2 * EAP peer state machines (RFC 4137)
3 * Copyright (c) 2004-2010, Jouni Malinen <j@w1.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Alternatively, this software may be distributed under the terms of BSD
12 * See README and COPYING for more details.
14 * This file implements the Peer State Machine as defined in RFC 4137. The used
15 * states and state transitions match mostly with the RFC. However, there are
16 * couple of additional transitions for working around small issues noticed
17 * during testing. These exceptions are explained in comments within the
18 * functions in this file. The method functions, m.func(), are similar to the
19 * ones used in RFC 4137, but some small changes have used here to optimize
20 * operations and to add functionality needed for fast re-authentication
21 * (session resumption).
27 #include "pcsc_funcs.h"
28 #include "state_machine.h"
29 #include "crypto/crypto.h"
30 #include "crypto/tls.h"
31 #include "common/wpa_ctrl.h"
32 #include "eap_common/eap_wsc_common.h"
34 #include "eap_config.h"
36 #define STATE_MACHINE_DATA struct eap_sm
37 #define STATE_MACHINE_DEBUG_PREFIX "EAP"
39 #define EAP_MAX_AUTH_ROUNDS 50
40 #define EAP_CLIENT_TIMEOUT_DEFAULT 60
43 static Boolean eap_sm_allowMethod(struct eap_sm *sm, int vendor,
45 static struct wpabuf * eap_sm_buildNak(struct eap_sm *sm, int id);
46 static void eap_sm_processIdentity(struct eap_sm *sm,
47 const struct wpabuf *req);
48 static void eap_sm_processNotify(struct eap_sm *sm, const struct wpabuf *req);
49 static struct wpabuf * eap_sm_buildNotify(int id);
50 static void eap_sm_parseEapReq(struct eap_sm *sm, const struct wpabuf *req);
51 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
52 static const char * eap_sm_method_state_txt(EapMethodState state);
53 static const char * eap_sm_decision_txt(EapDecision decision);
54 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
58 static Boolean eapol_get_bool(struct eap_sm *sm, enum eapol_bool_var var)
60 return sm->eapol_cb->get_bool(sm->eapol_ctx, var);
64 static void eapol_set_bool(struct eap_sm *sm, enum eapol_bool_var var,
67 sm->eapol_cb->set_bool(sm->eapol_ctx, var, value);
71 static unsigned int eapol_get_int(struct eap_sm *sm, enum eapol_int_var var)
73 return sm->eapol_cb->get_int(sm->eapol_ctx, var);
77 static void eapol_set_int(struct eap_sm *sm, enum eapol_int_var var,
80 sm->eapol_cb->set_int(sm->eapol_ctx, var, value);
84 static struct wpabuf * eapol_get_eapReqData(struct eap_sm *sm)
86 return sm->eapol_cb->get_eapReqData(sm->eapol_ctx);
90 static void eap_deinit_prev_method(struct eap_sm *sm, const char *txt)
92 if (sm->m == NULL || sm->eap_method_priv == NULL)
95 wpa_printf(MSG_DEBUG, "EAP: deinitialize previously used EAP method "
96 "(%d, %s) at %s", sm->selectedMethod, sm->m->name, txt);
97 sm->m->deinit(sm, sm->eap_method_priv);
98 sm->eap_method_priv = NULL;
104 * eap_allowed_method - Check whether EAP method is allowed
105 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
106 * @vendor: Vendor-Id for expanded types or 0 = IETF for legacy types
108 * Returns: 1 = allowed EAP method, 0 = not allowed
110 int eap_allowed_method(struct eap_sm *sm, int vendor, u32 method)
112 struct eap_peer_config *config = eap_get_config(sm);
114 struct eap_method_type *m;
116 if (config == NULL || config->eap_methods == NULL)
119 m = config->eap_methods;
120 for (i = 0; m[i].vendor != EAP_VENDOR_IETF ||
121 m[i].method != EAP_TYPE_NONE; i++) {
122 if (m[i].vendor == vendor && m[i].method == method)
130 * This state initializes state machine variables when the machine is
131 * activated (portEnabled = TRUE). This is also used when re-starting
132 * authentication (eapRestart == TRUE).
134 SM_STATE(EAP, INITIALIZE)
136 SM_ENTRY(EAP, INITIALIZE);
137 if (sm->fast_reauth && sm->m && sm->m->has_reauth_data &&
138 sm->m->has_reauth_data(sm, sm->eap_method_priv) &&
140 wpa_printf(MSG_DEBUG, "EAP: maintaining EAP method data for "
141 "fast reauthentication");
142 sm->m->deinit_for_reauth(sm, sm->eap_method_priv);
144 eap_deinit_prev_method(sm, "INITIALIZE");
146 sm->selectedMethod = EAP_TYPE_NONE;
147 sm->methodState = METHOD_NONE;
148 sm->allowNotifications = TRUE;
149 sm->decision = DECISION_FAIL;
150 eapol_set_int(sm, EAPOL_idleWhile, sm->ClientTimeout);
151 eapol_set_bool(sm, EAPOL_eapSuccess, FALSE);
152 eapol_set_bool(sm, EAPOL_eapFail, FALSE);
153 os_free(sm->eapKeyData);
154 sm->eapKeyData = NULL;
155 sm->eapKeyAvailable = FALSE;
156 eapol_set_bool(sm, EAPOL_eapRestart, FALSE);
157 sm->lastId = -1; /* new session - make sure this does not match with
158 * the first EAP-Packet */
160 * RFC 4137 does not reset eapResp and eapNoResp here. However, this
161 * seemed to be able to trigger cases where both were set and if EAPOL
162 * state machine uses eapNoResp first, it may end up not sending a real
163 * reply correctly. This occurred when the workaround in FAIL state set
164 * eapNoResp = TRUE.. Maybe that workaround needs to be fixed to do
167 eapol_set_bool(sm, EAPOL_eapResp, FALSE);
168 eapol_set_bool(sm, EAPOL_eapNoResp, FALSE);
170 sm->prev_failure = 0;
175 * This state is reached whenever service from the lower layer is interrupted
176 * or unavailable (portEnabled == FALSE). Immediate transition to INITIALIZE
177 * occurs when the port becomes enabled.
179 SM_STATE(EAP, DISABLED)
181 SM_ENTRY(EAP, DISABLED);
187 * The state machine spends most of its time here, waiting for something to
188 * happen. This state is entered unconditionally from INITIALIZE, DISCARD, and
189 * SEND_RESPONSE states.
198 * This state is entered when an EAP packet is received (eapReq == TRUE) to
199 * parse the packet header.
201 SM_STATE(EAP, RECEIVED)
203 const struct wpabuf *eapReqData;
205 SM_ENTRY(EAP, RECEIVED);
206 eapReqData = eapol_get_eapReqData(sm);
207 /* parse rxReq, rxSuccess, rxFailure, reqId, reqMethod */
208 eap_sm_parseEapReq(sm, eapReqData);
214 * This state is entered when a request for a new type comes in. Either the
215 * correct method is started, or a Nak response is built.
217 SM_STATE(EAP, GET_METHOD)
222 SM_ENTRY(EAP, GET_METHOD);
224 if (sm->reqMethod == EAP_TYPE_EXPANDED)
225 method = sm->reqVendorMethod;
227 method = sm->reqMethod;
229 if (!eap_sm_allowMethod(sm, sm->reqVendor, method)) {
230 wpa_printf(MSG_DEBUG, "EAP: vendor %u method %u not allowed",
231 sm->reqVendor, method);
232 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_PROPOSED_METHOD
233 "vendor=%u method=%u -> NAK",
234 sm->reqVendor, method);
238 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_PROPOSED_METHOD
239 "vendor=%u method=%u", sm->reqVendor, method);
242 * RFC 4137 does not define specific operation for fast
243 * re-authentication (session resumption). The design here is to allow
244 * the previously used method data to be maintained for
245 * re-authentication if the method support session resumption.
246 * Otherwise, the previously used method data is freed and a new method
249 if (sm->fast_reauth &&
250 sm->m && sm->m->vendor == sm->reqVendor &&
251 sm->m->method == method &&
252 sm->m->has_reauth_data &&
253 sm->m->has_reauth_data(sm, sm->eap_method_priv)) {
254 wpa_printf(MSG_DEBUG, "EAP: Using previous method data"
255 " for fast re-authentication");
258 eap_deinit_prev_method(sm, "GET_METHOD");
262 sm->selectedMethod = sm->reqMethod;
264 sm->m = eap_peer_get_eap_method(sm->reqVendor, method);
266 wpa_printf(MSG_DEBUG, "EAP: Could not find selected method: "
267 "vendor %d method %d",
268 sm->reqVendor, method);
272 sm->ClientTimeout = EAP_CLIENT_TIMEOUT_DEFAULT;
274 wpa_printf(MSG_DEBUG, "EAP: Initialize selected EAP method: "
275 "vendor %u method %u (%s)",
276 sm->reqVendor, method, sm->m->name);
278 sm->eap_method_priv = sm->m->init_for_reauth(
279 sm, sm->eap_method_priv);
281 sm->eap_method_priv = sm->m->init(sm);
283 if (sm->eap_method_priv == NULL) {
284 struct eap_peer_config *config = eap_get_config(sm);
285 wpa_msg(sm->msg_ctx, MSG_INFO,
286 "EAP: Failed to initialize EAP method: vendor %u "
288 sm->reqVendor, method, sm->m->name);
290 sm->methodState = METHOD_NONE;
291 sm->selectedMethod = EAP_TYPE_NONE;
292 if (sm->reqMethod == EAP_TYPE_TLS && config &&
293 (config->pending_req_pin ||
294 config->pending_req_passphrase)) {
296 * Return without generating Nak in order to allow
297 * entering of PIN code or passphrase to retry the
298 * current EAP packet.
300 wpa_printf(MSG_DEBUG, "EAP: Pending PIN/passphrase "
301 "request - skip Nak");
308 sm->methodState = METHOD_INIT;
309 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_METHOD
310 "EAP vendor %u method %u (%s) selected",
311 sm->reqVendor, method, sm->m->name);
315 wpabuf_free(sm->eapRespData);
316 sm->eapRespData = NULL;
317 sm->eapRespData = eap_sm_buildNak(sm, sm->reqId);
322 * The method processing happens here. The request from the authenticator is
323 * processed, and an appropriate response packet is built.
325 SM_STATE(EAP, METHOD)
327 struct wpabuf *eapReqData;
328 struct eap_method_ret ret;
330 SM_ENTRY(EAP, METHOD);
332 wpa_printf(MSG_WARNING, "EAP::METHOD - method not selected");
336 eapReqData = eapol_get_eapReqData(sm);
339 * Get ignore, methodState, decision, allowNotifications, and
340 * eapRespData. RFC 4137 uses three separate method procedure (check,
341 * process, and buildResp) in this state. These have been combined into
342 * a single function call to m->process() in order to optimize EAP
343 * method implementation interface a bit. These procedures are only
344 * used from within this METHOD state, so there is no need to keep
345 * these as separate C functions.
347 * The RFC 4137 procedures return values as follows:
348 * ignore = m.check(eapReqData)
349 * (methodState, decision, allowNotifications) = m.process(eapReqData)
350 * eapRespData = m.buildResp(reqId)
352 os_memset(&ret, 0, sizeof(ret));
353 ret.ignore = sm->ignore;
354 ret.methodState = sm->methodState;
355 ret.decision = sm->decision;
356 ret.allowNotifications = sm->allowNotifications;
357 wpabuf_free(sm->eapRespData);
358 sm->eapRespData = NULL;
359 sm->eapRespData = sm->m->process(sm, sm->eap_method_priv, &ret,
361 wpa_printf(MSG_DEBUG, "EAP: method process -> ignore=%s "
362 "methodState=%s decision=%s",
363 ret.ignore ? "TRUE" : "FALSE",
364 eap_sm_method_state_txt(ret.methodState),
365 eap_sm_decision_txt(ret.decision));
367 sm->ignore = ret.ignore;
370 sm->methodState = ret.methodState;
371 sm->decision = ret.decision;
372 sm->allowNotifications = ret.allowNotifications;
374 if (sm->m->isKeyAvailable && sm->m->getKey &&
375 sm->m->isKeyAvailable(sm, sm->eap_method_priv)) {
376 os_free(sm->eapKeyData);
377 sm->eapKeyData = sm->m->getKey(sm, sm->eap_method_priv,
384 * This state signals the lower layer that a response packet is ready to be
387 SM_STATE(EAP, SEND_RESPONSE)
389 SM_ENTRY(EAP, SEND_RESPONSE);
390 wpabuf_free(sm->lastRespData);
391 if (sm->eapRespData) {
393 os_memcpy(sm->last_md5, sm->req_md5, 16);
394 sm->lastId = sm->reqId;
395 sm->lastRespData = wpabuf_dup(sm->eapRespData);
396 eapol_set_bool(sm, EAPOL_eapResp, TRUE);
398 sm->lastRespData = NULL;
399 eapol_set_bool(sm, EAPOL_eapReq, FALSE);
400 eapol_set_int(sm, EAPOL_idleWhile, sm->ClientTimeout);
405 * This state signals the lower layer that the request was discarded, and no
406 * response packet will be sent at this time.
408 SM_STATE(EAP, DISCARD)
410 SM_ENTRY(EAP, DISCARD);
411 eapol_set_bool(sm, EAPOL_eapReq, FALSE);
412 eapol_set_bool(sm, EAPOL_eapNoResp, TRUE);
417 * Handles requests for Identity method and builds a response.
419 SM_STATE(EAP, IDENTITY)
421 const struct wpabuf *eapReqData;
423 SM_ENTRY(EAP, IDENTITY);
424 eapReqData = eapol_get_eapReqData(sm);
425 eap_sm_processIdentity(sm, eapReqData);
426 wpabuf_free(sm->eapRespData);
427 sm->eapRespData = NULL;
428 sm->eapRespData = eap_sm_buildIdentity(sm, sm->reqId, 0);
433 * Handles requests for Notification method and builds a response.
435 SM_STATE(EAP, NOTIFICATION)
437 const struct wpabuf *eapReqData;
439 SM_ENTRY(EAP, NOTIFICATION);
440 eapReqData = eapol_get_eapReqData(sm);
441 eap_sm_processNotify(sm, eapReqData);
442 wpabuf_free(sm->eapRespData);
443 sm->eapRespData = NULL;
444 sm->eapRespData = eap_sm_buildNotify(sm->reqId);
449 * This state retransmits the previous response packet.
451 SM_STATE(EAP, RETRANSMIT)
453 SM_ENTRY(EAP, RETRANSMIT);
454 wpabuf_free(sm->eapRespData);
455 if (sm->lastRespData)
456 sm->eapRespData = wpabuf_dup(sm->lastRespData);
458 sm->eapRespData = NULL;
463 * This state is entered in case of a successful completion of authentication
464 * and state machine waits here until port is disabled or EAP authentication is
467 SM_STATE(EAP, SUCCESS)
469 SM_ENTRY(EAP, SUCCESS);
470 if (sm->eapKeyData != NULL)
471 sm->eapKeyAvailable = TRUE;
472 eapol_set_bool(sm, EAPOL_eapSuccess, TRUE);
475 * RFC 4137 does not clear eapReq here, but this seems to be required
476 * to avoid processing the same request twice when state machine is
479 eapol_set_bool(sm, EAPOL_eapReq, FALSE);
482 * RFC 4137 does not set eapNoResp here, but this seems to be required
483 * to get EAPOL Supplicant backend state machine into SUCCESS state. In
484 * addition, either eapResp or eapNoResp is required to be set after
485 * processing the received EAP frame.
487 eapol_set_bool(sm, EAPOL_eapNoResp, TRUE);
489 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_SUCCESS
490 "EAP authentication completed successfully");
495 * This state is entered in case of a failure and state machine waits here
496 * until port is disabled or EAP authentication is restarted.
498 SM_STATE(EAP, FAILURE)
500 SM_ENTRY(EAP, FAILURE);
501 eapol_set_bool(sm, EAPOL_eapFail, TRUE);
504 * RFC 4137 does not clear eapReq here, but this seems to be required
505 * to avoid processing the same request twice when state machine is
508 eapol_set_bool(sm, EAPOL_eapReq, FALSE);
511 * RFC 4137 does not set eapNoResp here. However, either eapResp or
512 * eapNoResp is required to be set after processing the received EAP
515 eapol_set_bool(sm, EAPOL_eapNoResp, TRUE);
517 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_FAILURE
518 "EAP authentication failed");
520 sm->prev_failure = 1;
524 static int eap_success_workaround(struct eap_sm *sm, int reqId, int lastId)
527 * At least Microsoft IAS and Meetinghouse Aegis seem to be sending
528 * EAP-Success/Failure with lastId + 1 even though RFC 3748 and
529 * RFC 4137 require that reqId == lastId. In addition, it looks like
530 * Ringmaster v2.1.2.0 would be using lastId + 2 in EAP-Success.
532 * Accept this kind of Id if EAP workarounds are enabled. These are
533 * unauthenticated plaintext messages, so this should have minimal
534 * security implications (bit easier to fake EAP-Success/Failure).
536 if (sm->workaround && (reqId == ((lastId + 1) & 0xff) ||
537 reqId == ((lastId + 2) & 0xff))) {
538 wpa_printf(MSG_DEBUG, "EAP: Workaround for unexpected "
539 "identifier field in EAP Success: "
540 "reqId=%d lastId=%d (these are supposed to be "
541 "same)", reqId, lastId);
544 wpa_printf(MSG_DEBUG, "EAP: EAP-Success Id mismatch - reqId=%d "
545 "lastId=%d", reqId, lastId);
551 * RFC 4137 - Appendix A.1: EAP Peer State Machine - State transitions
554 static void eap_peer_sm_step_idle(struct eap_sm *sm)
557 * The first three transitions are from RFC 4137. The last two are
558 * local additions to handle special cases with LEAP and PEAP server
559 * not sending EAP-Success in some cases.
561 if (eapol_get_bool(sm, EAPOL_eapReq))
562 SM_ENTER(EAP, RECEIVED);
563 else if ((eapol_get_bool(sm, EAPOL_altAccept) &&
564 sm->decision != DECISION_FAIL) ||
565 (eapol_get_int(sm, EAPOL_idleWhile) == 0 &&
566 sm->decision == DECISION_UNCOND_SUCC))
567 SM_ENTER(EAP, SUCCESS);
568 else if (eapol_get_bool(sm, EAPOL_altReject) ||
569 (eapol_get_int(sm, EAPOL_idleWhile) == 0 &&
570 sm->decision != DECISION_UNCOND_SUCC) ||
571 (eapol_get_bool(sm, EAPOL_altAccept) &&
572 sm->methodState != METHOD_CONT &&
573 sm->decision == DECISION_FAIL))
574 SM_ENTER(EAP, FAILURE);
575 else if (sm->selectedMethod == EAP_TYPE_LEAP &&
576 sm->leap_done && sm->decision != DECISION_FAIL &&
577 sm->methodState == METHOD_DONE)
578 SM_ENTER(EAP, SUCCESS);
579 else if (sm->selectedMethod == EAP_TYPE_PEAP &&
580 sm->peap_done && sm->decision != DECISION_FAIL &&
581 sm->methodState == METHOD_DONE)
582 SM_ENTER(EAP, SUCCESS);
586 static int eap_peer_req_is_duplicate(struct eap_sm *sm)
590 duplicate = (sm->reqId == sm->lastId) && sm->rxReq;
591 if (sm->workaround && duplicate &&
592 os_memcmp(sm->req_md5, sm->last_md5, 16) != 0) {
594 * RFC 4137 uses (reqId == lastId) as the only verification for
595 * duplicate EAP requests. However, this misses cases where the
596 * AS is incorrectly using the same id again; and
597 * unfortunately, such implementations exist. Use MD5 hash as
598 * an extra verification for the packets being duplicate to
599 * workaround these issues.
601 wpa_printf(MSG_DEBUG, "EAP: AS used the same Id again, but "
602 "EAP packets were not identical");
603 wpa_printf(MSG_DEBUG, "EAP: workaround - assume this is not a "
612 static void eap_peer_sm_step_received(struct eap_sm *sm)
614 int duplicate = eap_peer_req_is_duplicate(sm);
617 * Two special cases below for LEAP are local additions to work around
618 * odd LEAP behavior (EAP-Success in the middle of authentication and
619 * then swapped roles). Other transitions are based on RFC 4137.
621 if (sm->rxSuccess && sm->decision != DECISION_FAIL &&
622 (sm->reqId == sm->lastId ||
623 eap_success_workaround(sm, sm->reqId, sm->lastId)))
624 SM_ENTER(EAP, SUCCESS);
625 else if (sm->methodState != METHOD_CONT &&
627 sm->decision != DECISION_UNCOND_SUCC) ||
628 (sm->rxSuccess && sm->decision == DECISION_FAIL &&
629 (sm->selectedMethod != EAP_TYPE_LEAP ||
630 sm->methodState != METHOD_MAY_CONT))) &&
631 (sm->reqId == sm->lastId ||
632 eap_success_workaround(sm, sm->reqId, sm->lastId)))
633 SM_ENTER(EAP, FAILURE);
634 else if (sm->rxReq && duplicate)
635 SM_ENTER(EAP, RETRANSMIT);
636 else if (sm->rxReq && !duplicate &&
637 sm->reqMethod == EAP_TYPE_NOTIFICATION &&
638 sm->allowNotifications)
639 SM_ENTER(EAP, NOTIFICATION);
640 else if (sm->rxReq && !duplicate &&
641 sm->selectedMethod == EAP_TYPE_NONE &&
642 sm->reqMethod == EAP_TYPE_IDENTITY)
643 SM_ENTER(EAP, IDENTITY);
644 else if (sm->rxReq && !duplicate &&
645 sm->selectedMethod == EAP_TYPE_NONE &&
646 sm->reqMethod != EAP_TYPE_IDENTITY &&
647 sm->reqMethod != EAP_TYPE_NOTIFICATION)
648 SM_ENTER(EAP, GET_METHOD);
649 else if (sm->rxReq && !duplicate &&
650 sm->reqMethod == sm->selectedMethod &&
651 sm->methodState != METHOD_DONE)
652 SM_ENTER(EAP, METHOD);
653 else if (sm->selectedMethod == EAP_TYPE_LEAP &&
654 (sm->rxSuccess || sm->rxResp))
655 SM_ENTER(EAP, METHOD);
657 SM_ENTER(EAP, DISCARD);
661 static void eap_peer_sm_step_local(struct eap_sm *sm)
663 switch (sm->EAP_state) {
668 if (eapol_get_bool(sm, EAPOL_portEnabled) &&
670 SM_ENTER(EAP, INITIALIZE);
673 eap_peer_sm_step_idle(sm);
676 eap_peer_sm_step_received(sm);
679 if (sm->selectedMethod == sm->reqMethod)
680 SM_ENTER(EAP, METHOD);
682 SM_ENTER(EAP, SEND_RESPONSE);
686 SM_ENTER(EAP, DISCARD);
688 SM_ENTER(EAP, SEND_RESPONSE);
690 case EAP_SEND_RESPONSE:
697 SM_ENTER(EAP, SEND_RESPONSE);
699 case EAP_NOTIFICATION:
700 SM_ENTER(EAP, SEND_RESPONSE);
703 SM_ENTER(EAP, SEND_RESPONSE);
715 /* Global transitions */
716 if (eapol_get_bool(sm, EAPOL_eapRestart) &&
717 eapol_get_bool(sm, EAPOL_portEnabled))
718 SM_ENTER_GLOBAL(EAP, INITIALIZE);
719 else if (!eapol_get_bool(sm, EAPOL_portEnabled) || sm->force_disabled)
720 SM_ENTER_GLOBAL(EAP, DISABLED);
721 else if (sm->num_rounds > EAP_MAX_AUTH_ROUNDS) {
722 /* RFC 4137 does not place any limit on number of EAP messages
723 * in an authentication session. However, some error cases have
724 * ended up in a state were EAP messages were sent between the
725 * peer and server in a loop (e.g., TLS ACK frame in both
726 * direction). Since this is quite undesired outcome, limit the
727 * total number of EAP round-trips and abort authentication if
728 * this limit is exceeded.
730 if (sm->num_rounds == EAP_MAX_AUTH_ROUNDS + 1) {
731 wpa_msg(sm->msg_ctx, MSG_INFO, "EAP: more than %d "
732 "authentication rounds - abort",
733 EAP_MAX_AUTH_ROUNDS);
735 SM_ENTER_GLOBAL(EAP, FAILURE);
738 /* Local transitions */
739 eap_peer_sm_step_local(sm);
744 static Boolean eap_sm_allowMethod(struct eap_sm *sm, int vendor,
747 if (!eap_allowed_method(sm, vendor, method)) {
748 wpa_printf(MSG_DEBUG, "EAP: configuration does not allow: "
749 "vendor %u method %u", vendor, method);
752 if (eap_peer_get_eap_method(vendor, method))
754 wpa_printf(MSG_DEBUG, "EAP: not included in build: "
755 "vendor %u method %u", vendor, method);
760 static struct wpabuf * eap_sm_build_expanded_nak(
761 struct eap_sm *sm, int id, const struct eap_method *methods,
766 const struct eap_method *m;
768 wpa_printf(MSG_DEBUG, "EAP: Building expanded EAP-Nak");
770 /* RFC 3748 - 5.3.2: Expanded Nak */
771 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_EXPANDED,
772 8 + 8 * (count + 1), EAP_CODE_RESPONSE, id);
776 wpabuf_put_be24(resp, EAP_VENDOR_IETF);
777 wpabuf_put_be32(resp, EAP_TYPE_NAK);
779 for (m = methods; m; m = m->next) {
780 if (sm->reqVendor == m->vendor &&
781 sm->reqVendorMethod == m->method)
782 continue; /* do not allow the current method again */
783 if (eap_allowed_method(sm, m->vendor, m->method)) {
784 wpa_printf(MSG_DEBUG, "EAP: allowed type: "
785 "vendor=%u method=%u",
786 m->vendor, m->method);
787 wpabuf_put_u8(resp, EAP_TYPE_EXPANDED);
788 wpabuf_put_be24(resp, m->vendor);
789 wpabuf_put_be32(resp, m->method);
795 wpa_printf(MSG_DEBUG, "EAP: no more allowed methods");
796 wpabuf_put_u8(resp, EAP_TYPE_EXPANDED);
797 wpabuf_put_be24(resp, EAP_VENDOR_IETF);
798 wpabuf_put_be32(resp, EAP_TYPE_NONE);
801 eap_update_len(resp);
807 static struct wpabuf * eap_sm_buildNak(struct eap_sm *sm, int id)
811 int found = 0, expanded_found = 0;
813 const struct eap_method *methods, *m;
815 wpa_printf(MSG_DEBUG, "EAP: Building EAP-Nak (requested type %u "
816 "vendor=%u method=%u not allowed)", sm->reqMethod,
817 sm->reqVendor, sm->reqVendorMethod);
818 methods = eap_peer_get_methods(&count);
821 if (sm->reqMethod == EAP_TYPE_EXPANDED)
822 return eap_sm_build_expanded_nak(sm, id, methods, count);
824 /* RFC 3748 - 5.3.1: Legacy Nak */
825 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_NAK,
826 sizeof(struct eap_hdr) + 1 + count + 1,
827 EAP_CODE_RESPONSE, id);
831 start = wpabuf_put(resp, 0);
832 for (m = methods; m; m = m->next) {
833 if (m->vendor == EAP_VENDOR_IETF && m->method == sm->reqMethod)
834 continue; /* do not allow the current method again */
835 if (eap_allowed_method(sm, m->vendor, m->method)) {
836 if (m->vendor != EAP_VENDOR_IETF) {
840 wpabuf_put_u8(resp, EAP_TYPE_EXPANDED);
842 wpabuf_put_u8(resp, m->method);
847 wpabuf_put_u8(resp, EAP_TYPE_NONE);
848 wpa_hexdump(MSG_DEBUG, "EAP: allowed methods", start, found);
850 eap_update_len(resp);
856 static void eap_sm_processIdentity(struct eap_sm *sm, const struct wpabuf *req)
858 const struct eap_hdr *hdr = wpabuf_head(req);
859 const u8 *pos = (const u8 *) (hdr + 1);
862 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_STARTED
863 "EAP authentication started");
866 * RFC 3748 - 5.1: Identity
867 * Data field may contain a displayable message in UTF-8. If this
868 * includes NUL-character, only the data before that should be
869 * displayed. Some EAP implementasitons may piggy-back additional
870 * options after the NUL.
872 /* TODO: could save displayable message so that it can be shown to the
873 * user in case of interaction is required */
874 wpa_hexdump_ascii(MSG_DEBUG, "EAP: EAP-Request Identity data",
875 pos, be_to_host16(hdr->length) - 5);
880 static int eap_sm_imsi_identity(struct eap_sm *sm,
881 struct eap_peer_config *conf)
886 struct eap_method_type *m = conf->eap_methods;
889 imsi_len = sizeof(imsi);
890 if (scard_get_imsi(sm->scard_ctx, imsi, &imsi_len)) {
891 wpa_printf(MSG_WARNING, "Failed to get IMSI from SIM");
895 wpa_hexdump_ascii(MSG_DEBUG, "IMSI", (u8 *) imsi, imsi_len);
897 for (i = 0; m && (m[i].vendor != EAP_VENDOR_IETF ||
898 m[i].method != EAP_TYPE_NONE); i++) {
899 if (m[i].vendor == EAP_VENDOR_IETF &&
900 m[i].method == EAP_TYPE_AKA) {
906 os_free(conf->identity);
907 conf->identity = os_malloc(1 + imsi_len);
908 if (conf->identity == NULL) {
909 wpa_printf(MSG_WARNING, "Failed to allocate buffer for "
910 "IMSI-based identity");
914 conf->identity[0] = aka ? '0' : '1';
915 os_memcpy(conf->identity + 1, imsi, imsi_len);
916 conf->identity_len = 1 + imsi_len;
920 #endif /* PCSC_FUNCS */
923 static int eap_sm_set_scard_pin(struct eap_sm *sm,
924 struct eap_peer_config *conf)
927 if (scard_set_pin(sm->scard_ctx, conf->pin)) {
929 * Make sure the same PIN is not tried again in order to avoid
935 wpa_printf(MSG_WARNING, "PIN validation failed");
936 eap_sm_request_pin(sm);
940 #else /* PCSC_FUNCS */
942 #endif /* PCSC_FUNCS */
945 static int eap_sm_get_scard_identity(struct eap_sm *sm,
946 struct eap_peer_config *conf)
949 if (eap_sm_set_scard_pin(sm, conf))
952 return eap_sm_imsi_identity(sm, conf);
953 #else /* PCSC_FUNCS */
955 #endif /* PCSC_FUNCS */
960 * eap_sm_buildIdentity - Build EAP-Identity/Response for the current network
961 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
962 * @id: EAP identifier for the packet
963 * @encrypted: Whether the packet is for encrypted tunnel (EAP phase 2)
964 * Returns: Pointer to the allocated EAP-Identity/Response packet or %NULL on
967 * This function allocates and builds an EAP-Identity/Response packet for the
968 * current network. The caller is responsible for freeing the returned data.
970 struct wpabuf * eap_sm_buildIdentity(struct eap_sm *sm, int id, int encrypted)
972 struct eap_peer_config *config = eap_get_config(sm);
977 if (config == NULL) {
978 wpa_printf(MSG_WARNING, "EAP: buildIdentity: configuration "
979 "was not available");
983 if (sm->m && sm->m->get_identity &&
984 (identity = sm->m->get_identity(sm, sm->eap_method_priv,
985 &identity_len)) != NULL) {
986 wpa_hexdump_ascii(MSG_DEBUG, "EAP: using method re-auth "
987 "identity", identity, identity_len);
988 } else if (!encrypted && config->anonymous_identity) {
989 identity = config->anonymous_identity;
990 identity_len = config->anonymous_identity_len;
991 wpa_hexdump_ascii(MSG_DEBUG, "EAP: using anonymous identity",
992 identity, identity_len);
994 identity = config->identity;
995 identity_len = config->identity_len;
996 wpa_hexdump_ascii(MSG_DEBUG, "EAP: using real identity",
997 identity, identity_len);
1000 if (identity == NULL) {
1001 wpa_printf(MSG_WARNING, "EAP: buildIdentity: identity "
1002 "configuration was not available");
1004 if (eap_sm_get_scard_identity(sm, config) < 0)
1006 identity = config->identity;
1007 identity_len = config->identity_len;
1008 wpa_hexdump_ascii(MSG_DEBUG, "permanent identity from "
1009 "IMSI", identity, identity_len);
1011 eap_sm_request_identity(sm);
1014 } else if (config->pcsc) {
1015 if (eap_sm_set_scard_pin(sm, config) < 0)
1019 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_IDENTITY, identity_len,
1020 EAP_CODE_RESPONSE, id);
1024 wpabuf_put_data(resp, identity, identity_len);
1030 static void eap_sm_processNotify(struct eap_sm *sm, const struct wpabuf *req)
1036 pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_NOTIFICATION, req,
1040 wpa_hexdump_ascii(MSG_DEBUG, "EAP: EAP-Request Notification data",
1043 msg = os_malloc(msg_len + 1);
1046 for (i = 0; i < msg_len; i++)
1047 msg[i] = isprint(pos[i]) ? (char) pos[i] : '_';
1048 msg[msg_len] = '\0';
1049 wpa_msg(sm->msg_ctx, MSG_INFO, "%s%s",
1050 WPA_EVENT_EAP_NOTIFICATION, msg);
1055 static struct wpabuf * eap_sm_buildNotify(int id)
1057 struct wpabuf *resp;
1059 wpa_printf(MSG_DEBUG, "EAP: Generating EAP-Response Notification");
1060 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_NOTIFICATION, 0,
1061 EAP_CODE_RESPONSE, id);
1069 static void eap_sm_parseEapReq(struct eap_sm *sm, const struct wpabuf *req)
1071 const struct eap_hdr *hdr;
1075 sm->rxReq = sm->rxResp = sm->rxSuccess = sm->rxFailure = FALSE;
1077 sm->reqMethod = EAP_TYPE_NONE;
1078 sm->reqVendor = EAP_VENDOR_IETF;
1079 sm->reqVendorMethod = EAP_TYPE_NONE;
1081 if (req == NULL || wpabuf_len(req) < sizeof(*hdr))
1084 hdr = wpabuf_head(req);
1085 plen = be_to_host16(hdr->length);
1086 if (plen > wpabuf_len(req)) {
1087 wpa_printf(MSG_DEBUG, "EAP: Ignored truncated EAP-Packet "
1088 "(len=%lu plen=%lu)",
1089 (unsigned long) wpabuf_len(req),
1090 (unsigned long) plen);
1094 sm->reqId = hdr->identifier;
1096 if (sm->workaround) {
1098 addr[0] = wpabuf_head(req);
1099 md5_vector(1, addr, &plen, sm->req_md5);
1102 switch (hdr->code) {
1103 case EAP_CODE_REQUEST:
1104 if (plen < sizeof(*hdr) + 1) {
1105 wpa_printf(MSG_DEBUG, "EAP: Too short EAP-Request - "
1110 pos = (const u8 *) (hdr + 1);
1111 sm->reqMethod = *pos++;
1112 if (sm->reqMethod == EAP_TYPE_EXPANDED) {
1113 if (plen < sizeof(*hdr) + 8) {
1114 wpa_printf(MSG_DEBUG, "EAP: Ignored truncated "
1115 "expanded EAP-Packet (plen=%lu)",
1116 (unsigned long) plen);
1119 sm->reqVendor = WPA_GET_BE24(pos);
1121 sm->reqVendorMethod = WPA_GET_BE32(pos);
1123 wpa_printf(MSG_DEBUG, "EAP: Received EAP-Request id=%d "
1124 "method=%u vendor=%u vendorMethod=%u",
1125 sm->reqId, sm->reqMethod, sm->reqVendor,
1126 sm->reqVendorMethod);
1128 case EAP_CODE_RESPONSE:
1129 if (sm->selectedMethod == EAP_TYPE_LEAP) {
1131 * LEAP differs from RFC 4137 by using reversed roles
1132 * for mutual authentication and because of this, we
1133 * need to accept EAP-Response frames if LEAP is used.
1135 if (plen < sizeof(*hdr) + 1) {
1136 wpa_printf(MSG_DEBUG, "EAP: Too short "
1137 "EAP-Response - no Type field");
1141 pos = (const u8 *) (hdr + 1);
1142 sm->reqMethod = *pos;
1143 wpa_printf(MSG_DEBUG, "EAP: Received EAP-Response for "
1144 "LEAP method=%d id=%d",
1145 sm->reqMethod, sm->reqId);
1148 wpa_printf(MSG_DEBUG, "EAP: Ignored EAP-Response");
1150 case EAP_CODE_SUCCESS:
1151 wpa_printf(MSG_DEBUG, "EAP: Received EAP-Success");
1152 sm->rxSuccess = TRUE;
1154 case EAP_CODE_FAILURE:
1155 wpa_printf(MSG_DEBUG, "EAP: Received EAP-Failure");
1156 sm->rxFailure = TRUE;
1159 wpa_printf(MSG_DEBUG, "EAP: Ignored EAP-Packet with unknown "
1160 "code %d", hdr->code);
1166 static void eap_peer_sm_tls_event(void *ctx, enum tls_event ev,
1167 union tls_event_data *data)
1169 struct eap_sm *sm = ctx;
1170 char *hash_hex = NULL;
1173 case TLS_CERT_CHAIN_FAILURE:
1174 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_TLS_CERT_ERROR
1175 "reason=%d depth=%d subject='%s' err='%s'",
1176 data->cert_fail.reason,
1177 data->cert_fail.depth,
1178 data->cert_fail.subject,
1179 data->cert_fail.reason_txt);
1181 case TLS_PEER_CERTIFICATE:
1182 if (!sm->eapol_cb->notify_cert)
1185 if (data->peer_cert.hash) {
1186 size_t len = data->peer_cert.hash_len * 2 + 1;
1187 hash_hex = os_malloc(len);
1189 wpa_snprintf_hex(hash_hex, len,
1190 data->peer_cert.hash,
1191 data->peer_cert.hash_len);
1195 sm->eapol_cb->notify_cert(sm->eapol_ctx,
1196 data->peer_cert.depth,
1197 data->peer_cert.subject,
1198 hash_hex, data->peer_cert.cert);
1207 * eap_peer_sm_init - Allocate and initialize EAP peer state machine
1208 * @eapol_ctx: Context data to be used with eapol_cb calls
1209 * @eapol_cb: Pointer to EAPOL callback functions
1210 * @msg_ctx: Context data for wpa_msg() calls
1211 * @conf: EAP configuration
1212 * Returns: Pointer to the allocated EAP state machine or %NULL on failure
1214 * This function allocates and initializes an EAP state machine. In addition,
1215 * this initializes TLS library for the new EAP state machine. eapol_cb pointer
1216 * will be in use until eap_peer_sm_deinit() is used to deinitialize this EAP
1217 * state machine. Consequently, the caller must make sure that this data
1218 * structure remains alive while the EAP state machine is active.
1220 struct eap_sm * eap_peer_sm_init(void *eapol_ctx,
1221 struct eapol_callbacks *eapol_cb,
1222 void *msg_ctx, struct eap_config *conf)
1225 struct tls_config tlsconf;
1227 sm = os_zalloc(sizeof(*sm));
1230 sm->eapol_ctx = eapol_ctx;
1231 sm->eapol_cb = eapol_cb;
1232 sm->msg_ctx = msg_ctx;
1233 sm->ClientTimeout = EAP_CLIENT_TIMEOUT_DEFAULT;
1234 sm->wps = conf->wps;
1236 os_memset(&tlsconf, 0, sizeof(tlsconf));
1237 tlsconf.opensc_engine_path = conf->opensc_engine_path;
1238 tlsconf.pkcs11_engine_path = conf->pkcs11_engine_path;
1239 tlsconf.pkcs11_module_path = conf->pkcs11_module_path;
1241 tlsconf.fips_mode = 1;
1242 #endif /* CONFIG_FIPS */
1243 tlsconf.event_cb = eap_peer_sm_tls_event;
1244 tlsconf.cb_ctx = sm;
1245 sm->ssl_ctx = tls_init(&tlsconf);
1246 if (sm->ssl_ctx == NULL) {
1247 wpa_printf(MSG_WARNING, "SSL: Failed to initialize TLS "
1258 * eap_peer_sm_deinit - Deinitialize and free an EAP peer state machine
1259 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1261 * This function deinitializes EAP state machine and frees all allocated
1264 void eap_peer_sm_deinit(struct eap_sm *sm)
1268 eap_deinit_prev_method(sm, "EAP deinit");
1270 tls_deinit(sm->ssl_ctx);
1276 * eap_peer_sm_step - Step EAP peer state machine
1277 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1278 * Returns: 1 if EAP state was changed or 0 if not
1280 * This function advances EAP state machine to a new state to match with the
1281 * current variables. This should be called whenever variables used by the EAP
1282 * state machine have changed.
1284 int eap_peer_sm_step(struct eap_sm *sm)
1288 sm->changed = FALSE;
1292 } while (sm->changed);
1298 * eap_sm_abort - Abort EAP authentication
1299 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1301 * Release system resources that have been allocated for the authentication
1302 * session without fully deinitializing the EAP state machine.
1304 void eap_sm_abort(struct eap_sm *sm)
1306 wpabuf_free(sm->lastRespData);
1307 sm->lastRespData = NULL;
1308 wpabuf_free(sm->eapRespData);
1309 sm->eapRespData = NULL;
1310 os_free(sm->eapKeyData);
1311 sm->eapKeyData = NULL;
1313 /* This is not clearly specified in the EAP statemachines draft, but
1314 * it seems necessary to make sure that some of the EAPOL variables get
1315 * cleared for the next authentication. */
1316 eapol_set_bool(sm, EAPOL_eapSuccess, FALSE);
1320 #ifdef CONFIG_CTRL_IFACE
1321 static const char * eap_sm_state_txt(int state)
1324 case EAP_INITIALIZE:
1325 return "INITIALIZE";
1332 case EAP_GET_METHOD:
1333 return "GET_METHOD";
1336 case EAP_SEND_RESPONSE:
1337 return "SEND_RESPONSE";
1342 case EAP_NOTIFICATION:
1343 return "NOTIFICATION";
1344 case EAP_RETRANSMIT:
1345 return "RETRANSMIT";
1354 #endif /* CONFIG_CTRL_IFACE */
1357 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
1358 static const char * eap_sm_method_state_txt(EapMethodState state)
1367 case METHOD_MAY_CONT:
1377 static const char * eap_sm_decision_txt(EapDecision decision)
1382 case DECISION_COND_SUCC:
1384 case DECISION_UNCOND_SUCC:
1385 return "UNCOND_SUCC";
1390 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
1393 #ifdef CONFIG_CTRL_IFACE
1396 * eap_sm_get_status - Get EAP state machine status
1397 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1398 * @buf: Buffer for status information
1399 * @buflen: Maximum buffer length
1400 * @verbose: Whether to include verbose status information
1401 * Returns: Number of bytes written to buf.
1403 * Query EAP state machine for status information. This function fills in a
1404 * text area with current status information from the EAPOL state machine. If
1405 * the buffer (buf) is not large enough, status information will be truncated
1406 * to fit the buffer.
1408 int eap_sm_get_status(struct eap_sm *sm, char *buf, size_t buflen, int verbose)
1415 len = os_snprintf(buf, buflen,
1417 eap_sm_state_txt(sm->EAP_state));
1418 if (len < 0 || (size_t) len >= buflen)
1421 if (sm->selectedMethod != EAP_TYPE_NONE) {
1426 const struct eap_method *m =
1427 eap_peer_get_eap_method(EAP_VENDOR_IETF,
1428 sm->selectedMethod);
1434 ret = os_snprintf(buf + len, buflen - len,
1435 "selectedMethod=%d (EAP-%s)\n",
1436 sm->selectedMethod, name);
1437 if (ret < 0 || (size_t) ret >= buflen - len)
1441 if (sm->m && sm->m->get_status) {
1442 len += sm->m->get_status(sm, sm->eap_method_priv,
1443 buf + len, buflen - len,
1449 ret = os_snprintf(buf + len, buflen - len,
1453 "ClientTimeout=%d\n",
1455 eap_sm_method_state_txt(sm->methodState),
1456 eap_sm_decision_txt(sm->decision),
1458 if (ret < 0 || (size_t) ret >= buflen - len)
1465 #endif /* CONFIG_CTRL_IFACE */
1468 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
1470 TYPE_IDENTITY, TYPE_PASSWORD, TYPE_OTP, TYPE_PIN, TYPE_NEW_PASSWORD,
1472 } eap_ctrl_req_type;
1474 static void eap_sm_request(struct eap_sm *sm, eap_ctrl_req_type type,
1475 const char *msg, size_t msglen)
1477 struct eap_peer_config *config;
1478 char *field, *txt, *tmp;
1482 config = eap_get_config(sm);
1490 config->pending_req_identity++;
1495 config->pending_req_password++;
1497 case TYPE_NEW_PASSWORD:
1498 field = "NEW_PASSWORD";
1499 txt = "New Password";
1500 config->pending_req_new_password++;
1505 config->pending_req_pin++;
1510 tmp = os_malloc(msglen + 3);
1514 os_memcpy(tmp + 1, msg, msglen);
1515 tmp[msglen + 1] = ']';
1516 tmp[msglen + 2] = '\0';
1518 os_free(config->pending_req_otp);
1519 config->pending_req_otp = tmp;
1520 config->pending_req_otp_len = msglen + 3;
1522 if (config->pending_req_otp == NULL)
1524 txt = config->pending_req_otp;
1527 case TYPE_PASSPHRASE:
1528 field = "PASSPHRASE";
1529 txt = "Private key passphrase";
1530 config->pending_req_passphrase++;
1536 if (sm->eapol_cb->eap_param_needed)
1537 sm->eapol_cb->eap_param_needed(sm->eapol_ctx, field, txt);
1539 #else /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
1540 #define eap_sm_request(sm, type, msg, msglen) do { } while (0)
1541 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
1543 const char * eap_sm_get_method_name(struct eap_sm *sm)
1552 * eap_sm_request_identity - Request identity from user (ctrl_iface)
1553 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1555 * EAP methods can call this function to request identity information for the
1556 * current network. This is normally called when the identity is not included
1557 * in the network configuration. The request will be sent to monitor programs
1558 * through the control interface.
1560 void eap_sm_request_identity(struct eap_sm *sm)
1562 eap_sm_request(sm, TYPE_IDENTITY, NULL, 0);
1567 * eap_sm_request_password - Request password from user (ctrl_iface)
1568 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1570 * EAP methods can call this function to request password information for the
1571 * current network. This is normally called when the password is not included
1572 * in the network configuration. The request will be sent to monitor programs
1573 * through the control interface.
1575 void eap_sm_request_password(struct eap_sm *sm)
1577 eap_sm_request(sm, TYPE_PASSWORD, NULL, 0);
1582 * eap_sm_request_new_password - Request new password from user (ctrl_iface)
1583 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1585 * EAP methods can call this function to request new password information for
1586 * the current network. This is normally called when the EAP method indicates
1587 * that the current password has expired and password change is required. The
1588 * request will be sent to monitor programs through the control interface.
1590 void eap_sm_request_new_password(struct eap_sm *sm)
1592 eap_sm_request(sm, TYPE_NEW_PASSWORD, NULL, 0);
1597 * eap_sm_request_pin - Request SIM or smart card PIN from user (ctrl_iface)
1598 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1600 * EAP methods can call this function to request SIM or smart card PIN
1601 * information for the current network. This is normally called when the PIN is
1602 * not included in the network configuration. The request will be sent to
1603 * monitor programs through the control interface.
1605 void eap_sm_request_pin(struct eap_sm *sm)
1607 eap_sm_request(sm, TYPE_PIN, NULL, 0);
1612 * eap_sm_request_otp - Request one time password from user (ctrl_iface)
1613 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1614 * @msg: Message to be displayed to the user when asking for OTP
1615 * @msg_len: Length of the user displayable message
1617 * EAP methods can call this function to request open time password (OTP) for
1618 * the current network. The request will be sent to monitor programs through
1619 * the control interface.
1621 void eap_sm_request_otp(struct eap_sm *sm, const char *msg, size_t msg_len)
1623 eap_sm_request(sm, TYPE_OTP, msg, msg_len);
1628 * eap_sm_request_passphrase - Request passphrase from user (ctrl_iface)
1629 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1631 * EAP methods can call this function to request passphrase for a private key
1632 * for the current network. This is normally called when the passphrase is not
1633 * included in the network configuration. The request will be sent to monitor
1634 * programs through the control interface.
1636 void eap_sm_request_passphrase(struct eap_sm *sm)
1638 eap_sm_request(sm, TYPE_PASSPHRASE, NULL, 0);
1643 * eap_sm_notify_ctrl_attached - Notification of attached monitor
1644 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1646 * Notify EAP state machines that a monitor was attached to the control
1647 * interface to trigger re-sending of pending requests for user input.
1649 void eap_sm_notify_ctrl_attached(struct eap_sm *sm)
1651 struct eap_peer_config *config = eap_get_config(sm);
1656 /* Re-send any pending requests for user data since a new control
1657 * interface was added. This handles cases where the EAP authentication
1658 * starts immediately after system startup when the user interface is
1659 * not yet running. */
1660 if (config->pending_req_identity)
1661 eap_sm_request_identity(sm);
1662 if (config->pending_req_password)
1663 eap_sm_request_password(sm);
1664 if (config->pending_req_new_password)
1665 eap_sm_request_new_password(sm);
1666 if (config->pending_req_otp)
1667 eap_sm_request_otp(sm, NULL, 0);
1668 if (config->pending_req_pin)
1669 eap_sm_request_pin(sm);
1670 if (config->pending_req_passphrase)
1671 eap_sm_request_passphrase(sm);
1675 static int eap_allowed_phase2_type(int vendor, int type)
1677 if (vendor != EAP_VENDOR_IETF)
1679 return type != EAP_TYPE_PEAP && type != EAP_TYPE_TTLS &&
1680 type != EAP_TYPE_FAST;
1685 * eap_get_phase2_type - Get EAP type for the given EAP phase 2 method name
1686 * @name: EAP method name, e.g., MD5
1687 * @vendor: Buffer for returning EAP Vendor-Id
1688 * Returns: EAP method type or %EAP_TYPE_NONE if not found
1690 * This function maps EAP type names into EAP type numbers that are allowed for
1691 * Phase 2, i.e., for tunneled authentication. Phase 2 is used, e.g., with
1692 * EAP-PEAP, EAP-TTLS, and EAP-FAST.
1694 u32 eap_get_phase2_type(const char *name, int *vendor)
1697 u8 type = eap_peer_get_type(name, &v);
1698 if (eap_allowed_phase2_type(v, type)) {
1702 *vendor = EAP_VENDOR_IETF;
1703 return EAP_TYPE_NONE;
1708 * eap_get_phase2_types - Get list of allowed EAP phase 2 types
1709 * @config: Pointer to a network configuration
1710 * @count: Pointer to a variable to be filled with number of returned EAP types
1711 * Returns: Pointer to allocated type list or %NULL on failure
1713 * This function generates an array of allowed EAP phase 2 (tunneled) types for
1714 * the given network configuration.
1716 struct eap_method_type * eap_get_phase2_types(struct eap_peer_config *config,
1719 struct eap_method_type *buf;
1723 const struct eap_method *methods, *m;
1725 methods = eap_peer_get_methods(&mcount);
1726 if (methods == NULL)
1729 buf = os_malloc(mcount * sizeof(struct eap_method_type));
1733 for (m = methods; m; m = m->next) {
1736 if (eap_allowed_phase2_type(vendor, method)) {
1737 if (vendor == EAP_VENDOR_IETF &&
1738 method == EAP_TYPE_TLS && config &&
1739 config->private_key2 == NULL)
1741 buf[*count].vendor = vendor;
1742 buf[*count].method = method;
1752 * eap_set_fast_reauth - Update fast_reauth setting
1753 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1754 * @enabled: 1 = Fast reauthentication is enabled, 0 = Disabled
1756 void eap_set_fast_reauth(struct eap_sm *sm, int enabled)
1758 sm->fast_reauth = enabled;
1763 * eap_set_workaround - Update EAP workarounds setting
1764 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1765 * @workaround: 1 = Enable EAP workarounds, 0 = Disable EAP workarounds
1767 void eap_set_workaround(struct eap_sm *sm, unsigned int workaround)
1769 sm->workaround = workaround;
1774 * eap_get_config - Get current network configuration
1775 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1776 * Returns: Pointer to the current network configuration or %NULL if not found
1778 * EAP peer methods should avoid using this function if they can use other
1779 * access functions, like eap_get_config_identity() and
1780 * eap_get_config_password(), that do not require direct access to
1781 * struct eap_peer_config.
1783 struct eap_peer_config * eap_get_config(struct eap_sm *sm)
1785 return sm->eapol_cb->get_config(sm->eapol_ctx);
1790 * eap_get_config_identity - Get identity from the network configuration
1791 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1792 * @len: Buffer for the length of the identity
1793 * Returns: Pointer to the identity or %NULL if not found
1795 const u8 * eap_get_config_identity(struct eap_sm *sm, size_t *len)
1797 struct eap_peer_config *config = eap_get_config(sm);
1800 *len = config->identity_len;
1801 return config->identity;
1806 * eap_get_config_password - Get password from the network configuration
1807 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1808 * @len: Buffer for the length of the password
1809 * Returns: Pointer to the password or %NULL if not found
1811 const u8 * eap_get_config_password(struct eap_sm *sm, size_t *len)
1813 struct eap_peer_config *config = eap_get_config(sm);
1816 *len = config->password_len;
1817 return config->password;
1822 * eap_get_config_password2 - Get password from the network configuration
1823 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1824 * @len: Buffer for the length of the password
1825 * @hash: Buffer for returning whether the password is stored as a
1826 * NtPasswordHash instead of plaintext password; can be %NULL if this
1827 * information is not needed
1828 * Returns: Pointer to the password or %NULL if not found
1830 const u8 * eap_get_config_password2(struct eap_sm *sm, size_t *len, int *hash)
1832 struct eap_peer_config *config = eap_get_config(sm);
1835 *len = config->password_len;
1837 *hash = !!(config->flags & EAP_CONFIG_FLAGS_PASSWORD_NTHASH);
1838 return config->password;
1843 * eap_get_config_new_password - Get new password from network configuration
1844 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1845 * @len: Buffer for the length of the new password
1846 * Returns: Pointer to the new password or %NULL if not found
1848 const u8 * eap_get_config_new_password(struct eap_sm *sm, size_t *len)
1850 struct eap_peer_config *config = eap_get_config(sm);
1853 *len = config->new_password_len;
1854 return config->new_password;
1859 * eap_get_config_otp - Get one-time password from the network configuration
1860 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1861 * @len: Buffer for the length of the one-time password
1862 * Returns: Pointer to the one-time password or %NULL if not found
1864 const u8 * eap_get_config_otp(struct eap_sm *sm, size_t *len)
1866 struct eap_peer_config *config = eap_get_config(sm);
1869 *len = config->otp_len;
1875 * eap_clear_config_otp - Clear used one-time password
1876 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1878 * This function clears a used one-time password (OTP) from the current network
1879 * configuration. This should be called when the OTP has been used and is not
1882 void eap_clear_config_otp(struct eap_sm *sm)
1884 struct eap_peer_config *config = eap_get_config(sm);
1887 os_memset(config->otp, 0, config->otp_len);
1888 os_free(config->otp);
1890 config->otp_len = 0;
1895 * eap_get_config_phase1 - Get phase1 data from the network configuration
1896 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1897 * Returns: Pointer to the phase1 data or %NULL if not found
1899 const char * eap_get_config_phase1(struct eap_sm *sm)
1901 struct eap_peer_config *config = eap_get_config(sm);
1904 return config->phase1;
1909 * eap_get_config_phase2 - Get phase2 data from the network configuration
1910 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1911 * Returns: Pointer to the phase1 data or %NULL if not found
1913 const char * eap_get_config_phase2(struct eap_sm *sm)
1915 struct eap_peer_config *config = eap_get_config(sm);
1918 return config->phase2;
1922 int eap_get_config_fragment_size(struct eap_sm *sm)
1924 struct eap_peer_config *config = eap_get_config(sm);
1927 return config->fragment_size;
1932 * eap_key_available - Get key availability (eapKeyAvailable variable)
1933 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1934 * Returns: 1 if EAP keying material is available, 0 if not
1936 int eap_key_available(struct eap_sm *sm)
1938 return sm ? sm->eapKeyAvailable : 0;
1943 * eap_notify_success - Notify EAP state machine about external success trigger
1944 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1946 * This function is called when external event, e.g., successful completion of
1947 * WPA-PSK key handshake, is indicating that EAP state machine should move to
1948 * success state. This is mainly used with security modes that do not use EAP
1949 * state machine (e.g., WPA-PSK).
1951 void eap_notify_success(struct eap_sm *sm)
1954 sm->decision = DECISION_COND_SUCC;
1955 sm->EAP_state = EAP_SUCCESS;
1961 * eap_notify_lower_layer_success - Notification of lower layer success
1962 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1964 * Notify EAP state machines that a lower layer has detected a successful
1965 * authentication. This is used to recover from dropped EAP-Success messages.
1967 void eap_notify_lower_layer_success(struct eap_sm *sm)
1972 if (eapol_get_bool(sm, EAPOL_eapSuccess) ||
1973 sm->decision == DECISION_FAIL ||
1974 (sm->methodState != METHOD_MAY_CONT &&
1975 sm->methodState != METHOD_DONE))
1978 if (sm->eapKeyData != NULL)
1979 sm->eapKeyAvailable = TRUE;
1980 eapol_set_bool(sm, EAPOL_eapSuccess, TRUE);
1981 wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_SUCCESS
1982 "EAP authentication completed successfully (based on lower "
1988 * eap_get_eapKeyData - Get master session key (MSK) from EAP state machine
1989 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
1990 * @len: Pointer to variable that will be set to number of bytes in the key
1991 * Returns: Pointer to the EAP keying data or %NULL on failure
1993 * Fetch EAP keying material (MSK, eapKeyData) from the EAP state machine. The
1994 * key is available only after a successful authentication. EAP state machine
1995 * continues to manage the key data and the caller must not change or free the
1998 const u8 * eap_get_eapKeyData(struct eap_sm *sm, size_t *len)
2000 if (sm == NULL || sm->eapKeyData == NULL) {
2005 *len = sm->eapKeyDataLen;
2006 return sm->eapKeyData;
2011 * eap_get_eapKeyData - Get EAP response data
2012 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
2013 * Returns: Pointer to the EAP response (eapRespData) or %NULL on failure
2015 * Fetch EAP response (eapRespData) from the EAP state machine. This data is
2016 * available when EAP state machine has processed an incoming EAP request. The
2017 * EAP state machine does not maintain a reference to the response after this
2018 * function is called and the caller is responsible for freeing the data.
2020 struct wpabuf * eap_get_eapRespData(struct eap_sm *sm)
2022 struct wpabuf *resp;
2024 if (sm == NULL || sm->eapRespData == NULL)
2027 resp = sm->eapRespData;
2028 sm->eapRespData = NULL;
2035 * eap_sm_register_scard_ctx - Notification of smart card context
2036 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
2037 * @ctx: Context data for smart card operations
2039 * Notify EAP state machines of context data for smart card operations. This
2040 * context data will be used as a parameter for scard_*() functions.
2042 void eap_register_scard_ctx(struct eap_sm *sm, void *ctx)
2045 sm->scard_ctx = ctx;
2050 * eap_set_config_blob - Set or add a named configuration blob
2051 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
2052 * @blob: New value for the blob
2054 * Adds a new configuration blob or replaces the current value of an existing
2057 void eap_set_config_blob(struct eap_sm *sm, struct wpa_config_blob *blob)
2059 #ifndef CONFIG_NO_CONFIG_BLOBS
2060 sm->eapol_cb->set_config_blob(sm->eapol_ctx, blob);
2061 #endif /* CONFIG_NO_CONFIG_BLOBS */
2066 * eap_get_config_blob - Get a named configuration blob
2067 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
2068 * @name: Name of the blob
2069 * Returns: Pointer to blob data or %NULL if not found
2071 const struct wpa_config_blob * eap_get_config_blob(struct eap_sm *sm,
2074 #ifndef CONFIG_NO_CONFIG_BLOBS
2075 return sm->eapol_cb->get_config_blob(sm->eapol_ctx, name);
2076 #else /* CONFIG_NO_CONFIG_BLOBS */
2078 #endif /* CONFIG_NO_CONFIG_BLOBS */
2083 * eap_set_force_disabled - Set force_disabled flag
2084 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
2085 * @disabled: 1 = EAP disabled, 0 = EAP enabled
2087 * This function is used to force EAP state machine to be disabled when it is
2088 * not in use (e.g., with WPA-PSK or plaintext connections).
2090 void eap_set_force_disabled(struct eap_sm *sm, int disabled)
2092 sm->force_disabled = disabled;
2097 * eap_notify_pending - Notify that EAP method is ready to re-process a request
2098 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
2100 * An EAP method can perform a pending operation (e.g., to get a response from
2101 * an external process). Once the response is available, this function can be
2102 * used to request EAPOL state machine to retry delivering the previously
2103 * received (and still unanswered) EAP request to EAP state machine.
2105 void eap_notify_pending(struct eap_sm *sm)
2107 sm->eapol_cb->notify_pending(sm->eapol_ctx);
2112 * eap_invalidate_cached_session - Mark cached session data invalid
2113 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
2115 void eap_invalidate_cached_session(struct eap_sm *sm)
2118 eap_deinit_prev_method(sm, "invalidate");
2122 int eap_is_wps_pbc_enrollee(struct eap_peer_config *conf)
2124 if (conf->identity_len != WSC_ID_ENROLLEE_LEN ||
2125 os_memcmp(conf->identity, WSC_ID_ENROLLEE, WSC_ID_ENROLLEE_LEN))
2126 return 0; /* Not a WPS Enrollee */
2128 if (conf->phase1 == NULL || os_strstr(conf->phase1, "pbc=1") == NULL)
2129 return 0; /* Not using PBC */
2135 int eap_is_wps_pin_enrollee(struct eap_peer_config *conf)
2137 if (conf->identity_len != WSC_ID_ENROLLEE_LEN ||
2138 os_memcmp(conf->identity, WSC_ID_ENROLLEE, WSC_ID_ENROLLEE_LEN))
2139 return 0; /* Not a WPS Enrollee */
2141 if (conf->phase1 == NULL || os_strstr(conf->phase1, "pin=") == NULL)
2142 return 0; /* Not using PIN */