1 /* 2 * EAP peer configuration data 3 * Copyright (c) 2003-2013, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #ifndef EAP_CONFIG_H 10 #define EAP_CONFIG_H 11 12 /** 13 * struct eap_peer_config - EAP peer configuration/credentials 14 */ 15 struct eap_peer_config { 16 /** 17 * identity - EAP Identity 18 * 19 * This field is used to set the real user identity or NAI (for 20 * EAP-PSK/PAX/SAKE/GPSK). 21 */ 22 u8 *identity; 23 24 /** 25 * identity_len - EAP Identity length 26 */ 27 size_t identity_len; 28 29 /** 30 * anonymous_identity - Anonymous EAP Identity 31 * 32 * This field is used for unencrypted use with EAP types that support 33 * different tunnelled identity, e.g., EAP-TTLS, in order to reveal the 34 * real identity (identity field) only to the authentication server. 35 * 36 * If not set, the identity field will be used for both unencrypted and 37 * protected fields. 38 * 39 * This field can also be used with EAP-SIM/AKA/AKA' to store the 40 * pseudonym identity. 41 */ 42 u8 *anonymous_identity; 43 44 /** 45 * anonymous_identity_len - Length of anonymous_identity 46 */ 47 size_t anonymous_identity_len; 48 49 /** 50 * password - Password string for EAP 51 * 52 * This field can include either the plaintext password (default 53 * option) or a NtPasswordHash (16-byte MD4 hash of the unicode 54 * presentation of the password) if flags field has 55 * EAP_CONFIG_FLAGS_PASSWORD_NTHASH bit set to 1. NtPasswordHash can 56 * only be used with authentication mechanism that use this hash as the 57 * starting point for operation: MSCHAP and MSCHAPv2 (EAP-MSCHAPv2, 58 * EAP-TTLS/MSCHAPv2, EAP-TTLS/MSCHAP, LEAP). 59 * 60 * In addition, this field is used to configure a pre-shared key for 61 * EAP-PSK/PAX/SAKE/GPSK. The length of the PSK must be 16 for EAP-PSK 62 * and EAP-PAX and 32 for EAP-SAKE. EAP-GPSK can use a variable length 63 * PSK. 64 */ 65 u8 *password; 66 67 /** 68 * password_len - Length of password field 69 */ 70 size_t password_len; 71 72 /** 73 * ca_cert - File path to CA certificate file (PEM/DER) 74 * 75 * This file can have one or more trusted CA certificates. If ca_cert 76 * and ca_path are not included, server certificate will not be 77 * verified. This is insecure and a trusted CA certificate should 78 * always be configured when using EAP-TLS/TTLS/PEAP. Full path to the 79 * file should be used since working directory may change when 80 * wpa_supplicant is run in the background. 81 * 82 * Alternatively, a named configuration blob can be used by setting 83 * this to blob://blob_name. 84 * 85 * Alternatively, this can be used to only perform matching of the 86 * server certificate (SHA-256 hash of the DER encoded X.509 87 * certificate). In this case, the possible CA certificates in the 88 * server certificate chain are ignored and only the server certificate 89 * is verified. This is configured with the following format: 90 * hash:://server/sha256/cert_hash_in_hex 91 * For example: "hash://server/sha256/ 92 * 5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca6a" 93 * 94 * On Windows, trusted CA certificates can be loaded from the system 95 * certificate store by setting this to cert_store://name, e.g., 96 * ca_cert="cert_store://CA" or ca_cert="cert_store://ROOT". 97 * Note that when running wpa_supplicant as an application, the user 98 * certificate store (My user account) is used, whereas computer store 99 * (Computer account) is used when running wpasvc as a service. 100 */ 101 u8 *ca_cert; 102 103 /** 104 * ca_path - Directory path for CA certificate files (PEM) 105 * 106 * This path may contain multiple CA certificates in OpenSSL format. 107 * Common use for this is to point to system trusted CA list which is 108 * often installed into directory like /etc/ssl/certs. If configured, 109 * these certificates are added to the list of trusted CAs. ca_cert 110 * may also be included in that case, but it is not required. 111 */ 112 u8 *ca_path; 113 114 /** 115 * client_cert - File path to client certificate file (PEM/DER) 116 * 117 * This field is used with EAP method that use TLS authentication. 118 * Usually, this is only configured for EAP-TLS, even though this could 119 * in theory be used with EAP-TTLS and EAP-PEAP, too. Full path to the 120 * file should be used since working directory may change when 121 * wpa_supplicant is run in the background. 122 * 123 * Alternatively, a named configuration blob can be used by setting 124 * this to blob://blob_name. 125 */ 126 u8 *client_cert; 127 128 /** 129 * private_key - File path to client private key file (PEM/DER/PFX) 130 * 131 * When PKCS#12/PFX file (.p12/.pfx) is used, client_cert should be 132 * commented out. Both the private key and certificate will be read 133 * from the PKCS#12 file in this case. Full path to the file should be 134 * used since working directory may change when wpa_supplicant is run 135 * in the background. 136 * 137 * Windows certificate store can be used by leaving client_cert out and 138 * configuring private_key in one of the following formats: 139 * 140 * cert://substring_to_match 141 * 142 * hash://certificate_thumbprint_in_hex 143 * 144 * For example: private_key="hash://63093aa9c47f56ae88334c7b65a4" 145 * 146 * Note that when running wpa_supplicant as an application, the user 147 * certificate store (My user account) is used, whereas computer store 148 * (Computer account) is used when running wpasvc as a service. 149 * 150 * Alternatively, a named configuration blob can be used by setting 151 * this to blob://blob_name. 152 */ 153 u8 *private_key; 154 155 /** 156 * private_key_passwd - Password for private key file 157 * 158 * If left out, this will be asked through control interface. 159 */ 160 const u8 *private_key_passwd; 161 162 /** 163 * Phase 2 164 */ 165 u8 *ca_cert2; 166 167 /** 168 * ca_path2 - Directory path for CA certificate files (PEM) (Phase 2) 169 * 170 * This path may contain multiple CA certificates in OpenSSL format. 171 * Common use for this is to point to system trusted CA list which is 172 * often installed into directory like /etc/ssl/certs. If configured, 173 * these certificates are added to the list of trusted CAs. ca_cert 174 * may also be included in that case, but it is not required. 175 * 176 * This field is like ca_path, but used for phase 2 (inside 177 * EAP-TTLS/PEAP/FAST tunnel) authentication. 178 */ 179 u8 *ca_path2; 180 181 /** 182 * client_cert2 - File path to client certificate file 183 * 184 * This field is like client_cert, but used for phase 2 (inside 185 * EAP-TTLS/PEAP/FAST tunnel) authentication. Full path to the 186 * file should be used since working directory may change when 187 * wpa_supplicant is run in the background. 188 * 189 * Alternatively, a named configuration blob can be used by setting 190 * this to blob://blob_name. 191 */ 192 u8 *client_cert2; 193 194 /** 195 * private_key2 - File path to client private key file 196 * 197 * This field is like private_key, but used for phase 2 (inside 198 * EAP-TTLS/PEAP/FAST tunnel) authentication. Full path to the 199 * file should be used since working directory may change when 200 * wpa_supplicant is run in the background. 201 * 202 * Alternatively, a named configuration blob can be used by setting 203 * this to blob://blob_name. 204 */ 205 u8 *private_key2; 206 207 u8 *private_key2_password; 208 209 /** 210 * eap_methods - Allowed EAP methods 211 * 212 * (vendor=EAP_VENDOR_IETF,method=EAP_TYPE_NONE) terminated list of 213 * allowed EAP methods or %NULL if all methods are accepted. 214 */ 215 struct eap_method_type *eap_methods; 216 217 218 char *phase1; 219 220 /** 221 * phase2 - Phase2 (inner authentication with TLS tunnel) parameters 222 * 223 * String with field-value pairs, e.g., "auth=MSCHAPV2" for EAP-PEAP or 224 * "autheap=MSCHAPV2 autheap=MD5" for EAP-TTLS. "mschapv2_retry=0" can 225 * be used to disable MSCHAPv2 password retry in authentication failure 226 * cases. 227 */ 228 char *phase2; 229 230 /** 231 * pcsc - Parameters for PC/SC smartcard interface for USIM and GSM SIM 232 * 233 * This field is used to configure PC/SC smartcard interface. 234 * Currently, the only configuration is whether this field is %NULL (do 235 * not use PC/SC) or non-NULL (e.g., "") to enable PC/SC. 236 * 237 * This field is used for EAP-SIM and EAP-AKA. 238 */ 239 char *pcsc; 240 241 /** 242 * pin - PIN for USIM, GSM SIM, and smartcards 243 * 244 * This field is used to configure PIN for SIM and smartcards for 245 * EAP-SIM and EAP-AKA. In addition, this is used with EAP-TLS if a 246 * smartcard is used for private key operations. 247 * 248 * If left out, this will be asked through control interface. 249 */ 250 char *pin; 251 252 /** 253 * pending_req_identity - Whether there is a pending identity request 254 * 255 * This field should not be set in configuration step. It is only used 256 * internally when control interface is used to request needed 257 * information. 258 */ 259 int pending_req_identity; 260 261 /** 262 * pending_req_password - Whether there is a pending password request 263 * 264 * This field should not be set in configuration step. It is only used 265 * internally when control interface is used to request needed 266 * information. 267 */ 268 int pending_req_password; 269 270 /** 271 * pending_req_pin - Whether there is a pending PIN request 272 * 273 * This field should not be set in configuration step. It is only used 274 * internally when control interface is used to request needed 275 * information. 276 */ 277 int pending_req_pin; 278 279 /** 280 * pending_req_new_password - Pending password update request 281 * 282 * This field should not be set in configuration step. It is only used 283 * internally when control interface is used to request needed 284 * information. 285 */ 286 int pending_req_new_password; 287 288 /** 289 * pending_req_passphrase - Pending passphrase request 290 * 291 * This field should not be set in configuration step. It is only used 292 * internally when control interface is used to request needed 293 * information. 294 */ 295 int pending_req_passphrase; 296 297 /** 298 * pending_req_sim - Pending SIM request 299 * 300 * This field should not be set in configuration step. It is only used 301 * internally when control interface is used to request needed 302 * information. 303 */ 304 int pending_req_sim; 305 306 /** 307 * pending_req_otp - Whether there is a pending OTP request 308 * 309 * This field should not be set in configuration step. It is only used 310 * internally when control interface is used to request needed 311 * information. 312 */ 313 char *pending_req_otp; 314 315 /** 316 * pac_file - File path or blob name for the PAC entries (EAP-FAST) 317 * 318 * wpa_supplicant will need to be able to create this file and write 319 * updates to it when PAC is being provisioned or refreshed. Full path 320 * to the file should be used since working directory may change when 321 * wpa_supplicant is run in the background. 322 * Alternatively, a named configuration blob can be used by setting 323 * this to blob://blob_name. 324 */ 325 char *pac_file; 326 327 /** 328 * mschapv2_retry - MSCHAPv2 retry in progress 329 * 330 * This field is used internally by EAP-MSCHAPv2 and should not be set 331 * as part of configuration. 332 */ 333 int mschapv2_retry; 334 335 /** 336 * new_password - New password for password update 337 * 338 * This field is used during MSCHAPv2 password update. This is normally 339 * requested from the user through the control interface and not set 340 * from configuration. 341 */ 342 u8 *new_password; 343 344 /** 345 * new_password_len - Length of new_password field 346 */ 347 size_t new_password_len; 348 349 /** 350 * fragment_size - Maximum EAP fragment size in bytes (default 1398) 351 * 352 * This value limits the fragment size for EAP methods that support 353 * fragmentation (e.g., EAP-TLS and EAP-PEAP). This value should be set 354 * small enough to make the EAP messages fit in MTU of the network 355 * interface used for EAPOL. The default value is suitable for most 356 * cases. 357 */ 358 int fragment_size; 359 360 #define EAP_CONFIG_FLAGS_PASSWORD_NTHASH BIT(0) 361 #define EAP_CONFIG_FLAGS_EXT_PASSWORD BIT(1) 362 /** 363 * flags - Network configuration flags (bitfield) 364 * 365 * This variable is used for internal flags to describe further details 366 * for the network parameters. 367 * bit 0 = password is represented as a 16-byte NtPasswordHash value 368 * instead of plaintext password 369 * bit 1 = password is stored in external storage; the value in the 370 * password field is the name of that external entry 371 */ 372 u32 flags; 373 374 /** 375 * ocsp - Whether to use/require OCSP to check server certificate 376 * 377 * 0 = do not use OCSP stapling (TLS certificate status extension) 378 * 1 = try to use OCSP stapling, but not require response 379 * 2 = require valid OCSP stapling response 380 */ 381 int ocsp; 382 383 /** 384 * erp - Whether EAP Re-authentication Protocol (ERP) is enabled 385 */ 386 int erp; 387 388 /** 389 * pending_ext_cert_check - External server certificate check status 390 * 391 * This field should not be set in configuration step. It is only used 392 * internally when control interface is used to request external 393 * validation of server certificate chain. 394 */ 395 enum { 396 NO_CHECK = 0, 397 PENDING_CHECK, 398 EXT_CERT_CHECK_GOOD, 399 EXT_CERT_CHECK_BAD, 400 } pending_ext_cert_check; 401 402 }; 403 404 405 /** 406 * struct wpa_config_blob - Named configuration blob 407 * 408 * This data structure is used to provide storage for binary objects to store 409 * abstract information like certificates and private keys inlined with the 410 * configuration data. 411 */ 412 struct wpa_config_blob { 413 /** 414 * name - Blob name 415 */ 416 char *name; 417 418 /** 419 * data - Pointer to binary data 420 */ 421 const u8 *data; 422 423 /** 424 * len - Length of binary data 425 */ 426 size_t len; 427 428 /** 429 * next - Pointer to next blob in the configuration 430 */ 431 struct wpa_config_blob *next; 432 }; 433 434 #endif /* EAP_CONFIG_H */ 435
