1 /* $NetBSD: eap.h,v 1.6 2025/01/08 19:59:39 christos Exp $ */ 2 3 /* 4 * eap.h - Extensible Authentication Protocol for PPP (RFC 2284) 5 * 6 * Copyright (c) 2001 by Sun Microsystems, Inc. 7 * All rights reserved. 8 * 9 * Non-exclusive rights to redistribute, modify, translate, and use 10 * this software in source and binary forms, in whole or in part, is 11 * hereby granted, provided that the above copyright notice is 12 * duplicated in any source form, and that neither the name of the 13 * copyright holder nor the author is used to endorse or promote 14 * products derived from this software. 15 * 16 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 18 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19 * 20 * Original version by James Carlson 21 */ 22 23 #ifndef PPP_EAP_H 24 #define PPP_EAP_H 25 26 #include "pppdconf.h" 27 28 #ifdef __cplusplus 29 extern "C" { 30 #endif 31 32 33 #ifndef PPP_EAP 34 #define PPP_EAP 0xc227 35 #endif 36 37 38 /* 39 * Packet header = Code, id, length. 40 */ 41 #define EAP_HEADERLEN 4 42 43 44 /* EAP message codes. */ 45 #define EAP_REQUEST 1 46 #define EAP_RESPONSE 2 47 #define EAP_SUCCESS 3 48 #define EAP_FAILURE 4 49 50 /* EAP types */ 51 #define EAPT_IDENTITY 1 52 #define EAPT_NOTIFICATION 2 53 #define EAPT_NAK 3 /* (response only) */ 54 #define EAPT_MD5CHAP 4 55 #define EAPT_OTP 5 /* One-Time Password; RFC 1938 */ 56 #define EAPT_TOKEN 6 /* Generic Token Card */ 57 /* 7 and 8 are unassigned. */ 58 #define EAPT_RSA 9 /* RSA Public Key Authentication */ 59 #define EAPT_DSS 10 /* DSS Unilateral */ 60 #define EAPT_KEA 11 /* KEA */ 61 #define EAPT_KEA_VALIDATE 12 /* KEA-VALIDATE */ 62 #define EAPT_TLS 13 /* EAP-TLS */ 63 #define EAPT_DEFENDER 14 /* Defender Token (AXENT) */ 64 #define EAPT_W2K 15 /* Windows 2000 EAP */ 65 #define EAPT_ARCOT 16 /* Arcot Systems */ 66 #define EAPT_CISCOWIRELESS 17 /* Cisco Wireless */ 67 #define EAPT_NOKIACARD 18 /* Nokia IP smart card */ 68 #define EAPT_SRP 19 /* Secure Remote Password */ 69 /* 20 is deprecated */ 70 #define EAPT_TTLS 21 /* EAP Tunneled TLS Authentication Protocol RFC5281 */ 71 #define EAPT_RAS 22 /* Remote Access Service */ 72 #define EAPT_AKA 23 /* EAP method for 3rd Generation Authentication and Key Agreement RFC4187 */ 73 #define EAPT_3COM 24 /* EAP-3Com Wireless */ 74 #define EAPT_PEAP 25 /* Protected EAP */ 75 #define EAPT_MSCHAPV2 26 /* EAP-MSCHAPv2 RFC-draft-kamath-pppext-eap-mschapv2-02 */ 76 77 /* OpCodes for MSCHAPv2 */ 78 #define CHAP_CHALLENGE 1 79 #define CHAP_RESPONSE 2 80 #define CHAP_SUCCESS 3 81 #define CHAP_FAILURE 4 82 83 /* EAP SRP-SHA1 Subtypes */ 84 #define EAPSRP_CHALLENGE 1 /* Request 1 - Challenge */ 85 #define EAPSRP_CKEY 1 /* Response 1 - Client Key */ 86 #define EAPSRP_SKEY 2 /* Request 2 - Server Key */ 87 #define EAPSRP_CVALIDATOR 2 /* Response 2 - Client Validator */ 88 #define EAPSRP_SVALIDATOR 3 /* Request 3 - Server Validator */ 89 #define EAPSRP_ACK 3 /* Response 3 - final ack */ 90 #define EAPSRP_LWRECHALLENGE 4 /* Req/resp 4 - Lightweight rechal */ 91 92 #define SRPVAL_EBIT 0x00000001 /* Use shared key for ECP */ 93 94 #define SRP_PSEUDO_ID "pseudo_" 95 #define SRP_PSEUDO_LEN 7 96 97 #define MIN_CHALLENGE_LENGTH 16 98 #define MAX_CHALLENGE_LENGTH 24 99 100 enum eap_state_code { 101 eapInitial = 0, /* No EAP authentication yet requested */ 102 eapPending, /* Waiting for LCP (no timer) */ 103 eapClosed, /* Authentication not in use */ 104 eapListen, /* Client ready (and timer running) */ 105 eapIdentify, /* EAP Identify sent */ 106 eapTlsStart, /* Send EAP-TLS start packet */ 107 eapTlsRecv, /* Receive EAP-TLS tls data */ 108 eapTlsSendAck, /* Send EAP-TLS ack */ 109 eapTlsSend, /* Send EAP-TLS tls data */ 110 eapTlsRecvAck, /* Receive EAP-TLS ack */ 111 eapTlsRecvClient, /* Receive EAP-TLS auth response from client*/ 112 eapTlsSendAlert, /* Send EAP-TLS tls alert (server)*/ 113 eapTlsRecvAlertAck, /* Receive EAP-TLS ack after sending alert */ 114 eapTlsRecvSuccess, /* Receive EAP success */ 115 eapTlsRecvFailure, /* Receive EAP failure */ 116 eapSRP1, /* Sent EAP SRP-SHA1 Subtype 1 */ 117 eapSRP2, /* Sent EAP SRP-SHA1 Subtype 2 */ 118 eapSRP3, /* Sent EAP SRP-SHA1 Subtype 3 */ 119 eapMD5Chall, /* Sent MD5-Challenge */ 120 eapMSCHAPv2Chall, /* Sent MSCHAPv2-Challenge */ 121 eapOpen, /* Completed authentication */ 122 eapSRP4, /* Sent EAP SRP-SHA1 Subtype 4 */ 123 eapBadAuth /* Failed authentication */ 124 }; 125 126 #define EAP_STATES \ 127 "Initial", "Pending", "Closed", "Listen", "Identify", \ 128 "TlsStart", "TlsRecv", "TlsSendAck", "TlsSend", "TlsRecvAck", "TlsRecvClient",\ 129 "TlsSendAlert", "TlsRecvAlertAck" , "TlsRecvSuccess", "TlsRecvFailure", \ 130 "SRP1", "SRP2", "SRP3", "MD5Chall", "MSCHAPv2Chall", "Open", "SRP4", "BadAuth" 131 132 #ifdef PPP_WITH_EAPTLS 133 #define eap_client_active(esp) ((esp)->es_client.ea_state != eapInitial &&\ 134 (esp)->es_client.ea_state != eapPending &&\ 135 (esp)->es_client.ea_state != eapClosed) 136 #else 137 #define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) 138 #endif /* PPP_WITH_EAPTLS */ 139 140 #define eap_server_active(esp) \ 141 ((esp)->es_server.ea_state >= eapIdentify && \ 142 (esp)->es_server.ea_state <= eapMD5Chall) 143 144 struct eap_auth { 145 char *ea_name; /* Our name */ 146 char *ea_peer; /* Peer's name */ 147 void *ea_session; /* Authentication library linkage */ 148 unsigned char *ea_skey; /* Shared encryption key */ 149 int ea_timeout; /* Time to wait (for retransmit/fail) */ 150 int ea_maxrequests; /* Max Requests allowed */ 151 unsigned short ea_namelen; /* Length of our name */ 152 unsigned short ea_peerlen; /* Length of peer's name */ 153 enum eap_state_code ea_state; 154 #ifdef PPP_WITH_EAPTLS 155 enum eap_state_code ea_prev_state; 156 #endif 157 #ifdef PPP_WITH_CHAPMS 158 struct chap_digest_type *digest; 159 #endif 160 unsigned char ea_id; /* Current id */ 161 unsigned char ea_requests; /* Number of Requests sent/received */ 162 unsigned char ea_responses; /* Number of Responses */ 163 unsigned char ea_type; /* One of EAPT_* */ 164 uint32_t ea_keyflags; /* SRP shared key usage flags */ 165 #ifdef PPP_WITH_EAPTLS 166 bool ea_using_eaptls; 167 #endif 168 }; 169 170 /* 171 * Complete EAP state for one PPP session. 172 */ 173 typedef struct eap_state { 174 int es_unit; /* Interface unit number */ 175 struct eap_auth es_client; /* Client (authenticatee) data */ 176 struct eap_auth es_server; /* Server (authenticator) data */ 177 #ifdef PPP_WITH_PEAP 178 struct peap_state *ea_peap; /* Client PEAP (authenticator) data */ 179 #endif 180 int es_savedtime; /* Saved timeout */ 181 int es_rechallenge; /* EAP rechallenge interval */ 182 int es_lwrechallenge; /* SRP lightweight rechallenge inter */ 183 bool es_usepseudo; /* Use SRP Pseudonym if offered one */ 184 int es_usedpseudo; /* Set if we already sent PN */ 185 int es_challen; /* Length of challenge string */ 186 unsigned char es_challenge[MAX_CHALLENGE_LENGTH]; 187 } eap_state; 188 189 /* 190 * Timeouts. 191 */ 192 #define EAP_DEFTIMEOUT 3 /* Timeout (seconds) for rexmit */ 193 #ifdef PPP_WITH_EAPTLS 194 #define EAP_DEFTRANSMITS 30 /* max # times to transmit */ 195 /* certificates can be long ... */ 196 #else 197 #define EAP_DEFTRANSMITS 10 /* max # times to transmit */ 198 #endif /* PPP_WITH_EAPTLS */ 199 #define EAP_DEFREQTIME 20 /* Time to wait for peer request */ 200 #define EAP_DEFALLOWREQ 20 /* max # times to accept requests */ 201 202 extern eap_state eap_states[]; 203 204 void eap_authwithpeer (int unit, char *localname); 205 void eap_authpeer (int unit, char *localname); 206 207 extern struct protent eap_protent; 208 209 #ifdef PPP_WITH_EAPTLS 210 typedef int (eaptls_passwd_hook_fn)(char *user, char *passwd); 211 extern eaptls_passwd_hook_fn *eaptls_passwd_hook; 212 #endif 213 214 #ifdef __cplusplus 215 } 216 #endif 217 218 #endif /* PPP_EAP_H */ 219 220