Line data Source code
1 : /*
2 : * Authentication server setup
3 : * Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi>
4 : *
5 : * This software may be distributed under the terms of the BSD license.
6 : * See README for more details.
7 : */
8 :
9 : #include "utils/includes.h"
10 :
11 : #include "utils/common.h"
12 : #include "crypto/tls.h"
13 : #include "eap_server/eap.h"
14 : #include "eap_server/eap_sim_db.h"
15 : #include "eapol_auth/eapol_auth_sm.h"
16 : #include "radius/radius_server.h"
17 : #include "hostapd.h"
18 : #include "ap_config.h"
19 : #include "sta_info.h"
20 : #include "authsrv.h"
21 :
22 :
23 : #if defined(EAP_SERVER_SIM) || defined(EAP_SERVER_AKA)
24 : #define EAP_SIM_DB
25 : #endif /* EAP_SERVER_SIM || EAP_SERVER_AKA */
26 :
27 :
28 : #ifdef EAP_SIM_DB
29 7 : static int hostapd_sim_db_cb_sta(struct hostapd_data *hapd,
30 : struct sta_info *sta, void *ctx)
31 : {
32 7 : if (eapol_auth_eap_pending_cb(sta->eapol_sm, ctx) == 0)
33 7 : return 1;
34 0 : return 0;
35 : }
36 :
37 :
38 96 : static void hostapd_sim_db_cb(void *ctx, void *session_ctx)
39 : {
40 96 : struct hostapd_data *hapd = ctx;
41 96 : if (ap_for_each_sta(hapd, hostapd_sim_db_cb_sta, session_ctx) == 0) {
42 : #ifdef RADIUS_SERVER
43 89 : radius_server_eap_pending_cb(hapd->radius_srv, session_ctx);
44 : #endif /* RADIUS_SERVER */
45 : }
46 96 : }
47 : #endif /* EAP_SIM_DB */
48 :
49 :
50 : #ifdef RADIUS_SERVER
51 :
52 1932 : static int hostapd_radius_get_eap_user(void *ctx, const u8 *identity,
53 : size_t identity_len, int phase2,
54 : struct eap_user *user)
55 : {
56 : const struct hostapd_eap_user *eap_user;
57 : int i;
58 1932 : int rv = -1;
59 :
60 1932 : eap_user = hostapd_get_eap_user(ctx, identity, identity_len, phase2);
61 1932 : if (eap_user == NULL)
62 1 : goto out;
63 :
64 1931 : if (user == NULL)
65 0 : return 0;
66 :
67 1931 : os_memset(user, 0, sizeof(*user));
68 17379 : for (i = 0; i < EAP_MAX_METHODS; i++) {
69 15448 : user->methods[i].vendor = eap_user->methods[i].vendor;
70 15448 : user->methods[i].method = eap_user->methods[i].method;
71 : }
72 :
73 1931 : if (eap_user->password) {
74 1194 : user->password = os_malloc(eap_user->password_len);
75 1194 : if (user->password == NULL)
76 0 : goto out;
77 1194 : os_memcpy(user->password, eap_user->password,
78 : eap_user->password_len);
79 1194 : user->password_len = eap_user->password_len;
80 1194 : user->password_hash = eap_user->password_hash;
81 : }
82 1931 : user->force_version = eap_user->force_version;
83 1931 : user->macacl = eap_user->macacl;
84 1931 : user->ttls_auth = eap_user->ttls_auth;
85 1931 : user->remediation = eap_user->remediation;
86 1931 : user->accept_attr = eap_user->accept_attr;
87 1931 : rv = 0;
88 :
89 : out:
90 1932 : if (rv)
91 1 : wpa_printf(MSG_DEBUG, "%s: Failed to find user", __func__);
92 :
93 1932 : return rv;
94 : }
95 :
96 :
97 26 : static int hostapd_setup_radius_srv(struct hostapd_data *hapd)
98 : {
99 : struct radius_server_conf srv;
100 26 : struct hostapd_bss_config *conf = hapd->conf;
101 26 : os_memset(&srv, 0, sizeof(srv));
102 26 : srv.client_file = conf->radius_server_clients;
103 26 : srv.auth_port = conf->radius_server_auth_port;
104 26 : srv.acct_port = conf->radius_server_acct_port;
105 26 : srv.conf_ctx = hapd;
106 26 : srv.eap_sim_db_priv = hapd->eap_sim_db_priv;
107 26 : srv.ssl_ctx = hapd->ssl_ctx;
108 26 : srv.msg_ctx = hapd->msg_ctx;
109 26 : srv.pac_opaque_encr_key = conf->pac_opaque_encr_key;
110 26 : srv.eap_fast_a_id = conf->eap_fast_a_id;
111 26 : srv.eap_fast_a_id_len = conf->eap_fast_a_id_len;
112 26 : srv.eap_fast_a_id_info = conf->eap_fast_a_id_info;
113 26 : srv.eap_fast_prov = conf->eap_fast_prov;
114 26 : srv.pac_key_lifetime = conf->pac_key_lifetime;
115 26 : srv.pac_key_refresh_time = conf->pac_key_refresh_time;
116 26 : srv.eap_sim_aka_result_ind = conf->eap_sim_aka_result_ind;
117 26 : srv.tnc = conf->tnc;
118 26 : srv.wps = hapd->wps;
119 26 : srv.ipv6 = conf->radius_server_ipv6;
120 26 : srv.get_eap_user = hostapd_radius_get_eap_user;
121 26 : srv.eap_req_id_text = conf->eap_req_id_text;
122 26 : srv.eap_req_id_text_len = conf->eap_req_id_text_len;
123 26 : srv.pwd_group = conf->pwd_group;
124 26 : srv.server_id = conf->server_id ? conf->server_id : "hostapd";
125 26 : srv.sqlite_file = conf->eap_user_sqlite;
126 : #ifdef CONFIG_RADIUS_TEST
127 : srv.dump_msk_file = conf->dump_msk_file;
128 : #endif /* CONFIG_RADIUS_TEST */
129 : #ifdef CONFIG_HS20
130 26 : srv.subscr_remediation_url = conf->subscr_remediation_url;
131 26 : srv.subscr_remediation_method = conf->subscr_remediation_method;
132 : #endif /* CONFIG_HS20 */
133 26 : srv.erp = conf->eap_server_erp;
134 26 : srv.erp_domain = conf->erp_domain;
135 26 : srv.tls_session_lifetime = conf->tls_session_lifetime;
136 :
137 26 : hapd->radius_srv = radius_server_init(&srv);
138 26 : if (hapd->radius_srv == NULL) {
139 0 : wpa_printf(MSG_ERROR, "RADIUS server initialization failed.");
140 0 : return -1;
141 : }
142 :
143 26 : return 0;
144 : }
145 :
146 : #endif /* RADIUS_SERVER */
147 :
148 :
149 2051 : int authsrv_init(struct hostapd_data *hapd)
150 : {
151 : #ifdef EAP_TLS_FUNCS
152 2025 : if (hapd->conf->eap_server &&
153 875 : (hapd->conf->ca_cert || hapd->conf->server_cert ||
154 528 : hapd->conf->private_key || hapd->conf->dh_file)) {
155 : struct tls_config conf;
156 : struct tls_connection_params params;
157 :
158 83 : os_memset(&conf, 0, sizeof(conf));
159 83 : conf.tls_session_lifetime = hapd->conf->tls_session_lifetime;
160 83 : hapd->ssl_ctx = tls_init(&conf);
161 83 : if (hapd->ssl_ctx == NULL) {
162 0 : wpa_printf(MSG_ERROR, "Failed to initialize TLS");
163 0 : authsrv_deinit(hapd);
164 3 : return -1;
165 : }
166 :
167 83 : os_memset(¶ms, 0, sizeof(params));
168 83 : params.ca_cert = hapd->conf->ca_cert;
169 83 : params.client_cert = hapd->conf->server_cert;
170 83 : params.private_key = hapd->conf->private_key;
171 83 : params.private_key_passwd = hapd->conf->private_key_passwd;
172 83 : params.dh_file = hapd->conf->dh_file;
173 83 : params.openssl_ciphers = hapd->conf->openssl_ciphers;
174 83 : params.ocsp_stapling_response =
175 83 : hapd->conf->ocsp_stapling_response;
176 :
177 83 : if (tls_global_set_params(hapd->ssl_ctx, ¶ms)) {
178 3 : wpa_printf(MSG_ERROR, "Failed to set TLS parameters");
179 3 : authsrv_deinit(hapd);
180 3 : return -1;
181 : }
182 :
183 80 : if (tls_global_set_verify(hapd->ssl_ctx,
184 80 : hapd->conf->check_crl)) {
185 0 : wpa_printf(MSG_ERROR, "Failed to enable check_crl");
186 0 : authsrv_deinit(hapd);
187 0 : return -1;
188 : }
189 : }
190 : #endif /* EAP_TLS_FUNCS */
191 :
192 : #ifdef EAP_SIM_DB
193 1675 : if (hapd->conf->eap_sim_db) {
194 15 : hapd->eap_sim_db_priv =
195 15 : eap_sim_db_init(hapd->conf->eap_sim_db,
196 : hostapd_sim_db_cb, hapd);
197 15 : if (hapd->eap_sim_db_priv == NULL) {
198 0 : wpa_printf(MSG_ERROR, "Failed to initialize EAP-SIM "
199 : "database interface");
200 0 : authsrv_deinit(hapd);
201 0 : return -1;
202 : }
203 : }
204 : #endif /* EAP_SIM_DB */
205 :
206 : #ifdef RADIUS_SERVER
207 1701 : if (hapd->conf->radius_server_clients &&
208 26 : hostapd_setup_radius_srv(hapd))
209 0 : return -1;
210 : #endif /* RADIUS_SERVER */
211 :
212 2048 : return 0;
213 : }
214 :
215 :
216 2058 : void authsrv_deinit(struct hostapd_data *hapd)
217 : {
218 : #ifdef RADIUS_SERVER
219 1685 : radius_server_deinit(hapd->radius_srv);
220 1685 : hapd->radius_srv = NULL;
221 : #endif /* RADIUS_SERVER */
222 :
223 : #ifdef EAP_TLS_FUNCS
224 1685 : if (hapd->ssl_ctx) {
225 83 : tls_deinit(hapd->ssl_ctx);
226 83 : hapd->ssl_ctx = NULL;
227 : }
228 : #endif /* EAP_TLS_FUNCS */
229 :
230 : #ifdef EAP_SIM_DB
231 1685 : if (hapd->eap_sim_db_priv) {
232 15 : eap_sim_db_deinit(hapd->eap_sim_db_priv);
233 15 : hapd->eap_sim_db_priv = NULL;
234 : }
235 : #endif /* EAP_SIM_DB */
236 2058 : }
|
