2 * chap.h - Challenge Handshake Authentication Protocol definitions.
4 * Copyright (c) 1993-2002 Paul Mackerras. All rights reserved.
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in
15 * the documentation and/or other materials provided with the
18 * 3. The name(s) of the authors of this software must not be used to
19 * endorse or promote products derived from this software without
20 * prior written permission.
22 * 4. Redistributions of any form whatsoever must retain the following
24 * "This product includes software developed by Paul Mackerras
25 * <paulus@samba.org>".
27 * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO
28 * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
29 * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY
30 * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
31 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
32 * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
33 * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
35 * Copyright (c) 1991 Gregory M. Christy
36 * All rights reserved.
38 * Redistribution and use in source and binary forms are permitted
39 * provided that the above copyright notice and this paragraph are
40 * duplicated in all such forms and that any documentation,
41 * advertising materials, and other materials related to such
42 * distribution and use acknowledge that the software was developed
45 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
46 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
47 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
49 * $Id: chap.h,v 1.15 2002/12/04 23:03:32 paulus Exp $
52 #ifndef __CHAP_INCLUDE__
54 /* Code + ID + length */
55 #define CHAP_HEADERLEN 4
61 #define CHAP_DIGEST_MD5 5 /* use MD5 algorithm */
62 #define MD5_SIGNATURE_SIZE 16 /* 16 bytes in a MD5 message digest */
63 #define CHAP_MICROSOFT 0x80 /* use Microsoft-compatible alg. */
64 #define CHAP_MICROSOFT_V2 0x81 /* use Microsoft-compatible alg. */
67 * Digest type and selection.
70 /* bitmask of supported algorithms */
71 #define MDTYPE_MICROSOFT_V2 0x1
72 #define MDTYPE_MICROSOFT 0x2
73 #define MDTYPE_MD5 0x4
76 #define MDTYPE_ALL (MDTYPE_MICROSOFT_V2 | MDTYPE_MICROSOFT | MDTYPE_MD5)
78 #define MDTYPE_ALL (MDTYPE_MD5)
82 /* Return the digest alg. ID for the most preferred digest type. */
83 #define CHAP_DIGEST(mdtype) \
84 ((mdtype) & MDTYPE_MICROSOFT_V2)? CHAP_MICROSOFT_V2: \
85 ((mdtype) & MDTYPE_MICROSOFT)? CHAP_MICROSOFT: \
86 ((mdtype) & MDTYPE_MD5)? CHAP_DIGEST_MD5: \
89 /* Return the bit flag (lsb set) for our most preferred digest type. */
90 #define CHAP_MDTYPE(mdtype) ((mdtype) ^ ((mdtype) - 1)) & (mdtype)
92 /* Return the bit flag for a given digest algorithm ID. */
93 #define CHAP_MDTYPE_D(digest) \
94 ((digest) == CHAP_MICROSOFT_V2)? MDTYPE_MICROSOFT_V2: \
95 ((digest) == CHAP_MICROSOFT)? MDTYPE_MICROSOFT: \
96 ((digest) == CHAP_DIGEST_MD5)? MDTYPE_MD5: \
99 /* Can we do the requested digest? */
100 #define CHAP_CANDIGEST(mdtype, digest) \
101 ((digest) == CHAP_MICROSOFT_V2)? (mdtype) & MDTYPE_MICROSOFT_V2: \
102 ((digest) == CHAP_MICROSOFT)? (mdtype) & MDTYPE_MICROSOFT: \
103 ((digest) == CHAP_DIGEST_MD5)? (mdtype) & MDTYPE_MD5: \
106 #define CHAP_CHALLENGE 1
107 #define CHAP_RESPONSE 2
108 #define CHAP_SUCCESS 3
109 #define CHAP_FAILURE 4
112 * Challenge lengths (for challenges we send) and other limits.
114 #define MIN_CHALLENGE_LENGTH 16
115 #define MAX_CHALLENGE_LENGTH 24 /* sufficient for MS-CHAP Peer Chal. */
116 #define MAX_RESPONSE_LENGTH 64 /* sufficient for MD5 or MS-CHAP */
117 #define MS_AUTH_RESPONSE_LENGTH 40 /* MS-CHAPv2 authenticator response, */
121 * Each interface is described by a chap structure.
124 typedef struct chap_state {
125 int unit; /* Interface unit number */
126 int clientstate; /* Client state */
127 int serverstate; /* Server state */
128 u_char challenge[MAX_CHALLENGE_LENGTH]; /* last challenge string sent */
129 u_char chal_len; /* challenge length */
130 u_char chal_id; /* ID of last challenge */
131 u_char chal_type; /* hash algorithm for challenges */
132 u_char id; /* Current id */
133 char *chal_name; /* Our name to use with challenge */
134 int chal_interval; /* Time until we challenge peer again */
135 int timeouttime; /* Timeout time in seconds */
136 int max_transmits; /* Maximum # of challenge transmissions */
137 int chal_transmits; /* Number of transmissions of challenge */
138 int resp_transmits; /* Number of transmissions of response */
139 u_char response[MAX_RESPONSE_LENGTH]; /* Response to send */
140 char saresponse[MS_AUTH_RESPONSE_LENGTH+1]; /* Auth response to send */
141 char earesponse[MS_AUTH_RESPONSE_LENGTH+1]; /* Auth response expected */
142 /* +1 for null terminator */
143 u_char resp_flags; /* flags from MS-CHAPv2 auth response */
144 u_char resp_length; /* length of response */
145 u_char resp_id; /* ID for response messages */
146 u_char resp_type; /* hash algorithm for responses */
147 char *resp_name; /* Our name to send with response */
150 /* We need the declaration of chap_state to use this prototype */
151 extern int (*chap_auth_hook) __P((char *user, u_char *remmd,
152 int remmd_len, chap_state *cstate));
155 * Client (peer) states.
157 #define CHAPCS_INITIAL 0 /* Lower layer down, not opened */
158 #define CHAPCS_CLOSED 1 /* Lower layer up, not opened */
159 #define CHAPCS_PENDING 2 /* Auth us to peer when lower up */
160 #define CHAPCS_LISTEN 3 /* Listening for a challenge */
161 #define CHAPCS_RESPONSE 4 /* Sent response, waiting for status */
162 #define CHAPCS_OPEN 5 /* We've received Success */
165 * Server (authenticator) states.
167 #define CHAPSS_INITIAL 0 /* Lower layer down, not opened */
168 #define CHAPSS_CLOSED 1 /* Lower layer up, not opened */
169 #define CHAPSS_PENDING 2 /* Auth peer when lower up */
170 #define CHAPSS_INITIAL_CHAL 3 /* We've sent the first challenge */
171 #define CHAPSS_OPEN 4 /* We've sent a Success msg */
172 #define CHAPSS_RECHALLENGE 5 /* We've sent another challenge */
173 #define CHAPSS_BADAUTH 6 /* We've sent a Failure msg */
178 #define CHAP_DEFTIMEOUT 3 /* Timeout time in seconds */
179 #define CHAP_DEFTRANSMITS 10 /* max # times to send challenge */
181 extern chap_state chap[];
183 void ChapAuthWithPeer __P((int, char *, int));
184 void ChapAuthPeer __P((int, char *, int));
186 extern struct protent chap_protent;
188 #define __CHAP_INCLUDE__
189 #endif /* __CHAP_INCLUDE__ */