eap_ssl_data struct

eap_peer_tls_reset_input - Reset input buffers @data: Data for TLS processing This function frees any allocated memory for input buffers and resets input state.

eap_peer_tls_reset_output - Reset output buffers @data: Data for TLS processing This function frees any allocated memory for output buffers and resets output state.

eap_peer_tls_encrypt - Encrypt phase 2 TLS message @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() @data: Data for TLS processing @eap_type: EAP type (EAP_TYPE_TLS, EAP_TYPE_PEAP, ...) @peap_version: Version number for EAP-PEAP/TTLS @id: EAP identifier for the response @in_data: Plaintext phase 2 data to encrypt or %NULL to continue fragments @out_data: Buffer for returning a pointer to the encrypted response message Returns: 0 on success, -1 on failure

eap_peer_tls_derive_key - Derive a key based on TLS session data @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() @data: Data for TLS processing @label: Label string for deriving the keys, e.g., "client EAP encryption" @context: Optional extra upper-layer context (max len 2^16) @context_len: The length of the context value @len: Length of the key material to generate (usually 64 for MSK) Returns: Pointer to allocated key on success or %NULL on failure This function uses TLS-PRF to generate pseudo-random data based on the TLS session data (client/server random and master key). Each key type may use a different label to bind the key usage into the generated material. The caller is responsible for freeing the returned buffer. Note: To provide the RFC 5705 context, the context variable must be non-NULL.

eap_peer_tls_ssl_init - Initialize shared TLS functionality @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() @data: Data for TLS processing @config: Pointer to the network configuration @eap_type: EAP method used in Phase 1 (EAP_TYPE_TLS/PEAP/TTLS/FAST) Returns: 0 on success, -1 on failure This function is used to initialize shared TLS functionality for EAP-TLS, EAP-PEAP, EAP-TTLS, and EAP-FAST.

eap_peer_tls_ssl_deinit - Deinitialize shared TLS functionality @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() @data: Data for TLS processing This function deinitializes shared TLS functionality that was initialized with eap_peer_tls_ssl_init().

eap_peer_tls_derive_session_id - Derive a Session-Id based on TLS data @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() @data: Data for TLS processing @eap_type: EAP method used in Phase 1 (EAP_TYPE_TLS/PEAP/TTLS/FAST) @len: Pointer to length of the session ID generated Returns: Pointer to allocated Session-Id on success or %NULL on failure This function derive the Session-Id based on the TLS session data (client/server random and method type). The caller is responsible for freeing the returned buffer.

eap_peer_tls_process_helper - Process TLS handshake message @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() @data: Data for TLS processing @eap_type: EAP type (EAP_TYPE_TLS, EAP_TYPE_PEAP, ...) @peap_version: Version number for EAP-PEAP/TTLS @id: EAP identifier for the response @in_data: Message received from the server @in_len: Length of in_data @out_data: Buffer for returning a pointer to the response message Returns: 0 on success, 1 if more input data is needed, 2 if application data is available, or -1 on failure This function can be used to process TLS handshake messages. It reassembles the received fragments and uses a TLS library to process the messages. The response data from the TLS library is fragmented to suitable output messages that the caller can send out. out_data is used to return the response message if the return value of this function is 0, 2, or -1. In case of failure, the message is likely a TLS alarm message. The caller is responsible for freeing the allocated buffer if *out_data is not %NULL. This function is called for each received TLS message during the TLS handshake after eap_peer_tls_process_init() call and possible processing of TLS Flags field. Once the handshake has been completed, i.e., when tls_connection_established() returns 1, EAP method specific decrypting of the tunneled data is used.

eap_peer_tls_process_init - Initial validation/processing of EAP requests @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() @data: Data for TLS processing @eap_type: EAP type (EAP_TYPE_TLS, EAP_TYPE_PEAP, ...) @ret: Return values from EAP request validation and processing @reqData: EAP request to be processed (eapReqData) @len: Buffer for returning length of the remaining payload @flags: Buffer for returning TLS flags Returns: Pointer to payload after TLS flags and length or %NULL on failure This function validates the EAP header and processes the optional TLS Message Length field. If this is the first fragment of a TLS message, the TLS reassembly code is initialized to receive the indicated number of bytes. EAP-TLS, EAP-PEAP, EAP-TTLS, and EAP-FAST methods are expected to use this function as the first step in processing received messages. They will need to process the flags (apart from Message Length Included) that are returned through the flags pointer and the message payload that will be returned (and the length is returned through the len pointer). Return values (ret) are set for continuation of EAP method processing. The caller is responsible for setting these to indicate completion (either success or failure) based on the authentication result.

eap_peer_tls_status - Get TLS status @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() @data: Data for TLS processing @buf: Buffer for status information @buflen: Maximum buffer length @verbose: Whether to include verbose status information Returns: Number of bytes written to buf.

eap_peer_tls_decrypt - Decrypt received phase 2 TLS message @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() @data: Data for TLS processing @in_data: Message received from the server @in_decrypted: Buffer for returning a pointer to the decrypted message Returns: 0 on success, 1 if more input data is needed, or -1 on failure

eap_peer_tls_reauth_init - Re-initialize shared TLS for session resumption @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() @data: Data for TLS processing Returns: 0 on success, -1 on failure

eap_tls_process_output - Process outgoing TLS message @data: Data for TLS processing @eap_type: EAP type (EAP_TYPE_TLS, EAP_TYPE_PEAP, ...) @peap_version: Version number for EAP-PEAP/TTLS @id: EAP identifier for the response @ret: Return value to use on success @out_data: Buffer for returning the allocated output buffer Returns: ret (0 or 1) on success, -1 on failure

eap_peer_tls_data_reassemble - Reassemble TLS data @data: Data for TLS processing @in_data: Next incoming TLS segment @need_more_input: Variable for returning whether more input data is needed to reassemble this TLS packet Returns: Pointer to output data, %NULL on error or when more data is needed for the full message (in which case, *need_more_input is also set to 1). This function reassembles TLS fragments. Caller must not free the returned data buffer since an internal pointer to it is maintained.

eap_tls_process_input - Process incoming TLS message @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() @data: Data for TLS processing @in_data: Message received from the server @in_len: Length of in_data @out_data: Buffer for returning a pointer to application data (if available) Returns: 0 on success, 1 if more input data is needed, 2 if application data is available, -1 on failure

eap_peer_tls_reassemble_fragment - Reassemble a received fragment @data: Data for TLS processing @in_data: Next incoming TLS segment Returns: 0 on success, 1 if more data is needed for the full message, or -1 on error