contrib/hostapd/eapol_sm.c

   1 /*
   2  * Host AP (software wireless LAN access point) user space daemon for
   3  * Host AP kernel driver / IEEE 802.1X Authenticator - EAPOL state machine
   4  * Copyright (c) 2002-2005, Jouni Malinen <jkmaline@cc.hut.fi>
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 as
   8  * published by the Free Software Foundation.
   9  *
  10  * Alternatively, this software may be distributed under the terms of BSD
  11  * license.
  12  *
  13  * See README and COPYING for more details.
  14  *
  15  * $FreeBSD$
  16  */
  17
  18 #include <stdlib.h>
  19 #include <stdio.h>
  20 #include <unistd.h>
  21 #include <netinet/in.h>
  22 #include <string.h>
  23 #include <sys/socket.h>
  24
  25 #include "hostapd.h"
  26 #include "ieee802_1x.h"
  27 #include "eapol_sm.h"
  28 #include "eloop.h"
  29 #include "wpa.h"
  30 #include "sta_info.h"
  31 #include "eap.h"
  32
  33 static struct eapol_callbacks eapol_cb;
  34
  35 /* EAPOL state machines are described in IEEE Std 802.1X-REV-d11, Chap. 8.2 */
  36
  37 #define setPortAuthorized() \
  38 ieee802_1x_set_sta_authorized(sm->hapd, sm->sta, 1)
  39 #define setPortUnauthorized() \
  40 ieee802_1x_set_sta_authorized(sm->hapd, sm->sta, 0)
  41
  42 /* procedures */
  43 #define txCannedFail() ieee802_1x_tx_canned_eap(sm->hapd, sm->sta, 0)
  44 #define txCannedSuccess() ieee802_1x_tx_canned_eap(sm->hapd, sm->sta, 1)
  45 #define txReq() ieee802_1x_tx_req(sm->hapd, sm->sta)
  46 #define sendRespToServer() ieee802_1x_send_resp_to_server(sm->hapd, sm->sta)
  47 #define abortAuth() ieee802_1x_abort_auth(sm->hapd, sm->sta)
  48 #define txKey() ieee802_1x_tx_key(sm->hapd, sm->sta)
  49 #define processKey() do { } while (0)
  50
  51
  52 /* Definitions for clarifying state machine implementation */
  53 #define SM_STATE(machine, state) \
  54 static void sm_ ## machine ## _ ## state ## _Enter(struct eapol_state_machine \
  55 *sm)
  56
  57 #define SM_ENTRY(machine, _state, _data) \
  58 sm->_data.state = machine ## _ ## _state; \
  59 if (sm->hapd->conf->debug >= HOSTAPD_DEBUG_MINIMAL) \
  60         printf("IEEE 802.1X: " MACSTR " " #machine " entering state " #_state \
  61                 "\n", MAC2STR(sm->addr));
  62
  63 #define SM_ENTER(machine, state) sm_ ## machine ## _ ## state ## _Enter(sm)
  64
  65 #define SM_STEP(machine) \
  66 static void sm_ ## machine ## _Step(struct eapol_state_machine *sm)
  67
  68 #define SM_STEP_RUN(machine) sm_ ## machine ## _Step(sm)
  69
  70
  71 static void eapol_sm_step_run(struct eapol_state_machine *sm);
  72 static void eapol_sm_step_cb(void *eloop_ctx, void *timeout_ctx);
  73
  74
  75 /* Port Timers state machine - implemented as a function that will be called
  76  * once a second as a registered event loop timeout */
  77
  78 static void eapol_port_timers_tick(void *eloop_ctx, void *timeout_ctx)
  79 {
  80         struct eapol_state_machine *state = timeout_ctx;
  81
  82         if (state->aWhile > 0) {
  83                 state->aWhile--;
  84                 if (state->aWhile == 0) {
  85                         wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR
  86                                    " - aWhile --> 0",
  87                                    MAC2STR(state->addr));
  88                 }
  89         }
  90
  91         if (state->quietWhile > 0) {
  92                 state->quietWhile--;
  93                 if (state->quietWhile == 0) {
  94                         wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR
  95                                    " - quietWhile --> 0",
  96                                    MAC2STR(state->addr));
  97                 }
  98         }
  99
 100         if (state->reAuthWhen > 0) {
 101                 state->reAuthWhen--;
 102                 if (state->reAuthWhen == 0) {
 103                         wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR
 104                                    " - reAuthWhen --> 0",
 105                                    MAC2STR(state->addr));
 106                 }
 107         }
 108
 109         eapol_sm_step_run(state);
 110
 111         eloop_register_timeout(1, 0, eapol_port_timers_tick, eloop_ctx, state);
 112 }
 113
 114
 115
 116 /* Authenticator PAE state machine */
 117
 118 SM_STATE(AUTH_PAE, INITIALIZE)
 119 {
 120         SM_ENTRY(AUTH_PAE, INITIALIZE, auth_pae);
 121         sm->auth_pae.portMode = Auto;
 122
 123         sm->currentId = 255;
 124 }
 125
 126
 127 SM_STATE(AUTH_PAE, DISCONNECTED)
 128 {
 129         int from_initialize = sm->auth_pae.state == AUTH_PAE_INITIALIZE;
 130
 131         if (sm->auth_pae.eapolLogoff) {
 132                 if (sm->auth_pae.state == AUTH_PAE_CONNECTING)
 133                         sm->auth_pae.authEapLogoffsWhileConnecting++;
 134                 else if (sm->auth_pae.state == AUTH_PAE_AUTHENTICATED)
 135                         sm->auth_pae.authAuthEapLogoffWhileAuthenticated++;
 136         }
 137
 138         SM_ENTRY(AUTH_PAE, DISCONNECTED, auth_pae);
 139
 140         sm->authPortStatus = Unauthorized;
 141         setPortUnauthorized();
 142         sm->auth_pae.reAuthCount = 0;
 143         sm->auth_pae.eapolLogoff = FALSE;
 144         if (!from_initialize) {
 145                 if (sm->flags & EAPOL_SM_PREAUTH)
 146                         rsn_preauth_finished(sm->hapd, sm->sta, 0);
 147                 else
 148                         ieee802_1x_finished(sm->hapd, sm->sta, 0);
 149         }
 150 }
 151
 152
 153 SM_STATE(AUTH_PAE, RESTART)
 154 {
 155         if (sm->auth_pae.state == AUTH_PAE_AUTHENTICATED) {
 156                 if (sm->reAuthenticate)
 157                         sm->auth_pae.authAuthReauthsWhileAuthenticated++;
 158                 if (sm->auth_pae.eapolStart)
 159                         sm->auth_pae.authAuthEapStartsWhileAuthenticated++;
 160                 if (sm->auth_pae.eapolLogoff)
 161                         sm->auth_pae.authAuthEapLogoffWhileAuthenticated++;
 162         }
 163
 164         SM_ENTRY(AUTH_PAE, RESTART, auth_pae);
 165
 166         sm->auth_pae.eapRestart = TRUE;
 167         ieee802_1x_request_identity(sm->hapd, sm->sta);
 168 }
 169
 170
 171 SM_STATE(AUTH_PAE, CONNECTING)
 172 {
 173         if (sm->auth_pae.state != AUTH_PAE_CONNECTING)
 174                 sm->auth_pae.authEntersConnecting++;
 175
 176         SM_ENTRY(AUTH_PAE, CONNECTING, auth_pae);
 177
 178         sm->reAuthenticate = FALSE;
 179         sm->auth_pae.reAuthCount++;
 180 }
 181
 182
 183 SM_STATE(AUTH_PAE, HELD)
 184 {
 185         if (sm->auth_pae.state == AUTH_PAE_AUTHENTICATING && sm->authFail)
 186                 sm->auth_pae.authAuthFailWhileAuthenticating++;
 187
 188         SM_ENTRY(AUTH_PAE, HELD, auth_pae);
 189
 190         sm->authPortStatus = Unauthorized;
 191         setPortUnauthorized();
 192         sm->quietWhile = sm->auth_pae.quietPeriod;
 193         sm->auth_pae.eapolLogoff = FALSE;
 194
 195         hostapd_logger(sm->hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
 196                        HOSTAPD_LEVEL_WARNING, "authentication failed");
 197         if (sm->flags & EAPOL_SM_PREAUTH)
 198                 rsn_preauth_finished(sm->hapd, sm->sta, 0);
 199         else
 200                 ieee802_1x_finished(sm->hapd, sm->sta, 0);
 201 }
 202
 203
 204 SM_STATE(AUTH_PAE, AUTHENTICATED)
 205 {
 206         if (sm->auth_pae.state == AUTH_PAE_AUTHENTICATING && sm->authSuccess)
 207                 sm->auth_pae.authAuthSuccessesWhileAuthenticating++;
 208
 209         SM_ENTRY(AUTH_PAE, AUTHENTICATED, auth_pae);
 210
 211         sm->authPortStatus = Authorized;
 212         setPortAuthorized();
 213         sm->auth_pae.reAuthCount = 0;
 214         hostapd_logger(sm->hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
 215                        HOSTAPD_LEVEL_INFO, "authenticated");
 216         if (sm->flags & EAPOL_SM_PREAUTH)
 217                 rsn_preauth_finished(sm->hapd, sm->sta, 1);
 218         else
 219                 ieee802_1x_finished(sm->hapd, sm->sta, 1);
 220 }
 221
 222
 223 SM_STATE(AUTH_PAE, AUTHENTICATING)
 224 {
 225         if (sm->auth_pae.state == AUTH_PAE_CONNECTING && sm->rx_identity) {
 226                 sm->auth_pae.authEntersAuthenticating++;
 227                 sm->rx_identity = FALSE;
 228         }
 229
 230         SM_ENTRY(AUTH_PAE, AUTHENTICATING, auth_pae);
 231
 232         sm->auth_pae.eapolStart = FALSE;
 233         sm->authSuccess = FALSE;
 234         sm->authFail = FALSE;
 235         sm->authTimeout = FALSE;
 236         sm->authStart = TRUE;
 237         sm->keyRun = FALSE;
 238         sm->keyDone = FALSE;
 239 }
 240
 241
 242 SM_STATE(AUTH_PAE, ABORTING)
 243 {
 244         if (sm->auth_pae.state == AUTH_PAE_AUTHENTICATING) {
 245                 if (sm->authTimeout)
 246                         sm->auth_pae.authAuthTimeoutsWhileAuthenticating++;
 247                 if (sm->auth_pae.eapolStart)
 248                         sm->auth_pae.authAuthEapStartsWhileAuthenticating++;
 249                 if (sm->auth_pae.eapolLogoff)
 250                         sm->auth_pae.authAuthEapLogoffWhileAuthenticating++;
 251         }
 252
 253         SM_ENTRY(AUTH_PAE, ABORTING, auth_pae);
 254
 255         sm->authAbort = TRUE;
 256         sm->keyRun = FALSE;
 257         sm->keyDone = FALSE;
 258 }
 259
 260
 261 SM_STATE(AUTH_PAE, FORCE_AUTH)
 262 {
 263         SM_ENTRY(AUTH_PAE, FORCE_AUTH, auth_pae);
 264
 265         sm->authPortStatus = Authorized;
 266         setPortAuthorized();
 267         sm->auth_pae.portMode = ForceAuthorized;
 268         sm->auth_pae.eapolStart = FALSE;
 269         txCannedSuccess();
 270 }
 271
 272
 273 SM_STATE(AUTH_PAE, FORCE_UNAUTH)
 274 {
 275         SM_ENTRY(AUTH_PAE, FORCE_UNAUTH, auth_pae);
 276
 277         sm->authPortStatus = Unauthorized;
 278         setPortUnauthorized();
 279         sm->auth_pae.portMode = ForceUnauthorized;
 280         sm->auth_pae.eapolStart = FALSE;
 281         txCannedFail();
 282 }
 283
 284
 285 SM_STEP(AUTH_PAE)
 286 {
 287         if ((sm->portControl == Auto &&
 288              sm->auth_pae.portMode != sm->portControl) ||
 289             sm->initialize || !sm->portEnabled)
 290                 SM_ENTER(AUTH_PAE, INITIALIZE);
 291         else if (sm->portControl == ForceAuthorized &&
 292                  sm->auth_pae.portMode != sm->portControl &&
 293                  !(sm->initialize || !sm->portEnabled))
 294                 SM_ENTER(AUTH_PAE, FORCE_AUTH);
 295         else if (sm->portControl == ForceUnauthorized &&
 296                  sm->auth_pae.portMode != sm->portControl &&
 297                  !(sm->initialize || !sm->portEnabled))
 298                 SM_ENTER(AUTH_PAE, FORCE_UNAUTH);
 299         else {
 300                 switch (sm->auth_pae.state) {
 301                 case AUTH_PAE_INITIALIZE:
 302                         SM_ENTER(AUTH_PAE, DISCONNECTED);
 303                         break;
 304                 case AUTH_PAE_DISCONNECTED:
 305                         SM_ENTER(AUTH_PAE, RESTART);
 306                         break;
 307                 case AUTH_PAE_RESTART:
 308                         if (!sm->auth_pae.eapRestart)
 309                                 SM_ENTER(AUTH_PAE, CONNECTING);
 310                         break;
 311                 case AUTH_PAE_HELD:
 312                         if (sm->quietWhile == 0)
 313                                 SM_ENTER(AUTH_PAE, RESTART);
 314                         break;
 315                 case AUTH_PAE_CONNECTING:
 316                         if (sm->auth_pae.eapolLogoff ||
 317                             sm->auth_pae.reAuthCount > sm->auth_pae.reAuthMax)
 318                                 SM_ENTER(AUTH_PAE, DISCONNECTED);
 319                         else if ((sm->be_auth.eapReq &&
 320                                   sm->auth_pae.reAuthCount <=
 321                                   sm->auth_pae.reAuthMax) ||
 322                                  sm->eapSuccess || sm->eapFail)
 323                                 SM_ENTER(AUTH_PAE, AUTHENTICATING);
 324                         break;
 325                 case AUTH_PAE_AUTHENTICATED:
 326                         if (sm->auth_pae.eapolStart || sm->reAuthenticate)
 327                                 SM_ENTER(AUTH_PAE, RESTART);
 328                         else if (sm->auth_pae.eapolLogoff || !sm->portValid)
 329                                 SM_ENTER(AUTH_PAE, DISCONNECTED);
 330                         break;
 331                 case AUTH_PAE_AUTHENTICATING:
 332                         if (sm->authSuccess && sm->portValid)
 333                                 SM_ENTER(AUTH_PAE, AUTHENTICATED);
 334                         else if (sm->authFail ||
 335                                  (sm->keyDone && !sm->portValid))
 336                                 SM_ENTER(AUTH_PAE, HELD);
 337                         else if (sm->auth_pae.eapolStart ||
 338                                  sm->auth_pae.eapolLogoff || sm->authTimeout)
 339                                 SM_ENTER(AUTH_PAE, ABORTING);
 340                         break;
 341                 case AUTH_PAE_ABORTING:
 342                         if (sm->auth_pae.eapolLogoff && !sm->authAbort)
 343                                 SM_ENTER(AUTH_PAE, DISCONNECTED);
 344                         else if (!sm->auth_pae.eapolLogoff && !sm->authAbort)
 345                                 SM_ENTER(AUTH_PAE, RESTART);
 346                         break;
 347                 case AUTH_PAE_FORCE_AUTH:
 348                         if (sm->auth_pae.eapolStart)
 349                                 SM_ENTER(AUTH_PAE, FORCE_AUTH);
 350                         break;
 351                 case AUTH_PAE_FORCE_UNAUTH:
 352                         if (sm->auth_pae.eapolStart)
 353                                 SM_ENTER(AUTH_PAE, FORCE_UNAUTH);
 354                         break;
 355                 }
 356         }
 357 }
 358
 359
 360
 361 /* Backend Authentication state machine */
 362
 363 SM_STATE(BE_AUTH, INITIALIZE)
 364 {
 365         SM_ENTRY(BE_AUTH, INITIALIZE, be_auth);
 366
 367         abortAuth();
 368         sm->be_auth.eapNoReq = FALSE;
 369         sm->authAbort = FALSE;
 370 }
 371
 372
 373 SM_STATE(BE_AUTH, REQUEST)
 374 {
 375         SM_ENTRY(BE_AUTH, REQUEST, be_auth);
 376
 377         txReq();
 378         sm->be_auth.eapReq = FALSE;
 379         sm->be_auth.backendOtherRequestsToSupplicant++;
 380
 381         /*
 382          * Clearing eapolEap here is not specified in IEEE Std 802.1X-2004, but
 383          * it looks like this would be logical thing to do there since the old
 384          * EAP response would not be valid anymore after the new EAP request
 385          * was sent out.
 386          *
 387          * A race condition has been reported, in which hostapd ended up
 388          * sending out EAP-Response/Identity as a response to the first
 389          * EAP-Request from the main EAP method. This can be avoided by
 390          * clearing eapolEap here.
 391          */
 392         sm->eapolEap = FALSE;
 393 }
 394
 395
 396 SM_STATE(BE_AUTH, RESPONSE)
 397 {
 398         SM_ENTRY(BE_AUTH, RESPONSE, be_auth);
 399
 400         sm->authTimeout = FALSE;
 401         sm->eapolEap = FALSE;
 402         sm->be_auth.eapNoReq = FALSE;
 403         sm->aWhile = sm->be_auth.serverTimeout;
 404         sm->be_auth.eapResp = TRUE;
 405         sendRespToServer();
 406         sm->be_auth.backendResponses++;
 407 }
 408
 409
 410 SM_STATE(BE_AUTH, SUCCESS)
 411 {
 412         SM_ENTRY(BE_AUTH, SUCCESS, be_auth);
 413
 414         txReq();
 415         sm->authSuccess = TRUE;
 416         sm->keyRun = TRUE;
 417 }
 418
 419
 420 SM_STATE(BE_AUTH, FAIL)
 421 {
 422         SM_ENTRY(BE_AUTH, FAIL, be_auth);
 423
 424         /* Note: IEEE 802.1X-REV-d11 has unconditional txReq() here.
 425          * txCannelFail() is used as a workaround for the case where
 426          * authentication server does not include EAP-Message with
 427          * Access-Reject. */
 428         if (sm->last_eap_radius == NULL)
 429                 txCannedFail();
 430         else
 431                 txReq();
 432         sm->authFail = TRUE;
 433 }
 434
 435
 436 SM_STATE(BE_AUTH, TIMEOUT)
 437 {
 438         SM_ENTRY(BE_AUTH, TIMEOUT, be_auth);
 439
 440         sm->authTimeout = TRUE;
 441 }
 442
 443
 444 SM_STATE(BE_AUTH, IDLE)
 445 {
 446         SM_ENTRY(BE_AUTH, IDLE, be_auth);
 447
 448         sm->authStart = FALSE;
 449 }
 450
 451
 452 SM_STATE(BE_AUTH, IGNORE)
 453 {
 454         SM_ENTRY(BE_AUTH, IGNORE, be_auth);
 455
 456         sm->be_auth.eapNoReq = FALSE;
 457 }
 458
 459
 460 SM_STEP(BE_AUTH)
 461 {
 462         if (sm->portControl != Auto || sm->initialize || sm->authAbort) {
 463                 SM_ENTER(BE_AUTH, INITIALIZE);
 464                 return;
 465         }
 466
 467         switch (sm->be_auth.state) {
 468         case BE_AUTH_INITIALIZE:
 469                 SM_ENTER(BE_AUTH, IDLE);
 470                 break;
 471         case BE_AUTH_REQUEST:
 472                 if (sm->eapolEap)
 473                         SM_ENTER(BE_AUTH, RESPONSE);
 474                 else if (sm->be_auth.eapReq)
 475                         SM_ENTER(BE_AUTH, REQUEST);
 476                 else if (sm->eapTimeout)
 477                         SM_ENTER(BE_AUTH, TIMEOUT);
 478                 break;
 479         case BE_AUTH_RESPONSE:
 480                 if (sm->be_auth.eapNoReq)
 481                         SM_ENTER(BE_AUTH, IGNORE);
 482                 if (sm->be_auth.eapReq) {
 483                         sm->be_auth.backendAccessChallenges++;
 484                         SM_ENTER(BE_AUTH, REQUEST);
 485                 } else if (sm->aWhile == 0)
 486                         SM_ENTER(BE_AUTH, TIMEOUT);
 487                 else if (sm->eapFail) {
 488                         sm->be_auth.backendAuthFails++;
 489                         SM_ENTER(BE_AUTH, FAIL);
 490                 } else if (sm->eapSuccess) {
 491                         sm->be_auth.backendAuthSuccesses++;
 492                         SM_ENTER(BE_AUTH, SUCCESS);
 493                 }
 494                 break;
 495         case BE_AUTH_SUCCESS:
 496                 SM_ENTER(BE_AUTH, IDLE);
 497                 break;
 498         case BE_AUTH_FAIL:
 499                 SM_ENTER(BE_AUTH, IDLE);
 500                 break;
 501         case BE_AUTH_TIMEOUT:
 502                 SM_ENTER(BE_AUTH, IDLE);
 503                 break;
 504         case BE_AUTH_IDLE:
 505                 if (sm->eapFail && sm->authStart)
 506                         SM_ENTER(BE_AUTH, FAIL);
 507                 else if (sm->be_auth.eapReq && sm->authStart)
 508                         SM_ENTER(BE_AUTH, REQUEST);
 509                 else if (sm->eapSuccess && sm->authStart)
 510                         SM_ENTER(BE_AUTH, SUCCESS);
 511                 break;
 512         case BE_AUTH_IGNORE:
 513                 if (sm->eapolEap)
 514                         SM_ENTER(BE_AUTH, RESPONSE);
 515                 else if (sm->be_auth.eapReq)
 516                         SM_ENTER(BE_AUTH, REQUEST);
 517                 else if (sm->eapTimeout)
 518                         SM_ENTER(BE_AUTH, TIMEOUT);
 519                 break;
 520         }
 521 }
 522
 523
 524
 525 /* Reauthentication Timer state machine */
 526
 527 SM_STATE(REAUTH_TIMER, INITIALIZE)
 528 {
 529         SM_ENTRY(REAUTH_TIMER, INITIALIZE, reauth_timer);
 530
 531         sm->reAuthWhen = sm->reauth_timer.reAuthPeriod;
 532 }
 533
 534
 535 SM_STATE(REAUTH_TIMER, REAUTHENTICATE)
 536 {
 537         SM_ENTRY(REAUTH_TIMER, REAUTHENTICATE, reauth_timer);
 538
 539         sm->reAuthenticate = TRUE;
 540         wpa_sm_event(sm->hapd, sm->sta, WPA_REAUTH_EAPOL);
 541 }
 542
 543
 544 SM_STEP(REAUTH_TIMER)
 545 {
 546         if (sm->portControl != Auto || sm->initialize ||
 547             sm->authPortStatus == Unauthorized ||
 548             !sm->reauth_timer.reAuthEnabled) {
 549                 SM_ENTER(REAUTH_TIMER, INITIALIZE);
 550                 return;
 551         }
 552
 553         switch (sm->reauth_timer.state) {
 554         case REAUTH_TIMER_INITIALIZE:
 555                 if (sm->reAuthWhen == 0)
 556                         SM_ENTER(REAUTH_TIMER, REAUTHENTICATE);
 557                 break;
 558         case REAUTH_TIMER_REAUTHENTICATE:
 559                 SM_ENTER(REAUTH_TIMER, INITIALIZE);
 560                 break;
 561         }
 562 }
 563
 564
 565
 566 /* Authenticator Key Transmit state machine */
 567
 568 SM_STATE(AUTH_KEY_TX, NO_KEY_TRANSMIT)
 569 {
 570         SM_ENTRY(AUTH_KEY_TX, NO_KEY_TRANSMIT, auth_key_tx);
 571 }
 572
 573
 574 SM_STATE(AUTH_KEY_TX, KEY_TRANSMIT)
 575 {
 576         SM_ENTRY(AUTH_KEY_TX, KEY_TRANSMIT, auth_key_tx);
 577
 578         txKey();
 579         sm->keyAvailable = FALSE;
 580         sm->keyDone = TRUE;
 581 }
 582
 583
 584 SM_STEP(AUTH_KEY_TX)
 585 {
 586         if (sm->initialize || sm->portControl != Auto) {
 587                 SM_ENTER(AUTH_KEY_TX, NO_KEY_TRANSMIT);
 588                 return;
 589         }
 590
 591         switch (sm->auth_key_tx.state) {
 592         case AUTH_KEY_TX_NO_KEY_TRANSMIT:
 593                 if (sm->keyTxEnabled && sm->keyAvailable && sm->keyRun &&
 594                     !sm->sta->wpa)
 595                         SM_ENTER(AUTH_KEY_TX, KEY_TRANSMIT);
 596                 break;
 597         case AUTH_KEY_TX_KEY_TRANSMIT:
 598                 if (!sm->keyTxEnabled || !sm->keyRun)
 599                         SM_ENTER(AUTH_KEY_TX, NO_KEY_TRANSMIT);
 600                 else if (sm->keyAvailable)
 601                         SM_ENTER(AUTH_KEY_TX, KEY_TRANSMIT);
 602                 break;
 603         }
 604 }
 605
 606
 607
 608 /* Key Receive state machine */
 609
 610 SM_STATE(KEY_RX, NO_KEY_RECEIVE)
 611 {
 612         SM_ENTRY(KEY_RX, NO_KEY_RECEIVE, key_rx);
 613 }
 614
 615
 616 SM_STATE(KEY_RX, KEY_RECEIVE)
 617 {
 618         SM_ENTRY(KEY_RX, KEY_RECEIVE, key_rx);
 619
 620         processKey();
 621         sm->key_rx.rxKey = FALSE;
 622 }
 623
 624
 625 SM_STEP(KEY_RX)
 626 {
 627         if (sm->initialize || !sm->portEnabled) {
 628                 SM_ENTER(KEY_RX, NO_KEY_RECEIVE);
 629                 return;
 630         }
 631
 632         switch (sm->key_rx.state) {
 633         case KEY_RX_NO_KEY_RECEIVE:
 634                 if (sm->key_rx.rxKey)
 635                         SM_ENTER(KEY_RX, KEY_RECEIVE);
 636                 break;
 637         case KEY_RX_KEY_RECEIVE:
 638                 if (sm->key_rx.rxKey)
 639                         SM_ENTER(KEY_RX, KEY_RECEIVE);
 640                 break;
 641         }
 642 }
 643
 644
 645
 646 /* Controlled Directions state machine */
 647
 648 SM_STATE(CTRL_DIR, FORCE_BOTH)
 649 {
 650         SM_ENTRY(CTRL_DIR, FORCE_BOTH, ctrl_dir);
 651         sm->ctrl_dir.operControlledDirections = Both;
 652 }
 653
 654
 655 SM_STATE(CTRL_DIR, IN_OR_BOTH)
 656 {
 657         SM_ENTRY(CTRL_DIR, IN_OR_BOTH, ctrl_dir);
 658         sm->ctrl_dir.operControlledDirections =
 659                 sm->ctrl_dir.adminControlledDirections;
 660 }
 661
 662
 663 SM_STEP(CTRL_DIR)
 664 {
 665         if (sm->initialize) {
 666                 SM_ENTER(CTRL_DIR, IN_OR_BOTH);
 667                 return;
 668         }
 669
 670         switch (sm->ctrl_dir.state) {
 671         case CTRL_DIR_FORCE_BOTH:
 672                 if (sm->portEnabled && sm->ctrl_dir.operEdge)
 673                         SM_ENTER(CTRL_DIR, IN_OR_BOTH);
 674                 break;
 675         case CTRL_DIR_IN_OR_BOTH:
 676                 if (sm->ctrl_dir.operControlledDirections !=
 677                     sm->ctrl_dir.adminControlledDirections)
 678                         SM_ENTER(CTRL_DIR, IN_OR_BOTH);
 679                 if (!sm->portEnabled || !sm->ctrl_dir.operEdge)
 680                         SM_ENTER(CTRL_DIR, FORCE_BOTH);
 681                 break;
 682         }
 683 }
 684
 685
 686
 687 struct eapol_state_machine *
 688 eapol_sm_alloc(hostapd *hapd, struct sta_info *sta)
 689 {
 690         struct eapol_state_machine *sm;
 691
 692         sm = (struct eapol_state_machine *) malloc(sizeof(*sm));
 693         if (sm == NULL) {
 694                 printf("IEEE 802.1X port state allocation failed\n");
 695                 return NULL;
 696         }
 697         memset(sm, 0, sizeof(*sm));
 698         sm->radius_identifier = -1;
 699         memcpy(sm->addr, sta->addr, ETH_ALEN);
 700         if (sta->flags & WLAN_STA_PREAUTH)
 701                 sm->flags |= EAPOL_SM_PREAUTH;
 702
 703         sm->hapd = hapd;
 704         sm->sta = sta;
 705
 706         /* Set default values for state machine constants */
 707         sm->auth_pae.state = AUTH_PAE_INITIALIZE;
 708         sm->auth_pae.quietPeriod = AUTH_PAE_DEFAULT_quietPeriod;
 709         sm->auth_pae.reAuthMax = AUTH_PAE_DEFAULT_reAuthMax;
 710
 711         sm->be_auth.state = BE_AUTH_INITIALIZE;
 712         sm->be_auth.serverTimeout = BE_AUTH_DEFAULT_serverTimeout;
 713
 714         sm->reauth_timer.state = REAUTH_TIMER_INITIALIZE;
 715         sm->reauth_timer.reAuthPeriod = hapd->conf->eap_reauth_period;
 716         sm->reauth_timer.reAuthEnabled = hapd->conf->eap_reauth_period > 0 ?
 717                 TRUE : FALSE;
 718
 719         sm->auth_key_tx.state = AUTH_KEY_TX_NO_KEY_TRANSMIT;
 720
 721         sm->key_rx.state = KEY_RX_NO_KEY_RECEIVE;
 722
 723         sm->ctrl_dir.state = CTRL_DIR_IN_OR_BOTH;
 724
 725         sm->portEnabled = FALSE;
 726         sm->portControl = Auto;
 727
 728         sm->keyAvailable = FALSE;
 729         if (!hapd->conf->wpa &&
 730             (hapd->default_wep_key || hapd->conf->individual_wep_key_len > 0))
 731                 sm->keyTxEnabled = TRUE;
 732         else
 733                 sm->keyTxEnabled = FALSE;
 734         if (hapd->conf->wpa)
 735                 sm->portValid = FALSE;
 736         else
 737                 sm->portValid = TRUE;
 738
 739         if (hapd->conf->eap_server) {
 740                 struct eap_config eap_conf;
 741                 memset(&eap_conf, 0, sizeof(eap_conf));
 742                 eap_conf.ssl_ctx = hapd->ssl_ctx;
 743                 eap_conf.eap_sim_db_priv = hapd->eap_sim_db_priv;
 744                 sm->eap = eap_sm_init(sm, &eapol_cb, &eap_conf);
 745                 if (sm->eap == NULL) {
 746                         eapol_sm_free(sm);
 747                         return NULL;
 748                 }
 749         }
 750
 751         eapol_sm_initialize(sm);
 752
 753         return sm;
 754 }
 755
 756
 757 void eapol_sm_free(struct eapol_state_machine *sm)
 758 {
 759         if (sm == NULL)
 760                 return;
 761
 762         eloop_cancel_timeout(eapol_port_timers_tick, sm->hapd, sm);
 763         eloop_cancel_timeout(eapol_sm_step_cb, sm, NULL);
 764         if (sm->eap)
 765                 eap_sm_deinit(sm->eap);
 766         free(sm);
 767 }
 768
 769
 770 static int eapol_sm_sta_entry_alive(struct hostapd_data *hapd, u8 *addr)
 771 {
 772         struct sta_info *sta;
 773         sta = ap_get_sta(hapd, addr);
 774         if (sta == NULL || sta->eapol_sm == NULL)
 775                 return 0;
 776         return 1;
 777 }
 778
 779
 780 static void eapol_sm_step_run(struct eapol_state_machine *sm)
 781 {
 782         struct hostapd_data *hapd = sm->hapd;
 783         u8 addr[ETH_ALEN];
 784         int prev_auth_pae, prev_be_auth, prev_reauth_timer, prev_auth_key_tx,
 785                 prev_key_rx, prev_ctrl_dir;
 786         int max_steps = 100;
 787
 788         memcpy(addr, sm->sta->addr, ETH_ALEN);
 789
 790         /*
 791          * Allow EAPOL state machines to run as long as there are state
 792          * changes, but exit and return here through event loop if more than
 793          * 100 steps is needed as a precaution against infinite loops inside
 794          * eloop callback.
 795          */
 796 restart:
 797         prev_auth_pae = sm->auth_pae.state;
 798         prev_be_auth = sm->be_auth.state;
 799         prev_reauth_timer = sm->reauth_timer.state;
 800         prev_auth_key_tx = sm->auth_key_tx.state;
 801         prev_key_rx = sm->key_rx.state;
 802         prev_ctrl_dir = sm->ctrl_dir.state;
 803
 804         SM_STEP_RUN(AUTH_PAE);
 805         if (sm->initializing || eapol_sm_sta_entry_alive(hapd, addr))
 806                 SM_STEP_RUN(BE_AUTH);
 807         if (sm->initializing || eapol_sm_sta_entry_alive(hapd, addr))
 808                 SM_STEP_RUN(REAUTH_TIMER);
 809         if (sm->initializing || eapol_sm_sta_entry_alive(hapd, addr))
 810                 SM_STEP_RUN(AUTH_KEY_TX);
 811         if (sm->initializing || eapol_sm_sta_entry_alive(hapd, addr))
 812                 SM_STEP_RUN(KEY_RX);
 813         if (sm->initializing || eapol_sm_sta_entry_alive(hapd, addr))
 814                 SM_STEP_RUN(CTRL_DIR);
 815
 816         if (prev_auth_pae != sm->auth_pae.state ||
 817             prev_be_auth != sm->be_auth.state ||
 818             prev_reauth_timer != sm->reauth_timer.state ||
 819             prev_auth_key_tx != sm->auth_key_tx.state ||
 820             prev_key_rx != sm->key_rx.state ||
 821             prev_ctrl_dir != sm->ctrl_dir.state) {
 822                 if (--max_steps > 0)
 823                         goto restart;
 824                 /* Re-run from eloop timeout */
 825                 eapol_sm_step(sm);
 826                 return;
 827         }
 828
 829         if (eapol_sm_sta_entry_alive(hapd, addr) && sm->eap) {
 830                 if (eap_sm_step(sm->eap)) {
 831                         if (--max_steps > 0)
 832                                 goto restart;
 833                         /* Re-run from eloop timeout */
 834                         eapol_sm_step(sm);
 835                         return;
 836                 }
 837         }
 838
 839         if (eapol_sm_sta_entry_alive(hapd, addr))
 840                 wpa_sm_notify(sm->hapd, sm->sta);
 841 }
 842
 843
 844 static void eapol_sm_step_cb(void *eloop_ctx, void *timeout_ctx)
 845 {
 846         struct eapol_state_machine *sm = eloop_ctx;
 847         eapol_sm_step_run(sm);
 848 }
 849
 850
 851 void eapol_sm_step(struct eapol_state_machine *sm)
 852 {
 853         /*
 854          * Run eapol_sm_step_run from a registered timeout to make sure that
 855          * other possible timeouts/events are processed and to avoid long
 856          * function call chains.
 857          */
 858
 859         eloop_register_timeout(0, 0, eapol_sm_step_cb, sm, NULL);
 860 }
 861
 862
 863 void eapol_sm_initialize(struct eapol_state_machine *sm)
 864 {
 865         sm->initializing = TRUE;
 866         /* Initialize the state machines by asserting initialize and then
 867          * deasserting it after one step */
 868         sm->initialize = TRUE;
 869         eapol_sm_step_run(sm);
 870         sm->initialize = FALSE;
 871         eapol_sm_step_run(sm);
 872         sm->initializing = FALSE;
 873
 874         /* Start one second tick for port timers state machine */
 875         eloop_cancel_timeout(eapol_port_timers_tick, sm->hapd, sm);
 876         eloop_register_timeout(1, 0, eapol_port_timers_tick, sm->hapd, sm);
 877 }
 878
 879
 880 #ifdef HOSTAPD_DUMP_STATE
 881 static inline const char * port_type_txt(PortTypes pt)
 882 {
 883         switch (pt) {
 884         case ForceUnauthorized: return "ForceUnauthorized";
 885         case ForceAuthorized: return "ForceAuthorized";
 886         case Auto: return "Auto";
 887         default: return "Unknown";
 888         }
 889 }
 890
 891
 892 static inline const char * port_state_txt(PortState ps)
 893 {
 894         switch (ps) {
 895         case Unauthorized: return "Unauthorized";
 896         case Authorized: return "Authorized";
 897         default: return "Unknown";
 898         }
 899 }
 900
 901
 902 static inline const char * ctrl_dir_txt(ControlledDirection dir)
 903 {
 904         switch (dir) {
 905         case Both: return "Both";
 906         case In: return "In";
 907         default: return "Unknown";
 908         }
 909 }
 910
 911
 912 static inline const char * auth_pae_state_txt(int s)
 913 {
 914         switch (s) {
 915         case AUTH_PAE_INITIALIZE: return "INITIALIZE";
 916         case AUTH_PAE_DISCONNECTED: return "DISCONNECTED";
 917         case AUTH_PAE_CONNECTING: return "CONNECTING";
 918         case AUTH_PAE_AUTHENTICATING: return "AUTHENTICATING";
 919         case AUTH_PAE_AUTHENTICATED: return "AUTHENTICATED";
 920         case AUTH_PAE_ABORTING: return "ABORTING";
 921         case AUTH_PAE_HELD: return "HELD";
 922         case AUTH_PAE_FORCE_AUTH: return "FORCE_AUTH";
 923         case AUTH_PAE_FORCE_UNAUTH: return "FORCE_UNAUTH";
 924         case AUTH_PAE_RESTART: return "RESTART";
 925         default: return "Unknown";
 926         }
 927 }
 928
 929
 930 static inline const char * be_auth_state_txt(int s)
 931 {
 932         switch (s) {
 933         case BE_AUTH_REQUEST: return "REQUEST";
 934         case BE_AUTH_RESPONSE: return "RESPONSE";
 935         case BE_AUTH_SUCCESS: return "SUCCESS";
 936         case BE_AUTH_FAIL: return "FAIL";
 937         case BE_AUTH_TIMEOUT: return "TIMEOUT";
 938         case BE_AUTH_IDLE: return "IDLE";
 939         case BE_AUTH_INITIALIZE: return "INITIALIZE";
 940         case BE_AUTH_IGNORE: return "IGNORE";
 941         default: return "Unknown";
 942         }
 943 }
 944
 945
 946 static inline const char * reauth_timer_state_txt(int s)
 947 {
 948         switch (s) {
 949         case REAUTH_TIMER_INITIALIZE: return "INITIALIZE";
 950         case REAUTH_TIMER_REAUTHENTICATE: return "REAUTHENTICATE";
 951         default: return "Unknown";
 952         }
 953 }
 954
 955
 956 static inline const char * auth_key_tx_state_txt(int s)
 957 {
 958         switch (s) {
 959         case AUTH_KEY_TX_NO_KEY_TRANSMIT: return "NO_KEY_TRANSMIT";
 960         case AUTH_KEY_TX_KEY_TRANSMIT: return "KEY_TRANSMIT";
 961         default: return "Unknown";
 962         }
 963 }
 964
 965
 966 static inline const char * key_rx_state_txt(int s)
 967 {
 968         switch (s) {
 969         case KEY_RX_NO_KEY_RECEIVE: return "NO_KEY_RECEIVE";
 970         case KEY_RX_KEY_RECEIVE: return "KEY_RECEIVE";
 971         default: return "Unknown";
 972         }
 973 }
 974
 975
 976 static inline const char * ctrl_dir_state_txt(int s)
 977 {
 978         switch (s) {
 979         case CTRL_DIR_FORCE_BOTH: return "FORCE_BOTH";
 980         case CTRL_DIR_IN_OR_BOTH: return "IN_OR_BOTH";
 981         default: return "Unknown";
 982         }
 983 }
 984
 985
 986 void eapol_sm_dump_state(FILE *f, const char *prefix,
 987                          struct eapol_state_machine *sm)
 988 {
 989         fprintf(f, "%sEAPOL state machine:\n", prefix);
 990         fprintf(f, "%s  aWhile=%d quietWhile=%d reAuthWhen=%d\n", prefix,
 991                 sm->aWhile, sm->quietWhile, sm->reAuthWhen);
 992 #define _SB(b) ((b) ? "TRUE" : "FALSE")
 993         fprintf(f,
 994                 "%s  authAbort=%s authFail=%s authPortStatus=%s authStart=%s\n"
 995                 "%s  authTimeout=%s authSuccess=%s eapFail=%s eapolEap=%s\n"
 996                 "%s  eapSuccess=%s eapTimeout=%s initialize=%s "
 997                 "keyAvailable=%s\n"
 998                 "%s  keyDone=%s keyRun=%s keyTxEnabled=%s portControl=%s\n"
 999                 "%s  portEnabled=%s portValid=%s reAuthenticate=%s\n",
1000                 prefix, _SB(sm->authAbort), _SB(sm->authFail),
1001                 port_state_txt(sm->authPortStatus), _SB(sm->authStart),
1002                 prefix, _SB(sm->authTimeout), _SB(sm->authSuccess),
1003                 _SB(sm->eapFail), _SB(sm->eapolEap),
1004                 prefix, _SB(sm->eapSuccess), _SB(sm->eapTimeout),
1005                 _SB(sm->initialize), _SB(sm->keyAvailable),
1006                 prefix, _SB(sm->keyDone), _SB(sm->keyRun),
1007                 _SB(sm->keyTxEnabled), port_type_txt(sm->portControl),
1008                 prefix, _SB(sm->portEnabled), _SB(sm->portValid),
1009                 _SB(sm->reAuthenticate));
1010
1011         fprintf(f, "%s  Authenticator PAE:\n"
1012                 "%s    state=%s\n"
1013                 "%s    eapolLogoff=%s eapolStart=%s eapRestart=%s\n"
1014                 "%s    portMode=%s reAuthCount=%d\n"
1015                 "%s    quietPeriod=%d reAuthMax=%d\n"
1016                 "%s    authEntersConnecting=%d\n"
1017                 "%s    authEapLogoffsWhileConnecting=%d\n"
1018                 "%s    authEntersAuthenticating=%d\n"
1019                 "%s    authAuthSuccessesWhileAuthenticating=%d\n"
1020                 "%s    authAuthTimeoutsWhileAuthenticating=%d\n"
1021                 "%s    authAuthFailWhileAuthenticating=%d\n"
1022                 "%s    authAuthEapStartsWhileAuthenticating=%d\n"
1023                 "%s    authAuthEapLogoffWhileAuthenticating=%d\n"
1024                 "%s    authAuthReauthsWhileAuthenticated=%d\n"
1025                 "%s    authAuthEapStartsWhileAuthenticated=%d\n"
1026                 "%s    authAuthEapLogoffWhileAuthenticated=%d\n",
1027                 prefix, prefix, auth_pae_state_txt(sm->auth_pae.state), prefix,
1028                 _SB(sm->auth_pae.eapolLogoff), _SB(sm->auth_pae.eapolStart),
1029                 _SB(sm->auth_pae.eapRestart), prefix,
1030                 port_type_txt(sm->auth_pae.portMode), sm->auth_pae.reAuthCount,
1031                 prefix, sm->auth_pae.quietPeriod, sm->auth_pae.reAuthMax,
1032                 prefix, sm->auth_pae.authEntersConnecting,
1033                 prefix, sm->auth_pae.authEapLogoffsWhileConnecting,
1034                 prefix, sm->auth_pae.authEntersAuthenticating,
1035                 prefix, sm->auth_pae.authAuthSuccessesWhileAuthenticating,
1036                 prefix, sm->auth_pae.authAuthTimeoutsWhileAuthenticating,
1037                 prefix, sm->auth_pae.authAuthFailWhileAuthenticating,
1038                 prefix, sm->auth_pae.authAuthEapStartsWhileAuthenticating,
1039                 prefix, sm->auth_pae.authAuthEapLogoffWhileAuthenticating,
1040                 prefix, sm->auth_pae.authAuthReauthsWhileAuthenticated,
1041                 prefix, sm->auth_pae.authAuthEapStartsWhileAuthenticated,
1042                 prefix, sm->auth_pae.authAuthEapLogoffWhileAuthenticated);
1043
1044         fprintf(f, "%s  Backend Authentication:\n"
1045                 "%s    state=%s\n"
1046                 "%s    eapNoReq=%s eapReq=%s eapResp=%s\n"
1047                 "%s    serverTimeout=%d\n"
1048                 "%s    backendResponses=%d\n"
1049                 "%s    backendAccessChallenges=%d\n"
1050                 "%s    backendOtherRequestsToSupplicant=%d\n"
1051                 "%s    backendAuthSuccesses=%d\n"
1052                 "%s    backendAuthFails=%d\n",
1053                 prefix, prefix,
1054                 be_auth_state_txt(sm->be_auth.state),
1055                 prefix, _SB(sm->be_auth.eapNoReq), _SB(sm->be_auth.eapReq),
1056                 _SB(sm->be_auth.eapResp),
1057                 prefix, sm->be_auth.serverTimeout,
1058                 prefix, sm->be_auth.backendResponses,
1059                 prefix, sm->be_auth.backendAccessChallenges,
1060                 prefix, sm->be_auth.backendOtherRequestsToSupplicant,
1061                 prefix, sm->be_auth.backendAuthSuccesses,
1062                 prefix, sm->be_auth.backendAuthFails);
1063
1064         fprintf(f, "%s  Reauthentication Timer:\n"
1065                 "%s    state=%s\n"
1066                 "%s    reAuthPeriod=%d reAuthEnabled=%s\n", prefix, prefix,
1067                 reauth_timer_state_txt(sm->reauth_timer.state), prefix,
1068                 sm->reauth_timer.reAuthPeriod,
1069                 _SB(sm->reauth_timer.reAuthEnabled));
1070
1071         fprintf(f, "%s  Authenticator Key Transmit:\n"
1072                 "%s    state=%s\n", prefix, prefix,
1073                 auth_key_tx_state_txt(sm->auth_key_tx.state));
1074
1075         fprintf(f, "%s  Key Receive:\n"
1076                 "%s    state=%s\n"
1077                 "%s    rxKey=%s\n", prefix, prefix,
1078                 key_rx_state_txt(sm->key_rx.state),
1079                 prefix, _SB(sm->key_rx.rxKey));
1080
1081         fprintf(f, "%s  Controlled Directions:\n"
1082                 "%s    state=%s\n"
1083                 "%s    adminControlledDirections=%s "
1084                 "operControlledDirections=%s\n"
1085                 "%s    operEdge=%s\n", prefix, prefix,
1086                 ctrl_dir_state_txt(sm->ctrl_dir.state),
1087                 prefix, ctrl_dir_txt(sm->ctrl_dir.adminControlledDirections),
1088                 ctrl_dir_txt(sm->ctrl_dir.operControlledDirections),
1089                 prefix, _SB(sm->ctrl_dir.operEdge));
1090 #undef _SB
1091 }
1092 #endif /* HOSTAPD_DUMP_STATE */
1093
1094
1095 static Boolean eapol_sm_get_bool(void *ctx, enum eapol_bool_var variable)
1096 {
1097         struct eapol_state_machine *sm = ctx;
1098         if (sm == NULL)
1099                 return FALSE;
1100         switch (variable) {
1101         case EAPOL_eapSuccess:
1102                 return sm->eapSuccess;
1103         case EAPOL_eapRestart:
1104                 return sm->auth_pae.eapRestart;
1105         case EAPOL_eapFail:
1106                 return sm->eapFail;
1107         case EAPOL_eapResp:
1108                 return sm->be_auth.eapResp;
1109         case EAPOL_eapReq:
1110                 return sm->be_auth.eapReq;
1111         case EAPOL_eapNoReq:
1112                 return sm->be_auth.eapNoReq;
1113         case EAPOL_portEnabled:
1114                 return sm->portEnabled;
1115         case EAPOL_eapTimeout:
1116                 return sm->eapTimeout;
1117         }
1118         return FALSE;
1119 }
1120
1121
1122 static void eapol_sm_set_bool(void *ctx, enum eapol_bool_var variable,
1123                               Boolean value)
1124 {
1125         struct eapol_state_machine *sm = ctx;
1126         if (sm == NULL)
1127                 return;
1128         switch (variable) {
1129         case EAPOL_eapSuccess:
1130                 sm->eapSuccess = value;
1131                 break;
1132         case EAPOL_eapRestart:
1133                 sm->auth_pae.eapRestart = value;
1134                 break;
1135         case EAPOL_eapFail:
1136                 sm->eapFail = value;
1137                 break;
1138         case EAPOL_eapResp:
1139                 sm->be_auth.eapResp = value;
1140                 break;
1141         case EAPOL_eapReq:
1142                 sm->be_auth.eapReq = value;
1143                 break;
1144         case EAPOL_eapNoReq:
1145                 sm->be_auth.eapNoReq = value;
1146                 break;
1147         case EAPOL_portEnabled:
1148                 sm->portEnabled = value;
1149                 break;
1150         case EAPOL_eapTimeout:
1151                 sm->eapTimeout = value;
1152                 break;
1153         }
1154 }
1155
1156
1157 static void eapol_sm_set_eapReqData(void *ctx, const u8 *eapReqData,
1158                                     size_t eapReqDataLen)
1159 {
1160         struct eapol_state_machine *sm = ctx;
1161         if (sm == NULL)
1162                 return;
1163
1164         free(sm->last_eap_radius);
1165         sm->last_eap_radius = malloc(eapReqDataLen);
1166         if (sm->last_eap_radius == NULL)
1167                 return;
1168         memcpy(sm->last_eap_radius, eapReqData, eapReqDataLen);
1169         sm->last_eap_radius_len = eapReqDataLen;
1170 }
1171
1172
1173 static void eapol_sm_set_eapKeyData(void *ctx, const u8 *eapKeyData,
1174                                     size_t eapKeyDataLen)
1175 {
1176         struct eapol_state_machine *sm = ctx;
1177         struct hostapd_data *hapd;
1178
1179         if (sm == NULL)
1180                 return;
1181
1182         hapd = sm->hapd;
1183
1184         if (eapKeyData && eapKeyDataLen >= 64) {
1185                 free(sm->eapol_key_sign);
1186                 free(sm->eapol_key_crypt);
1187                 sm->eapol_key_crypt = malloc(32);
1188                 if (sm->eapol_key_crypt) {
1189                         memcpy(sm->eapol_key_crypt, eapKeyData, 32);
1190                         sm->eapol_key_crypt_len = 32;
1191                 }
1192                 sm->eapol_key_sign = malloc(32);
1193                 if (sm->eapol_key_sign) {
1194                         memcpy(sm->eapol_key_sign, eapKeyData + 32, 32);
1195                         sm->eapol_key_sign_len = 32;
1196                 }
1197                 if (hapd->default_wep_key ||
1198                     hapd->conf->individual_wep_key_len > 0 ||
1199                     hapd->conf->wpa)
1200                         sm->keyAvailable = TRUE;
1201         } else {
1202                 free(sm->eapol_key_sign);
1203                 free(sm->eapol_key_crypt);
1204                 sm->eapol_key_sign = NULL;
1205                 sm->eapol_key_crypt = NULL;
1206                 sm->eapol_key_sign_len = 0;
1207                 sm->eapol_key_crypt_len = 0;
1208                 sm->keyAvailable = FALSE;
1209         }
1210 }
1211
1212
1213 static int eapol_sm_get_eap_user(void *ctx, const u8 *identity,
1214                                  size_t identity_len, int phase2,
1215                                  struct eap_user *user)
1216 {
1217         struct eapol_state_machine *sm = ctx;
1218         const struct hostapd_eap_user *eap_user;
1219
1220         eap_user = hostapd_get_eap_user(sm->hapd->conf, identity,
1221                                         identity_len, phase2);
1222         if (eap_user == NULL)
1223                 return -1;
1224
1225         memset(user, 0, sizeof(*user));
1226         user->phase2 = phase2;
1227         memcpy(user->methods, eap_user->methods,
1228                EAP_USER_MAX_METHODS > EAP_MAX_METHODS ?
1229                EAP_USER_MAX_METHODS : EAP_MAX_METHODS);
1230
1231         if (eap_user->password) {
1232                 user->password = malloc(eap_user->password_len);
1233                 if (user->password == NULL)
1234                         return -1;
1235                 memcpy(user->password, eap_user->password,
1236                        eap_user->password_len);
1237                 user->password_len = eap_user->password_len;
1238         }
1239         user->force_version = eap_user->force_version;
1240
1241         return 0;
1242 }
1243
1244
1245 static const char * eapol_sm_get_eap_req_id_text(void *ctx, size_t *len)
1246 {
1247         struct eapol_state_machine *sm = ctx;
1248         *len = sm->hapd->conf->eap_req_id_text_len;
1249         return sm->hapd->conf->eap_req_id_text;
1250 }
1251
1252
1253 static struct eapol_callbacks eapol_cb =
1254 {
1255         .get_bool = eapol_sm_get_bool,
1256         .set_bool = eapol_sm_set_bool,
1257         .set_eapReqData = eapol_sm_set_eapReqData,
1258         .set_eapKeyData = eapol_sm_set_eapKeyData,
1259         .get_eap_user = eapol_sm_get_eap_user,
1260         .get_eap_req_id_text = eapol_sm_get_eap_req_id_text,
1261 };