1 /* 2 * hostapd / EAP Full Authenticator state machine (RFC 4137) 3 * Copyright (c) 2004-2014, Jouni Malinen <j (at) w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #ifndef EAP_H 10 #define EAP_H 11 12 #include "common/defs.h" 13 #include "utils/list.h" 14 #include "eap_common/eap_defs.h" 15 #include "eap_server/eap_methods.h" 16 #include "wpabuf.h" 17 18 struct eap_sm; 19 20 #define EAP_TTLS_AUTH_PAP 1 21 #define EAP_TTLS_AUTH_CHAP 2 22 #define EAP_TTLS_AUTH_MSCHAP 4 23 #define EAP_TTLS_AUTH_MSCHAPV2 8 24 25 struct eap_user { 26 struct { 27 int vendor; 28 u32 method; 29 } methods[EAP_MAX_METHODS]; 30 u8 *password; 31 size_t password_len; 32 int password_hash; /* whether password is hashed with 33 * nt_password_hash() */ 34 int phase2; 35 int force_version; 36 unsigned int remediation:1; 37 unsigned int macacl:1; 38 int ttls_auth; /* bitfield of 39 * EAP_TTLS_AUTH_{PAP,CHAP,MSCHAP,MSCHAPV2} */ 40 struct hostapd_radius_attr *accept_attr; 41 }; 42 43 struct eap_eapol_interface { 44 /* Lower layer to full authenticator variables */ 45 Boolean eapResp; /* shared with EAPOL Backend Authentication */ 46 struct wpabuf *eapRespData; 47 Boolean portEnabled; 48 int retransWhile; 49 Boolean eapRestart; /* shared with EAPOL Authenticator PAE */ 50 int eapSRTT; 51 int eapRTTVAR; 52 53 /* Full authenticator to lower layer variables */ 54 Boolean eapReq; /* shared with EAPOL Backend Authentication */ 55 Boolean eapNoReq; /* shared with EAPOL Backend Authentication */ 56 Boolean eapSuccess; 57 Boolean eapFail; 58 Boolean eapTimeout; 59 struct wpabuf *eapReqData; 60 u8 *eapKeyData; 61 size_t eapKeyDataLen; 62 u8 *eapSessionId; 63 size_t eapSessionIdLen; 64 Boolean eapKeyAvailable; /* called keyAvailable in IEEE 802.1X-2004 */ 65 66 /* AAA interface to full authenticator variables */ 67 Boolean aaaEapReq; 68 Boolean aaaEapNoReq; 69 Boolean aaaSuccess; 70 Boolean aaaFail; 71 struct wpabuf *aaaEapReqData; 72 u8 *aaaEapKeyData; 73 size_t aaaEapKeyDataLen; 74 Boolean aaaEapKeyAvailable; 75 int aaaMethodTimeout; 76 77 /* Full authenticator to AAA interface variables */ 78 Boolean aaaEapResp; 79 struct wpabuf *aaaEapRespData; 80 /* aaaIdentity -> eap_get_identity() */ 81 Boolean aaaTimeout; 82 }; 83 84 struct eap_server_erp_key { 85 struct dl_list list; 86 size_t rRK_len; 87 size_t rIK_len; 88 u8 rRK[ERP_MAX_KEY_LEN]; 89 u8 rIK[ERP_MAX_KEY_LEN]; 90 u32 recv_seq; 91 u8 cryptosuite; 92 char keyname_nai[]; 93 }; 94 95 struct eapol_callbacks { 96 int (*get_eap_user)(void *ctx, const u8 *identity, size_t identity_len, 97 int phase2, struct eap_user *user); 98 const char * (*get_eap_req_id_text)(void *ctx, size_t *len); 99 void (*log_msg)(void *ctx, const char *msg); 100 int (*get_erp_send_reauth_start)(void *ctx); 101 const char * (*get_erp_domain)(void *ctx); 102 struct eap_server_erp_key * (*erp_get_key)(void *ctx, 103 const char *keyname); 104 int (*erp_add_key)(void *ctx, struct eap_server_erp_key *erp); 105 }; 106 107 struct eap_config { 108 void *ssl_ctx; 109 void *msg_ctx; 110 void *eap_sim_db_priv; 111 Boolean backend_auth; 112 int eap_server; 113 u16 pwd_group; 114 u8 *pac_opaque_encr_key; 115 u8 *eap_fast_a_id; 116 size_t eap_fast_a_id_len; 117 char *eap_fast_a_id_info; 118 int eap_fast_prov; 119 int pac_key_lifetime; 120 int pac_key_refresh_time; 121 int eap_sim_aka_result_ind; 122 int tnc; 123 struct wps_context *wps; 124 const struct wpabuf *assoc_wps_ie; 125 const struct wpabuf *assoc_p2p_ie; 126 const u8 *peer_addr; 127 int fragment_size; 128 129 int pbc_in_m1; 130 131 const u8 *server_id; 132 size_t server_id_len; 133 int erp; 134 unsigned int tls_session_lifetime; 135 unsigned int tls_flags; 136 137 #ifdef CONFIG_TESTING_OPTIONS 138 u32 tls_test_flags; 139 #endif /* CONFIG_TESTING_OPTIONS */ 140 }; 141 142 143 struct eap_sm * eap_server_sm_init(void *eapol_ctx, 144 const struct eapol_callbacks *eapol_cb, 145 struct eap_config *eap_conf); 146 void eap_server_sm_deinit(struct eap_sm *sm); 147 int eap_server_sm_step(struct eap_sm *sm); 148 void eap_sm_notify_cached(struct eap_sm *sm); 149 void eap_sm_pending_cb(struct eap_sm *sm); 150 int eap_sm_method_pending(struct eap_sm *sm); 151 const u8 * eap_get_identity(struct eap_sm *sm, size_t *len); 152 struct eap_eapol_interface * eap_get_interface(struct eap_sm *sm); 153 void eap_server_clear_identity(struct eap_sm *sm); 154 void eap_server_mschap_rx_callback(struct eap_sm *sm, const char *source, 155 const u8 *username, size_t username_len, 156 const u8 *challenge, const u8 *response); 157 void eap_erp_update_identity(struct eap_sm *sm, const u8 *eap, size_t len); 158 159 #endif /* EAP_H */ 160
