c3f7c48621121e1b769ff63d54efbe5c307e9e89
[strongswan.git] / src / charon / sa / authenticators / eap / eap_method.h
1 /*
2 * Copyright (C) 2006 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 *
15 * $Id$
16 */
17
18 /**
19 * @defgroup eap_method eap_method
20 * @{ @ingroup eap
21 */
22
23 #ifndef EAP_METHOD_H_
24 #define EAP_METHOD_H_
25
26 typedef struct eap_method_t eap_method_t;
27 typedef enum eap_role_t eap_role_t;
28 typedef enum eap_type_t eap_type_t;
29 typedef enum eap_code_t eap_code_t;
30
31 #include <library.h>
32 #include <utils/identification.h>
33 #include <encoding/payloads/eap_payload.h>
34
35 /**
36 * Role of an eap_method, SERVER or PEER (client)
37 */
38 enum eap_role_t {
39 EAP_SERVER,
40 EAP_PEER,
41 };
42 /**
43 * enum names for eap_role_t.
44 */
45 extern enum_name_t *eap_role_names;
46
47 /**
48 * EAP types, defines the EAP method implementation
49 */
50 enum eap_type_t {
51 EAP_IDENTITY = 1,
52 EAP_NOTIFICATION = 2,
53 EAP_NAK = 3,
54 EAP_MD5 = 4,
55 EAP_OTP = 5,
56 EAP_GTC = 6,
57 EAP_SIM = 18,
58 EAP_AKA = 23,
59 EAP_MSCHAPV2 = 26,
60 /** not a method, but an implementation providing different methods */
61 EAP_RADIUS = 253,
62 EAP_EXPANDED = 254,
63 EAP_EXPERIMENTAL = 255,
64 };
65
66 /**
67 * enum names for eap_type_t.
68 */
69 extern enum_name_t *eap_type_names;
70
71 /**
72 * EAP code, type of an EAP message
73 */
74 enum eap_code_t {
75 EAP_REQUEST = 1,
76 EAP_RESPONSE = 2,
77 EAP_SUCCESS = 3,
78 EAP_FAILURE = 4,
79 };
80
81 /**
82 * enum names for eap_code_t.
83 */
84 extern enum_name_t *eap_code_names;
85
86
87 /**
88 * Interface of an EAP method for server and client side.
89 *
90 * An EAP method initiates an EAP exchange and processes requests and
91 * responses. An EAP method may need multiple exchanges before succeeding, and
92 * the eap_authentication may use multiple EAP methods to authenticate a peer.
93 * To accomplish these requirements, all EAP methods have their own
94 * implementation while the eap_authenticatior uses one or more of these
95 * EAP methods. Sending of EAP(SUCCESS/FAILURE) message is not the job
96 * of the method, the eap_authenticator does this.
97 * An EAP method may establish a MSK, this is used the complete the
98 * authentication. Even if a mutual EAP method is used, the traditional
99 * AUTH payloads are required. Only these include the nonces and messages from
100 * ike_sa_init and therefore prevent man in the middle attacks.
101 * The EAP method must use an initial EAP identifier value != 0, as a preceding
102 * EAP-Identity exchange always uses identifier 0.
103 */
104 struct eap_method_t {
105
106 /**
107 * Initiate the EAP exchange.
108 *
109 * initiate() is only useable for server implementations, as clients only
110 * reply to server requests.
111 * A eap_payload is created in "out" if result is NEED_MORE.
112 *
113 * @param out eap_payload to send to the client
114 * @return
115 * - NEED_MORE, if an other exchange is required
116 * - FAILED, if unable to create eap request payload
117 */
118 status_t (*initiate) (eap_method_t *this, eap_payload_t **out);
119
120 /**
121 * Process a received EAP message.
122 *
123 * A eap_payload is created in "out" if result is NEED_MORE.
124 *
125 * @param in eap_payload response received
126 * @param out created eap_payload to send
127 * @return
128 * - NEED_MORE, if an other exchange is required
129 * - FAILED, if EAP method failed
130 * - SUCCESS, if EAP method succeeded
131 */
132 status_t (*process) (eap_method_t *this, eap_payload_t *in,
133 eap_payload_t **out);
134
135 /**
136 * Get the EAP type implemented in this method.
137 *
138 * @param vendor pointer receiving vendor identifier for type, 0 for none
139 * @return type of the EAP method
140 */
141 eap_type_t (*get_type) (eap_method_t *this, u_int32_t *vendor);
142
143 /**
144 * Check if this EAP method authenticates the server.
145 *
146 * Some EAP methods provide mutual authentication and
147 * allow authentication using only EAP, if the peer supports it.
148 *
149 * @return TRUE if methods provides mutual authentication
150 */
151 bool (*is_mutual) (eap_method_t *this);
152
153 /**
154 * Get the MSK established by this EAP method.
155 *
156 * Not all EAP methods establish a shared secret. For implementations of
157 * the EAP-Identity method, get_msk() returns the received identity.
158 *
159 * @param msk chunk receiving internal stored MSK
160 * @return
161 * - SUCCESS, or
162 * - FAILED, if MSK not established (yet)
163 */
164 status_t (*get_msk) (eap_method_t *this, chunk_t *msk);
165
166 /**
167 * Destroys a eap_method_t object.
168 */
169 void (*destroy) (eap_method_t *this);
170 };
171
172 /**
173 * Constructor definition for a pluggable EAP method.
174 *
175 * Each EAP module must define a constructor function which will return
176 * an initialized object with the methods defined in eap_method_t.
177 * Constructors for server and peers are identical, to support both roles
178 * of a EAP method, a plugin needs register two constructors in the
179 * eap_manager_t.
180 * The passed identites are of type ID_EAP and valid only during the
181 * constructor invocation.
182 *
183 * @param server ID of the server to use for credential lookup
184 * @param peer ID of the peer to use for credential lookup
185 * @return implementation of the eap_method_t interface
186 */
187 typedef eap_method_t *(*eap_constructor_t)(identification_t *server,
188 identification_t *peer);
189
190 #endif /* EAP_METHOD_H_ @} */