1 /*
2 * RADIUS Dynamic Authorization Server (DAS) (RFC 5176)
3 * Copyright (c) 2012-2013, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10 #include <net/if.h>
11
12 #include "utils/common.h"
13 #include "utils/eloop.h"
14 #include "utils/ip_addr.h"
15 #include "radius.h"
16 #include "radius_das.h"
17
18
19 struct radius_das_data {
20 int sock;
21 u8 *shared_secret;
22 size_t shared_secret_len;
23 struct hostapd_ip_addr client_addr;
24 unsigned int time_window;
25 int require_event_timestamp;
26 int require_message_authenticator;
27 void *ctx;
28 enum radius_das_res (*disconnect)(void *ctx,
29 struct radius_das_attrs *attr);
30 enum radius_das_res (*coa)(void *ctx, struct radius_das_attrs *attr);
31 };
32
33
radius_das_disconnect(struct radius_das_data * das,struct radius_msg * msg,const char * abuf,int from_port)34 static struct radius_msg * radius_das_disconnect(struct radius_das_data *das,
35 struct radius_msg *msg,
36 const char *abuf,
37 int from_port)
38 {
39 struct radius_hdr *hdr;
40 struct radius_msg *reply;
41 u8 allowed[] = {
42 RADIUS_ATTR_USER_NAME,
43 RADIUS_ATTR_NAS_IP_ADDRESS,
44 RADIUS_ATTR_CALLING_STATION_ID,
45 RADIUS_ATTR_NAS_IDENTIFIER,
46 RADIUS_ATTR_ACCT_SESSION_ID,
47 RADIUS_ATTR_ACCT_MULTI_SESSION_ID,
48 RADIUS_ATTR_EVENT_TIMESTAMP,
49 RADIUS_ATTR_MESSAGE_AUTHENTICATOR,
50 RADIUS_ATTR_CHARGEABLE_USER_IDENTITY,
51 #ifdef CONFIG_IPV6
52 RADIUS_ATTR_NAS_IPV6_ADDRESS,
53 #endif /* CONFIG_IPV6 */
54 0
55 };
56 int error = 405;
57 u8 attr;
58 enum radius_das_res res;
59 struct radius_das_attrs attrs;
60 u8 *buf;
61 size_t len;
62 char tmp[100];
63 u8 sta_addr[ETH_ALEN];
64
65 hdr = radius_msg_get_hdr(msg);
66
67 attr = radius_msg_find_unlisted_attr(msg, allowed);
68 if (attr) {
69 wpa_printf(MSG_INFO, "DAS: Unsupported attribute %u in "
70 "Disconnect-Request from %s:%d", attr,
71 abuf, from_port);
72 error = 401;
73 goto fail;
74 }
75
76 os_memset(&attrs, 0, sizeof(attrs));
77
78 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_NAS_IP_ADDRESS,
79 &buf, &len, NULL) == 0) {
80 if (len != 4) {
81 wpa_printf(MSG_INFO, "DAS: Invalid NAS-IP-Address from %s:%d",
82 abuf, from_port);
83 error = 407;
84 goto fail;
85 }
86 attrs.nas_ip_addr = buf;
87 }
88
89 #ifdef CONFIG_IPV6
90 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_NAS_IPV6_ADDRESS,
91 &buf, &len, NULL) == 0) {
92 if (len != 16) {
93 wpa_printf(MSG_INFO, "DAS: Invalid NAS-IPv6-Address from %s:%d",
94 abuf, from_port);
95 error = 407;
96 goto fail;
97 }
98 attrs.nas_ipv6_addr = buf;
99 }
100 #endif /* CONFIG_IPV6 */
101
102 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_NAS_IDENTIFIER,
103 &buf, &len, NULL) == 0) {
104 attrs.nas_identifier = buf;
105 attrs.nas_identifier_len = len;
106 }
107
108 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_CALLING_STATION_ID,
109 &buf, &len, NULL) == 0) {
110 if (len >= sizeof(tmp))
111 len = sizeof(tmp) - 1;
112 os_memcpy(tmp, buf, len);
113 tmp[len] = '\0';
114 if (hwaddr_aton2(tmp, sta_addr) < 0) {
115 wpa_printf(MSG_INFO, "DAS: Invalid Calling-Station-Id "
116 "'%s' from %s:%d", tmp, abuf, from_port);
117 error = 407;
118 goto fail;
119 }
120 attrs.sta_addr = sta_addr;
121 }
122
123 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_USER_NAME,
124 &buf, &len, NULL) == 0) {
125 attrs.user_name = buf;
126 attrs.user_name_len = len;
127 }
128
129 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_ACCT_SESSION_ID,
130 &buf, &len, NULL) == 0) {
131 attrs.acct_session_id = buf;
132 attrs.acct_session_id_len = len;
133 }
134
135 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_ACCT_MULTI_SESSION_ID,
136 &buf, &len, NULL) == 0) {
137 attrs.acct_multi_session_id = buf;
138 attrs.acct_multi_session_id_len = len;
139 }
140
141 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_CHARGEABLE_USER_IDENTITY,
142 &buf, &len, NULL) == 0) {
143 attrs.cui = buf;
144 attrs.cui_len = len;
145 }
146
147 res = das->disconnect(das->ctx, &attrs);
148 switch (res) {
149 case RADIUS_DAS_NAS_MISMATCH:
150 wpa_printf(MSG_INFO, "DAS: NAS mismatch from %s:%d",
151 abuf, from_port);
152 error = 403;
153 break;
154 case RADIUS_DAS_SESSION_NOT_FOUND:
155 wpa_printf(MSG_INFO, "DAS: Session not found for request from "
156 "%s:%d", abuf, from_port);
157 error = 503;
158 break;
159 case RADIUS_DAS_MULTI_SESSION_MATCH:
160 wpa_printf(MSG_INFO,
161 "DAS: Multiple sessions match for request from %s:%d",
162 abuf, from_port);
163 error = 508;
164 break;
165 case RADIUS_DAS_COA_FAILED:
166 /* not used with Disconnect-Request */
167 error = 405;
168 break;
169 case RADIUS_DAS_SUCCESS:
170 error = 0;
171 break;
172 }
173
174 fail:
175 reply = radius_msg_new(error ? RADIUS_CODE_DISCONNECT_NAK :
176 RADIUS_CODE_DISCONNECT_ACK, hdr->identifier);
177 if (reply == NULL)
178 return NULL;
179
180 if (!radius_msg_add_msg_auth(reply)) {
181 radius_msg_free(reply);
182 return NULL;
183 }
184
185 if (error) {
186 if (!radius_msg_add_attr_int32(reply, RADIUS_ATTR_ERROR_CAUSE,
187 error)) {
188 radius_msg_free(reply);
189 return NULL;
190 }
191 }
192
193 return reply;
194 }
195
196
radius_das_coa(struct radius_das_data * das,struct radius_msg * msg,const char * abuf,int from_port)197 static struct radius_msg * radius_das_coa(struct radius_das_data *das,
198 struct radius_msg *msg,
199 const char *abuf, int from_port)
200 {
201 struct radius_hdr *hdr;
202 struct radius_msg *reply;
203 u8 allowed[] = {
204 RADIUS_ATTR_USER_NAME,
205 RADIUS_ATTR_NAS_IP_ADDRESS,
206 RADIUS_ATTR_CALLING_STATION_ID,
207 RADIUS_ATTR_NAS_IDENTIFIER,
208 RADIUS_ATTR_ACCT_SESSION_ID,
209 RADIUS_ATTR_ACCT_MULTI_SESSION_ID,
210 RADIUS_ATTR_EVENT_TIMESTAMP,
211 RADIUS_ATTR_MESSAGE_AUTHENTICATOR,
212 RADIUS_ATTR_CHARGEABLE_USER_IDENTITY,
213 #ifdef CONFIG_HS20
214 RADIUS_ATTR_VENDOR_SPECIFIC,
215 #endif /* CONFIG_HS20 */
216 #ifdef CONFIG_IPV6
217 RADIUS_ATTR_NAS_IPV6_ADDRESS,
218 #endif /* CONFIG_IPV6 */
219 0
220 };
221 int error = 405;
222 u8 attr;
223 enum radius_das_res res;
224 struct radius_das_attrs attrs;
225 u8 *buf;
226 size_t len;
227 char tmp[100];
228 u8 sta_addr[ETH_ALEN];
229
230 hdr = radius_msg_get_hdr(msg);
231
232 if (!das->coa) {
233 wpa_printf(MSG_INFO, "DAS: CoA not supported");
234 goto fail;
235 }
236
237 attr = radius_msg_find_unlisted_attr(msg, allowed);
238 if (attr) {
239 wpa_printf(MSG_INFO,
240 "DAS: Unsupported attribute %u in CoA-Request from %s:%d",
241 attr, abuf, from_port);
242 error = 401;
243 goto fail;
244 }
245
246 os_memset(&attrs, 0, sizeof(attrs));
247
248 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_NAS_IP_ADDRESS,
249 &buf, &len, NULL) == 0) {
250 if (len != 4) {
251 wpa_printf(MSG_INFO, "DAS: Invalid NAS-IP-Address from %s:%d",
252 abuf, from_port);
253 error = 407;
254 goto fail;
255 }
256 attrs.nas_ip_addr = buf;
257 }
258
259 #ifdef CONFIG_IPV6
260 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_NAS_IPV6_ADDRESS,
261 &buf, &len, NULL) == 0) {
262 if (len != 16) {
263 wpa_printf(MSG_INFO, "DAS: Invalid NAS-IPv6-Address from %s:%d",
264 abuf, from_port);
265 error = 407;
266 goto fail;
267 }
268 attrs.nas_ipv6_addr = buf;
269 }
270 #endif /* CONFIG_IPV6 */
271
272 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_NAS_IDENTIFIER,
273 &buf, &len, NULL) == 0) {
274 attrs.nas_identifier = buf;
275 attrs.nas_identifier_len = len;
276 }
277
278 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_CALLING_STATION_ID,
279 &buf, &len, NULL) == 0) {
280 if (len >= sizeof(tmp))
281 len = sizeof(tmp) - 1;
282 os_memcpy(tmp, buf, len);
283 tmp[len] = '\0';
284 if (hwaddr_aton2(tmp, sta_addr) < 0) {
285 wpa_printf(MSG_INFO, "DAS: Invalid Calling-Station-Id "
286 "'%s' from %s:%d", tmp, abuf, from_port);
287 error = 407;
288 goto fail;
289 }
290 attrs.sta_addr = sta_addr;
291 }
292
293 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_USER_NAME,
294 &buf, &len, NULL) == 0) {
295 attrs.user_name = buf;
296 attrs.user_name_len = len;
297 }
298
299 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_ACCT_SESSION_ID,
300 &buf, &len, NULL) == 0) {
301 attrs.acct_session_id = buf;
302 attrs.acct_session_id_len = len;
303 }
304
305 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_ACCT_MULTI_SESSION_ID,
306 &buf, &len, NULL) == 0) {
307 attrs.acct_multi_session_id = buf;
308 attrs.acct_multi_session_id_len = len;
309 }
310
311 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_CHARGEABLE_USER_IDENTITY,
312 &buf, &len, NULL) == 0) {
313 attrs.cui = buf;
314 attrs.cui_len = len;
315 }
316
317 #ifdef CONFIG_HS20
318 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_VENDOR_SPECIFIC,
319 &buf, &len, NULL) == 0) {
320 if (len < 10 || WPA_GET_BE32(buf) != RADIUS_VENDOR_ID_WFA ||
321 buf[4] != RADIUS_VENDOR_ATTR_WFA_HS20_T_C_FILTERING ||
322 buf[5] < 6) {
323 wpa_printf(MSG_INFO,
324 "DAS: Unsupported attribute %u in CoA-Request from %s:%d",
325 attr, abuf, from_port);
326 error = 401;
327 goto fail;
328 }
329 attrs.hs20_t_c_filtering = &buf[6];
330 }
331
332 if (!attrs.hs20_t_c_filtering) {
333 wpa_printf(MSG_INFO,
334 "DAS: No supported authorization change attribute in CoA-Request from %s:%d",
335 abuf, from_port);
336 error = 402;
337 goto fail;
338 }
339 #endif /* CONFIG_HS20 */
340
341 res = das->coa(das->ctx, &attrs);
342 switch (res) {
343 case RADIUS_DAS_NAS_MISMATCH:
344 wpa_printf(MSG_INFO, "DAS: NAS mismatch from %s:%d",
345 abuf, from_port);
346 error = 403;
347 break;
348 case RADIUS_DAS_SESSION_NOT_FOUND:
349 wpa_printf(MSG_INFO,
350 "DAS: Session not found for request from %s:%d",
351 abuf, from_port);
352 error = 503;
353 break;
354 case RADIUS_DAS_MULTI_SESSION_MATCH:
355 wpa_printf(MSG_INFO,
356 "DAS: Multiple sessions match for request from %s:%d",
357 abuf, from_port);
358 error = 508;
359 break;
360 case RADIUS_DAS_COA_FAILED:
361 wpa_printf(MSG_INFO, "DAS: CoA failed for request from %s:%d",
362 abuf, from_port);
363 error = 407;
364 break;
365 case RADIUS_DAS_SUCCESS:
366 error = 0;
367 break;
368 }
369
370 fail:
371 reply = radius_msg_new(error ? RADIUS_CODE_COA_NAK :
372 RADIUS_CODE_COA_ACK, hdr->identifier);
373 if (!reply)
374 return NULL;
375
376 if (!radius_msg_add_msg_auth(reply)) {
377 radius_msg_free(reply);
378 return NULL;
379 }
380
381 if (error &&
382 !radius_msg_add_attr_int32(reply, RADIUS_ATTR_ERROR_CAUSE, error)) {
383 radius_msg_free(reply);
384 return NULL;
385 }
386
387 return reply;
388 }
389
390
radius_das_receive(int sock,void * eloop_ctx,void * sock_ctx)391 static void radius_das_receive(int sock, void *eloop_ctx, void *sock_ctx)
392 {
393 struct radius_das_data *das = eloop_ctx;
394 u8 buf[1500];
395 union {
396 struct sockaddr_storage ss;
397 struct sockaddr_in sin;
398 #ifdef CONFIG_IPV6
399 struct sockaddr_in6 sin6;
400 #endif /* CONFIG_IPV6 */
401 } from;
402 char abuf[50];
403 int from_port = 0;
404 socklen_t fromlen;
405 int len;
406 struct radius_msg *msg, *reply = NULL;
407 struct radius_hdr *hdr;
408 struct wpabuf *rbuf;
409 u32 val;
410 int res;
411 struct os_time now;
412
413 fromlen = sizeof(from);
414 len = recvfrom(sock, buf, sizeof(buf), 0,
415 (struct sockaddr *) &from.ss, &fromlen);
416 if (len < 0) {
417 wpa_printf(MSG_ERROR, "DAS: recvfrom: %s", strerror(errno));
418 return;
419 }
420
421 os_strlcpy(abuf, inet_ntoa(from.sin.sin_addr), sizeof(abuf));
422 from_port = ntohs(from.sin.sin_port);
423
424 wpa_printf(MSG_DEBUG, "DAS: Received %d bytes from %s:%d",
425 len, abuf, from_port);
426 if (das->client_addr.u.v4.s_addr &&
427 das->client_addr.u.v4.s_addr != from.sin.sin_addr.s_addr) {
428 wpa_printf(MSG_DEBUG, "DAS: Drop message from unknown client");
429 return;
430 }
431
432 msg = radius_msg_parse(buf, len);
433 if (msg == NULL) {
434 wpa_printf(MSG_DEBUG, "DAS: Parsing incoming RADIUS packet "
435 "from %s:%d failed", abuf, from_port);
436 return;
437 }
438
439 if (wpa_debug_level <= MSG_MSGDUMP)
440 radius_msg_dump(msg);
441
442 if (radius_msg_verify_das_req(msg, das->shared_secret,
443 das->shared_secret_len,
444 das->require_message_authenticator)) {
445 wpa_printf(MSG_DEBUG,
446 "DAS: Invalid authenticator or Message-Authenticator in packet from %s:%d - drop",
447 abuf, from_port);
448 goto fail;
449 }
450
451 os_get_time(&now);
452 res = radius_msg_get_attr(msg, RADIUS_ATTR_EVENT_TIMESTAMP,
453 (u8 *) &val, 4);
454 if (res == 4) {
455 u32 timestamp = ntohl(val);
456 if ((unsigned int) abs((int) (now.sec - timestamp)) >
457 das->time_window) {
458 wpa_printf(MSG_DEBUG, "DAS: Unacceptable "
459 "Event-Timestamp (%u; local time %u) in "
460 "packet from %s:%d - drop",
461 timestamp, (unsigned int) now.sec,
462 abuf, from_port);
463 goto fail;
464 }
465 } else if (das->require_event_timestamp) {
466 wpa_printf(MSG_DEBUG, "DAS: Missing Event-Timestamp in packet "
467 "from %s:%d - drop", abuf, from_port);
468 goto fail;
469 }
470
471 hdr = radius_msg_get_hdr(msg);
472
473 switch (hdr->code) {
474 case RADIUS_CODE_DISCONNECT_REQUEST:
475 reply = radius_das_disconnect(das, msg, abuf, from_port);
476 break;
477 case RADIUS_CODE_COA_REQUEST:
478 reply = radius_das_coa(das, msg, abuf, from_port);
479 break;
480 default:
481 wpa_printf(MSG_DEBUG, "DAS: Unexpected RADIUS code %u in "
482 "packet from %s:%d",
483 hdr->code, abuf, from_port);
484 }
485
486 if (reply) {
487 wpa_printf(MSG_DEBUG, "DAS: Reply to %s:%d", abuf, from_port);
488
489 if (!radius_msg_add_attr_int32(reply,
490 RADIUS_ATTR_EVENT_TIMESTAMP,
491 now.sec)) {
492 wpa_printf(MSG_DEBUG, "DAS: Failed to add "
493 "Event-Timestamp attribute");
494 }
495
496 if (radius_msg_finish_das_resp(reply, das->shared_secret,
497 das->shared_secret_len, hdr) <
498 0) {
499 wpa_printf(MSG_DEBUG, "DAS: Failed to add "
500 "Message-Authenticator attribute");
501 }
502
503 if (wpa_debug_level <= MSG_MSGDUMP)
504 radius_msg_dump(reply);
505
506 rbuf = radius_msg_get_buf(reply);
507 res = sendto(das->sock, wpabuf_head(rbuf),
508 wpabuf_len(rbuf), 0,
509 (struct sockaddr *) &from.ss, fromlen);
510 if (res < 0) {
511 wpa_printf(MSG_ERROR, "DAS: sendto(to %s:%d): %s",
512 abuf, from_port, strerror(errno));
513 }
514 }
515
516 fail:
517 radius_msg_free(msg);
518 radius_msg_free(reply);
519 }
520
521
radius_das_open_socket(int port)522 static int radius_das_open_socket(int port)
523 {
524 int s;
525 struct sockaddr_in addr;
526
527 s = socket(PF_INET, SOCK_DGRAM, 0);
528 if (s < 0) {
529 wpa_printf(MSG_INFO, "RADIUS DAS: socket: %s", strerror(errno));
530 return -1;
531 }
532
533 os_memset(&addr, 0, sizeof(addr));
534 addr.sin_family = AF_INET;
535 addr.sin_port = htons(port);
536 if (bind(s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
537 wpa_printf(MSG_INFO, "RADIUS DAS: bind: %s", strerror(errno));
538 close(s);
539 return -1;
540 }
541
542 return s;
543 }
544
545
546 struct radius_das_data *
radius_das_init(struct radius_das_conf * conf)547 radius_das_init(struct radius_das_conf *conf)
548 {
549 struct radius_das_data *das;
550
551 if (conf->port == 0 || conf->shared_secret == NULL ||
552 conf->client_addr == NULL)
553 return NULL;
554
555 das = os_zalloc(sizeof(*das));
556 if (das == NULL)
557 return NULL;
558
559 das->time_window = conf->time_window;
560 das->require_event_timestamp = conf->require_event_timestamp;
561 das->require_message_authenticator =
562 conf->require_message_authenticator;
563 das->ctx = conf->ctx;
564 das->disconnect = conf->disconnect;
565 das->coa = conf->coa;
566
567 os_memcpy(&das->client_addr, conf->client_addr,
568 sizeof(das->client_addr));
569
570 das->shared_secret = os_memdup(conf->shared_secret,
571 conf->shared_secret_len);
572 if (das->shared_secret == NULL) {
573 radius_das_deinit(das);
574 return NULL;
575 }
576 das->shared_secret_len = conf->shared_secret_len;
577
578 das->sock = radius_das_open_socket(conf->port);
579 if (das->sock < 0) {
580 wpa_printf(MSG_ERROR, "Failed to open UDP socket for RADIUS "
581 "DAS");
582 radius_das_deinit(das);
583 return NULL;
584 }
585
586 if (eloop_register_read_sock(das->sock, radius_das_receive, das, NULL))
587 {
588 radius_das_deinit(das);
589 return NULL;
590 }
591
592 return das;
593 }
594
595
radius_das_deinit(struct radius_das_data * das)596 void radius_das_deinit(struct radius_das_data *das)
597 {
598 if (das == NULL)
599 return;
600
601 if (das->sock >= 0) {
602 eloop_unregister_read_sock(das->sock);
603 close(das->sock);
604 }
605
606 os_free(das->shared_secret);
607 os_free(das);
608 }
609