/* 02comp_ipnet_eap.cdf - IPNet EAP configuration file */ /* * Copyright (c) 2006-2007 Wind River Systems, Inc. * * The right to copy, distribute or otherwise make use of this software * may be licensed only pursuant to the terms of an applicable Wind River * license agreement. No license to Wind River intellectual property rights * is granted herein. All rights not licensed by Wind River are reserved * by Wind River. */ /* modification history -------------------- 01i,13jul10,hfc Add secure keyDB support 01h,14may10,hfc EAP configuration consolidation 01g,04nov08,mry Adding EAP-WSC 01f,02apr08,dwb Adding EAP-AKA 01e,28feb08,mry Adding LEAP support 01d,21feb08,mry Adding PEAPv1, GTC support 01c,08jan07,kch Removed trailing spaces. 01b,12dec06,kch Added EAP_INSTALL_CALLBACK_HOOK. 01a,19oct06,kch created. */ #ifdef _WRS_CONFIG_COMPONENT_IPEAP Component INCLUDE_IPEAP { NAME EAP key management framework SYNOPSIS EAP key management framework MODULES ipeap.o CONFIGLETTES ipeap_config.c CFG_PARAMS EAP_IDENTITY \ IPEAP_LOG_LEVEL } #if defined(_WRS_CONFIG_IPEAP_USE_EAP_COMMON_TLS) || defined(_WRS_CONFIG_IPEAP_USE_EAP_SIM) || defined(_WRS_CONFIG_IPEAP_USE_EAP_AKA) Component INCLUDE_IPEAP { REQUIRES INCLUDE_IPSSL } #endif #ifdef _WRS_CONFIG_IPEAP_USE_EAP_MD5 Component INCLUDE_IPEAP { MODULES += ipeap_md5.o } #endif #ifdef _WRS_CONFIG_IPEAP_USE_EAP_TLS Component INCLUDE_IPEAP { MODULES += ipeap_tls.o ipeap_common_tls.o } #endif #ifdef _WRS_CONFIG_IPEAP_USE_EAP_TTLS Component INCLUDE_IPEAP { MODULES += ipeap_ttls.o ipeap_common_tls.o } #endif #ifdef _WRS_CONFIG_IPEAP_USE_EAP_PEAP Component INCLUDE_IPEAP { MODULES += ipeap_peap.o } #endif #ifdef _WRS_CONFIG_IPEAP_USE_EAP_GTC Component INCLUDE_IPEAP { MODULES += ipeap_gtc.o } #endif #ifdef _WRS_CONFIG_IPEAP_USE_EAP_LEAP Component INCLUDE_IPEAP { MODULES += ipeap_leap.o ipeap_mschapv2.o } #endif #ifdef _WRS_CONFIG_IPEAP_USE_EAP_MSCHAPV2 Component INCLUDE_IPEAP { MODULES += ipeap_mschapv2.o } #endif #ifdef _WRS_CONFIG_IPEAP_USE_EAP_SIM Component INCLUDE_IPEAP { MODULES += ipeap_sim.o ipeap_sim_card.o ipeap_sim_reader.o ipeap_sim_util.o } #endif #ifdef _WRS_CONFIG_IPEAP_SIM_ENABLE_TEST Component INCLUDE_IPEAP { MODULES += ipeap_sim_test.o } #endif #ifdef _WRS_CONFIG_IPEAP_USE_EAP_AKA Component INCLUDE_IPEAP { MODULES += ipeap_aka.o } #endif #ifdef _WRS_CONFIG_IPEAP_USE_EAP_WSC Component INCLUDE_IPEAP { MODULES += ipeap_wsc.o } #endif Component INCLUDE_IPEAP_PRIVACY { NAME EAP key Privacy support SYNOPSIS This will use Secure Key Database to retrieve passowrd for \ EAP-LEAP,EAP-MD5, EAP-MSCHAPV2, EAP-TTLS and private key for TLS. \ Password and private key have to be manually imported into secure key \ database if this option has been selected REQUIRES INCLUDE_IPEAP \ INCLUDE_IPCOM_USE_KEY_DB _CHILDREN FOLDER_EAP } /******************** Advance Privacy Configuration Parameter **********************/ /********* This will allowe to name the password ID or Key ID **********************/ Parameter ENABLE_ADVANCE_EAP_PRIVACY { NAME Enable Advance option for EAP Privacy SYNOPSIS If set to "1" \ Password from secureKey Database will be retrieved using the following \ Password ID \ - for EAP-LEAP, password id will be the value of EAP_LEAP_PASSWD \ - for EAP-MD5, password id will be the value of EAP_MD5_SECRET \ - for EAP-MSCHAPV2, password id will be the value of EAP_MSCHAPV2_PASSWD \ - for EAP-TTLS, password id will be the value of EAP_TTLS_PASSWD \ And private key from secureKey Database will be retrieved using \ Key ID as the value of EAP_TLS_KEY_FILE for EAP-TLS \ If set to "0" \ Password from secureKey Database will be retrieved using the following \ Password ID \ - for EAP-LEAP password id is "leapPasswordID" \ - for EAP-MD5 password id is "md5PasswordID" \ - for EAP-MSCHAPV2 password id is "mschapv2PasswordID" \ - for EAP-TTLS password id is "ttlsPasswordID" \ And Key ID to retrieve private key from secureKey Database for \ - EAP-TLS is "tlsPkeyID". TYPE char * DEFAULT "0" _CFG_PARAMS INCLUDE_IPEAP_PRIVACY } /******************** Configuration Parameters *****************************/ Parameter EAP_IDENTITY { NAME EAP Identity SYNOPSIS The identity sent in response messages. TYPE char * DEFAULT "user" } Parameter IPEAP_LOG_LEVEL { NAME EAP Syslog Level SYNOPSIS Syslog Level for the IPEAP module. \ One of: IPCOM_LOG_EMERG, IPCOM_LOG_CRIT, IPCOM_LOG_ERR, \ IPCOM_LOG_WARNING, IPCOM_LOG_NOTICE, IPCOM_LOG_INFO, \ IPCOM_LOG_DEBUG, IPCOM_LOG_DEBUG2 TYPE int DEFAULT IPCOM_LOG_INFO } /* INCLUDE_IPEAP_USE_EAP_MD5 configuration parameters */ #if defined(_WRS_CONFIG_IPEAP_USE_EAP_MD5) Parameter EAP_MD5 { NAME Method EAP MD5 Enable SYNOPSIS Controls whether EAP-MD5 is activated or not. If set to \ "1" EAPMD5 is active, if set to "0" it is de-activated. \ The EAP-MD5 configuration parameters are only meaningful \ if IPEAP_USE_EAP_MD5 is defined when ipeap is compiled. TYPE char * DEFAULT "0" _CFG_PARAMS INCLUDE_IPEAP } Parameter EAP_MD5_SECRET { NAME Method EAP MD5 secret SYNOPSIS The secret, or password, used in EAP-MD5. If INCLUDE_IPEAP_PRIVACY is selected \ this field will be ignored , the corresponding secret or password will be \ retrieved from secure Key db using Password ID 'md5PasswordID'. User has to manually \ import this password into secure key db. \ If INCLUDE_IPEAP_PRIVACY is selected, this field will not be uesd as \ md5 secret.If ENABLE_ADVANCE_EAP_PRIVACY is set to "1" \ password will be retrieved from secure key database using the value of this field as \ the password ID. If ENABLE_ADVANCE_EAP_PRIVACY is set to "0" Password ID will be \ 'md5PasswordID'. User has to manually import this password into secure key db. \ If INCLUDE_IPEAP_PRIVACY is not selected than this will be the md5 secret. TYPE char * DEFAULT "this_should_be_secret" _CFG_PARAMS INCLUDE_IPEAP } #endif /* INCLUDE_IPEAP_USE_EAP_GTC configuration parameters */ #if defined(_WRS_CONFIG_IPEAP_USE_EAP_GTC) Parameter EAP_GTC { NAME Method EAP GTC Enable SYNOPSIS Controls whether EAP-GTC is activated or not. If set to \ "1" EAP-GTC is active, if set to "0" it is de-activated. \ The EAP-GTC configuration parameters are only meaningful \ if IPEAP_USE_EAP_GTC is defined when ipeap is compiled. TYPE char * DEFAULT "0" _CFG_PARAMS INCLUDE_IPEAP } #endif /* INCLUDE_IPEAP_USE_EAP_LEAP configuration parameters */ #if defined(_WRS_CONFIG_IPEAP_USE_EAP_LEAP) Parameter EAP_LEAP { NAME Method EAP LEAP Enable SYNOPSIS Controls whether EAP-LEAP is activated or not. If set \ to "1", EAP-LEAP is active, if set to "0" it is \ de-activated. The EAP-LEAP configuration parameters are \ only meaningful if IPEAP_USE_EAP_LEAP is defined when \ ipeap is compiled. TYPE char * DEFAULT "0" _CFG_PARAMS INCLUDE_IPEAP } Parameter EAP_LEAP_USER_ID { NAME Method EAP LEAP user id SYNOPSIS The user-id used in LEAP handshakes. TYPE char * DEFAULT "user" _CFG_PARAMS INCLUDE_IPEAP } Parameter EAP_LEAP_PASSWD { NAME Method EAP LEAP password SYNOPSIS The password used in LEAP handshakes. \ NOTE: It is HIGHLY RECOMMENDED to use a strong\ password to avoid offline dictionary attacks \ on LEAP. \ Some characteristics of strong passwords : \ - A minimum of ten characters \ - A mix of uppercase and lowercase letters \ - At least one numeric character and one \ non-alphanumeric character (Example: !#@$%)\ - No form of the user's name or user ID \ - A word that is not found in the dictionary (domestic or foreign). \ If INCLUDE_IPEAP_PRIVACY is selected, this field will not be uesd as \ leap password.If ENABLE_ADVANCE_EAP_PRIVACY is set to "1" \ password will be retrieved from secure key database using this as \ the password ID. If ENABLE_ADVANCE_EAP_PRIVACY is set to "0" Password ID will be \ 'leapPasswordID'. User has to manually import this password into secure key db. \ If INCLUDE_IPEAP_PRIVACY is not selected than this will be the leap password. TYPE char * DEFAULT "u$3A$tR0nGp@$$w0Rd" _CFG_PARAMS INCLUDE_IPEAP } #endif /* INCLUDE_IPEAP_USE_EAP_MSCHAPV2 configuration parameters */ #if defined(_WRS_CONFIG_IPEAP_USE_EAP_MSCHAPV2) Parameter EAP_MSCHAPV2 { NAME Method EAP MSCHAPv2 Enable SYNOPSIS Controls whether EAP-MSCHAPv2 is activated or not. If set \ to "1", EAP-MSCHAPv2 is active, if set to "0" it is \ de-activated. The EAP-MSCHAPV2 configuration parameters are \ only meaningful if IPEAP_USE_EAP_MSCHAPV2 is defined when \ ipeap is compiled. TYPE char * DEFAULT "0" _CFG_PARAMS INCLUDE_IPEAP } Parameter EAP_MSCHAPV2_USER_ID { NAME Method EAP MSCHAPV2 user id SYNOPSIS The user-id used in MSCHAPv2 handshakes. TYPE char * DEFAULT "user" _CFG_PARAMS INCLUDE_IPEAP } Parameter EAP_MSCHAPV2_PASSWD { NAME Method EAP MSCHAPV2 password SYNOPSIS The password used in MSCHAPv2 handshakes. \ If INCLUDE_IPEAP_PRIVACY is selected, this field will not be uesd as \ mschapv2 password.If ENABLE_ADVANCE_EAP_PRIVACY is set to "1" \ password will be retrieved from secure key database using the value of this field as \ the password ID. If ENABLE_ADVANCE_EAP_PRIVACY is set to "0" Password ID will be \ 'mschapv2PasswordID'. User has to manually import this password into secure key db. \ If INCLUDE_IPEAP_PRIVACY is not selected than this will be the mschapv2 password. TYPE char * DEFAULT "Ch@ng3_Me" _CFG_PARAMS INCLUDE_IPEAP } #endif /* INCLUDE_IPEAP_USE_EAP_PEAP configuration parameters */ #if defined(_WRS_CONFIG_IPEAP_USE_EAP_PEAP) Parameter EAP_PEAP { NAME Method EAP PEAP Enable SYNOPSIS Controls whether EAP-PEAP is activated or not. If set to \ "1", EAPPEAP is active, if set to "0" it is de-activated. \ The EAP-PEAP configuration parameters are only meaningful \ if IPEAP_USE_EAP_PEAP is defined when ipeap is compiled. TYPE char * DEFAULT "0" _CFG_PARAMS INCLUDE_IPEAP } Parameter EAP_PEAP_MINVER { NAME Method EAP PEAP Minimum Supported version SYNOPSIS Specifies the lowest version of PEAP that will be accepted. \ Valid Values: 0, 1. \ Note: Make sure EAP_PEAP_MINVER <= EAP_PEAP_MAXVER TYPE char * DEFAULT "0" _CFG_PARAMS INCLUDE_IPEAP } Parameter EAP_PEAP_MAXVER { NAME Method EAP PEAP Maximum Supported version SYNOPSIS Specifies the highest version of PEAP that will be accepted. \ Valid Values: 0, 1. \ Note: Make sure EAP_PEAP_MAXVER >= EAP_PEAP_MINVER TYPE char * DEFAULT "1" _CFG_PARAMS INCLUDE_IPEAP } Parameter EAP_PEAP_V1_PRF_LABEL { NAME Method EAP PEAP PEAPv1 PRF Label SYNOPSIS Specifies which PRF label to use with PEAPv1 (doesn't affect PEAPv0). \ Must match what is used by the RADIUS server's implementation of PEAPv1.\ Valid Values: "client EAP encryption" or "client PEAP encryption". \ Note: If invalid value entered, default "client EAP encryption" will be used. TYPE char * DEFAULT "client EAP encryption" _CFG_PARAMS INCLUDE_IPEAP } #endif /* INCLUDE_IPEAP_USE_EAP_SIM configuration parameters */ #if defined(_WRS_CONFIG_IPEAP_USE_EAP_SIM) Parameter EAP_SIM { NAME Method EAP SIM Enable SYNOPSIS Controls whether EAP-SIM is activated or not. If set to \ "1" EAP-SIM is active, if set to "0" it is de-activated. \ The EAP-SIM configuration parameters are only meaningful \ if IPEAP_USE_EAP_SIM is defined when ipeap is compiled. TYPE char * DEFAULT "0" _CFG_PARAMS INCLUDE_IPEAP } #endif #if defined(_WRS_CONFIG_IPEAP_SIM_ENABLE_TEST) Parameter EAP_SIM_TEST { NAME Method EAP SIM test Enable SYNOPSIS Controls whether EAP-SIM test is activated or not. If set \ to "1" EAP-SIM test is activated, if set to "0" it is \ de-activated. TYPE CHAR * DEFAULT "0" _CFG_PARAMS INCLUDE_IPEAP } #endif /* INCLUDE_IPEAP_USE_EAP_AKA configuration parameters */ #if defined(_WRS_CONFIG_IPEAP_USE_EAP_AKA) Parameter EAP_AKA { NAME Method EAP AKA Enable SYNOPSIS Controls whether EAP-AKA is activated or not. If set to \ "1" EAP-AKA is active, if set to "0" it is de-activated. TYPE char * DEFAULT "0" _CFG_PARAMS INCLUDE_IPEAP } #endif #if defined(_WRS_CONFIG_IPEAP_AKA_ENABLE_TEST) Parameter EAP_AKA_TEST { NAME Method EAP AKA test Enable SYNOPSIS Controls whether EAP-AKA test is activated or not. If set \ to "1" EAP-AKA test is activated, if set to "0" it is \ de-activated. TYPE CHAR * DEFAULT "0" _CFG_PARAMS INCLUDE_IPEAP } #endif #if defined(_WRS_CONFIG_IPEAP_USE_EAP_WSC) Parameter EAP_WSC { NAME Method EAP WSC Enable SYNOPSIS Controls whether EAP-WSC is activated or not. If set to \ "1" EAP-WSC is active, if set to "0" it is de-activated. \ The EAP-WSC configuration parameters are only meaningful \ if IPEAP_USE_EAP_WSC is defined when ipeap is compiled. TYPE char * DEFAULT "1" _CFG_PARAMS INCLUDE_IPEAP } #endif /* INCLUDE_IPEAP_TLS_COMMON configuration parameters */ #if defined(_WRS_CONFIG_IPEAP_USE_EAP_COMMON_TLS) Parameter EAP_INSTALL_CALLBACK_HOOK { NAME TLS Install eap callback routines SYNOPSIS Determine if the user-defined EAP callback routines as \ specified by EAP_TLS_CERT_VERIFY_CALLBACK_HOOK, \ EAP_LOAD_TLS_KEY_CALLBACK_HOOK, \ EAP_LOAD_TLS_CERT_CALLBACK_HOOK and \ EAP_LOAD_CA_CERT_CALLBACK_HOOK should be installed. If \ FALSE, those callback routines are not applicable. TYPE BOOL DEFAULT FALSE _CFG_PARAMS INCLUDE_IPEAP } Parameter EAP_TLS_CERT_VERIFY_CALLBACK_HOOK { NAME TLS verification callback routine SYNOPSIS This callback routine is called once for each certificate \ in the certificate chain of the TLS peer. Additional \ certificate and policy checks can be implemented in this \ function. If not specified, the internal TLS cert \ verification example routine will be used. The \ EAP_INSTALL_CALLBACK_HOOK must also be set to TRUE in \ order to install this callback hook. TYPE FUNCPTR DEFAULT NULL _CFG_PARAMS INCLUDE_IPEAP } Parameter EAP_LOAD_TLS_KEY_CALLBACK_HOOK { NAME TLS key load callback routine SYNOPSIS This callback routine loads the key pair to use in SSL/TLS \ handshakes. It is called every time a new EAP-TLS session \ is initiated. If not specified, the internal TLS key load \ example routine will be used. The EAP_INSTALL_CALLBACK_HOOK \ must also be set to TRUE in order to install this callback \ hook. TYPE FUNCPTR DEFAULT NULL _CFG_PARAMS INCLUDE_IPEAP } Parameter EAP_LOAD_TLS_CERT_CALLBACK_HOOK { NAME TLS X509 certificate load callback routine SYNOPSIS This callback routine loads the X509 certificate to use in \ SSL/TLS handshakes. It is called every time a new EAP-TLS \ session is initiated. If not specified, the internal X509 \ certificate load example routine will be used. TYPE FUNCPTR DEFAULT NULL _CFG_PARAMS INCLUDE_IPEAP } Parameter EAP_LOAD_CA_CERT_CALLBACK_HOOK { NAME TLS X509 CA certificates callback routine SYNOPSIS This callback routine loads the X509 CA certificates to use \ in SSL/TLS handshakes. It is called every time a new EAP-TLS \ session is initiated. If not specified, the internal X509 \ CA certificates example routine will be used. TYPE FUNCPTR DEFAULT NULL _CFG_PARAMS INCLUDE_IPEAP } Parameter EAP_TLS_KEY_FILE { NAME TLS key file SYNOPSIS The path to the file containing the key pair to use in \ SSL/TLS connections. Used by the example implementation of \ ipeap_load_tls_key(). If INCLUDE_IPEAP_PRIVACY is selected \ this field will be ignored as the location of private key ,\ instead the corresponding private key will be \ retrieved from secure Key db using Key ID 'tlsPkeyID' if ENABLE_ADVANCE_EAP_PRIVACY \ is set to "0".if ENABLE_ADVANCE_EAP_PRIVACY is set to "1" the value of this field will be \ the Key ID for private key retrieval from secure key database .\ User has to manually import this private key into secure key db. TYPE char * DEFAULT "default" _CFG_PARAMS INCLUDE_IPEAP } Parameter EAP_TLS_CERT_FILE { NAME TLS certificate file SYNOPSIS The path to the file containing the X509 certificate to \ use in SSL/TLS connections. Used by the example \ implementation of ipeap_load_tls_cert (). TYPE char * DEFAULT "default" _CFG_PARAMS INCLUDE_IPEAP } Parameter EAP_TLS_CA_CERT_FILE { NAME TLS CA certifcate file SYNOPSIS The path to the file containing the X509 certificate of \ trusted CAs. SSL/TLS connections. Used by the example \ implementation of ipeap_load_ca_certs(). TYPE char * DEFAULT "default" _CFG_PARAMS INCLUDE_IPEAP } #endif #if defined(_WRS_CONFIG_IPEAP_USE_EAP_TLS) /* INCLUDE_IPEAP_USE_EAP_TLS configuratio parameters */ Parameter EAP_TLS { NAME Method EAP TLS Enable SYNOPSIS Controls whether EAP-TLS is activated or not If set to "1" \ EAP-TLS is active, if set to "0" it is de-activated. The \ EAP-TLS configuration parameters are only meaningful if \ IPEAP_USE_EAP_TLS is defined when ipeap is compiled. TYPE char * DEFAULT "0" _CFG_PARAMS INCLUDE_IPEAP } #endif /* INCLUDE_IPEAP_USE_EAP_TTLS configuration parameters */ #if defined(_WRS_CONFIG_IPEAP_USE_EAP_TTLS) Parameter EAP_TTLS { NAME Method EAP TTLS Enable SYNOPSIS Controls whether EAP-TTLS is activated or not. If set to \ "1" EAP-TTLS is active, if set to "0" it is de-activated. \ The EAP-TTLS configuration parameters are only meaningful \ if IPEAP_USE_EAP_TTLS is defined when ipeap is compiled. TYPE char * DEFAULT "0" _CFG_PARAMS INCLUDE_IPEAP } Parameter EAP_TTLS_PHASE2 { NAME Method EAP TTLS Phase 2 auth type SYNOPSIS Controls what authentication mechanism that shall be used \ during phase 2 of an EAP-TTLS handshake. Valid values are \ "pap" for password authentication, "mschapv2" for \ Microsoft CHAPv2, or "eap" for EAP authentication. TYPE char * DEFAULT "mschapv2" _CFG_PARAMS INCLUDE_IPEAP } Parameter EAP_TTLS_USER_ID { NAME Method EAP TTLS user id SYNOPSIS The user id that shall be used during phase 2 of an \ EAP-TTLS handshake. TYPE char * DEFAULT "user" _CFG_PARAMS INCLUDE_IPEAP } Parameter EAP_TTLS_PASSWD { NAME Method EAP TTLS password SYNOPSIS The password that shall be used during phase 2 of an \ EAP-TTLS handshake.If INCLUDE_IPEAP_PRIVACY is selected, this field will not be uesd as \ ttls password.If ENABLE_ADVANCE_EAP_PRIVACY is set to "1" \ password will be retrieved from secure key database using this as \ the password ID. If ENABLE_ADVANCE_EAP_PRIVACY is set to "0" Password ID will be \ 'ttlsPasswordID'. User has to manually import this password into secure key db. \ If INCLUDE_IPEAP_PRIVACY is not selected than this will be the ttls password. TYPE char * DEFAULT "Ch@ng3_Me" _CFG_PARAMS INCLUDE_IPEAP } #endif #endif /* _WRS_CONFIG_COMPONENT_IPEAP */