2 * hostapd / IEEE 802.1X-2004 Authenticator - EAPOL state machine
3 * Copyright (c) 2002-2007, Jouni Malinen <j@w1.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Alternatively, this software may be distributed under the terms of BSD
12 * See README and COPYING for more details.
20 /* IEEE Std 802.1X-2004, Ch. 8.2 */
22 typedef enum { ForceUnauthorized
= 1, ForceAuthorized
= 3, Auto
= 2 }
24 typedef enum { Unauthorized
= 2, Authorized
= 1 } PortState
;
25 typedef enum { Both
= 0, In
= 1 } ControlledDirection
;
26 typedef unsigned int Counter
;
30 struct radius_attr_data
{
35 struct radius_class_data
{
36 struct radius_attr_data
*attr
;
41 struct eapol_auth_config
{
42 int eap_reauth_period
;
44 int individual_wep_key_len
;
47 void *eap_sim_db_priv
;
48 char *eap_req_id_text
; /* a copy of this will be allocated */
49 size_t eap_req_id_text_len
;
50 u8
*pac_opaque_encr_key
;
52 size_t eap_fast_a_id_len
;
53 char *eap_fast_a_id_info
;
56 int pac_key_refresh_time
;
57 int eap_sim_aka_result_ind
;
59 struct wps_context
*wps
;
62 * Pointer to hostapd data. This is a temporary workaround for
63 * transition phase and will be removed once IEEE 802.1X/EAPOL code is
64 * separated more cleanly from rest of hostapd.
66 struct hostapd_data
*hapd
;
72 EAPOL_LOGGER_DEBUG
, EAPOL_LOGGER_INFO
, EAPOL_LOGGER_WARNING
75 struct eapol_auth_cb
{
76 void (*eapol_send
)(void *ctx
, void *sta_ctx
, u8 type
, const u8
*data
,
78 void (*aaa_send
)(void *ctx
, void *sta_ctx
, const u8
*data
,
80 void (*finished
)(void *ctx
, void *sta_ctx
, int success
, int preauth
);
81 int (*get_eap_user
)(void *ctx
, const u8
*identity
, size_t identity_len
,
82 int phase2
, struct eap_user
*user
);
83 int (*sta_entry_alive
)(void *ctx
, const u8
*addr
);
84 void (*logger
)(void *ctx
, const u8
*addr
, eapol_logger_level level
,
86 void (*set_port_authorized
)(void *ctx
, void *sta_ctx
, int authorized
);
87 void (*abort_auth
)(void *ctx
, void *sta_ctx
);
88 void (*tx_key
)(void *ctx
, void *sta_ctx
);
92 * struct eapol_authenticator - Global EAPOL authenticator data
94 struct eapol_authenticator
{
95 struct eapol_auth_config conf
;
96 struct eapol_auth_cb cb
;
101 * struct eapol_state_machine - Per-Supplicant Authenticator state machines
103 struct eapol_state_machine
{
109 /* global variables */
112 PortState authPortStatus
;
120 Boolean keyTxEnabled
;
121 PortTypes portControl
;
123 Boolean reAuthenticate
;
125 /* Port Timers state machine */
126 /* 'Boolean tick' implicitly handled as registered timeout */
128 /* Authenticator PAE state machine */
129 enum { AUTH_PAE_INITIALIZE
, AUTH_PAE_DISCONNECTED
, AUTH_PAE_CONNECTING
,
130 AUTH_PAE_AUTHENTICATING
, AUTH_PAE_AUTHENTICATED
,
131 AUTH_PAE_ABORTING
, AUTH_PAE_HELD
, AUTH_PAE_FORCE_AUTH
,
132 AUTH_PAE_FORCE_UNAUTH
, AUTH_PAE_RESTART
} auth_pae_state
;
137 unsigned int reAuthCount
;
139 unsigned int quietPeriod
; /* default 60; 0..65535 */
140 #define AUTH_PAE_DEFAULT_quietPeriod 60
141 unsigned int reAuthMax
; /* default 2 */
142 #define AUTH_PAE_DEFAULT_reAuthMax 2
144 Counter authEntersConnecting
;
145 Counter authEapLogoffsWhileConnecting
;
146 Counter authEntersAuthenticating
;
147 Counter authAuthSuccessesWhileAuthenticating
;
148 Counter authAuthTimeoutsWhileAuthenticating
;
149 Counter authAuthFailWhileAuthenticating
;
150 Counter authAuthEapStartsWhileAuthenticating
;
151 Counter authAuthEapLogoffWhileAuthenticating
;
152 Counter authAuthReauthsWhileAuthenticated
;
153 Counter authAuthEapStartsWhileAuthenticated
;
154 Counter authAuthEapLogoffWhileAuthenticated
;
156 /* Backend Authentication state machine */
157 enum { BE_AUTH_REQUEST
, BE_AUTH_RESPONSE
, BE_AUTH_SUCCESS
,
158 BE_AUTH_FAIL
, BE_AUTH_TIMEOUT
, BE_AUTH_IDLE
, BE_AUTH_INITIALIZE
,
162 unsigned int serverTimeout
; /* default 30; 1..X */
163 #define BE_AUTH_DEFAULT_serverTimeout 30
165 Counter backendResponses
;
166 Counter backendAccessChallenges
;
167 Counter backendOtherRequestsToSupplicant
;
168 Counter backendAuthSuccesses
;
169 Counter backendAuthFails
;
171 /* Reauthentication Timer state machine */
172 enum { REAUTH_TIMER_INITIALIZE
, REAUTH_TIMER_REAUTHENTICATE
173 } reauth_timer_state
;
175 unsigned int reAuthPeriod
; /* default 3600 s */
176 Boolean reAuthEnabled
;
178 /* Authenticator Key Transmit state machine */
179 enum { AUTH_KEY_TX_NO_KEY_TRANSMIT
, AUTH_KEY_TX_KEY_TRANSMIT
182 /* Key Receive state machine */
183 enum { KEY_RX_NO_KEY_RECEIVE
, KEY_RX_KEY_RECEIVE
} key_rx_state
;
187 /* Controlled Directions state machine */
188 enum { CTRL_DIR_FORCE_BOTH
, CTRL_DIR_IN_OR_BOTH
} ctrl_dir_state
;
190 ControlledDirection adminControlledDirections
;
191 ControlledDirection operControlledDirections
;
194 /* Authenticator Statistics Table */
195 Counter dot1xAuthEapolFramesRx
;
196 Counter dot1xAuthEapolFramesTx
;
197 Counter dot1xAuthEapolStartFramesRx
;
198 Counter dot1xAuthEapolLogoffFramesRx
;
199 Counter dot1xAuthEapolRespIdFramesRx
;
200 Counter dot1xAuthEapolRespFramesRx
;
201 Counter dot1xAuthEapolReqIdFramesTx
;
202 Counter dot1xAuthEapolReqFramesTx
;
203 Counter dot1xAuthInvalidEapolFramesRx
;
204 Counter dot1xAuthEapLengthErrorFramesRx
;
205 Counter dot1xAuthLastEapolFrameVersion
;
207 /* Other variables - not defined in IEEE 802.1X */
208 u8 addr
[ETH_ALEN
]; /* Supplicant address */
209 #define EAPOL_SM_PREAUTH BIT(0)
210 #define EAPOL_SM_WAIT_START BIT(1)
211 int flags
; /* EAPOL_SM_* */
213 /* EAPOL/AAA <-> EAP full authenticator interface */
214 struct eap_eapol_interface
*eap_if
;
216 int radius_identifier
;
217 /* TODO: check when the last messages can be released */
218 struct radius_msg
*last_recv_radius
;
219 u8 last_eap_id
; /* last used EAP Identifier */
222 u8 eap_type_authsrv
; /* EAP type of the last EAP packet from
223 * Authentication server */
224 u8 eap_type_supp
; /* EAP type of the last EAP packet from Supplicant */
225 struct radius_class_data radius_class
;
227 /* Keys for encrypting and signing EAPOL-Key frames */
229 size_t eapol_key_sign_len
;
231 size_t eapol_key_crypt_len
;
235 Boolean initializing
; /* in process of initializing state machines */
238 struct eapol_authenticator
*eapol
;
240 /* Somewhat nasty pointers to global hostapd and STA data to avoid
241 * passing these to every function */
242 struct hostapd_data
*hapd
;
243 struct sta_info
*sta
;
247 struct eapol_authenticator
* eapol_auth_init(struct eapol_auth_config
*conf
,
248 struct eapol_auth_cb
*cb
);
249 void eapol_auth_deinit(struct eapol_authenticator
*eapol
);
250 struct eapol_state_machine
*
251 eapol_auth_alloc(struct eapol_authenticator
*eapol
, const u8
*addr
,
252 int preauth
, struct sta_info
*sta
);
253 void eapol_auth_free(struct eapol_state_machine
*sm
);
254 void eapol_auth_step(struct eapol_state_machine
*sm
);
255 void eapol_auth_initialize(struct eapol_state_machine
*sm
);
256 void eapol_auth_dump_state(FILE *f
, const char *prefix
,
257 struct eapol_state_machine
*sm
);
258 int eapol_auth_eap_pending_cb(struct eapol_state_machine
*sm
, void *ctx
);
260 #endif /* EAPOL_SM_H */