1/* 2 * RADIUS authentication server 3 * Copyright (c) 2005-2009, 2011, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9#ifndef RADIUS_SERVER_H 10#define RADIUS_SERVER_H 11 12struct radius_server_data; 13struct eap_user; 14 15/** 16 * struct radius_server_conf - RADIUS server configuration 17 */ 18struct radius_server_conf { 19 /** 20 * auth_port - UDP port to listen to as an authentication server 21 */ 22 int auth_port; 23 24 /** 25 * acct_port - UDP port to listen to as an accounting server 26 */ 27 int acct_port; 28 29 /** 30 * client_file - RADIUS client configuration file 31 * 32 * This file contains the RADIUS clients and the shared secret to be 33 * used with them in a format where each client is on its own line. The 34 * first item on the line is the IPv4 or IPv6 address of the client 35 * with an optional address mask to allow full network to be specified 36 * (e.g., 192.168.1.2 or 192.168.1.0/24). This is followed by white 37 * space (space or tabulator) and the shared secret. Lines starting 38 * with '#' are skipped and can be used as comments. 39 */ 40 char *client_file; 41 42 /** 43 * sqlite_file - SQLite database for storing debug log information 44 */ 45 const char *sqlite_file; 46 47 /** 48 * conf_ctx - Context pointer for callbacks 49 * 50 * This is used as the ctx argument in get_eap_user() calls. 51 */ 52 void *conf_ctx; 53 54 /** 55 * eap_sim_db_priv - EAP-SIM/AKA database context 56 * 57 * This is passed to the EAP-SIM/AKA server implementation as a 58 * callback context. 59 */ 60 void *eap_sim_db_priv; 61 62 /** 63 * ssl_ctx - TLS context 64 * 65 * This is passed to the EAP server implementation as a callback 66 * context for TLS operations. 67 */ 68 void *ssl_ctx; 69 70 /** 71 * pac_opaque_encr_key - PAC-Opaque encryption key for EAP-FAST 72 * 73 * This parameter is used to set a key for EAP-FAST to encrypt the 74 * PAC-Opaque data. It can be set to %NULL if EAP-FAST is not used. If 75 * set, must point to a 16-octet key. 76 */ 77 u8 *pac_opaque_encr_key; 78 79 /** 80 * eap_fast_a_id - EAP-FAST authority identity (A-ID) 81 * 82 * If EAP-FAST is not used, this can be set to %NULL. In theory, this 83 * is a variable length field, but due to some existing implementations 84 * requiring A-ID to be 16 octets in length, it is recommended to use 85 * that length for the field to provide interoperability with deployed 86 * peer implementations. 87 */ 88 u8 *eap_fast_a_id; 89 90 /** 91 * eap_fast_a_id_len - Length of eap_fast_a_id buffer in octets 92 */ 93 size_t eap_fast_a_id_len; 94 95 /** 96 * eap_fast_a_id_info - EAP-FAST authority identifier information 97 * 98 * This A-ID-Info contains a user-friendly name for the A-ID. For 99 * example, this could be the enterprise and server names in 100 * human-readable format. This field is encoded as UTF-8. If EAP-FAST 101 * is not used, this can be set to %NULL. 102 */ 103 char *eap_fast_a_id_info; 104 105 /** 106 * eap_fast_prov - EAP-FAST provisioning modes 107 * 108 * 0 = provisioning disabled, 1 = only anonymous provisioning allowed, 109 * 2 = only authenticated provisioning allowed, 3 = both provisioning 110 * modes allowed. 111 */ 112 int eap_fast_prov; 113 114 /** 115 * pac_key_lifetime - EAP-FAST PAC-Key lifetime in seconds 116 * 117 * This is the hard limit on how long a provisioned PAC-Key can be 118 * used. 119 */ 120 int pac_key_lifetime; 121 122 /** 123 * pac_key_refresh_time - EAP-FAST PAC-Key refresh time in seconds 124 * 125 * This is a soft limit on the PAC-Key. The server will automatically 126 * generate a new PAC-Key when this number of seconds (or fewer) of the 127 * lifetime remains. 128 */ 129 int pac_key_refresh_time; 130 131 int eap_teap_auth; 132 int eap_teap_pac_no_inner; 133 134 /** 135 * eap_sim_aka_result_ind - EAP-SIM/AKA protected success indication 136 * 137 * This controls whether the protected success/failure indication 138 * (AT_RESULT_IND) is used with EAP-SIM and EAP-AKA. 139 */ 140 int eap_sim_aka_result_ind; 141 142 int eap_sim_id; 143 144 /** 145 * tnc - Trusted Network Connect (TNC) 146 * 147 * This controls whether TNC is enabled and will be required before the 148 * peer is allowed to connect. Note: This is only used with EAP-TTLS 149 * and EAP-FAST. If any other EAP method is enabled, the peer will be 150 * allowed to connect without TNC. 151 */ 152 int tnc; 153 154 /** 155 * pwd_group - EAP-pwd D-H group 156 * 157 * This is used to select which D-H group to use with EAP-pwd. 158 */ 159 u16 pwd_group; 160 161 /** 162 * server_id - Server identity 163 */ 164 const char *server_id; 165 166 /** 167 * erp - Whether EAP Re-authentication Protocol (ERP) is enabled 168 * 169 * This controls whether the authentication server derives ERP key 170 * hierarchy (rRK and rIK) from full EAP authentication and allows 171 * these keys to be used to perform ERP to derive rMSK instead of full 172 * EAP authentication to derive MSK. 173 */ 174 int erp; 175 176 const char *erp_domain; 177 178 unsigned int tls_session_lifetime; 179 180 unsigned int tls_flags; 181 182 /** 183 * wps - Wi-Fi Protected Setup context 184 * 185 * If WPS is used with an external RADIUS server (which is quite 186 * unlikely configuration), this is used to provide a pointer to WPS 187 * context data. Normally, this can be set to %NULL. 188 */ 189 struct wps_context *wps; 190 191 /** 192 * ipv6 - Whether to enable IPv6 support in the RADIUS server 193 */ 194 int ipv6; 195 196 /** 197 * get_eap_user - Callback for fetching EAP user information 198 * @ctx: Context data from conf_ctx 199 * @identity: User identity 200 * @identity_len: identity buffer length in octets 201 * @phase2: Whether this is for Phase 2 identity 202 * @user: Data structure for filling in the user information 203 * Returns: 0 on success, -1 on failure 204 * 205 * This is used to fetch information from user database. The callback 206 * will fill in information about allowed EAP methods and the user 207 * password. The password field will be an allocated copy of the 208 * password data and RADIUS server will free it after use. 209 */ 210 int (*get_eap_user)(void *ctx, const u8 *identity, size_t identity_len, 211 int phase2, struct eap_user *user); 212 213 /** 214 * eap_req_id_text - Optional data for EAP-Request/Identity 215 * 216 * This can be used to configure an optional, displayable message that 217 * will be sent in EAP-Request/Identity. This string can contain an 218 * ASCII-0 character (nul) to separate network infromation per RFC 219 * 4284. The actual string length is explicit provided in 220 * eap_req_id_text_len since nul character will not be used as a string 221 * terminator. 222 */ 223 const char *eap_req_id_text; 224 225 /** 226 * eap_req_id_text_len - Length of eap_req_id_text buffer in octets 227 */ 228 size_t eap_req_id_text_len; 229 230 /* 231 * msg_ctx - Context data for wpa_msg() calls 232 */ 233 void *msg_ctx; 234 235#ifdef CONFIG_RADIUS_TEST 236 const char *dump_msk_file; 237#endif /* CONFIG_RADIUS_TEST */ 238 239 char *subscr_remediation_url; 240 u8 subscr_remediation_method; 241 char *hs20_sim_provisioning_url; 242 243 char *t_c_server_url; 244}; 245 246 247struct radius_server_data * 248radius_server_init(struct radius_server_conf *conf); 249 250void radius_server_erp_flush(struct radius_server_data *data); 251void radius_server_deinit(struct radius_server_data *data); 252 253int radius_server_get_mib(struct radius_server_data *data, char *buf, 254 size_t buflen); 255 256void radius_server_eap_pending_cb(struct radius_server_data *data, void *ctx); 257int radius_server_dac_request(struct radius_server_data *data, const char *req); 258 259#endif /* RADIUS_SERVER_H */ 260