Extensible Authentication Protocol. More...

#include <stdint.h>
#include <ipxe/netdevice.h>
#include <ipxe/timer.h>
#include <ipxe/tables.h>

Data Structures
struct	eap_header
	EAP header. More...
struct	eap_message
	EAP request/response message. More...
struct	eap_md5
	EAP MD5 challenge request/response type data. More...
struct	eap_mschapv2
	EAP MS-CHAPv2 request/response type data. More...
union	eap_packet
	EAP packet. More...
struct	eap_supplicant
	An EAP supplicant. More...
struct	eap_method
	An EAP method. More...

Macros
#define	EAP_CODE_REQUEST 1
	EAP request.
#define	EAP_CODE_RESPONSE 2
	EAP response.
#define	EAP_TYPE_NONE 0
	EAP "no available types" marker.
#define	EAP_TYPE_IDENTITY 1
	EAP identity.
#define	EAP_TYPE_NAK 3
	EAP NAK.
#define	EAP_TYPE_MD5 4
	EAP MD5 challenge request/response.
#define	EAP_TYPE_MSCHAPV2 26
	EAP MS-CHAPv2 request/response.
#define	EAP_CODE_SUCCESS 3
	EAP success.
#define	EAP_CODE_FAILURE 4
	EAP failure.
#define	EAP_BLOCK_TIMEOUT ( 45 * TICKS_PER_SEC )
	EAP link block timeout.
#define	EAP_WAIT_TIMEOUT ( EAP_BLOCK_TIMEOUT * 7 / 8 )
	EAP protocol wait timeout.
#define	EAP_FL_ONGOING 0x0001
	EAP authentication is in progress.
#define	EAP_FL_PASSIVE 0x0002
	EAP supplicant is passive.
#define	EAP_METHODS __table ( struct eap_method, "eap_methods" )
	EAP method table.
#define	__eap_method __table_entry ( EAP_METHODS, 01 )
	Declare an EAP method.

Functions
	FILE_LICENCE (GPL2_OR_LATER_OR_UBDL)
	FILE_SECBOOT (PERMITTED)
int	eap_tx_response (struct eap_supplicant supplicant, const void rsp, size_t rsp_len)
	Transmit EAP response.
int	eap_rx (struct eap_supplicant supplicant, const void data, size_t len)
	Handle EAP packet.

Detailed Description

Extensible Authentication Protocol.

Definition in file eap.h.

Macro Definition Documentation

◆ EAP_CODE_REQUEST

#define EAP_CODE_REQUEST 1

EAP request.

Definition at line 29 of file eap.h.

Referenced by eap_rx(), and eap_rx_mschapv2().

◆ EAP_CODE_RESPONSE

#define EAP_CODE_RESPONSE 2

EAP response.

Definition at line 32 of file eap.h.

Referenced by eap_rx(), eap_rx_mschapv2_request(), and eap_tx_response().

◆ EAP_TYPE_NONE

#define EAP_TYPE_NONE 0

EAP "no available types" marker.

Definition at line 45 of file eap.h.

Referenced by eap_tx_nak().

◆ EAP_TYPE_IDENTITY

#define EAP_TYPE_IDENTITY 1

EAP identity.

Definition at line 48 of file eap.h.

◆ EAP_TYPE_NAK

#define EAP_TYPE_NAK 3

EAP NAK.

Definition at line 51 of file eap.h.

Referenced by eap_rx_request(), and eap_tx_nak().

◆ EAP_TYPE_MD5

#define EAP_TYPE_MD5 4

EAP MD5 challenge request/response.

Definition at line 54 of file eap.h.

◆ EAP_TYPE_MSCHAPV2

#define EAP_TYPE_MSCHAPV2 26

EAP MS-CHAPv2 request/response.

Definition at line 65 of file eap.h.

◆ EAP_CODE_SUCCESS

#define EAP_CODE_SUCCESS 3

EAP success.

Definition at line 94 of file eap.h.

Referenced by eap_rx(), eap_rx_mschapv2(), and eap_rx_mschapv2_success().

◆ EAP_CODE_FAILURE

#define EAP_CODE_FAILURE 4

EAP failure.

Definition at line 97 of file eap.h.

Referenced by eap_rx().

◆ EAP_BLOCK_TIMEOUT

#define EAP_BLOCK_TIMEOUT ( 45 * TICKS_PER_SEC )

EAP link block timeout.

We mark the link as blocked upon receiving a Request-Identity, on the basis that this most likely indicates that the switch will not yet be forwarding packets.

There is no way to tell how frequently the Request-Identity packet will be retransmitted by the switch. The default value for Cisco switches seems to be 30 seconds, so treat the link as blocked for 45 seconds.

Definition at line 118 of file eap.h.

Referenced by eap_rx_identity().

◆ EAP_WAIT_TIMEOUT

#define EAP_WAIT_TIMEOUT ( EAP_BLOCK_TIMEOUT * 7 / 8 )

EAP protocol wait timeout.

In the EAP model, the supplicant is a pure responder. The model also defines no acknowledgement response for the final Success or Failure "requests". This leaves open the possibility that the final Success or Failure packet is lost, with the supplicant having no way to determine the final authentication status.

Sideband mechanisms such as EAPoL-Start may be used to restart the entire EAP process, as a (crude) workaround for this protocol flaw. When expecting to receive a further EAP request (e.g. an authentication challenge), we may wait for some length of time before triggering this restart. Choose a duration that is shorter than the link block timeout, so that there is no period during which we erroneously leave the link marked as not blocked.

Definition at line 136 of file eap.h.

Referenced by eapol_eap_rx().

◆ EAP_FL_ONGOING

#define EAP_FL_ONGOING 0x0001

EAP authentication is in progress.

This indicates that we have received an EAP Request-Identity, but have not yet received a final EAP Success or EAP Failure.

Definition at line 165 of file eap.h.

Referenced by eap_rx_identity(), and eapol_eap_rx().

◆ EAP_FL_PASSIVE

#define EAP_FL_PASSIVE 0x0002

EAP supplicant is passive.

This indicates that the supplicant should not transmit any futher unsolicited packets (e.g. EAPoL-Start for a supplicant running over EAPoL). This could be because authentication has already completed, or because we are relying upon MAC Authentication Bypass (MAB) which may have a very long timeout.

Definition at line 175 of file eap.h.

Referenced by eap_rx_failure(), eap_rx_identity(), eap_rx_success(), eapol_eap_rx(), and eapol_notify().

◆ EAP_METHODS

#define EAP_METHODS __table ( struct eap_method, "eap_methods" )

EAP method table.

Definition at line 194 of file eap.h.

Referenced by eap_rx_request(), and eap_tx_nak().

◆ __eap_method

#define __eap_method __table_entry ( EAP_METHODS, 01 )

Declare an EAP method.

Definition at line 197 of file eap.h.

Function Documentation

◆ FILE_LICENCE()

FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL )

◆ FILE_SECBOOT()

FILE_SECBOOT ( PERMITTED )

◆ eap_tx_response()

int eap_tx_response	(	struct eap_supplicant *	supplicant,
		const void *	rsp,
		size_t	rsp_len )

extern

Transmit EAP response.

Parameters

supplicant	EAP supplicant
rsp	Response type data
rsp_len	Length of response type data

Return values

rc	Return status code

Definition at line 48 of file eap.c.

                                                        {
        struct net_device *netdev = supplicant->netdev;
        struct eap_message *msg;
        size_t len;
        int rc;
 
        /* Allocate and populate response */
        len = ( sizeof ( *msg ) + rsp_len );
        msg = malloc ( len );
        if ( ! msg ) {
                rc = -ENOMEM;
                goto err_alloc;
        }
        msg->hdr.code = EAP_CODE_RESPONSE;
        msg->hdr.id = supplicant->id;
        msg->hdr.len = htons ( len );
        msg->type = supplicant->type;
        memcpy ( msg->data, rsp, rsp_len );
        DBGC ( netdev, "EAP %s Response id %#02x type %d\n",
               netdev->name, msg->hdr.id, msg->type );
 
        /* Transmit response */
        if ( ( rc = supplicant->tx ( supplicant, msg, len ) ) != 0 ) {
                DBGC ( netdev, "EAP %s could not transmit: %s\n",
                       netdev->name, strerror ( rc ) );
                goto err_tx;
        }
 
 err_tx:
        free ( msg );
 err_alloc:
        return rc;
}

References DBGC, EAP_CODE_RESPONSE, ENOMEM, free, htons, eap_supplicant::id, len, malloc(), memcpy(), msg(), eap_supplicant::netdev, netdev, rc, rsp, strerror(), eap_supplicant::tx, and eap_supplicant::type.

Referenced by eap_rx_identity(), eap_rx_md5(), eap_rx_mschapv2_request(), eap_rx_mschapv2_success(), and eap_tx_nak().

◆ eap_rx()

int eap_rx	(	struct eap_supplicant *	supplicant,
		const void *	data,
		size_t	len )