xref: /freebsd/contrib/wpa/src/eap_peer/eap_config.h (revision 87c1627502a5dde91e5284118eec8682b60f27a2)
1 /*
2  * EAP peer configuration data
3  * Copyright (c) 2003-2008, Jouni Malinen <j@w1.fi>
4  *
5  * This program is free software; you can redistribute it and/or modify
6  * it under the terms of the GNU General Public License version 2 as
7  * published by the Free Software Foundation.
8  *
9  * Alternatively, this software may be distributed under the terms of BSD
10  * license.
11  *
12  * See README and COPYING for more details.
13  */
14 
15 #ifndef EAP_CONFIG_H
16 #define EAP_CONFIG_H
17 
18 /**
19  * struct eap_peer_config - EAP peer configuration/credentials
20  */
21 struct eap_peer_config {
22 	/**
23 	 * identity - EAP Identity
24 	 *
25 	 * This field is used to set the real user identity or NAI (for
26 	 * EAP-PSK/PAX/SAKE/GPSK).
27 	 */
28 	u8 *identity;
29 
30 	/**
31 	 * identity_len - EAP Identity length
32 	 */
33 	size_t identity_len;
34 
35 	/**
36 	 * anonymous_identity -  Anonymous EAP Identity
37 	 *
38 	 * This field is used for unencrypted use with EAP types that support
39 	 * different tunnelled identity, e.g., EAP-TTLS, in order to reveal the
40 	 * real identity (identity field) only to the authentication server.
41 	 *
42 	 * If not set, the identity field will be used for both unencrypted and
43 	 * protected fields.
44 	 */
45 	u8 *anonymous_identity;
46 
47 	/**
48 	 * anonymous_identity_len - Length of anonymous_identity
49 	 */
50 	size_t anonymous_identity_len;
51 
52 	/**
53 	 * password - Password string for EAP
54 	 *
55 	 * This field can include either the plaintext password (default
56 	 * option) or a NtPasswordHash (16-byte MD4 hash of the unicode
57 	 * presentation of the password) if flags field has
58 	 * EAP_CONFIG_FLAGS_PASSWORD_NTHASH bit set to 1. NtPasswordHash can
59 	 * only be used with authentication mechanism that use this hash as the
60 	 * starting point for operation: MSCHAP and MSCHAPv2 (EAP-MSCHAPv2,
61 	 * EAP-TTLS/MSCHAPv2, EAP-TTLS/MSCHAP, LEAP).
62 	 *
63 	 * In addition, this field is used to configure a pre-shared key for
64 	 * EAP-PSK/PAX/SAKE/GPSK. The length of the PSK must be 16 for EAP-PSK
65 	 * and EAP-PAX and 32 for EAP-SAKE. EAP-GPSK can use a variable length
66 	 * PSK.
67 	 */
68 	u8 *password;
69 
70 	/**
71 	 * password_len - Length of password field
72 	 */
73 	size_t password_len;
74 
75 	/**
76 	 * ca_cert - File path to CA certificate file (PEM/DER)
77 	 *
78 	 * This file can have one or more trusted CA certificates. If ca_cert
79 	 * and ca_path are not included, server certificate will not be
80 	 * verified. This is insecure and a trusted CA certificate should
81 	 * always be configured when using EAP-TLS/TTLS/PEAP. Full path to the
82 	 * file should be used since working directory may change when
83 	 * wpa_supplicant is run in the background.
84 	 *
85 	 * Alternatively, a named configuration blob can be used by setting
86 	 * this to blob://blob_name.
87 	 *
88 	 * Alternatively, this can be used to only perform matching of the
89 	 * server certificate (SHA-256 hash of the DER encoded X.509
90 	 * certificate). In this case, the possible CA certificates in the
91 	 * server certificate chain are ignored and only the server certificate
92 	 * is verified. This is configured with the following format:
93 	 * hash:://server/sha256/cert_hash_in_hex
94 	 * For example: "hash://server/sha256/
95 	 * 5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca6a"
96 	 *
97 	 * On Windows, trusted CA certificates can be loaded from the system
98 	 * certificate store by setting this to cert_store://name, e.g.,
99 	 * ca_cert="cert_store://CA" or ca_cert="cert_store://ROOT".
100 	 * Note that when running wpa_supplicant as an application, the user
101 	 * certificate store (My user account) is used, whereas computer store
102 	 * (Computer account) is used when running wpasvc as a service.
103 	 */
104 	u8 *ca_cert;
105 
106 	/**
107 	 * ca_path - Directory path for CA certificate files (PEM)
108 	 *
109 	 * This path may contain multiple CA certificates in OpenSSL format.
110 	 * Common use for this is to point to system trusted CA list which is
111 	 * often installed into directory like /etc/ssl/certs. If configured,
112 	 * these certificates are added to the list of trusted CAs. ca_cert
113 	 * may also be included in that case, but it is not required.
114 	 */
115 	u8 *ca_path;
116 
117 	/**
118 	 * client_cert - File path to client certificate file (PEM/DER)
119 	 *
120 	 * This field is used with EAP method that use TLS authentication.
121 	 * Usually, this is only configured for EAP-TLS, even though this could
122 	 * in theory be used with EAP-TTLS and EAP-PEAP, too. Full path to the
123 	 * file should be used since working directory may change when
124 	 * wpa_supplicant is run in the background.
125 	 *
126 	 * Alternatively, a named configuration blob can be used by setting
127 	 * this to blob://blob_name.
128 	 */
129 	u8 *client_cert;
130 
131 	/**
132 	 * private_key - File path to client private key file (PEM/DER/PFX)
133 	 *
134 	 * When PKCS#12/PFX file (.p12/.pfx) is used, client_cert should be
135 	 * commented out. Both the private key and certificate will be read
136 	 * from the PKCS#12 file in this case. Full path to the file should be
137 	 * used since working directory may change when wpa_supplicant is run
138 	 * in the background.
139 	 *
140 	 * Windows certificate store can be used by leaving client_cert out and
141 	 * configuring private_key in one of the following formats:
142 	 *
143 	 * cert://substring_to_match
144 	 *
145 	 * hash://certificate_thumbprint_in_hex
146 	 *
147 	 * For example: private_key="hash://63093aa9c47f56ae88334c7b65a4"
148 	 *
149 	 * Note that when running wpa_supplicant as an application, the user
150 	 * certificate store (My user account) is used, whereas computer store
151 	 * (Computer account) is used when running wpasvc as a service.
152 	 *
153 	 * Alternatively, a named configuration blob can be used by setting
154 	 * this to blob://blob_name.
155 	 */
156 	u8 *private_key;
157 
158 	/**
159 	 * private_key_passwd - Password for private key file
160 	 *
161 	 * If left out, this will be asked through control interface.
162 	 */
163 	u8 *private_key_passwd;
164 
165 	/**
166 	 * dh_file - File path to DH/DSA parameters file (in PEM format)
167 	 *
168 	 * This is an optional configuration file for setting parameters for an
169 	 * ephemeral DH key exchange. In most cases, the default RSA
170 	 * authentication does not use this configuration. However, it is
171 	 * possible setup RSA to use ephemeral DH key exchange. In addition,
172 	 * ciphers with DSA keys always use ephemeral DH keys. This can be used
173 	 * to achieve forward secrecy. If the file is in DSA parameters format,
174 	 * it will be automatically converted into DH params. Full path to the
175 	 * file should be used since working directory may change when
176 	 * wpa_supplicant is run in the background.
177 	 *
178 	 * Alternatively, a named configuration blob can be used by setting
179 	 * this to blob://blob_name.
180 	 */
181 	u8 *dh_file;
182 
183 	/**
184 	 * subject_match - Constraint for server certificate subject
185 	 *
186 	 * This substring is matched against the subject of the authentication
187 	 * server certificate. If this string is set, the server sertificate is
188 	 * only accepted if it contains this string in the subject. The subject
189 	 * string is in following format:
190 	 *
191 	 * /C=US/ST=CA/L=San Francisco/CN=Test AS/emailAddress=as@n.example.com
192 	 */
193 	u8 *subject_match;
194 
195 	/**
196 	 * altsubject_match - Constraint for server certificate alt. subject
197 	 *
198 	 * Semicolon separated string of entries to be matched against the
199 	 * alternative subject name of the authentication server certificate.
200 	 * If this string is set, the server sertificate is only accepted if it
201 	 * contains one of the entries in an alternative subject name
202 	 * extension.
203 	 *
204 	 * altSubjectName string is in following format: TYPE:VALUE
205 	 *
206 	 * Example: EMAIL:server@example.com
207 	 * Example: DNS:server.example.com;DNS:server2.example.com
208 	 *
209 	 * Following types are supported: EMAIL, DNS, URI
210 	 */
211 	u8 *altsubject_match;
212 
213 	/**
214 	 * ca_cert2 - File path to CA certificate file (PEM/DER) (Phase 2)
215 	 *
216 	 * This file can have one or more trusted CA certificates. If ca_cert2
217 	 * and ca_path2 are not included, server certificate will not be
218 	 * verified. This is insecure and a trusted CA certificate should
219 	 * always be configured. Full path to the file should be used since
220 	 * working directory may change when wpa_supplicant is run in the
221 	 * background.
222 	 *
223 	 * This field is like ca_cert, but used for phase 2 (inside
224 	 * EAP-TTLS/PEAP/FAST tunnel) authentication.
225 	 *
226 	 * Alternatively, a named configuration blob can be used by setting
227 	 * this to blob://blob_name.
228 	 */
229 	u8 *ca_cert2;
230 
231 	/**
232 	 * ca_path2 - Directory path for CA certificate files (PEM) (Phase 2)
233 	 *
234 	 * This path may contain multiple CA certificates in OpenSSL format.
235 	 * Common use for this is to point to system trusted CA list which is
236 	 * often installed into directory like /etc/ssl/certs. If configured,
237 	 * these certificates are added to the list of trusted CAs. ca_cert
238 	 * may also be included in that case, but it is not required.
239 	 *
240 	 * This field is like ca_path, but used for phase 2 (inside
241 	 * EAP-TTLS/PEAP/FAST tunnel) authentication.
242 	 */
243 	u8 *ca_path2;
244 
245 	/**
246 	 * client_cert2 - File path to client certificate file
247 	 *
248 	 * This field is like client_cert, but used for phase 2 (inside
249 	 * EAP-TTLS/PEAP/FAST tunnel) authentication. Full path to the
250 	 * file should be used since working directory may change when
251 	 * wpa_supplicant is run in the background.
252 	 *
253 	 * Alternatively, a named configuration blob can be used by setting
254 	 * this to blob://blob_name.
255 	 */
256 	u8 *client_cert2;
257 
258 	/**
259 	 * private_key2 - File path to client private key file
260 	 *
261 	 * This field is like private_key, but used for phase 2 (inside
262 	 * EAP-TTLS/PEAP/FAST tunnel) authentication. Full path to the
263 	 * file should be used since working directory may change when
264 	 * wpa_supplicant is run in the background.
265 	 *
266 	 * Alternatively, a named configuration blob can be used by setting
267 	 * this to blob://blob_name.
268 	 */
269 	u8 *private_key2;
270 
271 	/**
272 	 * private_key2_passwd -  Password for private key file
273 	 *
274 	 * This field is like private_key_passwd, but used for phase 2 (inside
275 	 * EAP-TTLS/PEAP/FAST tunnel) authentication.
276 	 */
277 	u8 *private_key2_passwd;
278 
279 	/**
280 	 * dh_file2 - File path to DH/DSA parameters file (in PEM format)
281 	 *
282 	 * This field is like dh_file, but used for phase 2 (inside
283 	 * EAP-TTLS/PEAP/FAST tunnel) authentication. Full path to the
284 	 * file should be used since working directory may change when
285 	 * wpa_supplicant is run in the background.
286 	 *
287 	 * Alternatively, a named configuration blob can be used by setting
288 	 * this to blob://blob_name.
289 	 */
290 	u8 *dh_file2;
291 
292 	/**
293 	 * subject_match2 - Constraint for server certificate subject
294 	 *
295 	 * This field is like subject_match, but used for phase 2 (inside
296 	 * EAP-TTLS/PEAP/FAST tunnel) authentication.
297 	 */
298 	u8 *subject_match2;
299 
300 	/**
301 	 * altsubject_match2 - Constraint for server certificate alt. subject
302 	 *
303 	 * This field is like altsubject_match, but used for phase 2 (inside
304 	 * EAP-TTLS/PEAP/FAST tunnel) authentication.
305 	 */
306 	u8 *altsubject_match2;
307 
308 	/**
309 	 * eap_methods - Allowed EAP methods
310 	 *
311 	 * (vendor=EAP_VENDOR_IETF,method=EAP_TYPE_NONE) terminated list of
312 	 * allowed EAP methods or %NULL if all methods are accepted.
313 	 */
314 	struct eap_method_type *eap_methods;
315 
316 	/**
317 	 * phase1 - Phase 1 (outer authentication) parameters
318 	 *
319 	 * String with field-value pairs, e.g., "peapver=0" or
320 	 * "peapver=1 peaplabel=1".
321 	 *
322 	 * 'peapver' can be used to force which PEAP version (0 or 1) is used.
323 	 *
324 	 * 'peaplabel=1' can be used to force new label, "client PEAP
325 	 * encryption",	to be used during key derivation when PEAPv1 or newer.
326 	 *
327 	 * Most existing PEAPv1 implementation seem to be using the old label,
328 	 * "client EAP encryption", and wpa_supplicant is now using that as the
329 	 * default value.
330 	 *
331 	 * Some servers, e.g., Radiator, may require peaplabel=1 configuration
332 	 * to interoperate with PEAPv1; see eap_testing.txt for more details.
333 	 *
334 	 * 'peap_outer_success=0' can be used to terminate PEAP authentication
335 	 * on tunneled EAP-Success. This is required with some RADIUS servers
336 	 * that implement draft-josefsson-pppext-eap-tls-eap-05.txt (e.g.,
337 	 * Lucent NavisRadius v4.4.0 with PEAP in "IETF Draft 5" mode).
338 	 *
339 	 * include_tls_length=1 can be used to force wpa_supplicant to include
340 	 * TLS Message Length field in all TLS messages even if they are not
341 	 * fragmented.
342 	 *
343 	 * sim_min_num_chal=3 can be used to configure EAP-SIM to require three
344 	 * challenges (by default, it accepts 2 or 3).
345 	 *
346 	 * result_ind=1 can be used to enable EAP-SIM and EAP-AKA to use
347 	 * protected result indication.
348 	 *
349 	 * fast_provisioning option can be used to enable in-line provisioning
350 	 * of EAP-FAST credentials (PAC):
351 	 * 0 = disabled,
352 	 * 1 = allow unauthenticated provisioning,
353 	 * 2 = allow authenticated provisioning,
354 	 * 3 = allow both unauthenticated and authenticated provisioning
355 	 *
356 	 * fast_max_pac_list_len=num option can be used to set the maximum
357 	 * number of PAC entries to store in a PAC list (default: 10).
358 	 *
359 	 * fast_pac_format=binary option can be used to select binary format
360 	 * for storing PAC entries in order to save some space (the default
361 	 * text format uses about 2.5 times the size of minimal binary format).
362 	 *
363 	 * crypto_binding option can be used to control PEAPv0 cryptobinding
364 	 * behavior:
365 	 * 0 = do not use cryptobinding (default)
366 	 * 1 = use cryptobinding if server supports it
367 	 * 2 = require cryptobinding
368 	 *
369 	 * EAP-WSC (WPS) uses following options: pin=Device_Password and
370 	 * uuid=Device_UUID
371 	 */
372 	char *phase1;
373 
374 	/**
375 	 * phase2 - Phase2 (inner authentication with TLS tunnel) parameters
376 	 *
377 	 * String with field-value pairs, e.g., "auth=MSCHAPV2" for EAP-PEAP or
378 	 * "autheap=MSCHAPV2 autheap=MD5" for EAP-TTLS.
379 	 */
380 	char *phase2;
381 
382 	/**
383 	 * pcsc - Parameters for PC/SC smartcard interface for USIM and GSM SIM
384 	 *
385 	 * This field is used to configure PC/SC smartcard interface.
386 	 * Currently, the only configuration is whether this field is %NULL (do
387 	 * not use PC/SC) or non-NULL (e.g., "") to enable PC/SC.
388 	 *
389 	 * This field is used for EAP-SIM and EAP-AKA.
390 	 */
391 	char *pcsc;
392 
393 	/**
394 	 * pin - PIN for USIM, GSM SIM, and smartcards
395 	 *
396 	 * This field is used to configure PIN for SIM and smartcards for
397 	 * EAP-SIM and EAP-AKA. In addition, this is used with EAP-TLS if a
398 	 * smartcard is used for private key operations.
399 	 *
400 	 * If left out, this will be asked through control interface.
401 	 */
402 	char *pin;
403 
404 	/**
405 	 * engine - Enable OpenSSL engine (e.g., for smartcard access)
406 	 *
407 	 * This is used if private key operations for EAP-TLS are performed
408 	 * using a smartcard.
409 	 */
410 	int engine;
411 
412 	/**
413 	 * engine_id - Engine ID for OpenSSL engine
414 	 *
415 	 * "opensc" to select OpenSC engine or "pkcs11" to select PKCS#11
416 	 * engine.
417 	 *
418 	 * This is used if private key operations for EAP-TLS are performed
419 	 * using a smartcard.
420 	 */
421 	char *engine_id;
422 
423 	/**
424 	 * engine2 - Enable OpenSSL engine (e.g., for smartcard) (Phase 2)
425 	 *
426 	 * This is used if private key operations for EAP-TLS are performed
427 	 * using a smartcard.
428 	 *
429 	 * This field is like engine, but used for phase 2 (inside
430 	 * EAP-TTLS/PEAP/FAST tunnel) authentication.
431 	 */
432 	int engine2;
433 
434 
435 	/**
436 	 * pin2 - PIN for USIM, GSM SIM, and smartcards (Phase 2)
437 	 *
438 	 * This field is used to configure PIN for SIM and smartcards for
439 	 * EAP-SIM and EAP-AKA. In addition, this is used with EAP-TLS if a
440 	 * smartcard is used for private key operations.
441 	 *
442 	 * This field is like pin2, but used for phase 2 (inside
443 	 * EAP-TTLS/PEAP/FAST tunnel) authentication.
444 	 *
445 	 * If left out, this will be asked through control interface.
446 	 */
447 	char *pin2;
448 
449 	/**
450 	 * engine2_id - Engine ID for OpenSSL engine (Phase 2)
451 	 *
452 	 * "opensc" to select OpenSC engine or "pkcs11" to select PKCS#11
453 	 * engine.
454 	 *
455 	 * This is used if private key operations for EAP-TLS are performed
456 	 * using a smartcard.
457 	 *
458 	 * This field is like engine_id, but used for phase 2 (inside
459 	 * EAP-TTLS/PEAP/FAST tunnel) authentication.
460 	 */
461 	char *engine2_id;
462 
463 
464 	/**
465 	 * key_id - Key ID for OpenSSL engine
466 	 *
467 	 * This is used if private key operations for EAP-TLS are performed
468 	 * using a smartcard.
469 	 */
470 	char *key_id;
471 
472 	/**
473 	 * cert_id - Cert ID for OpenSSL engine
474 	 *
475 	 * This is used if the certificate operations for EAP-TLS are performed
476 	 * using a smartcard.
477 	 */
478 	char *cert_id;
479 
480 	/**
481 	 * ca_cert_id - CA Cert ID for OpenSSL engine
482 	 *
483 	 * This is used if the CA certificate for EAP-TLS is on a smartcard.
484 	 */
485 	char *ca_cert_id;
486 
487 	/**
488 	 * key2_id - Key ID for OpenSSL engine (phase2)
489 	 *
490 	 * This is used if private key operations for EAP-TLS are performed
491 	 * using a smartcard.
492 	 */
493 	char *key2_id;
494 
495 	/**
496 	 * cert2_id - Cert ID for OpenSSL engine (phase2)
497 	 *
498 	 * This is used if the certificate operations for EAP-TLS are performed
499 	 * using a smartcard.
500 	 */
501 	char *cert2_id;
502 
503 	/**
504 	 * ca_cert2_id - CA Cert ID for OpenSSL engine (phase2)
505 	 *
506 	 * This is used if the CA certificate for EAP-TLS is on a smartcard.
507 	 */
508 	char *ca_cert2_id;
509 
510 	/**
511 	 * otp - One-time-password
512 	 *
513 	 * This field should not be set in configuration step. It is only used
514 	 * internally when OTP is entered through the control interface.
515 	 */
516 	u8 *otp;
517 
518 	/**
519 	 * otp_len - Length of the otp field
520 	 */
521 	size_t otp_len;
522 
523 	/**
524 	 * pending_req_identity - Whether there is a pending identity request
525 	 *
526 	 * This field should not be set in configuration step. It is only used
527 	 * internally when control interface is used to request needed
528 	 * information.
529 	 */
530 	int pending_req_identity;
531 
532 	/**
533 	 * pending_req_password - Whether there is a pending password request
534 	 *
535 	 * This field should not be set in configuration step. It is only used
536 	 * internally when control interface is used to request needed
537 	 * information.
538 	 */
539 	int pending_req_password;
540 
541 	/**
542 	 * pending_req_pin - Whether there is a pending PIN request
543 	 *
544 	 * This field should not be set in configuration step. It is only used
545 	 * internally when control interface is used to request needed
546 	 * information.
547 	 */
548 	int pending_req_pin;
549 
550 	/**
551 	 * pending_req_new_password - Pending password update request
552 	 *
553 	 * This field should not be set in configuration step. It is only used
554 	 * internally when control interface is used to request needed
555 	 * information.
556 	 */
557 	int pending_req_new_password;
558 
559 	/**
560 	 * pending_req_passphrase - Pending passphrase request
561 	 *
562 	 * This field should not be set in configuration step. It is only used
563 	 * internally when control interface is used to request needed
564 	 * information.
565 	 */
566 	int pending_req_passphrase;
567 
568 	/**
569 	 * pending_req_otp - Whether there is a pending OTP request
570 	 *
571 	 * This field should not be set in configuration step. It is only used
572 	 * internally when control interface is used to request needed
573 	 * information.
574 	 */
575 	char *pending_req_otp;
576 
577 	/**
578 	 * pending_req_otp_len - Length of the pending OTP request
579 	 */
580 	size_t pending_req_otp_len;
581 
582 	/**
583 	 * pac_file - File path or blob name for the PAC entries (EAP-FAST)
584 	 *
585 	 * wpa_supplicant will need to be able to create this file and write
586 	 * updates to it when PAC is being provisioned or refreshed. Full path
587 	 * to the file should be used since working directory may change when
588 	 * wpa_supplicant is run in the background.
589 	 * Alternatively, a named configuration blob can be used by setting
590 	 * this to blob://blob_name.
591 	 */
592 	char *pac_file;
593 
594 	/**
595 	 * mschapv2_retry - MSCHAPv2 retry in progress
596 	 *
597 	 * This field is used internally by EAP-MSCHAPv2 and should not be set
598 	 * as part of configuration.
599 	 */
600 	int mschapv2_retry;
601 
602 	/**
603 	 * new_password - New password for password update
604 	 *
605 	 * This field is used during MSCHAPv2 password update. This is normally
606 	 * requested from the user through the control interface and not set
607 	 * from configuration.
608 	 */
609 	u8 *new_password;
610 
611 	/**
612 	 * new_password_len - Length of new_password field
613 	 */
614 	size_t new_password_len;
615 
616 	/**
617 	 * fragment_size - Maximum EAP fragment size in bytes (default 1398)
618 	 *
619 	 * This value limits the fragment size for EAP methods that support
620 	 * fragmentation (e.g., EAP-TLS and EAP-PEAP). This value should be set
621 	 * small enough to make the EAP messages fit in MTU of the network
622 	 * interface used for EAPOL. The default value is suitable for most
623 	 * cases.
624 	 */
625 	int fragment_size;
626 
627 #define EAP_CONFIG_FLAGS_PASSWORD_NTHASH BIT(0)
628 	/**
629 	 * flags - Network configuration flags (bitfield)
630 	 *
631 	 * This variable is used for internal flags to describe further details
632 	 * for the network parameters.
633 	 * bit 0 = password is represented as a 16-byte NtPasswordHash value
634 	 *         instead of plaintext password
635 	 */
636 	u32 flags;
637 };
638 
639 
640 /**
641  * struct wpa_config_blob - Named configuration blob
642  *
643  * This data structure is used to provide storage for binary objects to store
644  * abstract information like certificates and private keys inlined with the
645  * configuration data.
646  */
647 struct wpa_config_blob {
648 	/**
649 	 * name - Blob name
650 	 */
651 	char *name;
652 
653 	/**
654 	 * data - Pointer to binary data
655 	 */
656 	u8 *data;
657 
658 	/**
659 	 * len - Length of binary data
660 	 */
661 	size_t len;
662 
663 	/**
664 	 * next - Pointer to next blob in the configuration
665 	 */
666 	struct wpa_config_blob *next;
667 };
668 
669 #endif /* EAP_CONFIG_H */
670