1 /*
2 * Authentication server setup
3 * Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "utils/includes.h"
10
11 #include "utils/common.h"
12 #include "crypto/tls.h"
13 #include "eap_server/eap.h"
14 #include "eap_server/eap_sim_db.h"
15 #include "eapol_auth/eapol_auth_sm.h"
16 #include "radius/radius_server.h"
17 #include "hostapd.h"
18 #include "ap_config.h"
19 #include "sta_info.h"
20 #include "authsrv.h"
21
22
23 #if defined(EAP_SERVER_SIM) || defined(EAP_SERVER_AKA)
24 #define EAP_SIM_DB
25 #endif /* EAP_SERVER_SIM || EAP_SERVER_AKA */
26
27
28 #ifdef EAP_SIM_DB
hostapd_sim_db_cb_sta(struct hostapd_data * hapd,struct sta_info * sta,void * ctx)29 static int hostapd_sim_db_cb_sta(struct hostapd_data *hapd,
30 struct sta_info *sta, void *ctx)
31 {
32 if (eapol_auth_eap_pending_cb(sta->eapol_sm, ctx) == 0)
33 return 1;
34 return 0;
35 }
36
37
hostapd_sim_db_cb(void * ctx,void * session_ctx)38 static void hostapd_sim_db_cb(void *ctx, void *session_ctx)
39 {
40 struct hostapd_data *hapd = ctx;
41 if (ap_for_each_sta(hapd, hostapd_sim_db_cb_sta, session_ctx) == 0) {
42 #ifdef RADIUS_SERVER
43 radius_server_eap_pending_cb(hapd->radius_srv, session_ctx);
44 #endif /* RADIUS_SERVER */
45 }
46 }
47 #endif /* EAP_SIM_DB */
48
49
50 #ifdef RADIUS_SERVER
51
hostapd_radius_get_eap_user(void * ctx,const u8 * identity,size_t identity_len,int phase2,struct eap_user * user)52 static int hostapd_radius_get_eap_user(void *ctx, const u8 *identity,
53 size_t identity_len, int phase2,
54 struct eap_user *user)
55 {
56 const struct hostapd_eap_user *eap_user;
57 int i;
58 int rv = -1;
59
60 eap_user = hostapd_get_eap_user(ctx, identity, identity_len, phase2);
61 if (eap_user == NULL)
62 goto out;
63
64 if (user == NULL)
65 return 0;
66
67 os_memset(user, 0, sizeof(*user));
68 for (i = 0; i < EAP_MAX_METHODS; i++) {
69 user->methods[i].vendor = eap_user->methods[i].vendor;
70 user->methods[i].method = eap_user->methods[i].method;
71 }
72
73 if (eap_user->password) {
74 user->password = os_memdup(eap_user->password,
75 eap_user->password_len);
76 if (user->password == NULL)
77 goto out;
78 user->password_len = eap_user->password_len;
79 user->password_hash = eap_user->password_hash;
80 if (eap_user->salt && eap_user->salt_len) {
81 user->salt = os_memdup(eap_user->salt,
82 eap_user->salt_len);
83 if (!user->salt)
84 goto out;
85 user->salt_len = eap_user->salt_len;
86 }
87 }
88 user->force_version = eap_user->force_version;
89 user->macacl = eap_user->macacl;
90 user->ttls_auth = eap_user->ttls_auth;
91 user->remediation = eap_user->remediation;
92 user->accept_attr = eap_user->accept_attr;
93 user->t_c_timestamp = eap_user->t_c_timestamp;
94 rv = 0;
95
96 out:
97 if (rv)
98 wpa_printf(MSG_DEBUG, "%s: Failed to find user", __func__);
99
100 return rv;
101 }
102
103
hostapd_setup_radius_srv(struct hostapd_data * hapd)104 static int hostapd_setup_radius_srv(struct hostapd_data *hapd)
105 {
106 struct radius_server_conf srv;
107 struct hostapd_bss_config *conf = hapd->conf;
108 os_memset(&srv, 0, sizeof(srv));
109 srv.client_file = conf->radius_server_clients;
110 srv.auth_port = conf->radius_server_auth_port;
111 srv.acct_port = conf->radius_server_acct_port;
112 srv.conf_ctx = hapd;
113 srv.eap_sim_db_priv = hapd->eap_sim_db_priv;
114 srv.ssl_ctx = hapd->ssl_ctx;
115 srv.msg_ctx = hapd->msg_ctx;
116 srv.pac_opaque_encr_key = conf->pac_opaque_encr_key;
117 srv.eap_fast_a_id = conf->eap_fast_a_id;
118 srv.eap_fast_a_id_len = conf->eap_fast_a_id_len;
119 srv.eap_fast_a_id_info = conf->eap_fast_a_id_info;
120 srv.eap_fast_prov = conf->eap_fast_prov;
121 srv.pac_key_lifetime = conf->pac_key_lifetime;
122 srv.pac_key_refresh_time = conf->pac_key_refresh_time;
123 srv.eap_sim_aka_result_ind = conf->eap_sim_aka_result_ind;
124 srv.tnc = conf->tnc;
125 srv.wps = hapd->wps;
126 srv.ipv6 = conf->radius_server_ipv6;
127 srv.get_eap_user = hostapd_radius_get_eap_user;
128 srv.eap_req_id_text = conf->eap_req_id_text;
129 srv.eap_req_id_text_len = conf->eap_req_id_text_len;
130 srv.pwd_group = conf->pwd_group;
131 srv.server_id = conf->server_id ? conf->server_id : "hostapd";
132 srv.sqlite_file = conf->eap_user_sqlite;
133 #ifdef CONFIG_RADIUS_TEST
134 srv.dump_msk_file = conf->dump_msk_file;
135 #endif /* CONFIG_RADIUS_TEST */
136 #ifdef CONFIG_HS20
137 srv.subscr_remediation_url = conf->subscr_remediation_url;
138 srv.subscr_remediation_method = conf->subscr_remediation_method;
139 srv.hs20_sim_provisioning_url = conf->hs20_sim_provisioning_url;
140 srv.t_c_server_url = conf->t_c_server_url;
141 #endif /* CONFIG_HS20 */
142 srv.erp = conf->eap_server_erp;
143 srv.erp_domain = conf->erp_domain;
144 srv.tls_session_lifetime = conf->tls_session_lifetime;
145 srv.tls_flags = conf->tls_flags;
146
147 hapd->radius_srv = radius_server_init(&srv);
148 if (hapd->radius_srv == NULL) {
149 wpa_printf(MSG_ERROR, "RADIUS server initialization failed.");
150 return -1;
151 }
152
153 return 0;
154 }
155
156 #endif /* RADIUS_SERVER */
157
158
159 #ifdef EAP_TLS_FUNCS
authsrv_tls_event(void * ctx,enum tls_event ev,union tls_event_data * data)160 static void authsrv_tls_event(void *ctx, enum tls_event ev,
161 union tls_event_data *data)
162 {
163 switch (ev) {
164 case TLS_CERT_CHAIN_SUCCESS:
165 wpa_printf(MSG_DEBUG, "authsrv: remote certificate verification success");
166 break;
167 case TLS_CERT_CHAIN_FAILURE:
168 wpa_printf(MSG_INFO, "authsrv: certificate chain failure: reason=%d depth=%d subject='%s' err='%s'",
169 data->cert_fail.reason,
170 data->cert_fail.depth,
171 data->cert_fail.subject,
172 data->cert_fail.reason_txt);
173 break;
174 case TLS_PEER_CERTIFICATE:
175 wpa_printf(MSG_DEBUG, "authsrv: peer certificate: depth=%d serial_num=%s subject=%s",
176 data->peer_cert.depth,
177 data->peer_cert.serial_num ? data->peer_cert.serial_num : "N/A",
178 data->peer_cert.subject);
179 break;
180 case TLS_ALERT:
181 if (data->alert.is_local)
182 wpa_printf(MSG_DEBUG, "authsrv: local TLS alert: %s",
183 data->alert.description);
184 else
185 wpa_printf(MSG_DEBUG, "authsrv: remote TLS alert: %s",
186 data->alert.description);
187 break;
188 }
189 }
190 #endif /* EAP_TLS_FUNCS */
191
192
authsrv_init(struct hostapd_data * hapd)193 int authsrv_init(struct hostapd_data *hapd)
194 {
195 #ifdef EAP_TLS_FUNCS
196 if (hapd->conf->eap_server &&
197 (hapd->conf->ca_cert || hapd->conf->server_cert ||
198 hapd->conf->private_key || hapd->conf->dh_file)) {
199 struct tls_config conf;
200 struct tls_connection_params params;
201
202 os_memset(&conf, 0, sizeof(conf));
203 conf.tls_session_lifetime = hapd->conf->tls_session_lifetime;
204 if (hapd->conf->crl_reload_interval > 0 &&
205 hapd->conf->check_crl <= 0) {
206 wpa_printf(MSG_INFO,
207 "Cannot enable CRL reload functionality - it depends on check_crl being set");
208 } else if (hapd->conf->crl_reload_interval > 0) {
209 conf.crl_reload_interval =
210 hapd->conf->crl_reload_interval;
211 wpa_printf(MSG_INFO,
212 "Enabled CRL reload functionality");
213 }
214 conf.tls_flags = hapd->conf->tls_flags;
215 conf.event_cb = authsrv_tls_event;
216 conf.cb_ctx = hapd;
217 hapd->ssl_ctx = tls_init(&conf);
218 if (hapd->ssl_ctx == NULL) {
219 wpa_printf(MSG_ERROR, "Failed to initialize TLS");
220 authsrv_deinit(hapd);
221 return -1;
222 }
223
224 os_memset(¶ms, 0, sizeof(params));
225 params.ca_cert = hapd->conf->ca_cert;
226 params.client_cert = hapd->conf->server_cert;
227 params.private_key = hapd->conf->private_key;
228 params.private_key_passwd = hapd->conf->private_key_passwd;
229 params.dh_file = hapd->conf->dh_file;
230 params.openssl_ciphers = hapd->conf->openssl_ciphers;
231 params.openssl_ecdh_curves = hapd->conf->openssl_ecdh_curves;
232 params.ocsp_stapling_response =
233 hapd->conf->ocsp_stapling_response;
234 params.ocsp_stapling_response_multi =
235 hapd->conf->ocsp_stapling_response_multi;
236 params.check_cert_subject = hapd->conf->check_cert_subject;
237
238 if (tls_global_set_params(hapd->ssl_ctx, ¶ms)) {
239 wpa_printf(MSG_ERROR, "Failed to set TLS parameters");
240 authsrv_deinit(hapd);
241 return -1;
242 }
243
244 if (tls_global_set_verify(hapd->ssl_ctx,
245 hapd->conf->check_crl,
246 hapd->conf->check_crl_strict)) {
247 wpa_printf(MSG_ERROR, "Failed to enable check_crl");
248 authsrv_deinit(hapd);
249 return -1;
250 }
251 }
252 #endif /* EAP_TLS_FUNCS */
253
254 #ifdef EAP_SIM_DB
255 if (hapd->conf->eap_sim_db) {
256 hapd->eap_sim_db_priv =
257 eap_sim_db_init(hapd->conf->eap_sim_db,
258 hapd->conf->eap_sim_db_timeout,
259 hostapd_sim_db_cb, hapd);
260 if (hapd->eap_sim_db_priv == NULL) {
261 wpa_printf(MSG_ERROR, "Failed to initialize EAP-SIM "
262 "database interface");
263 authsrv_deinit(hapd);
264 return -1;
265 }
266 }
267 #endif /* EAP_SIM_DB */
268
269 #ifdef RADIUS_SERVER
270 if (hapd->conf->radius_server_clients &&
271 hostapd_setup_radius_srv(hapd))
272 return -1;
273 #endif /* RADIUS_SERVER */
274
275 return 0;
276 }
277
278
authsrv_deinit(struct hostapd_data * hapd)279 void authsrv_deinit(struct hostapd_data *hapd)
280 {
281 #ifdef RADIUS_SERVER
282 radius_server_deinit(hapd->radius_srv);
283 hapd->radius_srv = NULL;
284 #endif /* RADIUS_SERVER */
285
286 #ifdef EAP_TLS_FUNCS
287 if (hapd->ssl_ctx) {
288 tls_deinit(hapd->ssl_ctx);
289 hapd->ssl_ctx = NULL;
290 }
291 #endif /* EAP_TLS_FUNCS */
292
293 #ifdef EAP_SIM_DB
294 if (hapd->eap_sim_db_priv) {
295 eap_sim_db_deinit(hapd->eap_sim_db_priv);
296 hapd->eap_sim_db_priv = NULL;
297 }
298 #endif /* EAP_SIM_DB */
299 }
300