1 /* 2 * IEEE 802.1X-2004 Authenticator - EAPOL state machine 3 * Copyright (c) 2002-2015, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 11 #include "common.h" 12 #include "eloop.h" 13 #include "state_machine.h" 14 #include "common/eapol_common.h" 15 #include "eap_common/eap_defs.h" 16 #include "eap_common/eap_common.h" 17 #include "eap_server/eap.h" 18 #include "eapol_auth_sm.h" 19 #include "eapol_auth_sm_i.h" 20 21 #define STATE_MACHINE_DATA struct eapol_state_machine 22 #define STATE_MACHINE_DEBUG_PREFIX "IEEE 802.1X" 23 #define STATE_MACHINE_ADDR sm->addr 24 25 static const struct eapol_callbacks eapol_cb; 26 27 /* EAPOL state machines are described in IEEE Std 802.1X-2004, Chap. 8.2 */ 28 29 #define setPortAuthorized() \ 30 sm->eapol->cb.set_port_authorized(sm->eapol->conf.ctx, sm->sta, 1) 31 #define setPortUnauthorized() \ 32 sm->eapol->cb.set_port_authorized(sm->eapol->conf.ctx, sm->sta, 0) 33 34 /* procedures */ 35 #define txCannedFail() eapol_auth_tx_canned_eap(sm, 0) 36 #define txCannedSuccess() eapol_auth_tx_canned_eap(sm, 1) 37 #define txReq() eapol_auth_tx_req(sm) 38 #define abortAuth() sm->eapol->cb.abort_auth(sm->eapol->conf.ctx, sm->sta) 39 #define txKey() sm->eapol->cb.tx_key(sm->eapol->conf.ctx, sm->sta) 40 #define processKey() do { } while (0) 41 42 43 static void eapol_sm_step_run(struct eapol_state_machine *sm); 44 static void eapol_sm_step_cb(void *eloop_ctx, void *timeout_ctx); 45 static void eapol_auth_initialize(struct eapol_state_machine *sm); 46 static void eapol_auth_conf_free(struct eapol_auth_config *conf); 47 48 49 static void eapol_auth_logger(struct eapol_authenticator *eapol, 50 const u8 *addr, eapol_logger_level level, 51 const char *txt) 52 { 53 if (eapol->cb.logger == NULL) 54 return; 55 eapol->cb.logger(eapol->conf.ctx, addr, level, txt); 56 } 57 58 59 PRINTF_FORMAT(4, 5) 60 static void eapol_auth_vlogger(struct eapol_authenticator *eapol, 61 const u8 *addr, eapol_logger_level level, 62 const char *fmt, ...) 63 { 64 char *format; 65 int maxlen; 66 va_list ap; 67 68 if (eapol->cb.logger == NULL) 69 return; 70 71 maxlen = os_strlen(fmt) + 100; 72 format = os_malloc(maxlen); 73 if (!format) 74 return; 75 76 va_start(ap, fmt); 77 vsnprintf(format, maxlen, fmt, ap); 78 va_end(ap); 79 80 eapol_auth_logger(eapol, addr, level, format); 81 82 os_free(format); 83 } 84 85 86 static void eapol_auth_tx_canned_eap(struct eapol_state_machine *sm, 87 int success) 88 { 89 struct eap_hdr eap; 90 91 os_memset(&eap, 0, sizeof(eap)); 92 93 eap.code = success ? EAP_CODE_SUCCESS : EAP_CODE_FAILURE; 94 eap.identifier = ++sm->last_eap_id; 95 eap.length = host_to_be16(sizeof(eap)); 96 97 eapol_auth_vlogger(sm->eapol, sm->addr, EAPOL_LOGGER_DEBUG, 98 "Sending canned EAP packet %s (identifier %d)", 99 success ? "SUCCESS" : "FAILURE", eap.identifier); 100 sm->eapol->cb.eapol_send(sm->eapol->conf.ctx, sm->sta, 101 IEEE802_1X_TYPE_EAP_PACKET, 102 (u8 *) &eap, sizeof(eap)); 103 sm->dot1xAuthEapolFramesTx++; 104 } 105 106 107 static void eapol_auth_tx_req(struct eapol_state_machine *sm) 108 { 109 if (sm->eap_if->eapReqData == NULL || 110 wpabuf_len(sm->eap_if->eapReqData) < sizeof(struct eap_hdr)) { 111 eapol_auth_logger(sm->eapol, sm->addr, 112 EAPOL_LOGGER_DEBUG, 113 "TxReq called, but there is no EAP request " 114 "from authentication server"); 115 return; 116 } 117 118 if (sm->flags & EAPOL_SM_WAIT_START) { 119 wpa_printf(MSG_DEBUG, "EAPOL: Drop EAPOL TX to " MACSTR 120 " while waiting for EAPOL-Start", 121 MAC2STR(sm->addr)); 122 return; 123 } 124 125 sm->last_eap_id = eap_get_id(sm->eap_if->eapReqData); 126 eapol_auth_vlogger(sm->eapol, sm->addr, EAPOL_LOGGER_DEBUG, 127 "Sending EAP Packet (identifier %d)", 128 sm->last_eap_id); 129 sm->eapol->cb.eapol_send(sm->eapol->conf.ctx, sm->sta, 130 IEEE802_1X_TYPE_EAP_PACKET, 131 wpabuf_head(sm->eap_if->eapReqData), 132 wpabuf_len(sm->eap_if->eapReqData)); 133 sm->dot1xAuthEapolFramesTx++; 134 if (eap_get_type(sm->eap_if->eapReqData) == EAP_TYPE_IDENTITY) 135 sm->dot1xAuthEapolReqIdFramesTx++; 136 else 137 sm->dot1xAuthEapolReqFramesTx++; 138 } 139 140 141 /** 142 * eapol_port_timers_tick - Port Timers state machine 143 * @eloop_ctx: struct eapol_state_machine * 144 * @timeout_ctx: Not used 145 * 146 * This statemachine is implemented as a function that will be called 147 * once a second as a registered event loop timeout. 148 */ 149 static void eapol_port_timers_tick(void *eloop_ctx, void *timeout_ctx) 150 { 151 struct eapol_state_machine *state = timeout_ctx; 152 153 if (state->aWhile > 0) { 154 state->aWhile--; 155 if (state->aWhile == 0) { 156 wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR 157 " - aWhile --> 0", 158 MAC2STR(state->addr)); 159 } 160 } 161 162 if (state->quietWhile > 0) { 163 state->quietWhile--; 164 if (state->quietWhile == 0) { 165 wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR 166 " - quietWhile --> 0", 167 MAC2STR(state->addr)); 168 } 169 } 170 171 if (state->reAuthWhen > 0) { 172 state->reAuthWhen--; 173 if (state->reAuthWhen == 0) { 174 wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR 175 " - reAuthWhen --> 0", 176 MAC2STR(state->addr)); 177 } 178 } 179 180 if (state->eap_if->retransWhile > 0) { 181 state->eap_if->retransWhile--; 182 if (state->eap_if->retransWhile == 0) { 183 wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR 184 " - (EAP) retransWhile --> 0", 185 MAC2STR(state->addr)); 186 } 187 } 188 189 eapol_sm_step_run(state); 190 191 eloop_register_timeout(1, 0, eapol_port_timers_tick, eloop_ctx, state); 192 } 193 194 195 196 /* Authenticator PAE state machine */ 197 198 SM_STATE(AUTH_PAE, INITIALIZE) 199 { 200 SM_ENTRY_MA(AUTH_PAE, INITIALIZE, auth_pae); 201 sm->portMode = Auto; 202 203 /* 204 * Clearing keyRun here is not specified in IEEE Std 802.1X-2004, but 205 * it looks like this would be logical thing to do here since the 206 * EAPOL-Key exchange is not possible in this state. It is possible to 207 * get here on disconnection event without advancing to the 208 * AUTHENTICATING state to clear keyRun before the IEEE 802.11 RSN 209 * authenticator state machine runs and that may advance from 210 * AUTHENTICATION2 to INITPMK if keyRun = true has been left from the 211 * last association. This can be avoided by clearing keyRun here. 212 */ 213 sm->keyRun = false; 214 } 215 216 217 SM_STATE(AUTH_PAE, DISCONNECTED) 218 { 219 int from_initialize = sm->auth_pae_state == AUTH_PAE_INITIALIZE; 220 221 if (sm->eapolLogoff) { 222 if (sm->auth_pae_state == AUTH_PAE_CONNECTING) 223 sm->authEapLogoffsWhileConnecting++; 224 else if (sm->auth_pae_state == AUTH_PAE_AUTHENTICATED) 225 sm->authAuthEapLogoffWhileAuthenticated++; 226 } 227 228 SM_ENTRY_MA(AUTH_PAE, DISCONNECTED, auth_pae); 229 230 sm->authPortStatus = Unauthorized; 231 setPortUnauthorized(); 232 sm->reAuthCount = 0; 233 sm->eapolLogoff = false; 234 if (!from_initialize) { 235 sm->eapol->cb.finished(sm->eapol->conf.ctx, sm->sta, 0, 236 sm->flags & EAPOL_SM_PREAUTH, 237 sm->remediation); 238 } 239 } 240 241 242 SM_STATE(AUTH_PAE, RESTART) 243 { 244 if (sm->auth_pae_state == AUTH_PAE_AUTHENTICATED) { 245 if (sm->reAuthenticate) 246 sm->authAuthReauthsWhileAuthenticated++; 247 if (sm->eapolStart) 248 sm->authAuthEapStartsWhileAuthenticated++; 249 if (sm->eapolLogoff) 250 sm->authAuthEapLogoffWhileAuthenticated++; 251 } 252 253 SM_ENTRY_MA(AUTH_PAE, RESTART, auth_pae); 254 255 sm->eap_if->eapRestart = true; 256 } 257 258 259 SM_STATE(AUTH_PAE, CONNECTING) 260 { 261 if (sm->auth_pae_state != AUTH_PAE_CONNECTING) 262 sm->authEntersConnecting++; 263 264 SM_ENTRY_MA(AUTH_PAE, CONNECTING, auth_pae); 265 266 sm->reAuthenticate = false; 267 sm->reAuthCount++; 268 } 269 270 271 SM_STATE(AUTH_PAE, HELD) 272 { 273 if (sm->auth_pae_state == AUTH_PAE_AUTHENTICATING && sm->authFail) 274 sm->authAuthFailWhileAuthenticating++; 275 276 SM_ENTRY_MA(AUTH_PAE, HELD, auth_pae); 277 278 sm->authPortStatus = Unauthorized; 279 setPortUnauthorized(); 280 sm->quietWhile = sm->quietPeriod; 281 sm->eapolLogoff = false; 282 283 eapol_auth_vlogger(sm->eapol, sm->addr, EAPOL_LOGGER_WARNING, 284 "authentication failed - EAP type: %d (%s)", 285 sm->eap_type_authsrv, 286 eap_server_get_name(0, sm->eap_type_authsrv)); 287 if (sm->eap_type_authsrv != sm->eap_type_supp) { 288 eapol_auth_vlogger(sm->eapol, sm->addr, EAPOL_LOGGER_INFO, 289 "Supplicant used different EAP type: " 290 "%d (%s)", sm->eap_type_supp, 291 eap_server_get_name(0, sm->eap_type_supp)); 292 } 293 sm->eapol->cb.finished(sm->eapol->conf.ctx, sm->sta, 0, 294 sm->flags & EAPOL_SM_PREAUTH, sm->remediation); 295 } 296 297 298 SM_STATE(AUTH_PAE, AUTHENTICATED) 299 { 300 char *extra = ""; 301 302 if (sm->auth_pae_state == AUTH_PAE_AUTHENTICATING && sm->authSuccess) 303 sm->authAuthSuccessesWhileAuthenticating++; 304 305 SM_ENTRY_MA(AUTH_PAE, AUTHENTICATED, auth_pae); 306 307 sm->authPortStatus = Authorized; 308 setPortAuthorized(); 309 sm->reAuthCount = 0; 310 if (sm->flags & EAPOL_SM_PREAUTH) 311 extra = " (pre-authentication)"; 312 else if (sm->flags & EAPOL_SM_FROM_PMKSA_CACHE) 313 extra = " (PMKSA cache)"; 314 eapol_auth_vlogger(sm->eapol, sm->addr, EAPOL_LOGGER_INFO, 315 "authenticated - EAP type: %d (%s)%s", 316 sm->eap_type_authsrv, 317 eap_server_get_name(0, sm->eap_type_authsrv), 318 extra); 319 sm->eapol->cb.finished(sm->eapol->conf.ctx, sm->sta, 1, 320 sm->flags & EAPOL_SM_PREAUTH, sm->remediation); 321 } 322 323 324 SM_STATE(AUTH_PAE, AUTHENTICATING) 325 { 326 SM_ENTRY_MA(AUTH_PAE, AUTHENTICATING, auth_pae); 327 328 sm->eapolStart = false; 329 sm->authSuccess = false; 330 sm->authFail = false; 331 sm->authTimeout = false; 332 sm->authStart = true; 333 sm->keyRun = false; 334 sm->keyDone = false; 335 } 336 337 338 SM_STATE(AUTH_PAE, ABORTING) 339 { 340 if (sm->auth_pae_state == AUTH_PAE_AUTHENTICATING) { 341 if (sm->authTimeout) 342 sm->authAuthTimeoutsWhileAuthenticating++; 343 if (sm->eapolStart) 344 sm->authAuthEapStartsWhileAuthenticating++; 345 if (sm->eapolLogoff) 346 sm->authAuthEapLogoffWhileAuthenticating++; 347 } 348 349 SM_ENTRY_MA(AUTH_PAE, ABORTING, auth_pae); 350 351 sm->authAbort = true; 352 sm->keyRun = false; 353 sm->keyDone = false; 354 } 355 356 357 SM_STATE(AUTH_PAE, FORCE_AUTH) 358 { 359 SM_ENTRY_MA(AUTH_PAE, FORCE_AUTH, auth_pae); 360 361 sm->authPortStatus = Authorized; 362 setPortAuthorized(); 363 sm->portMode = ForceAuthorized; 364 sm->eapolStart = false; 365 txCannedSuccess(); 366 } 367 368 369 SM_STATE(AUTH_PAE, FORCE_UNAUTH) 370 { 371 SM_ENTRY_MA(AUTH_PAE, FORCE_UNAUTH, auth_pae); 372 373 sm->authPortStatus = Unauthorized; 374 setPortUnauthorized(); 375 sm->portMode = ForceUnauthorized; 376 sm->eapolStart = false; 377 txCannedFail(); 378 } 379 380 381 SM_STEP(AUTH_PAE) 382 { 383 if ((sm->portControl == Auto && sm->portMode != sm->portControl) || 384 sm->initialize || !sm->eap_if->portEnabled) 385 SM_ENTER_GLOBAL(AUTH_PAE, INITIALIZE); 386 else if (sm->portControl == ForceAuthorized && 387 sm->portMode != sm->portControl && 388 !(sm->initialize || !sm->eap_if->portEnabled)) 389 SM_ENTER_GLOBAL(AUTH_PAE, FORCE_AUTH); 390 else if (sm->portControl == ForceUnauthorized && 391 sm->portMode != sm->portControl && 392 !(sm->initialize || !sm->eap_if->portEnabled)) 393 SM_ENTER_GLOBAL(AUTH_PAE, FORCE_UNAUTH); 394 else { 395 switch (sm->auth_pae_state) { 396 case AUTH_PAE_INITIALIZE: 397 SM_ENTER(AUTH_PAE, DISCONNECTED); 398 break; 399 case AUTH_PAE_DISCONNECTED: 400 SM_ENTER(AUTH_PAE, RESTART); 401 break; 402 case AUTH_PAE_RESTART: 403 if (!sm->eap_if->eapRestart) 404 SM_ENTER(AUTH_PAE, CONNECTING); 405 break; 406 case AUTH_PAE_HELD: 407 if (sm->quietWhile == 0) 408 SM_ENTER(AUTH_PAE, RESTART); 409 break; 410 case AUTH_PAE_CONNECTING: 411 if (sm->eapolLogoff || sm->reAuthCount > sm->reAuthMax) 412 SM_ENTER(AUTH_PAE, DISCONNECTED); 413 else if ((sm->eap_if->eapReq && 414 sm->reAuthCount <= sm->reAuthMax) || 415 sm->eap_if->eapSuccess || sm->eap_if->eapFail) 416 SM_ENTER(AUTH_PAE, AUTHENTICATING); 417 break; 418 case AUTH_PAE_AUTHENTICATED: 419 if (sm->eapolStart || sm->reAuthenticate) 420 SM_ENTER(AUTH_PAE, RESTART); 421 else if (sm->eapolLogoff || !sm->portValid) 422 SM_ENTER(AUTH_PAE, DISCONNECTED); 423 break; 424 case AUTH_PAE_AUTHENTICATING: 425 if (sm->authSuccess && sm->portValid) 426 SM_ENTER(AUTH_PAE, AUTHENTICATED); 427 else if (sm->authFail || 428 (sm->keyDone && !sm->portValid)) 429 SM_ENTER(AUTH_PAE, HELD); 430 else if (sm->eapolStart || sm->eapolLogoff || 431 sm->authTimeout) 432 SM_ENTER(AUTH_PAE, ABORTING); 433 break; 434 case AUTH_PAE_ABORTING: 435 if (sm->eapolLogoff && !sm->authAbort) 436 SM_ENTER(AUTH_PAE, DISCONNECTED); 437 else if (!sm->eapolLogoff && !sm->authAbort) 438 SM_ENTER(AUTH_PAE, RESTART); 439 break; 440 case AUTH_PAE_FORCE_AUTH: 441 if (sm->eapolStart) 442 SM_ENTER(AUTH_PAE, FORCE_AUTH); 443 break; 444 case AUTH_PAE_FORCE_UNAUTH: 445 if (sm->eapolStart) 446 SM_ENTER(AUTH_PAE, FORCE_UNAUTH); 447 break; 448 } 449 } 450 } 451 452 453 454 /* Backend Authentication state machine */ 455 456 SM_STATE(BE_AUTH, INITIALIZE) 457 { 458 SM_ENTRY_MA(BE_AUTH, INITIALIZE, be_auth); 459 460 abortAuth(); 461 sm->eap_if->eapNoReq = false; 462 sm->authAbort = false; 463 } 464 465 466 SM_STATE(BE_AUTH, REQUEST) 467 { 468 SM_ENTRY_MA(BE_AUTH, REQUEST, be_auth); 469 470 txReq(); 471 sm->eap_if->eapReq = false; 472 sm->backendOtherRequestsToSupplicant++; 473 474 /* 475 * Clearing eapolEap here is not specified in IEEE Std 802.1X-2004, but 476 * it looks like this would be logical thing to do there since the old 477 * EAP response would not be valid anymore after the new EAP request 478 * was sent out. 479 * 480 * A race condition has been reported, in which hostapd ended up 481 * sending out EAP-Response/Identity as a response to the first 482 * EAP-Request from the main EAP method. This can be avoided by 483 * clearing eapolEap here. 484 */ 485 sm->eapolEap = false; 486 } 487 488 489 SM_STATE(BE_AUTH, RESPONSE) 490 { 491 SM_ENTRY_MA(BE_AUTH, RESPONSE, be_auth); 492 493 sm->authTimeout = false; 494 sm->eapolEap = false; 495 sm->eap_if->eapNoReq = false; 496 sm->aWhile = sm->serverTimeout; 497 sm->eap_if->eapResp = true; 498 /* sendRespToServer(); */ 499 sm->backendResponses++; 500 } 501 502 503 SM_STATE(BE_AUTH, SUCCESS) 504 { 505 SM_ENTRY_MA(BE_AUTH, SUCCESS, be_auth); 506 507 txReq(); 508 sm->authSuccess = true; 509 sm->keyRun = true; 510 } 511 512 513 SM_STATE(BE_AUTH, FAIL) 514 { 515 SM_ENTRY_MA(BE_AUTH, FAIL, be_auth); 516 517 txReq(); 518 sm->authFail = true; 519 } 520 521 522 SM_STATE(BE_AUTH, TIMEOUT) 523 { 524 SM_ENTRY_MA(BE_AUTH, TIMEOUT, be_auth); 525 526 sm->authTimeout = true; 527 } 528 529 530 SM_STATE(BE_AUTH, IDLE) 531 { 532 SM_ENTRY_MA(BE_AUTH, IDLE, be_auth); 533 534 sm->authStart = false; 535 } 536 537 538 SM_STATE(BE_AUTH, IGNORE) 539 { 540 SM_ENTRY_MA(BE_AUTH, IGNORE, be_auth); 541 542 sm->eap_if->eapNoReq = false; 543 } 544 545 546 SM_STEP(BE_AUTH) 547 { 548 if (sm->portControl != Auto || sm->initialize || sm->authAbort) { 549 SM_ENTER_GLOBAL(BE_AUTH, INITIALIZE); 550 return; 551 } 552 553 switch (sm->be_auth_state) { 554 case BE_AUTH_INITIALIZE: 555 SM_ENTER(BE_AUTH, IDLE); 556 break; 557 case BE_AUTH_REQUEST: 558 if (sm->eapolEap) 559 SM_ENTER(BE_AUTH, RESPONSE); 560 else if (sm->eap_if->eapReq) 561 SM_ENTER(BE_AUTH, REQUEST); 562 else if (sm->eap_if->eapTimeout) 563 SM_ENTER(BE_AUTH, TIMEOUT); 564 break; 565 case BE_AUTH_RESPONSE: 566 if (sm->eap_if->eapNoReq) 567 SM_ENTER(BE_AUTH, IGNORE); 568 if (sm->eap_if->eapReq) { 569 sm->backendAccessChallenges++; 570 SM_ENTER(BE_AUTH, REQUEST); 571 } else if (sm->aWhile == 0) 572 SM_ENTER(BE_AUTH, TIMEOUT); 573 else if (sm->eap_if->eapFail) { 574 sm->backendAuthFails++; 575 SM_ENTER(BE_AUTH, FAIL); 576 } else if (sm->eap_if->eapSuccess) { 577 sm->backendAuthSuccesses++; 578 SM_ENTER(BE_AUTH, SUCCESS); 579 } 580 break; 581 case BE_AUTH_SUCCESS: 582 SM_ENTER(BE_AUTH, IDLE); 583 break; 584 case BE_AUTH_FAIL: 585 SM_ENTER(BE_AUTH, IDLE); 586 break; 587 case BE_AUTH_TIMEOUT: 588 SM_ENTER(BE_AUTH, IDLE); 589 break; 590 case BE_AUTH_IDLE: 591 if (sm->eap_if->eapFail && sm->authStart) 592 SM_ENTER(BE_AUTH, FAIL); 593 else if (sm->eap_if->eapReq && sm->authStart) 594 SM_ENTER(BE_AUTH, REQUEST); 595 else if (sm->eap_if->eapSuccess && sm->authStart) 596 SM_ENTER(BE_AUTH, SUCCESS); 597 break; 598 case BE_AUTH_IGNORE: 599 if (sm->eapolEap) 600 SM_ENTER(BE_AUTH, RESPONSE); 601 else if (sm->eap_if->eapReq) 602 SM_ENTER(BE_AUTH, REQUEST); 603 else if (sm->eap_if->eapTimeout) 604 SM_ENTER(BE_AUTH, TIMEOUT); 605 break; 606 } 607 } 608 609 610 611 /* Reauthentication Timer state machine */ 612 613 SM_STATE(REAUTH_TIMER, INITIALIZE) 614 { 615 SM_ENTRY_MA(REAUTH_TIMER, INITIALIZE, reauth_timer); 616 617 sm->reAuthWhen = sm->reAuthPeriod; 618 } 619 620 621 SM_STATE(REAUTH_TIMER, REAUTHENTICATE) 622 { 623 SM_ENTRY_MA(REAUTH_TIMER, REAUTHENTICATE, reauth_timer); 624 625 sm->reAuthenticate = true; 626 sm->eapol->cb.eapol_event(sm->eapol->conf.ctx, sm->sta, 627 EAPOL_AUTH_REAUTHENTICATE); 628 } 629 630 631 SM_STEP(REAUTH_TIMER) 632 { 633 if (sm->portControl != Auto || sm->initialize || 634 sm->authPortStatus == Unauthorized || !sm->reAuthEnabled) { 635 SM_ENTER_GLOBAL(REAUTH_TIMER, INITIALIZE); 636 return; 637 } 638 639 switch (sm->reauth_timer_state) { 640 case REAUTH_TIMER_INITIALIZE: 641 if (sm->reAuthWhen == 0) 642 SM_ENTER(REAUTH_TIMER, REAUTHENTICATE); 643 break; 644 case REAUTH_TIMER_REAUTHENTICATE: 645 SM_ENTER(REAUTH_TIMER, INITIALIZE); 646 break; 647 } 648 } 649 650 651 652 #ifdef CONFIG_WEP 653 654 /* Authenticator Key Transmit state machine */ 655 656 SM_STATE(AUTH_KEY_TX, NO_KEY_TRANSMIT) 657 { 658 SM_ENTRY_MA(AUTH_KEY_TX, NO_KEY_TRANSMIT, auth_key_tx); 659 } 660 661 662 SM_STATE(AUTH_KEY_TX, KEY_TRANSMIT) 663 { 664 SM_ENTRY_MA(AUTH_KEY_TX, KEY_TRANSMIT, auth_key_tx); 665 666 txKey(); 667 sm->eap_if->eapKeyAvailable = false; 668 sm->keyDone = true; 669 } 670 671 672 SM_STEP(AUTH_KEY_TX) 673 { 674 if (sm->initialize || sm->portControl != Auto) { 675 SM_ENTER_GLOBAL(AUTH_KEY_TX, NO_KEY_TRANSMIT); 676 return; 677 } 678 679 switch (sm->auth_key_tx_state) { 680 case AUTH_KEY_TX_NO_KEY_TRANSMIT: 681 if (sm->keyTxEnabled && sm->eap_if->eapKeyAvailable && 682 sm->keyRun && !(sm->flags & EAPOL_SM_USES_WPA)) 683 SM_ENTER(AUTH_KEY_TX, KEY_TRANSMIT); 684 break; 685 case AUTH_KEY_TX_KEY_TRANSMIT: 686 if (!sm->keyTxEnabled || !sm->keyRun) 687 SM_ENTER(AUTH_KEY_TX, NO_KEY_TRANSMIT); 688 else if (sm->eap_if->eapKeyAvailable) 689 SM_ENTER(AUTH_KEY_TX, KEY_TRANSMIT); 690 break; 691 } 692 } 693 694 695 696 /* Key Receive state machine */ 697 698 SM_STATE(KEY_RX, NO_KEY_RECEIVE) 699 { 700 SM_ENTRY_MA(KEY_RX, NO_KEY_RECEIVE, key_rx); 701 } 702 703 704 SM_STATE(KEY_RX, KEY_RECEIVE) 705 { 706 SM_ENTRY_MA(KEY_RX, KEY_RECEIVE, key_rx); 707 708 processKey(); 709 sm->rxKey = false; 710 } 711 712 713 SM_STEP(KEY_RX) 714 { 715 if (sm->initialize || !sm->eap_if->portEnabled) { 716 SM_ENTER_GLOBAL(KEY_RX, NO_KEY_RECEIVE); 717 return; 718 } 719 720 switch (sm->key_rx_state) { 721 case KEY_RX_NO_KEY_RECEIVE: 722 if (sm->rxKey) 723 SM_ENTER(KEY_RX, KEY_RECEIVE); 724 break; 725 case KEY_RX_KEY_RECEIVE: 726 if (sm->rxKey) 727 SM_ENTER(KEY_RX, KEY_RECEIVE); 728 break; 729 } 730 } 731 732 #endif /* CONFIG_WEP */ 733 734 735 736 /* Controlled Directions state machine */ 737 738 SM_STATE(CTRL_DIR, FORCE_BOTH) 739 { 740 SM_ENTRY_MA(CTRL_DIR, FORCE_BOTH, ctrl_dir); 741 sm->operControlledDirections = Both; 742 } 743 744 745 SM_STATE(CTRL_DIR, IN_OR_BOTH) 746 { 747 SM_ENTRY_MA(CTRL_DIR, IN_OR_BOTH, ctrl_dir); 748 sm->operControlledDirections = sm->adminControlledDirections; 749 } 750 751 752 SM_STEP(CTRL_DIR) 753 { 754 if (sm->initialize) { 755 SM_ENTER_GLOBAL(CTRL_DIR, IN_OR_BOTH); 756 return; 757 } 758 759 switch (sm->ctrl_dir_state) { 760 case CTRL_DIR_FORCE_BOTH: 761 if (sm->eap_if->portEnabled && sm->operEdge) 762 SM_ENTER(CTRL_DIR, IN_OR_BOTH); 763 break; 764 case CTRL_DIR_IN_OR_BOTH: 765 if (sm->operControlledDirections != 766 sm->adminControlledDirections) 767 SM_ENTER(CTRL_DIR, IN_OR_BOTH); 768 if (!sm->eap_if->portEnabled || !sm->operEdge) 769 SM_ENTER(CTRL_DIR, FORCE_BOTH); 770 break; 771 } 772 } 773 774 775 776 struct eapol_state_machine * 777 eapol_auth_alloc(struct eapol_authenticator *eapol, const u8 *addr, 778 int flags, const struct wpabuf *assoc_wps_ie, 779 const struct wpabuf *assoc_p2p_ie, void *sta_ctx, 780 const char *identity, const char *radius_cui) 781 { 782 struct eapol_state_machine *sm; 783 struct eap_session_data eap_sess; 784 785 if (eapol == NULL) 786 return NULL; 787 788 sm = os_zalloc(sizeof(*sm)); 789 if (sm == NULL) { 790 wpa_printf(MSG_DEBUG, "IEEE 802.1X state machine allocation " 791 "failed"); 792 return NULL; 793 } 794 sm->radius_identifier = -1; 795 os_memcpy(sm->addr, addr, ETH_ALEN); 796 sm->flags = flags; 797 798 sm->eapol = eapol; 799 sm->sta = sta_ctx; 800 801 /* Set default values for state machine constants */ 802 sm->auth_pae_state = AUTH_PAE_INITIALIZE; 803 sm->quietPeriod = AUTH_PAE_DEFAULT_quietPeriod; 804 sm->reAuthMax = AUTH_PAE_DEFAULT_reAuthMax; 805 806 sm->be_auth_state = BE_AUTH_INITIALIZE; 807 sm->serverTimeout = BE_AUTH_DEFAULT_serverTimeout; 808 809 sm->reauth_timer_state = REAUTH_TIMER_INITIALIZE; 810 sm->reAuthPeriod = eapol->conf.eap_reauth_period; 811 sm->reAuthEnabled = eapol->conf.eap_reauth_period > 0; 812 813 sm->auth_key_tx_state = AUTH_KEY_TX_NO_KEY_TRANSMIT; 814 815 sm->key_rx_state = KEY_RX_NO_KEY_RECEIVE; 816 817 sm->ctrl_dir_state = CTRL_DIR_IN_OR_BOTH; 818 819 sm->portControl = Auto; 820 821 #ifdef CONFIG_WEP 822 if (!eapol->conf.wpa && 823 (eapol->default_wep_key || eapol->conf.individual_wep_key_len > 0)) 824 sm->keyTxEnabled = true; 825 else 826 #endif /* CONFIG_WEP */ 827 sm->keyTxEnabled = false; 828 if (eapol->conf.wpa) 829 sm->portValid = false; 830 else 831 sm->portValid = true; 832 833 os_memset(&eap_sess, 0, sizeof(eap_sess)); 834 eap_sess.assoc_wps_ie = assoc_wps_ie; 835 eap_sess.assoc_p2p_ie = assoc_p2p_ie; 836 eap_sess.peer_addr = addr; 837 sm->eap = eap_server_sm_init(sm, &eapol_cb, eapol->conf.eap_cfg, 838 &eap_sess); 839 if (sm->eap == NULL) { 840 eapol_auth_free(sm); 841 return NULL; 842 } 843 sm->eap_if = eap_get_interface(sm->eap); 844 845 eapol_auth_initialize(sm); 846 847 if (identity) { 848 sm->identity = (u8 *) os_strdup(identity); 849 if (sm->identity) 850 sm->identity_len = os_strlen(identity); 851 } 852 if (radius_cui) 853 sm->radius_cui = wpabuf_alloc_copy(radius_cui, 854 os_strlen(radius_cui)); 855 856 #ifndef CONFIG_NO_RADIUS 857 if (radius_gen_session_id((u8 *) &sm->acct_multi_session_id, 858 sizeof(sm->acct_multi_session_id)) < 0) { 859 eapol_auth_free(sm); 860 return NULL; 861 } 862 #endif /* CONFIG_NO_RADIUS */ 863 864 return sm; 865 } 866 867 868 void eapol_auth_free(struct eapol_state_machine *sm) 869 { 870 if (sm == NULL) 871 return; 872 873 eloop_cancel_timeout(eapol_port_timers_tick, NULL, sm); 874 eloop_cancel_timeout(eapol_sm_step_cb, sm, NULL); 875 if (sm->eap) 876 eap_server_sm_deinit(sm->eap); 877 878 wpabuf_free(sm->radius_cui); 879 os_free(sm->identity); 880 os_free(sm); 881 } 882 883 884 static int eapol_sm_sta_entry_alive(struct eapol_authenticator *eapol, 885 const u8 *addr) 886 { 887 return eapol->cb.sta_entry_alive(eapol->conf.ctx, addr); 888 } 889 890 891 static void eapol_sm_step_run(struct eapol_state_machine *sm) 892 { 893 struct eapol_authenticator *eapol = sm->eapol; 894 u8 addr[ETH_ALEN]; 895 unsigned int prev_auth_pae, prev_be_auth, prev_reauth_timer, 896 prev_auth_key_tx, prev_key_rx, prev_ctrl_dir; 897 int max_steps = 100; 898 899 os_memcpy(addr, sm->addr, ETH_ALEN); 900 901 /* 902 * Allow EAPOL state machines to run as long as there are state 903 * changes, but exit and return here through event loop if more than 904 * 100 steps is needed as a precaution against infinite loops inside 905 * eloop callback. 906 */ 907 restart: 908 prev_auth_pae = sm->auth_pae_state; 909 prev_be_auth = sm->be_auth_state; 910 prev_reauth_timer = sm->reauth_timer_state; 911 prev_auth_key_tx = sm->auth_key_tx_state; 912 prev_key_rx = sm->key_rx_state; 913 prev_ctrl_dir = sm->ctrl_dir_state; 914 915 SM_STEP_RUN(AUTH_PAE); 916 if (sm->initializing || eapol_sm_sta_entry_alive(eapol, addr)) 917 SM_STEP_RUN(BE_AUTH); 918 if (sm->initializing || eapol_sm_sta_entry_alive(eapol, addr)) 919 SM_STEP_RUN(REAUTH_TIMER); 920 #ifdef CONFIG_WEP 921 if (sm->initializing || eapol_sm_sta_entry_alive(eapol, addr)) 922 SM_STEP_RUN(AUTH_KEY_TX); 923 if (sm->initializing || eapol_sm_sta_entry_alive(eapol, addr)) 924 SM_STEP_RUN(KEY_RX); 925 #endif /* CONFIG_WEP */ 926 if (sm->initializing || eapol_sm_sta_entry_alive(eapol, addr)) 927 SM_STEP_RUN(CTRL_DIR); 928 929 if (prev_auth_pae != sm->auth_pae_state || 930 prev_be_auth != sm->be_auth_state || 931 prev_reauth_timer != sm->reauth_timer_state || 932 prev_auth_key_tx != sm->auth_key_tx_state || 933 prev_key_rx != sm->key_rx_state || 934 prev_ctrl_dir != sm->ctrl_dir_state) { 935 if (--max_steps > 0) 936 goto restart; 937 /* Re-run from eloop timeout */ 938 eapol_auth_step(sm); 939 return; 940 } 941 942 if (eapol_sm_sta_entry_alive(eapol, addr) && sm->eap) { 943 if (eap_server_sm_step(sm->eap)) { 944 if (--max_steps > 0) 945 goto restart; 946 /* Re-run from eloop timeout */ 947 eapol_auth_step(sm); 948 return; 949 } 950 951 /* TODO: find a better location for this */ 952 if (sm->eap_if->aaaEapResp) { 953 sm->eap_if->aaaEapResp = false; 954 if (sm->eap_if->aaaEapRespData == NULL) { 955 wpa_printf(MSG_DEBUG, "EAPOL: aaaEapResp set, " 956 "but no aaaEapRespData available"); 957 return; 958 } 959 sm->eapol->cb.aaa_send( 960 sm->eapol->conf.ctx, sm->sta, 961 wpabuf_head(sm->eap_if->aaaEapRespData), 962 wpabuf_len(sm->eap_if->aaaEapRespData)); 963 } 964 } 965 966 if (eapol_sm_sta_entry_alive(eapol, addr)) 967 sm->eapol->cb.eapol_event(sm->eapol->conf.ctx, sm->sta, 968 EAPOL_AUTH_SM_CHANGE); 969 } 970 971 972 static void eapol_sm_step_cb(void *eloop_ctx, void *timeout_ctx) 973 { 974 struct eapol_state_machine *sm = eloop_ctx; 975 eapol_sm_step_run(sm); 976 } 977 978 979 /** 980 * eapol_auth_step - Advance EAPOL state machines 981 * @sm: EAPOL state machine 982 * 983 * This function is called to advance EAPOL state machines after any change 984 * that could affect their state. 985 */ 986 void eapol_auth_step(struct eapol_state_machine *sm) 987 { 988 /* 989 * Run eapol_sm_step_run from a registered timeout to make sure that 990 * other possible timeouts/events are processed and to avoid long 991 * function call chains. 992 */ 993 994 eloop_register_timeout(0, 0, eapol_sm_step_cb, sm, NULL); 995 } 996 997 998 static void eapol_auth_initialize(struct eapol_state_machine *sm) 999 { 1000 sm->initializing = true; 1001 /* Initialize the state machines by asserting initialize and then 1002 * deasserting it after one step */ 1003 sm->initialize = true; 1004 eapol_sm_step_run(sm); 1005 sm->initialize = false; 1006 eapol_sm_step_run(sm); 1007 sm->initializing = false; 1008 1009 /* Start one second tick for port timers state machine */ 1010 eloop_cancel_timeout(eapol_port_timers_tick, NULL, sm); 1011 eloop_register_timeout(1, 0, eapol_port_timers_tick, NULL, sm); 1012 } 1013 1014 1015 static int eapol_sm_get_eap_user(void *ctx, const u8 *identity, 1016 size_t identity_len, int phase2, 1017 struct eap_user *user) 1018 { 1019 struct eapol_state_machine *sm = ctx; 1020 int ret; 1021 1022 ret = sm->eapol->cb.get_eap_user(sm->eapol->conf.ctx, identity, 1023 identity_len, phase2, user); 1024 if (user->remediation) 1025 sm->remediation = 1; 1026 return ret; 1027 } 1028 1029 1030 static const char * eapol_sm_get_eap_req_id_text(void *ctx, size_t *len) 1031 { 1032 struct eapol_state_machine *sm = ctx; 1033 *len = sm->eapol->conf.eap_req_id_text_len; 1034 return sm->eapol->conf.eap_req_id_text; 1035 } 1036 1037 1038 static int eapol_sm_get_erp_send_reauth_start(void *ctx) 1039 { 1040 struct eapol_state_machine *sm = ctx; 1041 return sm->eapol->conf.erp_send_reauth_start; 1042 } 1043 1044 1045 static const char * eapol_sm_get_erp_domain(void *ctx) 1046 { 1047 struct eapol_state_machine *sm = ctx; 1048 return sm->eapol->conf.erp_domain; 1049 } 1050 1051 1052 static struct eap_server_erp_key * eapol_sm_erp_get_key(void *ctx, 1053 const char *keyname) 1054 { 1055 struct eapol_state_machine *sm = ctx; 1056 return sm->eapol->cb.erp_get_key(sm->eapol->conf.ctx, keyname); 1057 } 1058 1059 1060 static int eapol_sm_erp_add_key(void *ctx, struct eap_server_erp_key *erp) 1061 { 1062 struct eapol_state_machine *sm = ctx; 1063 return sm->eapol->cb.erp_add_key(sm->eapol->conf.ctx, erp); 1064 } 1065 1066 1067 static const struct eapol_callbacks eapol_cb = 1068 { 1069 eapol_sm_get_eap_user, 1070 eapol_sm_get_eap_req_id_text, 1071 NULL, 1072 eapol_sm_get_erp_send_reauth_start, 1073 eapol_sm_get_erp_domain, 1074 eapol_sm_erp_get_key, 1075 eapol_sm_erp_add_key, 1076 }; 1077 1078 1079 int eapol_auth_eap_pending_cb(struct eapol_state_machine *sm, void *ctx) 1080 { 1081 if (sm == NULL || ctx == NULL || ctx != sm->eap) 1082 return -1; 1083 1084 eap_sm_pending_cb(sm->eap); 1085 eapol_auth_step(sm); 1086 1087 return 0; 1088 } 1089 1090 1091 void eapol_auth_reauthenticate(struct eapol_state_machine *sm) 1092 { 1093 wpa_printf(MSG_DEBUG, "EAPOL: External reauthentication trigger for " 1094 MACSTR, MAC2STR(sm->addr)); 1095 sm->reAuthenticate = true; 1096 eapol_auth_step(sm); 1097 } 1098 1099 1100 int eapol_auth_set_conf(struct eapol_state_machine *sm, const char *param, 1101 const char *value) 1102 { 1103 wpa_printf(MSG_DEBUG, "EAPOL: External configuration operation for " 1104 MACSTR " - param=%s value=%s", 1105 MAC2STR(sm->addr), param, value); 1106 1107 if (os_strcasecmp(param, "AdminControlledDirections") == 0) { 1108 if (os_strcmp(value, "Both") == 0) 1109 sm->adminControlledDirections = Both; 1110 else if (os_strcmp(value, "In") == 0) 1111 sm->adminControlledDirections = In; 1112 else 1113 return -1; 1114 eapol_auth_step(sm); 1115 return 0; 1116 } 1117 1118 if (os_strcasecmp(param, "AdminControlledPortControl") == 0) { 1119 if (os_strcmp(value, "ForceAuthorized") == 0) 1120 sm->portControl = ForceAuthorized; 1121 else if (os_strcmp(value, "ForceUnauthorized") == 0) 1122 sm->portControl = ForceUnauthorized; 1123 else if (os_strcmp(value, "Auto") == 0) 1124 sm->portControl = Auto; 1125 else 1126 return -1; 1127 eapol_auth_step(sm); 1128 return 0; 1129 } 1130 1131 if (os_strcasecmp(param, "quietPeriod") == 0) { 1132 sm->quietPeriod = atoi(value); 1133 return 0; 1134 } 1135 1136 if (os_strcasecmp(param, "serverTimeout") == 0) { 1137 sm->serverTimeout = atoi(value); 1138 return 0; 1139 } 1140 1141 if (os_strcasecmp(param, "reAuthPeriod") == 0) { 1142 sm->reAuthPeriod = atoi(value); 1143 return 0; 1144 } 1145 1146 if (os_strcasecmp(param, "reAuthEnabled") == 0) { 1147 if (os_strcmp(value, "TRUE") == 0) 1148 sm->reAuthEnabled = true; 1149 else if (os_strcmp(value, "FALSE") == 0) 1150 sm->reAuthEnabled = false; 1151 else 1152 return -1; 1153 eapol_auth_step(sm); 1154 return 0; 1155 } 1156 1157 if (os_strcasecmp(param, "KeyTransmissionEnabled") == 0) { 1158 if (os_strcmp(value, "TRUE") == 0) 1159 sm->keyTxEnabled = true; 1160 else if (os_strcmp(value, "FALSE") == 0) 1161 sm->keyTxEnabled = false; 1162 else 1163 return -1; 1164 eapol_auth_step(sm); 1165 return 0; 1166 } 1167 1168 return -1; 1169 } 1170 1171 1172 static int eapol_auth_conf_clone(struct eapol_auth_config *dst, 1173 struct eapol_auth_config *src) 1174 { 1175 dst->eap_cfg = src->eap_cfg; 1176 dst->ctx = src->ctx; 1177 dst->eap_reauth_period = src->eap_reauth_period; 1178 dst->wpa = src->wpa; 1179 #ifdef CONFIG_WEP 1180 dst->individual_wep_key_len = src->individual_wep_key_len; 1181 #endif /* CONFIG_WEP */ 1182 os_free(dst->eap_req_id_text); 1183 if (src->eap_req_id_text) { 1184 dst->eap_req_id_text = os_memdup(src->eap_req_id_text, 1185 src->eap_req_id_text_len); 1186 if (dst->eap_req_id_text == NULL) 1187 return -1; 1188 dst->eap_req_id_text_len = src->eap_req_id_text_len; 1189 } else { 1190 dst->eap_req_id_text = NULL; 1191 dst->eap_req_id_text_len = 0; 1192 } 1193 1194 os_free(dst->erp_domain); 1195 if (src->erp_domain) { 1196 dst->erp_domain = os_strdup(src->erp_domain); 1197 if (dst->erp_domain == NULL) 1198 goto fail; 1199 } else { 1200 dst->erp_domain = NULL; 1201 } 1202 dst->erp_send_reauth_start = src->erp_send_reauth_start; 1203 1204 return 0; 1205 1206 fail: 1207 eapol_auth_conf_free(dst); 1208 return -1; 1209 } 1210 1211 1212 static void eapol_auth_conf_free(struct eapol_auth_config *conf) 1213 { 1214 os_free(conf->eap_req_id_text); 1215 conf->eap_req_id_text = NULL; 1216 os_free(conf->erp_domain); 1217 conf->erp_domain = NULL; 1218 } 1219 1220 1221 struct eapol_authenticator * eapol_auth_init(struct eapol_auth_config *conf, 1222 struct eapol_auth_cb *cb) 1223 { 1224 struct eapol_authenticator *eapol; 1225 1226 eapol = os_zalloc(sizeof(*eapol)); 1227 if (eapol == NULL) 1228 return NULL; 1229 1230 if (eapol_auth_conf_clone(&eapol->conf, conf) < 0) { 1231 os_free(eapol); 1232 return NULL; 1233 } 1234 1235 #ifdef CONFIG_WEP 1236 if (conf->individual_wep_key_len > 0) { 1237 /* use key0 in individual key and key1 in broadcast key */ 1238 eapol->default_wep_key_idx = 1; 1239 } 1240 #endif /* CONFIG_WEP */ 1241 1242 eapol->cb.eapol_send = cb->eapol_send; 1243 eapol->cb.aaa_send = cb->aaa_send; 1244 eapol->cb.finished = cb->finished; 1245 eapol->cb.get_eap_user = cb->get_eap_user; 1246 eapol->cb.sta_entry_alive = cb->sta_entry_alive; 1247 eapol->cb.logger = cb->logger; 1248 eapol->cb.set_port_authorized = cb->set_port_authorized; 1249 eapol->cb.abort_auth = cb->abort_auth; 1250 eapol->cb.tx_key = cb->tx_key; 1251 eapol->cb.eapol_event = cb->eapol_event; 1252 eapol->cb.erp_get_key = cb->erp_get_key; 1253 eapol->cb.erp_add_key = cb->erp_add_key; 1254 1255 return eapol; 1256 } 1257 1258 1259 void eapol_auth_deinit(struct eapol_authenticator *eapol) 1260 { 1261 if (eapol == NULL) 1262 return; 1263 1264 eapol_auth_conf_free(&eapol->conf); 1265 #ifdef CONFIG_WEP 1266 os_free(eapol->default_wep_key); 1267 #endif /* CONFIG_WEP */ 1268 os_free(eapol); 1269 } 1270