[457] | 1 | /*
|
---|
| 2 | * eap.h - Extensible Authentication Protocol for PPP (RFC 2284)
|
---|
| 3 | *
|
---|
| 4 | * Copyright (c) 2001 by Sun Microsystems, Inc.
|
---|
| 5 | * All rights reserved.
|
---|
| 6 | *
|
---|
| 7 | * Non-exclusive rights to redistribute, modify, translate, and use
|
---|
| 8 | * this software in source and binary forms, in whole or in part, is
|
---|
| 9 | * hereby granted, provided that the above copyright notice is
|
---|
| 10 | * duplicated in any source form, and that neither the name of the
|
---|
| 11 | * copyright holder nor the author is used to endorse or promote
|
---|
| 12 | * products derived from this software.
|
---|
| 13 | *
|
---|
| 14 | * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
|
---|
| 15 | * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
---|
| 16 | * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
---|
| 17 | *
|
---|
| 18 | * Original version by James Carlson
|
---|
| 19 | *
|
---|
| 20 | * $Id$
|
---|
| 21 | */
|
---|
| 22 |
|
---|
| 23 | #include "netif/ppp/ppp_opts.h"
|
---|
| 24 | #if PPP_SUPPORT && EAP_SUPPORT /* don't build if not configured for use in lwipopts.h */
|
---|
| 25 |
|
---|
| 26 | #ifndef PPP_EAP_H
|
---|
| 27 | #define PPP_EAP_H
|
---|
| 28 |
|
---|
| 29 | #include "ppp.h"
|
---|
| 30 |
|
---|
| 31 | #ifdef __cplusplus
|
---|
| 32 | extern "C" {
|
---|
| 33 | #endif
|
---|
| 34 |
|
---|
| 35 | /*
|
---|
| 36 | * Packet header = Code, id, length.
|
---|
| 37 | */
|
---|
| 38 | #define EAP_HEADERLEN 4
|
---|
| 39 |
|
---|
| 40 |
|
---|
| 41 | /* EAP message codes. */
|
---|
| 42 | #define EAP_REQUEST 1
|
---|
| 43 | #define EAP_RESPONSE 2
|
---|
| 44 | #define EAP_SUCCESS 3
|
---|
| 45 | #define EAP_FAILURE 4
|
---|
| 46 |
|
---|
| 47 | /* EAP types */
|
---|
| 48 | #define EAPT_IDENTITY 1
|
---|
| 49 | #define EAPT_NOTIFICATION 2
|
---|
| 50 | #define EAPT_NAK 3 /* (response only) */
|
---|
| 51 | #define EAPT_MD5CHAP 4
|
---|
| 52 | #define EAPT_OTP 5 /* One-Time Password; RFC 1938 */
|
---|
| 53 | #define EAPT_TOKEN 6 /* Generic Token Card */
|
---|
| 54 | /* 7 and 8 are unassigned. */
|
---|
| 55 | #define EAPT_RSA 9 /* RSA Public Key Authentication */
|
---|
| 56 | #define EAPT_DSS 10 /* DSS Unilateral */
|
---|
| 57 | #define EAPT_KEA 11 /* KEA */
|
---|
| 58 | #define EAPT_KEA_VALIDATE 12 /* KEA-VALIDATE */
|
---|
| 59 | #define EAPT_TLS 13 /* EAP-TLS */
|
---|
| 60 | #define EAPT_DEFENDER 14 /* Defender Token (AXENT) */
|
---|
| 61 | #define EAPT_W2K 15 /* Windows 2000 EAP */
|
---|
| 62 | #define EAPT_ARCOT 16 /* Arcot Systems */
|
---|
| 63 | #define EAPT_CISCOWIRELESS 17 /* Cisco Wireless */
|
---|
| 64 | #define EAPT_NOKIACARD 18 /* Nokia IP smart card */
|
---|
| 65 | #define EAPT_SRP 19 /* Secure Remote Password */
|
---|
| 66 | /* 20 is deprecated */
|
---|
| 67 |
|
---|
| 68 | /* EAP SRP-SHA1 Subtypes */
|
---|
| 69 | #define EAPSRP_CHALLENGE 1 /* Request 1 - Challenge */
|
---|
| 70 | #define EAPSRP_CKEY 1 /* Response 1 - Client Key */
|
---|
| 71 | #define EAPSRP_SKEY 2 /* Request 2 - Server Key */
|
---|
| 72 | #define EAPSRP_CVALIDATOR 2 /* Response 2 - Client Validator */
|
---|
| 73 | #define EAPSRP_SVALIDATOR 3 /* Request 3 - Server Validator */
|
---|
| 74 | #define EAPSRP_ACK 3 /* Response 3 - final ack */
|
---|
| 75 | #define EAPSRP_LWRECHALLENGE 4 /* Req/resp 4 - Lightweight rechal */
|
---|
| 76 |
|
---|
| 77 | #define SRPVAL_EBIT 0x00000001 /* Use shared key for ECP */
|
---|
| 78 |
|
---|
| 79 | #define SRP_PSEUDO_ID "pseudo_"
|
---|
| 80 | #define SRP_PSEUDO_LEN 7
|
---|
| 81 |
|
---|
| 82 | #define MD5_SIGNATURE_SIZE 16
|
---|
| 83 | #define EAP_MIN_CHALLENGE_LENGTH 17
|
---|
| 84 | #define EAP_MAX_CHALLENGE_LENGTH 24
|
---|
| 85 | #define EAP_MIN_MAX_POWER_OF_TWO_CHALLENGE_LENGTH 3 /* 2^3-1 = 7, 17+7 = 24 */
|
---|
| 86 |
|
---|
| 87 | #define EAP_STATES \
|
---|
| 88 | "Initial", "Pending", "Closed", "Listen", "Identify", \
|
---|
| 89 | "SRP1", "SRP2", "SRP3", "MD5Chall", "Open", "SRP4", "BadAuth"
|
---|
| 90 |
|
---|
| 91 | #define eap_client_active(pcb) ((pcb)->eap.es_client.ea_state == eapListen)
|
---|
| 92 | #if PPP_SERVER
|
---|
| 93 | #define eap_server_active(pcb) \
|
---|
| 94 | ((pcb)->eap.es_server.ea_state >= eapIdentify && \
|
---|
| 95 | (pcb)->eap.es_server.ea_state <= eapMD5Chall)
|
---|
| 96 | #endif /* PPP_SERVER */
|
---|
| 97 |
|
---|
| 98 | /*
|
---|
| 99 | * Complete EAP state for one PPP session.
|
---|
| 100 | */
|
---|
| 101 | enum eap_state_code {
|
---|
| 102 | eapInitial = 0, /* No EAP authentication yet requested */
|
---|
| 103 | eapPending, /* Waiting for LCP (no timer) */
|
---|
| 104 | eapClosed, /* Authentication not in use */
|
---|
| 105 | eapListen, /* Client ready (and timer running) */
|
---|
| 106 | eapIdentify, /* EAP Identify sent */
|
---|
| 107 | eapSRP1, /* Sent EAP SRP-SHA1 Subtype 1 */
|
---|
| 108 | eapSRP2, /* Sent EAP SRP-SHA1 Subtype 2 */
|
---|
| 109 | eapSRP3, /* Sent EAP SRP-SHA1 Subtype 3 */
|
---|
| 110 | eapMD5Chall, /* Sent MD5-Challenge */
|
---|
| 111 | eapOpen, /* Completed authentication */
|
---|
| 112 | eapSRP4, /* Sent EAP SRP-SHA1 Subtype 4 */
|
---|
| 113 | eapBadAuth /* Failed authentication */
|
---|
| 114 | };
|
---|
| 115 |
|
---|
| 116 | struct eap_auth {
|
---|
| 117 | const char *ea_name; /* Our name */
|
---|
| 118 | char ea_peer[MAXNAMELEN +1]; /* Peer's name */
|
---|
| 119 | void *ea_session; /* Authentication library linkage */
|
---|
| 120 | u_char *ea_skey; /* Shared encryption key */
|
---|
| 121 | u_short ea_namelen; /* Length of our name */
|
---|
| 122 | u_short ea_peerlen; /* Length of peer's name */
|
---|
| 123 | enum eap_state_code ea_state;
|
---|
| 124 | u_char ea_id; /* Current id */
|
---|
| 125 | u_char ea_requests; /* Number of Requests sent/received */
|
---|
| 126 | u_char ea_responses; /* Number of Responses */
|
---|
| 127 | u_char ea_type; /* One of EAPT_* */
|
---|
| 128 | u32_t ea_keyflags; /* SRP shared key usage flags */
|
---|
| 129 | };
|
---|
| 130 |
|
---|
| 131 | #ifndef EAP_MAX_CHALLENGE_LENGTH
|
---|
| 132 | #define EAP_MAX_CHALLENGE_LENGTH 24
|
---|
| 133 | #endif
|
---|
| 134 | typedef struct eap_state {
|
---|
| 135 | struct eap_auth es_client; /* Client (authenticatee) data */
|
---|
| 136 | #if PPP_SERVER
|
---|
| 137 | struct eap_auth es_server; /* Server (authenticator) data */
|
---|
| 138 | #endif /* PPP_SERVER */
|
---|
| 139 | int es_savedtime; /* Saved timeout */
|
---|
| 140 | int es_rechallenge; /* EAP rechallenge interval */
|
---|
| 141 | int es_lwrechallenge; /* SRP lightweight rechallenge inter */
|
---|
| 142 | u8_t es_usepseudo; /* Use SRP Pseudonym if offered one */
|
---|
| 143 | int es_usedpseudo; /* Set if we already sent PN */
|
---|
| 144 | int es_challen; /* Length of challenge string */
|
---|
| 145 | u_char es_challenge[EAP_MAX_CHALLENGE_LENGTH];
|
---|
| 146 | } eap_state;
|
---|
| 147 |
|
---|
| 148 | /*
|
---|
| 149 | * Timeouts.
|
---|
| 150 | */
|
---|
| 151 | #if 0 /* moved to ppp_opts.h */
|
---|
| 152 | #define EAP_DEFTIMEOUT 3 /* Timeout (seconds) for rexmit */
|
---|
| 153 | #define EAP_DEFTRANSMITS 10 /* max # times to transmit */
|
---|
| 154 | #define EAP_DEFREQTIME 20 /* Time to wait for peer request */
|
---|
| 155 | #define EAP_DEFALLOWREQ 20 /* max # times to accept requests */
|
---|
| 156 | #endif /* moved to ppp_opts.h */
|
---|
| 157 |
|
---|
| 158 | void eap_authwithpeer(ppp_pcb *pcb, const char *localname);
|
---|
| 159 | void eap_authpeer(ppp_pcb *pcb, const char *localname);
|
---|
| 160 |
|
---|
| 161 | extern const struct protent eap_protent;
|
---|
| 162 |
|
---|
| 163 | #ifdef __cplusplus
|
---|
| 164 | }
|
---|
| 165 | #endif
|
---|
| 166 |
|
---|
| 167 | #endif /* PPP_EAP_H */
|
---|
| 168 |
|
---|
| 169 | #endif /* PPP_SUPPORT && EAP_SUPPORT */
|
---|