1/* $NetBSD: eap.h,v 1.1.1.1 2005/02/20 10:28:43 cube Exp $ */ 2 3/* 4 * eap.h - Extensible Authentication Protocol for PPP (RFC 2284) 5 * 6 * Copyright (c) 2001 by Sun Microsystems, Inc. 7 * All rights reserved. 8 * 9 * Non-exclusive rights to redistribute, modify, translate, and use 10 * this software in source and binary forms, in whole or in part, is 11 * hereby granted, provided that the above copyright notice is 12 * duplicated in any source form, and that neither the name of the 13 * copyright holder nor the author is used to endorse or promote 14 * products derived from this software. 15 * 16 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 18 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19 * 20 * Original version by James Carlson 21 * 22 * Id: eap.h,v 1.2 2003/06/11 23:56:26 paulus Exp 23 */ 24 25#ifndef PPP_EAP_H 26#define PPP_EAP_H 27 28#ifdef __cplusplus 29extern "C" { 30#endif 31 32/* 33 * Packet header = Code, id, length. 34 */ 35#define EAP_HEADERLEN 4 36 37 38/* EAP message codes. */ 39#define EAP_REQUEST 1 40#define EAP_RESPONSE 2 41#define EAP_SUCCESS 3 42#define EAP_FAILURE 4 43 44/* EAP types */ 45#define EAPT_IDENTITY 1 46#define EAPT_NOTIFICATION 2 47#define EAPT_NAK 3 /* (response only) */ 48#define EAPT_MD5CHAP 4 49#define EAPT_OTP 5 /* One-Time Password; RFC 1938 */ 50#define EAPT_TOKEN 6 /* Generic Token Card */ 51/* 7 and 8 are unassigned. */ 52#define EAPT_RSA 9 /* RSA Public Key Authentication */ 53#define EAPT_DSS 10 /* DSS Unilateral */ 54#define EAPT_KEA 11 /* KEA */ 55#define EAPT_KEA_VALIDATE 12 /* KEA-VALIDATE */ 56#define EAPT_TLS 13 /* EAP-TLS */ 57#define EAPT_DEFENDER 14 /* Defender Token (AXENT) */ 58#define EAPT_W2K 15 /* Windows 2000 EAP */ 59#define EAPT_ARCOT 16 /* Arcot Systems */ 60#define EAPT_CISCOWIRELESS 17 /* Cisco Wireless */ 61#define EAPT_NOKIACARD 18 /* Nokia IP smart card */ 62#define EAPT_SRP 19 /* Secure Remote Password */ 63/* 20 is deprecated */ 64 65/* EAP SRP-SHA1 Subtypes */ 66#define EAPSRP_CHALLENGE 1 /* Request 1 - Challenge */ 67#define EAPSRP_CKEY 1 /* Response 1 - Client Key */ 68#define EAPSRP_SKEY 2 /* Request 2 - Server Key */ 69#define EAPSRP_CVALIDATOR 2 /* Response 2 - Client Validator */ 70#define EAPSRP_SVALIDATOR 3 /* Request 3 - Server Validator */ 71#define EAPSRP_ACK 3 /* Response 3 - final ack */ 72#define EAPSRP_LWRECHALLENGE 4 /* Req/resp 4 - Lightweight rechal */ 73 74#define SRPVAL_EBIT 0x00000001 /* Use shared key for ECP */ 75 76#define SRP_PSEUDO_ID "pseudo_" 77#define SRP_PSEUDO_LEN 7 78 79#define MD5_SIGNATURE_SIZE 16 80#define MIN_CHALLENGE_LENGTH 16 81#define MAX_CHALLENGE_LENGTH 24 82 83enum eap_state_code { 84 eapInitial = 0, /* No EAP authentication yet requested */ 85 eapPending, /* Waiting for LCP (no timer) */ 86 eapClosed, /* Authentication not in use */ 87 eapListen, /* Client ready (and timer running) */ 88 eapIdentify, /* EAP Identify sent */ 89 eapSRP1, /* Sent EAP SRP-SHA1 Subtype 1 */ 90 eapSRP2, /* Sent EAP SRP-SHA1 Subtype 2 */ 91 eapSRP3, /* Sent EAP SRP-SHA1 Subtype 3 */ 92 eapMD5Chall, /* Sent MD5-Challenge */ 93 eapOpen, /* Completed authentication */ 94 eapSRP4, /* Sent EAP SRP-SHA1 Subtype 4 */ 95 eapBadAuth /* Failed authentication */ 96}; 97 98#define EAP_STATES \ 99 "Initial", "Pending", "Closed", "Listen", "Identify", \ 100 "SRP1", "SRP2", "SRP3", "MD5Chall", "Open", "SRP4", "BadAuth" 101 102#define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) 103#define eap_server_active(esp) \ 104 ((esp)->es_server.ea_state >= eapIdentify && \ 105 (esp)->es_server.ea_state <= eapMD5Chall) 106 107struct eap_auth { 108 char *ea_name; /* Our name */ 109 char *ea_peer; /* Peer's name */ 110 void *ea_session; /* Authentication library linkage */ 111 u_char *ea_skey; /* Shared encryption key */ 112 int ea_timeout; /* Time to wait (for retransmit/fail) */ 113 int ea_maxrequests; /* Max Requests allowed */ 114 u_short ea_namelen; /* Length of our name */ 115 u_short ea_peerlen; /* Length of peer's name */ 116 enum eap_state_code ea_state; 117 u_char ea_id; /* Current id */ 118 u_char ea_requests; /* Number of Requests sent/received */ 119 u_char ea_responses; /* Number of Responses */ 120 u_char ea_type; /* One of EAPT_* */ 121 u_int32_t ea_keyflags; /* SRP shared key usage flags */ 122}; 123 124/* 125 * Complete EAP state for one PPP session. 126 */ 127typedef struct eap_state { 128 int es_unit; /* Interface unit number */ 129 struct eap_auth es_client; /* Client (authenticatee) data */ 130 struct eap_auth es_server; /* Server (authenticator) data */ 131 int es_savedtime; /* Saved timeout */ 132 int es_rechallenge; /* EAP rechallenge interval */ 133 int es_lwrechallenge; /* SRP lightweight rechallenge inter */ 134 bool es_usepseudo; /* Use SRP Pseudonym if offered one */ 135 int es_usedpseudo; /* Set if we already sent PN */ 136 int es_challen; /* Length of challenge string */ 137 u_char es_challenge[MAX_CHALLENGE_LENGTH]; 138} eap_state; 139 140/* 141 * Timeouts. 142 */ 143#define EAP_DEFTIMEOUT 3 /* Timeout (seconds) for rexmit */ 144#define EAP_DEFTRANSMITS 10 /* max # times to transmit */ 145#define EAP_DEFREQTIME 20 /* Time to wait for peer request */ 146#define EAP_DEFALLOWREQ 20 /* max # times to accept requests */ 147 148extern eap_state eap_states[]; 149 150void eap_authwithpeer __P((int unit, char *localname)); 151void eap_authpeer __P((int unit, char *localname)); 152 153extern struct protent eap_protent; 154 155#ifdef __cplusplus 156} 157#endif 158 159#endif /* PPP_EAP_H */ 160 161