Annotation of embedaddon/strongswan/src/libcharon/sa/eap/eap_method.h, revision 1.1
1.1 ! misho 1: /*
! 2: * Copyright (C) 2006 Martin Willi
! 3: * HSR Hochschule fuer Technik Rapperswil
! 4: *
! 5: * This program is free software; you can redistribute it and/or modify it
! 6: * under the terms of the GNU General Public License as published by the
! 7: * Free Software Foundation; either version 2 of the License, or (at your
! 8: * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
! 9: *
! 10: * This program is distributed in the hope that it will be useful, but
! 11: * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
! 12: * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
! 13: * for more details.
! 14: */
! 15:
! 16: /**
! 17: * @defgroup eap_method eap_method
! 18: * @{ @ingroup eap
! 19: */
! 20:
! 21: #ifndef EAP_METHOD_H_
! 22: #define EAP_METHOD_H_
! 23:
! 24: typedef struct eap_method_t eap_method_t;
! 25: typedef enum eap_role_t eap_role_t;
! 26:
! 27: #include <library.h>
! 28: #include <plugins/plugin.h>
! 29: #include <utils/identification.h>
! 30: #include <eap/eap.h>
! 31: #include <encoding/payloads/eap_payload.h>
! 32:
! 33: /**
! 34: * Role of an eap_method, SERVER or PEER (client)
! 35: */
! 36: enum eap_role_t {
! 37: EAP_SERVER,
! 38: EAP_PEER,
! 39: };
! 40: /**
! 41: * enum names for eap_role_t.
! 42: */
! 43: extern enum_name_t *eap_role_names;
! 44:
! 45: /**
! 46: * Interface of an EAP method for server and client side.
! 47: *
! 48: * An EAP method initiates an EAP exchange and processes requests and
! 49: * responses. An EAP method may need multiple exchanges before succeeding, and
! 50: * the eap_authentication may use multiple EAP methods to authenticate a peer.
! 51: * To accomplish these requirements, all EAP methods have their own
! 52: * implementation while the eap_authenticator uses one or more of these
! 53: * EAP methods. Sending of EAP(SUCCESS/FAILURE) message is not the job
! 54: * of the method, the eap_authenticator does this.
! 55: * An EAP method may establish a MSK, this is used the complete the
! 56: * authentication. Even if a mutual EAP method is used, the traditional
! 57: * AUTH payloads are required. Only these include the nonces and messages from
! 58: * ike_sa_init and therefore prevent man in the middle attacks.
! 59: * The EAP method must use an initial EAP identifier value != 0, as a preceding
! 60: * EAP-Identity exchange always uses identifier 0.
! 61: */
! 62: struct eap_method_t {
! 63:
! 64: /**
! 65: * Initiate the EAP exchange.
! 66: *
! 67: * initiate() is only usable for server implementations, as clients only
! 68: * reply to server requests.
! 69: * A eap_payload is created in "out" if result is NEED_MORE.
! 70: *
! 71: * @param out eap_payload to send to the client
! 72: * @return
! 73: * - NEED_MORE, if an other exchange is required
! 74: * - FAILED, if unable to create eap request payload
! 75: */
! 76: status_t (*initiate) (eap_method_t *this, eap_payload_t **out);
! 77:
! 78: /**
! 79: * Process a received EAP message.
! 80: *
! 81: * A eap_payload is created in "out" if result is NEED_MORE.
! 82: *
! 83: * @param in eap_payload response received
! 84: * @param out created eap_payload to send
! 85: * @return
! 86: * - NEED_MORE, if an other exchange is required
! 87: * - FAILED, if EAP method failed
! 88: * - SUCCESS, if EAP method succeeded
! 89: */
! 90: status_t (*process) (eap_method_t *this, eap_payload_t *in,
! 91: eap_payload_t **out);
! 92:
! 93: /**
! 94: * Get the EAP type implemented in this method.
! 95: *
! 96: * @param vendor pointer receiving vendor identifier for type, 0 for none
! 97: * @return type of the EAP method
! 98: */
! 99: eap_type_t (*get_type) (eap_method_t *this, uint32_t *vendor);
! 100:
! 101: /**
! 102: * Check if this EAP method authenticates the server.
! 103: *
! 104: * Some EAP methods provide mutual authentication and
! 105: * allow authentication using only EAP, if the peer supports it.
! 106: *
! 107: * @return TRUE if methods provides mutual authentication
! 108: */
! 109: bool (*is_mutual) (eap_method_t *this);
! 110:
! 111: /**
! 112: * Get the MSK established by this EAP method.
! 113: *
! 114: * Not all EAP methods establish a shared secret. For implementations of
! 115: * the EAP-Identity method, get_msk() returns the received identity.
! 116: *
! 117: * @param msk chunk receiving internal stored MSK
! 118: * @return
! 119: * - SUCCESS, or
! 120: * - FAILED, if MSK not established (yet)
! 121: */
! 122: status_t (*get_msk) (eap_method_t *this, chunk_t *msk);
! 123:
! 124: /**
! 125: * Get the current EAP identifier.
! 126: *
! 127: * @return current EAP identifier
! 128: */
! 129: uint8_t (*get_identifier) (eap_method_t *this);
! 130:
! 131: /**
! 132: * Set the EAP identifier to a deterministic value, overwriting
! 133: * the randomly initialized default value.
! 134: *
! 135: * @param identifier current EAP identifier
! 136: */
! 137: void (*set_identifier) (eap_method_t *this, uint8_t identifier);
! 138:
! 139: /**
! 140: * Get authentication details performed by this EAP method.
! 141: *
! 142: * After EAP completion, the auth data contains additional information
! 143: * of the authentication process, used certificates etc.
! 144: * This method is optional to implement, but if it is, it must return
! 145: * a valid auth_cfg.
! 146: *
! 147: * @return auth method, internal data
! 148: */
! 149: auth_cfg_t* (*get_auth)(eap_method_t *this);
! 150:
! 151: /**
! 152: * Destroys a eap_method_t object.
! 153: */
! 154: void (*destroy) (eap_method_t *this);
! 155: };
! 156:
! 157: /**
! 158: * Constructor definition for a pluggable EAP method.
! 159: *
! 160: * Each EAP module must define a constructor function which will return
! 161: * an initialized object with the methods defined in eap_method_t.
! 162: * Constructors for server and peers are identical, to support both roles
! 163: * of a EAP method, a plugin needs register two constructors in the
! 164: * eap_manager_t.
! 165: * The passed identities are of type ID_EAP and valid only during the
! 166: * constructor invocation.
! 167: *
! 168: * @param server ID of the server to use for credential lookup
! 169: * @param peer ID of the peer to use for credential lookup
! 170: * @return implementation of the eap_method_t interface
! 171: */
! 172: typedef eap_method_t *(*eap_constructor_t)(identification_t *server,
! 173: identification_t *peer);
! 174:
! 175: /**
! 176: * Helper function to (un-)register EAP methods from plugin features.
! 177: *
! 178: * This function is a plugin_feature_callback_t and can be used with the
! 179: * PLUGIN_CALLBACK macro to register a EAP method constructor.
! 180: *
! 181: * @param plugin plugin registering the EAP method constructor
! 182: * @param feature associated plugin feature
! 183: * @param reg TRUE to register, FALSE to unregister.
! 184: * @param data data passed to callback, an eap_constructor_t
! 185: */
! 186: bool eap_method_register(plugin_t *plugin, plugin_feature_t *feature,
! 187: bool reg, void *data);
! 188:
! 189: #endif /** EAP_METHOD_H_ @}*/
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to eap_method.h CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libcharon / sa / eap