contrib/hostapd/eap.c

   1 /*
   2  * hostapd / EAP Standalone Authenticator state machine (RFC 4137)
   3  * Copyright (c) 2004-2006, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  *
  14  * $FreeBSD$
  15  */
  16
  17 #include "includes.h"
  18
  19 #include "hostapd.h"
  20 #include "sta_info.h"
  21 #include "eap_i.h"
  22 #include "state_machine.h"
  23
  24 #define STATE_MACHINE_DATA struct eap_sm
  25 #define STATE_MACHINE_DEBUG_PREFIX "EAP"
  26
  27 #define EAP_MAX_AUTH_ROUNDS 50
  28
  29 static void eap_user_free(struct eap_user *user);
  30
  31
  32 /* EAP state machines are described in RFC 4137 */
  33
  34 static int eap_sm_calculateTimeout(struct eap_sm *sm, int retransCount,
  35                                    int eapSRTT, int eapRTTVAR,
  36                                    int methodTimeout);
  37 static void eap_sm_parseEapResp(struct eap_sm *sm, u8 *resp, size_t len);
  38 static u8 * eap_sm_buildSuccess(struct eap_sm *sm, int id, size_t *len);
  39 static u8 * eap_sm_buildFailure(struct eap_sm *sm, int id, size_t *len);
  40 static int eap_sm_nextId(struct eap_sm *sm, int id);
  41 static void eap_sm_Policy_update(struct eap_sm *sm, u8 *nak_list, size_t len);
  42 static EapType eap_sm_Policy_getNextMethod(struct eap_sm *sm, int *vendor);
  43 static int eap_sm_Policy_getDecision(struct eap_sm *sm);
  44 static Boolean eap_sm_Policy_doPickUp(struct eap_sm *sm, EapType method);
  45
  46
  47 static Boolean eapol_get_bool(struct eap_sm *sm, enum eapol_bool_var var)
  48 {
  49         return sm->eapol_cb->get_bool(sm->eapol_ctx, var);
  50 }
  51
  52
  53 static void eapol_set_bool(struct eap_sm *sm, enum eapol_bool_var var,
  54                            Boolean value)
  55 {
  56         sm->eapol_cb->set_bool(sm->eapol_ctx, var, value);
  57 }
  58
  59
  60 static void eapol_set_eapReqData(struct eap_sm *sm,
  61                                  const u8 *eapReqData, size_t eapReqDataLen)
  62 {
  63         wpa_hexdump(MSG_MSGDUMP, "EAP: eapReqData -> EAPOL",
  64                     sm->eapReqData, sm->eapReqDataLen);
  65         sm->eapol_cb->set_eapReqData(sm->eapol_ctx, eapReqData, eapReqDataLen);
  66 }
  67
  68
  69 static void eapol_set_eapKeyData(struct eap_sm *sm,
  70                                  const u8 *eapKeyData, size_t eapKeyDataLen)
  71 {
  72         wpa_hexdump(MSG_MSGDUMP, "EAP: eapKeyData -> EAPOL",
  73                     sm->eapKeyData, sm->eapKeyDataLen);
  74         sm->eapol_cb->set_eapKeyData(sm->eapol_ctx, eapKeyData, eapKeyDataLen);
  75 }
  76
  77
  78 /**
  79  * eap_user_get - Fetch user information from the database
  80  * @sm: Pointer to EAP state machine allocated with eap_sm_init()
  81  * @identity: Identity (User-Name) of the user
  82  * @identity_len: Length of identity in bytes
  83  * @phase2: 0 = EAP phase1 user, 1 = EAP phase2 (tunneled) user
  84  * Returns: 0 on success, or -1 on failure
  85  *
  86  * This function is used to fetch user information for EAP. The user will be
  87  * selected based on the specified identity. sm->user and
  88  * sm->user_eap_method_index are updated for the new user when a matching user
  89  * is found. sm->user can be used to get user information (e.g., password).
  90  */
  91 int eap_user_get(struct eap_sm *sm, const u8 *identity, size_t identity_len,
  92                  int phase2)
  93 {
  94         struct eap_user *user;
  95
  96         if (sm == NULL || sm->eapol_cb == NULL ||
  97             sm->eapol_cb->get_eap_user == NULL)
  98                 return -1;
  99
 100         eap_user_free(sm->user);
 101         sm->user = NULL;
 102
 103         user = wpa_zalloc(sizeof(*user));
 104         if (user == NULL)
 105             return -1;
 106
 107         if (sm->eapol_cb->get_eap_user(sm->eapol_ctx, identity,
 108                                        identity_len, phase2, user) != 0) {
 109                 eap_user_free(user);
 110                 return -1;
 111         }
 112
 113         sm->user = user;
 114         sm->user_eap_method_index = 0;
 115
 116         return 0;
 117 }
 118
 119
 120 SM_STATE(EAP, DISABLED)
 121 {
 122         SM_ENTRY(EAP, DISABLED);
 123         sm->num_rounds = 0;
 124 }
 125
 126
 127 SM_STATE(EAP, INITIALIZE)
 128 {
 129         SM_ENTRY(EAP, INITIALIZE);
 130
 131         sm->currentId = -1;
 132         eapol_set_bool(sm, EAPOL_eapSuccess, FALSE);
 133         eapol_set_bool(sm, EAPOL_eapFail, FALSE);
 134         eapol_set_bool(sm, EAPOL_eapTimeout, FALSE);
 135         free(sm->eapKeyData);
 136         sm->eapKeyData = NULL;
 137         sm->eapKeyDataLen = 0;
 138         /* eapKeyAvailable = FALSE */
 139         eapol_set_bool(sm, EAPOL_eapRestart, FALSE);
 140
 141         /*
 142          * This is not defined in RFC 4137, but method state needs to be
 143          * reseted here so that it does not remain in success state when
 144          * re-authentication starts.
 145          */
 146         if (sm->m && sm->eap_method_priv) {
 147                 sm->m->reset(sm, sm->eap_method_priv);
 148                 sm->eap_method_priv = NULL;
 149         }
 150         sm->m = NULL;
 151         sm->user_eap_method_index = 0;
 152
 153         if (sm->backend_auth) {
 154                 sm->currentMethod = EAP_TYPE_NONE;
 155                 /* parse rxResp, respId, respMethod */
 156                 eap_sm_parseEapResp(sm, sm->eapRespData, sm->eapRespDataLen);
 157                 if (sm->rxResp) {
 158                         sm->currentId = sm->respId;
 159                 }
 160         }
 161         sm->num_rounds = 0;
 162         sm->method_pending = METHOD_PENDING_NONE;
 163 }
 164
 165
 166 SM_STATE(EAP, PICK_UP_METHOD)
 167 {
 168         SM_ENTRY(EAP, PICK_UP_METHOD);
 169
 170         if (eap_sm_Policy_doPickUp(sm, sm->respMethod)) {
 171                 sm->currentMethod = sm->respMethod;
 172                 if (sm->m && sm->eap_method_priv) {
 173                         sm->m->reset(sm, sm->eap_method_priv);
 174                         sm->eap_method_priv = NULL;
 175                 }
 176                 sm->m = eap_sm_get_eap_methods(EAP_VENDOR_IETF,
 177                                                sm->currentMethod);
 178                 if (sm->m && sm->m->initPickUp) {
 179                         sm->eap_method_priv = sm->m->initPickUp(sm);
 180                         if (sm->eap_method_priv == NULL) {
 181                                 wpa_printf(MSG_DEBUG, "EAP: Failed to "
 182                                            "initialize EAP method %d",
 183                                            sm->currentMethod);
 184                                 sm->m = NULL;
 185                                 sm->currentMethod = EAP_TYPE_NONE;
 186                         }
 187                 } else {
 188                         sm->m = NULL;
 189                         sm->currentMethod = EAP_TYPE_NONE;
 190                 }
 191         }
 192 }
 193
 194
 195 SM_STATE(EAP, IDLE)
 196 {
 197         SM_ENTRY(EAP, IDLE);
 198
 199         sm->retransWhile = eap_sm_calculateTimeout(sm, sm->retransCount,
 200                                                    sm->eapSRTT, sm->eapRTTVAR,
 201                                                    sm->methodTimeout);
 202 }
 203
 204
 205 SM_STATE(EAP, RETRANSMIT)
 206 {
 207         SM_ENTRY(EAP, RETRANSMIT);
 208
 209         /* TODO: Is this needed since EAPOL state machines take care of
 210          * retransmit? */
 211 }
 212
 213
 214 SM_STATE(EAP, RECEIVED)
 215 {
 216         SM_ENTRY(EAP, RECEIVED);
 217
 218         /* parse rxResp, respId, respMethod */
 219         eap_sm_parseEapResp(sm, sm->eapRespData, sm->eapRespDataLen);
 220         sm->num_rounds++;
 221 }
 222
 223
 224 SM_STATE(EAP, DISCARD)
 225 {
 226         SM_ENTRY(EAP, DISCARD);
 227         eapol_set_bool(sm, EAPOL_eapResp, FALSE);
 228         eapol_set_bool(sm, EAPOL_eapNoReq, TRUE);
 229 }
 230
 231
 232 SM_STATE(EAP, SEND_REQUEST)
 233 {
 234         SM_ENTRY(EAP, SEND_REQUEST);
 235
 236         sm->retransCount = 0;
 237         if (sm->eapReqData) {
 238                 eapol_set_eapReqData(sm, sm->eapReqData, sm->eapReqDataLen);
 239                 free(sm->lastReqData);
 240                 sm->lastReqData = sm->eapReqData;
 241                 sm->lastReqDataLen = sm->eapReqDataLen;
 242                 sm->eapReqData = NULL;
 243                 sm->eapReqDataLen = 0;
 244                 eapol_set_bool(sm, EAPOL_eapResp, FALSE);
 245                 eapol_set_bool(sm, EAPOL_eapReq, TRUE);
 246         } else {
 247                 wpa_printf(MSG_INFO, "EAP: SEND_REQUEST - no eapReqData");
 248                 eapol_set_bool(sm, EAPOL_eapResp, FALSE);
 249                 eapol_set_bool(sm, EAPOL_eapReq, FALSE);
 250                 eapol_set_bool(sm, EAPOL_eapNoReq, TRUE);
 251         }
 252 }
 253
 254
 255 SM_STATE(EAP, INTEGRITY_CHECK)
 256 {
 257         SM_ENTRY(EAP, INTEGRITY_CHECK);
 258
 259         if (sm->m->check) {
 260                 sm->ignore = sm->m->check(sm, sm->eap_method_priv,
 261                                           sm->eapRespData, sm->eapRespDataLen);
 262         }
 263 }
 264
 265
 266 SM_STATE(EAP, METHOD_REQUEST)
 267 {
 268         SM_ENTRY(EAP, METHOD_REQUEST);
 269
 270         if (sm->m == NULL) {
 271                 wpa_printf(MSG_DEBUG, "EAP: method not initialized");
 272                 return;
 273         }
 274
 275         sm->currentId = eap_sm_nextId(sm, sm->currentId);
 276         wpa_printf(MSG_DEBUG, "EAP: building EAP-Request: Identifier %d",
 277                    sm->currentId);
 278         sm->lastId = sm->currentId;
 279         free(sm->eapReqData);
 280         sm->eapReqData = sm->m->buildReq(sm, sm->eap_method_priv,
 281                                          sm->currentId, &sm->eapReqDataLen);
 282         if (sm->m->getTimeout)
 283                 sm->methodTimeout = sm->m->getTimeout(sm, sm->eap_method_priv);
 284         else
 285                 sm->methodTimeout = 0;
 286 }
 287
 288
 289 SM_STATE(EAP, METHOD_RESPONSE)
 290 {
 291         SM_ENTRY(EAP, METHOD_RESPONSE);
 292
 293         sm->m->process(sm, sm->eap_method_priv, sm->eapRespData,
 294                        sm->eapRespDataLen);
 295         if (sm->m->isDone(sm, sm->eap_method_priv)) {
 296                 eap_sm_Policy_update(sm, NULL, 0);
 297                 free(sm->eapKeyData);
 298                 if (sm->m->getKey) {
 299                         sm->eapKeyData = sm->m->getKey(sm, sm->eap_method_priv,
 300                                                        &sm->eapKeyDataLen);
 301                 } else {
 302                         sm->eapKeyData = NULL;
 303                         sm->eapKeyDataLen = 0;
 304                 }
 305                 sm->methodState = METHOD_END;
 306         } else {
 307                 sm->methodState = METHOD_CONTINUE;
 308         }
 309 }
 310
 311
 312 SM_STATE(EAP, PROPOSE_METHOD)
 313 {
 314         int vendor;
 315         EapType type;
 316
 317         SM_ENTRY(EAP, PROPOSE_METHOD);
 318
 319         type = eap_sm_Policy_getNextMethod(sm, &vendor);
 320         if (vendor == EAP_VENDOR_IETF)
 321                 sm->currentMethod = type;
 322         else
 323                 sm->currentMethod = EAP_TYPE_EXPANDED;
 324         if (sm->m && sm->eap_method_priv) {
 325                 sm->m->reset(sm, sm->eap_method_priv);
 326                 sm->eap_method_priv = NULL;
 327         }
 328         sm->m = eap_sm_get_eap_methods(vendor, type);
 329         if (sm->m) {
 330                 sm->eap_method_priv = sm->m->init(sm);
 331                 if (sm->eap_method_priv == NULL) {
 332                         wpa_printf(MSG_DEBUG, "EAP: Failed to initialize EAP "
 333                                    "method %d", sm->currentMethod);
 334                         sm->m = NULL;
 335                         sm->currentMethod = EAP_TYPE_NONE;
 336                 }
 337         }
 338         if (sm->currentMethod == EAP_TYPE_IDENTITY ||
 339             sm->currentMethod == EAP_TYPE_NOTIFICATION)
 340                 sm->methodState = METHOD_CONTINUE;
 341         else
 342                 sm->methodState = METHOD_PROPOSED;
 343 }
 344
 345
 346 SM_STATE(EAP, NAK)
 347 {
 348         struct eap_hdr *nak;
 349         size_t len = 0;
 350         u8 *pos, *nak_list = NULL;
 351
 352         SM_ENTRY(EAP, NAK);
 353
 354         if (sm->eap_method_priv) {
 355                 sm->m->reset(sm, sm->eap_method_priv);
 356                 sm->eap_method_priv = NULL;
 357         }
 358         sm->m = NULL;
 359
 360         nak = (struct eap_hdr *) sm->eapRespData;
 361         if (nak && sm->eapRespDataLen > sizeof(*nak)) {
 362                 len = ntohs(nak->length);
 363                 if (len > sm->eapRespDataLen)
 364                         len = sm->eapRespDataLen;
 365                 pos = (u8 *) (nak + 1);
 366                 len -= sizeof(*nak);
 367                 if (*pos == EAP_TYPE_NAK) {
 368                         pos++;
 369                         len--;
 370                         nak_list = pos;
 371                 }
 372         }
 373         eap_sm_Policy_update(sm, nak_list, len);
 374 }
 375
 376
 377 SM_STATE(EAP, SELECT_ACTION)
 378 {
 379         SM_ENTRY(EAP, SELECT_ACTION);
 380
 381         sm->decision = eap_sm_Policy_getDecision(sm);
 382 }
 383
 384
 385 SM_STATE(EAP, TIMEOUT_FAILURE)
 386 {
 387         SM_ENTRY(EAP, TIMEOUT_FAILURE);
 388
 389         eapol_set_bool(sm, EAPOL_eapTimeout, TRUE);
 390 }
 391
 392
 393 SM_STATE(EAP, FAILURE)
 394 {
 395         SM_ENTRY(EAP, FAILURE);
 396
 397         free(sm->eapReqData);
 398         sm->eapReqData = eap_sm_buildFailure(sm, sm->currentId,
 399                                              &sm->eapReqDataLen);
 400         if (sm->eapReqData) {
 401                 eapol_set_eapReqData(sm, sm->eapReqData, sm->eapReqDataLen);
 402                 free(sm->eapReqData);
 403                 sm->eapReqData = NULL;
 404                 sm->eapReqDataLen = 0;
 405         }
 406         free(sm->lastReqData);
 407         sm->lastReqData = NULL;
 408         sm->lastReqDataLen = 0;
 409         eapol_set_bool(sm, EAPOL_eapFail, TRUE);
 410 }
 411
 412
 413 SM_STATE(EAP, SUCCESS)
 414 {
 415         SM_ENTRY(EAP, SUCCESS);
 416
 417         free(sm->eapReqData);
 418         sm->eapReqData = eap_sm_buildSuccess(sm, sm->currentId,
 419                                              &sm->eapReqDataLen);
 420         if (sm->eapReqData) {
 421                 eapol_set_eapReqData(sm, sm->eapReqData, sm->eapReqDataLen);
 422                 free(sm->eapReqData);
 423                 sm->eapReqData = NULL;
 424                 sm->eapReqDataLen = 0;
 425         }
 426         free(sm->lastReqData);
 427         sm->lastReqData = NULL;
 428         sm->lastReqDataLen = 0;
 429         if (sm->eapKeyData) {
 430                 eapol_set_eapKeyData(sm, sm->eapKeyData, sm->eapKeyDataLen);
 431         }
 432         eapol_set_bool(sm, EAPOL_eapSuccess, TRUE);
 433 }
 434
 435
 436 SM_STEP(EAP)
 437 {
 438         if (eapol_get_bool(sm, EAPOL_eapRestart) &&
 439             eapol_get_bool(sm, EAPOL_portEnabled))
 440                 SM_ENTER_GLOBAL(EAP, INITIALIZE);
 441         else if (!eapol_get_bool(sm, EAPOL_portEnabled))
 442                 SM_ENTER_GLOBAL(EAP, DISABLED);
 443         else if (sm->num_rounds > EAP_MAX_AUTH_ROUNDS) {
 444                 if (sm->num_rounds == EAP_MAX_AUTH_ROUNDS + 1) {
 445                         wpa_printf(MSG_DEBUG, "EAP: more than %d "
 446                                    "authentication rounds - abort",
 447                                    EAP_MAX_AUTH_ROUNDS);
 448                         sm->num_rounds++;
 449                         SM_ENTER_GLOBAL(EAP, FAILURE);
 450                 }
 451         } else switch (sm->EAP_state) {
 452         case EAP_INITIALIZE:
 453                 if (sm->backend_auth) {
 454                         if (!sm->rxResp)
 455                                 SM_ENTER(EAP, SELECT_ACTION);
 456                         else if (sm->rxResp &&
 457                                  (sm->respMethod == EAP_TYPE_NAK ||
 458                                   (sm->respMethod == EAP_TYPE_EXPANDED &&
 459                                    sm->respVendor == EAP_VENDOR_IETF &&
 460                                    sm->respVendorMethod == EAP_TYPE_NAK)))
 461                                 SM_ENTER(EAP, NAK);
 462                         else
 463                                 SM_ENTER(EAP, PICK_UP_METHOD);
 464                 } else {
 465                         SM_ENTER(EAP, SELECT_ACTION);
 466                 }
 467                 break;
 468         case EAP_PICK_UP_METHOD:
 469                 if (sm->currentMethod == EAP_TYPE_NONE) {
 470                         SM_ENTER(EAP, SELECT_ACTION);
 471                 } else {
 472                         SM_ENTER(EAP, METHOD_RESPONSE);
 473                 }
 474                 break;
 475         case EAP_DISABLED:
 476                 if (eapol_get_bool(sm, EAPOL_portEnabled))
 477                         SM_ENTER(EAP, INITIALIZE);
 478                 break;
 479         case EAP_IDLE:
 480                 if (sm->retransWhile == 0)
 481                         SM_ENTER(EAP, RETRANSMIT);
 482                 else if (eapol_get_bool(sm, EAPOL_eapResp))
 483                         SM_ENTER(EAP, RECEIVED);
 484                 break;
 485         case EAP_RETRANSMIT:
 486                 if (sm->retransCount > sm->MaxRetrans)
 487                         SM_ENTER(EAP, TIMEOUT_FAILURE);
 488                 else
 489                         SM_ENTER(EAP, IDLE);
 490                 break;
 491         case EAP_RECEIVED:
 492                 if (sm->rxResp && (sm->respId == sm->currentId) &&
 493                     (sm->respMethod == EAP_TYPE_NAK ||
 494                      (sm->respMethod == EAP_TYPE_EXPANDED &&
 495                       sm->respVendor == EAP_VENDOR_IETF &&
 496                       sm->respVendorMethod == EAP_TYPE_NAK))
 497                     && (sm->methodState == METHOD_PROPOSED))
 498                         SM_ENTER(EAP, NAK);
 499                 else if (sm->rxResp && (sm->respId == sm->currentId) &&
 500                          ((sm->respMethod == sm->currentMethod) ||
 501                           (sm->respMethod == EAP_TYPE_EXPANDED &&
 502                            sm->respVendor == EAP_VENDOR_IETF &&
 503                            sm->respVendorMethod == sm->currentMethod)))
 504                         SM_ENTER(EAP, INTEGRITY_CHECK);
 505                 else {
 506                         wpa_printf(MSG_DEBUG, "EAP: RECEIVED->DISCARD: "
 507                                    "rxResp=%d respId=%d currentId=%d "
 508                                    "respMethod=%d currentMethod=%d",
 509                                    sm->rxResp, sm->respId, sm->currentId,
 510                                    sm->respMethod, sm->currentMethod);
 511                         SM_ENTER(EAP, DISCARD);
 512                 }
 513                 break;
 514         case EAP_DISCARD:
 515                 SM_ENTER(EAP, IDLE);
 516                 break;
 517         case EAP_SEND_REQUEST:
 518                 SM_ENTER(EAP, IDLE);
 519                 break;
 520         case EAP_INTEGRITY_CHECK:
 521                 if (sm->ignore)
 522                         SM_ENTER(EAP, DISCARD);
 523                 else
 524                         SM_ENTER(EAP, METHOD_RESPONSE);
 525                 break;
 526         case EAP_METHOD_REQUEST:
 527                 SM_ENTER(EAP, SEND_REQUEST);
 528                 break;
 529         case EAP_METHOD_RESPONSE:
 530                 /*
 531                  * Note: Mechanism to allow EAP methods to wait while going
 532                  * through pending processing is an extension to RFC 4137
 533                  * which only defines the transits to SELECT_ACTION and
 534                  * METHOD_REQUEST from this METHOD_RESPONSE state.
 535                  */
 536                 if (sm->methodState == METHOD_END)
 537                         SM_ENTER(EAP, SELECT_ACTION);
 538                 else if (sm->method_pending == METHOD_PENDING_WAIT) {
 539                         wpa_printf(MSG_DEBUG, "EAP: Method has pending "
 540                                    "processing - wait before proceeding to "
 541                                    "METHOD_REQUEST state");
 542                 } else if (sm->method_pending == METHOD_PENDING_CONT) {
 543                         wpa_printf(MSG_DEBUG, "EAP: Method has completed "
 544                                    "pending processing - reprocess pending "
 545                                    "EAP message");
 546                         sm->method_pending = METHOD_PENDING_NONE;
 547                         SM_ENTER(EAP, METHOD_RESPONSE);
 548                 } else
 549                         SM_ENTER(EAP, METHOD_REQUEST);
 550                 break;
 551         case EAP_PROPOSE_METHOD:
 552                 /*
 553                  * Note: Mechanism to allow EAP methods to wait while going
 554                  * through pending processing is an extension to RFC 4137
 555                  * which only defines the transit to METHOD_REQUEST from this
 556                  * PROPOSE_METHOD state.
 557                  */
 558                 if (sm->method_pending == METHOD_PENDING_WAIT) {
 559                         wpa_printf(MSG_DEBUG, "EAP: Method has pending "
 560                                    "processing - wait before proceeding to "
 561                                    "METHOD_REQUEST state");
 562                         if (sm->user_eap_method_index > 0)
 563                                 sm->user_eap_method_index--;
 564                 } else if (sm->method_pending == METHOD_PENDING_CONT) {
 565                         wpa_printf(MSG_DEBUG, "EAP: Method has completed "
 566                                    "pending processing - reprocess pending "
 567                                    "EAP message");
 568                         sm->method_pending = METHOD_PENDING_NONE;
 569                         SM_ENTER(EAP, PROPOSE_METHOD);
 570                 } else
 571                         SM_ENTER(EAP, METHOD_REQUEST);
 572                 break;
 573         case EAP_NAK:
 574                 SM_ENTER(EAP, SELECT_ACTION);
 575                 break;
 576         case EAP_SELECT_ACTION:
 577                 if (sm->decision == DECISION_FAILURE)
 578                         SM_ENTER(EAP, FAILURE);
 579                 else if (sm->decision == DECISION_SUCCESS)
 580                         SM_ENTER(EAP, SUCCESS);
 581                 else
 582                         SM_ENTER(EAP, PROPOSE_METHOD);
 583                 break;
 584         case EAP_TIMEOUT_FAILURE:
 585                 break;
 586         case EAP_FAILURE:
 587                 break;
 588         case EAP_SUCCESS:
 589                 break;
 590         }
 591 }
 592
 593
 594 static int eap_sm_calculateTimeout(struct eap_sm *sm, int retransCount,
 595                                    int eapSRTT, int eapRTTVAR,
 596                                    int methodTimeout)
 597 {
 598         /* For now, retransmission is done in EAPOL state machines, so make
 599          * sure EAP state machine does not end up trying to retransmit packets.
 600          */
 601         return 1;
 602 }
 603
 604
 605 static void eap_sm_parseEapResp(struct eap_sm *sm, u8 *resp, size_t len)
 606 {
 607         struct eap_hdr *hdr;
 608         size_t plen;
 609
 610         /* parse rxResp, respId, respMethod */
 611         sm->rxResp = FALSE;
 612         sm->respId = -1;
 613         sm->respMethod = EAP_TYPE_NONE;
 614         sm->respVendor = EAP_VENDOR_IETF;
 615         sm->respVendorMethod = EAP_TYPE_NONE;
 616
 617         if (resp == NULL || len < sizeof(*hdr))
 618                 return;
 619
 620         hdr = (struct eap_hdr *) resp;
 621         plen = ntohs(hdr->length);
 622         if (plen > len) {
 623                 wpa_printf(MSG_DEBUG, "EAP: Ignored truncated EAP-Packet "
 624                            "(len=%lu plen=%lu)", (unsigned long) len,
 625                            (unsigned long) plen);
 626                 return;
 627         }
 628
 629         sm->respId = hdr->identifier;
 630
 631         if (hdr->code == EAP_CODE_RESPONSE)
 632                 sm->rxResp = TRUE;
 633
 634         if (plen > sizeof(*hdr)) {
 635                 u8 *pos = (u8 *) (hdr + 1);
 636                 sm->respMethod = *pos++;
 637                 if (sm->respMethod == EAP_TYPE_EXPANDED) {
 638                         if (plen < sizeof(*hdr) + 8) {
 639                                 wpa_printf(MSG_DEBUG, "EAP: Ignored truncated "
 640                                            "expanded EAP-Packet (plen=%lu)",
 641                                            (unsigned long) plen);
 642                                 return;
 643                         }
 644                         sm->respVendor = WPA_GET_BE24(pos);
 645                         pos += 3;
 646                         sm->respVendorMethod = WPA_GET_BE32(pos);
 647                 }
 648         }
 649
 650         wpa_printf(MSG_DEBUG, "EAP: parseEapResp: rxResp=%d respId=%d "
 651                    "respMethod=%u respVendor=%u respVendorMethod=%u",
 652                    sm->rxResp, sm->respId, sm->respMethod, sm->respVendor,
 653                    sm->respVendorMethod);
 654 }
 655
 656
 657 static u8 * eap_sm_buildSuccess(struct eap_sm *sm, int id, size_t *len)
 658 {
 659         struct eap_hdr *resp;
 660         wpa_printf(MSG_DEBUG, "EAP: Building EAP-Success (id=%d)", id);
 661
 662         *len = sizeof(*resp);
 663         resp = malloc(*len);
 664         if (resp == NULL)
 665                 return NULL;
 666         resp->code = EAP_CODE_SUCCESS;
 667         resp->identifier = id;
 668         resp->length = htons(*len);
 669
 670         return (u8 *) resp;
 671 }
 672
 673
 674 static u8 * eap_sm_buildFailure(struct eap_sm *sm, int id, size_t *len)
 675 {
 676         struct eap_hdr *resp;
 677         wpa_printf(MSG_DEBUG, "EAP: Building EAP-Failure (id=%d)", id);
 678
 679         *len = sizeof(*resp);
 680         resp = malloc(*len);
 681         if (resp == NULL)
 682                 return NULL;
 683         resp->code = EAP_CODE_FAILURE;
 684         resp->identifier = id;
 685         resp->length = htons(*len);
 686
 687         return (u8 *) resp;
 688 }
 689
 690
 691 static int eap_sm_nextId(struct eap_sm *sm, int id)
 692 {
 693         if (id < 0) {
 694                 /* RFC 3748 Ch 4.1: recommended to initialize Identifier with a
 695                  * random number */
 696                 id = rand() & 0xff;
 697                 if (id != sm->lastId)
 698                         return id;
 699         }
 700         return (id + 1) & 0xff;
 701 }
 702
 703
 704 /**
 705  * eap_sm_process_nak - Process EAP-Response/Nak
 706  * @sm: Pointer to EAP state machine allocated with eap_sm_init()
 707  * @nak_list: Nak list (allowed methods) from the supplicant
 708  * @len: Length of nak_list in bytes
 709  *
 710  * This function is called when EAP-Response/Nak is received from the
 711  * supplicant. This can happen for both phase 1 and phase 2 authentications.
 712  */
 713 void eap_sm_process_nak(struct eap_sm *sm, u8 *nak_list, size_t len)
 714 {
 715         int i;
 716         size_t j;
 717
 718         if (sm->user == NULL)
 719                 return;
 720
 721         wpa_printf(MSG_MSGDUMP, "EAP: processing NAK (current EAP method "
 722                    "index %d)", sm->user_eap_method_index);
 723
 724         wpa_hexdump(MSG_MSGDUMP, "EAP: configured methods",
 725                     (u8 *) sm->user->methods,
 726                     EAP_MAX_METHODS * sizeof(sm->user->methods[0]));
 727         wpa_hexdump(MSG_MSGDUMP, "EAP: list of methods supported by the peer",
 728                     nak_list, len);
 729
 730         i = sm->user_eap_method_index;
 731         while (i < EAP_MAX_METHODS &&
 732                (sm->user->methods[i].vendor != EAP_VENDOR_IETF ||
 733                 sm->user->methods[i].method != EAP_TYPE_NONE)) {
 734                 if (sm->user->methods[i].vendor != EAP_VENDOR_IETF)
 735                         goto not_found;
 736                 for (j = 0; j < len; j++) {
 737                         if (nak_list[j] == sm->user->methods[i].method) {
 738                                 break;
 739                         }
 740                 }
 741
 742                 if (j < len) {
 743                         /* found */
 744                         i++;
 745                         continue;
 746                 }
 747
 748         not_found:
 749                 /* not found - remove from the list */
 750                 memmove(&sm->user->methods[i], &sm->user->methods[i + 1],
 751                         (EAP_MAX_METHODS - i - 1) *
 752                         sizeof(sm->user->methods[0]));
 753                 sm->user->methods[EAP_MAX_METHODS - 1].vendor =
 754                         EAP_VENDOR_IETF;
 755                 sm->user->methods[EAP_MAX_METHODS - 1].method = EAP_TYPE_NONE;
 756         }
 757
 758         wpa_hexdump(MSG_MSGDUMP, "EAP: new list of configured methods",
 759                     (u8 *) sm->user->methods, EAP_MAX_METHODS *
 760                     sizeof(sm->user->methods[0]));
 761 }
 762
 763
 764 static void eap_sm_Policy_update(struct eap_sm *sm, u8 *nak_list, size_t len)
 765 {
 766         if (nak_list == NULL || sm == NULL || sm->user == NULL)
 767                 return;
 768
 769         if (sm->user->phase2) {
 770                 wpa_printf(MSG_DEBUG, "EAP: EAP-Nak received after Phase2 user"
 771                            " info was selected - reject");
 772                 sm->decision = DECISION_FAILURE;
 773                 return;
 774         }
 775
 776         eap_sm_process_nak(sm, nak_list, len);
 777 }
 778
 779
 780 static EapType eap_sm_Policy_getNextMethod(struct eap_sm *sm, int *vendor)
 781 {
 782         EapType next;
 783         int idx = sm->user_eap_method_index;
 784
 785         /* In theory, there should be no problems with starting
 786          * re-authentication with something else than EAP-Request/Identity and
 787          * this does indeed work with wpa_supplicant. However, at least Funk
 788          * Supplicant seemed to ignore re-auth if it skipped
 789          * EAP-Request/Identity.
 790          * Re-auth sets currentId == -1, so that can be used here to select
 791          * whether Identity needs to be requested again. */
 792         if (sm->identity == NULL || sm->currentId == -1) {
 793                 *vendor = EAP_VENDOR_IETF;
 794                 next = EAP_TYPE_IDENTITY;
 795                 sm->update_user = TRUE;
 796         } else if (sm->user && idx < EAP_MAX_METHODS &&
 797                    (sm->user->methods[idx].vendor != EAP_VENDOR_IETF ||
 798                     sm->user->methods[idx].method != EAP_TYPE_NONE)) {
 799                 *vendor = sm->user->methods[idx].vendor;
 800                 next = sm->user->methods[idx].method;
 801                 sm->user_eap_method_index++;
 802         } else {
 803                 *vendor = EAP_VENDOR_IETF;
 804                 next = EAP_TYPE_NONE;
 805         }
 806         wpa_printf(MSG_DEBUG, "EAP: getNextMethod: vendor %d type %d",
 807                    *vendor, next);
 808         return next;
 809 }
 810
 811
 812 static int eap_sm_Policy_getDecision(struct eap_sm *sm)
 813 {
 814         if (sm->m && sm->currentMethod != EAP_TYPE_IDENTITY &&
 815             sm->m->isSuccess(sm, sm->eap_method_priv)) {
 816                 wpa_printf(MSG_DEBUG, "EAP: getDecision: method succeeded -> "
 817                            "SUCCESS");
 818                 sm->update_user = TRUE;
 819                 return DECISION_SUCCESS;
 820         }
 821
 822         if (sm->m && sm->m->isDone(sm, sm->eap_method_priv) &&
 823             !sm->m->isSuccess(sm, sm->eap_method_priv)) {
 824                 wpa_printf(MSG_DEBUG, "EAP: getDecision: method failed -> "
 825                            "FAILURE");
 826                 sm->update_user = TRUE;
 827                 return DECISION_FAILURE;
 828         }
 829
 830         if ((sm->user == NULL || sm->update_user) && sm->identity) {
 831                 if (eap_user_get(sm, sm->identity, sm->identity_len, 0) != 0) {
 832                         wpa_printf(MSG_DEBUG, "EAP: getDecision: user not "
 833                                    "found from database -> FAILURE");
 834                         return DECISION_FAILURE;
 835                 }
 836                 sm->update_user = FALSE;
 837         }
 838
 839         if (sm->user && sm->user_eap_method_index < EAP_MAX_METHODS &&
 840             (sm->user->methods[sm->user_eap_method_index].vendor !=
 841              EAP_VENDOR_IETF ||
 842              sm->user->methods[sm->user_eap_method_index].method !=
 843              EAP_TYPE_NONE)) {
 844                 wpa_printf(MSG_DEBUG, "EAP: getDecision: another method "
 845                            "available -> CONTINUE");
 846                 return DECISION_CONTINUE;
 847         }
 848
 849         if (sm->identity == NULL || sm->currentId == -1) {
 850                 wpa_printf(MSG_DEBUG, "EAP: getDecision: no identity known "
 851                            "yet -> CONTINUE");
 852                 return DECISION_CONTINUE;
 853         }
 854
 855         wpa_printf(MSG_DEBUG, "EAP: getDecision: no more methods available -> "
 856                    "FAILURE");
 857         return DECISION_FAILURE;
 858 }
 859
 860
 861 static Boolean eap_sm_Policy_doPickUp(struct eap_sm *sm, EapType method)
 862 {
 863         return method == EAP_TYPE_IDENTITY ? TRUE : FALSE;
 864 }
 865
 866
 867 /**
 868  * eap_sm_step - Step EAP state machine
 869  * @sm: Pointer to EAP state machine allocated with eap_sm_init()
 870  * Returns: 1 if EAP state was changed or 0 if not
 871  *
 872  * This function advances EAP state machine to a new state to match with the
 873  * current variables. This should be called whenever variables used by the EAP
 874  * state machine have changed.
 875  */
 876 int eap_sm_step(struct eap_sm *sm)
 877 {
 878         int res = 0;
 879         do {
 880                 sm->changed = FALSE;
 881                 SM_STEP_RUN(EAP);
 882                 if (sm->changed)
 883                         res = 1;
 884         } while (sm->changed);
 885         return res;
 886 }
 887
 888
 889 /**
 890  * eap_set_eapRespData - Set EAP response (eapRespData)
 891  * @sm: Pointer to EAP state machine allocated with eap_sm_init()
 892  * @eapRespData: EAP-Response payload from the supplicant
 893  * @eapRespDataLen: Length of eapRespData in bytes
 894  *
 895  * This function is called when an EAP-Response is received from a supplicant.
 896  */
 897 void eap_set_eapRespData(struct eap_sm *sm, const u8 *eapRespData,
 898                          size_t eapRespDataLen)
 899 {
 900         if (sm == NULL)
 901                 return;
 902         free(sm->eapRespData);
 903         sm->eapRespData = malloc(eapRespDataLen);
 904         if (sm->eapRespData == NULL)
 905                 return;
 906         memcpy(sm->eapRespData, eapRespData, eapRespDataLen);
 907         sm->eapRespDataLen = eapRespDataLen;
 908         wpa_hexdump(MSG_MSGDUMP, "EAP: EAP-Response received",
 909                     eapRespData, eapRespDataLen);
 910 }
 911
 912
 913 static void eap_user_free(struct eap_user *user)
 914 {
 915         if (user == NULL)
 916                 return;
 917         free(user->password);
 918         user->password = NULL;
 919         free(user);
 920 }
 921
 922
 923 /**
 924  * eap_sm_init - Allocate and initialize EAP state machine
 925  * @eapol_ctx: Context data to be used with eapol_cb calls
 926  * @eapol_cb: Pointer to EAPOL callback functions
 927  * @conf: EAP configuration
 928  * Returns: Pointer to the allocated EAP state machine or %NULL on failure
 929  *
 930  * This function allocates and initializes an EAP state machine.
 931  */
 932 struct eap_sm * eap_sm_init(void *eapol_ctx, struct eapol_callbacks *eapol_cb,
 933                             struct eap_config *conf)
 934 {
 935         struct eap_sm *sm;
 936
 937         sm = wpa_zalloc(sizeof(*sm));
 938         if (sm == NULL)
 939                 return NULL;
 940         sm->eapol_ctx = eapol_ctx;
 941         sm->eapol_cb = eapol_cb;
 942         sm->MaxRetrans = 10;
 943         sm->ssl_ctx = conf->ssl_ctx;
 944         sm->eap_sim_db_priv = conf->eap_sim_db_priv;
 945         sm->backend_auth = conf->backend_auth;
 946
 947         wpa_printf(MSG_DEBUG, "EAP: State machine created");
 948
 949         return sm;
 950 }
 951
 952
 953 /**
 954  * eap_sm_deinit - Deinitialize and free an EAP state machine
 955  * @sm: Pointer to EAP state machine allocated with eap_sm_init()
 956  *
 957  * This function deinitializes EAP state machine and frees all allocated
 958  * resources.
 959  */
 960 void eap_sm_deinit(struct eap_sm *sm)
 961 {
 962         if (sm == NULL)
 963                 return;
 964         wpa_printf(MSG_DEBUG, "EAP: State machine removed");
 965         if (sm->m && sm->eap_method_priv)
 966                 sm->m->reset(sm, sm->eap_method_priv);
 967         free(sm->eapReqData);
 968         free(sm->eapKeyData);
 969         free(sm->lastReqData);
 970         free(sm->eapRespData);
 971         free(sm->identity);
 972         eap_user_free(sm->user);
 973         free(sm);
 974 }
 975
 976
 977 /**
 978  * eap_sm_notify_cached - Notify EAP state machine of cached PMK
 979  * @sm: Pointer to EAP state machine allocated with eap_sm_init()
 980  *
 981  * This function is called when PMKSA caching is used to skip EAP
 982  * authentication.
 983  */
 984 void eap_sm_notify_cached(struct eap_sm *sm)
 985 {
 986         if (sm == NULL)
 987                 return;
 988
 989         sm->EAP_state = EAP_SUCCESS;
 990 }
 991
 992
 993 /**
 994  * eap_sm_pending_cb - EAP state machine callback for a pending EAP request
 995  * @sm: Pointer to EAP state machine allocated with eap_sm_init()
 996  *
 997  * This function is called when data for a pending EAP-Request is received.
 998  */
 999 void eap_sm_pending_cb(struct eap_sm *sm)
1000 {
1001         if (sm == NULL)
1002                 return;
1003         wpa_printf(MSG_DEBUG, "EAP: Callback for pending request received");
1004         if (sm->method_pending == METHOD_PENDING_WAIT)
1005                 sm->method_pending = METHOD_PENDING_CONT;
1006 }
1007
1008
1009 /**
1010  * eap_sm_method_pending - Query whether EAP method is waiting for pending data
1011  * @sm: Pointer to EAP state machine allocated with eap_sm_init()
1012  * Returns: 1 if method is waiting for pending data or 0 if not
1013  */
1014 int eap_sm_method_pending(struct eap_sm *sm)
1015 {
1016         if (sm == NULL)
1017                 return 0;
1018         return sm->method_pending == METHOD_PENDING_WAIT;
1019 }
1020
1021
1022 /**
1023  * eap_hdr_validate - Validate EAP header
1024  * @vendor: Expected EAP Vendor-Id (0 = IETF)
1025  * @eap_type: Expected EAP type number
1026  * @msg: EAP frame (starting with EAP header)
1027  * @msglen: Length of msg
1028  * @plen: Pointer to variable to contain the returned payload length
1029  * Returns: Pointer to EAP payload (after type field), or %NULL on failure
1030  *
1031  * This is a helper function for EAP method implementations. This is usually
1032  * called in the beginning of struct eap_method::process() function to verify
1033  * that the received EAP request packet has a valid header. This function is
1034  * able to process both legacy and expanded EAP headers and in most cases, the
1035  * caller can just use the returned payload pointer (into *plen) for processing
1036  * the payload regardless of whether the packet used the expanded EAP header or
1037  * not.
1038  */
1039 const u8 * eap_hdr_validate(int vendor, EapType eap_type,
1040                             const u8 *msg, size_t msglen, size_t *plen)
1041 {
1042         const struct eap_hdr *hdr;
1043         const u8 *pos;
1044         size_t len;
1045
1046         hdr = (const struct eap_hdr *) msg;
1047
1048         if (msglen < sizeof(*hdr)) {
1049                 wpa_printf(MSG_INFO, "EAP: Too short EAP frame");
1050                 return NULL;
1051         }
1052
1053         len = be_to_host16(hdr->length);
1054         if (len < sizeof(*hdr) + 1 || len > msglen) {
1055                 wpa_printf(MSG_INFO, "EAP: Invalid EAP length");
1056                 return NULL;
1057         }
1058
1059         pos = (const u8 *) (hdr + 1);
1060
1061         if (*pos == EAP_TYPE_EXPANDED) {
1062                 int exp_vendor;
1063                 u32 exp_type;
1064                 if (len < sizeof(*hdr) + 8) {
1065                         wpa_printf(MSG_INFO, "EAP: Invalid expanded EAP "
1066                                    "length");
1067                         return NULL;
1068                 }
1069                 pos++;
1070                 exp_vendor = WPA_GET_BE24(pos);
1071                 pos += 3;
1072                 exp_type = WPA_GET_BE32(pos);
1073                 pos += 4;
1074                 if (exp_vendor != vendor || exp_type != (u32) eap_type) {
1075                         wpa_printf(MSG_INFO, "EAP: Invalid expanded frame "
1076                                    "type");
1077                         return NULL;
1078                 }
1079
1080                 *plen = len - sizeof(*hdr) - 8;
1081                 return pos;
1082         } else {
1083                 if (vendor != EAP_VENDOR_IETF || *pos != eap_type) {
1084                         wpa_printf(MSG_INFO, "EAP: Invalid frame type");
1085                         return NULL;
1086                 }
1087                 *plen = len - sizeof(*hdr) - 1;
1088                 return pos + 1;
1089         }
1090 }
1091
1092
1093 /**
1094  * eap_msg_alloc - Allocate a buffer for an EAP message
1095  * @vendor: Vendor-Id (0 = IETF)
1096  * @type: EAP type
1097  * @len: Buffer for returning message length
1098  * @payload_len: Payload length in bytes (data after Type)
1099  * @code: Message Code (EAP_CODE_*)
1100  * @identifier: Identifier
1101  * @payload: Pointer to payload pointer that will be set to point to the
1102  * beginning of the payload or %NULL if payload pointer is not needed
1103  * Returns: Pointer to the allocated message buffer or %NULL on error
1104  *
1105  * This function can be used to allocate a buffer for an EAP message and fill
1106  * in the EAP header. This function is automatically using expanded EAP header
1107  * if the selected Vendor-Id is not IETF. In other words, most EAP methods do
1108  * not need to separately select which header type to use when using this
1109  * function to allocate the message buffers.
1110  */
1111 struct eap_hdr * eap_msg_alloc(int vendor, EapType type, size_t *len,
1112                                size_t payload_len, u8 code, u8 identifier,
1113                                u8 **payload)
1114 {
1115         struct eap_hdr *hdr;
1116         u8 *pos;
1117
1118         *len = sizeof(struct eap_hdr) + (vendor == EAP_VENDOR_IETF ? 1 : 8) +
1119                 payload_len;
1120         hdr = malloc(*len);
1121         if (hdr) {
1122                 hdr->code = code;
1123                 hdr->identifier = identifier;
1124                 hdr->length = host_to_be16(*len);
1125                 pos = (u8 *) (hdr + 1);
1126                 if (vendor == EAP_VENDOR_IETF) {
1127                         *pos++ = type;
1128                 } else {
1129                         *pos++ = EAP_TYPE_EXPANDED;
1130                         WPA_PUT_BE24(pos, vendor);
1131                         pos += 3;
1132                         WPA_PUT_BE32(pos, type);
1133                         pos += 4;
1134                 }
1135                 if (payload)
1136                         *payload = pos;
1137         }
1138
1139         return hdr;
1140 }