contrib/hostapd-0.5.8/eapol_sm.c

   1 /*
   2  * hostapd / IEEE 802.1X Authenticator - EAPOL state machine
   3  * Copyright (c) 2002-2005, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "hostapd.h"
  18 #include "ieee802_1x.h"
  19 #include "eapol_sm.h"
  20 #include "eloop.h"
  21 #include "wpa.h"
  22 #include "preauth.h"
  23 #include "sta_info.h"
  24 #include "eap.h"
  25 #include "state_machine.h"
  26
  27 #define STATE_MACHINE_DATA struct eapol_state_machine
  28 #define STATE_MACHINE_DEBUG_PREFIX "IEEE 802.1X"
  29 #define STATE_MACHINE_ADDR sm->addr
  30
  31 static struct eapol_callbacks eapol_cb;
  32
  33 /* EAPOL state machines are described in IEEE Std 802.1X-REV-d11, Chap. 8.2 */
  34
  35 #define setPortAuthorized() \
  36 ieee802_1x_set_sta_authorized(sm->hapd, sm->sta, 1)
  37 #define setPortUnauthorized() \
  38 ieee802_1x_set_sta_authorized(sm->hapd, sm->sta, 0)
  39
  40 /* procedures */
  41 #define txCannedFail() ieee802_1x_tx_canned_eap(sm->hapd, sm->sta, 0)
  42 #define txCannedSuccess() ieee802_1x_tx_canned_eap(sm->hapd, sm->sta, 1)
  43 #define txReq() ieee802_1x_tx_req(sm->hapd, sm->sta)
  44 #define sendRespToServer() ieee802_1x_send_resp_to_server(sm->hapd, sm->sta)
  45 #define abortAuth() ieee802_1x_abort_auth(sm->hapd, sm->sta)
  46 #define txKey() ieee802_1x_tx_key(sm->hapd, sm->sta)
  47 #define processKey() do { } while (0)
  48
  49
  50 static void eapol_sm_step_run(struct eapol_state_machine *sm);
  51 static void eapol_sm_step_cb(void *eloop_ctx, void *timeout_ctx);
  52
  53
  54 /* Port Timers state machine - implemented as a function that will be called
  55  * once a second as a registered event loop timeout */
  56
  57 static void eapol_port_timers_tick(void *eloop_ctx, void *timeout_ctx)
  58 {
  59         struct eapol_state_machine *state = timeout_ctx;
  60
  61         if (state->aWhile > 0) {
  62                 state->aWhile--;
  63                 if (state->aWhile == 0) {
  64                         wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR
  65                                    " - aWhile --> 0",
  66                                    MAC2STR(state->addr));
  67                 }
  68         }
  69
  70         if (state->quietWhile > 0) {
  71                 state->quietWhile--;
  72                 if (state->quietWhile == 0) {
  73                         wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR
  74                                    " - quietWhile --> 0",
  75                                    MAC2STR(state->addr));
  76                 }
  77         }
  78
  79         if (state->reAuthWhen > 0) {
  80                 state->reAuthWhen--;
  81                 if (state->reAuthWhen == 0) {
  82                         wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR
  83                                    " - reAuthWhen --> 0",
  84                                    MAC2STR(state->addr));
  85                 }
  86         }
  87
  88         eapol_sm_step_run(state);
  89
  90         eloop_register_timeout(1, 0, eapol_port_timers_tick, eloop_ctx, state);
  91 }
  92
  93
  94
  95 /* Authenticator PAE state machine */
  96
  97 SM_STATE(AUTH_PAE, INITIALIZE)
  98 {
  99         SM_ENTRY_MA(AUTH_PAE, INITIALIZE, auth_pae);
 100         sm->portMode = Auto;
 101
 102         sm->currentId = 255;
 103 }
 104
 105
 106 SM_STATE(AUTH_PAE, DISCONNECTED)
 107 {
 108         int from_initialize = sm->auth_pae_state == AUTH_PAE_INITIALIZE;
 109
 110         if (sm->eapolLogoff) {
 111                 if (sm->auth_pae_state == AUTH_PAE_CONNECTING)
 112                         sm->authEapLogoffsWhileConnecting++;
 113                 else if (sm->auth_pae_state == AUTH_PAE_AUTHENTICATED)
 114                         sm->authAuthEapLogoffWhileAuthenticated++;
 115         }
 116
 117         SM_ENTRY_MA(AUTH_PAE, DISCONNECTED, auth_pae);
 118
 119         sm->authPortStatus = Unauthorized;
 120         setPortUnauthorized();
 121         sm->reAuthCount = 0;
 122         sm->eapolLogoff = FALSE;
 123         if (!from_initialize) {
 124                 if (sm->flags & EAPOL_SM_PREAUTH)
 125                         rsn_preauth_finished(sm->hapd, sm->sta, 0);
 126                 else
 127                         ieee802_1x_finished(sm->hapd, sm->sta, 0);
 128         }
 129 }
 130
 131
 132 SM_STATE(AUTH_PAE, RESTART)
 133 {
 134         if (sm->auth_pae_state == AUTH_PAE_AUTHENTICATED) {
 135                 if (sm->reAuthenticate)
 136                         sm->authAuthReauthsWhileAuthenticated++;
 137                 if (sm->eapolStart)
 138                         sm->authAuthEapStartsWhileAuthenticated++;
 139                 if (sm->eapolLogoff)
 140                         sm->authAuthEapLogoffWhileAuthenticated++;
 141         }
 142
 143         SM_ENTRY_MA(AUTH_PAE, RESTART, auth_pae);
 144
 145         sm->eapRestart = TRUE;
 146         ieee802_1x_request_identity(sm->hapd, sm->sta);
 147 }
 148
 149
 150 SM_STATE(AUTH_PAE, CONNECTING)
 151 {
 152         if (sm->auth_pae_state != AUTH_PAE_CONNECTING)
 153                 sm->authEntersConnecting++;
 154
 155         SM_ENTRY_MA(AUTH_PAE, CONNECTING, auth_pae);
 156
 157         sm->reAuthenticate = FALSE;
 158         sm->reAuthCount++;
 159 }
 160
 161
 162 SM_STATE(AUTH_PAE, HELD)
 163 {
 164         if (sm->auth_pae_state == AUTH_PAE_AUTHENTICATING && sm->authFail)
 165                 sm->authAuthFailWhileAuthenticating++;
 166
 167         SM_ENTRY_MA(AUTH_PAE, HELD, auth_pae);
 168
 169         sm->authPortStatus = Unauthorized;
 170         setPortUnauthorized();
 171         sm->quietWhile = sm->quietPeriod;
 172         sm->eapolLogoff = FALSE;
 173
 174         hostapd_logger(sm->hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
 175                        HOSTAPD_LEVEL_WARNING, "authentication failed - "
 176                        "EAP type: %d (%s)",
 177                        sm->eap_type_authsrv,
 178                        eap_type_text(sm->eap_type_authsrv));
 179         if (sm->eap_type_authsrv != sm->eap_type_supp) {
 180                 hostapd_logger(sm->hapd, sm->addr,
 181                                HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_INFO,
 182                                "Supplicant used different EAP type: %d (%s)",
 183                                sm->eap_type_supp,
 184                                eap_type_text(sm->eap_type_supp));
 185         }
 186         if (sm->flags & EAPOL_SM_PREAUTH)
 187                 rsn_preauth_finished(sm->hapd, sm->sta, 0);
 188         else
 189                 ieee802_1x_finished(sm->hapd, sm->sta, 0);
 190 }
 191
 192
 193 SM_STATE(AUTH_PAE, AUTHENTICATED)
 194 {
 195         char *extra = "";
 196
 197         if (sm->auth_pae_state == AUTH_PAE_AUTHENTICATING && sm->authSuccess)
 198                 sm->authAuthSuccessesWhileAuthenticating++;
 199
 200         SM_ENTRY_MA(AUTH_PAE, AUTHENTICATED, auth_pae);
 201
 202         sm->authPortStatus = Authorized;
 203         setPortAuthorized();
 204         sm->reAuthCount = 0;
 205         if (sm->flags & EAPOL_SM_PREAUTH)
 206                 extra = " (pre-authentication)";
 207         else if (wpa_auth_sta_get_pmksa(sm->sta->wpa_sm))
 208                 extra = " (PMKSA cache)";
 209         hostapd_logger(sm->hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
 210                        HOSTAPD_LEVEL_INFO, "authenticated - EAP type: %d (%s)"
 211                        "%s", sm->eap_type_authsrv,
 212                        eap_type_text(sm->eap_type_authsrv), extra);
 213         if (sm->flags & EAPOL_SM_PREAUTH)
 214                 rsn_preauth_finished(sm->hapd, sm->sta, 1);
 215         else
 216                 ieee802_1x_finished(sm->hapd, sm->sta, 1);
 217 }
 218
 219
 220 SM_STATE(AUTH_PAE, AUTHENTICATING)
 221 {
 222         if (sm->auth_pae_state == AUTH_PAE_CONNECTING && sm->rx_identity) {
 223                 sm->authEntersAuthenticating++;
 224                 sm->rx_identity = FALSE;
 225         }
 226
 227         SM_ENTRY_MA(AUTH_PAE, AUTHENTICATING, auth_pae);
 228
 229         sm->eapolStart = FALSE;
 230         sm->authSuccess = FALSE;
 231         sm->authFail = FALSE;
 232         sm->authTimeout = FALSE;
 233         sm->authStart = TRUE;
 234         sm->keyRun = FALSE;
 235         sm->keyDone = FALSE;
 236 }
 237
 238
 239 SM_STATE(AUTH_PAE, ABORTING)
 240 {
 241         if (sm->auth_pae_state == AUTH_PAE_AUTHENTICATING) {
 242                 if (sm->authTimeout)
 243                         sm->authAuthTimeoutsWhileAuthenticating++;
 244                 if (sm->eapolStart)
 245                         sm->authAuthEapStartsWhileAuthenticating++;
 246                 if (sm->eapolLogoff)
 247                         sm->authAuthEapLogoffWhileAuthenticating++;
 248         }
 249
 250         SM_ENTRY_MA(AUTH_PAE, ABORTING, auth_pae);
 251
 252         sm->authAbort = TRUE;
 253         sm->keyRun = FALSE;
 254         sm->keyDone = FALSE;
 255 }
 256
 257
 258 SM_STATE(AUTH_PAE, FORCE_AUTH)
 259 {
 260         SM_ENTRY_MA(AUTH_PAE, FORCE_AUTH, auth_pae);
 261
 262         sm->authPortStatus = Authorized;
 263         setPortAuthorized();
 264         sm->portMode = ForceAuthorized;
 265         sm->eapolStart = FALSE;
 266         txCannedSuccess();
 267 }
 268
 269
 270 SM_STATE(AUTH_PAE, FORCE_UNAUTH)
 271 {
 272         SM_ENTRY_MA(AUTH_PAE, FORCE_UNAUTH, auth_pae);
 273
 274         sm->authPortStatus = Unauthorized;
 275         setPortUnauthorized();
 276         sm->portMode = ForceUnauthorized;
 277         sm->eapolStart = FALSE;
 278         txCannedFail();
 279 }
 280
 281
 282 SM_STEP(AUTH_PAE)
 283 {
 284         if ((sm->portControl == Auto && sm->portMode != sm->portControl) ||
 285             sm->initialize || !sm->portEnabled)
 286                 SM_ENTER(AUTH_PAE, INITIALIZE);
 287         else if (sm->portControl == ForceAuthorized &&
 288                  sm->portMode != sm->portControl &&
 289                  !(sm->initialize || !sm->portEnabled))
 290                 SM_ENTER(AUTH_PAE, FORCE_AUTH);
 291         else if (sm->portControl == ForceUnauthorized &&
 292                  sm->portMode != sm->portControl &&
 293                  !(sm->initialize || !sm->portEnabled))
 294                 SM_ENTER(AUTH_PAE, FORCE_UNAUTH);
 295         else {
 296                 switch (sm->auth_pae_state) {
 297                 case AUTH_PAE_INITIALIZE:
 298                         SM_ENTER(AUTH_PAE, DISCONNECTED);
 299                         break;
 300                 case AUTH_PAE_DISCONNECTED:
 301                         SM_ENTER(AUTH_PAE, RESTART);
 302                         break;
 303                 case AUTH_PAE_RESTART:
 304                         if (!sm->eapRestart)
 305                                 SM_ENTER(AUTH_PAE, CONNECTING);
 306                         break;
 307                 case AUTH_PAE_HELD:
 308                         if (sm->quietWhile == 0)
 309                                 SM_ENTER(AUTH_PAE, RESTART);
 310                         break;
 311                 case AUTH_PAE_CONNECTING:
 312                         if (sm->eapolLogoff || sm->reAuthCount > sm->reAuthMax)
 313                                 SM_ENTER(AUTH_PAE, DISCONNECTED);
 314                         else if ((sm->eapReq &&
 315                                   sm->reAuthCount <= sm->reAuthMax) ||
 316                                  sm->eapSuccess || sm->eapFail)
 317                                 SM_ENTER(AUTH_PAE, AUTHENTICATING);
 318                         break;
 319                 case AUTH_PAE_AUTHENTICATED:
 320                         if (sm->eapolStart || sm->reAuthenticate)
 321                                 SM_ENTER(AUTH_PAE, RESTART);
 322                         else if (sm->eapolLogoff || !sm->portValid)
 323                                 SM_ENTER(AUTH_PAE, DISCONNECTED);
 324                         break;
 325                 case AUTH_PAE_AUTHENTICATING:
 326                         if (sm->authSuccess && sm->portValid)
 327                                 SM_ENTER(AUTH_PAE, AUTHENTICATED);
 328                         else if (sm->authFail ||
 329                                  (sm->keyDone && !sm->portValid))
 330                                 SM_ENTER(AUTH_PAE, HELD);
 331                         else if (sm->eapolStart || sm->eapolLogoff ||
 332                                  sm->authTimeout)
 333                                 SM_ENTER(AUTH_PAE, ABORTING);
 334                         break;
 335                 case AUTH_PAE_ABORTING:
 336                         if (sm->eapolLogoff && !sm->authAbort)
 337                                 SM_ENTER(AUTH_PAE, DISCONNECTED);
 338                         else if (!sm->eapolLogoff && !sm->authAbort)
 339                                 SM_ENTER(AUTH_PAE, RESTART);
 340                         break;
 341                 case AUTH_PAE_FORCE_AUTH:
 342                         if (sm->eapolStart)
 343                                 SM_ENTER(AUTH_PAE, FORCE_AUTH);
 344                         break;
 345                 case AUTH_PAE_FORCE_UNAUTH:
 346                         if (sm->eapolStart)
 347                                 SM_ENTER(AUTH_PAE, FORCE_UNAUTH);
 348                         break;
 349                 }
 350         }
 351 }
 352
 353
 354
 355 /* Backend Authentication state machine */
 356
 357 SM_STATE(BE_AUTH, INITIALIZE)
 358 {
 359         SM_ENTRY_MA(BE_AUTH, INITIALIZE, be_auth);
 360
 361         abortAuth();
 362         sm->eapNoReq = FALSE;
 363         sm->authAbort = FALSE;
 364 }
 365
 366
 367 SM_STATE(BE_AUTH, REQUEST)
 368 {
 369         SM_ENTRY_MA(BE_AUTH, REQUEST, be_auth);
 370
 371         txReq();
 372         sm->eapReq = FALSE;
 373         sm->backendOtherRequestsToSupplicant++;
 374
 375         /*
 376          * Clearing eapolEap here is not specified in IEEE Std 802.1X-2004, but
 377          * it looks like this would be logical thing to do there since the old
 378          * EAP response would not be valid anymore after the new EAP request
 379          * was sent out.
 380          *
 381          * A race condition has been reported, in which hostapd ended up
 382          * sending out EAP-Response/Identity as a response to the first
 383          * EAP-Request from the main EAP method. This can be avoided by
 384          * clearing eapolEap here.
 385          */
 386         sm->eapolEap = FALSE;
 387 }
 388
 389
 390 SM_STATE(BE_AUTH, RESPONSE)
 391 {
 392         SM_ENTRY_MA(BE_AUTH, RESPONSE, be_auth);
 393
 394         sm->authTimeout = FALSE;
 395         sm->eapolEap = FALSE;
 396         sm->eapNoReq = FALSE;
 397         sm->aWhile = sm->serverTimeout;
 398         sm->eapResp = TRUE;
 399         sendRespToServer();
 400         sm->backendResponses++;
 401 }
 402
 403
 404 SM_STATE(BE_AUTH, SUCCESS)
 405 {
 406         SM_ENTRY_MA(BE_AUTH, SUCCESS, be_auth);
 407
 408         txReq();
 409         sm->authSuccess = TRUE;
 410         sm->keyRun = TRUE;
 411 }
 412
 413
 414 SM_STATE(BE_AUTH, FAIL)
 415 {
 416         SM_ENTRY_MA(BE_AUTH, FAIL, be_auth);
 417
 418         /* Note: IEEE 802.1X-REV-d11 has unconditional txReq() here.
 419          * txCannelFail() is used as a workaround for the case where
 420          * authentication server does not include EAP-Message with
 421          * Access-Reject. */
 422         if (sm->last_eap_radius == NULL)
 423                 txCannedFail();
 424         else
 425                 txReq();
 426         sm->authFail = TRUE;
 427 }
 428
 429
 430 SM_STATE(BE_AUTH, TIMEOUT)
 431 {
 432         SM_ENTRY_MA(BE_AUTH, TIMEOUT, be_auth);
 433
 434         sm->authTimeout = TRUE;
 435 }
 436
 437
 438 SM_STATE(BE_AUTH, IDLE)
 439 {
 440         SM_ENTRY_MA(BE_AUTH, IDLE, be_auth);
 441
 442         sm->authStart = FALSE;
 443 }
 444
 445
 446 SM_STATE(BE_AUTH, IGNORE)
 447 {
 448         SM_ENTRY_MA(BE_AUTH, IGNORE, be_auth);
 449
 450         sm->eapNoReq = FALSE;
 451 }
 452
 453
 454 SM_STEP(BE_AUTH)
 455 {
 456         if (sm->portControl != Auto || sm->initialize || sm->authAbort) {
 457                 SM_ENTER(BE_AUTH, INITIALIZE);
 458                 return;
 459         }
 460
 461         switch (sm->be_auth_state) {
 462         case BE_AUTH_INITIALIZE:
 463                 SM_ENTER(BE_AUTH, IDLE);
 464                 break;
 465         case BE_AUTH_REQUEST:
 466                 if (sm->eapolEap)
 467                         SM_ENTER(BE_AUTH, RESPONSE);
 468                 else if (sm->eapReq)
 469                         SM_ENTER(BE_AUTH, REQUEST);
 470                 else if (sm->eapTimeout)
 471                         SM_ENTER(BE_AUTH, TIMEOUT);
 472                 break;
 473         case BE_AUTH_RESPONSE:
 474                 if (sm->eapNoReq)
 475                         SM_ENTER(BE_AUTH, IGNORE);
 476                 if (sm->eapReq) {
 477                         sm->backendAccessChallenges++;
 478                         SM_ENTER(BE_AUTH, REQUEST);
 479                 } else if (sm->aWhile == 0)
 480                         SM_ENTER(BE_AUTH, TIMEOUT);
 481                 else if (sm->eapFail) {
 482                         sm->backendAuthFails++;
 483                         SM_ENTER(BE_AUTH, FAIL);
 484                 } else if (sm->eapSuccess) {
 485                         sm->backendAuthSuccesses++;
 486                         SM_ENTER(BE_AUTH, SUCCESS);
 487                 }
 488                 break;
 489         case BE_AUTH_SUCCESS:
 490                 SM_ENTER(BE_AUTH, IDLE);
 491                 break;
 492         case BE_AUTH_FAIL:
 493                 SM_ENTER(BE_AUTH, IDLE);
 494                 break;
 495         case BE_AUTH_TIMEOUT:
 496                 SM_ENTER(BE_AUTH, IDLE);
 497                 break;
 498         case BE_AUTH_IDLE:
 499                 if (sm->eapFail && sm->authStart)
 500                         SM_ENTER(BE_AUTH, FAIL);
 501                 else if (sm->eapReq && sm->authStart)
 502                         SM_ENTER(BE_AUTH, REQUEST);
 503                 else if (sm->eapSuccess && sm->authStart)
 504                         SM_ENTER(BE_AUTH, SUCCESS);
 505                 break;
 506         case BE_AUTH_IGNORE:
 507                 if (sm->eapolEap)
 508                         SM_ENTER(BE_AUTH, RESPONSE);
 509                 else if (sm->eapReq)
 510                         SM_ENTER(BE_AUTH, REQUEST);
 511                 else if (sm->eapTimeout)
 512                         SM_ENTER(BE_AUTH, TIMEOUT);
 513                 break;
 514         }
 515 }
 516
 517
 518
 519 /* Reauthentication Timer state machine */
 520
 521 SM_STATE(REAUTH_TIMER, INITIALIZE)
 522 {
 523         SM_ENTRY_MA(REAUTH_TIMER, INITIALIZE, reauth_timer);
 524
 525         sm->reAuthWhen = sm->reAuthPeriod;
 526 }
 527
 528
 529 SM_STATE(REAUTH_TIMER, REAUTHENTICATE)
 530 {
 531         SM_ENTRY_MA(REAUTH_TIMER, REAUTHENTICATE, reauth_timer);
 532
 533         sm->reAuthenticate = TRUE;
 534         wpa_auth_sm_event(sm->sta->wpa_sm, WPA_REAUTH_EAPOL);
 535 }
 536
 537
 538 SM_STEP(REAUTH_TIMER)
 539 {
 540         if (sm->portControl != Auto || sm->initialize ||
 541             sm->authPortStatus == Unauthorized || !sm->reAuthEnabled) {
 542                 SM_ENTER(REAUTH_TIMER, INITIALIZE);
 543                 return;
 544         }
 545
 546         switch (sm->reauth_timer_state) {
 547         case REAUTH_TIMER_INITIALIZE:
 548                 if (sm->reAuthWhen == 0)
 549                         SM_ENTER(REAUTH_TIMER, REAUTHENTICATE);
 550                 break;
 551         case REAUTH_TIMER_REAUTHENTICATE:
 552                 SM_ENTER(REAUTH_TIMER, INITIALIZE);
 553                 break;
 554         }
 555 }
 556
 557
 558
 559 /* Authenticator Key Transmit state machine */
 560
 561 SM_STATE(AUTH_KEY_TX, NO_KEY_TRANSMIT)
 562 {
 563         SM_ENTRY_MA(AUTH_KEY_TX, NO_KEY_TRANSMIT, auth_key_tx);
 564 }
 565
 566
 567 SM_STATE(AUTH_KEY_TX, KEY_TRANSMIT)
 568 {
 569         SM_ENTRY_MA(AUTH_KEY_TX, KEY_TRANSMIT, auth_key_tx);
 570
 571         txKey();
 572         sm->keyAvailable = FALSE;
 573         sm->keyDone = TRUE;
 574 }
 575
 576
 577 SM_STEP(AUTH_KEY_TX)
 578 {
 579         if (sm->initialize || sm->portControl != Auto) {
 580                 SM_ENTER(AUTH_KEY_TX, NO_KEY_TRANSMIT);
 581                 return;
 582         }
 583
 584         switch (sm->auth_key_tx_state) {
 585         case AUTH_KEY_TX_NO_KEY_TRANSMIT:
 586                 if (sm->keyTxEnabled && sm->keyAvailable && sm->keyRun &&
 587                     !wpa_auth_sta_wpa_version(sm->sta->wpa_sm))
 588                         SM_ENTER(AUTH_KEY_TX, KEY_TRANSMIT);
 589                 break;
 590         case AUTH_KEY_TX_KEY_TRANSMIT:
 591                 if (!sm->keyTxEnabled || !sm->keyRun)
 592                         SM_ENTER(AUTH_KEY_TX, NO_KEY_TRANSMIT);
 593                 else if (sm->keyAvailable)
 594                         SM_ENTER(AUTH_KEY_TX, KEY_TRANSMIT);
 595                 break;
 596         }
 597 }
 598
 599
 600
 601 /* Key Receive state machine */
 602
 603 SM_STATE(KEY_RX, NO_KEY_RECEIVE)
 604 {
 605         SM_ENTRY_MA(KEY_RX, NO_KEY_RECEIVE, key_rx);
 606 }
 607
 608
 609 SM_STATE(KEY_RX, KEY_RECEIVE)
 610 {
 611         SM_ENTRY_MA(KEY_RX, KEY_RECEIVE, key_rx);
 612
 613         processKey();
 614         sm->rxKey = FALSE;
 615 }
 616
 617
 618 SM_STEP(KEY_RX)
 619 {
 620         if (sm->initialize || !sm->portEnabled) {
 621                 SM_ENTER(KEY_RX, NO_KEY_RECEIVE);
 622                 return;
 623         }
 624
 625         switch (sm->key_rx_state) {
 626         case KEY_RX_NO_KEY_RECEIVE:
 627                 if (sm->rxKey)
 628                         SM_ENTER(KEY_RX, KEY_RECEIVE);
 629                 break;
 630         case KEY_RX_KEY_RECEIVE:
 631                 if (sm->rxKey)
 632                         SM_ENTER(KEY_RX, KEY_RECEIVE);
 633                 break;
 634         }
 635 }
 636
 637
 638
 639 /* Controlled Directions state machine */
 640
 641 SM_STATE(CTRL_DIR, FORCE_BOTH)
 642 {
 643         SM_ENTRY_MA(CTRL_DIR, FORCE_BOTH, ctrl_dir);
 644         sm->operControlledDirections = Both;
 645 }
 646
 647
 648 SM_STATE(CTRL_DIR, IN_OR_BOTH)
 649 {
 650         SM_ENTRY_MA(CTRL_DIR, IN_OR_BOTH, ctrl_dir);
 651         sm->operControlledDirections = sm->adminControlledDirections;
 652 }
 653
 654
 655 SM_STEP(CTRL_DIR)
 656 {
 657         if (sm->initialize) {
 658                 SM_ENTER(CTRL_DIR, IN_OR_BOTH);
 659                 return;
 660         }
 661
 662         switch (sm->ctrl_dir_state) {
 663         case CTRL_DIR_FORCE_BOTH:
 664                 if (sm->portEnabled && sm->operEdge)
 665                         SM_ENTER(CTRL_DIR, IN_OR_BOTH);
 666                 break;
 667         case CTRL_DIR_IN_OR_BOTH:
 668                 if (sm->operControlledDirections !=
 669                     sm->adminControlledDirections)
 670                         SM_ENTER(CTRL_DIR, IN_OR_BOTH);
 671                 if (!sm->portEnabled || !sm->operEdge)
 672                         SM_ENTER(CTRL_DIR, FORCE_BOTH);
 673                 break;
 674         }
 675 }
 676
 677
 678
 679 struct eapol_state_machine *
 680 eapol_sm_alloc(struct hostapd_data *hapd, struct sta_info *sta)
 681 {
 682         struct eapol_state_machine *sm;
 683
 684         sm = wpa_zalloc(sizeof(*sm));
 685         if (sm == NULL) {
 686                 printf("IEEE 802.1X port state allocation failed\n");
 687                 return NULL;
 688         }
 689         sm->radius_identifier = -1;
 690         memcpy(sm->addr, sta->addr, ETH_ALEN);
 691         if (sta->flags & WLAN_STA_PREAUTH)
 692                 sm->flags |= EAPOL_SM_PREAUTH;
 693
 694         sm->hapd = hapd;
 695         sm->sta = sta;
 696
 697         /* Set default values for state machine constants */
 698         sm->auth_pae_state = AUTH_PAE_INITIALIZE;
 699         sm->quietPeriod = AUTH_PAE_DEFAULT_quietPeriod;
 700         sm->reAuthMax = AUTH_PAE_DEFAULT_reAuthMax;
 701
 702         sm->be_auth_state = BE_AUTH_INITIALIZE;
 703         sm->serverTimeout = BE_AUTH_DEFAULT_serverTimeout;
 704
 705         sm->reauth_timer_state = REAUTH_TIMER_INITIALIZE;
 706         sm->reAuthPeriod = hapd->conf->eap_reauth_period;
 707         sm->reAuthEnabled = hapd->conf->eap_reauth_period > 0 ? TRUE : FALSE;
 708
 709         sm->auth_key_tx_state = AUTH_KEY_TX_NO_KEY_TRANSMIT;
 710
 711         sm->key_rx_state = KEY_RX_NO_KEY_RECEIVE;
 712
 713         sm->ctrl_dir_state = CTRL_DIR_IN_OR_BOTH;
 714
 715         sm->portEnabled = FALSE;
 716         sm->portControl = Auto;
 717
 718         sm->keyAvailable = FALSE;
 719         if (!hapd->conf->wpa &&
 720             (hapd->default_wep_key || hapd->conf->individual_wep_key_len > 0))
 721                 sm->keyTxEnabled = TRUE;
 722         else
 723                 sm->keyTxEnabled = FALSE;
 724         if (hapd->conf->wpa)
 725                 sm->portValid = FALSE;
 726         else
 727                 sm->portValid = TRUE;
 728
 729         if (hapd->conf->eap_server) {
 730                 struct eap_config eap_conf;
 731                 memset(&eap_conf, 0, sizeof(eap_conf));
 732                 eap_conf.ssl_ctx = hapd->ssl_ctx;
 733                 eap_conf.eap_sim_db_priv = hapd->eap_sim_db_priv;
 734                 sm->eap = eap_sm_init(sm, &eapol_cb, &eap_conf);
 735                 if (sm->eap == NULL) {
 736                         eapol_sm_free(sm);
 737                         return NULL;
 738                 }
 739         }
 740
 741         eapol_sm_initialize(sm);
 742
 743         return sm;
 744 }
 745
 746
 747 void eapol_sm_free(struct eapol_state_machine *sm)
 748 {
 749         if (sm == NULL)
 750                 return;
 751
 752         eloop_cancel_timeout(eapol_port_timers_tick, sm->hapd, sm);
 753         eloop_cancel_timeout(eapol_sm_step_cb, sm, NULL);
 754         if (sm->eap)
 755                 eap_sm_deinit(sm->eap);
 756         free(sm);
 757 }
 758
 759
 760 static int eapol_sm_sta_entry_alive(struct hostapd_data *hapd, u8 *addr)
 761 {
 762         struct sta_info *sta;
 763         sta = ap_get_sta(hapd, addr);
 764         if (sta == NULL || sta->eapol_sm == NULL)
 765                 return 0;
 766         return 1;
 767 }
 768
 769
 770 static void eapol_sm_step_run(struct eapol_state_machine *sm)
 771 {
 772         struct hostapd_data *hapd = sm->hapd;
 773         u8 addr[ETH_ALEN];
 774         unsigned int prev_auth_pae, prev_be_auth, prev_reauth_timer,
 775                 prev_auth_key_tx, prev_key_rx, prev_ctrl_dir;
 776         int max_steps = 100;
 777
 778         memcpy(addr, sm->sta->addr, ETH_ALEN);
 779
 780         /*
 781          * Allow EAPOL state machines to run as long as there are state
 782          * changes, but exit and return here through event loop if more than
 783          * 100 steps is needed as a precaution against infinite loops inside
 784          * eloop callback.
 785          */
 786 restart:
 787         prev_auth_pae = sm->auth_pae_state;
 788         prev_be_auth = sm->be_auth_state;
 789         prev_reauth_timer = sm->reauth_timer_state;
 790         prev_auth_key_tx = sm->auth_key_tx_state;
 791         prev_key_rx = sm->key_rx_state;
 792         prev_ctrl_dir = sm->ctrl_dir_state;
 793
 794         SM_STEP_RUN(AUTH_PAE);
 795         if (sm->initializing || eapol_sm_sta_entry_alive(hapd, addr))
 796                 SM_STEP_RUN(BE_AUTH);
 797         if (sm->initializing || eapol_sm_sta_entry_alive(hapd, addr))
 798                 SM_STEP_RUN(REAUTH_TIMER);
 799         if (sm->initializing || eapol_sm_sta_entry_alive(hapd, addr))
 800                 SM_STEP_RUN(AUTH_KEY_TX);
 801         if (sm->initializing || eapol_sm_sta_entry_alive(hapd, addr))
 802                 SM_STEP_RUN(KEY_RX);
 803         if (sm->initializing || eapol_sm_sta_entry_alive(hapd, addr))
 804                 SM_STEP_RUN(CTRL_DIR);
 805
 806         if (prev_auth_pae != sm->auth_pae_state ||
 807             prev_be_auth != sm->be_auth_state ||
 808             prev_reauth_timer != sm->reauth_timer_state ||
 809             prev_auth_key_tx != sm->auth_key_tx_state ||
 810             prev_key_rx != sm->key_rx_state ||
 811             prev_ctrl_dir != sm->ctrl_dir_state) {
 812                 if (--max_steps > 0)
 813                         goto restart;
 814                 /* Re-run from eloop timeout */
 815                 eapol_sm_step(sm);
 816                 return;
 817         }
 818
 819         if (eapol_sm_sta_entry_alive(hapd, addr) && sm->eap) {
 820                 if (eap_sm_step(sm->eap)) {
 821                         if (--max_steps > 0)
 822                                 goto restart;
 823                         /* Re-run from eloop timeout */
 824                         eapol_sm_step(sm);
 825                         return;
 826                 }
 827         }
 828
 829         if (eapol_sm_sta_entry_alive(hapd, addr))
 830                 wpa_auth_sm_notify(sm->sta->wpa_sm);
 831 }
 832
 833
 834 static void eapol_sm_step_cb(void *eloop_ctx, void *timeout_ctx)
 835 {
 836         struct eapol_state_machine *sm = eloop_ctx;
 837         eapol_sm_step_run(sm);
 838 }
 839
 840
 841 void eapol_sm_step(struct eapol_state_machine *sm)
 842 {
 843         /*
 844          * Run eapol_sm_step_run from a registered timeout to make sure that
 845          * other possible timeouts/events are processed and to avoid long
 846          * function call chains.
 847          */
 848
 849         eloop_register_timeout(0, 0, eapol_sm_step_cb, sm, NULL);
 850 }
 851
 852
 853 void eapol_sm_initialize(struct eapol_state_machine *sm)
 854 {
 855         sm->initializing = TRUE;
 856         /* Initialize the state machines by asserting initialize and then
 857          * deasserting it after one step */
 858         sm->initialize = TRUE;
 859         eapol_sm_step_run(sm);
 860         sm->initialize = FALSE;
 861         eapol_sm_step_run(sm);
 862         sm->initializing = FALSE;
 863
 864         /* Start one second tick for port timers state machine */
 865         eloop_cancel_timeout(eapol_port_timers_tick, sm->hapd, sm);
 866         eloop_register_timeout(1, 0, eapol_port_timers_tick, sm->hapd, sm);
 867 }
 868
 869
 870 #ifdef HOSTAPD_DUMP_STATE
 871 static inline const char * port_type_txt(PortTypes pt)
 872 {
 873         switch (pt) {
 874         case ForceUnauthorized: return "ForceUnauthorized";
 875         case ForceAuthorized: return "ForceAuthorized";
 876         case Auto: return "Auto";
 877         default: return "Unknown";
 878         }
 879 }
 880
 881
 882 static inline const char * port_state_txt(PortState ps)
 883 {
 884         switch (ps) {
 885         case Unauthorized: return "Unauthorized";
 886         case Authorized: return "Authorized";
 887         default: return "Unknown";
 888         }
 889 }
 890
 891
 892 static inline const char * ctrl_dir_txt(ControlledDirection dir)
 893 {
 894         switch (dir) {
 895         case Both: return "Both";
 896         case In: return "In";
 897         default: return "Unknown";
 898         }
 899 }
 900
 901
 902 static inline const char * auth_pae_state_txt(int s)
 903 {
 904         switch (s) {
 905         case AUTH_PAE_INITIALIZE: return "INITIALIZE";
 906         case AUTH_PAE_DISCONNECTED: return "DISCONNECTED";
 907         case AUTH_PAE_CONNECTING: return "CONNECTING";
 908         case AUTH_PAE_AUTHENTICATING: return "AUTHENTICATING";
 909         case AUTH_PAE_AUTHENTICATED: return "AUTHENTICATED";
 910         case AUTH_PAE_ABORTING: return "ABORTING";
 911         case AUTH_PAE_HELD: return "HELD";
 912         case AUTH_PAE_FORCE_AUTH: return "FORCE_AUTH";
 913         case AUTH_PAE_FORCE_UNAUTH: return "FORCE_UNAUTH";
 914         case AUTH_PAE_RESTART: return "RESTART";
 915         default: return "Unknown";
 916         }
 917 }
 918
 919
 920 static inline const char * be_auth_state_txt(int s)
 921 {
 922         switch (s) {
 923         case BE_AUTH_REQUEST: return "REQUEST";
 924         case BE_AUTH_RESPONSE: return "RESPONSE";
 925         case BE_AUTH_SUCCESS: return "SUCCESS";
 926         case BE_AUTH_FAIL: return "FAIL";
 927         case BE_AUTH_TIMEOUT: return "TIMEOUT";
 928         case BE_AUTH_IDLE: return "IDLE";
 929         case BE_AUTH_INITIALIZE: return "INITIALIZE";
 930         case BE_AUTH_IGNORE: return "IGNORE";
 931         default: return "Unknown";
 932         }
 933 }
 934
 935
 936 static inline const char * reauth_timer_state_txt(int s)
 937 {
 938         switch (s) {
 939         case REAUTH_TIMER_INITIALIZE: return "INITIALIZE";
 940         case REAUTH_TIMER_REAUTHENTICATE: return "REAUTHENTICATE";
 941         default: return "Unknown";
 942         }
 943 }
 944
 945
 946 static inline const char * auth_key_tx_state_txt(int s)
 947 {
 948         switch (s) {
 949         case AUTH_KEY_TX_NO_KEY_TRANSMIT: return "NO_KEY_TRANSMIT";
 950         case AUTH_KEY_TX_KEY_TRANSMIT: return "KEY_TRANSMIT";
 951         default: return "Unknown";
 952         }
 953 }
 954
 955
 956 static inline const char * key_rx_state_txt(int s)
 957 {
 958         switch (s) {
 959         case KEY_RX_NO_KEY_RECEIVE: return "NO_KEY_RECEIVE";
 960         case KEY_RX_KEY_RECEIVE: return "KEY_RECEIVE";
 961         default: return "Unknown";
 962         }
 963 }
 964
 965
 966 static inline const char * ctrl_dir_state_txt(int s)
 967 {
 968         switch (s) {
 969         case CTRL_DIR_FORCE_BOTH: return "FORCE_BOTH";
 970         case CTRL_DIR_IN_OR_BOTH: return "IN_OR_BOTH";
 971         default: return "Unknown";
 972         }
 973 }
 974
 975
 976 void eapol_sm_dump_state(FILE *f, const char *prefix,
 977                          struct eapol_state_machine *sm)
 978 {
 979         fprintf(f, "%sEAPOL state machine:\n", prefix);
 980         fprintf(f, "%s  aWhile=%d quietWhile=%d reAuthWhen=%d\n", prefix,
 981                 sm->aWhile, sm->quietWhile, sm->reAuthWhen);
 982 #define _SB(b) ((b) ? "TRUE" : "FALSE")
 983         fprintf(f,
 984                 "%s  authAbort=%s authFail=%s authPortStatus=%s authStart=%s\n"
 985                 "%s  authTimeout=%s authSuccess=%s eapFail=%s eapolEap=%s\n"
 986                 "%s  eapSuccess=%s eapTimeout=%s initialize=%s "
 987                 "keyAvailable=%s\n"
 988                 "%s  keyDone=%s keyRun=%s keyTxEnabled=%s portControl=%s\n"
 989                 "%s  portEnabled=%s portValid=%s reAuthenticate=%s\n",
 990                 prefix, _SB(sm->authAbort), _SB(sm->authFail),
 991                 port_state_txt(sm->authPortStatus), _SB(sm->authStart),
 992                 prefix, _SB(sm->authTimeout), _SB(sm->authSuccess),
 993                 _SB(sm->eapFail), _SB(sm->eapolEap),
 994                 prefix, _SB(sm->eapSuccess), _SB(sm->eapTimeout),
 995                 _SB(sm->initialize), _SB(sm->keyAvailable),
 996                 prefix, _SB(sm->keyDone), _SB(sm->keyRun),
 997                 _SB(sm->keyTxEnabled), port_type_txt(sm->portControl),
 998                 prefix, _SB(sm->portEnabled), _SB(sm->portValid),
 999                 _SB(sm->reAuthenticate));
1000
1001         fprintf(f, "%s  Authenticator PAE:\n"
1002                 "%s    state=%s\n"
1003                 "%s    eapolLogoff=%s eapolStart=%s eapRestart=%s\n"
1004                 "%s    portMode=%s reAuthCount=%d\n"
1005                 "%s    quietPeriod=%d reAuthMax=%d\n"
1006                 "%s    authEntersConnecting=%d\n"
1007                 "%s    authEapLogoffsWhileConnecting=%d\n"
1008                 "%s    authEntersAuthenticating=%d\n"
1009                 "%s    authAuthSuccessesWhileAuthenticating=%d\n"
1010                 "%s    authAuthTimeoutsWhileAuthenticating=%d\n"
1011                 "%s    authAuthFailWhileAuthenticating=%d\n"
1012                 "%s    authAuthEapStartsWhileAuthenticating=%d\n"
1013                 "%s    authAuthEapLogoffWhileAuthenticating=%d\n"
1014                 "%s    authAuthReauthsWhileAuthenticated=%d\n"
1015                 "%s    authAuthEapStartsWhileAuthenticated=%d\n"
1016                 "%s    authAuthEapLogoffWhileAuthenticated=%d\n",
1017                 prefix, prefix, auth_pae_state_txt(sm->auth_pae_state), prefix,
1018                 _SB(sm->eapolLogoff), _SB(sm->eapolStart), _SB(sm->eapRestart),
1019                 prefix, port_type_txt(sm->portMode), sm->reAuthCount,
1020                 prefix, sm->quietPeriod, sm->reAuthMax,
1021                 prefix, sm->authEntersConnecting,
1022                 prefix, sm->authEapLogoffsWhileConnecting,
1023                 prefix, sm->authEntersAuthenticating,
1024                 prefix, sm->authAuthSuccessesWhileAuthenticating,
1025                 prefix, sm->authAuthTimeoutsWhileAuthenticating,
1026                 prefix, sm->authAuthFailWhileAuthenticating,
1027                 prefix, sm->authAuthEapStartsWhileAuthenticating,
1028                 prefix, sm->authAuthEapLogoffWhileAuthenticating,
1029                 prefix, sm->authAuthReauthsWhileAuthenticated,
1030                 prefix, sm->authAuthEapStartsWhileAuthenticated,
1031                 prefix, sm->authAuthEapLogoffWhileAuthenticated);
1032
1033         fprintf(f, "%s  Backend Authentication:\n"
1034                 "%s    state=%s\n"
1035                 "%s    eapNoReq=%s eapReq=%s eapResp=%s\n"
1036                 "%s    serverTimeout=%d\n"
1037                 "%s    backendResponses=%d\n"
1038                 "%s    backendAccessChallenges=%d\n"
1039                 "%s    backendOtherRequestsToSupplicant=%d\n"
1040                 "%s    backendAuthSuccesses=%d\n"
1041                 "%s    backendAuthFails=%d\n",
1042                 prefix, prefix,
1043                 be_auth_state_txt(sm->be_auth_state),
1044                 prefix, _SB(sm->eapNoReq), _SB(sm->eapReq), _SB(sm->eapResp),
1045                 prefix, sm->serverTimeout,
1046                 prefix, sm->backendResponses,
1047                 prefix, sm->backendAccessChallenges,
1048                 prefix, sm->backendOtherRequestsToSupplicant,
1049                 prefix, sm->backendAuthSuccesses,
1050                 prefix, sm->backendAuthFails);
1051
1052         fprintf(f, "%s  Reauthentication Timer:\n"
1053                 "%s    state=%s\n"
1054                 "%s    reAuthPeriod=%d reAuthEnabled=%s\n", prefix, prefix,
1055                 reauth_timer_state_txt(sm->reauth_timer_state), prefix,
1056                 sm->reAuthPeriod, _SB(sm->reAuthEnabled));
1057
1058         fprintf(f, "%s  Authenticator Key Transmit:\n"
1059                 "%s    state=%s\n", prefix, prefix,
1060                 auth_key_tx_state_txt(sm->auth_key_tx_state));
1061
1062         fprintf(f, "%s  Key Receive:\n"
1063                 "%s    state=%s\n"
1064                 "%s    rxKey=%s\n", prefix, prefix,
1065                 key_rx_state_txt(sm->key_rx_state), prefix, _SB(sm->rxKey));
1066
1067         fprintf(f, "%s  Controlled Directions:\n"
1068                 "%s    state=%s\n"
1069                 "%s    adminControlledDirections=%s "
1070                 "operControlledDirections=%s\n"
1071                 "%s    operEdge=%s\n", prefix, prefix,
1072                 ctrl_dir_state_txt(sm->ctrl_dir_state),
1073                 prefix, ctrl_dir_txt(sm->adminControlledDirections),
1074                 ctrl_dir_txt(sm->operControlledDirections),
1075                 prefix, _SB(sm->operEdge));
1076 #undef _SB
1077 }
1078 #endif /* HOSTAPD_DUMP_STATE */
1079
1080
1081 static Boolean eapol_sm_get_bool(void *ctx, enum eapol_bool_var variable)
1082 {
1083         struct eapol_state_machine *sm = ctx;
1084         if (sm == NULL)
1085                 return FALSE;
1086         switch (variable) {
1087         case EAPOL_eapSuccess:
1088                 return sm->eapSuccess;
1089         case EAPOL_eapRestart:
1090                 return sm->eapRestart;
1091         case EAPOL_eapFail:
1092                 return sm->eapFail;
1093         case EAPOL_eapResp:
1094                 return sm->eapResp;
1095         case EAPOL_eapReq:
1096                 return sm->eapReq;
1097         case EAPOL_eapNoReq:
1098                 return sm->eapNoReq;
1099         case EAPOL_portEnabled:
1100                 return sm->portEnabled;
1101         case EAPOL_eapTimeout:
1102                 return sm->eapTimeout;
1103         }
1104         return FALSE;
1105 }
1106
1107
1108 static void eapol_sm_set_bool(void *ctx, enum eapol_bool_var variable,
1109                               Boolean value)
1110 {
1111         struct eapol_state_machine *sm = ctx;
1112         if (sm == NULL)
1113                 return;
1114         switch (variable) {
1115         case EAPOL_eapSuccess:
1116                 sm->eapSuccess = value;
1117                 break;
1118         case EAPOL_eapRestart:
1119                 sm->eapRestart = value;
1120                 break;
1121         case EAPOL_eapFail:
1122                 sm->eapFail = value;
1123                 break;
1124         case EAPOL_eapResp:
1125                 sm->eapResp = value;
1126                 break;
1127         case EAPOL_eapReq:
1128                 sm->eapReq = value;
1129                 break;
1130         case EAPOL_eapNoReq:
1131                 sm->eapNoReq = value;
1132                 break;
1133         case EAPOL_portEnabled:
1134                 sm->portEnabled = value;
1135                 break;
1136         case EAPOL_eapTimeout:
1137                 sm->eapTimeout = value;
1138                 break;
1139         }
1140 }
1141
1142
1143 static void eapol_sm_set_eapReqData(void *ctx, const u8 *eapReqData,
1144                                     size_t eapReqDataLen)
1145 {
1146         struct eapol_state_machine *sm = ctx;
1147         if (sm == NULL)
1148                 return;
1149
1150         free(sm->last_eap_radius);
1151         sm->last_eap_radius = malloc(eapReqDataLen);
1152         if (sm->last_eap_radius == NULL)
1153                 return;
1154         memcpy(sm->last_eap_radius, eapReqData, eapReqDataLen);
1155         sm->last_eap_radius_len = eapReqDataLen;
1156 }
1157
1158
1159 static void eapol_sm_set_eapKeyData(void *ctx, const u8 *eapKeyData,
1160                                     size_t eapKeyDataLen)
1161 {
1162         struct eapol_state_machine *sm = ctx;
1163         struct hostapd_data *hapd;
1164
1165         if (sm == NULL)
1166                 return;
1167
1168         hapd = sm->hapd;
1169
1170         if (eapKeyData && eapKeyDataLen >= 64) {
1171                 free(sm->eapol_key_sign);
1172                 free(sm->eapol_key_crypt);
1173                 sm->eapol_key_crypt = malloc(32);
1174                 if (sm->eapol_key_crypt) {
1175                         memcpy(sm->eapol_key_crypt, eapKeyData, 32);
1176                         sm->eapol_key_crypt_len = 32;
1177                 }
1178                 sm->eapol_key_sign = malloc(32);
1179                 if (sm->eapol_key_sign) {
1180                         memcpy(sm->eapol_key_sign, eapKeyData + 32, 32);
1181                         sm->eapol_key_sign_len = 32;
1182                 }
1183                 if (hapd->default_wep_key ||
1184                     hapd->conf->individual_wep_key_len > 0 ||
1185                     hapd->conf->wpa)
1186                         sm->keyAvailable = TRUE;
1187         } else {
1188                 free(sm->eapol_key_sign);
1189                 free(sm->eapol_key_crypt);
1190                 sm->eapol_key_sign = NULL;
1191                 sm->eapol_key_crypt = NULL;
1192                 sm->eapol_key_sign_len = 0;
1193                 sm->eapol_key_crypt_len = 0;
1194                 sm->keyAvailable = FALSE;
1195         }
1196 }
1197
1198
1199 static int eapol_sm_get_eap_user(void *ctx, const u8 *identity,
1200                                  size_t identity_len, int phase2,
1201                                  struct eap_user *user)
1202 {
1203         struct eapol_state_machine *sm = ctx;
1204         const struct hostapd_eap_user *eap_user;
1205         int i, count;
1206
1207         eap_user = hostapd_get_eap_user(sm->hapd->conf, identity,
1208                                         identity_len, phase2);
1209         if (eap_user == NULL)
1210                 return -1;
1211
1212         memset(user, 0, sizeof(*user));
1213         user->phase2 = phase2;
1214         count = EAP_USER_MAX_METHODS;
1215         if (count > EAP_MAX_METHODS)
1216                 count = EAP_MAX_METHODS;
1217         for (i = 0; i < count; i++) {
1218                 user->methods[i].vendor = eap_user->methods[i].vendor;
1219                 user->methods[i].method = eap_user->methods[i].method;
1220         }
1221
1222         if (eap_user->password) {
1223                 user->password = malloc(eap_user->password_len);
1224                 if (user->password == NULL)
1225                         return -1;
1226                 memcpy(user->password, eap_user->password,
1227                        eap_user->password_len);
1228                 user->password_len = eap_user->password_len;
1229         }
1230         user->force_version = eap_user->force_version;
1231
1232         return 0;
1233 }
1234
1235
1236 static const char * eapol_sm_get_eap_req_id_text(void *ctx, size_t *len)
1237 {
1238         struct eapol_state_machine *sm = ctx;
1239         *len = sm->hapd->conf->eap_req_id_text_len;
1240         return sm->hapd->conf->eap_req_id_text;
1241 }
1242
1243
1244 static struct eapol_callbacks eapol_cb =
1245 {
1246         .get_bool = eapol_sm_get_bool,
1247         .set_bool = eapol_sm_set_bool,
1248         .set_eapReqData = eapol_sm_set_eapReqData,
1249         .set_eapKeyData = eapol_sm_set_eapKeyData,
1250         .get_eap_user = eapol_sm_get_eap_user,
1251         .get_eap_req_id_text = eapol_sm_get_eap_req_id_text,
1252 };
1253
1254
1255 int eapol_sm_eap_pending_cb(struct eapol_state_machine *sm, void *ctx)
1256 {
1257         if (sm == NULL || ctx != sm->eap)
1258                 return -1;
1259
1260         eap_sm_pending_cb(sm->eap);
1261         eapol_sm_step(sm);
1262
1263         return 0;
1264 }