src/eapol_auth/eapol_auth_sm.c

   1 /*
   2  * IEEE 802.1X-2004 Authenticator - EAPOL state machine
   3  * Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "eloop.h"
  19 #include "state_machine.h"
  20 #include "common/eapol_common.h"
  21 #include "eap_common/eap_defs.h"
  22 #include "eap_common/eap_common.h"
  23 #include "eap_server/eap.h"
  24 #include "eapol_auth_sm.h"
  25 #include "eapol_auth_sm_i.h"
  26
  27 #define STATE_MACHINE_DATA struct eapol_state_machine
  28 #define STATE_MACHINE_DEBUG_PREFIX "IEEE 802.1X"
  29 #define STATE_MACHINE_ADDR sm->addr
  30
  31 static struct eapol_callbacks eapol_cb;
  32
  33 /* EAPOL state machines are described in IEEE Std 802.1X-2004, Chap. 8.2 */
  34
  35 #define setPortAuthorized() \
  36 sm->eapol->cb.set_port_authorized(sm->eapol->conf.ctx, sm->sta, 1)
  37 #define setPortUnauthorized() \
  38 sm->eapol->cb.set_port_authorized(sm->eapol->conf.ctx, sm->sta, 0)
  39
  40 /* procedures */
  41 #define txCannedFail() eapol_auth_tx_canned_eap(sm, 0)
  42 #define txCannedSuccess() eapol_auth_tx_canned_eap(sm, 1)
  43 #define txReq() eapol_auth_tx_req(sm)
  44 #define abortAuth() sm->eapol->cb.abort_auth(sm->eapol->conf.ctx, sm->sta)
  45 #define txKey() sm->eapol->cb.tx_key(sm->eapol->conf.ctx, sm->sta)
  46 #define processKey() do { } while (0)
  47
  48
  49 static void eapol_sm_step_run(struct eapol_state_machine *sm);
  50 static void eapol_sm_step_cb(void *eloop_ctx, void *timeout_ctx);
  51 static void eapol_auth_initialize(struct eapol_state_machine *sm);
  52
  53
  54 static void eapol_auth_logger(struct eapol_authenticator *eapol,
  55                               const u8 *addr, eapol_logger_level level,
  56                               const char *txt)
  57 {
  58         if (eapol->cb.logger == NULL)
  59                 return;
  60         eapol->cb.logger(eapol->conf.ctx, addr, level, txt);
  61 }
  62
  63
  64 static void eapol_auth_vlogger(struct eapol_authenticator *eapol,
  65                                const u8 *addr, eapol_logger_level level,
  66                                const char *fmt, ...)
  67 {
  68         char *format;
  69         int maxlen;
  70         va_list ap;
  71
  72         if (eapol->cb.logger == NULL)
  73                 return;
  74
  75         maxlen = os_strlen(fmt) + 100;
  76         format = os_malloc(maxlen);
  77         if (!format)
  78                 return;
  79
  80         va_start(ap, fmt);
  81         vsnprintf(format, maxlen, fmt, ap);
  82         va_end(ap);
  83
  84         eapol_auth_logger(eapol, addr, level, format);
  85
  86         os_free(format);
  87 }
  88
  89
  90 static void eapol_auth_tx_canned_eap(struct eapol_state_machine *sm,
  91                                      int success)
  92 {
  93         struct eap_hdr eap;
  94
  95         os_memset(&eap, 0, sizeof(eap));
  96
  97         eap.code = success ? EAP_CODE_SUCCESS : EAP_CODE_FAILURE;
  98         eap.identifier = ++sm->last_eap_id;
  99         eap.length = host_to_be16(sizeof(eap));
 100
 101         eapol_auth_vlogger(sm->eapol, sm->addr, EAPOL_LOGGER_DEBUG,
 102                            "Sending canned EAP packet %s (identifier %d)",
 103                            success ? "SUCCESS" : "FAILURE", eap.identifier);
 104         sm->eapol->cb.eapol_send(sm->eapol->conf.ctx, sm->sta,
 105                                  IEEE802_1X_TYPE_EAP_PACKET,
 106                                  (u8 *) &eap, sizeof(eap));
 107         sm->dot1xAuthEapolFramesTx++;
 108 }
 109
 110
 111 static void eapol_auth_tx_req(struct eapol_state_machine *sm)
 112 {
 113         if (sm->eap_if->eapReqData == NULL ||
 114             wpabuf_len(sm->eap_if->eapReqData) < sizeof(struct eap_hdr)) {
 115                 eapol_auth_logger(sm->eapol, sm->addr,
 116                                   EAPOL_LOGGER_DEBUG,
 117                                   "TxReq called, but there is no EAP request "
 118                                   "from authentication server");
 119                 return;
 120         }
 121
 122         if (sm->flags & EAPOL_SM_WAIT_START) {
 123                 wpa_printf(MSG_DEBUG, "EAPOL: Drop EAPOL TX to " MACSTR
 124                            " while waiting for EAPOL-Start",
 125                            MAC2STR(sm->addr));
 126                 return;
 127         }
 128
 129         sm->last_eap_id = eap_get_id(sm->eap_if->eapReqData);
 130         eapol_auth_vlogger(sm->eapol, sm->addr, EAPOL_LOGGER_DEBUG,
 131                            "Sending EAP Packet (identifier %d)",
 132                            sm->last_eap_id);
 133         sm->eapol->cb.eapol_send(sm->eapol->conf.ctx, sm->sta,
 134                                  IEEE802_1X_TYPE_EAP_PACKET,
 135                                  wpabuf_head(sm->eap_if->eapReqData),
 136                                  wpabuf_len(sm->eap_if->eapReqData));
 137         sm->dot1xAuthEapolFramesTx++;
 138         if (eap_get_type(sm->eap_if->eapReqData) == EAP_TYPE_IDENTITY)
 139                 sm->dot1xAuthEapolReqIdFramesTx++;
 140         else
 141                 sm->dot1xAuthEapolReqFramesTx++;
 142 }
 143
 144
 145 /**
 146  * eapol_port_timers_tick - Port Timers state machine
 147  * @eloop_ctx: struct eapol_state_machine *
 148  * @timeout_ctx: Not used
 149  *
 150  * This statemachine is implemented as a function that will be called
 151  * once a second as a registered event loop timeout.
 152  */
 153 static void eapol_port_timers_tick(void *eloop_ctx, void *timeout_ctx)
 154 {
 155         struct eapol_state_machine *state = timeout_ctx;
 156
 157         if (state->aWhile > 0) {
 158                 state->aWhile--;
 159                 if (state->aWhile == 0) {
 160                         wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR
 161                                    " - aWhile --> 0",
 162                                    MAC2STR(state->addr));
 163                 }
 164         }
 165
 166         if (state->quietWhile > 0) {
 167                 state->quietWhile--;
 168                 if (state->quietWhile == 0) {
 169                         wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR
 170                                    " - quietWhile --> 0",
 171                                    MAC2STR(state->addr));
 172                 }
 173         }
 174
 175         if (state->reAuthWhen > 0) {
 176                 state->reAuthWhen--;
 177                 if (state->reAuthWhen == 0) {
 178                         wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR
 179                                    " - reAuthWhen --> 0",
 180                                    MAC2STR(state->addr));
 181                 }
 182         }
 183
 184         if (state->eap_if->retransWhile > 0) {
 185                 state->eap_if->retransWhile--;
 186                 if (state->eap_if->retransWhile == 0) {
 187                         wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR
 188                                    " - (EAP) retransWhile --> 0",
 189                                    MAC2STR(state->addr));
 190                 }
 191         }
 192
 193         eapol_sm_step_run(state);
 194
 195         eloop_register_timeout(1, 0, eapol_port_timers_tick, eloop_ctx, state);
 196 }
 197
 198
 199
 200 /* Authenticator PAE state machine */
 201
 202 SM_STATE(AUTH_PAE, INITIALIZE)
 203 {
 204         SM_ENTRY_MA(AUTH_PAE, INITIALIZE, auth_pae);
 205         sm->portMode = Auto;
 206 }
 207
 208
 209 SM_STATE(AUTH_PAE, DISCONNECTED)
 210 {
 211         int from_initialize = sm->auth_pae_state == AUTH_PAE_INITIALIZE;
 212
 213         if (sm->eapolLogoff) {
 214                 if (sm->auth_pae_state == AUTH_PAE_CONNECTING)
 215                         sm->authEapLogoffsWhileConnecting++;
 216                 else if (sm->auth_pae_state == AUTH_PAE_AUTHENTICATED)
 217                         sm->authAuthEapLogoffWhileAuthenticated++;
 218         }
 219
 220         SM_ENTRY_MA(AUTH_PAE, DISCONNECTED, auth_pae);
 221
 222         sm->authPortStatus = Unauthorized;
 223         setPortUnauthorized();
 224         sm->reAuthCount = 0;
 225         sm->eapolLogoff = FALSE;
 226         if (!from_initialize) {
 227                 sm->eapol->cb.finished(sm->eapol->conf.ctx, sm->sta, 0,
 228                                        sm->flags & EAPOL_SM_PREAUTH);
 229         }
 230 }
 231
 232
 233 SM_STATE(AUTH_PAE, RESTART)
 234 {
 235         if (sm->auth_pae_state == AUTH_PAE_AUTHENTICATED) {
 236                 if (sm->reAuthenticate)
 237                         sm->authAuthReauthsWhileAuthenticated++;
 238                 if (sm->eapolStart)
 239                         sm->authAuthEapStartsWhileAuthenticated++;
 240                 if (sm->eapolLogoff)
 241                         sm->authAuthEapLogoffWhileAuthenticated++;
 242         }
 243
 244         SM_ENTRY_MA(AUTH_PAE, RESTART, auth_pae);
 245
 246         sm->eap_if->eapRestart = TRUE;
 247 }
 248
 249
 250 SM_STATE(AUTH_PAE, CONNECTING)
 251 {
 252         if (sm->auth_pae_state != AUTH_PAE_CONNECTING)
 253                 sm->authEntersConnecting++;
 254
 255         SM_ENTRY_MA(AUTH_PAE, CONNECTING, auth_pae);
 256
 257         sm->reAuthenticate = FALSE;
 258         sm->reAuthCount++;
 259 }
 260
 261
 262 SM_STATE(AUTH_PAE, HELD)
 263 {
 264         if (sm->auth_pae_state == AUTH_PAE_AUTHENTICATING && sm->authFail)
 265                 sm->authAuthFailWhileAuthenticating++;
 266
 267         SM_ENTRY_MA(AUTH_PAE, HELD, auth_pae);
 268
 269         sm->authPortStatus = Unauthorized;
 270         setPortUnauthorized();
 271         sm->quietWhile = sm->quietPeriod;
 272         sm->eapolLogoff = FALSE;
 273
 274         eapol_auth_vlogger(sm->eapol, sm->addr, EAPOL_LOGGER_WARNING,
 275                            "authentication failed - EAP type: %d (%s)",
 276                            sm->eap_type_authsrv,
 277                            eap_server_get_name(0, sm->eap_type_authsrv));
 278         if (sm->eap_type_authsrv != sm->eap_type_supp) {
 279                 eapol_auth_vlogger(sm->eapol, sm->addr, EAPOL_LOGGER_INFO,
 280                                    "Supplicant used different EAP type: "
 281                                    "%d (%s)", sm->eap_type_supp,
 282                                    eap_server_get_name(0, sm->eap_type_supp));
 283         }
 284         sm->eapol->cb.finished(sm->eapol->conf.ctx, sm->sta, 0,
 285                                sm->flags & EAPOL_SM_PREAUTH);
 286 }
 287
 288
 289 SM_STATE(AUTH_PAE, AUTHENTICATED)
 290 {
 291         char *extra = "";
 292
 293         if (sm->auth_pae_state == AUTH_PAE_AUTHENTICATING && sm->authSuccess)
 294                 sm->authAuthSuccessesWhileAuthenticating++;
 295
 296         SM_ENTRY_MA(AUTH_PAE, AUTHENTICATED, auth_pae);
 297
 298         sm->authPortStatus = Authorized;
 299         setPortAuthorized();
 300         sm->reAuthCount = 0;
 301         if (sm->flags & EAPOL_SM_PREAUTH)
 302                 extra = " (pre-authentication)";
 303         else if (sm->flags & EAPOL_SM_FROM_PMKSA_CACHE)
 304                 extra = " (PMKSA cache)";
 305         eapol_auth_vlogger(sm->eapol, sm->addr, EAPOL_LOGGER_INFO,
 306                            "authenticated - EAP type: %d (%s)%s",
 307                            sm->eap_type_authsrv,
 308                            eap_server_get_name(0, sm->eap_type_authsrv),
 309                            extra);
 310         sm->eapol->cb.finished(sm->eapol->conf.ctx, sm->sta, 1,
 311                                sm->flags & EAPOL_SM_PREAUTH);
 312 }
 313
 314
 315 SM_STATE(AUTH_PAE, AUTHENTICATING)
 316 {
 317         SM_ENTRY_MA(AUTH_PAE, AUTHENTICATING, auth_pae);
 318
 319         sm->eapolStart = FALSE;
 320         sm->authSuccess = FALSE;
 321         sm->authFail = FALSE;
 322         sm->authTimeout = FALSE;
 323         sm->authStart = TRUE;
 324         sm->keyRun = FALSE;
 325         sm->keyDone = FALSE;
 326 }
 327
 328
 329 SM_STATE(AUTH_PAE, ABORTING)
 330 {
 331         if (sm->auth_pae_state == AUTH_PAE_AUTHENTICATING) {
 332                 if (sm->authTimeout)
 333                         sm->authAuthTimeoutsWhileAuthenticating++;
 334                 if (sm->eapolStart)
 335                         sm->authAuthEapStartsWhileAuthenticating++;
 336                 if (sm->eapolLogoff)
 337                         sm->authAuthEapLogoffWhileAuthenticating++;
 338         }
 339
 340         SM_ENTRY_MA(AUTH_PAE, ABORTING, auth_pae);
 341
 342         sm->authAbort = TRUE;
 343         sm->keyRun = FALSE;
 344         sm->keyDone = FALSE;
 345 }
 346
 347
 348 SM_STATE(AUTH_PAE, FORCE_AUTH)
 349 {
 350         SM_ENTRY_MA(AUTH_PAE, FORCE_AUTH, auth_pae);
 351
 352         sm->authPortStatus = Authorized;
 353         setPortAuthorized();
 354         sm->portMode = ForceAuthorized;
 355         sm->eapolStart = FALSE;
 356         txCannedSuccess();
 357 }
 358
 359
 360 SM_STATE(AUTH_PAE, FORCE_UNAUTH)
 361 {
 362         SM_ENTRY_MA(AUTH_PAE, FORCE_UNAUTH, auth_pae);
 363
 364         sm->authPortStatus = Unauthorized;
 365         setPortUnauthorized();
 366         sm->portMode = ForceUnauthorized;
 367         sm->eapolStart = FALSE;
 368         txCannedFail();
 369 }
 370
 371
 372 SM_STEP(AUTH_PAE)
 373 {
 374         if ((sm->portControl == Auto && sm->portMode != sm->portControl) ||
 375             sm->initialize || !sm->eap_if->portEnabled)
 376                 SM_ENTER_GLOBAL(AUTH_PAE, INITIALIZE);
 377         else if (sm->portControl == ForceAuthorized &&
 378                  sm->portMode != sm->portControl &&
 379                  !(sm->initialize || !sm->eap_if->portEnabled))
 380                 SM_ENTER_GLOBAL(AUTH_PAE, FORCE_AUTH);
 381         else if (sm->portControl == ForceUnauthorized &&
 382                  sm->portMode != sm->portControl &&
 383                  !(sm->initialize || !sm->eap_if->portEnabled))
 384                 SM_ENTER_GLOBAL(AUTH_PAE, FORCE_UNAUTH);
 385         else {
 386                 switch (sm->auth_pae_state) {
 387                 case AUTH_PAE_INITIALIZE:
 388                         SM_ENTER(AUTH_PAE, DISCONNECTED);
 389                         break;
 390                 case AUTH_PAE_DISCONNECTED:
 391                         SM_ENTER(AUTH_PAE, RESTART);
 392                         break;
 393                 case AUTH_PAE_RESTART:
 394                         if (!sm->eap_if->eapRestart)
 395                                 SM_ENTER(AUTH_PAE, CONNECTING);
 396                         break;
 397                 case AUTH_PAE_HELD:
 398                         if (sm->quietWhile == 0)
 399                                 SM_ENTER(AUTH_PAE, RESTART);
 400                         break;
 401                 case AUTH_PAE_CONNECTING:
 402                         if (sm->eapolLogoff || sm->reAuthCount > sm->reAuthMax)
 403                                 SM_ENTER(AUTH_PAE, DISCONNECTED);
 404                         else if ((sm->eap_if->eapReq &&
 405                                   sm->reAuthCount <= sm->reAuthMax) ||
 406                                  sm->eap_if->eapSuccess || sm->eap_if->eapFail)
 407                                 SM_ENTER(AUTH_PAE, AUTHENTICATING);
 408                         break;
 409                 case AUTH_PAE_AUTHENTICATED:
 410                         if (sm->eapolStart || sm->reAuthenticate)
 411                                 SM_ENTER(AUTH_PAE, RESTART);
 412                         else if (sm->eapolLogoff || !sm->portValid)
 413                                 SM_ENTER(AUTH_PAE, DISCONNECTED);
 414                         break;
 415                 case AUTH_PAE_AUTHENTICATING:
 416                         if (sm->authSuccess && sm->portValid)
 417                                 SM_ENTER(AUTH_PAE, AUTHENTICATED);
 418                         else if (sm->authFail ||
 419                                  (sm->keyDone && !sm->portValid))
 420                                 SM_ENTER(AUTH_PAE, HELD);
 421                         else if (sm->eapolStart || sm->eapolLogoff ||
 422                                  sm->authTimeout)
 423                                 SM_ENTER(AUTH_PAE, ABORTING);
 424                         break;
 425                 case AUTH_PAE_ABORTING:
 426                         if (sm->eapolLogoff && !sm->authAbort)
 427                                 SM_ENTER(AUTH_PAE, DISCONNECTED);
 428                         else if (!sm->eapolLogoff && !sm->authAbort)
 429                                 SM_ENTER(AUTH_PAE, RESTART);
 430                         break;
 431                 case AUTH_PAE_FORCE_AUTH:
 432                         if (sm->eapolStart)
 433                                 SM_ENTER(AUTH_PAE, FORCE_AUTH);
 434                         break;
 435                 case AUTH_PAE_FORCE_UNAUTH:
 436                         if (sm->eapolStart)
 437                                 SM_ENTER(AUTH_PAE, FORCE_UNAUTH);
 438                         break;
 439                 }
 440         }
 441 }
 442
 443
 444
 445 /* Backend Authentication state machine */
 446
 447 SM_STATE(BE_AUTH, INITIALIZE)
 448 {
 449         SM_ENTRY_MA(BE_AUTH, INITIALIZE, be_auth);
 450
 451         abortAuth();
 452         sm->eap_if->eapNoReq = FALSE;
 453         sm->authAbort = FALSE;
 454 }
 455
 456
 457 SM_STATE(BE_AUTH, REQUEST)
 458 {
 459         SM_ENTRY_MA(BE_AUTH, REQUEST, be_auth);
 460
 461         txReq();
 462         sm->eap_if->eapReq = FALSE;
 463         sm->backendOtherRequestsToSupplicant++;
 464
 465         /*
 466          * Clearing eapolEap here is not specified in IEEE Std 802.1X-2004, but
 467          * it looks like this would be logical thing to do there since the old
 468          * EAP response would not be valid anymore after the new EAP request
 469          * was sent out.
 470          *
 471          * A race condition has been reported, in which hostapd ended up
 472          * sending out EAP-Response/Identity as a response to the first
 473          * EAP-Request from the main EAP method. This can be avoided by
 474          * clearing eapolEap here.
 475          */
 476         sm->eapolEap = FALSE;
 477 }
 478
 479
 480 SM_STATE(BE_AUTH, RESPONSE)
 481 {
 482         SM_ENTRY_MA(BE_AUTH, RESPONSE, be_auth);
 483
 484         sm->authTimeout = FALSE;
 485         sm->eapolEap = FALSE;
 486         sm->eap_if->eapNoReq = FALSE;
 487         sm->aWhile = sm->serverTimeout;
 488         sm->eap_if->eapResp = TRUE;
 489         /* sendRespToServer(); */
 490         sm->backendResponses++;
 491 }
 492
 493
 494 SM_STATE(BE_AUTH, SUCCESS)
 495 {
 496         SM_ENTRY_MA(BE_AUTH, SUCCESS, be_auth);
 497
 498         txReq();
 499         sm->authSuccess = TRUE;
 500         sm->keyRun = TRUE;
 501 }
 502
 503
 504 SM_STATE(BE_AUTH, FAIL)
 505 {
 506         SM_ENTRY_MA(BE_AUTH, FAIL, be_auth);
 507
 508         txReq();
 509         sm->authFail = TRUE;
 510 }
 511
 512
 513 SM_STATE(BE_AUTH, TIMEOUT)
 514 {
 515         SM_ENTRY_MA(BE_AUTH, TIMEOUT, be_auth);
 516
 517         sm->authTimeout = TRUE;
 518 }
 519
 520
 521 SM_STATE(BE_AUTH, IDLE)
 522 {
 523         SM_ENTRY_MA(BE_AUTH, IDLE, be_auth);
 524
 525         sm->authStart = FALSE;
 526 }
 527
 528
 529 SM_STATE(BE_AUTH, IGNORE)
 530 {
 531         SM_ENTRY_MA(BE_AUTH, IGNORE, be_auth);
 532
 533         sm->eap_if->eapNoReq = FALSE;
 534 }
 535
 536
 537 SM_STEP(BE_AUTH)
 538 {
 539         if (sm->portControl != Auto || sm->initialize || sm->authAbort) {
 540                 SM_ENTER_GLOBAL(BE_AUTH, INITIALIZE);
 541                 return;
 542         }
 543
 544         switch (sm->be_auth_state) {
 545         case BE_AUTH_INITIALIZE:
 546                 SM_ENTER(BE_AUTH, IDLE);
 547                 break;
 548         case BE_AUTH_REQUEST:
 549                 if (sm->eapolEap)
 550                         SM_ENTER(BE_AUTH, RESPONSE);
 551                 else if (sm->eap_if->eapReq)
 552                         SM_ENTER(BE_AUTH, REQUEST);
 553                 else if (sm->eap_if->eapTimeout)
 554                         SM_ENTER(BE_AUTH, TIMEOUT);
 555                 break;
 556         case BE_AUTH_RESPONSE:
 557                 if (sm->eap_if->eapNoReq)
 558                         SM_ENTER(BE_AUTH, IGNORE);
 559                 if (sm->eap_if->eapReq) {
 560                         sm->backendAccessChallenges++;
 561                         SM_ENTER(BE_AUTH, REQUEST);
 562                 } else if (sm->aWhile == 0)
 563                         SM_ENTER(BE_AUTH, TIMEOUT);
 564                 else if (sm->eap_if->eapFail) {
 565                         sm->backendAuthFails++;
 566                         SM_ENTER(BE_AUTH, FAIL);
 567                 } else if (sm->eap_if->eapSuccess) {
 568                         sm->backendAuthSuccesses++;
 569                         SM_ENTER(BE_AUTH, SUCCESS);
 570                 }
 571                 break;
 572         case BE_AUTH_SUCCESS:
 573                 SM_ENTER(BE_AUTH, IDLE);
 574                 break;
 575         case BE_AUTH_FAIL:
 576                 SM_ENTER(BE_AUTH, IDLE);
 577                 break;
 578         case BE_AUTH_TIMEOUT:
 579                 SM_ENTER(BE_AUTH, IDLE);
 580                 break;
 581         case BE_AUTH_IDLE:
 582                 if (sm->eap_if->eapFail && sm->authStart)
 583                         SM_ENTER(BE_AUTH, FAIL);
 584                 else if (sm->eap_if->eapReq && sm->authStart)
 585                         SM_ENTER(BE_AUTH, REQUEST);
 586                 else if (sm->eap_if->eapSuccess && sm->authStart)
 587                         SM_ENTER(BE_AUTH, SUCCESS);
 588                 break;
 589         case BE_AUTH_IGNORE:
 590                 if (sm->eapolEap)
 591                         SM_ENTER(BE_AUTH, RESPONSE);
 592                 else if (sm->eap_if->eapReq)
 593                         SM_ENTER(BE_AUTH, REQUEST);
 594                 else if (sm->eap_if->eapTimeout)
 595                         SM_ENTER(BE_AUTH, TIMEOUT);
 596                 break;
 597         }
 598 }
 599
 600
 601
 602 /* Reauthentication Timer state machine */
 603
 604 SM_STATE(REAUTH_TIMER, INITIALIZE)
 605 {
 606         SM_ENTRY_MA(REAUTH_TIMER, INITIALIZE, reauth_timer);
 607
 608         sm->reAuthWhen = sm->reAuthPeriod;
 609 }
 610
 611
 612 SM_STATE(REAUTH_TIMER, REAUTHENTICATE)
 613 {
 614         SM_ENTRY_MA(REAUTH_TIMER, REAUTHENTICATE, reauth_timer);
 615
 616         sm->reAuthenticate = TRUE;
 617         sm->eapol->cb.eapol_event(sm->eapol->conf.ctx, sm->sta,
 618                                   EAPOL_AUTH_REAUTHENTICATE);
 619 }
 620
 621
 622 SM_STEP(REAUTH_TIMER)
 623 {
 624         if (sm->portControl != Auto || sm->initialize ||
 625             sm->authPortStatus == Unauthorized || !sm->reAuthEnabled) {
 626                 SM_ENTER_GLOBAL(REAUTH_TIMER, INITIALIZE);
 627                 return;
 628         }
 629
 630         switch (sm->reauth_timer_state) {
 631         case REAUTH_TIMER_INITIALIZE:
 632                 if (sm->reAuthWhen == 0)
 633                         SM_ENTER(REAUTH_TIMER, REAUTHENTICATE);
 634                 break;
 635         case REAUTH_TIMER_REAUTHENTICATE:
 636                 SM_ENTER(REAUTH_TIMER, INITIALIZE);
 637                 break;
 638         }
 639 }
 640
 641
 642
 643 /* Authenticator Key Transmit state machine */
 644
 645 SM_STATE(AUTH_KEY_TX, NO_KEY_TRANSMIT)
 646 {
 647         SM_ENTRY_MA(AUTH_KEY_TX, NO_KEY_TRANSMIT, auth_key_tx);
 648 }
 649
 650
 651 SM_STATE(AUTH_KEY_TX, KEY_TRANSMIT)
 652 {
 653         SM_ENTRY_MA(AUTH_KEY_TX, KEY_TRANSMIT, auth_key_tx);
 654
 655         txKey();
 656         sm->eap_if->eapKeyAvailable = FALSE;
 657         sm->keyDone = TRUE;
 658 }
 659
 660
 661 SM_STEP(AUTH_KEY_TX)
 662 {
 663         if (sm->initialize || sm->portControl != Auto) {
 664                 SM_ENTER_GLOBAL(AUTH_KEY_TX, NO_KEY_TRANSMIT);
 665                 return;
 666         }
 667
 668         switch (sm->auth_key_tx_state) {
 669         case AUTH_KEY_TX_NO_KEY_TRANSMIT:
 670                 if (sm->keyTxEnabled && sm->eap_if->eapKeyAvailable &&
 671                     sm->keyRun && !(sm->flags & EAPOL_SM_USES_WPA))
 672                         SM_ENTER(AUTH_KEY_TX, KEY_TRANSMIT);
 673                 break;
 674         case AUTH_KEY_TX_KEY_TRANSMIT:
 675                 if (!sm->keyTxEnabled || !sm->keyRun)
 676                         SM_ENTER(AUTH_KEY_TX, NO_KEY_TRANSMIT);
 677                 else if (sm->eap_if->eapKeyAvailable)
 678                         SM_ENTER(AUTH_KEY_TX, KEY_TRANSMIT);
 679                 break;
 680         }
 681 }
 682
 683
 684
 685 /* Key Receive state machine */
 686
 687 SM_STATE(KEY_RX, NO_KEY_RECEIVE)
 688 {
 689         SM_ENTRY_MA(KEY_RX, NO_KEY_RECEIVE, key_rx);
 690 }
 691
 692
 693 SM_STATE(KEY_RX, KEY_RECEIVE)
 694 {
 695         SM_ENTRY_MA(KEY_RX, KEY_RECEIVE, key_rx);
 696
 697         processKey();
 698         sm->rxKey = FALSE;
 699 }
 700
 701
 702 SM_STEP(KEY_RX)
 703 {
 704         if (sm->initialize || !sm->eap_if->portEnabled) {
 705                 SM_ENTER_GLOBAL(KEY_RX, NO_KEY_RECEIVE);
 706                 return;
 707         }
 708
 709         switch (sm->key_rx_state) {
 710         case KEY_RX_NO_KEY_RECEIVE:
 711                 if (sm->rxKey)
 712                         SM_ENTER(KEY_RX, KEY_RECEIVE);
 713                 break;
 714         case KEY_RX_KEY_RECEIVE:
 715                 if (sm->rxKey)
 716                         SM_ENTER(KEY_RX, KEY_RECEIVE);
 717                 break;
 718         }
 719 }
 720
 721
 722
 723 /* Controlled Directions state machine */
 724
 725 SM_STATE(CTRL_DIR, FORCE_BOTH)
 726 {
 727         SM_ENTRY_MA(CTRL_DIR, FORCE_BOTH, ctrl_dir);
 728         sm->operControlledDirections = Both;
 729 }
 730
 731
 732 SM_STATE(CTRL_DIR, IN_OR_BOTH)
 733 {
 734         SM_ENTRY_MA(CTRL_DIR, IN_OR_BOTH, ctrl_dir);
 735         sm->operControlledDirections = sm->adminControlledDirections;
 736 }
 737
 738
 739 SM_STEP(CTRL_DIR)
 740 {
 741         if (sm->initialize) {
 742                 SM_ENTER_GLOBAL(CTRL_DIR, IN_OR_BOTH);
 743                 return;
 744         }
 745
 746         switch (sm->ctrl_dir_state) {
 747         case CTRL_DIR_FORCE_BOTH:
 748                 if (sm->eap_if->portEnabled && sm->operEdge)
 749                         SM_ENTER(CTRL_DIR, IN_OR_BOTH);
 750                 break;
 751         case CTRL_DIR_IN_OR_BOTH:
 752                 if (sm->operControlledDirections !=
 753                     sm->adminControlledDirections)
 754                         SM_ENTER(CTRL_DIR, IN_OR_BOTH);
 755                 if (!sm->eap_if->portEnabled || !sm->operEdge)
 756                         SM_ENTER(CTRL_DIR, FORCE_BOTH);
 757                 break;
 758         }
 759 }
 760
 761
 762
 763 struct eapol_state_machine *
 764 eapol_auth_alloc(struct eapol_authenticator *eapol, const u8 *addr,
 765                  int flags, const struct wpabuf *assoc_wps_ie, void *sta_ctx)
 766 {
 767         struct eapol_state_machine *sm;
 768         struct eap_config eap_conf;
 769
 770         if (eapol == NULL)
 771                 return NULL;
 772
 773         sm = os_zalloc(sizeof(*sm));
 774         if (sm == NULL) {
 775                 wpa_printf(MSG_DEBUG, "IEEE 802.1X state machine allocation "
 776                            "failed");
 777                 return NULL;
 778         }
 779         sm->radius_identifier = -1;
 780         os_memcpy(sm->addr, addr, ETH_ALEN);
 781         sm->flags = flags;
 782
 783         sm->eapol = eapol;
 784         sm->sta = sta_ctx;
 785
 786         /* Set default values for state machine constants */
 787         sm->auth_pae_state = AUTH_PAE_INITIALIZE;
 788         sm->quietPeriod = AUTH_PAE_DEFAULT_quietPeriod;
 789         sm->reAuthMax = AUTH_PAE_DEFAULT_reAuthMax;
 790
 791         sm->be_auth_state = BE_AUTH_INITIALIZE;
 792         sm->serverTimeout = BE_AUTH_DEFAULT_serverTimeout;
 793
 794         sm->reauth_timer_state = REAUTH_TIMER_INITIALIZE;
 795         sm->reAuthPeriod = eapol->conf.eap_reauth_period;
 796         sm->reAuthEnabled = eapol->conf.eap_reauth_period > 0 ? TRUE : FALSE;
 797
 798         sm->auth_key_tx_state = AUTH_KEY_TX_NO_KEY_TRANSMIT;
 799
 800         sm->key_rx_state = KEY_RX_NO_KEY_RECEIVE;
 801
 802         sm->ctrl_dir_state = CTRL_DIR_IN_OR_BOTH;
 803
 804         sm->portControl = Auto;
 805
 806         if (!eapol->conf.wpa &&
 807             (eapol->default_wep_key || eapol->conf.individual_wep_key_len > 0))
 808                 sm->keyTxEnabled = TRUE;
 809         else
 810                 sm->keyTxEnabled = FALSE;
 811         if (eapol->conf.wpa)
 812                 sm->portValid = FALSE;
 813         else
 814                 sm->portValid = TRUE;
 815
 816         os_memset(&eap_conf, 0, sizeof(eap_conf));
 817         eap_conf.eap_server = eapol->conf.eap_server;
 818         eap_conf.ssl_ctx = eapol->conf.ssl_ctx;
 819         eap_conf.eap_sim_db_priv = eapol->conf.eap_sim_db_priv;
 820         eap_conf.pac_opaque_encr_key = eapol->conf.pac_opaque_encr_key;
 821         eap_conf.eap_fast_a_id = eapol->conf.eap_fast_a_id;
 822         eap_conf.eap_fast_a_id_len = eapol->conf.eap_fast_a_id_len;
 823         eap_conf.eap_fast_a_id_info = eapol->conf.eap_fast_a_id_info;
 824         eap_conf.eap_fast_prov = eapol->conf.eap_fast_prov;
 825         eap_conf.pac_key_lifetime = eapol->conf.pac_key_lifetime;
 826         eap_conf.pac_key_refresh_time = eapol->conf.pac_key_refresh_time;
 827         eap_conf.eap_sim_aka_result_ind = eapol->conf.eap_sim_aka_result_ind;
 828         eap_conf.tnc = eapol->conf.tnc;
 829         eap_conf.wps = eapol->conf.wps;
 830         eap_conf.assoc_wps_ie = assoc_wps_ie;
 831         eap_conf.peer_addr = addr;
 832         sm->eap = eap_server_sm_init(sm, &eapol_cb, &eap_conf);
 833         if (sm->eap == NULL) {
 834                 eapol_auth_free(sm);
 835                 return NULL;
 836         }
 837         sm->eap_if = eap_get_interface(sm->eap);
 838
 839         eapol_auth_initialize(sm);
 840
 841         return sm;
 842 }
 843
 844
 845 void eapol_auth_free(struct eapol_state_machine *sm)
 846 {
 847         if (sm == NULL)
 848                 return;
 849
 850         eloop_cancel_timeout(eapol_port_timers_tick, NULL, sm);
 851         eloop_cancel_timeout(eapol_sm_step_cb, sm, NULL);
 852         if (sm->eap)
 853                 eap_server_sm_deinit(sm->eap);
 854         os_free(sm);
 855 }
 856
 857
 858 static int eapol_sm_sta_entry_alive(struct eapol_authenticator *eapol,
 859                                     const u8 *addr)
 860 {
 861         return eapol->cb.sta_entry_alive(eapol->conf.ctx, addr);
 862 }
 863
 864
 865 static void eapol_sm_step_run(struct eapol_state_machine *sm)
 866 {
 867         struct eapol_authenticator *eapol = sm->eapol;
 868         u8 addr[ETH_ALEN];
 869         unsigned int prev_auth_pae, prev_be_auth, prev_reauth_timer,
 870                 prev_auth_key_tx, prev_key_rx, prev_ctrl_dir;
 871         int max_steps = 100;
 872
 873         os_memcpy(addr, sm->addr, ETH_ALEN);
 874
 875         /*
 876          * Allow EAPOL state machines to run as long as there are state
 877          * changes, but exit and return here through event loop if more than
 878          * 100 steps is needed as a precaution against infinite loops inside
 879          * eloop callback.
 880          */
 881 restart:
 882         prev_auth_pae = sm->auth_pae_state;
 883         prev_be_auth = sm->be_auth_state;
 884         prev_reauth_timer = sm->reauth_timer_state;
 885         prev_auth_key_tx = sm->auth_key_tx_state;
 886         prev_key_rx = sm->key_rx_state;
 887         prev_ctrl_dir = sm->ctrl_dir_state;
 888
 889         SM_STEP_RUN(AUTH_PAE);
 890         if (sm->initializing || eapol_sm_sta_entry_alive(eapol, addr))
 891                 SM_STEP_RUN(BE_AUTH);
 892         if (sm->initializing || eapol_sm_sta_entry_alive(eapol, addr))
 893                 SM_STEP_RUN(REAUTH_TIMER);
 894         if (sm->initializing || eapol_sm_sta_entry_alive(eapol, addr))
 895                 SM_STEP_RUN(AUTH_KEY_TX);
 896         if (sm->initializing || eapol_sm_sta_entry_alive(eapol, addr))
 897                 SM_STEP_RUN(KEY_RX);
 898         if (sm->initializing || eapol_sm_sta_entry_alive(eapol, addr))
 899                 SM_STEP_RUN(CTRL_DIR);
 900
 901         if (prev_auth_pae != sm->auth_pae_state ||
 902             prev_be_auth != sm->be_auth_state ||
 903             prev_reauth_timer != sm->reauth_timer_state ||
 904             prev_auth_key_tx != sm->auth_key_tx_state ||
 905             prev_key_rx != sm->key_rx_state ||
 906             prev_ctrl_dir != sm->ctrl_dir_state) {
 907                 if (--max_steps > 0)
 908                         goto restart;
 909                 /* Re-run from eloop timeout */
 910                 eapol_auth_step(sm);
 911                 return;
 912         }
 913
 914         if (eapol_sm_sta_entry_alive(eapol, addr) && sm->eap) {
 915                 if (eap_server_sm_step(sm->eap)) {
 916                         if (--max_steps > 0)
 917                                 goto restart;
 918                         /* Re-run from eloop timeout */
 919                         eapol_auth_step(sm);
 920                         return;
 921                 }
 922
 923                 /* TODO: find a better location for this */
 924                 if (sm->eap_if->aaaEapResp) {
 925                         sm->eap_if->aaaEapResp = FALSE;
 926                         if (sm->eap_if->aaaEapRespData == NULL) {
 927                                 wpa_printf(MSG_DEBUG, "EAPOL: aaaEapResp set, "
 928                                            "but no aaaEapRespData available");
 929                                 return;
 930                         }
 931                         sm->eapol->cb.aaa_send(
 932                                 sm->eapol->conf.ctx, sm->sta,
 933                                 wpabuf_head(sm->eap_if->aaaEapRespData),
 934                                 wpabuf_len(sm->eap_if->aaaEapRespData));
 935                 }
 936         }
 937
 938         if (eapol_sm_sta_entry_alive(eapol, addr))
 939                 sm->eapol->cb.eapol_event(sm->eapol->conf.ctx, sm->sta,
 940                                           EAPOL_AUTH_SM_CHANGE);
 941 }
 942
 943
 944 static void eapol_sm_step_cb(void *eloop_ctx, void *timeout_ctx)
 945 {
 946         struct eapol_state_machine *sm = eloop_ctx;
 947         eapol_sm_step_run(sm);
 948 }
 949
 950
 951 /**
 952  * eapol_auth_step - Advance EAPOL state machines
 953  * @sm: EAPOL state machine
 954  *
 955  * This function is called to advance EAPOL state machines after any change
 956  * that could affect their state.
 957  */
 958 void eapol_auth_step(struct eapol_state_machine *sm)
 959 {
 960         /*
 961          * Run eapol_sm_step_run from a registered timeout to make sure that
 962          * other possible timeouts/events are processed and to avoid long
 963          * function call chains.
 964          */
 965
 966         eloop_register_timeout(0, 0, eapol_sm_step_cb, sm, NULL);
 967 }
 968
 969
 970 static void eapol_auth_initialize(struct eapol_state_machine *sm)
 971 {
 972         sm->initializing = TRUE;
 973         /* Initialize the state machines by asserting initialize and then
 974          * deasserting it after one step */
 975         sm->initialize = TRUE;
 976         eapol_sm_step_run(sm);
 977         sm->initialize = FALSE;
 978         eapol_sm_step_run(sm);
 979         sm->initializing = FALSE;
 980
 981         /* Start one second tick for port timers state machine */
 982         eloop_cancel_timeout(eapol_port_timers_tick, NULL, sm);
 983         eloop_register_timeout(1, 0, eapol_port_timers_tick, NULL, sm);
 984 }
 985
 986
 987 static int eapol_sm_get_eap_user(void *ctx, const u8 *identity,
 988                                  size_t identity_len, int phase2,
 989                                  struct eap_user *user)
 990 {
 991         struct eapol_state_machine *sm = ctx;
 992         return sm->eapol->cb.get_eap_user(sm->eapol->conf.ctx, identity,
 993                                           identity_len, phase2, user);
 994 }
 995
 996
 997 static const char * eapol_sm_get_eap_req_id_text(void *ctx, size_t *len)
 998 {
 999         struct eapol_state_machine *sm = ctx;
1000         *len = sm->eapol->conf.eap_req_id_text_len;
1001         return sm->eapol->conf.eap_req_id_text;
1002 }
1003
1004
1005 static struct eapol_callbacks eapol_cb =
1006 {
1007         .get_eap_user = eapol_sm_get_eap_user,
1008         .get_eap_req_id_text = eapol_sm_get_eap_req_id_text,
1009 };
1010
1011
1012 int eapol_auth_eap_pending_cb(struct eapol_state_machine *sm, void *ctx)
1013 {
1014         if (sm == NULL || ctx != sm->eap)
1015                 return -1;
1016
1017         eap_sm_pending_cb(sm->eap);
1018         eapol_auth_step(sm);
1019
1020         return 0;
1021 }
1022
1023
1024 static int eapol_auth_conf_clone(struct eapol_auth_config *dst,
1025                                  struct eapol_auth_config *src)
1026 {
1027         dst->ctx = src->ctx;
1028         dst->eap_reauth_period = src->eap_reauth_period;
1029         dst->wpa = src->wpa;
1030         dst->individual_wep_key_len = src->individual_wep_key_len;
1031         dst->eap_server = src->eap_server;
1032         dst->ssl_ctx = src->ssl_ctx;
1033         dst->eap_sim_db_priv = src->eap_sim_db_priv;
1034         os_free(dst->eap_req_id_text);
1035         if (src->eap_req_id_text) {
1036                 dst->eap_req_id_text = os_malloc(src->eap_req_id_text_len);
1037                 if (dst->eap_req_id_text == NULL)
1038                         return -1;
1039                 os_memcpy(dst->eap_req_id_text, src->eap_req_id_text,
1040                           src->eap_req_id_text_len);
1041                 dst->eap_req_id_text_len = src->eap_req_id_text_len;
1042         } else {
1043                 dst->eap_req_id_text = NULL;
1044                 dst->eap_req_id_text_len = 0;
1045         }
1046         if (src->pac_opaque_encr_key) {
1047                 dst->pac_opaque_encr_key = os_malloc(16);
1048                 os_memcpy(dst->pac_opaque_encr_key, src->pac_opaque_encr_key,
1049                           16);
1050         } else
1051                 dst->pac_opaque_encr_key = NULL;
1052         if (src->eap_fast_a_id) {
1053                 dst->eap_fast_a_id = os_malloc(src->eap_fast_a_id_len);
1054                 if (dst->eap_fast_a_id == NULL) {
1055                         os_free(dst->eap_req_id_text);
1056                         return -1;
1057                 }
1058                 os_memcpy(dst->eap_fast_a_id, src->eap_fast_a_id,
1059                           src->eap_fast_a_id_len);
1060                 dst->eap_fast_a_id_len = src->eap_fast_a_id_len;
1061         } else
1062                 dst->eap_fast_a_id = NULL;
1063         if (src->eap_fast_a_id_info) {
1064                 dst->eap_fast_a_id_info = os_strdup(src->eap_fast_a_id_info);
1065                 if (dst->eap_fast_a_id_info == NULL) {
1066                         os_free(dst->eap_req_id_text);
1067                         os_free(dst->eap_fast_a_id);
1068                         return -1;
1069                 }
1070         } else
1071                 dst->eap_fast_a_id_info = NULL;
1072         dst->eap_fast_prov = src->eap_fast_prov;
1073         dst->pac_key_lifetime = src->pac_key_lifetime;
1074         dst->pac_key_refresh_time = src->pac_key_refresh_time;
1075         dst->eap_sim_aka_result_ind = src->eap_sim_aka_result_ind;
1076         dst->tnc = src->tnc;
1077         dst->wps = src->wps;
1078         return 0;
1079 }
1080
1081
1082 static void eapol_auth_conf_free(struct eapol_auth_config *conf)
1083 {
1084         os_free(conf->eap_req_id_text);
1085         conf->eap_req_id_text = NULL;
1086         os_free(conf->pac_opaque_encr_key);
1087         conf->pac_opaque_encr_key = NULL;
1088         os_free(conf->eap_fast_a_id);
1089         conf->eap_fast_a_id = NULL;
1090         os_free(conf->eap_fast_a_id_info);
1091         conf->eap_fast_a_id_info = NULL;
1092 }
1093
1094
1095 struct eapol_authenticator * eapol_auth_init(struct eapol_auth_config *conf,
1096                                              struct eapol_auth_cb *cb)
1097 {
1098         struct eapol_authenticator *eapol;
1099
1100         eapol = os_zalloc(sizeof(*eapol));
1101         if (eapol == NULL)
1102                 return NULL;
1103
1104         if (eapol_auth_conf_clone(&eapol->conf, conf) < 0) {
1105                 os_free(eapol);
1106                 return NULL;
1107         }
1108
1109         if (conf->individual_wep_key_len > 0) {
1110                 /* use key0 in individual key and key1 in broadcast key */
1111                 eapol->default_wep_key_idx = 1;
1112         }
1113
1114         eapol->cb.eapol_send = cb->eapol_send;
1115         eapol->cb.aaa_send = cb->aaa_send;
1116         eapol->cb.finished = cb->finished;
1117         eapol->cb.get_eap_user = cb->get_eap_user;
1118         eapol->cb.sta_entry_alive = cb->sta_entry_alive;
1119         eapol->cb.logger = cb->logger;
1120         eapol->cb.set_port_authorized = cb->set_port_authorized;
1121         eapol->cb.abort_auth = cb->abort_auth;
1122         eapol->cb.tx_key = cb->tx_key;
1123         eapol->cb.eapol_event = cb->eapol_event;
1124
1125         return eapol;
1126 }
1127
1128
1129 void eapol_auth_deinit(struct eapol_authenticator *eapol)
1130 {
1131         if (eapol == NULL)
1132                 return;
1133
1134         eapol_auth_conf_free(&eapol->conf);
1135         os_free(eapol->default_wep_key);
1136         os_free(eapol);
1137 }