1 /* 2 * RADIUS authentication server 3 * Copyright (c) 2005-2009, Jouni Malinen <j (at) w1.fi> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 * Alternatively, this software may be distributed under the terms of BSD 10 * license. 11 * 12 * See README and COPYING for more details. 13 */ 14 15 #ifndef RADIUS_SERVER_H 16 #define RADIUS_SERVER_H 17 18 struct radius_server_data; 19 struct eap_user; 20 21 /** 22 * struct radius_server_conf - RADIUS server configuration 23 */ 24 struct radius_server_conf { 25 /** 26 * auth_port - UDP port to listen to as an authentication server 27 */ 28 int auth_port; 29 30 /** 31 * client_file - RADIUS client configuration file 32 * 33 * This file contains the RADIUS clients and the shared secret to be 34 * used with them in a format where each client is on its own line. The 35 * first item on the line is the IPv4 or IPv6 address of the client 36 * with an optional address mask to allow full network to be specified 37 * (e.g., 192.168.1.2 or 192.168.1.0/24). This is followed by white 38 * space (space or tabulator) and the shared secret. Lines starting 39 * with '#' are skipped and can be used as comments. 40 */ 41 char *client_file; 42 43 /** 44 * conf_ctx - Context pointer for callbacks 45 * 46 * This is used as the ctx argument in get_eap_user() calls. 47 */ 48 void *conf_ctx; 49 50 /** 51 * eap_sim_db_priv - EAP-SIM/AKA database context 52 * 53 * This is passed to the EAP-SIM/AKA server implementation as a 54 * callback context. 55 */ 56 void *eap_sim_db_priv; 57 58 /** 59 * ssl_ctx - TLS context 60 * 61 * This is passed to the EAP server implementation as a callback 62 * context for TLS operations. 63 */ 64 void *ssl_ctx; 65 66 /** 67 * pac_opaque_encr_key - PAC-Opaque encryption key for EAP-FAST 68 * 69 * This parameter is used to set a key for EAP-FAST to encrypt the 70 * PAC-Opaque data. It can be set to %NULL if EAP-FAST is not used. If 71 * set, must point to a 16-octet key. 72 */ 73 u8 *pac_opaque_encr_key; 74 75 /** 76 * eap_fast_a_id - EAP-FAST authority identity (A-ID) 77 * 78 * If EAP-FAST is not used, this can be set to %NULL. In theory, this 79 * is a variable length field, but due to some existing implementations 80 * requiring A-ID to be 16 octets in length, it is recommended to use 81 * that length for the field to provide interoperability with deployed 82 * peer implementations. 83 */ 84 u8 *eap_fast_a_id; 85 86 /** 87 * eap_fast_a_id_len - Length of eap_fast_a_id buffer in octets 88 */ 89 size_t eap_fast_a_id_len; 90 91 /** 92 * eap_fast_a_id_info - EAP-FAST authority identifier information 93 * 94 * This A-ID-Info contains a user-friendly name for the A-ID. For 95 * example, this could be the enterprise and server names in 96 * human-readable format. This field is encoded as UTF-8. If EAP-FAST 97 * is not used, this can be set to %NULL. 98 */ 99 char *eap_fast_a_id_info; 100 101 /** 102 * eap_fast_prov - EAP-FAST provisioning modes 103 * 104 * 0 = provisioning disabled, 1 = only anonymous provisioning allowed, 105 * 2 = only authenticated provisioning allowed, 3 = both provisioning 106 * modes allowed. 107 */ 108 int eap_fast_prov; 109 110 /** 111 * pac_key_lifetime - EAP-FAST PAC-Key lifetime in seconds 112 * 113 * This is the hard limit on how long a provisioned PAC-Key can be 114 * used. 115 */ 116 int pac_key_lifetime; 117 118 /** 119 * pac_key_refresh_time - EAP-FAST PAC-Key refresh time in seconds 120 * 121 * This is a soft limit on the PAC-Key. The server will automatically 122 * generate a new PAC-Key when this number of seconds (or fewer) of the 123 * lifetime remains. 124 */ 125 int pac_key_refresh_time; 126 127 /** 128 * eap_sim_aka_result_ind - EAP-SIM/AKA protected success indication 129 * 130 * This controls whether the protected success/failure indication 131 * (AT_RESULT_IND) is used with EAP-SIM and EAP-AKA. 132 */ 133 int eap_sim_aka_result_ind; 134 135 /** 136 * tnc - Trusted Network Connect (TNC) 137 * 138 * This controls whether TNC is enabled and will be required before the 139 * peer is allowed to connect. Note: This is only used with EAP-TTLS 140 * and EAP-FAST. If any other EAP method is enabled, the peer will be 141 * allowed to connect without TNC. 142 */ 143 int tnc; 144 145 /** 146 * pwd_group - EAP-pwd D-H group 147 * 148 * This is used to select which D-H group to use with EAP-pwd. 149 */ 150 u16 pwd_group; 151 152 /** 153 * wps - Wi-Fi Protected Setup context 154 * 155 * If WPS is used with an external RADIUS server (which is quite 156 * unlikely configuration), this is used to provide a pointer to WPS 157 * context data. Normally, this can be set to %NULL. 158 */ 159 struct wps_context *wps; 160 161 /** 162 * ipv6 - Whether to enable IPv6 support in the RADIUS server 163 */ 164 int ipv6; 165 166 /** 167 * get_eap_user - Callback for fetching EAP user information 168 * @ctx: Context data from conf_ctx 169 * @identity: User identity 170 * @identity_len: identity buffer length in octets 171 * @phase2: Whether this is for Phase 2 identity 172 * @user: Data structure for filling in the user information 173 * Returns: 0 on success, -1 on failure 174 * 175 * This is used to fetch information from user database. The callback 176 * will fill in information about allowed EAP methods and the user 177 * password. The password field will be an allocated copy of the 178 * password data and RADIUS server will free it after use. 179 */ 180 int (*get_eap_user)(void *ctx, const u8 *identity, size_t identity_len, 181 int phase2, struct eap_user *user); 182 183 /** 184 * eap_req_id_text - Optional data for EAP-Request/Identity 185 * 186 * This can be used to configure an optional, displayable message that 187 * will be sent in EAP-Request/Identity. This string can contain an 188 * ASCII-0 character (nul) to separate network infromation per RFC 189 * 4284. The actual string length is explicit provided in 190 * eap_req_id_text_len since nul character will not be used as a string 191 * terminator. 192 */ 193 const char *eap_req_id_text; 194 195 /** 196 * eap_req_id_text_len - Length of eap_req_id_text buffer in octets 197 */ 198 size_t eap_req_id_text_len; 199 200 /* 201 * msg_ctx - Context data for wpa_msg() calls 202 */ 203 void *msg_ctx; 204 }; 205 206 207 struct radius_server_data * 208 radius_server_init(struct radius_server_conf *conf); 209 210 void radius_server_deinit(struct radius_server_data *data); 211 212 int radius_server_get_mib(struct radius_server_data *data, char *buf, 213 size_t buflen); 214 215 void radius_server_eap_pending_cb(struct radius_server_data *data, void *ctx); 216 217 #endif /* RADIUS_SERVER_H */ 218
