moved eap_from_string() fomr libcharon to libstrongswan to make it available in starter
[strongswan.git] / src / libcharon / sa / authenticators / eap / eap_method.h
1 /*
2 * Copyright (C) 2006 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 /**
17 * @defgroup eap_method eap_method
18 * @{ @ingroup eap
19 */
20
21 #ifndef EAP_METHOD_H_
22 #define EAP_METHOD_H_
23
24 typedef struct eap_method_t eap_method_t;
25 typedef enum eap_role_t eap_role_t;
26 typedef enum eap_code_t eap_code_t;
27
28 #include <library.h>
29 #include <utils/identification.h>
30 #include <encoding/payloads/eap_payload.h>
31
32 /**
33 * Role of an eap_method, SERVER or PEER (client)
34 */
35 enum eap_role_t {
36 EAP_SERVER,
37 EAP_PEER,
38 };
39 /**
40 * enum names for eap_role_t.
41 */
42 extern enum_name_t *eap_role_names;
43
44 /**
45 * EAP code, type of an EAP message
46 */
47 enum eap_code_t {
48 EAP_REQUEST = 1,
49 EAP_RESPONSE = 2,
50 EAP_SUCCESS = 3,
51 EAP_FAILURE = 4,
52 };
53
54 /**
55 * enum names for eap_code_t.
56 */
57 extern enum_name_t *eap_code_names;
58
59 /**
60 * short string enum names for eap_code_t.
61 */
62 extern enum_name_t *eap_code_short_names;
63
64 /**
65 * Interface of an EAP method for server and client side.
66 *
67 * An EAP method initiates an EAP exchange and processes requests and
68 * responses. An EAP method may need multiple exchanges before succeeding, and
69 * the eap_authentication may use multiple EAP methods to authenticate a peer.
70 * To accomplish these requirements, all EAP methods have their own
71 * implementation while the eap_authenticatior uses one or more of these
72 * EAP methods. Sending of EAP(SUCCESS/FAILURE) message is not the job
73 * of the method, the eap_authenticator does this.
74 * An EAP method may establish a MSK, this is used the complete the
75 * authentication. Even if a mutual EAP method is used, the traditional
76 * AUTH payloads are required. Only these include the nonces and messages from
77 * ike_sa_init and therefore prevent man in the middle attacks.
78 * The EAP method must use an initial EAP identifier value != 0, as a preceding
79 * EAP-Identity exchange always uses identifier 0.
80 */
81 struct eap_method_t {
82
83 /**
84 * Initiate the EAP exchange.
85 *
86 * initiate() is only useable for server implementations, as clients only
87 * reply to server requests.
88 * A eap_payload is created in "out" if result is NEED_MORE.
89 *
90 * @param out eap_payload to send to the client
91 * @return
92 * - NEED_MORE, if an other exchange is required
93 * - FAILED, if unable to create eap request payload
94 */
95 status_t (*initiate) (eap_method_t *this, eap_payload_t **out);
96
97 /**
98 * Process a received EAP message.
99 *
100 * A eap_payload is created in "out" if result is NEED_MORE.
101 *
102 * @param in eap_payload response received
103 * @param out created eap_payload to send
104 * @return
105 * - NEED_MORE, if an other exchange is required
106 * - FAILED, if EAP method failed
107 * - SUCCESS, if EAP method succeeded
108 */
109 status_t (*process) (eap_method_t *this, eap_payload_t *in,
110 eap_payload_t **out);
111
112 /**
113 * Get the EAP type implemented in this method.
114 *
115 * @param vendor pointer receiving vendor identifier for type, 0 for none
116 * @return type of the EAP method
117 */
118 eap_type_t (*get_type) (eap_method_t *this, u_int32_t *vendor);
119
120 /**
121 * Check if this EAP method authenticates the server.
122 *
123 * Some EAP methods provide mutual authentication and
124 * allow authentication using only EAP, if the peer supports it.
125 *
126 * @return TRUE if methods provides mutual authentication
127 */
128 bool (*is_mutual) (eap_method_t *this);
129
130 /**
131 * Get the MSK established by this EAP method.
132 *
133 * Not all EAP methods establish a shared secret. For implementations of
134 * the EAP-Identity method, get_msk() returns the received identity.
135 *
136 * @param msk chunk receiving internal stored MSK
137 * @return
138 * - SUCCESS, or
139 * - FAILED, if MSK not established (yet)
140 */
141 status_t (*get_msk) (eap_method_t *this, chunk_t *msk);
142
143 /**
144 * Destroys a eap_method_t object.
145 */
146 void (*destroy) (eap_method_t *this);
147 };
148
149 /**
150 * Constructor definition for a pluggable EAP method.
151 *
152 * Each EAP module must define a constructor function which will return
153 * an initialized object with the methods defined in eap_method_t.
154 * Constructors for server and peers are identical, to support both roles
155 * of a EAP method, a plugin needs register two constructors in the
156 * eap_manager_t.
157 * The passed identites are of type ID_EAP and valid only during the
158 * constructor invocation.
159 *
160 * @param server ID of the server to use for credential lookup
161 * @param peer ID of the peer to use for credential lookup
162 * @return implementation of the eap_method_t interface
163 */
164 typedef eap_method_t *(*eap_constructor_t)(identification_t *server,
165 identification_t *peer);
166
167 #endif /** EAP_METHOD_H_ @}*/