2015-10-30 11:12:13 +01:00
|
|
|
/*
|
|
|
|
*
|
|
|
|
* Wireless daemon for Linux
|
|
|
|
*
|
2018-11-16 23:15:32 +01:00
|
|
|
* Copyright (C) 2013-2018 Intel Corporation. All rights reserved.
|
2015-10-30 11:12:13 +01:00
|
|
|
*
|
|
|
|
* This library is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
|
|
* License as published by the Free Software Foundation; either
|
|
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This library is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
|
* Lesser General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
|
|
* License along with this library; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
|
|
|
|
*
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifdef HAVE_CONFIG_H
|
|
|
|
#include <config.h>
|
|
|
|
#endif
|
|
|
|
|
2018-11-01 22:37:11 +01:00
|
|
|
#define _GNU_SOURCE
|
2015-10-30 11:12:13 +01:00
|
|
|
#include <stdio.h>
|
|
|
|
#include <errno.h>
|
2018-11-01 22:37:11 +01:00
|
|
|
#include <string.h>
|
2015-10-30 11:12:13 +01:00
|
|
|
#include <ell/ell.h>
|
|
|
|
|
2019-04-03 18:34:22 +02:00
|
|
|
#include "src/missing.h"
|
|
|
|
#include "src/eap.h"
|
|
|
|
#include "src/eap-private.h"
|
2015-10-30 11:12:13 +01:00
|
|
|
|
2016-11-15 23:44:07 +01:00
|
|
|
static uint32_t default_mtu;
|
2015-10-30 11:12:13 +01:00
|
|
|
struct l_queue *eap_methods;
|
|
|
|
|
2018-05-18 17:29:58 +02:00
|
|
|
static void dump_eap(const char *str, void *user_data)
|
|
|
|
{
|
|
|
|
const char *prefix = user_data;
|
|
|
|
|
|
|
|
l_info("%s%s\n", prefix, str);
|
|
|
|
}
|
|
|
|
|
2015-10-30 11:12:13 +01:00
|
|
|
struct eap_state {
|
|
|
|
eap_tx_packet_func_t tx_packet;
|
|
|
|
eap_key_material_func_t set_key_material;
|
|
|
|
eap_complete_func_t complete;
|
2016-09-12 22:26:03 +02:00
|
|
|
eap_event_func_t event_func;
|
2015-10-30 11:12:13 +01:00
|
|
|
void *user_data;
|
|
|
|
size_t mtu;
|
|
|
|
|
|
|
|
struct eap_method *method;
|
|
|
|
char *identity;
|
|
|
|
|
|
|
|
int last_id;
|
|
|
|
void *method_state;
|
|
|
|
bool method_success;
|
|
|
|
struct l_timeout *complete_timeout;
|
2018-02-23 18:48:44 +01:00
|
|
|
|
|
|
|
bool discard_success_and_failure:1;
|
2015-10-30 11:12:13 +01:00
|
|
|
};
|
|
|
|
|
|
|
|
struct eap_state *eap_new(eap_tx_packet_func_t tx_packet,
|
|
|
|
eap_complete_func_t complete, void *user_data)
|
|
|
|
{
|
|
|
|
struct eap_state *eap;
|
|
|
|
|
|
|
|
eap = l_new(struct eap_state, 1);
|
|
|
|
|
|
|
|
eap->last_id = -1;
|
2016-11-15 23:44:07 +01:00
|
|
|
eap->mtu = default_mtu;
|
2015-10-30 11:12:13 +01:00
|
|
|
|
|
|
|
eap->tx_packet = tx_packet;
|
|
|
|
eap->complete = complete;
|
|
|
|
eap->user_data = user_data;
|
|
|
|
|
|
|
|
return eap;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Setting a non-NULL set_key_material callback for this EAP instance will
|
|
|
|
* disable the legacy methods that don't generate key material, such
|
|
|
|
* as EAP-MD5.
|
|
|
|
*/
|
|
|
|
void eap_set_key_material_func(struct eap_state *eap,
|
|
|
|
eap_key_material_func_t func)
|
|
|
|
{
|
|
|
|
eap->set_key_material = func;
|
|
|
|
}
|
|
|
|
|
2016-09-12 22:26:03 +02:00
|
|
|
void eap_set_event_func(struct eap_state *eap, eap_event_func_t func)
|
|
|
|
{
|
|
|
|
eap->event_func = func;
|
|
|
|
}
|
|
|
|
|
2018-05-30 21:52:22 +02:00
|
|
|
bool eap_reset(struct eap_state *eap)
|
|
|
|
{
|
|
|
|
if (eap->method_state && eap->method->reset_state) {
|
|
|
|
if (!eap->method->reset_state(eap))
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
eap->method_success = false;
|
|
|
|
l_timeout_remove(eap->complete_timeout);
|
|
|
|
eap->complete_timeout = NULL;
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2019-04-08 23:24:18 +02:00
|
|
|
static void eap_free_common(struct eap_state *eap)
|
2015-10-30 11:12:13 +01:00
|
|
|
{
|
2018-01-23 20:42:44 +01:00
|
|
|
if (eap->method_state && eap->method->free)
|
2017-09-06 04:12:17 +02:00
|
|
|
eap->method->free(eap);
|
2015-10-30 11:12:13 +01:00
|
|
|
|
2019-04-08 23:24:18 +02:00
|
|
|
eap->method = NULL;
|
|
|
|
|
|
|
|
if (eap->identity) {
|
2015-10-30 11:12:13 +01:00
|
|
|
l_free(eap->identity);
|
2019-04-08 23:24:18 +02:00
|
|
|
eap->identity = NULL;
|
|
|
|
}
|
|
|
|
}
|
2015-10-30 11:12:13 +01:00
|
|
|
|
2019-04-08 23:24:18 +02:00
|
|
|
void eap_free(struct eap_state *eap)
|
|
|
|
{
|
|
|
|
eap_free_common(eap);
|
2015-10-30 11:12:13 +01:00
|
|
|
l_timeout_remove(eap->complete_timeout);
|
|
|
|
|
|
|
|
l_free(eap);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Note: callers must check for a minimum value */
|
|
|
|
void eap_set_mtu(struct eap_state *eap, size_t mtu)
|
|
|
|
{
|
|
|
|
eap->mtu = mtu;
|
|
|
|
}
|
|
|
|
|
|
|
|
size_t eap_get_mtu(struct eap_state *eap)
|
|
|
|
{
|
|
|
|
return eap->mtu;
|
|
|
|
}
|
|
|
|
|
2016-08-10 21:30:57 +02:00
|
|
|
/**
|
|
|
|
* eap_send_response:
|
|
|
|
* @eap: EAP state
|
|
|
|
* @type: Type of response being sent
|
|
|
|
* @buf: Buffer to send
|
|
|
|
* @len: Size of the buffer
|
|
|
|
*
|
|
|
|
* Sends out a response to a received request. This method first fills the
|
|
|
|
* EAP header into the buffer based on the EAP type response being sent.
|
|
|
|
*
|
|
|
|
* If the response type is EAP_TYPE_EXPANDED, then the Vendor-Id and
|
|
|
|
* Vendor-Type fields are filled in based on contents of the eap_method
|
|
|
|
* associated with @eap.
|
|
|
|
*
|
|
|
|
* The buffer passed in MUST be at least 12 bytes long if @type is
|
|
|
|
* EAP_TYPE_EXPANDED and at least 5 bytes for other cases.
|
|
|
|
**/
|
|
|
|
void eap_send_response(struct eap_state *eap, enum eap_type type,
|
|
|
|
uint8_t *buf, size_t len)
|
2015-10-30 11:12:13 +01:00
|
|
|
{
|
|
|
|
buf[0] = EAP_CODE_RESPONSE;
|
|
|
|
buf[1] = eap->last_id;
|
|
|
|
l_put_be16(len, &buf[2]);
|
2016-08-10 21:30:57 +02:00
|
|
|
buf[4] = type;
|
|
|
|
|
|
|
|
if (type == EAP_TYPE_EXPANDED) {
|
|
|
|
memcpy(buf + 5, eap->method->vendor_id, 3);
|
|
|
|
l_put_be32(eap->method->vendor_type, buf + 8);
|
|
|
|
}
|
2015-10-30 11:12:13 +01:00
|
|
|
|
|
|
|
eap->tx_packet(buf, len, eap->user_data);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void eap_complete_timeout(struct l_timeout *timeout, void *user_data)
|
|
|
|
{
|
|
|
|
struct eap_state *eap = user_data;
|
|
|
|
|
|
|
|
eap->complete_timeout = NULL;
|
|
|
|
|
|
|
|
eap->complete(eap->method_success ? EAP_RESULT_SUCCESS :
|
|
|
|
EAP_RESULT_TIMEOUT, eap->user_data);
|
|
|
|
}
|
|
|
|
|
|
|
|
void eap_start_complete_timeout(struct eap_state *eap)
|
|
|
|
{
|
|
|
|
if (eap->complete_timeout)
|
|
|
|
l_timeout_remove(eap->complete_timeout);
|
|
|
|
|
|
|
|
eap->complete_timeout = l_timeout_create(5, eap_complete_timeout,
|
|
|
|
eap, NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void eap_send_identity_response(struct eap_state *eap, char *identity)
|
|
|
|
{
|
|
|
|
int len = identity ? strlen(identity) : 0;
|
|
|
|
uint8_t buf[5 + len];
|
|
|
|
|
|
|
|
if (!identity)
|
|
|
|
identity = "";
|
|
|
|
|
|
|
|
memcpy(buf + 5, identity, len);
|
|
|
|
|
|
|
|
eap_send_response(eap, EAP_TYPE_IDENTITY, buf, len + 5);
|
|
|
|
}
|
|
|
|
|
2018-02-14 01:00:40 +01:00
|
|
|
void __eap_handle_request(struct eap_state *eap, uint16_t id,
|
2015-10-30 11:12:13 +01:00
|
|
|
const uint8_t *pkt, size_t len)
|
|
|
|
{
|
2016-08-10 20:06:47 +02:00
|
|
|
enum eap_type type;
|
2015-10-30 11:12:13 +01:00
|
|
|
uint8_t buf[10];
|
|
|
|
int buf_len;
|
2018-05-18 17:27:42 +02:00
|
|
|
bool retransmit;
|
2015-10-30 11:12:13 +01:00
|
|
|
|
|
|
|
if (len < 1)
|
|
|
|
/* Invalid packets to be ignored */
|
|
|
|
return;
|
|
|
|
|
2017-05-22 10:49:49 +02:00
|
|
|
type = pkt[0];
|
|
|
|
if (type >= __EAP_TYPE_MIN_METHOD && !eap->method) {
|
|
|
|
l_warn("EAP server tried method %i while client had no method "
|
|
|
|
"configured", type);
|
|
|
|
|
|
|
|
goto unsupported_method;
|
|
|
|
}
|
|
|
|
|
2018-05-18 17:27:42 +02:00
|
|
|
retransmit = id == eap->last_id ? true : false;
|
2016-11-29 23:31:22 +01:00
|
|
|
eap->last_id = id;
|
2015-10-30 11:12:13 +01:00
|
|
|
|
|
|
|
if (type >= __EAP_TYPE_MIN_METHOD) {
|
2018-05-18 17:27:42 +02:00
|
|
|
void (*op)(struct eap_state *eap,
|
|
|
|
const uint8_t *pkt, size_t len);
|
|
|
|
|
2017-05-22 10:49:49 +02:00
|
|
|
if (type != eap->method->request_type) {
|
2015-10-30 11:12:13 +01:00
|
|
|
l_warn("EAP server tried method %i while client was "
|
|
|
|
"configured for method %i",
|
|
|
|
type, eap->method->request_type);
|
|
|
|
|
|
|
|
goto unsupported_method;
|
|
|
|
}
|
|
|
|
|
2018-05-18 17:27:42 +02:00
|
|
|
op = retransmit && eap->method->handle_retransmit ?
|
|
|
|
eap->method->handle_retransmit :
|
|
|
|
eap->method->handle_request;
|
|
|
|
|
2016-08-25 04:32:16 +02:00
|
|
|
if (type != EAP_TYPE_EXPANDED) {
|
2016-11-29 23:31:22 +01:00
|
|
|
op(eap, pkt + 1, len - 1);
|
2016-08-25 04:32:16 +02:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2016-08-10 21:30:57 +02:00
|
|
|
/*
|
|
|
|
* TODO: Handle Expanded Nak if our vendor-id / vendor-types
|
|
|
|
* don't match
|
|
|
|
*/
|
2016-08-25 04:32:16 +02:00
|
|
|
if (len < 8)
|
|
|
|
return;
|
2015-10-30 11:12:13 +01:00
|
|
|
|
2016-11-29 23:31:22 +01:00
|
|
|
op(eap, pkt + 8, len - 8);
|
2015-10-30 11:12:13 +01:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
switch (type) {
|
|
|
|
case EAP_TYPE_IDENTITY:
|
|
|
|
if (len >= 2)
|
2018-09-07 19:25:20 +02:00
|
|
|
l_debug("Optional EAP server identity prompt: \"%.*s\"",
|
2018-05-18 16:46:12 +02:00
|
|
|
(int) len - 1, pkt + 1);
|
2015-10-30 11:12:13 +01:00
|
|
|
|
|
|
|
eap_send_identity_response(eap, eap->identity);
|
|
|
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
case EAP_TYPE_NOTIFICATION:
|
|
|
|
if (len < 2)
|
|
|
|
/* Invalid packets to be ignored */
|
|
|
|
return;
|
|
|
|
|
2018-05-18 16:46:12 +02:00
|
|
|
l_warn("EAP notification: \"%.*s\"", (int) len - 1, pkt + 1);
|
2015-10-30 11:12:13 +01:00
|
|
|
|
|
|
|
eap_send_response(eap, EAP_TYPE_NOTIFICATION, buf, 5);
|
|
|
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
default:
|
|
|
|
unsupported_method:
|
2018-05-18 17:29:58 +02:00
|
|
|
if (!eap->method) {
|
|
|
|
l_info("Received an unhandled EAP packet:");
|
|
|
|
l_util_hexdump(true, pkt, len, dump_eap, "[EAP] ");
|
|
|
|
}
|
|
|
|
|
2015-10-30 11:12:13 +01:00
|
|
|
/* Send a legacy NAK response */
|
|
|
|
buf_len = 5;
|
|
|
|
|
2016-08-10 21:30:57 +02:00
|
|
|
/*
|
|
|
|
* RFC3748, Section 5.3.1: "A peer supporting Expanded Types
|
|
|
|
* that receives a Request for an unacceptable authentication
|
|
|
|
* Type (4-253,255) MAY include the value 254 in the Nak
|
|
|
|
* Response (Type 3) to indicate the desire for an Expanded
|
|
|
|
* authentication Type."
|
|
|
|
*/
|
2015-10-30 11:12:13 +01:00
|
|
|
buf[buf_len++] = eap->method ? eap->method->request_type : 0;
|
|
|
|
|
|
|
|
eap_send_response(eap, EAP_TYPE_NAK, buf, buf_len);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
void eap_rx_packet(struct eap_state *eap, const uint8_t *pkt, size_t len)
|
|
|
|
{
|
|
|
|
uint8_t code, id;
|
|
|
|
uint16_t eap_len;
|
|
|
|
|
|
|
|
if (len < 4 || l_get_be16(&pkt[2]) < 4 || len < l_get_be16(&pkt[2]))
|
|
|
|
/* Invalid packets to be silently discarded */
|
|
|
|
return;
|
|
|
|
|
|
|
|
code = pkt[0];
|
|
|
|
id = pkt[1];
|
|
|
|
eap_len = l_get_be16(&pkt[2]);
|
|
|
|
|
2016-08-10 20:06:47 +02:00
|
|
|
switch ((enum eap_code) code) {
|
2015-10-30 11:12:13 +01:00
|
|
|
case EAP_CODE_REQUEST:
|
2018-02-14 01:00:40 +01:00
|
|
|
__eap_handle_request(eap, id, pkt + 4, eap_len - 4);
|
2015-10-30 11:12:13 +01:00
|
|
|
return;
|
|
|
|
|
|
|
|
case EAP_CODE_FAILURE:
|
|
|
|
case EAP_CODE_SUCCESS:
|
2018-02-23 18:48:44 +01:00
|
|
|
if (eap->discard_success_and_failure)
|
|
|
|
return;
|
|
|
|
|
2015-10-30 11:12:13 +01:00
|
|
|
l_timeout_remove(eap->complete_timeout);
|
|
|
|
eap->complete_timeout = NULL;
|
|
|
|
|
2018-02-15 19:49:08 +01:00
|
|
|
/* RFC3748, Section 4.2
|
|
|
|
*
|
|
|
|
* The Identifier field of the Success and Failure packets
|
|
|
|
* MUST match the Identifier field of the Response packet that
|
|
|
|
* it is sent in response to. However, many currently deployed
|
|
|
|
* implementations ignore this rule and increment Identity for
|
|
|
|
* the Success and Failure packets. In order to support
|
|
|
|
* interoperability with these products we validate id against
|
|
|
|
* eap->last_id and its incremented value.
|
|
|
|
*/
|
|
|
|
if (id != eap->last_id && id != eap->last_id + 1)
|
2015-10-30 11:12:13 +01:00
|
|
|
return;
|
|
|
|
|
|
|
|
if (eap_len != 4)
|
|
|
|
/* Invalid packets to be silently discarded */
|
|
|
|
return;
|
|
|
|
|
|
|
|
if (code == EAP_CODE_SUCCESS && !eap->method_success)
|
|
|
|
/* "Canned" success packets to be discarded */
|
|
|
|
return;
|
|
|
|
|
|
|
|
if (code == EAP_CODE_FAILURE && eap->method_success)
|
|
|
|
/*
|
|
|
|
* "On the peer, after success result indications have
|
|
|
|
* been exchanged by both sides, a Failure packet MUST
|
|
|
|
* be silently discarded."
|
|
|
|
*
|
|
|
|
* "Where the peer authenticates successfully to the
|
|
|
|
* authenticator, but the authenticator does not send
|
|
|
|
* a result indication, the authenticator MAY deny
|
|
|
|
* access by sending a Failure packet where the peer
|
|
|
|
* is not currently authorized for network access."
|
|
|
|
* -- eap->method_success implies we've received
|
|
|
|
* a full result indication.
|
|
|
|
*/
|
|
|
|
return;
|
|
|
|
|
|
|
|
eap->complete(code == EAP_CODE_SUCCESS ? EAP_RESULT_SUCCESS :
|
|
|
|
EAP_RESULT_FAIL, eap->user_data);
|
|
|
|
return;
|
|
|
|
|
|
|
|
default:
|
|
|
|
/* Invalid packets to be silently discarded */
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
eap: Validate settings, report passwords needed
With the goal of requesting the required passwords/passphrases, such as
the TLS private key passphrase, from the agent, add a static method
eap_check_settings to validate the settings and calculate what passwords
are needed for those settings, if any. This is separate from
eap_load_settings because that can only be called later, once we've
got an eap state machine object. We need to get all the needed EAP
credentials from the user before we even start connecting.
While we do this, we also validate the settings and output any error
messages through l_error (this could be changed so the messages go
somewhere else in the future), so I removed the error messages from
eap_load_settings and that method now assumes that eap_check_settings
has been called before.
eap_check_settings calls the appropriate method's .check_settings method
if the settings are complete enough to contain the method name. The
policy is that any data can be provided inside the l_settings object
(from the network provisioning/config file), but some of the more
sensitive fields, like private key passwords, can be optionally omitted
and then the UI will ask for them and iwd will be careful with
caching them.
Within struct eap_secret_info, "id" is mainly for the EAP method to
locate the info in the list. "value" is the actual value returned
by agent. "parameter" is an optional string to be passed to the agent.
For a private key passphrase it may be the path to the key file, for a
password it may be the username for which the password is requested.
2018-04-18 07:03:22 +02:00
|
|
|
bool eap_secret_info_match(const void *a, const void *b)
|
|
|
|
{
|
|
|
|
const struct eap_secret_info *s = a;
|
|
|
|
|
|
|
|
return !strcmp(s->id, b);
|
|
|
|
}
|
|
|
|
|
|
|
|
void eap_append_secret(struct l_queue **out_missing, enum eap_secret_type type,
|
2018-08-09 02:33:16 +02:00
|
|
|
const char *id, const char *id2, const char *parameter,
|
|
|
|
enum eap_secret_cache_policy cache_policy)
|
eap: Validate settings, report passwords needed
With the goal of requesting the required passwords/passphrases, such as
the TLS private key passphrase, from the agent, add a static method
eap_check_settings to validate the settings and calculate what passwords
are needed for those settings, if any. This is separate from
eap_load_settings because that can only be called later, once we've
got an eap state machine object. We need to get all the needed EAP
credentials from the user before we even start connecting.
While we do this, we also validate the settings and output any error
messages through l_error (this could be changed so the messages go
somewhere else in the future), so I removed the error messages from
eap_load_settings and that method now assumes that eap_check_settings
has been called before.
eap_check_settings calls the appropriate method's .check_settings method
if the settings are complete enough to contain the method name. The
policy is that any data can be provided inside the l_settings object
(from the network provisioning/config file), but some of the more
sensitive fields, like private key passwords, can be optionally omitted
and then the UI will ask for them and iwd will be careful with
caching them.
Within struct eap_secret_info, "id" is mainly for the EAP method to
locate the info in the list. "value" is the actual value returned
by agent. "parameter" is an optional string to be passed to the agent.
For a private key passphrase it may be the path to the key file, for a
password it may be the username for which the password is requested.
2018-04-18 07:03:22 +02:00
|
|
|
{
|
|
|
|
struct eap_secret_info *info;
|
|
|
|
|
|
|
|
if (!*out_missing)
|
|
|
|
*out_missing = l_queue_new();
|
|
|
|
|
|
|
|
info = l_new(struct eap_secret_info, 1);
|
|
|
|
info->id = l_strdup(id);
|
2018-06-14 03:45:23 +02:00
|
|
|
info->id2 = l_strdup(id2);
|
eap: Validate settings, report passwords needed
With the goal of requesting the required passwords/passphrases, such as
the TLS private key passphrase, from the agent, add a static method
eap_check_settings to validate the settings and calculate what passwords
are needed for those settings, if any. This is separate from
eap_load_settings because that can only be called later, once we've
got an eap state machine object. We need to get all the needed EAP
credentials from the user before we even start connecting.
While we do this, we also validate the settings and output any error
messages through l_error (this could be changed so the messages go
somewhere else in the future), so I removed the error messages from
eap_load_settings and that method now assumes that eap_check_settings
has been called before.
eap_check_settings calls the appropriate method's .check_settings method
if the settings are complete enough to contain the method name. The
policy is that any data can be provided inside the l_settings object
(from the network provisioning/config file), but some of the more
sensitive fields, like private key passwords, can be optionally omitted
and then the UI will ask for them and iwd will be careful with
caching them.
Within struct eap_secret_info, "id" is mainly for the EAP method to
locate the info in the list. "value" is the actual value returned
by agent. "parameter" is an optional string to be passed to the agent.
For a private key passphrase it may be the path to the key file, for a
password it may be the username for which the password is requested.
2018-04-18 07:03:22 +02:00
|
|
|
info->type = type;
|
|
|
|
info->parameter = l_strdup(parameter);
|
2018-08-09 02:33:16 +02:00
|
|
|
info->cache_policy = cache_policy;
|
eap: Validate settings, report passwords needed
With the goal of requesting the required passwords/passphrases, such as
the TLS private key passphrase, from the agent, add a static method
eap_check_settings to validate the settings and calculate what passwords
are needed for those settings, if any. This is separate from
eap_load_settings because that can only be called later, once we've
got an eap state machine object. We need to get all the needed EAP
credentials from the user before we even start connecting.
While we do this, we also validate the settings and output any error
messages through l_error (this could be changed so the messages go
somewhere else in the future), so I removed the error messages from
eap_load_settings and that method now assumes that eap_check_settings
has been called before.
eap_check_settings calls the appropriate method's .check_settings method
if the settings are complete enough to contain the method name. The
policy is that any data can be provided inside the l_settings object
(from the network provisioning/config file), but some of the more
sensitive fields, like private key passwords, can be optionally omitted
and then the UI will ask for them and iwd will be careful with
caching them.
Within struct eap_secret_info, "id" is mainly for the EAP method to
locate the info in the list. "value" is the actual value returned
by agent. "parameter" is an optional string to be passed to the agent.
For a private key passphrase it may be the path to the key file, for a
password it may be the username for which the password is requested.
2018-04-18 07:03:22 +02:00
|
|
|
l_queue_push_tail(*out_missing, info);
|
|
|
|
}
|
|
|
|
|
|
|
|
void eap_secret_info_free(void *data)
|
|
|
|
{
|
|
|
|
struct eap_secret_info *info = data;
|
|
|
|
|
|
|
|
if (!info)
|
|
|
|
return;
|
|
|
|
|
|
|
|
if (info->value) {
|
2019-03-22 00:56:53 +01:00
|
|
|
size_t value_len = strlen(info->value) + 1;
|
|
|
|
|
|
|
|
if (info->type == EAP_SECRET_REMOTE_USER_PASSWORD)
|
|
|
|
value_len += strlen(info->value + value_len);
|
|
|
|
|
|
|
|
explicit_bzero(info->value, value_len);
|
eap: Validate settings, report passwords needed
With the goal of requesting the required passwords/passphrases, such as
the TLS private key passphrase, from the agent, add a static method
eap_check_settings to validate the settings and calculate what passwords
are needed for those settings, if any. This is separate from
eap_load_settings because that can only be called later, once we've
got an eap state machine object. We need to get all the needed EAP
credentials from the user before we even start connecting.
While we do this, we also validate the settings and output any error
messages through l_error (this could be changed so the messages go
somewhere else in the future), so I removed the error messages from
eap_load_settings and that method now assumes that eap_check_settings
has been called before.
eap_check_settings calls the appropriate method's .check_settings method
if the settings are complete enough to contain the method name. The
policy is that any data can be provided inside the l_settings object
(from the network provisioning/config file), but some of the more
sensitive fields, like private key passwords, can be optionally omitted
and then the UI will ask for them and iwd will be careful with
caching them.
Within struct eap_secret_info, "id" is mainly for the EAP method to
locate the info in the list. "value" is the actual value returned
by agent. "parameter" is an optional string to be passed to the agent.
For a private key passphrase it may be the path to the key file, for a
password it may be the username for which the password is requested.
2018-04-18 07:03:22 +02:00
|
|
|
l_free(info->value);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (info->parameter) {
|
2019-03-22 00:56:53 +01:00
|
|
|
explicit_bzero(info->parameter, strlen(info->parameter));
|
eap: Validate settings, report passwords needed
With the goal of requesting the required passwords/passphrases, such as
the TLS private key passphrase, from the agent, add a static method
eap_check_settings to validate the settings and calculate what passwords
are needed for those settings, if any. This is separate from
eap_load_settings because that can only be called later, once we've
got an eap state machine object. We need to get all the needed EAP
credentials from the user before we even start connecting.
While we do this, we also validate the settings and output any error
messages through l_error (this could be changed so the messages go
somewhere else in the future), so I removed the error messages from
eap_load_settings and that method now assumes that eap_check_settings
has been called before.
eap_check_settings calls the appropriate method's .check_settings method
if the settings are complete enough to contain the method name. The
policy is that any data can be provided inside the l_settings object
(from the network provisioning/config file), but some of the more
sensitive fields, like private key passwords, can be optionally omitted
and then the UI will ask for them and iwd will be careful with
caching them.
Within struct eap_secret_info, "id" is mainly for the EAP method to
locate the info in the list. "value" is the actual value returned
by agent. "parameter" is an optional string to be passed to the agent.
For a private key passphrase it may be the path to the key file, for a
password it may be the username for which the password is requested.
2018-04-18 07:03:22 +02:00
|
|
|
l_free(info->parameter);
|
|
|
|
}
|
|
|
|
|
|
|
|
l_free(info->id);
|
2018-06-14 03:45:23 +02:00
|
|
|
l_free(info->id2);
|
eap: Validate settings, report passwords needed
With the goal of requesting the required passwords/passphrases, such as
the TLS private key passphrase, from the agent, add a static method
eap_check_settings to validate the settings and calculate what passwords
are needed for those settings, if any. This is separate from
eap_load_settings because that can only be called later, once we've
got an eap state machine object. We need to get all the needed EAP
credentials from the user before we even start connecting.
While we do this, we also validate the settings and output any error
messages through l_error (this could be changed so the messages go
somewhere else in the future), so I removed the error messages from
eap_load_settings and that method now assumes that eap_check_settings
has been called before.
eap_check_settings calls the appropriate method's .check_settings method
if the settings are complete enough to contain the method name. The
policy is that any data can be provided inside the l_settings object
(from the network provisioning/config file), but some of the more
sensitive fields, like private key passwords, can be optionally omitted
and then the UI will ask for them and iwd will be careful with
caching them.
Within struct eap_secret_info, "id" is mainly for the EAP method to
locate the info in the list. "value" is the actual value returned
by agent. "parameter" is an optional string to be passed to the agent.
For a private key passphrase it may be the path to the key file, for a
password it may be the username for which the password is requested.
2018-04-18 07:03:22 +02:00
|
|
|
l_free(info);
|
|
|
|
}
|
|
|
|
|
2018-06-15 02:10:11 +02:00
|
|
|
int __eap_check_settings(struct l_settings *settings, struct l_queue *secrets,
|
|
|
|
const char *prefix, bool set_key_material,
|
|
|
|
struct l_queue **missing)
|
eap: Validate settings, report passwords needed
With the goal of requesting the required passwords/passphrases, such as
the TLS private key passphrase, from the agent, add a static method
eap_check_settings to validate the settings and calculate what passwords
are needed for those settings, if any. This is separate from
eap_load_settings because that can only be called later, once we've
got an eap state machine object. We need to get all the needed EAP
credentials from the user before we even start connecting.
While we do this, we also validate the settings and output any error
messages through l_error (this could be changed so the messages go
somewhere else in the future), so I removed the error messages from
eap_load_settings and that method now assumes that eap_check_settings
has been called before.
eap_check_settings calls the appropriate method's .check_settings method
if the settings are complete enough to contain the method name. The
policy is that any data can be provided inside the l_settings object
(from the network provisioning/config file), but some of the more
sensitive fields, like private key passwords, can be optionally omitted
and then the UI will ask for them and iwd will be careful with
caching them.
Within struct eap_secret_info, "id" is mainly for the EAP method to
locate the info in the list. "value" is the actual value returned
by agent. "parameter" is an optional string to be passed to the agent.
For a private key passphrase it may be the path to the key file, for a
password it may be the username for which the password is requested.
2018-04-18 07:03:22 +02:00
|
|
|
{
|
|
|
|
char setting[64];
|
|
|
|
const char *method_name;
|
|
|
|
const struct l_queue_entry *entry;
|
|
|
|
struct eap_method *method;
|
2018-06-14 03:45:24 +02:00
|
|
|
int ret = 0;
|
eap: Validate settings, report passwords needed
With the goal of requesting the required passwords/passphrases, such as
the TLS private key passphrase, from the agent, add a static method
eap_check_settings to validate the settings and calculate what passwords
are needed for those settings, if any. This is separate from
eap_load_settings because that can only be called later, once we've
got an eap state machine object. We need to get all the needed EAP
credentials from the user before we even start connecting.
While we do this, we also validate the settings and output any error
messages through l_error (this could be changed so the messages go
somewhere else in the future), so I removed the error messages from
eap_load_settings and that method now assumes that eap_check_settings
has been called before.
eap_check_settings calls the appropriate method's .check_settings method
if the settings are complete enough to contain the method name. The
policy is that any data can be provided inside the l_settings object
(from the network provisioning/config file), but some of the more
sensitive fields, like private key passwords, can be optionally omitted
and then the UI will ask for them and iwd will be careful with
caching them.
Within struct eap_secret_info, "id" is mainly for the EAP method to
locate the info in the list. "value" is the actual value returned
by agent. "parameter" is an optional string to be passed to the agent.
For a private key passphrase it may be the path to the key file, for a
password it may be the username for which the password is requested.
2018-04-18 07:03:22 +02:00
|
|
|
|
|
|
|
snprintf(setting, sizeof(setting), "%sMethod", prefix);
|
|
|
|
method_name = l_settings_get_value(settings, "Security", setting);
|
|
|
|
|
|
|
|
if (!method_name) {
|
|
|
|
l_error("Property %s missing", setting);
|
2018-04-28 04:28:44 +02:00
|
|
|
return -ENOENT;
|
eap: Validate settings, report passwords needed
With the goal of requesting the required passwords/passphrases, such as
the TLS private key passphrase, from the agent, add a static method
eap_check_settings to validate the settings and calculate what passwords
are needed for those settings, if any. This is separate from
eap_load_settings because that can only be called later, once we've
got an eap state machine object. We need to get all the needed EAP
credentials from the user before we even start connecting.
While we do this, we also validate the settings and output any error
messages through l_error (this could be changed so the messages go
somewhere else in the future), so I removed the error messages from
eap_load_settings and that method now assumes that eap_check_settings
has been called before.
eap_check_settings calls the appropriate method's .check_settings method
if the settings are complete enough to contain the method name. The
policy is that any data can be provided inside the l_settings object
(from the network provisioning/config file), but some of the more
sensitive fields, like private key passwords, can be optionally omitted
and then the UI will ask for them and iwd will be careful with
caching them.
Within struct eap_secret_info, "id" is mainly for the EAP method to
locate the info in the list. "value" is the actual value returned
by agent. "parameter" is an optional string to be passed to the agent.
For a private key passphrase it may be the path to the key file, for a
password it may be the username for which the password is requested.
2018-04-18 07:03:22 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
for (entry = l_queue_get_entries(eap_methods); entry;
|
|
|
|
entry = entry->next) {
|
|
|
|
method = entry->data;
|
|
|
|
|
|
|
|
if (!strcasecmp(method_name, method->name))
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!entry) {
|
|
|
|
l_error("EAP method \"%s\" unsupported", method_name);
|
2018-04-28 04:28:44 +02:00
|
|
|
return -ENOTSUP;
|
eap: Validate settings, report passwords needed
With the goal of requesting the required passwords/passphrases, such as
the TLS private key passphrase, from the agent, add a static method
eap_check_settings to validate the settings and calculate what passwords
are needed for those settings, if any. This is separate from
eap_load_settings because that can only be called later, once we've
got an eap state machine object. We need to get all the needed EAP
credentials from the user before we even start connecting.
While we do this, we also validate the settings and output any error
messages through l_error (this could be changed so the messages go
somewhere else in the future), so I removed the error messages from
eap_load_settings and that method now assumes that eap_check_settings
has been called before.
eap_check_settings calls the appropriate method's .check_settings method
if the settings are complete enough to contain the method name. The
policy is that any data can be provided inside the l_settings object
(from the network provisioning/config file), but some of the more
sensitive fields, like private key passwords, can be optionally omitted
and then the UI will ask for them and iwd will be careful with
caching them.
Within struct eap_secret_info, "id" is mainly for the EAP method to
locate the info in the list. "value" is the actual value returned
by agent. "parameter" is an optional string to be passed to the agent.
For a private key passphrase it may be the path to the key file, for a
password it may be the username for which the password is requested.
2018-04-18 07:03:22 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Check if selected method is suitable for 802.1x */
|
|
|
|
if (set_key_material && !method->exports_msk) {
|
|
|
|
l_error("EAP method \"%s\" doesn't export key material",
|
|
|
|
method_name);
|
2018-04-28 04:28:44 +02:00
|
|
|
return -ENOTSUP;
|
eap: Validate settings, report passwords needed
With the goal of requesting the required passwords/passphrases, such as
the TLS private key passphrase, from the agent, add a static method
eap_check_settings to validate the settings and calculate what passwords
are needed for those settings, if any. This is separate from
eap_load_settings because that can only be called later, once we've
got an eap state machine object. We need to get all the needed EAP
credentials from the user before we even start connecting.
While we do this, we also validate the settings and output any error
messages through l_error (this could be changed so the messages go
somewhere else in the future), so I removed the error messages from
eap_load_settings and that method now assumes that eap_check_settings
has been called before.
eap_check_settings calls the appropriate method's .check_settings method
if the settings are complete enough to contain the method name. The
policy is that any data can be provided inside the l_settings object
(from the network provisioning/config file), but some of the more
sensitive fields, like private key passwords, can be optionally omitted
and then the UI will ask for them and iwd will be careful with
caching them.
Within struct eap_secret_info, "id" is mainly for the EAP method to
locate the info in the list. "value" is the actual value returned
by agent. "parameter" is an optional string to be passed to the agent.
For a private key passphrase it may be the path to the key file, for a
password it may be the username for which the password is requested.
2018-04-18 07:03:22 +02:00
|
|
|
}
|
|
|
|
|
2018-06-15 02:10:11 +02:00
|
|
|
if (method->check_settings) {
|
2018-06-14 03:45:24 +02:00
|
|
|
ret = method->check_settings(settings, secrets,
|
2018-06-15 02:10:11 +02:00
|
|
|
prefix, missing);
|
|
|
|
|
|
|
|
if (ret < 0)
|
|
|
|
return ret;
|
|
|
|
}
|
2018-06-14 03:45:24 +02:00
|
|
|
|
|
|
|
/*
|
2019-01-12 00:27:15 +01:00
|
|
|
* Individual methods are responsible for ensuring, inside their
|
|
|
|
* check_settings(), that they have enough data to return the
|
|
|
|
* identity after load_settings() if it is required.
|
2018-06-14 03:45:24 +02:00
|
|
|
*/
|
eap: Validate settings, report passwords needed
With the goal of requesting the required passwords/passphrases, such as
the TLS private key passphrase, from the agent, add a static method
eap_check_settings to validate the settings and calculate what passwords
are needed for those settings, if any. This is separate from
eap_load_settings because that can only be called later, once we've
got an eap state machine object. We need to get all the needed EAP
credentials from the user before we even start connecting.
While we do this, we also validate the settings and output any error
messages through l_error (this could be changed so the messages go
somewhere else in the future), so I removed the error messages from
eap_load_settings and that method now assumes that eap_check_settings
has been called before.
eap_check_settings calls the appropriate method's .check_settings method
if the settings are complete enough to contain the method name. The
policy is that any data can be provided inside the l_settings object
(from the network provisioning/config file), but some of the more
sensitive fields, like private key passwords, can be optionally omitted
and then the UI will ask for them and iwd will be careful with
caching them.
Within struct eap_secret_info, "id" is mainly for the EAP method to
locate the info in the list. "value" is the actual value returned
by agent. "parameter" is an optional string to be passed to the agent.
For a private key passphrase it may be the path to the key file, for a
password it may be the username for which the password is requested.
2018-04-18 07:03:22 +02:00
|
|
|
|
2018-06-15 02:10:11 +02:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
int eap_check_settings(struct l_settings *settings, struct l_queue *secrets,
|
|
|
|
const char *prefix, bool set_key_material,
|
|
|
|
struct l_queue **out_missing)
|
|
|
|
{
|
|
|
|
struct l_queue *missing = NULL;
|
|
|
|
int ret = __eap_check_settings(settings, secrets, prefix,
|
|
|
|
set_key_material, &missing);
|
|
|
|
|
|
|
|
if (ret < 0) {
|
|
|
|
l_queue_destroy(missing, eap_secret_info_free);
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2018-06-15 00:02:09 +02:00
|
|
|
if (missing && l_queue_isempty(missing)) {
|
|
|
|
l_queue_destroy(missing, NULL);
|
|
|
|
missing = NULL;
|
|
|
|
}
|
|
|
|
|
2018-06-14 23:57:51 +02:00
|
|
|
*out_missing = missing;
|
2018-06-14 03:45:24 +02:00
|
|
|
return 0;
|
eap: Validate settings, report passwords needed
With the goal of requesting the required passwords/passphrases, such as
the TLS private key passphrase, from the agent, add a static method
eap_check_settings to validate the settings and calculate what passwords
are needed for those settings, if any. This is separate from
eap_load_settings because that can only be called later, once we've
got an eap state machine object. We need to get all the needed EAP
credentials from the user before we even start connecting.
While we do this, we also validate the settings and output any error
messages through l_error (this could be changed so the messages go
somewhere else in the future), so I removed the error messages from
eap_load_settings and that method now assumes that eap_check_settings
has been called before.
eap_check_settings calls the appropriate method's .check_settings method
if the settings are complete enough to contain the method name. The
policy is that any data can be provided inside the l_settings object
(from the network provisioning/config file), but some of the more
sensitive fields, like private key passwords, can be optionally omitted
and then the UI will ask for them and iwd will be careful with
caching them.
Within struct eap_secret_info, "id" is mainly for the EAP method to
locate the info in the list. "value" is the actual value returned
by agent. "parameter" is an optional string to be passed to the agent.
For a private key passphrase it may be the path to the key file, for a
password it may be the username for which the password is requested.
2018-04-18 07:03:22 +02:00
|
|
|
}
|
|
|
|
|
2015-10-30 11:12:13 +01:00
|
|
|
bool eap_load_settings(struct eap_state *eap, struct l_settings *settings,
|
|
|
|
const char *prefix)
|
|
|
|
{
|
|
|
|
char setting[64];
|
|
|
|
const char *method_name;
|
|
|
|
const struct l_queue_entry *entry;
|
|
|
|
struct eap_method *method;
|
|
|
|
|
|
|
|
snprintf(setting, sizeof(setting), "%sMethod", prefix);
|
|
|
|
method_name = l_settings_get_value(settings, "Security", setting);
|
|
|
|
|
|
|
|
if (!method_name)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
for (entry = l_queue_get_entries(eap_methods); entry;
|
|
|
|
entry = entry->next) {
|
|
|
|
method = entry->data;
|
|
|
|
|
2017-09-06 04:12:17 +02:00
|
|
|
if (!strcasecmp(method_name, method->name)) {
|
2015-10-30 11:12:13 +01:00
|
|
|
eap->method = method;
|
|
|
|
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!eap->method)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
/* Check if selected method is suitable for 802.1x */
|
eap: Validate settings, report passwords needed
With the goal of requesting the required passwords/passphrases, such as
the TLS private key passphrase, from the agent, add a static method
eap_check_settings to validate the settings and calculate what passwords
are needed for those settings, if any. This is separate from
eap_load_settings because that can only be called later, once we've
got an eap state machine object. We need to get all the needed EAP
credentials from the user before we even start connecting.
While we do this, we also validate the settings and output any error
messages through l_error (this could be changed so the messages go
somewhere else in the future), so I removed the error messages from
eap_load_settings and that method now assumes that eap_check_settings
has been called before.
eap_check_settings calls the appropriate method's .check_settings method
if the settings are complete enough to contain the method name. The
policy is that any data can be provided inside the l_settings object
(from the network provisioning/config file), but some of the more
sensitive fields, like private key passwords, can be optionally omitted
and then the UI will ask for them and iwd will be careful with
caching them.
Within struct eap_secret_info, "id" is mainly for the EAP method to
locate the info in the list. "value" is the actual value returned
by agent. "parameter" is an optional string to be passed to the agent.
For a private key passphrase it may be the path to the key file, for a
password it may be the username for which the password is requested.
2018-04-18 07:03:22 +02:00
|
|
|
if (eap->set_key_material && !eap->method->exports_msk)
|
2015-10-30 11:12:13 +01:00
|
|
|
goto err;
|
|
|
|
|
2017-11-09 20:07:55 +01:00
|
|
|
if (eap->method->load_settings)
|
|
|
|
if (!eap->method->load_settings(eap, settings, prefix))
|
|
|
|
goto err;
|
|
|
|
|
|
|
|
/* get identity from settings or from EAP method */
|
|
|
|
if (!eap->method->get_identity) {
|
|
|
|
snprintf(setting, sizeof(setting), "%sIdentity", prefix);
|
2018-06-14 03:45:25 +02:00
|
|
|
eap->identity = l_settings_get_string(settings,
|
|
|
|
"Security", setting);
|
2017-11-09 20:07:55 +01:00
|
|
|
} else {
|
|
|
|
eap->identity = l_strdup(eap->method->get_identity(eap));
|
|
|
|
}
|
|
|
|
|
2019-04-08 23:01:58 +02:00
|
|
|
/*
|
|
|
|
* RFC 4282 Section 2.2 - NAI Length Considerations
|
|
|
|
*
|
|
|
|
* Devices handling NAIs MUST support an NAI length of at least 72
|
|
|
|
* octets. Support for an NAI length of 253 octets is RECOMMENDED.
|
|
|
|
* ...
|
|
|
|
* RADIUS is unable to support NAI lengths beyond 253 octets
|
|
|
|
*/
|
|
|
|
if (strlen(eap->identity) > 253) {
|
|
|
|
l_error("Identity is too long");
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
|
2015-10-30 11:12:13 +01:00
|
|
|
return true;
|
|
|
|
|
|
|
|
err:
|
2019-04-08 23:24:18 +02:00
|
|
|
eap_free_common(eap);
|
2015-10-30 11:12:13 +01:00
|
|
|
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
void eap_set_data(struct eap_state *eap, void *data)
|
|
|
|
{
|
|
|
|
eap->method_state = data;
|
|
|
|
}
|
|
|
|
|
|
|
|
void *eap_get_data(struct eap_state *eap)
|
|
|
|
{
|
|
|
|
return eap->method_state;
|
|
|
|
}
|
|
|
|
|
2018-11-16 23:15:32 +01:00
|
|
|
enum eap_type eap_get_method_type(struct eap_state *eap)
|
|
|
|
{
|
|
|
|
return eap->method->request_type;
|
|
|
|
}
|
|
|
|
|
|
|
|
const char *eap_get_method_name(struct eap_state *eap)
|
|
|
|
{
|
|
|
|
return eap->method->name;
|
|
|
|
}
|
|
|
|
|
2015-10-30 11:12:13 +01:00
|
|
|
void eap_set_key_material(struct eap_state *eap,
|
|
|
|
const uint8_t *msk_data, size_t msk_len,
|
|
|
|
const uint8_t *emsk_data, size_t emsk_len,
|
|
|
|
const uint8_t *iv, size_t iv_len)
|
|
|
|
{
|
|
|
|
if (!eap->set_key_material)
|
|
|
|
return;
|
|
|
|
|
|
|
|
eap->set_key_material(msk_data, msk_len, emsk_data, emsk_len,
|
|
|
|
iv, iv_len, eap->user_data);
|
|
|
|
}
|
|
|
|
|
2016-09-12 22:26:03 +02:00
|
|
|
void eap_method_event(struct eap_state *eap, unsigned int id, const void *data)
|
|
|
|
{
|
|
|
|
if (!eap->event_func)
|
|
|
|
return;
|
|
|
|
|
|
|
|
eap->event_func(id, data, eap->user_data);
|
|
|
|
}
|
|
|
|
|
2018-02-22 01:47:19 +01:00
|
|
|
bool eap_method_is_success(struct eap_state *eap)
|
|
|
|
{
|
|
|
|
return eap->method_success;
|
|
|
|
}
|
|
|
|
|
2015-10-30 11:12:13 +01:00
|
|
|
void eap_method_success(struct eap_state *eap)
|
|
|
|
{
|
|
|
|
eap->method_success = true;
|
|
|
|
}
|
|
|
|
|
2018-02-23 18:48:44 +01:00
|
|
|
void eap_discard_success_and_failure(struct eap_state *eap, bool discard)
|
|
|
|
{
|
|
|
|
eap->discard_success_and_failure = discard;
|
|
|
|
}
|
|
|
|
|
2015-10-30 11:12:13 +01:00
|
|
|
void eap_method_error(struct eap_state *eap)
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* It looks like neither EAP nor EAP-TLS specify the error handling
|
|
|
|
* behavior.
|
|
|
|
*/
|
|
|
|
eap->complete(EAP_RESULT_FAIL, eap->user_data);
|
|
|
|
}
|
|
|
|
|
|
|
|
void eap_save_last_id(struct eap_state *eap, uint8_t *last_id)
|
|
|
|
{
|
|
|
|
*last_id = eap->last_id;
|
|
|
|
}
|
|
|
|
|
|
|
|
void eap_restore_last_id(struct eap_state *eap, uint8_t last_id)
|
|
|
|
{
|
|
|
|
eap->last_id = last_id;
|
|
|
|
}
|
|
|
|
|
2015-11-02 16:54:12 +01:00
|
|
|
int eap_register_method(struct eap_method *method)
|
2015-10-30 11:12:13 +01:00
|
|
|
{
|
2018-01-23 20:42:44 +01:00
|
|
|
if (!method->handle_request)
|
|
|
|
return -EPERM;
|
|
|
|
|
2015-10-30 11:12:13 +01:00
|
|
|
l_queue_push_head(eap_methods, method);
|
2015-11-02 16:54:12 +01:00
|
|
|
return 0;
|
2015-10-30 11:12:13 +01:00
|
|
|
}
|
|
|
|
|
2015-11-03 04:38:45 +01:00
|
|
|
int eap_unregister_method(struct eap_method *method)
|
|
|
|
{
|
|
|
|
bool r;
|
|
|
|
|
|
|
|
r = l_queue_remove(eap_methods, method);
|
|
|
|
if (r)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
return -ENOENT;
|
|
|
|
}
|
|
|
|
|
2015-11-03 04:30:40 +01:00
|
|
|
static void __eap_method_enable(struct eap_method_desc *start,
|
|
|
|
struct eap_method_desc *stop)
|
|
|
|
{
|
2017-04-19 00:29:09 +02:00
|
|
|
struct eap_method_desc *desc;
|
2015-11-03 04:30:40 +01:00
|
|
|
|
|
|
|
l_debug("");
|
|
|
|
|
|
|
|
if (start == NULL || stop == NULL)
|
|
|
|
return;
|
|
|
|
|
|
|
|
for (desc = start; desc < stop; desc++) {
|
|
|
|
if (!desc->init)
|
|
|
|
continue;
|
|
|
|
|
|
|
|
desc->init();
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __eap_method_disable(struct eap_method_desc *start,
|
|
|
|
struct eap_method_desc *stop)
|
|
|
|
{
|
2017-04-19 00:29:09 +02:00
|
|
|
struct eap_method_desc *desc;
|
2015-10-30 11:12:15 +01:00
|
|
|
|
2015-11-03 04:30:40 +01:00
|
|
|
l_debug("");
|
|
|
|
|
|
|
|
if (start == NULL || stop == NULL)
|
|
|
|
return;
|
|
|
|
|
|
|
|
for (desc = start; desc < stop; desc++) {
|
|
|
|
if (!desc->exit)
|
|
|
|
continue;
|
|
|
|
|
|
|
|
desc->exit();
|
|
|
|
}
|
2015-10-30 11:12:13 +01:00
|
|
|
}
|
|
|
|
|
2015-11-03 04:30:40 +01:00
|
|
|
extern struct eap_method_desc __start___eap[];
|
|
|
|
extern struct eap_method_desc __stop___eap[];
|
|
|
|
|
2016-11-15 23:44:07 +01:00
|
|
|
void eap_init(uint32_t mtu)
|
2015-11-03 04:30:40 +01:00
|
|
|
{
|
|
|
|
eap_methods = l_queue_new();
|
|
|
|
__eap_method_enable(__start___eap, __stop___eap);
|
2016-11-15 23:44:07 +01:00
|
|
|
|
|
|
|
/*
|
|
|
|
* RFC 3748, Section 3.1, [4], "Minimum MTU":
|
|
|
|
* EAP is capable of functioning on lower layers that
|
|
|
|
* provide an EAP MTU size of 1020 octets or greater.
|
|
|
|
*/
|
|
|
|
if (mtu == 0)
|
|
|
|
default_mtu = 1020;
|
|
|
|
else
|
|
|
|
default_mtu = mtu;
|
2015-11-03 04:30:40 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
void eap_exit(void)
|
|
|
|
{
|
|
|
|
__eap_method_disable(__start___eap, __stop___eap);
|
2015-10-30 11:12:13 +01:00
|
|
|
l_queue_destroy(eap_methods, NULL);
|
|
|
|
}
|