radius_server.h revision 8d520ff1dc2da35cdca849e982051b86468016d8 
1/*
2 * RADIUS authentication server
3 * Copyright (c) 2005-2009, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 */
14
15#ifndef RADIUS_SERVER_H
16#define RADIUS_SERVER_H
17
18struct radius_server_data;
19struct eap_user;
20
21/**
22 * struct radius_server_conf - RADIUS server configuration
23 */
24struct radius_server_conf {
25	/**
26	 * auth_port - UDP port to listen to as an authentication server
27	 */
28	int auth_port;
29
30	/**
31	 * client_file - RADIUS client configuration file
32	 *
33	 * This file contains the RADIUS clients and the shared secret to be
34	 * used with them in a format where each client is on its own line. The
35	 * first item on the line is the IPv4 or IPv6 address of the client
36	 * with an optional address mask to allow full network to be specified
37	 * (e.g., 192.168.1.2 or 192.168.1.0/24). This is followed by white
38	 * space (space or tabulator) and the shared secret. Lines starting
39	 * with '#' are skipped and can be used as comments.
40	 */
41	char *client_file;
42
43	/**
44	 * conf_ctx - Context pointer for callbacks
45	 *
46	 * This is used as the ctx argument in get_eap_user() calls.
47	 */
48	void *conf_ctx;
49
50	/**
51	 * eap_sim_db_priv - EAP-SIM/AKA database context
52	 *
53	 * This is passed to the EAP-SIM/AKA server implementation as a
54	 * callback context.
55	 */
56	void *eap_sim_db_priv;
57
58	/**
59	 * ssl_ctx - TLS context
60	 *
61	 * This is passed to the EAP server implementation as a callback
62	 * context for TLS operations.
63	 */
64	void *ssl_ctx;
65
66	/**
67	 * pac_opaque_encr_key - PAC-Opaque encryption key for EAP-FAST
68	 *
69	 * This parameter is used to set a key for EAP-FAST to encrypt the
70	 * PAC-Opaque data. It can be set to %NULL if EAP-FAST is not used. If
71	 * set, must point to a 16-octet key.
72	 */
73	u8 *pac_opaque_encr_key;
74
75	/**
76	 * eap_fast_a_id - EAP-FAST authority identity (A-ID)
77	 *
78	 * If EAP-FAST is not used, this can be set to %NULL. In theory, this
79	 * is a variable length field, but due to some existing implementations
80	 * requiring A-ID to be 16 octets in length, it is recommended to use
81	 * that length for the field to provide interoperability with deployed
82	 * peer implementations.
83	 */
84	u8 *eap_fast_a_id;
85
86	/**
87	 * eap_fast_a_id_len - Length of eap_fast_a_id buffer in octets
88	 */
89	size_t eap_fast_a_id_len;
90
91	/**
92	 * eap_fast_a_id_info - EAP-FAST authority identifier information
93	 *
94	 * This A-ID-Info contains a user-friendly name for the A-ID. For
95	 * example, this could be the enterprise and server names in
96	 * human-readable format. This field is encoded as UTF-8. If EAP-FAST
97	 * is not used, this can be set to %NULL.
98	 */
99	char *eap_fast_a_id_info;
100
101	/**
102	 * eap_fast_prov - EAP-FAST provisioning modes
103	 *
104	 * 0 = provisioning disabled, 1 = only anonymous provisioning allowed,
105	 * 2 = only authenticated provisioning allowed, 3 = both provisioning
106	 * modes allowed.
107	 */
108	int eap_fast_prov;
109
110	/**
111	 * pac_key_lifetime - EAP-FAST PAC-Key lifetime in seconds
112	 *
113	 * This is the hard limit on how long a provisioned PAC-Key can be
114	 * used.
115	 */
116	int pac_key_lifetime;
117
118	/**
119	 * pac_key_refresh_time - EAP-FAST PAC-Key refresh time in seconds
120	 *
121	 * This is a soft limit on the PAC-Key. The server will automatically
122	 * generate a new PAC-Key when this number of seconds (or fewer) of the
123	 * lifetime remains.
124	 */
125	int pac_key_refresh_time;
126
127	/**
128	 * eap_sim_aka_result_ind - EAP-SIM/AKA protected success indication
129	 *
130	 * This controls whether the protected success/failure indication
131	 * (AT_RESULT_IND) is used with EAP-SIM and EAP-AKA.
132	 */
133	int eap_sim_aka_result_ind;
134
135	/**
136	 * tnc - Trusted Network Connect (TNC)
137	 *
138	 * This controls whether TNC is enabled and will be required before the
139	 * peer is allowed to connect. Note: This is only used with EAP-TTLS
140	 * and EAP-FAST. If any other EAP method is enabled, the peer will be
141	 * allowed to connect without TNC.
142	 */
143	int tnc;
144
145	/**
146	 * pwd_group - EAP-pwd D-H group
147	 *
148	 * This is used to select which D-H group to use with EAP-pwd.
149	 */
150	u16 pwd_group;
151
152	/**
153	 * wps - Wi-Fi Protected Setup context
154	 *
155	 * If WPS is used with an external RADIUS server (which is quite
156	 * unlikely configuration), this is used to provide a pointer to WPS
157	 * context data. Normally, this can be set to %NULL.
158	 */
159	struct wps_context *wps;
160
161	/**
162	 * ipv6 - Whether to enable IPv6 support in the RADIUS server
163	 */
164	int ipv6;
165
166	/**
167	 * get_eap_user - Callback for fetching EAP user information
168	 * @ctx: Context data from conf_ctx
169	 * @identity: User identity
170	 * @identity_len: identity buffer length in octets
171	 * @phase2: Whether this is for Phase 2 identity
172	 * @user: Data structure for filling in the user information
173	 * Returns: 0 on success, -1 on failure
174	 *
175	 * This is used to fetch information from user database. The callback
176	 * will fill in information about allowed EAP methods and the user
177	 * password. The password field will be an allocated copy of the
178	 * password data and RADIUS server will free it after use.
179	 */
180	int (*get_eap_user)(void *ctx, const u8 *identity, size_t identity_len,
181			    int phase2, struct eap_user *user);
182
183	/**
184	 * eap_req_id_text - Optional data for EAP-Request/Identity
185	 *
186	 * This can be used to configure an optional, displayable message that
187	 * will be sent in EAP-Request/Identity. This string can contain an
188	 * ASCII-0 character (nul) to separate network infromation per RFC
189	 * 4284. The actual string length is explicit provided in
190	 * eap_req_id_text_len since nul character will not be used as a string
191	 * terminator.
192	 */
193	const char *eap_req_id_text;
194
195	/**
196	 * eap_req_id_text_len - Length of eap_req_id_text buffer in octets
197	 */
198	size_t eap_req_id_text_len;
199
200	/*
201	 * msg_ctx - Context data for wpa_msg() calls
202	 */
203	void *msg_ctx;
204};
205
206
207struct radius_server_data *
208radius_server_init(struct radius_server_conf *conf);
209
210void radius_server_deinit(struct radius_server_data *data);
211
212int radius_server_get_mib(struct radius_server_data *data, char *buf,
213			  size_t buflen);
214
215void radius_server_eap_pending_cb(struct radius_server_data *data, void *ctx);
216
217#endif /* RADIUS_SERVER_H */
218