?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
hostapd: Update vendor branch to 0.6.10
[dragonfly.git] / contrib / hostapd / hostapd / eapol_sm.c
blob8e9d56c7964fba811f6d2b7c9de4fc06d492d5f6
1 /*
2 * hostapd / IEEE 802.1X-2004 Authenticator - EAPOL state machine
3 * Copyright (c) 2002-2008, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 */
14
15 #include "includes.h"
16
17 #include "hostapd.h"
18 #include "ieee802_1x.h"
19 #include "eapol_sm.h"
20 #include "eloop.h"
21 #include "wpa.h"
22 #include "preauth.h"
23 #include "sta_info.h"
24 #include "eap_server/eap.h"
25 #include "state_machine.h"
26 #include "eap_common/eap_common.h"
27
28 #define STATE_MACHINE_DATA struct eapol_state_machine
29 #define STATE_MACHINE_DEBUG_PREFIX "IEEE 802.1X"
30 #define STATE_MACHINE_ADDR sm->addr
31
32 static struct eapol_callbacks eapol_cb;
33
34 /* EAPOL state machines are described in IEEE Std 802.1X-2004, Chap. 8.2 */
35
36 #define setPortAuthorized() \
37 sm->eapol->cb.set_port_authorized(sm->hapd, sm->sta, 1)
38 #define setPortUnauthorized() \
39 sm->eapol->cb.set_port_authorized(sm->hapd, sm->sta, 0)
40
41 /* procedures */
42 #define txCannedFail() eapol_auth_tx_canned_eap(sm, 0)
43 #define txCannedSuccess() eapol_auth_tx_canned_eap(sm, 1)
44 #define txReq() eapol_auth_tx_req(sm)
45 #define abortAuth() sm->eapol->cb.abort_auth(sm->hapd, sm->sta)
46 #define txKey() sm->eapol->cb.tx_key(sm->hapd, sm->sta)
47 #define processKey() do { } while (0)
48
49
50 static void eapol_sm_step_run(struct eapol_state_machine *sm);
51 static void eapol_sm_step_cb(void *eloop_ctx, void *timeout_ctx);
52
53
54 static void eapol_auth_logger(struct eapol_authenticator *eapol,
55 const u8 *addr, logger_level level,
56 const char *txt)
57 {
58 if (eapol->cb.logger == NULL)
59 return;
60 eapol->cb.logger(eapol->conf.hapd, addr, level, txt);
61 }
62
63
64 static void eapol_auth_vlogger(struct eapol_authenticator *eapol,
65 const u8 *addr, logger_level level,
66 const char *fmt, ...)
67 {
68 char *format;
69 int maxlen;
70 va_list ap;
71
72 if (eapol->cb.logger == NULL)
73 return;
74
75 maxlen = os_strlen(fmt) + 100;
76 format = os_malloc(maxlen);
77 if (!format)
78 return;
79
80 va_start(ap, fmt);
81 vsnprintf(format, maxlen, fmt, ap);
82 va_end(ap);
83
84 eapol_auth_logger(eapol, addr, level, format);
85
86 os_free(format);
87 }
88
89
90 static void eapol_auth_tx_canned_eap(struct eapol_state_machine *sm,
91 int success)
92 {
93 struct eap_hdr eap;
94
95 os_memset(&eap, 0, sizeof(eap));
96
97 eap.code = success ? EAP_CODE_SUCCESS : EAP_CODE_FAILURE;
98 eap.identifier = ++sm->last_eap_id;
99 eap.length = host_to_be16(sizeof(eap));
100
101 eapol_auth_vlogger(sm->eapol, sm->addr, EAPOL_LOGGER_DEBUG,
102 "Sending canned EAP packet %s (identifier %d)",
103 success ? "SUCCESS" : "FAILURE", eap.identifier);
104 sm->eapol->cb.eapol_send(sm->hapd, sm->sta, IEEE802_1X_TYPE_EAP_PACKET,
105 (u8 *) &eap, sizeof(eap));
106 sm->dot1xAuthEapolFramesTx++;
107 }
108
109
110 static void eapol_auth_tx_req(struct eapol_state_machine *sm)
111 {
112 if (sm->eap_if->eapReqData == NULL ||
113 wpabuf_len(sm->eap_if->eapReqData) < sizeof(struct eap_hdr)) {
114 eapol_auth_logger(sm->eapol, sm->addr,
115 EAPOL_LOGGER_DEBUG,
116 "TxReq called, but there is no EAP request "
117 "from authentication server");
118 return;
119 }
120
121 if (sm->flags & EAPOL_SM_WAIT_START) {
122 wpa_printf(MSG_DEBUG, "EAPOL: Drop EAPOL TX to " MACSTR
123 " while waiting for EAPOL-Start",
124 MAC2STR(sm->addr));
125 return;
126 }
127
128 sm->last_eap_id = eap_get_id(sm->eap_if->eapReqData);
129 eapol_auth_vlogger(sm->eapol, sm->addr, EAPOL_LOGGER_DEBUG,
130 "Sending EAP Packet (identifier %d)",
131 sm->last_eap_id);
132 sm->eapol->cb.eapol_send(sm->hapd, sm->sta, IEEE802_1X_TYPE_EAP_PACKET,
133 wpabuf_head(sm->eap_if->eapReqData),
134 wpabuf_len(sm->eap_if->eapReqData));
135 sm->dot1xAuthEapolFramesTx++;
136 if (eap_get_type(sm->eap_if->eapReqData) == EAP_TYPE_IDENTITY)
137 sm->dot1xAuthEapolReqIdFramesTx++;
138 else
139 sm->dot1xAuthEapolReqFramesTx++;
140 }
141
142
143 /**
144 * eapol_port_timers_tick - Port Timers state machine
145 * @eloop_ctx: struct eapol_state_machine *
146 * @timeout_ctx: Not used
147 *
148 * This statemachine is implemented as a function that will be called
149 * once a second as a registered event loop timeout.
150 */
151 static void eapol_port_timers_tick(void *eloop_ctx, void *timeout_ctx)
152 {
153 struct eapol_state_machine *state = timeout_ctx;
154
155 if (state->aWhile > 0) {
156 state->aWhile--;
157 if (state->aWhile == 0) {
158 wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR
159 " - aWhile --> 0",
160 MAC2STR(state->addr));
161 }
162 }
163
164 if (state->quietWhile > 0) {
165 state->quietWhile--;
166 if (state->quietWhile == 0) {
167 wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR
168 " - quietWhile --> 0",
169 MAC2STR(state->addr));
170 }
171 }
172
173 if (state->reAuthWhen > 0) {
174 state->reAuthWhen--;
175 if (state->reAuthWhen == 0) {
176 wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR
177 " - reAuthWhen --> 0",
178 MAC2STR(state->addr));
179 }
180 }
181
182 if (state->eap_if->retransWhile > 0) {
183 state->eap_if->retransWhile--;
184 if (state->eap_if->retransWhile == 0) {
185 wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR
186 " - (EAP) retransWhile --> 0",
187 MAC2STR(state->addr));
188 }
189 }
190
191 eapol_sm_step_run(state);
192
193 eloop_register_timeout(1, 0, eapol_port_timers_tick, eloop_ctx, state);
194 }
195
196
197
198 /* Authenticator PAE state machine */
199
200 SM_STATE(AUTH_PAE, INITIALIZE)
201 {
202 SM_ENTRY_MA(AUTH_PAE, INITIALIZE, auth_pae);
203 sm->portMode = Auto;
204 }
205
206
207 SM_STATE(AUTH_PAE, DISCONNECTED)
208 {
209 int from_initialize = sm->auth_pae_state == AUTH_PAE_INITIALIZE;
210
211 if (sm->eapolLogoff) {
212 if (sm->auth_pae_state == AUTH_PAE_CONNECTING)
213 sm->authEapLogoffsWhileConnecting++;
214 else if (sm->auth_pae_state == AUTH_PAE_AUTHENTICATED)
215 sm->authAuthEapLogoffWhileAuthenticated++;
216 }
217
218 SM_ENTRY_MA(AUTH_PAE, DISCONNECTED, auth_pae);
219
220 sm->authPortStatus = Unauthorized;
221 setPortUnauthorized();
222 sm->reAuthCount = 0;
223 sm->eapolLogoff = FALSE;
224 if (!from_initialize) {
225 sm->eapol->cb.finished(sm->hapd, sm->sta, 0,
226 sm->flags & EAPOL_SM_PREAUTH);
227 }
228 }
229
230
231 SM_STATE(AUTH_PAE, RESTART)
232 {
233 if (sm->auth_pae_state == AUTH_PAE_AUTHENTICATED) {
234 if (sm->reAuthenticate)
235 sm->authAuthReauthsWhileAuthenticated++;
236 if (sm->eapolStart)
237 sm->authAuthEapStartsWhileAuthenticated++;
238 if (sm->eapolLogoff)
239 sm->authAuthEapLogoffWhileAuthenticated++;
240 }
241
242 SM_ENTRY_MA(AUTH_PAE, RESTART, auth_pae);
243
244 sm->eap_if->eapRestart = TRUE;
245 }
246
247
248 SM_STATE(AUTH_PAE, CONNECTING)
249 {
250 if (sm->auth_pae_state != AUTH_PAE_CONNECTING)
251 sm->authEntersConnecting++;
252
253 SM_ENTRY_MA(AUTH_PAE, CONNECTING, auth_pae);
254
255 sm->reAuthenticate = FALSE;
256 sm->reAuthCount++;
257 }
258
259
260 SM_STATE(AUTH_PAE, HELD)
261 {
262 if (sm->auth_pae_state == AUTH_PAE_AUTHENTICATING && sm->authFail)
263 sm->authAuthFailWhileAuthenticating++;
264
265 SM_ENTRY_MA(AUTH_PAE, HELD, auth_pae);
266
267 sm->authPortStatus = Unauthorized;
268 setPortUnauthorized();
269 sm->quietWhile = sm->quietPeriod;
270 sm->eapolLogoff = FALSE;
271
272 eapol_auth_vlogger(sm->eapol, sm->addr, EAPOL_LOGGER_WARNING,
273 "authentication failed - EAP type: %d (%s)",
274 sm->eap_type_authsrv,
275 eap_type_text(sm->eap_type_authsrv));
276 if (sm->eap_type_authsrv != sm->eap_type_supp) {
277 eapol_auth_vlogger(sm->eapol, sm->addr, EAPOL_LOGGER_INFO,
278 "Supplicant used different EAP type: "
279 "%d (%s)", sm->eap_type_supp,
280 eap_type_text(sm->eap_type_supp));
281 }
282 sm->eapol->cb.finished(sm->hapd, sm->sta, 0,
283 sm->flags & EAPOL_SM_PREAUTH);
284 }
285
286
287 SM_STATE(AUTH_PAE, AUTHENTICATED)
288 {
289 char *extra = "";
290
291 if (sm->auth_pae_state == AUTH_PAE_AUTHENTICATING && sm->authSuccess)
292 sm->authAuthSuccessesWhileAuthenticating++;
293
294 SM_ENTRY_MA(AUTH_PAE, AUTHENTICATED, auth_pae);
295
296 sm->authPortStatus = Authorized;
297 setPortAuthorized();
298 sm->reAuthCount = 0;
299 if (sm->flags & EAPOL_SM_PREAUTH)
300 extra = " (pre-authentication)";
301 else if (wpa_auth_sta_get_pmksa(sm->sta->wpa_sm))
302 extra = " (PMKSA cache)";
303 eapol_auth_vlogger(sm->eapol, sm->addr, EAPOL_LOGGER_INFO,
304 "authenticated - EAP type: %d (%s)%s",
305 sm->eap_type_authsrv,
306 eap_type_text(sm->eap_type_authsrv), extra);
307 sm->eapol->cb.finished(sm->hapd, sm->sta, 1,
308 sm->flags & EAPOL_SM_PREAUTH);
309 }
310
311
312 SM_STATE(AUTH_PAE, AUTHENTICATING)
313 {
314 SM_ENTRY_MA(AUTH_PAE, AUTHENTICATING, auth_pae);
315
316 sm->eapolStart = FALSE;
317 sm->authSuccess = FALSE;
318 sm->authFail = FALSE;
319 sm->authTimeout = FALSE;
320 sm->authStart = TRUE;
321 sm->keyRun = FALSE;
322 sm->keyDone = FALSE;
323 }
324
325
326 SM_STATE(AUTH_PAE, ABORTING)
327 {
328 if (sm->auth_pae_state == AUTH_PAE_AUTHENTICATING) {
329 if (sm->authTimeout)
330 sm->authAuthTimeoutsWhileAuthenticating++;
331 if (sm->eapolStart)
332 sm->authAuthEapStartsWhileAuthenticating++;
333 if (sm->eapolLogoff)
334 sm->authAuthEapLogoffWhileAuthenticating++;
335 }
336
337 SM_ENTRY_MA(AUTH_PAE, ABORTING, auth_pae);
338
339 sm->authAbort = TRUE;
340 sm->keyRun = FALSE;
341 sm->keyDone = FALSE;
342 }
343
344
345 SM_STATE(AUTH_PAE, FORCE_AUTH)
346 {
347 SM_ENTRY_MA(AUTH_PAE, FORCE_AUTH, auth_pae);
348
349 sm->authPortStatus = Authorized;
350 setPortAuthorized();
351 sm->portMode = ForceAuthorized;
352 sm->eapolStart = FALSE;
353 txCannedSuccess();
354 }
355
356
357 SM_STATE(AUTH_PAE, FORCE_UNAUTH)
358 {
359 SM_ENTRY_MA(AUTH_PAE, FORCE_UNAUTH, auth_pae);
360
361 sm->authPortStatus = Unauthorized;
362 setPortUnauthorized();
363 sm->portMode = ForceUnauthorized;
364 sm->eapolStart = FALSE;
365 txCannedFail();
366 }
367
368
369 SM_STEP(AUTH_PAE)
370 {
371 if ((sm->portControl == Auto && sm->portMode != sm->portControl) ||
372 sm->initialize || !sm->eap_if->portEnabled)
373 SM_ENTER_GLOBAL(AUTH_PAE, INITIALIZE);
374 else if (sm->portControl == ForceAuthorized &&
375 sm->portMode != sm->portControl &&
376 !(sm->initialize || !sm->eap_if->portEnabled))
377 SM_ENTER_GLOBAL(AUTH_PAE, FORCE_AUTH);
378 else if (sm->portControl == ForceUnauthorized &&
379 sm->portMode != sm->portControl &&
380 !(sm->initialize || !sm->eap_if->portEnabled))
381 SM_ENTER_GLOBAL(AUTH_PAE, FORCE_UNAUTH);
382 else {
383 switch (sm->auth_pae_state) {
384 case AUTH_PAE_INITIALIZE:
385 SM_ENTER(AUTH_PAE, DISCONNECTED);
386 break;
387 case AUTH_PAE_DISCONNECTED:
388 SM_ENTER(AUTH_PAE, RESTART);
389 break;
390 case AUTH_PAE_RESTART:
391 if (!sm->eap_if->eapRestart)
392 SM_ENTER(AUTH_PAE, CONNECTING);
393 break;
394 case AUTH_PAE_HELD:
395 if (sm->quietWhile == 0)
396 SM_ENTER(AUTH_PAE, RESTART);
397 break;
398 case AUTH_PAE_CONNECTING:
399 if (sm->eapolLogoff || sm->reAuthCount > sm->reAuthMax)
400 SM_ENTER(AUTH_PAE, DISCONNECTED);
401 else if ((sm->eap_if->eapReq &&
402 sm->reAuthCount <= sm->reAuthMax) ||
403 sm->eap_if->eapSuccess || sm->eap_if->eapFail)
404 SM_ENTER(AUTH_PAE, AUTHENTICATING);
405 break;
406 case AUTH_PAE_AUTHENTICATED:
407 if (sm->eapolStart || sm->reAuthenticate)
408 SM_ENTER(AUTH_PAE, RESTART);
409 else if (sm->eapolLogoff || !sm->portValid)
410 SM_ENTER(AUTH_PAE, DISCONNECTED);
411 break;
412 case AUTH_PAE_AUTHENTICATING:
413 if (sm->authSuccess && sm->portValid)
414 SM_ENTER(AUTH_PAE, AUTHENTICATED);
415 else if (sm->authFail ||
416 (sm->keyDone && !sm->portValid))
417 SM_ENTER(AUTH_PAE, HELD);
418 else if (sm->eapolStart || sm->eapolLogoff ||
419 sm->authTimeout)
420 SM_ENTER(AUTH_PAE, ABORTING);
421 break;
422 case AUTH_PAE_ABORTING:
423 if (sm->eapolLogoff && !sm->authAbort)
424 SM_ENTER(AUTH_PAE, DISCONNECTED);
425 else if (!sm->eapolLogoff && !sm->authAbort)
426 SM_ENTER(AUTH_PAE, RESTART);
427 break;
428 case AUTH_PAE_FORCE_AUTH:
429 if (sm->eapolStart)
430 SM_ENTER(AUTH_PAE, FORCE_AUTH);
431 break;
432 case AUTH_PAE_FORCE_UNAUTH:
433 if (sm->eapolStart)
434 SM_ENTER(AUTH_PAE, FORCE_UNAUTH);
435 break;
436 }
437 }
438 }
439
440
441
442 /* Backend Authentication state machine */
443
444 SM_STATE(BE_AUTH, INITIALIZE)
445 {
446 SM_ENTRY_MA(BE_AUTH, INITIALIZE, be_auth);
447
448 abortAuth();
449 sm->eap_if->eapNoReq = FALSE;
450 sm->authAbort = FALSE;
451 }
452
453
454 SM_STATE(BE_AUTH, REQUEST)
455 {
456 SM_ENTRY_MA(BE_AUTH, REQUEST, be_auth);
457
458 txReq();
459 sm->eap_if->eapReq = FALSE;
460 sm->backendOtherRequestsToSupplicant++;
461
462 /*
463 * Clearing eapolEap here is not specified in IEEE Std 802.1X-2004, but
464 * it looks like this would be logical thing to do there since the old
465 * EAP response would not be valid anymore after the new EAP request
466 * was sent out.
467 *
468 * A race condition has been reported, in which hostapd ended up
469 * sending out EAP-Response/Identity as a response to the first
470 * EAP-Request from the main EAP method. This can be avoided by
471 * clearing eapolEap here.
472 */
473 sm->eapolEap = FALSE;
474 }
475
476
477 SM_STATE(BE_AUTH, RESPONSE)
478 {
479 SM_ENTRY_MA(BE_AUTH, RESPONSE, be_auth);
480
481 sm->authTimeout = FALSE;
482 sm->eapolEap = FALSE;
483 sm->eap_if->eapNoReq = FALSE;
484 sm->aWhile = sm->serverTimeout;
485 sm->eap_if->eapResp = TRUE;
486 /* sendRespToServer(); */
487 sm->backendResponses++;
488 }
489
490
491 SM_STATE(BE_AUTH, SUCCESS)
492 {
493 SM_ENTRY_MA(BE_AUTH, SUCCESS, be_auth);
494
495 txReq();
496 sm->authSuccess = TRUE;
497 sm->keyRun = TRUE;
498 }
499
500
501 SM_STATE(BE_AUTH, FAIL)
502 {
503 SM_ENTRY_MA(BE_AUTH, FAIL, be_auth);
504
505 txReq();
506 sm->authFail = TRUE;
507 }
508
509
510 SM_STATE(BE_AUTH, TIMEOUT)
511 {
512 SM_ENTRY_MA(BE_AUTH, TIMEOUT, be_auth);
513
514 sm->authTimeout = TRUE;
515 }
516
517
518 SM_STATE(BE_AUTH, IDLE)
519 {
520 SM_ENTRY_MA(BE_AUTH, IDLE, be_auth);
521
522 sm->authStart = FALSE;
523 }
524
525
526 SM_STATE(BE_AUTH, IGNORE)
527 {
528 SM_ENTRY_MA(BE_AUTH, IGNORE, be_auth);
529
530 sm->eap_if->eapNoReq = FALSE;
531 }
532
533
534 SM_STEP(BE_AUTH)
535 {
536 if (sm->portControl != Auto || sm->initialize || sm->authAbort) {
537 SM_ENTER_GLOBAL(BE_AUTH, INITIALIZE);
538 return;
539 }
540
541 switch (sm->be_auth_state) {
542 case BE_AUTH_INITIALIZE:
543 SM_ENTER(BE_AUTH, IDLE);
544 break;
545 case BE_AUTH_REQUEST:
546 if (sm->eapolEap)
547 SM_ENTER(BE_AUTH, RESPONSE);
548 else if (sm->eap_if->eapReq)
549 SM_ENTER(BE_AUTH, REQUEST);
550 else if (sm->eap_if->eapTimeout)
551 SM_ENTER(BE_AUTH, TIMEOUT);
552 break;
553 case BE_AUTH_RESPONSE:
554 if (sm->eap_if->eapNoReq)
555 SM_ENTER(BE_AUTH, IGNORE);
556 if (sm->eap_if->eapReq) {
557 sm->backendAccessChallenges++;
558 SM_ENTER(BE_AUTH, REQUEST);
559 } else if (sm->aWhile == 0)
560 SM_ENTER(BE_AUTH, TIMEOUT);
561 else if (sm->eap_if->eapFail) {
562 sm->backendAuthFails++;
563 SM_ENTER(BE_AUTH, FAIL);
564 } else if (sm->eap_if->eapSuccess) {
565 sm->backendAuthSuccesses++;
566 SM_ENTER(BE_AUTH, SUCCESS);
567 }
568 break;
569 case BE_AUTH_SUCCESS:
570 SM_ENTER(BE_AUTH, IDLE);
571 break;
572 case BE_AUTH_FAIL:
573 SM_ENTER(BE_AUTH, IDLE);
574 break;
575 case BE_AUTH_TIMEOUT:
576 SM_ENTER(BE_AUTH, IDLE);
577 break;
578 case BE_AUTH_IDLE:
579 if (sm->eap_if->eapFail && sm->authStart)
580 SM_ENTER(BE_AUTH, FAIL);
581 else if (sm->eap_if->eapReq && sm->authStart)
582 SM_ENTER(BE_AUTH, REQUEST);
583 else if (sm->eap_if->eapSuccess && sm->authStart)
584 SM_ENTER(BE_AUTH, SUCCESS);
585 break;
586 case BE_AUTH_IGNORE:
587 if (sm->eapolEap)
588 SM_ENTER(BE_AUTH, RESPONSE);
589 else if (sm->eap_if->eapReq)
590 SM_ENTER(BE_AUTH, REQUEST);
591 else if (sm->eap_if->eapTimeout)
592 SM_ENTER(BE_AUTH, TIMEOUT);
593 break;
594 }
595 }
596
597
598
599 /* Reauthentication Timer state machine */
600
601 SM_STATE(REAUTH_TIMER, INITIALIZE)
602 {
603 SM_ENTRY_MA(REAUTH_TIMER, INITIALIZE, reauth_timer);
604
605 sm->reAuthWhen = sm->reAuthPeriod;
606 }
607
608
609 SM_STATE(REAUTH_TIMER, REAUTHENTICATE)
610 {
611 SM_ENTRY_MA(REAUTH_TIMER, REAUTHENTICATE, reauth_timer);
612
613 sm->reAuthenticate = TRUE;
614 wpa_auth_sm_event(sm->sta->wpa_sm, WPA_REAUTH_EAPOL);
615 }
616
617
618 SM_STEP(REAUTH_TIMER)
619 {
620 if (sm->portControl != Auto || sm->initialize ||
621 sm->authPortStatus == Unauthorized || !sm->reAuthEnabled) {
622 SM_ENTER_GLOBAL(REAUTH_TIMER, INITIALIZE);
623 return;
624 }
625
626 switch (sm->reauth_timer_state) {
627 case REAUTH_TIMER_INITIALIZE:
628 if (sm->reAuthWhen == 0)
629 SM_ENTER(REAUTH_TIMER, REAUTHENTICATE);
630 break;
631 case REAUTH_TIMER_REAUTHENTICATE:
632 SM_ENTER(REAUTH_TIMER, INITIALIZE);
633 break;
634 }
635 }
636
637
638
639 /* Authenticator Key Transmit state machine */
640
641 SM_STATE(AUTH_KEY_TX, NO_KEY_TRANSMIT)
642 {
643 SM_ENTRY_MA(AUTH_KEY_TX, NO_KEY_TRANSMIT, auth_key_tx);
644 }
645
646
647 SM_STATE(AUTH_KEY_TX, KEY_TRANSMIT)
648 {
649 SM_ENTRY_MA(AUTH_KEY_TX, KEY_TRANSMIT, auth_key_tx);
650
651 txKey();
652 sm->eap_if->eapKeyAvailable = FALSE;
653 sm->keyDone = TRUE;
654 }
655
656
657 SM_STEP(AUTH_KEY_TX)
658 {
659 if (sm->initialize || sm->portControl != Auto) {
660 SM_ENTER_GLOBAL(AUTH_KEY_TX, NO_KEY_TRANSMIT);
661 return;
662 }
663
664 switch (sm->auth_key_tx_state) {
665 case AUTH_KEY_TX_NO_KEY_TRANSMIT:
666 if (sm->keyTxEnabled && sm->eap_if->eapKeyAvailable &&
667 sm->keyRun && !wpa_auth_sta_wpa_version(sm->sta->wpa_sm))
668 SM_ENTER(AUTH_KEY_TX, KEY_TRANSMIT);
669 break;
670 case AUTH_KEY_TX_KEY_TRANSMIT:
671 if (!sm->keyTxEnabled || !sm->keyRun)
672 SM_ENTER(AUTH_KEY_TX, NO_KEY_TRANSMIT);
673 else if (sm->eap_if->eapKeyAvailable)
674 SM_ENTER(AUTH_KEY_TX, KEY_TRANSMIT);
675 break;
676 }
677 }
678
679
680
681 /* Key Receive state machine */
682
683 SM_STATE(KEY_RX, NO_KEY_RECEIVE)
684 {
685 SM_ENTRY_MA(KEY_RX, NO_KEY_RECEIVE, key_rx);
686 }
687
688
689 SM_STATE(KEY_RX, KEY_RECEIVE)
690 {
691 SM_ENTRY_MA(KEY_RX, KEY_RECEIVE, key_rx);
692
693 processKey();
694 sm->rxKey = FALSE;
695 }
696
697
698 SM_STEP(KEY_RX)
699 {
700 if (sm->initialize || !sm->eap_if->portEnabled) {
701 SM_ENTER_GLOBAL(KEY_RX, NO_KEY_RECEIVE);
702 return;
703 }
704
705 switch (sm->key_rx_state) {
706 case KEY_RX_NO_KEY_RECEIVE:
707 if (sm->rxKey)
708 SM_ENTER(KEY_RX, KEY_RECEIVE);
709 break;
710 case KEY_RX_KEY_RECEIVE:
711 if (sm->rxKey)
712 SM_ENTER(KEY_RX, KEY_RECEIVE);
713 break;
714 }
715 }
716
717
718
719 /* Controlled Directions state machine */
720
721 SM_STATE(CTRL_DIR, FORCE_BOTH)
722 {
723 SM_ENTRY_MA(CTRL_DIR, FORCE_BOTH, ctrl_dir);
724 sm->operControlledDirections = Both;
725 }
726
727
728 SM_STATE(CTRL_DIR, IN_OR_BOTH)
729 {
730 SM_ENTRY_MA(CTRL_DIR, IN_OR_BOTH, ctrl_dir);
731 sm->operControlledDirections = sm->adminControlledDirections;
732 }
733
734
735 SM_STEP(CTRL_DIR)
736 {
737 if (sm->initialize) {
738 SM_ENTER_GLOBAL(CTRL_DIR, IN_OR_BOTH);
739 return;
740 }
741
742 switch (sm->ctrl_dir_state) {
743 case CTRL_DIR_FORCE_BOTH:
744 if (sm->eap_if->portEnabled && sm->operEdge)
745 SM_ENTER(CTRL_DIR, IN_OR_BOTH);
746 break;
747 case CTRL_DIR_IN_OR_BOTH:
748 if (sm->operControlledDirections !=
749 sm->adminControlledDirections)
750 SM_ENTER(CTRL_DIR, IN_OR_BOTH);
751 if (!sm->eap_if->portEnabled || !sm->operEdge)
752 SM_ENTER(CTRL_DIR, FORCE_BOTH);
753 break;
754 }
755 }
756
757
758
759 struct eapol_state_machine *
760 eapol_auth_alloc(struct eapol_authenticator *eapol, const u8 *addr,
761 int preauth, struct sta_info *sta)
762 {
763 struct eapol_state_machine *sm;
764 struct hostapd_data *hapd; /* TODO: to be removed */
765 struct eap_config eap_conf;
766
767 if (eapol == NULL)
768 return NULL;
769 hapd = eapol->conf.hapd;
770
771 sm = os_zalloc(sizeof(*sm));
772 if (sm == NULL) {
773 wpa_printf(MSG_DEBUG, "IEEE 802.1X state machine allocation "
774 "failed");
775 return NULL;
776 }
777 sm->radius_identifier = -1;
778 os_memcpy(sm->addr, addr, ETH_ALEN);
779 if (preauth)
780 sm->flags |= EAPOL_SM_PREAUTH;
781
782 sm->hapd = hapd;
783 sm->eapol = eapol;
784 sm->sta = sta;
785
786 /* Set default values for state machine constants */
787 sm->auth_pae_state = AUTH_PAE_INITIALIZE;
788 sm->quietPeriod = AUTH_PAE_DEFAULT_quietPeriod;
789 sm->reAuthMax = AUTH_PAE_DEFAULT_reAuthMax;
790
791 sm->be_auth_state = BE_AUTH_INITIALIZE;
792 sm->serverTimeout = BE_AUTH_DEFAULT_serverTimeout;
793
794 sm->reauth_timer_state = REAUTH_TIMER_INITIALIZE;
795 sm->reAuthPeriod = eapol->conf.eap_reauth_period;
796 sm->reAuthEnabled = eapol->conf.eap_reauth_period > 0 ? TRUE : FALSE;
797
798 sm->auth_key_tx_state = AUTH_KEY_TX_NO_KEY_TRANSMIT;
799
800 sm->key_rx_state = KEY_RX_NO_KEY_RECEIVE;
801
802 sm->ctrl_dir_state = CTRL_DIR_IN_OR_BOTH;
803
804 sm->portControl = Auto;
805
806 if (!eapol->conf.wpa &&
807 (hapd->default_wep_key || eapol->conf.individual_wep_key_len > 0))
808 sm->keyTxEnabled = TRUE;
809 else
810 sm->keyTxEnabled = FALSE;
811 if (eapol->conf.wpa)
812 sm->portValid = FALSE;
813 else
814 sm->portValid = TRUE;
815
816 os_memset(&eap_conf, 0, sizeof(eap_conf));
817 eap_conf.eap_server = eapol->conf.eap_server;
818 eap_conf.ssl_ctx = eapol->conf.ssl_ctx;
819 eap_conf.eap_sim_db_priv = eapol->conf.eap_sim_db_priv;
820 eap_conf.pac_opaque_encr_key = eapol->conf.pac_opaque_encr_key;
821 eap_conf.eap_fast_a_id = eapol->conf.eap_fast_a_id;
822 eap_conf.eap_fast_a_id_len = eapol->conf.eap_fast_a_id_len;
823 eap_conf.eap_fast_a_id_info = eapol->conf.eap_fast_a_id_info;
824 eap_conf.eap_fast_prov = eapol->conf.eap_fast_prov;
825 eap_conf.pac_key_lifetime = eapol->conf.pac_key_lifetime;
826 eap_conf.pac_key_refresh_time = eapol->conf.pac_key_refresh_time;
827 eap_conf.eap_sim_aka_result_ind = eapol->conf.eap_sim_aka_result_ind;
828 eap_conf.tnc = eapol->conf.tnc;
829 eap_conf.wps = eapol->conf.wps;
830 eap_conf.assoc_wps_ie = sta->wps_ie;
831 sm->eap = eap_server_sm_init(sm, &eapol_cb, &eap_conf);
832 if (sm->eap == NULL) {
833 eapol_auth_free(sm);
834 return NULL;
835 }
836 sm->eap_if = eap_get_interface(sm->eap);
837
838 eapol_auth_initialize(sm);
839
840 return sm;
841 }
842
843
844 void eapol_auth_free(struct eapol_state_machine *sm)
845 {
846 if (sm == NULL)
847 return;
848
849 eloop_cancel_timeout(eapol_port_timers_tick, NULL, sm);
850 eloop_cancel_timeout(eapol_sm_step_cb, sm, NULL);
851 if (sm->eap)
852 eap_server_sm_deinit(sm->eap);
853 os_free(sm);
854 }
855
856
857 static int eapol_sm_sta_entry_alive(struct eapol_authenticator *eapol,
858 const u8 *addr)
859 {
860 return eapol->cb.sta_entry_alive(eapol->conf.hapd, addr);
861 }
862
863
864 static void eapol_sm_step_run(struct eapol_state_machine *sm)
865 {
866 struct eapol_authenticator *eapol = sm->eapol;
867 u8 addr[ETH_ALEN];
868 unsigned int prev_auth_pae, prev_be_auth, prev_reauth_timer,
869 prev_auth_key_tx, prev_key_rx, prev_ctrl_dir;
870 int max_steps = 100;
871
872 os_memcpy(addr, sm->addr, ETH_ALEN);
873
874 /*
875 * Allow EAPOL state machines to run as long as there are state
876 * changes, but exit and return here through event loop if more than
877 * 100 steps is needed as a precaution against infinite loops inside
878 * eloop callback.
879 */
880 restart:
881 prev_auth_pae = sm->auth_pae_state;
882 prev_be_auth = sm->be_auth_state;
883 prev_reauth_timer = sm->reauth_timer_state;
884 prev_auth_key_tx = sm->auth_key_tx_state;
885 prev_key_rx = sm->key_rx_state;
886 prev_ctrl_dir = sm->ctrl_dir_state;
887
888 SM_STEP_RUN(AUTH_PAE);
889 if (sm->initializing || eapol_sm_sta_entry_alive(eapol, addr))
890 SM_STEP_RUN(BE_AUTH);
891 if (sm->initializing || eapol_sm_sta_entry_alive(eapol, addr))
892 SM_STEP_RUN(REAUTH_TIMER);
893 if (sm->initializing || eapol_sm_sta_entry_alive(eapol, addr))
894 SM_STEP_RUN(AUTH_KEY_TX);
895 if (sm->initializing || eapol_sm_sta_entry_alive(eapol, addr))
896 SM_STEP_RUN(KEY_RX);
897 if (sm->initializing || eapol_sm_sta_entry_alive(eapol, addr))
898 SM_STEP_RUN(CTRL_DIR);
899
900 if (prev_auth_pae != sm->auth_pae_state ||
901 prev_be_auth != sm->be_auth_state ||
902 prev_reauth_timer != sm->reauth_timer_state ||
903 prev_auth_key_tx != sm->auth_key_tx_state ||
904 prev_key_rx != sm->key_rx_state ||
905 prev_ctrl_dir != sm->ctrl_dir_state) {
906 if (--max_steps > 0)
907 goto restart;
908 /* Re-run from eloop timeout */
909 eapol_auth_step(sm);
910 return;
911 }
912
913 if (eapol_sm_sta_entry_alive(eapol, addr) && sm->eap) {
914 if (eap_server_sm_step(sm->eap)) {
915 if (--max_steps > 0)
916 goto restart;
917 /* Re-run from eloop timeout */
918 eapol_auth_step(sm);
919 return;
920 }
921
922 /* TODO: find a better location for this */
923 if (sm->eap_if->aaaEapResp) {
924 sm->eap_if->aaaEapResp = FALSE;
925 if (sm->eap_if->aaaEapRespData == NULL) {
926 wpa_printf(MSG_DEBUG, "EAPOL: aaaEapResp set, "
927 "but no aaaEapRespData available");
928 return;
929 }
930 sm->eapol->cb.aaa_send(
931 sm->hapd, sm->sta,
932 wpabuf_head(sm->eap_if->aaaEapRespData),
933 wpabuf_len(sm->eap_if->aaaEapRespData));
934 }
935 }
936
937 if (eapol_sm_sta_entry_alive(eapol, addr))
938 wpa_auth_sm_notify(sm->sta->wpa_sm);
939 }
940
941
942 static void eapol_sm_step_cb(void *eloop_ctx, void *timeout_ctx)
943 {
944 struct eapol_state_machine *sm = eloop_ctx;
945 eapol_sm_step_run(sm);
946 }
947
948
949 /**
950 * eapol_auth_step - Advance EAPOL state machines
951 * @sm: EAPOL state machine
952 *
953 * This function is called to advance EAPOL state machines after any change
954 * that could affect their state.
955 */
956 void eapol_auth_step(struct eapol_state_machine *sm)
957 {
958 /*
959 * Run eapol_sm_step_run from a registered timeout to make sure that
960 * other possible timeouts/events are processed and to avoid long
961 * function call chains.
962 */
963
964 eloop_register_timeout(0, 0, eapol_sm_step_cb, sm, NULL);
965 }
966
967
968 void eapol_auth_initialize(struct eapol_state_machine *sm)
969 {
970 sm->initializing = TRUE;
971 /* Initialize the state machines by asserting initialize and then
972 * deasserting it after one step */
973 sm->initialize = TRUE;
974 eapol_sm_step_run(sm);
975 sm->initialize = FALSE;
976 eapol_sm_step_run(sm);
977 sm->initializing = FALSE;
978
979 /* Start one second tick for port timers state machine */
980 eloop_cancel_timeout(eapol_port_timers_tick, NULL, sm);
981 eloop_register_timeout(1, 0, eapol_port_timers_tick, NULL, sm);
982 }
983
984
985 #ifdef HOSTAPD_DUMP_STATE
986 static inline const char * port_type_txt(PortTypes pt)
987 {
988 switch (pt) {
989 case ForceUnauthorized: return "ForceUnauthorized";
990 case ForceAuthorized: return "ForceAuthorized";
991 case Auto: return "Auto";
992 default: return "Unknown";
993 }
994 }
995
996
997 static inline const char * port_state_txt(PortState ps)
998 {
999 switch (ps) {
1000 case Unauthorized: return "Unauthorized";
1001 case Authorized: return "Authorized";
1002 default: return "Unknown";
1003 }
1004 }
1005
1006
1007 static inline const char * ctrl_dir_txt(ControlledDirection dir)
1008 {
1009 switch (dir) {
1010 case Both: return "Both";
1011 case In: return "In";
1012 default: return "Unknown";
1013 }
1014 }
1015
1016
1017 static inline const char * auth_pae_state_txt(int s)
1018 {
1019 switch (s) {
1020 case AUTH_PAE_INITIALIZE: return "INITIALIZE";
1021 case AUTH_PAE_DISCONNECTED: return "DISCONNECTED";
1022 case AUTH_PAE_CONNECTING: return "CONNECTING";
1023 case AUTH_PAE_AUTHENTICATING: return "AUTHENTICATING";
1024 case AUTH_PAE_AUTHENTICATED: return "AUTHENTICATED";
1025 case AUTH_PAE_ABORTING: return "ABORTING";
1026 case AUTH_PAE_HELD: return "HELD";
1027 case AUTH_PAE_FORCE_AUTH: return "FORCE_AUTH";
1028 case AUTH_PAE_FORCE_UNAUTH: return "FORCE_UNAUTH";
1029 case AUTH_PAE_RESTART: return "RESTART";
1030 default: return "Unknown";
1031 }
1032 }
1033
1034
1035 static inline const char * be_auth_state_txt(int s)
1036 {
1037 switch (s) {
1038 case BE_AUTH_REQUEST: return "REQUEST";
1039 case BE_AUTH_RESPONSE: return "RESPONSE";
1040 case BE_AUTH_SUCCESS: return "SUCCESS";
1041 case BE_AUTH_FAIL: return "FAIL";
1042 case BE_AUTH_TIMEOUT: return "TIMEOUT";
1043 case BE_AUTH_IDLE: return "IDLE";
1044 case BE_AUTH_INITIALIZE: return "INITIALIZE";
1045 case BE_AUTH_IGNORE: return "IGNORE";
1046 default: return "Unknown";
1047 }
1048 }
1049
1050
1051 static inline const char * reauth_timer_state_txt(int s)
1052 {
1053 switch (s) {
1054 case REAUTH_TIMER_INITIALIZE: return "INITIALIZE";
1055 case REAUTH_TIMER_REAUTHENTICATE: return "REAUTHENTICATE";
1056 default: return "Unknown";
1057 }
1058 }
1059
1060
1061 static inline const char * auth_key_tx_state_txt(int s)
1062 {
1063 switch (s) {
1064 case AUTH_KEY_TX_NO_KEY_TRANSMIT: return "NO_KEY_TRANSMIT";
1065 case AUTH_KEY_TX_KEY_TRANSMIT: return "KEY_TRANSMIT";
1066 default: return "Unknown";
1067 }
1068 }
1069
1070
1071 static inline const char * key_rx_state_txt(int s)
1072 {
1073 switch (s) {
1074 case KEY_RX_NO_KEY_RECEIVE: return "NO_KEY_RECEIVE";
1075 case KEY_RX_KEY_RECEIVE: return "KEY_RECEIVE";
1076 default: return "Unknown";
1077 }
1078 }
1079
1080
1081 static inline const char * ctrl_dir_state_txt(int s)
1082 {
1083 switch (s) {
1084 case CTRL_DIR_FORCE_BOTH: return "FORCE_BOTH";
1085 case CTRL_DIR_IN_OR_BOTH: return "IN_OR_BOTH";
1086 default: return "Unknown";
1087 }
1088 }
1089
1090
1091 void eapol_auth_dump_state(FILE *f, const char *prefix,
1092 struct eapol_state_machine *sm)
1093 {
1094 fprintf(f, "%sEAPOL state machine:\n", prefix);
1095 fprintf(f, "%s aWhile=%d quietWhile=%d reAuthWhen=%d\n", prefix,
1096 sm->aWhile, sm->quietWhile, sm->reAuthWhen);
1097 #define _SB(b) ((b) ? "TRUE" : "FALSE")
1098 fprintf(f,
1099 "%s authAbort=%s authFail=%s authPortStatus=%s authStart=%s\n"
1100 "%s authTimeout=%s authSuccess=%s eapFail=%s eapolEap=%s\n"
1101 "%s eapSuccess=%s eapTimeout=%s initialize=%s "
1102 "keyAvailable=%s\n"
1103 "%s keyDone=%s keyRun=%s keyTxEnabled=%s portControl=%s\n"
1104 "%s portEnabled=%s portValid=%s reAuthenticate=%s\n",
1105 prefix, _SB(sm->authAbort), _SB(sm->authFail),
1106 port_state_txt(sm->authPortStatus), _SB(sm->authStart),
1107 prefix, _SB(sm->authTimeout), _SB(sm->authSuccess),
1108 _SB(sm->eap_if->eapFail), _SB(sm->eapolEap),
1109 prefix, _SB(sm->eap_if->eapSuccess),
1110 _SB(sm->eap_if->eapTimeout),
1111 _SB(sm->initialize), _SB(sm->eap_if->eapKeyAvailable),
1112 prefix, _SB(sm->keyDone), _SB(sm->keyRun),
1113 _SB(sm->keyTxEnabled), port_type_txt(sm->portControl),
1114 prefix, _SB(sm->eap_if->portEnabled), _SB(sm->portValid),
1115 _SB(sm->reAuthenticate));
1116
1117 fprintf(f, "%s Authenticator PAE:\n"
1118 "%s state=%s\n"
1119 "%s eapolLogoff=%s eapolStart=%s eapRestart=%s\n"
1120 "%s portMode=%s reAuthCount=%d\n"
1121 "%s quietPeriod=%d reAuthMax=%d\n"
1122 "%s authEntersConnecting=%d\n"
1123 "%s authEapLogoffsWhileConnecting=%d\n"
1124 "%s authEntersAuthenticating=%d\n"
1125 "%s authAuthSuccessesWhileAuthenticating=%d\n"
1126 "%s authAuthTimeoutsWhileAuthenticating=%d\n"
1127 "%s authAuthFailWhileAuthenticating=%d\n"
1128 "%s authAuthEapStartsWhileAuthenticating=%d\n"
1129 "%s authAuthEapLogoffWhileAuthenticating=%d\n"
1130 "%s authAuthReauthsWhileAuthenticated=%d\n"
1131 "%s authAuthEapStartsWhileAuthenticated=%d\n"
1132 "%s authAuthEapLogoffWhileAuthenticated=%d\n",
1133 prefix, prefix, auth_pae_state_txt(sm->auth_pae_state), prefix,
1134 _SB(sm->eapolLogoff), _SB(sm->eapolStart),
1135 _SB(sm->eap_if->eapRestart),
1136 prefix, port_type_txt(sm->portMode), sm->reAuthCount,
1137 prefix, sm->quietPeriod, sm->reAuthMax,
1138 prefix, sm->authEntersConnecting,
1139 prefix, sm->authEapLogoffsWhileConnecting,
1140 prefix, sm->authEntersAuthenticating,
1141 prefix, sm->authAuthSuccessesWhileAuthenticating,
1142 prefix, sm->authAuthTimeoutsWhileAuthenticating,
1143 prefix, sm->authAuthFailWhileAuthenticating,
1144 prefix, sm->authAuthEapStartsWhileAuthenticating,
1145 prefix, sm->authAuthEapLogoffWhileAuthenticating,
1146 prefix, sm->authAuthReauthsWhileAuthenticated,
1147 prefix, sm->authAuthEapStartsWhileAuthenticated,
1148 prefix, sm->authAuthEapLogoffWhileAuthenticated);
1149
1150 fprintf(f, "%s Backend Authentication:\n"
1151 "%s state=%s\n"
1152 "%s eapNoReq=%s eapReq=%s eapResp=%s\n"
1153 "%s serverTimeout=%d\n"
1154 "%s backendResponses=%d\n"
1155 "%s backendAccessChallenges=%d\n"
1156 "%s backendOtherRequestsToSupplicant=%d\n"
1157 "%s backendAuthSuccesses=%d\n"
1158 "%s backendAuthFails=%d\n",
1159 prefix, prefix,
1160 be_auth_state_txt(sm->be_auth_state),
1161 prefix, _SB(sm->eap_if->eapNoReq), _SB(sm->eap_if->eapReq),
1162 _SB(sm->eap_if->eapResp),
1163 prefix, sm->serverTimeout,
1164 prefix, sm->backendResponses,
1165 prefix, sm->backendAccessChallenges,
1166 prefix, sm->backendOtherRequestsToSupplicant,
1167 prefix, sm->backendAuthSuccesses,
1168 prefix, sm->backendAuthFails);
1169
1170 fprintf(f, "%s Reauthentication Timer:\n"
1171 "%s state=%s\n"
1172 "%s reAuthPeriod=%d reAuthEnabled=%s\n", prefix, prefix,
1173 reauth_timer_state_txt(sm->reauth_timer_state), prefix,
1174 sm->reAuthPeriod, _SB(sm->reAuthEnabled));
1175
1176 fprintf(f, "%s Authenticator Key Transmit:\n"
1177 "%s state=%s\n", prefix, prefix,
1178 auth_key_tx_state_txt(sm->auth_key_tx_state));
1179
1180 fprintf(f, "%s Key Receive:\n"
1181 "%s state=%s\n"
1182 "%s rxKey=%s\n", prefix, prefix,
1183 key_rx_state_txt(sm->key_rx_state), prefix, _SB(sm->rxKey));
1184
1185 fprintf(f, "%s Controlled Directions:\n"
1186 "%s state=%s\n"
1187 "%s adminControlledDirections=%s "
1188 "operControlledDirections=%s\n"
1189 "%s operEdge=%s\n", prefix, prefix,
1190 ctrl_dir_state_txt(sm->ctrl_dir_state),
1191 prefix, ctrl_dir_txt(sm->adminControlledDirections),
1192 ctrl_dir_txt(sm->operControlledDirections),
1193 prefix, _SB(sm->operEdge));
1194 #undef _SB
1195 }
1196 #endif /* HOSTAPD_DUMP_STATE */
1197
1198
1199 static int eapol_sm_get_eap_user(void *ctx, const u8 *identity,
1200 size_t identity_len, int phase2,
1201 struct eap_user *user)
1202 {
1203 struct eapol_state_machine *sm = ctx;
1204 return sm->eapol->cb.get_eap_user(sm->hapd, identity, identity_len,
1205 phase2, user);
1206 }
1207
1208
1209 static const char * eapol_sm_get_eap_req_id_text(void *ctx, size_t *len)
1210 {
1211 struct eapol_state_machine *sm = ctx;
1212 *len = sm->eapol->conf.eap_req_id_text_len;
1213 return sm->eapol->conf.eap_req_id_text;
1214 }
1215
1216
1217 static struct eapol_callbacks eapol_cb =
1218 {
1219 .get_eap_user = eapol_sm_get_eap_user,
1220 .get_eap_req_id_text = eapol_sm_get_eap_req_id_text,
1221 };
1222
1223
1224 int eapol_auth_eap_pending_cb(struct eapol_state_machine *sm, void *ctx)
1225 {
1226 if (sm == NULL || ctx != sm->eap)
1227 return -1;
1228
1229 eap_sm_pending_cb(sm->eap);
1230 eapol_auth_step(sm);
1231
1232 return 0;
1233 }
1234
1235
1236 static int eapol_auth_conf_clone(struct eapol_auth_config *dst,
1237 struct eapol_auth_config *src)
1238 {
1239 dst->hapd = src->hapd;
1240 dst->eap_reauth_period = src->eap_reauth_period;
1241 dst->wpa = src->wpa;
1242 dst->individual_wep_key_len = src->individual_wep_key_len;
1243 dst->eap_server = src->eap_server;
1244 dst->ssl_ctx = src->ssl_ctx;
1245 dst->eap_sim_db_priv = src->eap_sim_db_priv;
1246 os_free(dst->eap_req_id_text);
1247 if (src->eap_req_id_text) {
1248 dst->eap_req_id_text = os_malloc(src->eap_req_id_text_len);
1249 if (dst->eap_req_id_text == NULL)
1250 return -1;
1251 os_memcpy(dst->eap_req_id_text, src->eap_req_id_text,
1252 src->eap_req_id_text_len);
1253 dst->eap_req_id_text_len = src->eap_req_id_text_len;
1254 } else {
1255 dst->eap_req_id_text = NULL;
1256 dst->eap_req_id_text_len = 0;
1257 }
1258 if (src->pac_opaque_encr_key) {
1259 dst->pac_opaque_encr_key = os_malloc(16);
1260 os_memcpy(dst->pac_opaque_encr_key, src->pac_opaque_encr_key,
1261 16);
1262 } else
1263 dst->pac_opaque_encr_key = NULL;
1264 if (src->eap_fast_a_id) {
1265 dst->eap_fast_a_id = os_malloc(src->eap_fast_a_id_len);
1266 if (dst->eap_fast_a_id == NULL) {
1267 os_free(dst->eap_req_id_text);
1268 return -1;
1269 }
1270 os_memcpy(dst->eap_fast_a_id, src->eap_fast_a_id,
1271 src->eap_fast_a_id_len);
1272 dst->eap_fast_a_id_len = src->eap_fast_a_id_len;
1273 } else
1274 dst->eap_fast_a_id = NULL;
1275 if (src->eap_fast_a_id_info) {
1276 dst->eap_fast_a_id_info = os_strdup(src->eap_fast_a_id_info);
1277 if (dst->eap_fast_a_id_info == NULL) {
1278 os_free(dst->eap_req_id_text);
1279 os_free(dst->eap_fast_a_id);
1280 return -1;
1281 }
1282 } else
1283 dst->eap_fast_a_id_info = NULL;
1284 dst->eap_fast_prov = src->eap_fast_prov;
1285 dst->pac_key_lifetime = src->pac_key_lifetime;
1286 dst->pac_key_refresh_time = src->pac_key_refresh_time;
1287 dst->eap_sim_aka_result_ind = src->eap_sim_aka_result_ind;
1288 dst->tnc = src->tnc;
1289 dst->wps = src->wps;
1290 return 0;
1291 }
1292
1293
1294 static void eapol_auth_conf_free(struct eapol_auth_config *conf)
1295 {
1296 os_free(conf->eap_req_id_text);
1297 conf->eap_req_id_text = NULL;
1298 os_free(conf->pac_opaque_encr_key);
1299 conf->pac_opaque_encr_key = NULL;
1300 os_free(conf->eap_fast_a_id);
1301 conf->eap_fast_a_id = NULL;
1302 os_free(conf->eap_fast_a_id_info);
1303 conf->eap_fast_a_id_info = NULL;
1304 }
1305
1306
1307 struct eapol_authenticator * eapol_auth_init(struct eapol_auth_config *conf,
1308 struct eapol_auth_cb *cb)
1309 {
1310 struct eapol_authenticator *eapol;
1311
1312 eapol = os_zalloc(sizeof(*eapol));
1313 if (eapol == NULL)
1314 return NULL;
1315
1316 if (eapol_auth_conf_clone(&eapol->conf, conf) < 0) {
1317 os_free(eapol);
1318 return NULL;
1319 }
1320
1321 eapol->cb.eapol_send = cb->eapol_send;
1322 eapol->cb.aaa_send = cb->aaa_send;
1323 eapol->cb.finished = cb->finished;
1324 eapol->cb.get_eap_user = cb->get_eap_user;
1325 eapol->cb.sta_entry_alive = cb->sta_entry_alive;
1326 eapol->cb.logger = cb->logger;
1327 eapol->cb.set_port_authorized = cb->set_port_authorized;
1328 eapol->cb.abort_auth = cb->abort_auth;
1329 eapol->cb.tx_key = cb->tx_key;
1330
1331 return eapol;
1332 }
1333
1334
1335 void eapol_auth_deinit(struct eapol_authenticator *eapol)
1336 {
1337 if (eapol == NULL)
1338 return;
1339
1340 eapol_auth_conf_free(&eapol->conf);
1341 os_free(eapol);
1342 }
DragonFly BSD