BadVPN – Blame information for rev 1
?pathlinks?
Rev | Author | Line No. | Line |
---|---|---|---|
1 | office | 1 | /* |
2 | * eap.h - Extensible Authentication Protocol for PPP (RFC 2284) |
||
3 | * |
||
4 | * Copyright (c) 2001 by Sun Microsystems, Inc. |
||
5 | * All rights reserved. |
||
6 | * |
||
7 | * Non-exclusive rights to redistribute, modify, translate, and use |
||
8 | * this software in source and binary forms, in whole or in part, is |
||
9 | * hereby granted, provided that the above copyright notice is |
||
10 | * duplicated in any source form, and that neither the name of the |
||
11 | * copyright holder nor the author is used to endorse or promote |
||
12 | * products derived from this software. |
||
13 | * |
||
14 | * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR |
||
15 | * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED |
||
16 | * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. |
||
17 | * |
||
18 | * Original version by James Carlson |
||
19 | * |
||
20 | * $Id: eap.h,v 1.2 2003/06/11 23:56:26 paulus Exp $ |
||
21 | */ |
||
22 | |||
23 | #include "netif/ppp/ppp_opts.h" |
||
24 | #if PPP_SUPPORT && EAP_SUPPORT /* don't build if not configured for use in lwipopts.h */ |
||
25 | |||
26 | #ifndef PPP_EAP_H |
||
27 | #define PPP_EAP_H |
||
28 | |||
29 | #include "ppp.h" |
||
30 | |||
31 | #ifdef __cplusplus |
||
32 | extern "C" { |
||
33 | #endif |
||
34 | |||
35 | /* |
||
36 | * Packet header = Code, id, length. |
||
37 | */ |
||
38 | #define EAP_HEADERLEN 4 |
||
39 | |||
40 | |||
41 | /* EAP message codes. */ |
||
42 | #define EAP_REQUEST 1 |
||
43 | #define EAP_RESPONSE 2 |
||
44 | #define EAP_SUCCESS 3 |
||
45 | #define EAP_FAILURE 4 |
||
46 | |||
47 | /* EAP types */ |
||
48 | #define EAPT_IDENTITY 1 |
||
49 | #define EAPT_NOTIFICATION 2 |
||
50 | #define EAPT_NAK 3 /* (response only) */ |
||
51 | #define EAPT_MD5CHAP 4 |
||
52 | #define EAPT_OTP 5 /* One-Time Password; RFC 1938 */ |
||
53 | #define EAPT_TOKEN 6 /* Generic Token Card */ |
||
54 | /* 7 and 8 are unassigned. */ |
||
55 | #define EAPT_RSA 9 /* RSA Public Key Authentication */ |
||
56 | #define EAPT_DSS 10 /* DSS Unilateral */ |
||
57 | #define EAPT_KEA 11 /* KEA */ |
||
58 | #define EAPT_KEA_VALIDATE 12 /* KEA-VALIDATE */ |
||
59 | #define EAPT_TLS 13 /* EAP-TLS */ |
||
60 | #define EAPT_DEFENDER 14 /* Defender Token (AXENT) */ |
||
61 | #define EAPT_W2K 15 /* Windows 2000 EAP */ |
||
62 | #define EAPT_ARCOT 16 /* Arcot Systems */ |
||
63 | #define EAPT_CISCOWIRELESS 17 /* Cisco Wireless */ |
||
64 | #define EAPT_NOKIACARD 18 /* Nokia IP smart card */ |
||
65 | #define EAPT_SRP 19 /* Secure Remote Password */ |
||
66 | /* 20 is deprecated */ |
||
67 | |||
68 | /* EAP SRP-SHA1 Subtypes */ |
||
69 | #define EAPSRP_CHALLENGE 1 /* Request 1 - Challenge */ |
||
70 | #define EAPSRP_CKEY 1 /* Response 1 - Client Key */ |
||
71 | #define EAPSRP_SKEY 2 /* Request 2 - Server Key */ |
||
72 | #define EAPSRP_CVALIDATOR 2 /* Response 2 - Client Validator */ |
||
73 | #define EAPSRP_SVALIDATOR 3 /* Request 3 - Server Validator */ |
||
74 | #define EAPSRP_ACK 3 /* Response 3 - final ack */ |
||
75 | #define EAPSRP_LWRECHALLENGE 4 /* Req/resp 4 - Lightweight rechal */ |
||
76 | |||
77 | #define SRPVAL_EBIT 0x00000001 /* Use shared key for ECP */ |
||
78 | |||
79 | #define SRP_PSEUDO_ID "pseudo_" |
||
80 | #define SRP_PSEUDO_LEN 7 |
||
81 | |||
82 | #define MD5_SIGNATURE_SIZE 16 |
||
83 | #define EAP_MIN_CHALLENGE_LENGTH 17 |
||
84 | #define EAP_MAX_CHALLENGE_LENGTH 24 |
||
85 | #define EAP_MIN_MAX_POWER_OF_TWO_CHALLENGE_LENGTH 3 /* 2^3-1 = 7, 17+7 = 24 */ |
||
86 | |||
87 | #define EAP_STATES \ |
||
88 | "Initial", "Pending", "Closed", "Listen", "Identify", \ |
||
89 | "SRP1", "SRP2", "SRP3", "MD5Chall", "Open", "SRP4", "BadAuth" |
||
90 | |||
91 | #define eap_client_active(pcb) ((pcb)->eap.es_client.ea_state == eapListen) |
||
92 | #if PPP_SERVER |
||
93 | #define eap_server_active(pcb) \ |
||
94 | ((pcb)->eap.es_server.ea_state >= eapIdentify && \ |
||
95 | (pcb)->eap.es_server.ea_state <= eapMD5Chall) |
||
96 | #endif /* PPP_SERVER */ |
||
97 | |||
98 | /* |
||
99 | * Complete EAP state for one PPP session. |
||
100 | */ |
||
101 | enum eap_state_code { |
||
102 | eapInitial = 0, /* No EAP authentication yet requested */ |
||
103 | eapPending, /* Waiting for LCP (no timer) */ |
||
104 | eapClosed, /* Authentication not in use */ |
||
105 | eapListen, /* Client ready (and timer running) */ |
||
106 | eapIdentify, /* EAP Identify sent */ |
||
107 | eapSRP1, /* Sent EAP SRP-SHA1 Subtype 1 */ |
||
108 | eapSRP2, /* Sent EAP SRP-SHA1 Subtype 2 */ |
||
109 | eapSRP3, /* Sent EAP SRP-SHA1 Subtype 3 */ |
||
110 | eapMD5Chall, /* Sent MD5-Challenge */ |
||
111 | eapOpen, /* Completed authentication */ |
||
112 | eapSRP4, /* Sent EAP SRP-SHA1 Subtype 4 */ |
||
113 | eapBadAuth /* Failed authentication */ |
||
114 | }; |
||
115 | |||
116 | struct eap_auth { |
||
117 | const char *ea_name; /* Our name */ |
||
118 | char ea_peer[MAXNAMELEN +1]; /* Peer's name */ |
||
119 | void *ea_session; /* Authentication library linkage */ |
||
120 | u_char *ea_skey; /* Shared encryption key */ |
||
121 | u_short ea_namelen; /* Length of our name */ |
||
122 | u_short ea_peerlen; /* Length of peer's name */ |
||
123 | enum eap_state_code ea_state; |
||
124 | u_char ea_id; /* Current id */ |
||
125 | u_char ea_requests; /* Number of Requests sent/received */ |
||
126 | u_char ea_responses; /* Number of Responses */ |
||
127 | u_char ea_type; /* One of EAPT_* */ |
||
128 | u32_t ea_keyflags; /* SRP shared key usage flags */ |
||
129 | }; |
||
130 | |||
131 | #ifndef EAP_MAX_CHALLENGE_LENGTH |
||
132 | #define EAP_MAX_CHALLENGE_LENGTH 24 |
||
133 | #endif |
||
134 | typedef struct eap_state { |
||
135 | struct eap_auth es_client; /* Client (authenticatee) data */ |
||
136 | #if PPP_SERVER |
||
137 | struct eap_auth es_server; /* Server (authenticator) data */ |
||
138 | #endif /* PPP_SERVER */ |
||
139 | int es_savedtime; /* Saved timeout */ |
||
140 | int es_rechallenge; /* EAP rechallenge interval */ |
||
141 | int es_lwrechallenge; /* SRP lightweight rechallenge inter */ |
||
142 | u8_t es_usepseudo; /* Use SRP Pseudonym if offered one */ |
||
143 | int es_usedpseudo; /* Set if we already sent PN */ |
||
144 | int es_challen; /* Length of challenge string */ |
||
145 | u_char es_challenge[EAP_MAX_CHALLENGE_LENGTH]; |
||
146 | } eap_state; |
||
147 | |||
148 | /* |
||
149 | * Timeouts. |
||
150 | */ |
||
151 | #if 0 /* moved to ppp_opts.h */ |
||
152 | #define EAP_DEFTIMEOUT 3 /* Timeout (seconds) for rexmit */ |
||
153 | #define EAP_DEFTRANSMITS 10 /* max # times to transmit */ |
||
154 | #define EAP_DEFREQTIME 20 /* Time to wait for peer request */ |
||
155 | #define EAP_DEFALLOWREQ 20 /* max # times to accept requests */ |
||
156 | #endif /* moved to ppp_opts.h */ |
||
157 | |||
158 | void eap_authwithpeer(ppp_pcb *pcb, const char *localname); |
||
159 | void eap_authpeer(ppp_pcb *pcb, const char *localname); |
||
160 | |||
161 | extern const struct protent eap_protent; |
||
162 | |||
163 | #ifdef __cplusplus |
||
164 | } |
||
165 | #endif |
||
166 | |||
167 | #endif /* PPP_EAP_H */ |
||
168 | |||
169 | #endif /* PPP_SUPPORT && EAP_SUPPORT */ |