1 /* 2 * EAP peer state machine functions (RFC 4137) 3 * Copyright (c) 2004-2006, Jouni Malinen <j (at) w1.fi> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 * Alternatively, this software may be distributed under the terms of BSD 10 * license. 11 * 12 * See README and COPYING for more details. 13 */ 14 15 #ifndef EAP_H 16 #define EAP_H 17 18 #include "defs.h" 19 #include "eap_defs.h" 20 #include "eap_methods.h" 21 22 struct eap_sm; 23 struct wpa_ssid; 24 struct wpa_config_blob; 25 26 struct eap_method_type { 27 int vendor; 28 u32 method; 29 }; 30 31 #ifdef IEEE8021X_EAPOL 32 33 /** 34 * enum eapol_bool_var - EAPOL boolean state variables for EAP state machine 35 * 36 * These variables are used in the interface between EAP peer state machine and 37 * lower layer. These are defined in RFC 4137, Sect. 4.1. Lower layer code is 38 * expected to maintain these variables and register a callback functions for 39 * EAP state machine to get and set the variables. 40 */ 41 enum eapol_bool_var { 42 /** 43 * EAPOL_eapSuccess - EAP SUCCESS state reached 44 * 45 * EAP state machine reads and writes this value. 46 */ 47 EAPOL_eapSuccess, 48 49 /** 50 * EAPOL_eapRestart - Lower layer request to restart authentication 51 * 52 * Set to TRUE in lower layer, FALSE in EAP state machine. 53 */ 54 EAPOL_eapRestart, 55 56 /** 57 * EAPOL_eapFail - EAP FAILURE state reached 58 * 59 * EAP state machine writes this value. 60 */ 61 EAPOL_eapFail, 62 63 /** 64 * EAPOL_eapResp - Response to send 65 * 66 * Set to TRUE in EAP state machine, FALSE in lower layer. 67 */ 68 EAPOL_eapResp, 69 70 /** 71 * EAPOL_eapNoResp - Request has been process; no response to send 72 * 73 * Set to TRUE in EAP state machine, FALSE in lower layer. 74 */ 75 EAPOL_eapNoResp, 76 77 /** 78 * EAPOL_eapReq - EAP request available from lower layer 79 * 80 * Set to TRUE in lower layer, FALSE in EAP state machine. 81 */ 82 EAPOL_eapReq, 83 84 /** 85 * EAPOL_portEnabled - Lower layer is ready for communication 86 * 87 * EAP state machines reads this value. 88 */ 89 EAPOL_portEnabled, 90 91 /** 92 * EAPOL_altAccept - Alternate indication of success (RFC3748) 93 * 94 * EAP state machines reads this value. 95 */ 96 EAPOL_altAccept, 97 98 /** 99 * EAPOL_altReject - Alternate indication of failure (RFC3748) 100 * 101 * EAP state machines reads this value. 102 */ 103 EAPOL_altReject 104 }; 105 106 /** 107 * enum eapol_int_var - EAPOL integer state variables for EAP state machine 108 * 109 * These variables are used in the interface between EAP peer state machine and 110 * lower layer. These are defined in RFC 4137, Sect. 4.1. Lower layer code is 111 * expected to maintain these variables and register a callback functions for 112 * EAP state machine to get and set the variables. 113 */ 114 enum eapol_int_var { 115 /** 116 * EAPOL_idleWhile - Outside time for EAP peer timeout 117 * 118 * This integer variable is used to provide an outside timer that the 119 * external (to EAP state machine) code must decrement by one every 120 * second until the value reaches zero. This is used in the same way as 121 * EAPOL state machine timers. EAP state machine reads and writes this 122 * value. 123 */ 124 EAPOL_idleWhile 125 }; 126 127 /** 128 * struct eapol_callbacks - Callback functions from EAP to lower layer 129 * 130 * This structure defines the callback functions that EAP state machine 131 * requires from the lower layer (usually EAPOL state machine) for updating 132 * state variables and requesting information. eapol_ctx from eap_sm_init() 133 * call will be used as the ctx parameter for these callback functions. 134 */ 135 struct eapol_callbacks { 136 /** 137 * get_config - Get pointer to the current network configuration 138 * @ctx: eapol_ctx from eap_sm_init() call 139 */ 140 struct wpa_ssid * (*get_config)(void *ctx); 141 142 /** 143 * get_bool - Get a boolean EAPOL state variable 144 * @variable: EAPOL boolean variable to get 145 * Returns: Value of the EAPOL variable 146 */ 147 Boolean (*get_bool)(void *ctx, enum eapol_bool_var variable); 148 149 /** 150 * set_bool - Set a boolean EAPOL state variable 151 * @ctx: eapol_ctx from eap_sm_init() call 152 * @variable: EAPOL boolean variable to set 153 * @value: Value for the EAPOL variable 154 */ 155 void (*set_bool)(void *ctx, enum eapol_bool_var variable, 156 Boolean value); 157 158 /** 159 * get_int - Get an integer EAPOL state variable 160 * @ctx: eapol_ctx from eap_sm_init() call 161 * @variable: EAPOL integer variable to get 162 * Returns: Value of the EAPOL variable 163 */ 164 unsigned int (*get_int)(void *ctx, enum eapol_int_var variable); 165 166 /** 167 * set_int - Set an integer EAPOL state variable 168 * @ctx: eapol_ctx from eap_sm_init() call 169 * @variable: EAPOL integer variable to set 170 * @value: Value for the EAPOL variable 171 */ 172 void (*set_int)(void *ctx, enum eapol_int_var variable, 173 unsigned int value); 174 175 /** 176 * get_eapReqData - Get EAP-Request data 177 * @ctx: eapol_ctx from eap_sm_init() call 178 * @len: Pointer to variable that will be set to eapReqDataLen 179 * Returns: Reference to eapReqData (EAP state machine will not free 180 * this) or %NULL if eapReqData not available. 181 */ 182 u8 * (*get_eapReqData)(void *ctx, size_t *len); 183 184 /** 185 * set_config_blob - Set named configuration blob 186 * @ctx: eapol_ctx from eap_sm_init() call 187 * @blob: New value for the blob 188 * 189 * Adds a new configuration blob or replaces the current value of an 190 * existing blob. 191 */ 192 void (*set_config_blob)(void *ctx, struct wpa_config_blob *blob); 193 194 /** 195 * get_config_blob - Get a named configuration blob 196 * @ctx: eapol_ctx from eap_sm_init() call 197 * @name: Name of the blob 198 * Returns: Pointer to blob data or %NULL if not found 199 */ 200 const struct wpa_config_blob * (*get_config_blob)(void *ctx, 201 const char *name); 202 203 /** 204 * notify_pending - Notify that a pending request can be retried 205 * @ctx: eapol_ctx from eap_sm_init() call 206 * 207 * An EAP method can perform a pending operation (e.g., to get a 208 * response from an external process). Once the response is available, 209 * this callback function can be used to request EAPOL state machine to 210 * retry delivering the previously received (and still unanswered) EAP 211 * request to EAP state machine. 212 */ 213 void (*notify_pending)(void *ctx); 214 }; 215 216 /** 217 * struct eap_config - Configuration for EAP state machine 218 */ 219 struct eap_config { 220 /** 221 * opensc_engine_path - OpenSC engine for OpenSSL engine support 222 * 223 * Usually, path to engine_opensc.so. 224 */ 225 const char *opensc_engine_path; 226 /** 227 * pkcs11_engine_path - PKCS#11 engine for OpenSSL engine support 228 * 229 * Usually, path to engine_pkcs11.so. 230 */ 231 const char *pkcs11_engine_path; 232 /** 233 * pkcs11_module_path - OpenSC PKCS#11 module for OpenSSL engine 234 * 235 * Usually, path to opensc-pkcs11.so. 236 */ 237 const char *pkcs11_module_path; 238 }; 239 240 struct eap_sm * eap_sm_init(void *eapol_ctx, struct eapol_callbacks *eapol_cb, 241 void *msg_ctx, struct eap_config *conf); 242 void eap_sm_deinit(struct eap_sm *sm); 243 int eap_sm_step(struct eap_sm *sm); 244 void eap_sm_abort(struct eap_sm *sm); 245 int eap_sm_get_status(struct eap_sm *sm, char *buf, size_t buflen, 246 int verbose); 247 u8 * eap_sm_buildIdentity(struct eap_sm *sm, int id, size_t *len, 248 int encrypted); 249 void eap_sm_request_identity(struct eap_sm *sm); 250 void eap_sm_request_password(struct eap_sm *sm); 251 void eap_sm_request_new_password(struct eap_sm *sm); 252 void eap_sm_request_pin(struct eap_sm *sm); 253 void eap_sm_request_otp(struct eap_sm *sm, const char *msg, size_t msg_len); 254 void eap_sm_request_passphrase(struct eap_sm *sm); 255 void eap_sm_notify_ctrl_attached(struct eap_sm *sm); 256 u32 eap_get_phase2_type(const char *name, int *vendor); 257 struct eap_method_type * eap_get_phase2_types(struct wpa_ssid *config, 258 size_t *count); 259 void eap_set_fast_reauth(struct eap_sm *sm, int enabled); 260 void eap_set_workaround(struct eap_sm *sm, unsigned int workaround); 261 void eap_set_force_disabled(struct eap_sm *sm, int disabled); 262 int eap_key_available(struct eap_sm *sm); 263 void eap_notify_success(struct eap_sm *sm); 264 void eap_notify_lower_layer_success(struct eap_sm *sm); 265 const u8 * eap_get_eapKeyData(struct eap_sm *sm, size_t *len); 266 u8 * eap_get_eapRespData(struct eap_sm *sm, size_t *len); 267 void eap_register_scard_ctx(struct eap_sm *sm, void *ctx); 268 void eap_invalidate_cached_session(struct eap_sm *sm); 269 270 #endif /* IEEE8021X_EAPOL */ 271 272 #endif /* EAP_H */ 273
