xref: /freebsd/contrib/wpa/src/eapol_supp/eapol_supp_sm.c (revision d8a0fe102c0cfdfcd5b818f850eff09d8536c9bc)
1 /*
2  * EAPOL supplicant state machines
3  * Copyright (c) 2004-2012, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "includes.h"
10 
11 #include "common.h"
12 #include "state_machine.h"
13 #include "wpabuf.h"
14 #include "eloop.h"
15 #include "crypto/crypto.h"
16 #include "crypto/md5.h"
17 #include "common/eapol_common.h"
18 #include "eap_peer/eap.h"
19 #include "eap_peer/eap_proxy.h"
20 #include "eapol_supp_sm.h"
21 
22 #define STATE_MACHINE_DATA struct eapol_sm
23 #define STATE_MACHINE_DEBUG_PREFIX "EAPOL"
24 
25 
26 /* IEEE 802.1X-2004 - Supplicant - EAPOL state machines */
27 
28 /**
29  * struct eapol_sm - Internal data for EAPOL state machines
30  */
31 struct eapol_sm {
32 	/* Timers */
33 	unsigned int authWhile;
34 	unsigned int heldWhile;
35 	unsigned int startWhen;
36 	unsigned int idleWhile; /* for EAP state machine */
37 	int timer_tick_enabled;
38 
39 	/* Global variables */
40 	Boolean eapFail;
41 	Boolean eapolEap;
42 	Boolean eapSuccess;
43 	Boolean initialize;
44 	Boolean keyDone;
45 	Boolean keyRun;
46 	PortControl portControl;
47 	Boolean portEnabled;
48 	PortStatus suppPortStatus;  /* dot1xSuppControlledPortStatus */
49 	Boolean portValid;
50 	Boolean suppAbort;
51 	Boolean suppFail;
52 	Boolean suppStart;
53 	Boolean suppSuccess;
54 	Boolean suppTimeout;
55 
56 	/* Supplicant PAE state machine */
57 	enum {
58 		SUPP_PAE_UNKNOWN = 0,
59 		SUPP_PAE_DISCONNECTED = 1,
60 		SUPP_PAE_LOGOFF = 2,
61 		SUPP_PAE_CONNECTING = 3,
62 		SUPP_PAE_AUTHENTICATING = 4,
63 		SUPP_PAE_AUTHENTICATED = 5,
64 		/* unused(6) */
65 		SUPP_PAE_HELD = 7,
66 		SUPP_PAE_RESTART = 8,
67 		SUPP_PAE_S_FORCE_AUTH = 9,
68 		SUPP_PAE_S_FORCE_UNAUTH = 10
69 	} SUPP_PAE_state; /* dot1xSuppPaeState */
70 	/* Variables */
71 	Boolean userLogoff;
72 	Boolean logoffSent;
73 	unsigned int startCount;
74 	Boolean eapRestart;
75 	PortControl sPortMode;
76 	/* Constants */
77 	unsigned int heldPeriod; /* dot1xSuppHeldPeriod */
78 	unsigned int startPeriod; /* dot1xSuppStartPeriod */
79 	unsigned int maxStart; /* dot1xSuppMaxStart */
80 
81 	/* Key Receive state machine */
82 	enum {
83 		KEY_RX_UNKNOWN = 0,
84 		KEY_RX_NO_KEY_RECEIVE, KEY_RX_KEY_RECEIVE
85 	} KEY_RX_state;
86 	/* Variables */
87 	Boolean rxKey;
88 
89 	/* Supplicant Backend state machine */
90 	enum {
91 		SUPP_BE_UNKNOWN = 0,
92 		SUPP_BE_INITIALIZE = 1,
93 		SUPP_BE_IDLE = 2,
94 		SUPP_BE_REQUEST = 3,
95 		SUPP_BE_RECEIVE = 4,
96 		SUPP_BE_RESPONSE = 5,
97 		SUPP_BE_FAIL = 6,
98 		SUPP_BE_TIMEOUT = 7,
99 		SUPP_BE_SUCCESS = 8
100 	} SUPP_BE_state; /* dot1xSuppBackendPaeState */
101 	/* Variables */
102 	Boolean eapNoResp;
103 	Boolean eapReq;
104 	Boolean eapResp;
105 	/* Constants */
106 	unsigned int authPeriod; /* dot1xSuppAuthPeriod */
107 
108 	/* Statistics */
109 	unsigned int dot1xSuppEapolFramesRx;
110 	unsigned int dot1xSuppEapolFramesTx;
111 	unsigned int dot1xSuppEapolStartFramesTx;
112 	unsigned int dot1xSuppEapolLogoffFramesTx;
113 	unsigned int dot1xSuppEapolRespFramesTx;
114 	unsigned int dot1xSuppEapolReqIdFramesRx;
115 	unsigned int dot1xSuppEapolReqFramesRx;
116 	unsigned int dot1xSuppInvalidEapolFramesRx;
117 	unsigned int dot1xSuppEapLengthErrorFramesRx;
118 	unsigned int dot1xSuppLastEapolFrameVersion;
119 	unsigned char dot1xSuppLastEapolFrameSource[6];
120 
121 	/* Miscellaneous variables (not defined in IEEE 802.1X-2004) */
122 	Boolean changed;
123 	struct eap_sm *eap;
124 	struct eap_peer_config *config;
125 	Boolean initial_req;
126 	u8 *last_rx_key;
127 	size_t last_rx_key_len;
128 	struct wpabuf *eapReqData; /* for EAP */
129 	Boolean altAccept; /* for EAP */
130 	Boolean altReject; /* for EAP */
131 	Boolean eapTriggerStart;
132 	Boolean replay_counter_valid;
133 	u8 last_replay_counter[16];
134 	struct eapol_config conf;
135 	struct eapol_ctx *ctx;
136 	enum { EAPOL_CB_IN_PROGRESS = 0, EAPOL_CB_SUCCESS, EAPOL_CB_FAILURE }
137 		cb_status;
138 	Boolean cached_pmk;
139 
140 	Boolean unicast_key_received, broadcast_key_received;
141 
142 	Boolean force_authorized_update;
143 
144 #ifdef CONFIG_EAP_PROXY
145 	Boolean use_eap_proxy;
146 	struct eap_proxy_sm *eap_proxy;
147 #endif /* CONFIG_EAP_PROXY */
148 };
149 
150 
151 static void eapol_sm_txLogoff(struct eapol_sm *sm);
152 static void eapol_sm_txStart(struct eapol_sm *sm);
153 static void eapol_sm_processKey(struct eapol_sm *sm);
154 static void eapol_sm_getSuppRsp(struct eapol_sm *sm);
155 static void eapol_sm_txSuppRsp(struct eapol_sm *sm);
156 static void eapol_sm_abortSupp(struct eapol_sm *sm);
157 static void eapol_sm_abort_cached(struct eapol_sm *sm);
158 static void eapol_sm_step_timeout(void *eloop_ctx, void *timeout_ctx);
159 static void eapol_sm_set_port_authorized(struct eapol_sm *sm);
160 static void eapol_sm_set_port_unauthorized(struct eapol_sm *sm);
161 
162 
163 /* Port Timers state machine - implemented as a function that will be called
164  * once a second as a registered event loop timeout */
165 static void eapol_port_timers_tick(void *eloop_ctx, void *timeout_ctx)
166 {
167 	struct eapol_sm *sm = timeout_ctx;
168 
169 	if (sm->authWhile > 0) {
170 		sm->authWhile--;
171 		if (sm->authWhile == 0)
172 			wpa_printf(MSG_DEBUG, "EAPOL: authWhile --> 0");
173 	}
174 	if (sm->heldWhile > 0) {
175 		sm->heldWhile--;
176 		if (sm->heldWhile == 0)
177 			wpa_printf(MSG_DEBUG, "EAPOL: heldWhile --> 0");
178 	}
179 	if (sm->startWhen > 0) {
180 		sm->startWhen--;
181 		if (sm->startWhen == 0)
182 			wpa_printf(MSG_DEBUG, "EAPOL: startWhen --> 0");
183 	}
184 	if (sm->idleWhile > 0) {
185 		sm->idleWhile--;
186 		if (sm->idleWhile == 0)
187 			wpa_printf(MSG_DEBUG, "EAPOL: idleWhile --> 0");
188 	}
189 
190 	if (sm->authWhile | sm->heldWhile | sm->startWhen | sm->idleWhile) {
191 		eloop_register_timeout(1, 0, eapol_port_timers_tick, eloop_ctx,
192 				       sm);
193 	} else {
194 		wpa_printf(MSG_DEBUG, "EAPOL: disable timer tick");
195 		sm->timer_tick_enabled = 0;
196 	}
197 	eapol_sm_step(sm);
198 }
199 
200 
201 static void eapol_enable_timer_tick(struct eapol_sm *sm)
202 {
203 	if (sm->timer_tick_enabled)
204 		return;
205 	wpa_printf(MSG_DEBUG, "EAPOL: enable timer tick");
206 	sm->timer_tick_enabled = 1;
207 	eloop_cancel_timeout(eapol_port_timers_tick, NULL, sm);
208 	eloop_register_timeout(1, 0, eapol_port_timers_tick, NULL, sm);
209 }
210 
211 
212 SM_STATE(SUPP_PAE, LOGOFF)
213 {
214 	SM_ENTRY(SUPP_PAE, LOGOFF);
215 	eapol_sm_txLogoff(sm);
216 	sm->logoffSent = TRUE;
217 	eapol_sm_set_port_unauthorized(sm);
218 }
219 
220 
221 SM_STATE(SUPP_PAE, DISCONNECTED)
222 {
223 	SM_ENTRY(SUPP_PAE, DISCONNECTED);
224 	sm->sPortMode = Auto;
225 	sm->startCount = 0;
226 	sm->eapTriggerStart = FALSE;
227 	sm->logoffSent = FALSE;
228 	eapol_sm_set_port_unauthorized(sm);
229 	sm->suppAbort = TRUE;
230 
231 	sm->unicast_key_received = FALSE;
232 	sm->broadcast_key_received = FALSE;
233 
234 	/*
235 	 * IEEE Std 802.1X-2004 does not clear heldWhile here, but doing so
236 	 * allows the timer tick to be stopped more quickly when the port is
237 	 * not enabled. Since this variable is used only within HELD state,
238 	 * clearing it on initialization does not change actual state machine
239 	 * behavior.
240 	 */
241 	sm->heldWhile = 0;
242 }
243 
244 
245 SM_STATE(SUPP_PAE, CONNECTING)
246 {
247 	int send_start = sm->SUPP_PAE_state == SUPP_PAE_CONNECTING ||
248 		sm->SUPP_PAE_state == SUPP_PAE_HELD;
249 	SM_ENTRY(SUPP_PAE, CONNECTING);
250 
251 	if (sm->eapTriggerStart)
252 		send_start = 1;
253 	sm->eapTriggerStart = FALSE;
254 
255 	if (send_start) {
256 		sm->startWhen = sm->startPeriod;
257 		sm->startCount++;
258 	} else {
259 		/*
260 		 * Do not send EAPOL-Start immediately since in most cases,
261 		 * Authenticator is going to start authentication immediately
262 		 * after association and an extra EAPOL-Start is just going to
263 		 * delay authentication. Use a short timeout to send the first
264 		 * EAPOL-Start if Authenticator does not start authentication.
265 		 */
266 		if (sm->conf.wps && !(sm->conf.wps & EAPOL_PEER_IS_WPS20_AP)) {
267 			/* Reduce latency on starting WPS negotiation. */
268 			wpa_printf(MSG_DEBUG,
269 				   "EAPOL: Using shorter startWhen for WPS");
270 			sm->startWhen = 1;
271 		} else {
272 			sm->startWhen = 2;
273 		}
274 	}
275 	eapol_enable_timer_tick(sm);
276 	sm->eapolEap = FALSE;
277 	if (send_start)
278 		eapol_sm_txStart(sm);
279 }
280 
281 
282 SM_STATE(SUPP_PAE, AUTHENTICATING)
283 {
284 	SM_ENTRY(SUPP_PAE, AUTHENTICATING);
285 	sm->startCount = 0;
286 	sm->suppSuccess = FALSE;
287 	sm->suppFail = FALSE;
288 	sm->suppTimeout = FALSE;
289 	sm->keyRun = FALSE;
290 	sm->keyDone = FALSE;
291 	sm->suppStart = TRUE;
292 }
293 
294 
295 SM_STATE(SUPP_PAE, HELD)
296 {
297 	SM_ENTRY(SUPP_PAE, HELD);
298 	sm->heldWhile = sm->heldPeriod;
299 	eapol_enable_timer_tick(sm);
300 	eapol_sm_set_port_unauthorized(sm);
301 	sm->cb_status = EAPOL_CB_FAILURE;
302 }
303 
304 
305 SM_STATE(SUPP_PAE, AUTHENTICATED)
306 {
307 	SM_ENTRY(SUPP_PAE, AUTHENTICATED);
308 	eapol_sm_set_port_authorized(sm);
309 	sm->cb_status = EAPOL_CB_SUCCESS;
310 }
311 
312 
313 SM_STATE(SUPP_PAE, RESTART)
314 {
315 	SM_ENTRY(SUPP_PAE, RESTART);
316 	sm->eapRestart = TRUE;
317 }
318 
319 
320 SM_STATE(SUPP_PAE, S_FORCE_AUTH)
321 {
322 	SM_ENTRY(SUPP_PAE, S_FORCE_AUTH);
323 	eapol_sm_set_port_authorized(sm);
324 	sm->sPortMode = ForceAuthorized;
325 }
326 
327 
328 SM_STATE(SUPP_PAE, S_FORCE_UNAUTH)
329 {
330 	SM_ENTRY(SUPP_PAE, S_FORCE_UNAUTH);
331 	eapol_sm_set_port_unauthorized(sm);
332 	sm->sPortMode = ForceUnauthorized;
333 	eapol_sm_txLogoff(sm);
334 }
335 
336 
337 SM_STEP(SUPP_PAE)
338 {
339 	if ((sm->userLogoff && !sm->logoffSent) &&
340 	    !(sm->initialize || !sm->portEnabled))
341 		SM_ENTER_GLOBAL(SUPP_PAE, LOGOFF);
342 	else if (((sm->portControl == Auto) &&
343 		  (sm->sPortMode != sm->portControl)) ||
344 		 sm->initialize || !sm->portEnabled)
345 		SM_ENTER_GLOBAL(SUPP_PAE, DISCONNECTED);
346 	else if ((sm->portControl == ForceAuthorized) &&
347 		 (sm->sPortMode != sm->portControl) &&
348 		 !(sm->initialize || !sm->portEnabled))
349 		SM_ENTER_GLOBAL(SUPP_PAE, S_FORCE_AUTH);
350 	else if ((sm->portControl == ForceUnauthorized) &&
351 		 (sm->sPortMode != sm->portControl) &&
352 		 !(sm->initialize || !sm->portEnabled))
353 		SM_ENTER_GLOBAL(SUPP_PAE, S_FORCE_UNAUTH);
354 	else switch (sm->SUPP_PAE_state) {
355 	case SUPP_PAE_UNKNOWN:
356 		break;
357 	case SUPP_PAE_LOGOFF:
358 		if (!sm->userLogoff)
359 			SM_ENTER(SUPP_PAE, DISCONNECTED);
360 		break;
361 	case SUPP_PAE_DISCONNECTED:
362 		SM_ENTER(SUPP_PAE, CONNECTING);
363 		break;
364 	case SUPP_PAE_CONNECTING:
365 		if (sm->startWhen == 0 && sm->startCount < sm->maxStart)
366 			SM_ENTER(SUPP_PAE, CONNECTING);
367 		else if (sm->startWhen == 0 &&
368 			 sm->startCount >= sm->maxStart &&
369 			 sm->portValid)
370 			SM_ENTER(SUPP_PAE, AUTHENTICATED);
371 		else if (sm->eapSuccess || sm->eapFail)
372 			SM_ENTER(SUPP_PAE, AUTHENTICATING);
373 		else if (sm->eapolEap)
374 			SM_ENTER(SUPP_PAE, RESTART);
375 		else if (sm->startWhen == 0 &&
376 			 sm->startCount >= sm->maxStart &&
377 			 !sm->portValid)
378 			SM_ENTER(SUPP_PAE, HELD);
379 		break;
380 	case SUPP_PAE_AUTHENTICATING:
381 		if (sm->eapSuccess && !sm->portValid &&
382 		    sm->conf.accept_802_1x_keys &&
383 		    sm->conf.required_keys == 0) {
384 			wpa_printf(MSG_DEBUG, "EAPOL: IEEE 802.1X for "
385 				   "plaintext connection; no EAPOL-Key frames "
386 				   "required");
387 			sm->portValid = TRUE;
388 			if (sm->ctx->eapol_done_cb)
389 				sm->ctx->eapol_done_cb(sm->ctx->ctx);
390 		}
391 		if (sm->eapSuccess && sm->portValid)
392 			SM_ENTER(SUPP_PAE, AUTHENTICATED);
393 		else if (sm->eapFail || (sm->keyDone && !sm->portValid))
394 			SM_ENTER(SUPP_PAE, HELD);
395 		else if (sm->suppTimeout)
396 			SM_ENTER(SUPP_PAE, CONNECTING);
397 		else if (sm->eapTriggerStart)
398 			SM_ENTER(SUPP_PAE, CONNECTING);
399 		break;
400 	case SUPP_PAE_HELD:
401 		if (sm->heldWhile == 0)
402 			SM_ENTER(SUPP_PAE, CONNECTING);
403 		else if (sm->eapolEap)
404 			SM_ENTER(SUPP_PAE, RESTART);
405 		break;
406 	case SUPP_PAE_AUTHENTICATED:
407 		if (sm->eapolEap && sm->portValid)
408 			SM_ENTER(SUPP_PAE, RESTART);
409 		else if (!sm->portValid)
410 			SM_ENTER(SUPP_PAE, DISCONNECTED);
411 		break;
412 	case SUPP_PAE_RESTART:
413 		if (!sm->eapRestart)
414 			SM_ENTER(SUPP_PAE, AUTHENTICATING);
415 		break;
416 	case SUPP_PAE_S_FORCE_AUTH:
417 		break;
418 	case SUPP_PAE_S_FORCE_UNAUTH:
419 		break;
420 	}
421 }
422 
423 
424 SM_STATE(KEY_RX, NO_KEY_RECEIVE)
425 {
426 	SM_ENTRY(KEY_RX, NO_KEY_RECEIVE);
427 }
428 
429 
430 SM_STATE(KEY_RX, KEY_RECEIVE)
431 {
432 	SM_ENTRY(KEY_RX, KEY_RECEIVE);
433 	eapol_sm_processKey(sm);
434 	sm->rxKey = FALSE;
435 }
436 
437 
438 SM_STEP(KEY_RX)
439 {
440 	if (sm->initialize || !sm->portEnabled)
441 		SM_ENTER_GLOBAL(KEY_RX, NO_KEY_RECEIVE);
442 	switch (sm->KEY_RX_state) {
443 	case KEY_RX_UNKNOWN:
444 		break;
445 	case KEY_RX_NO_KEY_RECEIVE:
446 		if (sm->rxKey)
447 			SM_ENTER(KEY_RX, KEY_RECEIVE);
448 		break;
449 	case KEY_RX_KEY_RECEIVE:
450 		if (sm->rxKey)
451 			SM_ENTER(KEY_RX, KEY_RECEIVE);
452 		break;
453 	}
454 }
455 
456 
457 SM_STATE(SUPP_BE, REQUEST)
458 {
459 	SM_ENTRY(SUPP_BE, REQUEST);
460 	sm->authWhile = 0;
461 	sm->eapReq = TRUE;
462 	eapol_sm_getSuppRsp(sm);
463 }
464 
465 
466 SM_STATE(SUPP_BE, RESPONSE)
467 {
468 	SM_ENTRY(SUPP_BE, RESPONSE);
469 	eapol_sm_txSuppRsp(sm);
470 	sm->eapResp = FALSE;
471 }
472 
473 
474 SM_STATE(SUPP_BE, SUCCESS)
475 {
476 	SM_ENTRY(SUPP_BE, SUCCESS);
477 	sm->keyRun = TRUE;
478 	sm->suppSuccess = TRUE;
479 
480 #ifdef CONFIG_EAP_PROXY
481 	if (sm->use_eap_proxy) {
482 		if (eap_proxy_key_available(sm->eap_proxy)) {
483 			/* New key received - clear IEEE 802.1X EAPOL-Key replay
484 			 * counter */
485 			sm->replay_counter_valid = FALSE;
486 		}
487 		return;
488 	}
489 #endif /* CONFIG_EAP_PROXY */
490 
491 	if (eap_key_available(sm->eap)) {
492 		/* New key received - clear IEEE 802.1X EAPOL-Key replay
493 		 * counter */
494 		sm->replay_counter_valid = FALSE;
495 	}
496 }
497 
498 
499 SM_STATE(SUPP_BE, FAIL)
500 {
501 	SM_ENTRY(SUPP_BE, FAIL);
502 	sm->suppFail = TRUE;
503 }
504 
505 
506 SM_STATE(SUPP_BE, TIMEOUT)
507 {
508 	SM_ENTRY(SUPP_BE, TIMEOUT);
509 	sm->suppTimeout = TRUE;
510 }
511 
512 
513 SM_STATE(SUPP_BE, IDLE)
514 {
515 	SM_ENTRY(SUPP_BE, IDLE);
516 	sm->suppStart = FALSE;
517 	sm->initial_req = TRUE;
518 }
519 
520 
521 SM_STATE(SUPP_BE, INITIALIZE)
522 {
523 	SM_ENTRY(SUPP_BE, INITIALIZE);
524 	eapol_sm_abortSupp(sm);
525 	sm->suppAbort = FALSE;
526 
527 	/*
528 	 * IEEE Std 802.1X-2004 does not clear authWhile here, but doing so
529 	 * allows the timer tick to be stopped more quickly when the port is
530 	 * not enabled. Since this variable is used only within RECEIVE state,
531 	 * clearing it on initialization does not change actual state machine
532 	 * behavior.
533 	 */
534 	sm->authWhile = 0;
535 }
536 
537 
538 SM_STATE(SUPP_BE, RECEIVE)
539 {
540 	SM_ENTRY(SUPP_BE, RECEIVE);
541 	sm->authWhile = sm->authPeriod;
542 	eapol_enable_timer_tick(sm);
543 	sm->eapolEap = FALSE;
544 	sm->eapNoResp = FALSE;
545 	sm->initial_req = FALSE;
546 }
547 
548 
549 SM_STEP(SUPP_BE)
550 {
551 	if (sm->initialize || sm->suppAbort)
552 		SM_ENTER_GLOBAL(SUPP_BE, INITIALIZE);
553 	else switch (sm->SUPP_BE_state) {
554 	case SUPP_BE_UNKNOWN:
555 		break;
556 	case SUPP_BE_REQUEST:
557 		/*
558 		 * IEEE Std 802.1X-2004 has transitions from REQUEST to FAIL
559 		 * and SUCCESS based on eapFail and eapSuccess, respectively.
560 		 * However, IEEE Std 802.1X-2004 is also specifying that
561 		 * eapNoResp should be set in conjunction with eapSuccess and
562 		 * eapFail which would mean that more than one of the
563 		 * transitions here would be activated at the same time.
564 		 * Skipping RESPONSE and/or RECEIVE states in these cases can
565 		 * cause problems and the direct transitions to do not seem
566 		 * correct. Because of this, the conditions for these
567 		 * transitions are verified only after eapNoResp. They are
568 		 * unlikely to be used since eapNoResp should always be set if
569 		 * either of eapSuccess or eapFail is set.
570 		 */
571 		if (sm->eapResp && sm->eapNoResp) {
572 			wpa_printf(MSG_DEBUG, "EAPOL: SUPP_BE REQUEST: both "
573 				   "eapResp and eapNoResp set?!");
574 		}
575 		if (sm->eapResp)
576 			SM_ENTER(SUPP_BE, RESPONSE);
577 		else if (sm->eapNoResp)
578 			SM_ENTER(SUPP_BE, RECEIVE);
579 		else if (sm->eapFail)
580 			SM_ENTER(SUPP_BE, FAIL);
581 		else if (sm->eapSuccess)
582 			SM_ENTER(SUPP_BE, SUCCESS);
583 		break;
584 	case SUPP_BE_RESPONSE:
585 		SM_ENTER(SUPP_BE, RECEIVE);
586 		break;
587 	case SUPP_BE_SUCCESS:
588 		SM_ENTER(SUPP_BE, IDLE);
589 		break;
590 	case SUPP_BE_FAIL:
591 		SM_ENTER(SUPP_BE, IDLE);
592 		break;
593 	case SUPP_BE_TIMEOUT:
594 		SM_ENTER(SUPP_BE, IDLE);
595 		break;
596 	case SUPP_BE_IDLE:
597 		if (sm->eapFail && sm->suppStart)
598 			SM_ENTER(SUPP_BE, FAIL);
599 		else if (sm->eapolEap && sm->suppStart)
600 			SM_ENTER(SUPP_BE, REQUEST);
601 		else if (sm->eapSuccess && sm->suppStart)
602 			SM_ENTER(SUPP_BE, SUCCESS);
603 		break;
604 	case SUPP_BE_INITIALIZE:
605 		SM_ENTER(SUPP_BE, IDLE);
606 		break;
607 	case SUPP_BE_RECEIVE:
608 		if (sm->eapolEap)
609 			SM_ENTER(SUPP_BE, REQUEST);
610 		else if (sm->eapFail)
611 			SM_ENTER(SUPP_BE, FAIL);
612 		else if (sm->authWhile == 0)
613 			SM_ENTER(SUPP_BE, TIMEOUT);
614 		else if (sm->eapSuccess)
615 			SM_ENTER(SUPP_BE, SUCCESS);
616 		break;
617 	}
618 }
619 
620 
621 static void eapol_sm_txLogoff(struct eapol_sm *sm)
622 {
623 	wpa_printf(MSG_DEBUG, "EAPOL: txLogoff");
624 	sm->ctx->eapol_send(sm->ctx->eapol_send_ctx,
625 			    IEEE802_1X_TYPE_EAPOL_LOGOFF, (u8 *) "", 0);
626 	sm->dot1xSuppEapolLogoffFramesTx++;
627 	sm->dot1xSuppEapolFramesTx++;
628 }
629 
630 
631 static void eapol_sm_txStart(struct eapol_sm *sm)
632 {
633 	wpa_printf(MSG_DEBUG, "EAPOL: txStart");
634 	sm->ctx->eapol_send(sm->ctx->eapol_send_ctx,
635 			    IEEE802_1X_TYPE_EAPOL_START, (u8 *) "", 0);
636 	sm->dot1xSuppEapolStartFramesTx++;
637 	sm->dot1xSuppEapolFramesTx++;
638 }
639 
640 
641 #define IEEE8021X_ENCR_KEY_LEN 32
642 #define IEEE8021X_SIGN_KEY_LEN 32
643 
644 struct eap_key_data {
645 	u8 encr_key[IEEE8021X_ENCR_KEY_LEN];
646 	u8 sign_key[IEEE8021X_SIGN_KEY_LEN];
647 };
648 
649 
650 static void eapol_sm_processKey(struct eapol_sm *sm)
651 {
652 #ifndef CONFIG_FIPS
653 	struct ieee802_1x_hdr *hdr;
654 	struct ieee802_1x_eapol_key *key;
655 	struct eap_key_data keydata;
656 	u8 orig_key_sign[IEEE8021X_KEY_SIGN_LEN], datakey[32];
657 #ifndef CONFIG_NO_RC4
658 	u8 ekey[IEEE8021X_KEY_IV_LEN + IEEE8021X_ENCR_KEY_LEN];
659 #endif /* CONFIG_NO_RC4 */
660 	int key_len, res, sign_key_len, encr_key_len;
661 	u16 rx_key_length;
662 	size_t plen;
663 
664 	wpa_printf(MSG_DEBUG, "EAPOL: processKey");
665 	if (sm->last_rx_key == NULL)
666 		return;
667 
668 	if (!sm->conf.accept_802_1x_keys) {
669 		wpa_printf(MSG_WARNING, "EAPOL: Received IEEE 802.1X EAPOL-Key"
670 			   " even though this was not accepted - "
671 			   "ignoring this packet");
672 		return;
673 	}
674 
675 	if (sm->last_rx_key_len < sizeof(*hdr) + sizeof(*key))
676 		return;
677 	hdr = (struct ieee802_1x_hdr *) sm->last_rx_key;
678 	key = (struct ieee802_1x_eapol_key *) (hdr + 1);
679 	plen = be_to_host16(hdr->length);
680 	if (sizeof(*hdr) + plen > sm->last_rx_key_len || plen < sizeof(*key)) {
681 		wpa_printf(MSG_WARNING, "EAPOL: Too short EAPOL-Key frame");
682 		return;
683 	}
684 	rx_key_length = WPA_GET_BE16(key->key_length);
685 	wpa_printf(MSG_DEBUG, "EAPOL: RX IEEE 802.1X ver=%d type=%d len=%d "
686 		   "EAPOL-Key: type=%d key_length=%d key_index=0x%x",
687 		   hdr->version, hdr->type, be_to_host16(hdr->length),
688 		   key->type, rx_key_length, key->key_index);
689 
690 	eapol_sm_notify_lower_layer_success(sm, 1);
691 	sign_key_len = IEEE8021X_SIGN_KEY_LEN;
692 	encr_key_len = IEEE8021X_ENCR_KEY_LEN;
693 	res = eapol_sm_get_key(sm, (u8 *) &keydata, sizeof(keydata));
694 	if (res < 0) {
695 		wpa_printf(MSG_DEBUG, "EAPOL: Could not get master key for "
696 			   "decrypting EAPOL-Key keys");
697 		return;
698 	}
699 	if (res == 16) {
700 		/* LEAP derives only 16 bytes of keying material. */
701 		res = eapol_sm_get_key(sm, (u8 *) &keydata, 16);
702 		if (res) {
703 			wpa_printf(MSG_DEBUG, "EAPOL: Could not get LEAP "
704 				   "master key for decrypting EAPOL-Key keys");
705 			return;
706 		}
707 		sign_key_len = 16;
708 		encr_key_len = 16;
709 		os_memcpy(keydata.sign_key, keydata.encr_key, 16);
710 	} else if (res) {
711 		wpa_printf(MSG_DEBUG, "EAPOL: Could not get enough master key "
712 			   "data for decrypting EAPOL-Key keys (res=%d)", res);
713 		return;
714 	}
715 
716 	/* The key replay_counter must increase when same master key */
717 	if (sm->replay_counter_valid &&
718 	    os_memcmp(sm->last_replay_counter, key->replay_counter,
719 		      IEEE8021X_REPLAY_COUNTER_LEN) >= 0) {
720 		wpa_printf(MSG_WARNING, "EAPOL: EAPOL-Key replay counter did "
721 			   "not increase - ignoring key");
722 		wpa_hexdump(MSG_DEBUG, "EAPOL: last replay counter",
723 			    sm->last_replay_counter,
724 			    IEEE8021X_REPLAY_COUNTER_LEN);
725 		wpa_hexdump(MSG_DEBUG, "EAPOL: received replay counter",
726 			    key->replay_counter, IEEE8021X_REPLAY_COUNTER_LEN);
727 		return;
728 	}
729 
730 	/* Verify key signature (HMAC-MD5) */
731 	os_memcpy(orig_key_sign, key->key_signature, IEEE8021X_KEY_SIGN_LEN);
732 	os_memset(key->key_signature, 0, IEEE8021X_KEY_SIGN_LEN);
733 	hmac_md5(keydata.sign_key, sign_key_len,
734 		 sm->last_rx_key, sizeof(*hdr) + be_to_host16(hdr->length),
735 		 key->key_signature);
736 	if (os_memcmp_const(orig_key_sign, key->key_signature,
737 			    IEEE8021X_KEY_SIGN_LEN) != 0) {
738 		wpa_printf(MSG_DEBUG, "EAPOL: Invalid key signature in "
739 			   "EAPOL-Key packet");
740 		os_memcpy(key->key_signature, orig_key_sign,
741 			  IEEE8021X_KEY_SIGN_LEN);
742 		return;
743 	}
744 	wpa_printf(MSG_DEBUG, "EAPOL: EAPOL-Key key signature verified");
745 
746 	key_len = plen - sizeof(*key);
747 	if (key_len > 32 || rx_key_length > 32) {
748 		wpa_printf(MSG_WARNING, "EAPOL: Too long key data length %d",
749 			   key_len ? key_len : rx_key_length);
750 		return;
751 	}
752 	if (key_len == rx_key_length) {
753 #ifdef CONFIG_NO_RC4
754 		if (encr_key_len) {
755 			/* otherwise unused */
756 		}
757 		wpa_printf(MSG_ERROR, "EAPOL: RC4 not supported in the build");
758 		return;
759 #else /* CONFIG_NO_RC4 */
760 		os_memcpy(ekey, key->key_iv, IEEE8021X_KEY_IV_LEN);
761 		os_memcpy(ekey + IEEE8021X_KEY_IV_LEN, keydata.encr_key,
762 			  encr_key_len);
763 		os_memcpy(datakey, key + 1, key_len);
764 		rc4_skip(ekey, IEEE8021X_KEY_IV_LEN + encr_key_len, 0,
765 			 datakey, key_len);
766 		wpa_hexdump_key(MSG_DEBUG, "EAPOL: Decrypted(RC4) key",
767 				datakey, key_len);
768 #endif /* CONFIG_NO_RC4 */
769 	} else if (key_len == 0) {
770 		/*
771 		 * IEEE 802.1X-2004 specifies that least significant Key Length
772 		 * octets from MS-MPPE-Send-Key are used as the key if the key
773 		 * data is not present. This seems to be meaning the beginning
774 		 * of the MS-MPPE-Send-Key. In addition, MS-MPPE-Send-Key in
775 		 * Supplicant corresponds to MS-MPPE-Recv-Key in Authenticator.
776 		 * Anyway, taking the beginning of the keying material from EAP
777 		 * seems to interoperate with Authenticators.
778 		 */
779 		key_len = rx_key_length;
780 		os_memcpy(datakey, keydata.encr_key, key_len);
781 		wpa_hexdump_key(MSG_DEBUG, "EAPOL: using part of EAP keying "
782 				"material data encryption key",
783 				datakey, key_len);
784 	} else {
785 		wpa_printf(MSG_DEBUG, "EAPOL: Invalid key data length %d "
786 			   "(key_length=%d)", key_len, rx_key_length);
787 		return;
788 	}
789 
790 	sm->replay_counter_valid = TRUE;
791 	os_memcpy(sm->last_replay_counter, key->replay_counter,
792 		  IEEE8021X_REPLAY_COUNTER_LEN);
793 
794 	wpa_printf(MSG_DEBUG, "EAPOL: Setting dynamic WEP key: %s keyidx %d "
795 		   "len %d",
796 		   key->key_index & IEEE8021X_KEY_INDEX_FLAG ?
797 		   "unicast" : "broadcast",
798 		   key->key_index & IEEE8021X_KEY_INDEX_MASK, key_len);
799 
800 	if (sm->ctx->set_wep_key &&
801 	    sm->ctx->set_wep_key(sm->ctx->ctx,
802 				 key->key_index & IEEE8021X_KEY_INDEX_FLAG,
803 				 key->key_index & IEEE8021X_KEY_INDEX_MASK,
804 				 datakey, key_len) < 0) {
805 		wpa_printf(MSG_WARNING, "EAPOL: Failed to set WEP key to the "
806 			   " driver.");
807 	} else {
808 		if (key->key_index & IEEE8021X_KEY_INDEX_FLAG)
809 			sm->unicast_key_received = TRUE;
810 		else
811 			sm->broadcast_key_received = TRUE;
812 
813 		if ((sm->unicast_key_received ||
814 		     !(sm->conf.required_keys & EAPOL_REQUIRE_KEY_UNICAST)) &&
815 		    (sm->broadcast_key_received ||
816 		     !(sm->conf.required_keys & EAPOL_REQUIRE_KEY_BROADCAST)))
817 		{
818 			wpa_printf(MSG_DEBUG, "EAPOL: all required EAPOL-Key "
819 				   "frames received");
820 			sm->portValid = TRUE;
821 			if (sm->ctx->eapol_done_cb)
822 				sm->ctx->eapol_done_cb(sm->ctx->ctx);
823 		}
824 	}
825 #endif /* CONFIG_FIPS */
826 }
827 
828 
829 static void eapol_sm_getSuppRsp(struct eapol_sm *sm)
830 {
831 	wpa_printf(MSG_DEBUG, "EAPOL: getSuppRsp");
832 	/* EAP layer processing; no special code is needed, since Supplicant
833 	 * Backend state machine is waiting for eapNoResp or eapResp to be set
834 	 * and these are only set in the EAP state machine when the processing
835 	 * has finished. */
836 }
837 
838 
839 static void eapol_sm_txSuppRsp(struct eapol_sm *sm)
840 {
841 	struct wpabuf *resp;
842 
843 	wpa_printf(MSG_DEBUG, "EAPOL: txSuppRsp");
844 
845 #ifdef CONFIG_EAP_PROXY
846 	if (sm->use_eap_proxy) {
847 		/* Get EAP Response from EAP Proxy */
848 		resp = eap_proxy_get_eapRespData(sm->eap_proxy);
849 		if (resp == NULL) {
850 			wpa_printf(MSG_WARNING, "EAPOL: txSuppRsp - EAP Proxy "
851 				   "response data not available");
852 			return;
853 		}
854 	} else
855 #endif /* CONFIG_EAP_PROXY */
856 
857 	resp = eap_get_eapRespData(sm->eap);
858 	if (resp == NULL) {
859 		wpa_printf(MSG_WARNING, "EAPOL: txSuppRsp - EAP response data "
860 			   "not available");
861 		return;
862 	}
863 
864 	/* Send EAP-Packet from the EAP layer to the Authenticator */
865 	sm->ctx->eapol_send(sm->ctx->eapol_send_ctx,
866 			    IEEE802_1X_TYPE_EAP_PACKET, wpabuf_head(resp),
867 			    wpabuf_len(resp));
868 
869 	/* eapRespData is not used anymore, so free it here */
870 	wpabuf_free(resp);
871 
872 	if (sm->initial_req)
873 		sm->dot1xSuppEapolReqIdFramesRx++;
874 	else
875 		sm->dot1xSuppEapolReqFramesRx++;
876 	sm->dot1xSuppEapolRespFramesTx++;
877 	sm->dot1xSuppEapolFramesTx++;
878 }
879 
880 
881 static void eapol_sm_abortSupp(struct eapol_sm *sm)
882 {
883 	/* release system resources that may have been allocated for the
884 	 * authentication session */
885 	os_free(sm->last_rx_key);
886 	sm->last_rx_key = NULL;
887 	wpabuf_free(sm->eapReqData);
888 	sm->eapReqData = NULL;
889 	eap_sm_abort(sm->eap);
890 }
891 
892 
893 static void eapol_sm_step_timeout(void *eloop_ctx, void *timeout_ctx)
894 {
895 	eapol_sm_step(timeout_ctx);
896 }
897 
898 
899 static void eapol_sm_set_port_authorized(struct eapol_sm *sm)
900 {
901 	int cb;
902 
903 	cb = sm->suppPortStatus != Authorized || sm->force_authorized_update;
904 	sm->force_authorized_update = FALSE;
905 	sm->suppPortStatus = Authorized;
906 	if (cb && sm->ctx->port_cb)
907 		sm->ctx->port_cb(sm->ctx->ctx, 1);
908 }
909 
910 
911 static void eapol_sm_set_port_unauthorized(struct eapol_sm *sm)
912 {
913 	int cb;
914 
915 	cb = sm->suppPortStatus != Unauthorized || sm->force_authorized_update;
916 	sm->force_authorized_update = FALSE;
917 	sm->suppPortStatus = Unauthorized;
918 	if (cb && sm->ctx->port_cb)
919 		sm->ctx->port_cb(sm->ctx->ctx, 0);
920 }
921 
922 
923 /**
924  * eapol_sm_step - EAPOL state machine step function
925  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
926  *
927  * This function is called to notify the state machine about changed external
928  * variables. It will step through the EAPOL state machines in loop to process
929  * all triggered state changes.
930  */
931 void eapol_sm_step(struct eapol_sm *sm)
932 {
933 	int i;
934 
935 	/* In theory, it should be ok to run this in loop until !changed.
936 	 * However, it is better to use a limit on number of iterations to
937 	 * allow events (e.g., SIGTERM) to stop the program cleanly if the
938 	 * state machine were to generate a busy loop. */
939 	for (i = 0; i < 100; i++) {
940 		sm->changed = FALSE;
941 		SM_STEP_RUN(SUPP_PAE);
942 		SM_STEP_RUN(KEY_RX);
943 		SM_STEP_RUN(SUPP_BE);
944 #ifdef CONFIG_EAP_PROXY
945 		if (sm->use_eap_proxy) {
946 			/* Drive the EAP proxy state machine */
947 			if (eap_proxy_sm_step(sm->eap_proxy, sm->eap))
948 				sm->changed = TRUE;
949 		} else
950 #endif /* CONFIG_EAP_PROXY */
951 		if (eap_peer_sm_step(sm->eap))
952 			sm->changed = TRUE;
953 		if (!sm->changed)
954 			break;
955 	}
956 
957 	if (sm->changed) {
958 		/* restart EAPOL state machine step from timeout call in order
959 		 * to allow other events to be processed. */
960 		eloop_cancel_timeout(eapol_sm_step_timeout, NULL, sm);
961 		eloop_register_timeout(0, 0, eapol_sm_step_timeout, NULL, sm);
962 	}
963 
964 	if (sm->ctx->cb && sm->cb_status != EAPOL_CB_IN_PROGRESS) {
965 		enum eapol_supp_result result;
966 		if (sm->cb_status == EAPOL_CB_SUCCESS)
967 			result = EAPOL_SUPP_RESULT_SUCCESS;
968 		else if (eap_peer_was_failure_expected(sm->eap))
969 			result = EAPOL_SUPP_RESULT_EXPECTED_FAILURE;
970 		else
971 			result = EAPOL_SUPP_RESULT_FAILURE;
972 		sm->cb_status = EAPOL_CB_IN_PROGRESS;
973 		sm->ctx->cb(sm, result, sm->ctx->cb_ctx);
974 	}
975 }
976 
977 
978 #ifdef CONFIG_CTRL_IFACE
979 static const char *eapol_supp_pae_state(int state)
980 {
981 	switch (state) {
982 	case SUPP_PAE_LOGOFF:
983 		return "LOGOFF";
984 	case SUPP_PAE_DISCONNECTED:
985 		return "DISCONNECTED";
986 	case SUPP_PAE_CONNECTING:
987 		return "CONNECTING";
988 	case SUPP_PAE_AUTHENTICATING:
989 		return "AUTHENTICATING";
990 	case SUPP_PAE_HELD:
991 		return "HELD";
992 	case SUPP_PAE_AUTHENTICATED:
993 		return "AUTHENTICATED";
994 	case SUPP_PAE_RESTART:
995 		return "RESTART";
996 	default:
997 		return "UNKNOWN";
998 	}
999 }
1000 
1001 
1002 static const char *eapol_supp_be_state(int state)
1003 {
1004 	switch (state) {
1005 	case SUPP_BE_REQUEST:
1006 		return "REQUEST";
1007 	case SUPP_BE_RESPONSE:
1008 		return "RESPONSE";
1009 	case SUPP_BE_SUCCESS:
1010 		return "SUCCESS";
1011 	case SUPP_BE_FAIL:
1012 		return "FAIL";
1013 	case SUPP_BE_TIMEOUT:
1014 		return "TIMEOUT";
1015 	case SUPP_BE_IDLE:
1016 		return "IDLE";
1017 	case SUPP_BE_INITIALIZE:
1018 		return "INITIALIZE";
1019 	case SUPP_BE_RECEIVE:
1020 		return "RECEIVE";
1021 	default:
1022 		return "UNKNOWN";
1023 	}
1024 }
1025 
1026 
1027 static const char * eapol_port_status(PortStatus status)
1028 {
1029 	if (status == Authorized)
1030 		return "Authorized";
1031 	else
1032 		return "Unauthorized";
1033 }
1034 #endif /* CONFIG_CTRL_IFACE */
1035 
1036 
1037 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
1038 static const char * eapol_port_control(PortControl ctrl)
1039 {
1040 	switch (ctrl) {
1041 	case Auto:
1042 		return "Auto";
1043 	case ForceUnauthorized:
1044 		return "ForceUnauthorized";
1045 	case ForceAuthorized:
1046 		return "ForceAuthorized";
1047 	default:
1048 		return "Unknown";
1049 	}
1050 }
1051 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
1052 
1053 
1054 /**
1055  * eapol_sm_configure - Set EAPOL variables
1056  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1057  * @heldPeriod: dot1xSuppHeldPeriod
1058  * @authPeriod: dot1xSuppAuthPeriod
1059  * @startPeriod: dot1xSuppStartPeriod
1060  * @maxStart: dot1xSuppMaxStart
1061  *
1062  * Set configurable EAPOL state machine variables. Each variable can be set to
1063  * the given value or ignored if set to -1 (to set only some of the variables).
1064  */
1065 void eapol_sm_configure(struct eapol_sm *sm, int heldPeriod, int authPeriod,
1066 			int startPeriod, int maxStart)
1067 {
1068 	if (sm == NULL)
1069 		return;
1070 	if (heldPeriod >= 0)
1071 		sm->heldPeriod = heldPeriod;
1072 	if (authPeriod >= 0)
1073 		sm->authPeriod = authPeriod;
1074 	if (startPeriod >= 0)
1075 		sm->startPeriod = startPeriod;
1076 	if (maxStart >= 0)
1077 		sm->maxStart = maxStart;
1078 }
1079 
1080 
1081 /**
1082  * eapol_sm_get_method_name - Get EAPOL method name
1083  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1084  * Returns: Static string containing name of current eap method or NULL
1085  */
1086 const char * eapol_sm_get_method_name(struct eapol_sm *sm)
1087 {
1088 	if (sm->SUPP_PAE_state != SUPP_PAE_AUTHENTICATED ||
1089 	    sm->suppPortStatus != Authorized)
1090 		return NULL;
1091 
1092 	return eap_sm_get_method_name(sm->eap);
1093 }
1094 
1095 
1096 #ifdef CONFIG_CTRL_IFACE
1097 /**
1098  * eapol_sm_get_status - Get EAPOL state machine status
1099  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1100  * @buf: Buffer for status information
1101  * @buflen: Maximum buffer length
1102  * @verbose: Whether to include verbose status information
1103  * Returns: Number of bytes written to buf.
1104  *
1105  * Query EAPOL state machine for status information. This function fills in a
1106  * text area with current status information from the EAPOL state machine. If
1107  * the buffer (buf) is not large enough, status information will be truncated
1108  * to fit the buffer.
1109  */
1110 int eapol_sm_get_status(struct eapol_sm *sm, char *buf, size_t buflen,
1111 			int verbose)
1112 {
1113 	int len, ret;
1114 	if (sm == NULL)
1115 		return 0;
1116 
1117 	len = os_snprintf(buf, buflen,
1118 			  "Supplicant PAE state=%s\n"
1119 			  "suppPortStatus=%s\n",
1120 			  eapol_supp_pae_state(sm->SUPP_PAE_state),
1121 			  eapol_port_status(sm->suppPortStatus));
1122 	if (os_snprintf_error(buflen, len))
1123 		return 0;
1124 
1125 	if (verbose) {
1126 		ret = os_snprintf(buf + len, buflen - len,
1127 				  "heldPeriod=%u\n"
1128 				  "authPeriod=%u\n"
1129 				  "startPeriod=%u\n"
1130 				  "maxStart=%u\n"
1131 				  "portControl=%s\n"
1132 				  "Supplicant Backend state=%s\n",
1133 				  sm->heldPeriod,
1134 				  sm->authPeriod,
1135 				  sm->startPeriod,
1136 				  sm->maxStart,
1137 				  eapol_port_control(sm->portControl),
1138 				  eapol_supp_be_state(sm->SUPP_BE_state));
1139 		if (os_snprintf_error(buflen - len, ret))
1140 			return len;
1141 		len += ret;
1142 	}
1143 
1144 #ifdef CONFIG_EAP_PROXY
1145 	if (sm->use_eap_proxy)
1146 		len += eap_proxy_sm_get_status(sm->eap_proxy,
1147 					       buf + len, buflen - len,
1148 					       verbose);
1149 	else
1150 #endif /* CONFIG_EAP_PROXY */
1151 	len += eap_sm_get_status(sm->eap, buf + len, buflen - len, verbose);
1152 
1153 	return len;
1154 }
1155 
1156 
1157 /**
1158  * eapol_sm_get_mib - Get EAPOL state machine MIBs
1159  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1160  * @buf: Buffer for MIB information
1161  * @buflen: Maximum buffer length
1162  * Returns: Number of bytes written to buf.
1163  *
1164  * Query EAPOL state machine for MIB information. This function fills in a
1165  * text area with current MIB information from the EAPOL state machine. If
1166  * the buffer (buf) is not large enough, MIB information will be truncated to
1167  * fit the buffer.
1168  */
1169 int eapol_sm_get_mib(struct eapol_sm *sm, char *buf, size_t buflen)
1170 {
1171 	size_t len;
1172 	int ret;
1173 
1174 	if (sm == NULL)
1175 		return 0;
1176 	ret = os_snprintf(buf, buflen,
1177 			  "dot1xSuppPaeState=%d\n"
1178 			  "dot1xSuppHeldPeriod=%u\n"
1179 			  "dot1xSuppAuthPeriod=%u\n"
1180 			  "dot1xSuppStartPeriod=%u\n"
1181 			  "dot1xSuppMaxStart=%u\n"
1182 			  "dot1xSuppSuppControlledPortStatus=%s\n"
1183 			  "dot1xSuppBackendPaeState=%d\n",
1184 			  sm->SUPP_PAE_state,
1185 			  sm->heldPeriod,
1186 			  sm->authPeriod,
1187 			  sm->startPeriod,
1188 			  sm->maxStart,
1189 			  sm->suppPortStatus == Authorized ?
1190 			  "Authorized" : "Unauthorized",
1191 			  sm->SUPP_BE_state);
1192 
1193 	if (os_snprintf_error(buflen, ret))
1194 		return 0;
1195 	len = ret;
1196 
1197 	ret = os_snprintf(buf + len, buflen - len,
1198 			  "dot1xSuppEapolFramesRx=%u\n"
1199 			  "dot1xSuppEapolFramesTx=%u\n"
1200 			  "dot1xSuppEapolStartFramesTx=%u\n"
1201 			  "dot1xSuppEapolLogoffFramesTx=%u\n"
1202 			  "dot1xSuppEapolRespFramesTx=%u\n"
1203 			  "dot1xSuppEapolReqIdFramesRx=%u\n"
1204 			  "dot1xSuppEapolReqFramesRx=%u\n"
1205 			  "dot1xSuppInvalidEapolFramesRx=%u\n"
1206 			  "dot1xSuppEapLengthErrorFramesRx=%u\n"
1207 			  "dot1xSuppLastEapolFrameVersion=%u\n"
1208 			  "dot1xSuppLastEapolFrameSource=" MACSTR "\n",
1209 			  sm->dot1xSuppEapolFramesRx,
1210 			  sm->dot1xSuppEapolFramesTx,
1211 			  sm->dot1xSuppEapolStartFramesTx,
1212 			  sm->dot1xSuppEapolLogoffFramesTx,
1213 			  sm->dot1xSuppEapolRespFramesTx,
1214 			  sm->dot1xSuppEapolReqIdFramesRx,
1215 			  sm->dot1xSuppEapolReqFramesRx,
1216 			  sm->dot1xSuppInvalidEapolFramesRx,
1217 			  sm->dot1xSuppEapLengthErrorFramesRx,
1218 			  sm->dot1xSuppLastEapolFrameVersion,
1219 			  MAC2STR(sm->dot1xSuppLastEapolFrameSource));
1220 
1221 	if (os_snprintf_error(buflen - len, ret))
1222 		return len;
1223 	len += ret;
1224 
1225 	return len;
1226 }
1227 #endif /* CONFIG_CTRL_IFACE */
1228 
1229 
1230 /**
1231  * eapol_sm_rx_eapol - Process received EAPOL frames
1232  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1233  * @src: Source MAC address of the EAPOL packet
1234  * @buf: Pointer to the beginning of the EAPOL data (EAPOL header)
1235  * @len: Length of the EAPOL frame
1236  * Returns: 1 = EAPOL frame processed, 0 = not for EAPOL state machine,
1237  * -1 failure
1238  */
1239 int eapol_sm_rx_eapol(struct eapol_sm *sm, const u8 *src, const u8 *buf,
1240 		      size_t len)
1241 {
1242 	const struct ieee802_1x_hdr *hdr;
1243 	const struct ieee802_1x_eapol_key *key;
1244 	int data_len;
1245 	int res = 1;
1246 	size_t plen;
1247 
1248 	if (sm == NULL)
1249 		return 0;
1250 	sm->dot1xSuppEapolFramesRx++;
1251 	if (len < sizeof(*hdr)) {
1252 		sm->dot1xSuppInvalidEapolFramesRx++;
1253 		return 0;
1254 	}
1255 	hdr = (const struct ieee802_1x_hdr *) buf;
1256 	sm->dot1xSuppLastEapolFrameVersion = hdr->version;
1257 	os_memcpy(sm->dot1xSuppLastEapolFrameSource, src, ETH_ALEN);
1258 	if (hdr->version < EAPOL_VERSION) {
1259 		/* TODO: backwards compatibility */
1260 	}
1261 	plen = be_to_host16(hdr->length);
1262 	if (plen > len - sizeof(*hdr)) {
1263 		sm->dot1xSuppEapLengthErrorFramesRx++;
1264 		return 0;
1265 	}
1266 #ifdef CONFIG_WPS
1267 	if (sm->conf.wps && sm->conf.workaround &&
1268 	    plen < len - sizeof(*hdr) &&
1269 	    hdr->type == IEEE802_1X_TYPE_EAP_PACKET &&
1270 	    len - sizeof(*hdr) > sizeof(struct eap_hdr)) {
1271 		const struct eap_hdr *ehdr =
1272 			(const struct eap_hdr *) (hdr + 1);
1273 		u16 elen;
1274 
1275 		elen = be_to_host16(ehdr->length);
1276 		if (elen > plen && elen <= len - sizeof(*hdr)) {
1277 			/*
1278 			 * Buffalo WHR-G125 Ver.1.47 seems to send EAP-WPS
1279 			 * packets with too short EAPOL header length field
1280 			 * (14 octets). This is fixed in firmware Ver.1.49.
1281 			 * As a workaround, fix the EAPOL header based on the
1282 			 * correct length in the EAP packet.
1283 			 */
1284 			wpa_printf(MSG_DEBUG, "EAPOL: Workaround - fix EAPOL "
1285 				   "payload length based on EAP header: "
1286 				   "%d -> %d", (int) plen, elen);
1287 			plen = elen;
1288 		}
1289 	}
1290 #endif /* CONFIG_WPS */
1291 	data_len = plen + sizeof(*hdr);
1292 
1293 	switch (hdr->type) {
1294 	case IEEE802_1X_TYPE_EAP_PACKET:
1295 		if (sm->conf.workaround) {
1296 			/*
1297 			 * An AP has been reported to send out EAP message with
1298 			 * undocumented code 10 at some point near the
1299 			 * completion of EAP authentication. This can result in
1300 			 * issues with the unexpected EAP message triggering
1301 			 * restart of EAPOL authentication. Avoid this by
1302 			 * skipping the message without advancing the state
1303 			 * machine.
1304 			 */
1305 			const struct eap_hdr *ehdr =
1306 				(const struct eap_hdr *) (hdr + 1);
1307 			if (plen >= sizeof(*ehdr) && ehdr->code == 10) {
1308 				wpa_printf(MSG_DEBUG, "EAPOL: Ignore EAP packet with unknown code 10");
1309 				break;
1310 			}
1311 		}
1312 
1313 		if (sm->cached_pmk) {
1314 			/* Trying to use PMKSA caching, but Authenticator did
1315 			 * not seem to have a matching entry. Need to restart
1316 			 * EAPOL state machines.
1317 			 */
1318 			eapol_sm_abort_cached(sm);
1319 		}
1320 		wpabuf_free(sm->eapReqData);
1321 		sm->eapReqData = wpabuf_alloc_copy(hdr + 1, plen);
1322 		if (sm->eapReqData) {
1323 			wpa_printf(MSG_DEBUG, "EAPOL: Received EAP-Packet "
1324 				   "frame");
1325 			sm->eapolEap = TRUE;
1326 #ifdef CONFIG_EAP_PROXY
1327 			if (sm->use_eap_proxy) {
1328 				eap_proxy_packet_update(
1329 					sm->eap_proxy,
1330 					wpabuf_mhead_u8(sm->eapReqData),
1331 					wpabuf_len(sm->eapReqData));
1332 				wpa_printf(MSG_DEBUG, "EAPOL: eap_proxy "
1333 					   "EAP Req updated");
1334 			}
1335 #endif /* CONFIG_EAP_PROXY */
1336 			eapol_sm_step(sm);
1337 		}
1338 		break;
1339 	case IEEE802_1X_TYPE_EAPOL_KEY:
1340 		if (plen < sizeof(*key)) {
1341 			wpa_printf(MSG_DEBUG, "EAPOL: Too short EAPOL-Key "
1342 				   "frame received");
1343 			break;
1344 		}
1345 		key = (const struct ieee802_1x_eapol_key *) (hdr + 1);
1346 		if (key->type == EAPOL_KEY_TYPE_WPA ||
1347 		    key->type == EAPOL_KEY_TYPE_RSN) {
1348 			/* WPA Supplicant takes care of this frame. */
1349 			wpa_printf(MSG_DEBUG, "EAPOL: Ignoring WPA EAPOL-Key "
1350 				   "frame in EAPOL state machines");
1351 			res = 0;
1352 			break;
1353 		}
1354 		if (key->type != EAPOL_KEY_TYPE_RC4) {
1355 			wpa_printf(MSG_DEBUG, "EAPOL: Ignored unknown "
1356 				   "EAPOL-Key type %d", key->type);
1357 			break;
1358 		}
1359 		os_free(sm->last_rx_key);
1360 		sm->last_rx_key = os_malloc(data_len);
1361 		if (sm->last_rx_key) {
1362 			wpa_printf(MSG_DEBUG, "EAPOL: Received EAPOL-Key "
1363 				   "frame");
1364 			os_memcpy(sm->last_rx_key, buf, data_len);
1365 			sm->last_rx_key_len = data_len;
1366 			sm->rxKey = TRUE;
1367 			eapol_sm_step(sm);
1368 		}
1369 		break;
1370 #ifdef CONFIG_MACSEC
1371 	case IEEE802_1X_TYPE_EAPOL_MKA:
1372 		wpa_printf(MSG_EXCESSIVE,
1373 			   "EAPOL type %d will be handled by MKA",
1374 			   hdr->type);
1375 		break;
1376 #endif /* CONFIG_MACSEC */
1377 	default:
1378 		wpa_printf(MSG_DEBUG, "EAPOL: Received unknown EAPOL type %d",
1379 			   hdr->type);
1380 		sm->dot1xSuppInvalidEapolFramesRx++;
1381 		break;
1382 	}
1383 
1384 	return res;
1385 }
1386 
1387 
1388 /**
1389  * eapol_sm_notify_tx_eapol_key - Notification about transmitted EAPOL packet
1390  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1391  *
1392  * Notify EAPOL state machine about transmitted EAPOL packet from an external
1393  * component, e.g., WPA. This will update the statistics.
1394  */
1395 void eapol_sm_notify_tx_eapol_key(struct eapol_sm *sm)
1396 {
1397 	if (sm)
1398 		sm->dot1xSuppEapolFramesTx++;
1399 }
1400 
1401 
1402 /**
1403  * eapol_sm_notify_portEnabled - Notification about portEnabled change
1404  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1405  * @enabled: New portEnabled value
1406  *
1407  * Notify EAPOL state machine about new portEnabled value.
1408  */
1409 void eapol_sm_notify_portEnabled(struct eapol_sm *sm, Boolean enabled)
1410 {
1411 	if (sm == NULL)
1412 		return;
1413 	wpa_printf(MSG_DEBUG, "EAPOL: External notification - "
1414 		   "portEnabled=%d", enabled);
1415 	if (sm->portEnabled != enabled)
1416 		sm->force_authorized_update = TRUE;
1417 	sm->portEnabled = enabled;
1418 	eapol_sm_step(sm);
1419 }
1420 
1421 
1422 /**
1423  * eapol_sm_notify_portValid - Notification about portValid change
1424  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1425  * @valid: New portValid value
1426  *
1427  * Notify EAPOL state machine about new portValid value.
1428  */
1429 void eapol_sm_notify_portValid(struct eapol_sm *sm, Boolean valid)
1430 {
1431 	if (sm == NULL)
1432 		return;
1433 	wpa_printf(MSG_DEBUG, "EAPOL: External notification - "
1434 		   "portValid=%d", valid);
1435 	sm->portValid = valid;
1436 	eapol_sm_step(sm);
1437 }
1438 
1439 
1440 /**
1441  * eapol_sm_notify_eap_success - Notification of external EAP success trigger
1442  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1443  * @success: %TRUE = set success, %FALSE = clear success
1444  *
1445  * Notify the EAPOL state machine that external event has forced EAP state to
1446  * success (success = %TRUE). This can be cleared by setting success = %FALSE.
1447  *
1448  * This function is called to update EAP state when WPA-PSK key handshake has
1449  * been completed successfully since WPA-PSK does not use EAP state machine.
1450  */
1451 void eapol_sm_notify_eap_success(struct eapol_sm *sm, Boolean success)
1452 {
1453 	if (sm == NULL)
1454 		return;
1455 	wpa_printf(MSG_DEBUG, "EAPOL: External notification - "
1456 		   "EAP success=%d", success);
1457 	sm->eapSuccess = success;
1458 	sm->altAccept = success;
1459 	if (success)
1460 		eap_notify_success(sm->eap);
1461 	eapol_sm_step(sm);
1462 }
1463 
1464 
1465 /**
1466  * eapol_sm_notify_eap_fail - Notification of external EAP failure trigger
1467  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1468  * @fail: %TRUE = set failure, %FALSE = clear failure
1469  *
1470  * Notify EAPOL state machine that external event has forced EAP state to
1471  * failure (fail = %TRUE). This can be cleared by setting fail = %FALSE.
1472  */
1473 void eapol_sm_notify_eap_fail(struct eapol_sm *sm, Boolean fail)
1474 {
1475 	if (sm == NULL)
1476 		return;
1477 	wpa_printf(MSG_DEBUG, "EAPOL: External notification - "
1478 		   "EAP fail=%d", fail);
1479 	sm->eapFail = fail;
1480 	sm->altReject = fail;
1481 	eapol_sm_step(sm);
1482 }
1483 
1484 
1485 /**
1486  * eapol_sm_notify_config - Notification of EAPOL configuration change
1487  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1488  * @config: Pointer to current network EAP configuration
1489  * @conf: Pointer to EAPOL configuration data
1490  *
1491  * Notify EAPOL state machine that configuration has changed. config will be
1492  * stored as a backpointer to network configuration. This can be %NULL to clear
1493  * the stored pointed. conf will be copied to local EAPOL/EAP configuration
1494  * data. If conf is %NULL, this part of the configuration change will be
1495  * skipped.
1496  */
1497 void eapol_sm_notify_config(struct eapol_sm *sm,
1498 			    struct eap_peer_config *config,
1499 			    const struct eapol_config *conf)
1500 {
1501 	if (sm == NULL)
1502 		return;
1503 
1504 	sm->config = config;
1505 #ifdef CONFIG_EAP_PROXY
1506 	sm->use_eap_proxy = eap_proxy_notify_config(sm->eap_proxy, config) > 0;
1507 #endif /* CONFIG_EAP_PROXY */
1508 
1509 	if (conf == NULL)
1510 		return;
1511 
1512 	sm->conf.accept_802_1x_keys = conf->accept_802_1x_keys;
1513 	sm->conf.required_keys = conf->required_keys;
1514 	sm->conf.fast_reauth = conf->fast_reauth;
1515 	sm->conf.workaround = conf->workaround;
1516 	sm->conf.wps = conf->wps;
1517 #ifdef CONFIG_EAP_PROXY
1518 	if (sm->use_eap_proxy) {
1519 		/* Using EAP Proxy, so skip EAP state machine update */
1520 		return;
1521 	}
1522 #endif /* CONFIG_EAP_PROXY */
1523 	if (sm->eap) {
1524 		eap_set_fast_reauth(sm->eap, conf->fast_reauth);
1525 		eap_set_workaround(sm->eap, conf->workaround);
1526 		eap_set_force_disabled(sm->eap, conf->eap_disabled);
1527 		eap_set_external_sim(sm->eap, conf->external_sim);
1528 	}
1529 }
1530 
1531 
1532 /**
1533  * eapol_sm_get_key - Get master session key (MSK) from EAP
1534  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1535  * @key: Pointer for key buffer
1536  * @len: Number of bytes to copy to key
1537  * Returns: 0 on success (len of key available), maximum available key len
1538  * (>0) if key is available but it is shorter than len, or -1 on failure.
1539  *
1540  * Fetch EAP keying material (MSK, eapKeyData) from EAP state machine. The key
1541  * is available only after a successful authentication.
1542  */
1543 int eapol_sm_get_key(struct eapol_sm *sm, u8 *key, size_t len)
1544 {
1545 	const u8 *eap_key;
1546 	size_t eap_len;
1547 
1548 #ifdef CONFIG_EAP_PROXY
1549 	if (sm && sm->use_eap_proxy) {
1550 		/* Get key from EAP proxy */
1551 		if (sm == NULL || !eap_proxy_key_available(sm->eap_proxy)) {
1552 			wpa_printf(MSG_DEBUG, "EAPOL: EAP key not available");
1553 			return -1;
1554 		}
1555 		eap_key = eap_proxy_get_eapKeyData(sm->eap_proxy, &eap_len);
1556 		if (eap_key == NULL) {
1557 			wpa_printf(MSG_DEBUG, "EAPOL: Failed to get "
1558 				   "eapKeyData");
1559 			return -1;
1560 		}
1561 		goto key_fetched;
1562 	}
1563 #endif /* CONFIG_EAP_PROXY */
1564 	if (sm == NULL || !eap_key_available(sm->eap)) {
1565 		wpa_printf(MSG_DEBUG, "EAPOL: EAP key not available");
1566 		return -1;
1567 	}
1568 	eap_key = eap_get_eapKeyData(sm->eap, &eap_len);
1569 	if (eap_key == NULL) {
1570 		wpa_printf(MSG_DEBUG, "EAPOL: Failed to get eapKeyData");
1571 		return -1;
1572 	}
1573 #ifdef CONFIG_EAP_PROXY
1574 key_fetched:
1575 #endif /* CONFIG_EAP_PROXY */
1576 	if (len > eap_len) {
1577 		wpa_printf(MSG_DEBUG, "EAPOL: Requested key length (%lu) not "
1578 			   "available (len=%lu)",
1579 			   (unsigned long) len, (unsigned long) eap_len);
1580 		return eap_len;
1581 	}
1582 	os_memcpy(key, eap_key, len);
1583 	wpa_printf(MSG_DEBUG, "EAPOL: Successfully fetched key (len=%lu)",
1584 		   (unsigned long) len);
1585 	return 0;
1586 }
1587 
1588 
1589 /**
1590  * eapol_sm_get_session_id - Get EAP Session-Id
1591  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1592  * @len: Pointer to variable that will be set to number of bytes in the session
1593  * Returns: Pointer to the EAP Session-Id or %NULL on failure
1594  *
1595  * The Session-Id is available only after a successful authentication.
1596  */
1597 const u8 * eapol_sm_get_session_id(struct eapol_sm *sm, size_t *len)
1598 {
1599 	if (sm == NULL || !eap_key_available(sm->eap)) {
1600 		wpa_printf(MSG_DEBUG, "EAPOL: EAP Session-Id not available");
1601 		return NULL;
1602 	}
1603 	return eap_get_eapSessionId(sm->eap, len);
1604 }
1605 
1606 
1607 /**
1608  * eapol_sm_notify_logoff - Notification of logon/logoff commands
1609  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1610  * @logoff: Whether command was logoff
1611  *
1612  * Notify EAPOL state machines that user requested logon/logoff.
1613  */
1614 void eapol_sm_notify_logoff(struct eapol_sm *sm, Boolean logoff)
1615 {
1616 	if (sm) {
1617 		sm->userLogoff = logoff;
1618 		if (!logoff) {
1619 			/* If there is a delayed txStart queued, start now. */
1620 			sm->startWhen = 0;
1621 		}
1622 		eapol_sm_step(sm);
1623 	}
1624 }
1625 
1626 
1627 /**
1628  * eapol_sm_notify_pmkid_attempt - Notification of successful PMKSA caching
1629  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1630  *
1631  * Notify EAPOL state machines that PMKSA caching was successful. This is used
1632  * to move EAPOL and EAP state machines into authenticated/successful state.
1633  */
1634 void eapol_sm_notify_cached(struct eapol_sm *sm)
1635 {
1636 	if (sm == NULL)
1637 		return;
1638 	wpa_printf(MSG_DEBUG, "EAPOL: PMKSA caching was used - skip EAPOL");
1639 	sm->eapSuccess = TRUE;
1640 	eap_notify_success(sm->eap);
1641 	eapol_sm_step(sm);
1642 }
1643 
1644 
1645 /**
1646  * eapol_sm_notify_pmkid_attempt - Notification of PMKSA caching
1647  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1648  *
1649  * Notify EAPOL state machines if PMKSA caching is used.
1650  */
1651 void eapol_sm_notify_pmkid_attempt(struct eapol_sm *sm)
1652 {
1653 	if (sm == NULL)
1654 		return;
1655 	wpa_printf(MSG_DEBUG, "RSN: Trying to use cached PMKSA");
1656 	sm->cached_pmk = TRUE;
1657 }
1658 
1659 
1660 static void eapol_sm_abort_cached(struct eapol_sm *sm)
1661 {
1662 	wpa_printf(MSG_DEBUG, "RSN: Authenticator did not accept PMKID, "
1663 		   "doing full EAP authentication");
1664 	if (sm == NULL)
1665 		return;
1666 	sm->cached_pmk = FALSE;
1667 	sm->SUPP_PAE_state = SUPP_PAE_CONNECTING;
1668 	eapol_sm_set_port_unauthorized(sm);
1669 
1670 	/* Make sure we do not start sending EAPOL-Start frames first, but
1671 	 * instead move to RESTART state to start EAPOL authentication. */
1672 	sm->startWhen = 3;
1673 	eapol_enable_timer_tick(sm);
1674 
1675 	if (sm->ctx->aborted_cached)
1676 		sm->ctx->aborted_cached(sm->ctx->ctx);
1677 }
1678 
1679 
1680 /**
1681  * eapol_sm_register_scard_ctx - Notification of smart card context
1682  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1683  * @ctx: Context data for smart card operations
1684  *
1685  * Notify EAPOL state machines of context data for smart card operations. This
1686  * context data will be used as a parameter for scard_*() functions.
1687  */
1688 void eapol_sm_register_scard_ctx(struct eapol_sm *sm, void *ctx)
1689 {
1690 	if (sm) {
1691 		sm->ctx->scard_ctx = ctx;
1692 		eap_register_scard_ctx(sm->eap, ctx);
1693 	}
1694 }
1695 
1696 
1697 /**
1698  * eapol_sm_notify_portControl - Notification of portControl changes
1699  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1700  * @portControl: New value for portControl variable
1701  *
1702  * Notify EAPOL state machines that portControl variable has changed.
1703  */
1704 void eapol_sm_notify_portControl(struct eapol_sm *sm, PortControl portControl)
1705 {
1706 	if (sm == NULL)
1707 		return;
1708 	wpa_printf(MSG_DEBUG, "EAPOL: External notification - "
1709 		   "portControl=%s", eapol_port_control(portControl));
1710 	sm->portControl = portControl;
1711 	eapol_sm_step(sm);
1712 }
1713 
1714 
1715 /**
1716  * eapol_sm_notify_ctrl_attached - Notification of attached monitor
1717  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1718  *
1719  * Notify EAPOL state machines that a monitor was attached to the control
1720  * interface to trigger re-sending of pending requests for user input.
1721  */
1722 void eapol_sm_notify_ctrl_attached(struct eapol_sm *sm)
1723 {
1724 	if (sm == NULL)
1725 		return;
1726 	eap_sm_notify_ctrl_attached(sm->eap);
1727 }
1728 
1729 
1730 /**
1731  * eapol_sm_notify_ctrl_response - Notification of received user input
1732  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1733  *
1734  * Notify EAPOL state machines that a control response, i.e., user
1735  * input, was received in order to trigger retrying of a pending EAP request.
1736  */
1737 void eapol_sm_notify_ctrl_response(struct eapol_sm *sm)
1738 {
1739 	if (sm == NULL)
1740 		return;
1741 	if (sm->eapReqData && !sm->eapReq) {
1742 		wpa_printf(MSG_DEBUG, "EAPOL: received control response (user "
1743 			   "input) notification - retrying pending EAP "
1744 			   "Request");
1745 		sm->eapolEap = TRUE;
1746 		sm->eapReq = TRUE;
1747 		eapol_sm_step(sm);
1748 	}
1749 }
1750 
1751 
1752 /**
1753  * eapol_sm_request_reauth - Request reauthentication
1754  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1755  *
1756  * This function can be used to request EAPOL reauthentication, e.g., when the
1757  * current PMKSA entry is nearing expiration.
1758  */
1759 void eapol_sm_request_reauth(struct eapol_sm *sm)
1760 {
1761 	if (sm == NULL || sm->SUPP_PAE_state != SUPP_PAE_AUTHENTICATED)
1762 		return;
1763 	eapol_sm_txStart(sm);
1764 }
1765 
1766 
1767 /**
1768  * eapol_sm_notify_lower_layer_success - Notification of lower layer success
1769  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1770  * @in_eapol_sm: Whether the caller is already running inside EAPOL state
1771  * machine loop (eapol_sm_step())
1772  *
1773  * Notify EAPOL (and EAP) state machines that a lower layer has detected a
1774  * successful authentication. This is used to recover from dropped EAP-Success
1775  * messages.
1776  */
1777 void eapol_sm_notify_lower_layer_success(struct eapol_sm *sm, int in_eapol_sm)
1778 {
1779 	if (sm == NULL)
1780 		return;
1781 	eap_notify_lower_layer_success(sm->eap);
1782 	if (!in_eapol_sm)
1783 		eapol_sm_step(sm);
1784 }
1785 
1786 
1787 /**
1788  * eapol_sm_invalidate_cached_session - Mark cached EAP session data invalid
1789  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
1790  */
1791 void eapol_sm_invalidate_cached_session(struct eapol_sm *sm)
1792 {
1793 	if (sm)
1794 		eap_invalidate_cached_session(sm->eap);
1795 }
1796 
1797 
1798 static struct eap_peer_config * eapol_sm_get_config(void *ctx)
1799 {
1800 	struct eapol_sm *sm = ctx;
1801 	return sm ? sm->config : NULL;
1802 }
1803 
1804 
1805 static struct wpabuf * eapol_sm_get_eapReqData(void *ctx)
1806 {
1807 	struct eapol_sm *sm = ctx;
1808 	if (sm == NULL || sm->eapReqData == NULL)
1809 		return NULL;
1810 
1811 	return sm->eapReqData;
1812 }
1813 
1814 
1815 static Boolean eapol_sm_get_bool(void *ctx, enum eapol_bool_var variable)
1816 {
1817 	struct eapol_sm *sm = ctx;
1818 	if (sm == NULL)
1819 		return FALSE;
1820 	switch (variable) {
1821 	case EAPOL_eapSuccess:
1822 		return sm->eapSuccess;
1823 	case EAPOL_eapRestart:
1824 		return sm->eapRestart;
1825 	case EAPOL_eapFail:
1826 		return sm->eapFail;
1827 	case EAPOL_eapResp:
1828 		return sm->eapResp;
1829 	case EAPOL_eapNoResp:
1830 		return sm->eapNoResp;
1831 	case EAPOL_eapReq:
1832 		return sm->eapReq;
1833 	case EAPOL_portEnabled:
1834 		return sm->portEnabled;
1835 	case EAPOL_altAccept:
1836 		return sm->altAccept;
1837 	case EAPOL_altReject:
1838 		return sm->altReject;
1839 	case EAPOL_eapTriggerStart:
1840 		return sm->eapTriggerStart;
1841 	}
1842 	return FALSE;
1843 }
1844 
1845 
1846 static void eapol_sm_set_bool(void *ctx, enum eapol_bool_var variable,
1847 			      Boolean value)
1848 {
1849 	struct eapol_sm *sm = ctx;
1850 	if (sm == NULL)
1851 		return;
1852 	switch (variable) {
1853 	case EAPOL_eapSuccess:
1854 		sm->eapSuccess = value;
1855 		break;
1856 	case EAPOL_eapRestart:
1857 		sm->eapRestart = value;
1858 		break;
1859 	case EAPOL_eapFail:
1860 		sm->eapFail = value;
1861 		break;
1862 	case EAPOL_eapResp:
1863 		sm->eapResp = value;
1864 		break;
1865 	case EAPOL_eapNoResp:
1866 		sm->eapNoResp = value;
1867 		break;
1868 	case EAPOL_eapReq:
1869 		sm->eapReq = value;
1870 		break;
1871 	case EAPOL_portEnabled:
1872 		sm->portEnabled = value;
1873 		break;
1874 	case EAPOL_altAccept:
1875 		sm->altAccept = value;
1876 		break;
1877 	case EAPOL_altReject:
1878 		sm->altReject = value;
1879 		break;
1880 	case EAPOL_eapTriggerStart:
1881 		sm->eapTriggerStart = value;
1882 		break;
1883 	}
1884 }
1885 
1886 
1887 static unsigned int eapol_sm_get_int(void *ctx, enum eapol_int_var variable)
1888 {
1889 	struct eapol_sm *sm = ctx;
1890 	if (sm == NULL)
1891 		return 0;
1892 	switch (variable) {
1893 	case EAPOL_idleWhile:
1894 		return sm->idleWhile;
1895 	}
1896 	return 0;
1897 }
1898 
1899 
1900 static void eapol_sm_set_int(void *ctx, enum eapol_int_var variable,
1901 			     unsigned int value)
1902 {
1903 	struct eapol_sm *sm = ctx;
1904 	if (sm == NULL)
1905 		return;
1906 	switch (variable) {
1907 	case EAPOL_idleWhile:
1908 		sm->idleWhile = value;
1909 		if (sm->idleWhile > 0)
1910 			eapol_enable_timer_tick(sm);
1911 		break;
1912 	}
1913 }
1914 
1915 
1916 static void eapol_sm_set_config_blob(void *ctx, struct wpa_config_blob *blob)
1917 {
1918 #ifndef CONFIG_NO_CONFIG_BLOBS
1919 	struct eapol_sm *sm = ctx;
1920 	if (sm && sm->ctx && sm->ctx->set_config_blob)
1921 		sm->ctx->set_config_blob(sm->ctx->ctx, blob);
1922 #endif /* CONFIG_NO_CONFIG_BLOBS */
1923 }
1924 
1925 
1926 static const struct wpa_config_blob *
1927 eapol_sm_get_config_blob(void *ctx, const char *name)
1928 {
1929 #ifndef CONFIG_NO_CONFIG_BLOBS
1930 	struct eapol_sm *sm = ctx;
1931 	if (sm && sm->ctx && sm->ctx->get_config_blob)
1932 		return sm->ctx->get_config_blob(sm->ctx->ctx, name);
1933 	else
1934 		return NULL;
1935 #else /* CONFIG_NO_CONFIG_BLOBS */
1936 	return NULL;
1937 #endif /* CONFIG_NO_CONFIG_BLOBS */
1938 }
1939 
1940 
1941 static void eapol_sm_notify_pending(void *ctx)
1942 {
1943 	struct eapol_sm *sm = ctx;
1944 	if (sm == NULL)
1945 		return;
1946 	if (sm->eapReqData && !sm->eapReq) {
1947 		wpa_printf(MSG_DEBUG, "EAPOL: received notification from EAP "
1948 			   "state machine - retrying pending EAP Request");
1949 		sm->eapolEap = TRUE;
1950 		sm->eapReq = TRUE;
1951 		eapol_sm_step(sm);
1952 	}
1953 }
1954 
1955 
1956 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
1957 static void eapol_sm_eap_param_needed(void *ctx, enum wpa_ctrl_req_type field,
1958 				      const char *txt)
1959 {
1960 	struct eapol_sm *sm = ctx;
1961 	wpa_printf(MSG_DEBUG, "EAPOL: EAP parameter needed");
1962 	if (sm->ctx->eap_param_needed)
1963 		sm->ctx->eap_param_needed(sm->ctx->ctx, field, txt);
1964 }
1965 #else /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
1966 #define eapol_sm_eap_param_needed NULL
1967 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
1968 
1969 static void eapol_sm_notify_cert(void *ctx, int depth, const char *subject,
1970 				 const char *altsubject[],
1971 				 int num_altsubject, const char *cert_hash,
1972 				 const struct wpabuf *cert)
1973 {
1974 	struct eapol_sm *sm = ctx;
1975 	if (sm->ctx->cert_cb)
1976 		sm->ctx->cert_cb(sm->ctx->ctx, depth, subject, altsubject,
1977 				 num_altsubject, cert_hash, cert);
1978 }
1979 
1980 
1981 static void eapol_sm_notify_status(void *ctx, const char *status,
1982 				   const char *parameter)
1983 {
1984 	struct eapol_sm *sm = ctx;
1985 
1986 	if (sm->ctx->status_cb)
1987 		sm->ctx->status_cb(sm->ctx->ctx, status, parameter);
1988 }
1989 
1990 
1991 #ifdef CONFIG_EAP_PROXY
1992 static void eapol_sm_eap_proxy_cb(void *ctx)
1993 {
1994 	struct eapol_sm *sm = ctx;
1995 
1996 	if (sm->ctx->eap_proxy_cb)
1997 		sm->ctx->eap_proxy_cb(sm->ctx->ctx);
1998 }
1999 #endif /* CONFIG_EAP_PROXY */
2000 
2001 
2002 static void eapol_sm_set_anon_id(void *ctx, const u8 *id, size_t len)
2003 {
2004 	struct eapol_sm *sm = ctx;
2005 
2006 	if (sm->ctx->set_anon_id)
2007 		sm->ctx->set_anon_id(sm->ctx->ctx, id, len);
2008 }
2009 
2010 
2011 static const struct eapol_callbacks eapol_cb =
2012 {
2013 	eapol_sm_get_config,
2014 	eapol_sm_get_bool,
2015 	eapol_sm_set_bool,
2016 	eapol_sm_get_int,
2017 	eapol_sm_set_int,
2018 	eapol_sm_get_eapReqData,
2019 	eapol_sm_set_config_blob,
2020 	eapol_sm_get_config_blob,
2021 	eapol_sm_notify_pending,
2022 	eapol_sm_eap_param_needed,
2023 	eapol_sm_notify_cert,
2024 	eapol_sm_notify_status,
2025 #ifdef CONFIG_EAP_PROXY
2026 	eapol_sm_eap_proxy_cb,
2027 #endif /* CONFIG_EAP_PROXY */
2028 	eapol_sm_set_anon_id
2029 };
2030 
2031 
2032 /**
2033  * eapol_sm_init - Initialize EAPOL state machine
2034  * @ctx: Pointer to EAPOL context data; this needs to be an allocated buffer
2035  * and EAPOL state machine will free it in eapol_sm_deinit()
2036  * Returns: Pointer to the allocated EAPOL state machine or %NULL on failure
2037  *
2038  * Allocate and initialize an EAPOL state machine.
2039  */
2040 struct eapol_sm *eapol_sm_init(struct eapol_ctx *ctx)
2041 {
2042 	struct eapol_sm *sm;
2043 	struct eap_config conf;
2044 	sm = os_zalloc(sizeof(*sm));
2045 	if (sm == NULL)
2046 		return NULL;
2047 	sm->ctx = ctx;
2048 
2049 	sm->portControl = Auto;
2050 
2051 	/* Supplicant PAE state machine */
2052 	sm->heldPeriod = 60;
2053 	sm->startPeriod = 30;
2054 	sm->maxStart = 3;
2055 
2056 	/* Supplicant Backend state machine */
2057 	sm->authPeriod = 30;
2058 
2059 	os_memset(&conf, 0, sizeof(conf));
2060 	conf.opensc_engine_path = ctx->opensc_engine_path;
2061 	conf.pkcs11_engine_path = ctx->pkcs11_engine_path;
2062 	conf.pkcs11_module_path = ctx->pkcs11_module_path;
2063 	conf.openssl_ciphers = ctx->openssl_ciphers;
2064 	conf.wps = ctx->wps;
2065 	conf.cert_in_cb = ctx->cert_in_cb;
2066 
2067 	sm->eap = eap_peer_sm_init(sm, &eapol_cb, sm->ctx->msg_ctx, &conf);
2068 	if (sm->eap == NULL) {
2069 		os_free(sm);
2070 		return NULL;
2071 	}
2072 
2073 #ifdef CONFIG_EAP_PROXY
2074 	sm->use_eap_proxy = FALSE;
2075 	sm->eap_proxy = eap_proxy_init(sm, &eapol_cb, sm->ctx->msg_ctx);
2076 	if (sm->eap_proxy == NULL) {
2077 		wpa_printf(MSG_ERROR, "Unable to initialize EAP Proxy");
2078 	}
2079 #endif /* CONFIG_EAP_PROXY */
2080 
2081 	/* Initialize EAPOL state machines */
2082 	sm->force_authorized_update = TRUE;
2083 	sm->initialize = TRUE;
2084 	eapol_sm_step(sm);
2085 	sm->initialize = FALSE;
2086 	eapol_sm_step(sm);
2087 
2088 	sm->timer_tick_enabled = 1;
2089 	eloop_register_timeout(1, 0, eapol_port_timers_tick, NULL, sm);
2090 
2091 	return sm;
2092 }
2093 
2094 
2095 /**
2096  * eapol_sm_deinit - Deinitialize EAPOL state machine
2097  * @sm: Pointer to EAPOL state machine allocated with eapol_sm_init()
2098  *
2099  * Deinitialize and free EAPOL state machine.
2100  */
2101 void eapol_sm_deinit(struct eapol_sm *sm)
2102 {
2103 	if (sm == NULL)
2104 		return;
2105 	eloop_cancel_timeout(eapol_sm_step_timeout, NULL, sm);
2106 	eloop_cancel_timeout(eapol_port_timers_tick, NULL, sm);
2107 	eap_peer_sm_deinit(sm->eap);
2108 #ifdef CONFIG_EAP_PROXY
2109 	eap_proxy_deinit(sm->eap_proxy);
2110 #endif /* CONFIG_EAP_PROXY */
2111 	os_free(sm->last_rx_key);
2112 	wpabuf_free(sm->eapReqData);
2113 	os_free(sm->ctx);
2114 	os_free(sm);
2115 }
2116 
2117 
2118 void eapol_sm_set_ext_pw_ctx(struct eapol_sm *sm,
2119 			     struct ext_password_data *ext)
2120 {
2121 	if (sm && sm->eap)
2122 		eap_sm_set_ext_pw_ctx(sm->eap, ext);
2123 }
2124 
2125 
2126 int eapol_sm_failed(struct eapol_sm *sm)
2127 {
2128 	if (sm == NULL)
2129 		return 0;
2130 	return !sm->eapSuccess && sm->eapFail;
2131 }
2132 
2133 
2134 int eapol_sm_get_eap_proxy_imsi(struct eapol_sm *sm, char *imsi, size_t *len)
2135 {
2136 #ifdef CONFIG_EAP_PROXY
2137 	if (sm->eap_proxy == NULL)
2138 		return -1;
2139 	return eap_proxy_get_imsi(sm->eap_proxy, imsi, len);
2140 #else /* CONFIG_EAP_PROXY */
2141 	return -1;
2142 #endif /* CONFIG_EAP_PROXY */
2143 }
2144 
2145 
2146 void eapol_sm_erp_flush(struct eapol_sm *sm)
2147 {
2148 	if (sm)
2149 		eap_peer_erp_free_keys(sm->eap);
2150 }
2151