
|
|
const char * eap_sm_get_method_name(struct eap_sm *sm);
|
2008-02-28 02:34:43 +01:00
|
|
|
struct wpabuf * eap_sm_buildIdentity(struct eap_sm *sm, int id, int encrypted);
|
|
|
|
void eap_sm_request_identity(struct eap_sm *sm);
|
|
|
|
void eap_sm_request_password(struct eap_sm *sm);
|
|
|
|
void eap_sm_request_new_password(struct eap_sm *sm);
|
|
|
|
void eap_sm_request_pin(struct eap_sm *sm);
|
|
|
|
void eap_sm_request_otp(struct eap_sm *sm, const char *msg, size_t msg_len);
|
|
|
|
void eap_sm_request_passphrase(struct eap_sm *sm);
|
2013-10-19 16:32:05 +02:00
|
|
|
void eap_sm_request_sim(struct eap_sm *sm, const char *req);
|
2008-02-28 02:34:43 +01:00
|
|
|
void eap_sm_notify_ctrl_attached(struct eap_sm *sm);
|
|
|
|
u32 eap_get_phase2_type(const char *name, int *vendor);
|
|
|
|
struct eap_method_type * eap_get_phase2_types(struct eap_peer_config *config,
|
|
|
|
size_t *count);
|
|
|
|
void eap_set_fast_reauth(struct eap_sm *sm, int enabled);
|
|
|
|
void eap_set_workaround(struct eap_sm *sm, unsigned int workaround);
|
|
|
|
void eap_set_force_disabled(struct eap_sm *sm, int disabled);
|
2013-10-19 16:32:05 +02:00
|
|
|
void eap_set_external_sim(struct eap_sm *sm, int external_sim);
|
2008-02-28 02:34:43 +01:00
|
|
|
int eap_key_available(struct eap_sm *sm);
|
|
|
|
void eap_notify_success(struct eap_sm *sm);
|
|
|
|
void eap_notify_lower_layer_success(struct eap_sm *sm);
|
2013-02-06 17:52:33 +01:00
|
|
|
const u8 * eap_get_eapSessionId(struct eap_sm *sm, size_t *len);
|
2008-02-28 02:34:43 +01:00
|
|
|
const u8 * eap_get_eapKeyData(struct eap_sm *sm, size_t *len);
|
|
|
|
struct wpabuf * eap_get_eapRespData(struct eap_sm *sm);
|
|
|
|
void eap_register_scard_ctx(struct eap_sm *sm, void *ctx);
|
|
|
|
void eap_invalidate_cached_session(struct eap_sm *sm);
|
|
|
|
|
2008-11-23 18:34:26 +01:00
|
|
|
int eap_is_wps_pbc_enrollee(struct eap_peer_config *conf);
|
|
|
|
int eap_is_wps_pin_enrollee(struct eap_peer_config *conf);
|
|
|
|
|
2012-08-03 20:47:31 +02:00
|
|
|
struct ext_password_data;
|
|
|
|
void eap_sm_set_ext_pw_ctx(struct eap_sm *sm, struct ext_password_data *ext);
|
2012-09-02 12:04:18 +02:00
|
|
|
void eap_set_anon_id(struct eap_sm *sm, const u8 *id, size_t len);
|
2014-01-08 09:24:05 +01:00
|
|
|
int eap_peer_was_failure_expected(struct eap_sm *sm);
|
2014-12-01 00:11:29 +01:00
|
|
|
void eap_peer_erp_free_keys(struct eap_sm *sm);
|
2015-09-09 22:39:48 +02:00
|
|
|
struct wpabuf * eap_peer_build_erp_reauth_start(struct eap_sm *sm, u8 eap_id);
|
2015-09-10 20:34:15 +02:00
|
|
|
void eap_peer_finish(struct eap_sm *sm, const struct eap_hdr *hdr, size_t len);
|
2017-03-22 11:40:05 +01:00
|
|
|
int eap_peer_get_erp_info(struct eap_sm *sm, struct eap_peer_config *config,
|
|
|
|
const u8 **username, size_t *username_len,
|
|
|
|
const u8 **realm, size_t *realm_len, u16 *erp_seq_num,
|
|
|
|
const u8 **rrk, size_t *rrk_len);
|
|
|
|
int eap_peer_update_erp_next_seq_num(struct eap_sm *sm, u16 seq_num);
|
2017-05-15 16:28:25 +02:00
|
|
|
void eap_peer_erp_init(struct eap_sm *sm, u8 *ext_session_id,
|
|
|
|
size_t ext_session_id_len, u8 *ext_emsk,
|
|
|
|
size_t ext_emsk_len);
|
2012-08-03 20:47:31 +02:00
|
|
|
|
2008-02-28 02:34:43 +01:00
|
|
|
#endif /* IEEE8021X_EAPOL */
|
|
|
|
|
|
|
|
#endif /* EAP_H */
|