2 * eap.h - Extensible Authentication Protocol for PPP (RFC 2284)
4 * Copyright (c) 2001 by Sun Microsystems, Inc.
7 * Non-exclusive rights to redistribute, modify, translate, and use
8 * this software in source and binary forms, in whole or in part, is
9 * hereby granted, provided that the above copyright notice is
10 * duplicated in any source form, and that neither the name of the
11 * copyright holder nor the author is used to endorse or promote
12 * products derived from this software.
14 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
16 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
18 * Original version by James Carlson
20 * $Id: eap.h,v 1.2 2003/06/11 23:56:26 paulus Exp $
34 #define PPP_EAP 0xc227
39 * Packet header = Code, id, length.
41 #define EAP_HEADERLEN 4
44 /* EAP message codes. */
46 #define EAP_RESPONSE 2
51 #define EAPT_IDENTITY 1
52 #define EAPT_NOTIFICATION 2
53 #define EAPT_NAK 3 /* (response only) */
54 #define EAPT_MD5CHAP 4
55 #define EAPT_OTP 5 /* One-Time Password; RFC 1938 */
56 #define EAPT_TOKEN 6 /* Generic Token Card */
57 /* 7 and 8 are unassigned. */
58 #define EAPT_RSA 9 /* RSA Public Key Authentication */
59 #define EAPT_DSS 10 /* DSS Unilateral */
60 #define EAPT_KEA 11 /* KEA */
61 #define EAPT_KEA_VALIDATE 12 /* KEA-VALIDATE */
62 #define EAPT_TLS 13 /* EAP-TLS */
63 #define EAPT_DEFENDER 14 /* Defender Token (AXENT) */
64 #define EAPT_W2K 15 /* Windows 2000 EAP */
65 #define EAPT_ARCOT 16 /* Arcot Systems */
66 #define EAPT_CISCOWIRELESS 17 /* Cisco Wireless */
67 #define EAPT_NOKIACARD 18 /* Nokia IP smart card */
68 #define EAPT_SRP 19 /* Secure Remote Password */
69 /* 20 is deprecated */
70 #define EAPT_TTLS 21 /* EAP Tunneled TLS Authentication Protocol RFC5281 */
71 #define EAPT_RAS 22 /* Remote Access Service */
72 #define EAPT_AKA 23 /* EAP method for 3rd Generation Authentication and Key Agreement RFC4187 */
73 #define EAPT_3COM 24 /* EAP-3Com Wireless */
74 #define EAPT_PEAP 25 /* Protected EAP */
75 #define EAPT_MSCHAPV2 26 /* EAP-MSCHAPv2 RFC-draft-kamath-pppext-eap-mschapv2-02 */
77 /* OpCodes for MSCHAPv2 */
78 #define CHAP_CHALLENGE 1
79 #define CHAP_RESPONSE 2
80 #define CHAP_SUCCESS 3
81 #define CHAP_FAILURE 4
83 /* EAP SRP-SHA1 Subtypes */
84 #define EAPSRP_CHALLENGE 1 /* Request 1 - Challenge */
85 #define EAPSRP_CKEY 1 /* Response 1 - Client Key */
86 #define EAPSRP_SKEY 2 /* Request 2 - Server Key */
87 #define EAPSRP_CVALIDATOR 2 /* Response 2 - Client Validator */
88 #define EAPSRP_SVALIDATOR 3 /* Request 3 - Server Validator */
89 #define EAPSRP_ACK 3 /* Response 3 - final ack */
90 #define EAPSRP_LWRECHALLENGE 4 /* Req/resp 4 - Lightweight rechal */
92 #define SRPVAL_EBIT 0x00000001 /* Use shared key for ECP */
94 #define SRP_PSEUDO_ID "pseudo_"
95 #define SRP_PSEUDO_LEN 7
97 #define MIN_CHALLENGE_LENGTH 16
98 #define MAX_CHALLENGE_LENGTH 24
100 enum eap_state_code {
101 eapInitial = 0, /* No EAP authentication yet requested */
102 eapPending, /* Waiting for LCP (no timer) */
103 eapClosed, /* Authentication not in use */
104 eapListen, /* Client ready (and timer running) */
105 eapIdentify, /* EAP Identify sent */
106 eapTlsStart, /* Send EAP-TLS start packet */
107 eapTlsRecv, /* Receive EAP-TLS tls data */
108 eapTlsSendAck, /* Send EAP-TLS ack */
109 eapTlsSend, /* Send EAP-TLS tls data */
110 eapTlsRecvAck, /* Receive EAP-TLS ack */
111 eapTlsRecvClient, /* Receive EAP-TLS auth response from client*/
112 eapTlsSendAlert, /* Send EAP-TLS tls alert (server)*/
113 eapTlsRecvAlertAck, /* Receive EAP-TLS ack after sending alert */
114 eapTlsRecvSuccess, /* Receive EAP success */
115 eapTlsRecvFailure, /* Receive EAP failure */
116 eapSRP1, /* Sent EAP SRP-SHA1 Subtype 1 */
117 eapSRP2, /* Sent EAP SRP-SHA1 Subtype 2 */
118 eapSRP3, /* Sent EAP SRP-SHA1 Subtype 3 */
119 eapMD5Chall, /* Sent MD5-Challenge */
120 eapMSCHAPv2Chall, /* Sent MSCHAPv2-Challenge */
121 eapOpen, /* Completed authentication */
122 eapSRP4, /* Sent EAP SRP-SHA1 Subtype 4 */
123 eapBadAuth /* Failed authentication */
127 "Initial", "Pending", "Closed", "Listen", "Identify", \
128 "TlsStart", "TlsRecv", "TlsSendAck", "TlsSend", "TlsRecvAck", "TlsRecvClient",\
129 "TlsSendAlert", "TlsRecvAlertAck" , "TlsRecvSuccess", "TlsRecvFailure", \
130 "SRP1", "SRP2", "SRP3", "MD5Chall", "MSCHAPv2Chall", "Open", "SRP4", "BadAuth"
132 #ifdef PPP_WITH_EAPTLS
133 #define eap_client_active(esp) ((esp)->es_client.ea_state != eapInitial &&\
134 (esp)->es_client.ea_state != eapPending &&\
135 (esp)->es_client.ea_state != eapClosed)
137 #define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen)
138 #endif /* PPP_WITH_EAPTLS */
140 #define eap_server_active(esp) \
141 ((esp)->es_server.ea_state >= eapIdentify && \
142 (esp)->es_server.ea_state <= eapMD5Chall)
145 char *ea_name; /* Our name */
146 char *ea_peer; /* Peer's name */
147 void *ea_session; /* Authentication library linkage */
148 unsigned char *ea_skey; /* Shared encryption key */
149 int ea_timeout; /* Time to wait (for retransmit/fail) */
150 int ea_maxrequests; /* Max Requests allowed */
151 unsigned short ea_namelen; /* Length of our name */
152 unsigned short ea_peerlen; /* Length of peer's name */
153 enum eap_state_code ea_state;
154 #ifdef PPP_WITH_EAPTLS
155 enum eap_state_code ea_prev_state;
157 #ifdef PPP_WITH_CHAPMS
158 struct chap_digest_type *digest;
160 unsigned char ea_id; /* Current id */
161 unsigned char ea_requests; /* Number of Requests sent/received */
162 unsigned char ea_responses; /* Number of Responses */
163 unsigned char ea_type; /* One of EAPT_* */
164 uint32_t ea_keyflags; /* SRP shared key usage flags */
165 #ifdef PPP_WITH_EAPTLS
166 bool ea_using_eaptls;
171 * Complete EAP state for one PPP session.
173 typedef struct eap_state {
174 int es_unit; /* Interface unit number */
175 struct eap_auth es_client; /* Client (authenticatee) data */
176 struct eap_auth es_server; /* Server (authenticator) data */
178 struct peap_state *ea_peap; /* Client PEAP (authenticator) data */
180 int es_savedtime; /* Saved timeout */
181 int es_rechallenge; /* EAP rechallenge interval */
182 int es_lwrechallenge; /* SRP lightweight rechallenge inter */
183 bool es_usepseudo; /* Use SRP Pseudonym if offered one */
184 int es_usedpseudo; /* Set if we already sent PN */
185 int es_challen; /* Length of challenge string */
186 unsigned char es_challenge[MAX_CHALLENGE_LENGTH];
192 #define EAP_DEFTIMEOUT 3 /* Timeout (seconds) for rexmit */
193 #ifdef PPP_WITH_EAPTLS
194 #define EAP_DEFTRANSMITS 30 /* max # times to transmit */
195 /* certificates can be long ... */
197 #define EAP_DEFTRANSMITS 10 /* max # times to transmit */
198 #endif /* PPP_WITH_EAPTLS */
199 #define EAP_DEFREQTIME 20 /* Time to wait for peer request */
200 #define EAP_DEFALLOWREQ 20 /* max # times to accept requests */
202 extern eap_state eap_states[];
204 void eap_authwithpeer (int unit, char *localname);
205 void eap_authpeer (int unit, char *localname);
207 extern struct protent eap_protent;
209 #ifdef PPP_WITH_EAPTLS
210 typedef int (eaptls_passwd_hook_fn)(char *user, char *passwd);
211 extern eaptls_passwd_hook_fn *eaptls_passwd_hook;
218 #endif /* PPP_EAP_H */