1/* 2 * Authentication server setup 3 * Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9#include "utils/includes.h" 10 11#include "utils/common.h" 12#include "crypto/tls.h" 13#include "eap_server/eap.h" 14#include "eap_server/eap_sim_db.h" 15#include "eapol_auth/eapol_auth_sm.h" 16#include "radius/radius_server.h" 17#include "hostapd.h" 18#include "ap_config.h" 19#include "sta_info.h" 20#include "authsrv.h" 21 22 23#if defined(EAP_SERVER_SIM) || defined(EAP_SERVER_AKA) 24#define EAP_SIM_DB 25#endif /* EAP_SERVER_SIM || EAP_SERVER_AKA */ 26 27 28#ifdef EAP_SIM_DB 29static int hostapd_sim_db_cb_sta(struct hostapd_data *hapd, 30 struct sta_info *sta, void *ctx) 31{ 32 if (eapol_auth_eap_pending_cb(sta->eapol_sm, ctx) == 0) 33 return 1; 34 return 0; 35} 36 37 38static void hostapd_sim_db_cb(void *ctx, void *session_ctx) 39{ 40 struct hostapd_data *hapd = ctx; 41 if (ap_for_each_sta(hapd, hostapd_sim_db_cb_sta, session_ctx) == 0) { 42#ifdef RADIUS_SERVER 43 radius_server_eap_pending_cb(hapd->radius_srv, session_ctx); 44#endif /* RADIUS_SERVER */ 45 } 46} 47#endif /* EAP_SIM_DB */ 48 49 50#ifdef RADIUS_SERVER 51 52static int hostapd_radius_get_eap_user(void *ctx, const u8 *identity, 53 size_t identity_len, int phase2, 54 struct eap_user *user) 55{ 56 const struct hostapd_eap_user *eap_user; 57 int i; 58 int rv = -1; 59 60 eap_user = hostapd_get_eap_user(ctx, identity, identity_len, phase2); 61 if (eap_user == NULL) 62 goto out; 63 64 if (user == NULL) 65 return 0; 66 67 os_memset(user, 0, sizeof(*user)); 68 for (i = 0; i < EAP_MAX_METHODS; i++) { 69 user->methods[i].vendor = eap_user->methods[i].vendor; 70 user->methods[i].method = eap_user->methods[i].method; 71 } 72 73 if (eap_user->password) { 74 user->password = os_malloc(eap_user->password_len); 75 if (user->password == NULL) 76 goto out; 77 os_memcpy(user->password, eap_user->password, 78 eap_user->password_len); 79 user->password_len = eap_user->password_len; 80 user->password_hash = eap_user->password_hash; 81 } 82 user->force_version = eap_user->force_version; 83 user->macacl = eap_user->macacl; 84 user->ttls_auth = eap_user->ttls_auth; 85 user->remediation = eap_user->remediation; 86 user->accept_attr = eap_user->accept_attr; 87 rv = 0; 88 89out: 90 if (rv) 91 wpa_printf(MSG_DEBUG, "%s: Failed to find user", __func__); 92 93 return rv; 94} 95 96 97static int hostapd_setup_radius_srv(struct hostapd_data *hapd) 98{ 99 struct radius_server_conf srv; 100 struct hostapd_bss_config *conf = hapd->conf; 101 os_memset(&srv, 0, sizeof(srv)); 102 srv.client_file = conf->radius_server_clients; 103 srv.auth_port = conf->radius_server_auth_port; 104 srv.acct_port = conf->radius_server_acct_port; 105 srv.conf_ctx = hapd; 106 srv.eap_sim_db_priv = hapd->eap_sim_db_priv; 107 srv.ssl_ctx = hapd->ssl_ctx; 108 srv.msg_ctx = hapd->msg_ctx; 109 srv.pac_opaque_encr_key = conf->pac_opaque_encr_key; 110 srv.eap_fast_a_id = conf->eap_fast_a_id; 111 srv.eap_fast_a_id_len = conf->eap_fast_a_id_len; 112 srv.eap_fast_a_id_info = conf->eap_fast_a_id_info; 113 srv.eap_fast_prov = conf->eap_fast_prov; 114 srv.pac_key_lifetime = conf->pac_key_lifetime; 115 srv.pac_key_refresh_time = conf->pac_key_refresh_time; 116 srv.eap_sim_aka_result_ind = conf->eap_sim_aka_result_ind; 117 srv.tnc = conf->tnc; 118 srv.wps = hapd->wps; 119 srv.ipv6 = conf->radius_server_ipv6; 120 srv.get_eap_user = hostapd_radius_get_eap_user; 121 srv.eap_req_id_text = conf->eap_req_id_text; 122 srv.eap_req_id_text_len = conf->eap_req_id_text_len; 123 srv.pwd_group = conf->pwd_group; 124 srv.server_id = conf->server_id ? conf->server_id : "hostapd"; 125 srv.sqlite_file = conf->eap_user_sqlite; 126#ifdef CONFIG_RADIUS_TEST 127 srv.dump_msk_file = conf->dump_msk_file; 128#endif /* CONFIG_RADIUS_TEST */ 129#ifdef CONFIG_HS20 130 srv.subscr_remediation_url = conf->subscr_remediation_url; 131 srv.subscr_remediation_method = conf->subscr_remediation_method; 132#endif /* CONFIG_HS20 */ 133 srv.erp = conf->eap_server_erp; 134 srv.erp_domain = conf->erp_domain; 135 srv.tls_session_lifetime = conf->tls_session_lifetime; 136 137 hapd->radius_srv = radius_server_init(&srv); 138 if (hapd->radius_srv == NULL) { 139 wpa_printf(MSG_ERROR, "RADIUS server initialization failed."); 140 return -1; 141 } 142 143 return 0; 144} 145 146#endif /* RADIUS_SERVER */ 147 148 149int authsrv_init(struct hostapd_data *hapd) 150{ 151#ifdef EAP_TLS_FUNCS 152 if (hapd->conf->eap_server && 153 (hapd->conf->ca_cert || hapd->conf->server_cert || 154 hapd->conf->private_key || hapd->conf->dh_file)) { 155 struct tls_config conf; 156 struct tls_connection_params params; 157 158 os_memset(&conf, 0, sizeof(conf)); 159 conf.tls_session_lifetime = hapd->conf->tls_session_lifetime; 160 hapd->ssl_ctx = tls_init(&conf); 161 if (hapd->ssl_ctx == NULL) { 162 wpa_printf(MSG_ERROR, "Failed to initialize TLS"); 163 authsrv_deinit(hapd); 164 return -1; 165 } 166 167 os_memset(¶ms, 0, sizeof(params)); 168 params.ca_cert = hapd->conf->ca_cert; 169 params.client_cert = hapd->conf->server_cert; 170 params.private_key = hapd->conf->private_key; 171 params.private_key_passwd = hapd->conf->private_key_passwd; 172 params.dh_file = hapd->conf->dh_file; 173 params.openssl_ciphers = hapd->conf->openssl_ciphers; 174 params.ocsp_stapling_response = 175 hapd->conf->ocsp_stapling_response; 176 params.ocsp_stapling_response_multi = 177 hapd->conf->ocsp_stapling_response_multi; 178 179 if (tls_global_set_params(hapd->ssl_ctx, ¶ms)) { 180 wpa_printf(MSG_ERROR, "Failed to set TLS parameters"); 181 authsrv_deinit(hapd); 182 return -1; 183 } 184 185 if (tls_global_set_verify(hapd->ssl_ctx, 186 hapd->conf->check_crl)) { 187 wpa_printf(MSG_ERROR, "Failed to enable check_crl"); 188 authsrv_deinit(hapd); 189 return -1; 190 } 191 } 192#endif /* EAP_TLS_FUNCS */ 193 194#ifdef EAP_SIM_DB 195 if (hapd->conf->eap_sim_db) { 196 hapd->eap_sim_db_priv = 197 eap_sim_db_init(hapd->conf->eap_sim_db, 198 hapd->conf->eap_sim_db_timeout, 199 hostapd_sim_db_cb, hapd); 200 if (hapd->eap_sim_db_priv == NULL) { 201 wpa_printf(MSG_ERROR, "Failed to initialize EAP-SIM " 202 "database interface"); 203 authsrv_deinit(hapd); 204 return -1; 205 } 206 } 207#endif /* EAP_SIM_DB */ 208 209#ifdef RADIUS_SERVER 210 if (hapd->conf->radius_server_clients && 211 hostapd_setup_radius_srv(hapd)) 212 return -1; 213#endif /* RADIUS_SERVER */ 214 215 return 0; 216} 217 218 219void authsrv_deinit(struct hostapd_data *hapd) 220{ 221#ifdef RADIUS_SERVER 222 radius_server_deinit(hapd->radius_srv); 223 hapd->radius_srv = NULL; 224#endif /* RADIUS_SERVER */ 225 226#ifdef EAP_TLS_FUNCS 227 if (hapd->ssl_ctx) { 228 tls_deinit(hapd->ssl_ctx); 229 hapd->ssl_ctx = NULL; 230 } 231#endif /* EAP_TLS_FUNCS */ 232 233#ifdef EAP_SIM_DB 234 if (hapd->eap_sim_db_priv) { 235 eap_sim_db_deinit(hapd->eap_sim_db_priv); 236 hapd->eap_sim_db_priv = NULL; 237 } 238#endif /* EAP_SIM_DB */ 239} 240