Added a generic callback to register EAP methods using plugin features
[strongswan.git] / src / libcharon / sa / authenticators / eap / eap_method.h
1 /*
2 * Copyright (C) 2006 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 /**
17 * @defgroup eap_method eap_method
18 * @{ @ingroup eap
19 */
20
21 #ifndef EAP_METHOD_H_
22 #define EAP_METHOD_H_
23
24 typedef struct eap_method_t eap_method_t;
25 typedef enum eap_role_t eap_role_t;
26
27 #include <library.h>
28 #include <plugins/plugin.h>
29 #include <utils/identification.h>
30 #include <eap/eap.h>
31 #include <encoding/payloads/eap_payload.h>
32
33 /**
34 * Role of an eap_method, SERVER or PEER (client)
35 */
36 enum eap_role_t {
37 EAP_SERVER,
38 EAP_PEER,
39 };
40 /**
41 * enum names for eap_role_t.
42 */
43 extern enum_name_t *eap_role_names;
44
45 /**
46 * Interface of an EAP method for server and client side.
47 *
48 * An EAP method initiates an EAP exchange and processes requests and
49 * responses. An EAP method may need multiple exchanges before succeeding, and
50 * the eap_authentication may use multiple EAP methods to authenticate a peer.
51 * To accomplish these requirements, all EAP methods have their own
52 * implementation while the eap_authenticatior uses one or more of these
53 * EAP methods. Sending of EAP(SUCCESS/FAILURE) message is not the job
54 * of the method, the eap_authenticator does this.
55 * An EAP method may establish a MSK, this is used the complete the
56 * authentication. Even if a mutual EAP method is used, the traditional
57 * AUTH payloads are required. Only these include the nonces and messages from
58 * ike_sa_init and therefore prevent man in the middle attacks.
59 * The EAP method must use an initial EAP identifier value != 0, as a preceding
60 * EAP-Identity exchange always uses identifier 0.
61 */
62 struct eap_method_t {
63
64 /**
65 * Initiate the EAP exchange.
66 *
67 * initiate() is only useable for server implementations, as clients only
68 * reply to server requests.
69 * A eap_payload is created in "out" if result is NEED_MORE.
70 *
71 * @param out eap_payload to send to the client
72 * @return
73 * - NEED_MORE, if an other exchange is required
74 * - FAILED, if unable to create eap request payload
75 */
76 status_t (*initiate) (eap_method_t *this, eap_payload_t **out);
77
78 /**
79 * Process a received EAP message.
80 *
81 * A eap_payload is created in "out" if result is NEED_MORE.
82 *
83 * @param in eap_payload response received
84 * @param out created eap_payload to send
85 * @return
86 * - NEED_MORE, if an other exchange is required
87 * - FAILED, if EAP method failed
88 * - SUCCESS, if EAP method succeeded
89 */
90 status_t (*process) (eap_method_t *this, eap_payload_t *in,
91 eap_payload_t **out);
92
93 /**
94 * Get the EAP type implemented in this method.
95 *
96 * @param vendor pointer receiving vendor identifier for type, 0 for none
97 * @return type of the EAP method
98 */
99 eap_type_t (*get_type) (eap_method_t *this, u_int32_t *vendor);
100
101 /**
102 * Check if this EAP method authenticates the server.
103 *
104 * Some EAP methods provide mutual authentication and
105 * allow authentication using only EAP, if the peer supports it.
106 *
107 * @return TRUE if methods provides mutual authentication
108 */
109 bool (*is_mutual) (eap_method_t *this);
110
111 /**
112 * Get the MSK established by this EAP method.
113 *
114 * Not all EAP methods establish a shared secret. For implementations of
115 * the EAP-Identity method, get_msk() returns the received identity.
116 *
117 * @param msk chunk receiving internal stored MSK
118 * @return
119 * - SUCCESS, or
120 * - FAILED, if MSK not established (yet)
121 */
122 status_t (*get_msk) (eap_method_t *this, chunk_t *msk);
123
124 /**
125 * Get the current EAP identifier.
126 *
127 * @return current EAP identifier
128 */
129 u_int8_t (*get_identifier) (eap_method_t *this);
130
131 /**
132 * Set the EAP identifier to a deterministic value, overwriting
133 * the randomly initialized default value.
134 *
135 * @param identifier current EAP identifier
136 */
137 void (*set_identifier) (eap_method_t *this, u_int8_t identifier);
138
139 /**
140 * Destroys a eap_method_t object.
141 */
142 void (*destroy) (eap_method_t *this);
143 };
144
145 /**
146 * Constructor definition for a pluggable EAP method.
147 *
148 * Each EAP module must define a constructor function which will return
149 * an initialized object with the methods defined in eap_method_t.
150 * Constructors for server and peers are identical, to support both roles
151 * of a EAP method, a plugin needs register two constructors in the
152 * eap_manager_t.
153 * The passed identites are of type ID_EAP and valid only during the
154 * constructor invocation.
155 *
156 * @param server ID of the server to use for credential lookup
157 * @param peer ID of the peer to use for credential lookup
158 * @return implementation of the eap_method_t interface
159 */
160 typedef eap_method_t *(*eap_constructor_t)(identification_t *server,
161 identification_t *peer);
162
163 /**
164 * Helper function to (un-)register EAP methods from plugin features.
165 *
166 * This function is a plugin_feature_callback_t and can be used with the
167 * PLUGIN_CALLBACK macro to register a EAP method constructor.
168 *
169 * @param plugin plugin registering the EAP method constructor
170 * @param feature associated plugin feature
171 * @param reg TRUE to register, FALSE to unregister.
172 * @param data data passed to callback, an eap_constructor_t
173 */
174 bool eap_method_register(plugin_t *plugin, plugin_feature_t *feature,
175 bool reg, void *data);
176
177 #endif /** EAP_METHOD_H_ @}*/