The FreeRADIUS server  $Id: 15bac2a4c627c01d1aa2047687b3418955ac7f00 $
base.c
Go to the documentation of this file.
1 /*
2  * This program is free software; you can redistribute it and/or modify
3  * it under the terms of the GNU General Public License as published by
4  * the Free Software Foundation; either version 2 of the License, or
5  * (at your option) any later version.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
15  */
16 
17 /**
18  * $Id: 1f920fe6ace7f57f57e6aab2d91158ec23853754 $
19  * @file src/process/eap_sim/base.c
20  * @brief EAP-SIM process module
21  *
22  * The state machine for EAP-SIM, EAP-AKA and EAP-AKA' is common to all methods
23  * and is in src/lib/eap_aka_sim/state_machine.c
24  *
25  * The process modules for the different EAP methods just define the sections
26  * for that EAP method, and parse different config items.
27  *
28  * @copyright 2021 Arran Cudbard-Bell <a.cudbardb@freeradius.org>
29  */
30 
31 #include <freeradius-devel/eap_aka_sim/base.h>
32 #include <freeradius-devel/eap_aka_sim/attrs.h>
33 #include <freeradius-devel/eap_aka_sim/state_machine.h>
34 #include <freeradius-devel/server/virtual_servers.h>
35 #include <freeradius-devel/server/process.h>
36 
38  { FR_CONF_OFFSET("request_identity", eap_aka_sim_process_conf_t, request_identity ),
39  .func = cf_table_parse_int,
41  { FR_CONF_OFFSET("strip_permanent_identity_hint", eap_aka_sim_process_conf_t,
42  strip_permanent_identity_hint ), .dflt = "yes" },
43  { FR_CONF_OFFSET_TYPE_FLAGS("ephemeral_id_length", FR_TYPE_SIZE, 0, eap_aka_sim_process_conf_t, ephemeral_id_length ), .dflt = "14" }, /* 14 for compatibility */
44  { FR_CONF_OFFSET("protected_success", eap_aka_sim_process_conf_t, protected_success ), .dflt = "no" },
45 
47 };
48 
50  /*
51  * Identity negotiation
52  * The initial identity here is the EAP-Identity.
53  * We can then choose to request additional
54  * identities.
55  */
56  {
57  .section = SECTION_NAME("recv", "Identity-Response"),
58  .actions = &mod_actions_authorize,
59  .offset = offsetof(eap_aka_sim_process_conf_t, actions.recv_common_identity_response)
60  },
61  {
62  .section = SECTION_NAME("send", "Identity-Request"),
63  .actions = &mod_actions_authorize,
64  .offset = offsetof(eap_aka_sim_process_conf_t, actions.send_common_identity_request)
65  },
66 
67  /*
68  * Optional override sections if the user *really*
69  * wants to apply special policies for subsequent
70  * request/response rounds.
71  */
72  {
73  .section = SECTION_NAME("send", "Start-Request"),
74  .actions = &mod_actions_authorize,
75  .offset = offsetof(eap_aka_sim_process_conf_t, actions.send_sim_start_request)
76  },
77  {
78  .section = SECTION_NAME("recv", "Start-Response"),
79  .actions = &mod_actions_authorize,
80  .offset = offsetof(eap_aka_sim_process_conf_t, actions.recv_sim_start_response)
81  },
82 
83  /*
84  * Full-Authentication
85  */
86  {
87  .section = SECTION_NAME("send", "Challenge-Request"),
88  .actions = &mod_actions_authorize,
89  .offset = offsetof(eap_aka_sim_process_conf_t, actions.send_sim_challenge_request)
90  },
91  {
92  .section = SECTION_NAME("recv", "Challenge-Response"),
93  .actions = &mod_actions_authorize,
94  .offset = offsetof(eap_aka_sim_process_conf_t, actions.recv_sim_challenge_response)
95  },
96 
97  /*
98  * Fast-Re-Authentication
99  */
100  {
101  .section = SECTION_NAME("send", "Reauthentication-Request"),
102  .actions = &mod_actions_authorize,
103  .offset = offsetof(eap_aka_sim_process_conf_t, actions.send_common_reauthentication_request)
104  },
105  {
106  .section = SECTION_NAME("recv", "Reauthentication-Response"),
107  .actions = &mod_actions_authorize,
108  .offset = offsetof(eap_aka_sim_process_conf_t, actions.recv_common_reauthentication_response)
109  },
110 
111  /*
112  * Failures originating from the supplicant
113  */
114  {
115  .section = SECTION_NAME("recv", "Client-Error"),
116  .actions = &mod_actions_authorize,
117  .offset = offsetof(eap_aka_sim_process_conf_t, actions.recv_common_client_error)
118  },
119 
120  /*
121  * Failure originating from the server
122  */
123  {
124  .section = SECTION_NAME("send", "Failure-Notification"),
125  .actions = &mod_actions_authorize,
126  .offset = offsetof(eap_aka_sim_process_conf_t, actions.send_common_failure_notification)
127  },
128  {
129  .section = SECTION_NAME("recv", "Failure-Notification-ACK"),
130  .actions = &mod_actions_authorize,
131  .offset = offsetof(eap_aka_sim_process_conf_t, actions.recv_common_failure_notification_ack)
132  },
133 
134  /*
135  * Protected success indication
136  */
137  {
138  .section = SECTION_NAME("send", "Success-Notification"),
139  .actions = &mod_actions_authorize,
140  .offset = offsetof(eap_aka_sim_process_conf_t, actions.send_common_success_notification)
141  },
142  {
143  .section = SECTION_NAME("recv", "Success-Notification-ACK"),
144  .actions = &mod_actions_authorize,
145  .offset = offsetof(eap_aka_sim_process_conf_t, actions.recv_common_success_notification_ack)
146  },
147 
148  /*
149  * Final EAP-Success and EAP-Failure messages
150  */
151  {
152  .section = SECTION_NAME("send", "EAP-Success"),
153  .actions = &mod_actions_authorize,
154  .offset = offsetof(eap_aka_sim_process_conf_t, actions.send_eap_success)
155  },
156  {
157  .section = SECTION_NAME("send", "EAP-Failure"),
158  .actions = &mod_actions_authorize,
159  .offset = offsetof(eap_aka_sim_process_conf_t, actions.send_eap_failure)
160  },
161 
162  /*
163  * Fast-Reauth vectors
164  */
165  {
166  .section = SECTION_NAME("store", "session"),
167  .actions = &mod_actions_authorize,
168  .offset = offsetof(eap_aka_sim_process_conf_t, actions.store_session)
169  },
170  {
171  .section = SECTION_NAME("load", "session"),
172  .actions = &mod_actions_authorize,
173  .offset = offsetof(eap_aka_sim_process_conf_t, actions.load_session)
174  },
175  {
176  .section = SECTION_NAME("clear", "session"),
177  .actions = &mod_actions_authorize,
178  .offset = offsetof(eap_aka_sim_process_conf_t, actions.clear_session)
179  },
180 
181  /*
182  * Pseudonym processing
183  */
184  {
185  .section = SECTION_NAME("store", "pseudonym"),
186  .actions = &mod_actions_authorize,
187  .offset = offsetof(eap_aka_sim_process_conf_t, actions.store_pseudonym)
188  },
189  {
190  .section = SECTION_NAME("load", "pseudonym"),
191  .actions = &mod_actions_authorize,
192  .offset = offsetof(eap_aka_sim_process_conf_t, actions.load_pseudonym)
193  },
194  {
195  .section = SECTION_NAME("clear", "pseudonym"),
196  .actions = &mod_actions_authorize,
197  .offset = offsetof(eap_aka_sim_process_conf_t, actions.clear_pseudonym)
198  },
199 
201 };
202 
203 static int mod_instantiate(module_inst_ctx_t const *mctx)
204 {
205  eap_aka_sim_process_conf_t *inst = talloc_get_type_abort(mctx->mi->data, eap_aka_sim_process_conf_t);
206 
208 
209  /*
210  * This isn't allowed, so just munge
211  * it to no id request.
212  */
214 
215  return 0;
216 }
217 
218 static int mod_load(void)
219 {
220  if (unlikely(fr_aka_sim_init() < 0)) return -1;
221 
223 
224  return 0;
225 }
226 
227 static void mod_unload(void)
228 {
230 
231  fr_aka_sim_free();
232 }
233 
236  .common = {
237  .magic = MODULE_MAGIC_INIT,
238  .name = "eap_sim",
239  .onload = mod_load,
240  .unload = mod_unload,
241  .config = submodule_config,
242  .instantiate = mod_instantiate,
243  .inst_size = sizeof(eap_aka_sim_process_conf_t),
244  .inst_type = "eap_aka_sim_process_conf_t"
245  },
247  .compile_list = compile_list,
248  .dict = &dict_eap_aka_sim,
249 };
#define unlikely(_x)
Definition: build.h:379
int cf_table_parse_int(UNUSED TALLOC_CTX *ctx, void *out, UNUSED void *parent, CONF_ITEM *ci, conf_parser_t const *rule)
Generic function for parsing conf pair values as int.
Definition: cf_parse.c:1474
#define CONF_PARSER_TERMINATOR
Definition: cf_parse.h:627
#define FR_CONF_OFFSET(_name, _struct, _field)
conf_parser_t which parses a single CONF_PAIR, writing the result to a field in a struct
Definition: cf_parse.h:268
#define FR_CONF_OFFSET_TYPE_FLAGS(_name, _type, _flags, _struct, _field)
conf_parser_t which parses a single CONF_PAIR, writing the result to a field in a struct
Definition: cf_parse.h:241
Defines a CONF_PAIR to C data type mapping.
Definition: cf_parse.h:564
#define MODULE_MAGIC_INIT
Stop people using different module/library/server versions together.
Definition: dl_module.h:63
@ FR_EAP_METHOD_SIM
Definition: types.h:63
int fr_aka_sim_xlat_func_register(void)
Definition: xlat.c:497
void fr_aka_sim_xlat_func_unregister(void)
Definition: xlat.c:521
void fr_aka_sim_free(void)
Definition: base.c:315
int fr_aka_sim_init(void)
Definition: base.c:284
fr_dict_t const * dict_eap_aka_sim
Definition: base.c:48
fr_table_num_sorted_t const fr_aka_sim_id_request_table[]
Definition: id.c:33
size_t fr_aka_sim_id_request_table_len
Definition: id.c:41
@ AKA_SIM_INIT_ID_REQ
We've requested no ID. This is used for last_id_req.
Definition: id.h:78
@ AKA_SIM_NO_ID_REQ
We're not requesting any ID.
Definition: id.h:79
@ FR_TYPE_SIZE
Unsigned integer capable of representing any memory address on the local system.
Definition: merged_model.c:115
unlang_mod_actions_t const mod_actions_authorize
Definition: mod_action.c:44
module_instance_t * mi
Instance of the module being instantiated.
Definition: module_ctx.h:51
Temporary structure to hold arguments for instantiation calls.
Definition: module_ctx.h:50
static int mod_load(void)
Definition: base.c:218
static virtual_server_compile_t compile_list[]
Definition: base.c:49
static void mod_unload(void)
Definition: base.c:227
static conf_parser_t submodule_config[]
Definition: base.c:37
fr_process_module_t process_eap_sim
Definition: base.c:235
static int mod_instantiate(module_inst_ctx_t const *mctx)
Definition: base.c:203
module_t common
Common fields for all loadable modules.
Definition: process.h:55
Common public symbol definition for all process modules.
Definition: process.h:54
#define SECTION_NAME(_name1, _name2)
Define a section name consisting of a verb and a noun.
Definition: section.h:40
void * data
Module's instance data.
Definition: module.h:271
eap_aka_sim_process_conf_t * inst
unlang_action_t eap_aka_sim_state_machine_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
Resumes the state machine when receiving a new response packet.
eap_type_t type
The preferred EAP-Type of this instance of the EAP-SIM/AKA/AKA' state machine.
fr_aka_sim_id_req_type_t request_identity
Whether we always request the identity of the subscriber.
#define COMPILE_TERMINATOR
section_name_t const * section
Identifier for the section.
Processing sections which are allowed in this virtual server.