[eap] Treat an EAP Request-Identity as indicating a blocked link

A switch port using 802.1x authentication will send EAP
Request-Identity packets once the physical link is up, and will not be
forwarding packets until the port identity has been established.

We do not currently support 802.1x authentication.  However, a
reasonably common configuration involves using a preset list of
permitted MAC addresses, with the "authentication" taking place
between the switch and a RADIUS server.  In this configuration, the
end device does not need to perform any authentication step, but does
need to be prepared for the switch port to fail to forward packets for
a substantial time after physical link-up.  This exactly matches the
"blocked link" semantics already used when detecting a non-forwarding
switch port via LACP or STP.

Treat a received EAP Request-Identity as indicating a blocked link.
Unlike LACP or STP, there is no way to determine the expected time
until the next EAP packet and so we must choose a fixed timeout.

Erroneously assuming that the link is blocked is relatively harmless
since we will still attempt to transmit and receive data even over a
link that is marked as blocked, and so the net effect is merely to
prolong DHCP attempts.  In contrast, erroneously assuming that the
link is unblocked will potentially cause DHCP to time out and give up,
resulting in a failed boot.

The default EAP Request-Identity interval in Cisco switches (where
this is most likely to be encountered in practice) is 30 seconds, so
choose 45 seconds as a timeout that is likely to avoid gaps during
which we falsely assume that the link is unblocked.

Signed-off-by: Michael Brown <mcb30@ipxe.org>

1 files changed, 142 insertions, 0 deletions

diff --git a/src/net/eap.c b/src/net/eap.c
new file mode 100644
index 0000000..8d1d540
--- /dev/null
+++ b/src/net/eap.c
@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2021 Michael Brown <mbrown@fensystems.co.uk>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ * You can also choose to distribute this program under the terms of
+ * the Unmodified Binary Distribution Licence (as given in the file
+ * COPYING.UBDL), provided that you have satisfied its requirements.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+#include <errno.h>
+#include <ipxe/netdevice.h>
+#include <ipxe/eap.h>
+
+/** @file
+ *
+ * Extensible Authentication Protocol
+ *
+ */
+
+/**
+ * Handle EAP Request-Identity
+ *
+ * @v netdev		Network device
+ * @ret rc		Return status code
+ */
+static int eap_rx_request_identity ( struct net_device *netdev ) {
+
+	/* Treat Request-Identity as blocking the link */
+	DBGC ( netdev, "EAP %s Request-Identity blocking link\n",
+	       netdev->name );
+	netdev_link_block ( netdev, EAP_BLOCK_TIMEOUT );
+
+	return 0;
+}
+
+/**
+ * Handle EAP Request
+ *
+ * @v netdev		Network device
+ * @v req		EAP request
+ * @v len		Length of EAP request
+ * @ret rc		Return status code
+ */
+static int eap_rx_request ( struct net_device *netdev,
+			    const struct eap_request *req, size_t len ) {
+
+	/* Sanity check */
+	if ( len < sizeof ( *req ) ) {
+		DBGC ( netdev, "EAP %s underlength request:\n", netdev->name );
+		DBGC_HDA ( netdev, 0, req, len );
+		return -EINVAL;
+	}
+
+	/* Handle according to type */
+	switch ( req->type ) {
+	case EAP_TYPE_IDENTITY:
+		return eap_rx_request_identity ( netdev );
+	default:
+		DBGC ( netdev, "EAP %s requested type %d unknown:\n",
+		       netdev->name, req->type );
+		DBGC_HDA ( netdev, 0, req, len );
+		return -ENOTSUP;
+	}
+}
+
+/**
+ * Handle EAP Success
+ *
+ * @v netdev		Network device
+ * @ret rc		Return status code
+ */
+static int eap_rx_success ( struct net_device *netdev ) {
+
+	/* Mark link as unblocked */
+	DBGC ( netdev, "EAP %s Success\n", netdev->name );
+	netdev_link_unblock ( netdev );
+
+	return 0;
+}
+
+/**
+ * Handle EAP Failure
+ *
+ * @v netdev		Network device
+ * @ret rc		Return status code
+ */
+static int eap_rx_failure ( struct net_device *netdev ) {
+
+	/* Record error */
+	DBGC ( netdev, "EAP %s Failure\n", netdev->name );
+	return -EPERM;
+}
+
+/**
+ * Handle EAP packet
+ *
+ * @v netdev		Network device
+ * @v data		EAP packet
+ * @v len		Length of EAP packet
+ * @ret rc		Return status code
+ */
+int eap_rx ( struct net_device *netdev, const void *data, size_t len ) {
+	const union eap_packet *eap = data;
+
+	/* Sanity check */
+	if ( len < sizeof ( eap->hdr ) ) {
+		DBGC ( netdev, "EAP %s underlength header:\n", netdev->name );
+		DBGC_HDA ( netdev, 0, eap, len );
+		return -EINVAL;
+	}
+
+	/* Handle according to code */
+	switch ( eap->hdr.code ) {
+	case EAP_CODE_REQUEST:
+		return eap_rx_request ( netdev, &eap->req, len );
+	case EAP_CODE_SUCCESS:
+		return eap_rx_success ( netdev );
+	case EAP_CODE_FAILURE:
+		return eap_rx_failure ( netdev );
+	default:
+		DBGC ( netdev, "EAP %s unsupported code %d\n",
+		       netdev->name, eap->hdr.code );
+		DBGC_HDA ( netdev, 0, eap, len );
+		return -ENOTSUP;
+	}
+}