src/radius/radius_server.h - vendor/opensource/hostap - Git at Google

 /*
  * RADIUS authentication server
  * Copyright (c) 2005-2009, 2011, Jouni Malinen <j@w1.fi>
  *
  * This software may be distributed under the terms of the BSD license.
  * See README for more details.
  */

 #ifndef RADIUS_SERVER_H
 #define RADIUS_SERVER_H

 struct radius_server_data;
 struct eap_user;

 /**
  * struct radius_server_conf - RADIUS server configuration
  */
 struct radius_server_conf {
 	/**
 	 * auth_port - UDP port to listen to as an authentication server
 	 */
 	int auth_port;

 	/**
 	 * acct_port - UDP port to listen to as an accounting server
 	 */
 	int acct_port;

 	/**
 	 * client_file - RADIUS client configuration file
 	 *
 	 * This file contains the RADIUS clients and the shared secret to be
 	 * used with them in a format where each client is on its own line. The
 	 * first item on the line is the IPv4 or IPv6 address of the client
 	 * with an optional address mask to allow full network to be specified
 	 * (e.g., 192.168.1.2 or 192.168.1.0/24). This is followed by white
 	 * space (space or tabulator) and the shared secret. Lines starting
 	 * with '#' are skipped and can be used as comments.
 	 */
 	char *client_file;

 	/**
 	 * sqlite_file - SQLite database for storing debug log information
 	 */
 	const char *sqlite_file;

 	/**
 	 * conf_ctx - Context pointer for callbacks
 	 *
 	 * This is used as the ctx argument in get_eap_user() calls.
 	 */
 	void *conf_ctx;

 	/**
 	 * eap_sim_db_priv - EAP-SIM/AKA database context
 	 *
 	 * This is passed to the EAP-SIM/AKA server implementation as a
 	 * callback context.
 	 */
 	void *eap_sim_db_priv;

 	/**
 	 * ssl_ctx - TLS context
 	 *
 	 * This is passed to the EAP server implementation as a callback
 	 * context for TLS operations.
 	 */
 	void *ssl_ctx;

 	/**
 	 * pac_opaque_encr_key - PAC-Opaque encryption key for EAP-FAST
 	 *
 	 * This parameter is used to set a key for EAP-FAST to encrypt the
 	 * PAC-Opaque data. It can be set to %NULL if EAP-FAST is not used. If
 	 * set, must point to a 16-octet key.
 	 */
 	u8 *pac_opaque_encr_key;

 	/**
 	 * eap_fast_a_id - EAP-FAST authority identity (A-ID)
 	 *
 	 * If EAP-FAST is not used, this can be set to %NULL. In theory, this
 	 * is a variable length field, but due to some existing implementations
 	 * requiring A-ID to be 16 octets in length, it is recommended to use
 	 * that length for the field to provide interoperability with deployed
 	 * peer implementations.
 	 */
 	u8 *eap_fast_a_id;

 	/**
 	 * eap_fast_a_id_len - Length of eap_fast_a_id buffer in octets
 	 */
 	size_t eap_fast_a_id_len;

 	/**
 	 * eap_fast_a_id_info - EAP-FAST authority identifier information
 	 *
 	 * This A-ID-Info contains a user-friendly name for the A-ID. For
 	 * example, this could be the enterprise and server names in
 	 * human-readable format. This field is encoded as UTF-8. If EAP-FAST
 	 * is not used, this can be set to %NULL.
 	 */
 	char *eap_fast_a_id_info;

 	/**
 	 * eap_fast_prov - EAP-FAST provisioning modes
 	 *
 	 * 0 = provisioning disabled, 1 = only anonymous provisioning allowed,
 	 * 2 = only authenticated provisioning allowed, 3 = both provisioning
 	 * modes allowed.
 	 */
 	int eap_fast_prov;

 	/**
 	 * pac_key_lifetime - EAP-FAST PAC-Key lifetime in seconds
 	 *
 	 * This is the hard limit on how long a provisioned PAC-Key can be
 	 * used.
 	 */
 	int pac_key_lifetime;

 	/**
 	 * pac_key_refresh_time - EAP-FAST PAC-Key refresh time in seconds
 	 *
 	 * This is a soft limit on the PAC-Key. The server will automatically
 	 * generate a new PAC-Key when this number of seconds (or fewer) of the
 	 * lifetime remains.
 	 */
 	int pac_key_refresh_time;

 	/**
 	 * eap_sim_aka_result_ind - EAP-SIM/AKA protected success indication
 	 *
 	 * This controls whether the protected success/failure indication
 	 * (AT_RESULT_IND) is used with EAP-SIM and EAP-AKA.
 	 */
 	int eap_sim_aka_result_ind;

 	/**
 	 * tnc - Trusted Network Connect (TNC)
 	 *
 	 * This controls whether TNC is enabled and will be required before the
 	 * peer is allowed to connect. Note: This is only used with EAP-TTLS
 	 * and EAP-FAST. If any other EAP method is enabled, the peer will be
 	 * allowed to connect without TNC.
 	 */
 	int tnc;

 	/**
 	 * pwd_group - EAP-pwd D-H group
 	 *
 	 * This is used to select which D-H group to use with EAP-pwd.
 	 */
 	u16 pwd_group;

 	/**
 	 * server_id - Server identity
 	 */
 	const char *server_id;

 	/**
 	 * erp - Whether EAP Re-authentication Protocol (ERP) is enabled
 	 *
 	 * This controls whether the authentication server derives ERP key
 	 * hierarchy (rRK and rIK) from full EAP authentication and allows
 	 * these keys to be used to perform ERP to derive rMSK instead of full
 	 * EAP authentication to derive MSK.
 	 */
 	int erp;

 	const char *erp_domain;

 	/**
 	 * wps - Wi-Fi Protected Setup context
 	 *
 	 * If WPS is used with an external RADIUS server (which is quite
 	 * unlikely configuration), this is used to provide a pointer to WPS
 	 * context data. Normally, this can be set to %NULL.
 	 */
 	struct wps_context *wps;

 	/**
 	 * ipv6 - Whether to enable IPv6 support in the RADIUS server
 	 */
 	int ipv6;

 	/**
 	 * get_eap_user - Callback for fetching EAP user information
 	 * @ctx: Context data from conf_ctx
 	 * @identity: User identity
 	 * @identity_len: identity buffer length in octets
 	 * @phase2: Whether this is for Phase 2 identity
 	 * @user: Data structure for filling in the user information
 	 * Returns: 0 on success, -1 on failure
 	 *
 	 * This is used to fetch information from user database. The callback
 	 * will fill in information about allowed EAP methods and the user
 	 * password. The password field will be an allocated copy of the
 	 * password data and RADIUS server will free it after use.
 	 */
 	int (*get_eap_user)(void *ctx, const u8 *identity, size_t identity_len,
 			    int phase2, struct eap_user *user);

 	/**
 	 * eap_req_id_text - Optional data for EAP-Request/Identity
 	 *
 	 * This can be used to configure an optional, displayable message that
 	 * will be sent in EAP-Request/Identity. This string can contain an
 	 * ASCII-0 character (nul) to separate network infromation per RFC
 	 * 4284. The actual string length is explicit provided in
 	 * eap_req_id_text_len since nul character will not be used as a string
 	 * terminator.
 	 */
 	const char *eap_req_id_text;

 	/**
 	 * eap_req_id_text_len - Length of eap_req_id_text buffer in octets
 	 */
 	size_t eap_req_id_text_len;

 	/*
 	 * msg_ctx - Context data for wpa_msg() calls
 	 */
 	void *msg_ctx;

 #ifdef CONFIG_RADIUS_TEST
 	const char *dump_msk_file;
 #endif /* CONFIG_RADIUS_TEST */

 	char *subscr_remediation_url;
 	u8 subscr_remediation_method;
 };


 struct radius_server_data *
 radius_server_init(struct radius_server_conf *conf);

 void radius_server_erp_flush(struct radius_server_data *data);
 void radius_server_deinit(struct radius_server_data *data);

 int radius_server_get_mib(struct radius_server_data *data, char *buf,
 			  size_t buflen);

 void radius_server_eap_pending_cb(struct radius_server_data *data, void *ctx);

 #endif /* RADIUS_SERVER_H */
	/*
	* RADIUS authentication server
	* Copyright (c) 2005-2009, 2011, Jouni Malinen <j@w1.fi>
	*
	* This software may be distributed under the terms of the BSD license.
	* See README for more details.
	*/

	#ifndef RADIUS_SERVER_H
	#define RADIUS_SERVER_H

	struct radius_server_data;
	struct eap_user;

	/**
	* struct radius_server_conf - RADIUS server configuration
	*/
	struct radius_server_conf {
	/**
	* auth_port - UDP port to listen to as an authentication server
	*/
	int auth_port;

	/**
	* acct_port - UDP port to listen to as an accounting server
	*/
	int acct_port;

	/**
	* client_file - RADIUS client configuration file
	*
	* This file contains the RADIUS clients and the shared secret to be
	* used with them in a format where each client is on its own line. The
	* first item on the line is the IPv4 or IPv6 address of the client
	* with an optional address mask to allow full network to be specified
	* (e.g., 192.168.1.2 or 192.168.1.0/24). This is followed by white
	* space (space or tabulator) and the shared secret. Lines starting
	* with '#' are skipped and can be used as comments.
	*/
	char *client_file;

	/**
	* sqlite_file - SQLite database for storing debug log information
	*/
	const char *sqlite_file;

	/**
	* conf_ctx - Context pointer for callbacks
	*
	* This is used as the ctx argument in get_eap_user() calls.
	*/
	void *conf_ctx;

	/**
	* eap_sim_db_priv - EAP-SIM/AKA database context
	*
	* This is passed to the EAP-SIM/AKA server implementation as a
	* callback context.
	*/
	void *eap_sim_db_priv;

	/**
	* ssl_ctx - TLS context
	*
	* This is passed to the EAP server implementation as a callback
	* context for TLS operations.
	*/
	void *ssl_ctx;

	/**
	* pac_opaque_encr_key - PAC-Opaque encryption key for EAP-FAST
	*
	* This parameter is used to set a key for EAP-FAST to encrypt the
	* PAC-Opaque data. It can be set to %NULL if EAP-FAST is not used. If
	* set, must point to a 16-octet key.
	*/
	u8 *pac_opaque_encr_key;

	/**
	* eap_fast_a_id - EAP-FAST authority identity (A-ID)
	*
	* If EAP-FAST is not used, this can be set to %NULL. In theory, this
	* is a variable length field, but due to some existing implementations
	* requiring A-ID to be 16 octets in length, it is recommended to use
	* that length for the field to provide interoperability with deployed
	* peer implementations.
	*/
	u8 *eap_fast_a_id;

	/**
	* eap_fast_a_id_len - Length of eap_fast_a_id buffer in octets
	*/
	size_t eap_fast_a_id_len;

	/**
	* eap_fast_a_id_info - EAP-FAST authority identifier information
	*
	* This A-ID-Info contains a user-friendly name for the A-ID. For
	* example, this could be the enterprise and server names in
	* human-readable format. This field is encoded as UTF-8. If EAP-FAST
	* is not used, this can be set to %NULL.
	*/
	char *eap_fast_a_id_info;

	/**
	* eap_fast_prov - EAP-FAST provisioning modes
	*
	* 0 = provisioning disabled, 1 = only anonymous provisioning allowed,
	* 2 = only authenticated provisioning allowed, 3 = both provisioning
	* modes allowed.
	*/
	int eap_fast_prov;

	/**
	* pac_key_lifetime - EAP-FAST PAC-Key lifetime in seconds
	*
	* This is the hard limit on how long a provisioned PAC-Key can be
	* used.
	*/
	int pac_key_lifetime;

	/**
	* pac_key_refresh_time - EAP-FAST PAC-Key refresh time in seconds
	*
	* This is a soft limit on the PAC-Key. The server will automatically
	* generate a new PAC-Key when this number of seconds (or fewer) of the
	* lifetime remains.
	*/
	int pac_key_refresh_time;

	/**
	* eap_sim_aka_result_ind - EAP-SIM/AKA protected success indication
	*
	* This controls whether the protected success/failure indication
	* (AT_RESULT_IND) is used with EAP-SIM and EAP-AKA.
	*/
	int eap_sim_aka_result_ind;

	/**
	* tnc - Trusted Network Connect (TNC)
	*
	* This controls whether TNC is enabled and will be required before the
	* peer is allowed to connect. Note: This is only used with EAP-TTLS
	* and EAP-FAST. If any other EAP method is enabled, the peer will be
	* allowed to connect without TNC.
	*/
	int tnc;

	/**
	* pwd_group - EAP-pwd D-H group
	*
	* This is used to select which D-H group to use with EAP-pwd.
	*/
	u16 pwd_group;

	/**
	* server_id - Server identity
	*/
	const char *server_id;

	/**
	* erp - Whether EAP Re-authentication Protocol (ERP) is enabled
	*
	* This controls whether the authentication server derives ERP key
	* hierarchy (rRK and rIK) from full EAP authentication and allows
	* these keys to be used to perform ERP to derive rMSK instead of full
	* EAP authentication to derive MSK.
	*/
	int erp;

	const char *erp_domain;

	/**
	* wps - Wi-Fi Protected Setup context
	*
	* If WPS is used with an external RADIUS server (which is quite
	* unlikely configuration), this is used to provide a pointer to WPS
	* context data. Normally, this can be set to %NULL.
	*/
	struct wps_context *wps;

	/**
	* ipv6 - Whether to enable IPv6 support in the RADIUS server
	*/
	int ipv6;

	/**
	* get_eap_user - Callback for fetching EAP user information
	* @ctx: Context data from conf_ctx
	* @identity: User identity
	* @identity_len: identity buffer length in octets
	* @phase2: Whether this is for Phase 2 identity
	* @user: Data structure for filling in the user information
	* Returns: 0 on success, -1 on failure
	*
	* This is used to fetch information from user database. The callback
	* will fill in information about allowed EAP methods and the user
	* password. The password field will be an allocated copy of the
	* password data and RADIUS server will free it after use.
	*/
	int (get_eap_user)(void ctx, const u8 *identity, size_t identity_len,
	int phase2, struct eap_user *user);

	/**
	* eap_req_id_text - Optional data for EAP-Request/Identity
	*
	* This can be used to configure an optional, displayable message that
	* will be sent in EAP-Request/Identity. This string can contain an
	* ASCII-0 character (nul) to separate network infromation per RFC
	* 4284. The actual string length is explicit provided in
	* eap_req_id_text_len since nul character will not be used as a string
	* terminator.
	*/
	const char *eap_req_id_text;

	/**
	* eap_req_id_text_len - Length of eap_req_id_text buffer in octets
	*/
	size_t eap_req_id_text_len;

	/*
	* msg_ctx - Context data for wpa_msg() calls
	*/
	void *msg_ctx;

	#ifdef CONFIG_RADIUS_TEST
	const char *dump_msk_file;
	#endif /* CONFIG_RADIUS_TEST */

	char *subscr_remediation_url;
	u8 subscr_remediation_method;
	};


	struct radius_server_data *
	radius_server_init(struct radius_server_conf *conf);

	void radius_server_erp_flush(struct radius_server_data *data);
	void radius_server_deinit(struct radius_server_data *data);

	int radius_server_get_mib(struct radius_server_data data, char buf,
	size_t buflen);

	void radius_server_eap_pending_cb(struct radius_server_data data, void ctx);

	#endif /* RADIUS_SERVER_H */