1 /* 2 * hostapd / Configuration helper functions 3 * Copyright (c) 2003-2014, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "utils/includes.h" 10 11 #include "utils/common.h" 12 #include "crypto/sha1.h" 13 #include "radius/radius_client.h" 14 #include "common/ieee802_11_defs.h" 15 #include "common/eapol_common.h" 16 #include "eap_common/eap_wsc_common.h" 17 #include "eap_server/eap.h" 18 #include "wpa_auth.h" 19 #include "sta_info.h" 20 #include "ap_config.h" 21 22 23 static void hostapd_config_free_vlan(struct hostapd_bss_config *bss) 24 { 25 struct hostapd_vlan *vlan, *prev; 26 27 vlan = bss->vlan; 28 prev = NULL; 29 while (vlan) { 30 prev = vlan; 31 vlan = vlan->next; 32 os_free(prev); 33 } 34 35 bss->vlan = NULL; 36 } 37 38 39 void hostapd_config_defaults_bss(struct hostapd_bss_config *bss) 40 { 41 bss->logger_syslog_level = HOSTAPD_LEVEL_INFO; 42 bss->logger_stdout_level = HOSTAPD_LEVEL_INFO; 43 bss->logger_syslog = (unsigned int) -1; 44 bss->logger_stdout = (unsigned int) -1; 45 46 bss->auth_algs = WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED; 47 48 bss->wep_rekeying_period = 300; 49 /* use key0 in individual key and key1 in broadcast key */ 50 bss->broadcast_key_idx_min = 1; 51 bss->broadcast_key_idx_max = 2; 52 bss->eap_reauth_period = 3600; 53 54 bss->wpa_group_rekey = 600; 55 bss->wpa_gmk_rekey = 86400; 56 bss->wpa_key_mgmt = WPA_KEY_MGMT_PSK; 57 bss->wpa_pairwise = WPA_CIPHER_TKIP; 58 bss->wpa_group = WPA_CIPHER_TKIP; 59 bss->rsn_pairwise = 0; 60 61 bss->max_num_sta = MAX_STA_COUNT; 62 63 bss->dtim_period = 2; 64 65 bss->radius_server_auth_port = 1812; 66 bss->ap_max_inactivity = AP_MAX_INACTIVITY; 67 bss->eapol_version = EAPOL_VERSION; 68 69 bss->max_listen_interval = 65535; 70 71 bss->pwd_group = 19; /* ECC: GF(p=256) */ 72 73 #ifdef CONFIG_IEEE80211W 74 bss->assoc_sa_query_max_timeout = 1000; 75 bss->assoc_sa_query_retry_timeout = 201; 76 bss->group_mgmt_cipher = WPA_CIPHER_AES_128_CMAC; 77 #endif /* CONFIG_IEEE80211W */ 78 #ifdef EAP_SERVER_FAST 79 /* both anonymous and authenticated provisioning */ 80 bss->eap_fast_prov = 3; 81 bss->pac_key_lifetime = 7 * 24 * 60 * 60; 82 bss->pac_key_refresh_time = 1 * 24 * 60 * 60; 83 #endif /* EAP_SERVER_FAST */ 84 85 /* Set to -1 as defaults depends on HT in setup */ 86 bss->wmm_enabled = -1; 87 88 #ifdef CONFIG_IEEE80211R 89 bss->ft_over_ds = 1; 90 #endif /* CONFIG_IEEE80211R */ 91 92 bss->radius_das_time_window = 300; 93 94 bss->sae_anti_clogging_threshold = 5; 95 } 96 97 98 struct hostapd_config * hostapd_config_defaults(void) 99 { 100 #define ecw2cw(ecw) ((1 << (ecw)) - 1) 101 102 struct hostapd_config *conf; 103 struct hostapd_bss_config *bss; 104 const int aCWmin = 4, aCWmax = 10; 105 const struct hostapd_wmm_ac_params ac_bk = 106 { aCWmin, aCWmax, 7, 0, 0 }; /* background traffic */ 107 const struct hostapd_wmm_ac_params ac_be = 108 { aCWmin, aCWmax, 3, 0, 0 }; /* best effort traffic */ 109 const struct hostapd_wmm_ac_params ac_vi = /* video traffic */ 110 { aCWmin - 1, aCWmin, 2, 3008 / 32, 0 }; 111 const struct hostapd_wmm_ac_params ac_vo = /* voice traffic */ 112 { aCWmin - 2, aCWmin - 1, 2, 1504 / 32, 0 }; 113 const struct hostapd_tx_queue_params txq_bk = 114 { 7, ecw2cw(aCWmin), ecw2cw(aCWmax), 0 }; 115 const struct hostapd_tx_queue_params txq_be = 116 { 3, ecw2cw(aCWmin), 4 * (ecw2cw(aCWmin) + 1) - 1, 0}; 117 const struct hostapd_tx_queue_params txq_vi = 118 { 1, (ecw2cw(aCWmin) + 1) / 2 - 1, ecw2cw(aCWmin), 30}; 119 const struct hostapd_tx_queue_params txq_vo = 120 { 1, (ecw2cw(aCWmin) + 1) / 4 - 1, 121 (ecw2cw(aCWmin) + 1) / 2 - 1, 15}; 122 123 #undef ecw2cw 124 125 conf = os_zalloc(sizeof(*conf)); 126 bss = os_zalloc(sizeof(*bss)); 127 if (conf == NULL || bss == NULL) { 128 wpa_printf(MSG_ERROR, "Failed to allocate memory for " 129 "configuration data."); 130 os_free(conf); 131 os_free(bss); 132 return NULL; 133 } 134 conf->bss = os_calloc(1, sizeof(struct hostapd_bss_config *)); 135 if (conf->bss == NULL) { 136 os_free(conf); 137 os_free(bss); 138 return NULL; 139 } 140 conf->bss[0] = bss; 141 142 bss->radius = os_zalloc(sizeof(*bss->radius)); 143 if (bss->radius == NULL) { 144 os_free(conf->bss); 145 os_free(conf); 146 os_free(bss); 147 return NULL; 148 } 149 150 hostapd_config_defaults_bss(bss); 151 152 conf->num_bss = 1; 153 154 conf->beacon_int = 100; 155 conf->rts_threshold = -1; /* use driver default: 2347 */ 156 conf->fragm_threshold = -1; /* user driver default: 2346 */ 157 conf->send_probe_response = 1; 158 /* Set to invalid value means do not add Power Constraint IE */ 159 conf->local_pwr_constraint = -1; 160 161 conf->wmm_ac_params[0] = ac_be; 162 conf->wmm_ac_params[1] = ac_bk; 163 conf->wmm_ac_params[2] = ac_vi; 164 conf->wmm_ac_params[3] = ac_vo; 165 166 conf->tx_queue[0] = txq_vo; 167 conf->tx_queue[1] = txq_vi; 168 conf->tx_queue[2] = txq_be; 169 conf->tx_queue[3] = txq_bk; 170 171 conf->ht_capab = HT_CAP_INFO_SMPS_DISABLED; 172 173 conf->ap_table_max_size = 255; 174 conf->ap_table_expiration_time = 60; 175 conf->track_sta_max_age = 180; 176 177 #ifdef CONFIG_TESTING_OPTIONS 178 conf->ignore_probe_probability = 0.0; 179 conf->ignore_auth_probability = 0.0; 180 conf->ignore_assoc_probability = 0.0; 181 conf->ignore_reassoc_probability = 0.0; 182 conf->corrupt_gtk_rekey_mic_probability = 0.0; 183 #endif /* CONFIG_TESTING_OPTIONS */ 184 185 conf->acs = 0; 186 conf->acs_ch_list.num = 0; 187 #ifdef CONFIG_ACS 188 conf->acs_num_scans = 5; 189 #endif /* CONFIG_ACS */ 190 191 return conf; 192 } 193 194 195 int hostapd_mac_comp(const void *a, const void *b) 196 { 197 return os_memcmp(a, b, sizeof(macaddr)); 198 } 199 200 201 int hostapd_mac_comp_empty(const void *a) 202 { 203 macaddr empty = { 0 }; 204 return os_memcmp(a, empty, sizeof(macaddr)); 205 } 206 207 208 static int hostapd_config_read_wpa_psk(const char *fname, 209 struct hostapd_ssid *ssid) 210 { 211 FILE *f; 212 char buf[128], *pos; 213 int line = 0, ret = 0, len, ok; 214 u8 addr[ETH_ALEN]; 215 struct hostapd_wpa_psk *psk; 216 217 if (!fname) 218 return 0; 219 220 f = fopen(fname, "r"); 221 if (!f) { 222 wpa_printf(MSG_ERROR, "WPA PSK file '%s' not found.", fname); 223 return -1; 224 } 225 226 while (fgets(buf, sizeof(buf), f)) { 227 line++; 228 229 if (buf[0] == '#') 230 continue; 231 pos = buf; 232 while (*pos != '\0') { 233 if (*pos == '\n') { 234 *pos = '\0'; 235 break; 236 } 237 pos++; 238 } 239 if (buf[0] == '\0') 240 continue; 241 242 if (hwaddr_aton(buf, addr)) { 243 wpa_printf(MSG_ERROR, "Invalid MAC address '%s' on " 244 "line %d in '%s'", buf, line, fname); 245 ret = -1; 246 break; 247 } 248 249 psk = os_zalloc(sizeof(*psk)); 250 if (psk == NULL) { 251 wpa_printf(MSG_ERROR, "WPA PSK allocation failed"); 252 ret = -1; 253 break; 254 } 255 if (is_zero_ether_addr(addr)) 256 psk->group = 1; 257 else 258 os_memcpy(psk->addr, addr, ETH_ALEN); 259 260 pos = buf + 17; 261 if (*pos == '\0') { 262 wpa_printf(MSG_ERROR, "No PSK on line %d in '%s'", 263 line, fname); 264 os_free(psk); 265 ret = -1; 266 break; 267 } 268 pos++; 269 270 ok = 0; 271 len = os_strlen(pos); 272 if (len == 64 && hexstr2bin(pos, psk->psk, PMK_LEN) == 0) 273 ok = 1; 274 else if (len >= 8 && len < 64) { 275 pbkdf2_sha1(pos, ssid->ssid, ssid->ssid_len, 276 4096, psk->psk, PMK_LEN); 277 ok = 1; 278 } 279 if (!ok) { 280 wpa_printf(MSG_ERROR, "Invalid PSK '%s' on line %d in " 281 "'%s'", pos, line, fname); 282 os_free(psk); 283 ret = -1; 284 break; 285 } 286 287 psk->next = ssid->wpa_psk; 288 ssid->wpa_psk = psk; 289 } 290 291 fclose(f); 292 293 return ret; 294 } 295 296 297 static int hostapd_derive_psk(struct hostapd_ssid *ssid) 298 { 299 ssid->wpa_psk = os_zalloc(sizeof(struct hostapd_wpa_psk)); 300 if (ssid->wpa_psk == NULL) { 301 wpa_printf(MSG_ERROR, "Unable to alloc space for PSK"); 302 return -1; 303 } 304 wpa_hexdump_ascii(MSG_DEBUG, "SSID", 305 (u8 *) ssid->ssid, ssid->ssid_len); 306 wpa_hexdump_ascii_key(MSG_DEBUG, "PSK (ASCII passphrase)", 307 (u8 *) ssid->wpa_passphrase, 308 os_strlen(ssid->wpa_passphrase)); 309 pbkdf2_sha1(ssid->wpa_passphrase, 310 ssid->ssid, ssid->ssid_len, 311 4096, ssid->wpa_psk->psk, PMK_LEN); 312 wpa_hexdump_key(MSG_DEBUG, "PSK (from passphrase)", 313 ssid->wpa_psk->psk, PMK_LEN); 314 return 0; 315 } 316 317 318 int hostapd_setup_wpa_psk(struct hostapd_bss_config *conf) 319 { 320 struct hostapd_ssid *ssid = &conf->ssid; 321 322 if (ssid->wpa_passphrase != NULL) { 323 if (ssid->wpa_psk != NULL) { 324 wpa_printf(MSG_DEBUG, "Using pre-configured WPA PSK " 325 "instead of passphrase"); 326 } else { 327 wpa_printf(MSG_DEBUG, "Deriving WPA PSK based on " 328 "passphrase"); 329 if (hostapd_derive_psk(ssid) < 0) 330 return -1; 331 } 332 ssid->wpa_psk->group = 1; 333 } 334 335 if (ssid->wpa_psk_file) { 336 if (hostapd_config_read_wpa_psk(ssid->wpa_psk_file, 337 &conf->ssid)) 338 return -1; 339 } 340 341 return 0; 342 } 343 344 345 static void hostapd_config_free_radius(struct hostapd_radius_server *servers, 346 int num_servers) 347 { 348 int i; 349 350 for (i = 0; i < num_servers; i++) { 351 os_free(servers[i].shared_secret); 352 } 353 os_free(servers); 354 } 355 356 357 struct hostapd_radius_attr * 358 hostapd_config_get_radius_attr(struct hostapd_radius_attr *attr, u8 type) 359 { 360 for (; attr; attr = attr->next) { 361 if (attr->type == type) 362 return attr; 363 } 364 return NULL; 365 } 366 367 368 static void hostapd_config_free_radius_attr(struct hostapd_radius_attr *attr) 369 { 370 struct hostapd_radius_attr *prev; 371 372 while (attr) { 373 prev = attr; 374 attr = attr->next; 375 wpabuf_free(prev->val); 376 os_free(prev); 377 } 378 } 379 380 381 void hostapd_config_free_eap_user(struct hostapd_eap_user *user) 382 { 383 hostapd_config_free_radius_attr(user->accept_attr); 384 os_free(user->identity); 385 bin_clear_free(user->password, user->password_len); 386 os_free(user); 387 } 388 389 390 static void hostapd_config_free_wep(struct hostapd_wep_keys *keys) 391 { 392 int i; 393 for (i = 0; i < NUM_WEP_KEYS; i++) { 394 bin_clear_free(keys->key[i], keys->len[i]); 395 keys->key[i] = NULL; 396 } 397 } 398 399 400 void hostapd_config_clear_wpa_psk(struct hostapd_wpa_psk **l) 401 { 402 struct hostapd_wpa_psk *psk, *tmp; 403 404 for (psk = *l; psk;) { 405 tmp = psk; 406 psk = psk->next; 407 bin_clear_free(tmp, sizeof(*tmp)); 408 } 409 *l = NULL; 410 } 411 412 413 void hostapd_config_free_bss(struct hostapd_bss_config *conf) 414 { 415 struct hostapd_eap_user *user, *prev_user; 416 417 if (conf == NULL) 418 return; 419 420 hostapd_config_clear_wpa_psk(&conf->ssid.wpa_psk); 421 422 str_clear_free(conf->ssid.wpa_passphrase); 423 os_free(conf->ssid.wpa_psk_file); 424 hostapd_config_free_wep(&conf->ssid.wep); 425 #ifdef CONFIG_FULL_DYNAMIC_VLAN 426 os_free(conf->ssid.vlan_tagged_interface); 427 #endif /* CONFIG_FULL_DYNAMIC_VLAN */ 428 429 user = conf->eap_user; 430 while (user) { 431 prev_user = user; 432 user = user->next; 433 hostapd_config_free_eap_user(prev_user); 434 } 435 os_free(conf->eap_user_sqlite); 436 437 os_free(conf->eap_req_id_text); 438 os_free(conf->erp_domain); 439 os_free(conf->accept_mac); 440 os_free(conf->deny_mac); 441 os_free(conf->nas_identifier); 442 if (conf->radius) { 443 hostapd_config_free_radius(conf->radius->auth_servers, 444 conf->radius->num_auth_servers); 445 hostapd_config_free_radius(conf->radius->acct_servers, 446 conf->radius->num_acct_servers); 447 } 448 hostapd_config_free_radius_attr(conf->radius_auth_req_attr); 449 hostapd_config_free_radius_attr(conf->radius_acct_req_attr); 450 os_free(conf->rsn_preauth_interfaces); 451 os_free(conf->ctrl_interface); 452 os_free(conf->ca_cert); 453 os_free(conf->server_cert); 454 os_free(conf->private_key); 455 os_free(conf->private_key_passwd); 456 os_free(conf->ocsp_stapling_response); 457 os_free(conf->dh_file); 458 os_free(conf->openssl_ciphers); 459 os_free(conf->pac_opaque_encr_key); 460 os_free(conf->eap_fast_a_id); 461 os_free(conf->eap_fast_a_id_info); 462 os_free(conf->eap_sim_db); 463 os_free(conf->radius_server_clients); 464 os_free(conf->radius); 465 os_free(conf->radius_das_shared_secret); 466 hostapd_config_free_vlan(conf); 467 os_free(conf->time_zone); 468 469 #ifdef CONFIG_IEEE80211R 470 { 471 struct ft_remote_r0kh *r0kh, *r0kh_prev; 472 struct ft_remote_r1kh *r1kh, *r1kh_prev; 473 474 r0kh = conf->r0kh_list; 475 conf->r0kh_list = NULL; 476 while (r0kh) { 477 r0kh_prev = r0kh; 478 r0kh = r0kh->next; 479 os_free(r0kh_prev); 480 } 481 482 r1kh = conf->r1kh_list; 483 conf->r1kh_list = NULL; 484 while (r1kh) { 485 r1kh_prev = r1kh; 486 r1kh = r1kh->next; 487 os_free(r1kh_prev); 488 } 489 } 490 #endif /* CONFIG_IEEE80211R */ 491 492 #ifdef CONFIG_WPS 493 os_free(conf->wps_pin_requests); 494 os_free(conf->device_name); 495 os_free(conf->manufacturer); 496 os_free(conf->model_name); 497 os_free(conf->model_number); 498 os_free(conf->serial_number); 499 os_free(conf->config_methods); 500 os_free(conf->ap_pin); 501 os_free(conf->extra_cred); 502 os_free(conf->ap_settings); 503 os_free(conf->upnp_iface); 504 os_free(conf->friendly_name); 505 os_free(conf->manufacturer_url); 506 os_free(conf->model_description); 507 os_free(conf->model_url); 508 os_free(conf->upc); 509 { 510 unsigned int i; 511 512 for (i = 0; i < MAX_WPS_VENDOR_EXTENSIONS; i++) 513 wpabuf_free(conf->wps_vendor_ext[i]); 514 } 515 wpabuf_free(conf->wps_nfc_dh_pubkey); 516 wpabuf_free(conf->wps_nfc_dh_privkey); 517 wpabuf_free(conf->wps_nfc_dev_pw); 518 #endif /* CONFIG_WPS */ 519 520 os_free(conf->roaming_consortium); 521 os_free(conf->venue_name); 522 os_free(conf->nai_realm_data); 523 os_free(conf->network_auth_type); 524 os_free(conf->anqp_3gpp_cell_net); 525 os_free(conf->domain_name); 526 527 #ifdef CONFIG_RADIUS_TEST 528 os_free(conf->dump_msk_file); 529 #endif /* CONFIG_RADIUS_TEST */ 530 531 #ifdef CONFIG_HS20 532 os_free(conf->hs20_oper_friendly_name); 533 os_free(conf->hs20_wan_metrics); 534 os_free(conf->hs20_connection_capability); 535 os_free(conf->hs20_operating_class); 536 os_free(conf->hs20_icons); 537 if (conf->hs20_osu_providers) { 538 size_t i; 539 for (i = 0; i < conf->hs20_osu_providers_count; i++) { 540 struct hs20_osu_provider *p; 541 size_t j; 542 p = &conf->hs20_osu_providers[i]; 543 os_free(p->friendly_name); 544 os_free(p->server_uri); 545 os_free(p->method_list); 546 for (j = 0; j < p->icons_count; j++) 547 os_free(p->icons[j]); 548 os_free(p->icons); 549 os_free(p->osu_nai); 550 os_free(p->service_desc); 551 } 552 os_free(conf->hs20_osu_providers); 553 } 554 os_free(conf->subscr_remediation_url); 555 #endif /* CONFIG_HS20 */ 556 557 wpabuf_free(conf->vendor_elements); 558 559 os_free(conf->sae_groups); 560 561 os_free(conf->wowlan_triggers); 562 563 os_free(conf->server_id); 564 565 #ifdef CONFIG_TESTING_OPTIONS 566 wpabuf_free(conf->own_ie_override); 567 #endif /* CONFIG_TESTING_OPTIONS */ 568 569 os_free(conf->no_probe_resp_if_seen_on); 570 os_free(conf->no_auth_if_seen_on); 571 572 os_free(conf); 573 } 574 575 576 /** 577 * hostapd_config_free - Free hostapd configuration 578 * @conf: Configuration data from hostapd_config_read(). 579 */ 580 void hostapd_config_free(struct hostapd_config *conf) 581 { 582 size_t i; 583 584 if (conf == NULL) 585 return; 586 587 for (i = 0; i < conf->num_bss; i++) 588 hostapd_config_free_bss(conf->bss[i]); 589 os_free(conf->bss); 590 os_free(conf->supported_rates); 591 os_free(conf->basic_rates); 592 os_free(conf->acs_ch_list.range); 593 os_free(conf->driver_params); 594 #ifdef CONFIG_ACS 595 os_free(conf->acs_chan_bias); 596 #endif /* CONFIG_ACS */ 597 598 os_free(conf); 599 } 600 601 602 /** 603 * hostapd_maclist_found - Find a MAC address from a list 604 * @list: MAC address list 605 * @num_entries: Number of addresses in the list 606 * @addr: Address to search for 607 * @vlan_id: Buffer for returning VLAN ID or %NULL if not needed 608 * Returns: 1 if address is in the list or 0 if not. 609 * 610 * Perform a binary search for given MAC address from a pre-sorted list. 611 */ 612 int hostapd_maclist_found(struct mac_acl_entry *list, int num_entries, 613 const u8 *addr, int *vlan_id) 614 { 615 int start, end, middle, res; 616 617 start = 0; 618 end = num_entries - 1; 619 620 while (start <= end) { 621 middle = (start + end) / 2; 622 res = os_memcmp(list[middle].addr, addr, ETH_ALEN); 623 if (res == 0) { 624 if (vlan_id) 625 *vlan_id = list[middle].vlan_id; 626 return 1; 627 } 628 if (res < 0) 629 start = middle + 1; 630 else 631 end = middle - 1; 632 } 633 634 return 0; 635 } 636 637 638 int hostapd_rate_found(int *list, int rate) 639 { 640 int i; 641 642 if (list == NULL) 643 return 0; 644 645 for (i = 0; list[i] >= 0; i++) 646 if (list[i] == rate) 647 return 1; 648 649 return 0; 650 } 651 652 653 int hostapd_vlan_id_valid(struct hostapd_vlan *vlan, int vlan_id) 654 { 655 struct hostapd_vlan *v = vlan; 656 while (v) { 657 if (v->vlan_id == vlan_id || v->vlan_id == VLAN_ID_WILDCARD) 658 return 1; 659 v = v->next; 660 } 661 return 0; 662 } 663 664 665 const char * hostapd_get_vlan_id_ifname(struct hostapd_vlan *vlan, int vlan_id) 666 { 667 struct hostapd_vlan *v = vlan; 668 while (v) { 669 if (v->vlan_id == vlan_id) 670 return v->ifname; 671 v = v->next; 672 } 673 return NULL; 674 } 675 676 677 const u8 * hostapd_get_psk(const struct hostapd_bss_config *conf, 678 const u8 *addr, const u8 *p2p_dev_addr, 679 const u8 *prev_psk) 680 { 681 struct hostapd_wpa_psk *psk; 682 int next_ok = prev_psk == NULL; 683 684 if (p2p_dev_addr && !is_zero_ether_addr(p2p_dev_addr)) { 685 wpa_printf(MSG_DEBUG, "Searching a PSK for " MACSTR 686 " p2p_dev_addr=" MACSTR " prev_psk=%p", 687 MAC2STR(addr), MAC2STR(p2p_dev_addr), prev_psk); 688 addr = NULL; /* Use P2P Device Address for matching */ 689 } else { 690 wpa_printf(MSG_DEBUG, "Searching a PSK for " MACSTR 691 " prev_psk=%p", 692 MAC2STR(addr), prev_psk); 693 } 694 695 for (psk = conf->ssid.wpa_psk; psk != NULL; psk = psk->next) { 696 if (next_ok && 697 (psk->group || 698 (addr && os_memcmp(psk->addr, addr, ETH_ALEN) == 0) || 699 (!addr && p2p_dev_addr && 700 os_memcmp(psk->p2p_dev_addr, p2p_dev_addr, ETH_ALEN) == 701 0))) 702 return psk->psk; 703 704 if (psk->psk == prev_psk) 705 next_ok = 1; 706 } 707 708 return NULL; 709 } 710 711 712 static int hostapd_config_check_bss(struct hostapd_bss_config *bss, 713 struct hostapd_config *conf, 714 int full_config) 715 { 716 if (full_config && bss->ieee802_1x && !bss->eap_server && 717 !bss->radius->auth_servers) { 718 wpa_printf(MSG_ERROR, "Invalid IEEE 802.1X configuration (no " 719 "EAP authenticator configured)."); 720 return -1; 721 } 722 723 if (bss->wpa) { 724 int wep, i; 725 726 wep = bss->default_wep_key_len > 0 || 727 bss->individual_wep_key_len > 0; 728 for (i = 0; i < NUM_WEP_KEYS; i++) { 729 if (bss->ssid.wep.keys_set) { 730 wep = 1; 731 break; 732 } 733 } 734 735 if (wep) { 736 wpa_printf(MSG_ERROR, "WEP configuration in a WPA network is not supported"); 737 return -1; 738 } 739 } 740 741 if (full_config && bss->wpa && 742 bss->wpa_psk_radius != PSK_RADIUS_IGNORED && 743 bss->macaddr_acl != USE_EXTERNAL_RADIUS_AUTH) { 744 wpa_printf(MSG_ERROR, "WPA-PSK using RADIUS enabled, but no " 745 "RADIUS checking (macaddr_acl=2) enabled."); 746 return -1; 747 } 748 749 if (full_config && bss->wpa && (bss->wpa_key_mgmt & WPA_KEY_MGMT_PSK) && 750 bss->ssid.wpa_psk == NULL && bss->ssid.wpa_passphrase == NULL && 751 bss->ssid.wpa_psk_file == NULL && 752 (bss->wpa_psk_radius != PSK_RADIUS_REQUIRED || 753 bss->macaddr_acl != USE_EXTERNAL_RADIUS_AUTH)) { 754 wpa_printf(MSG_ERROR, "WPA-PSK enabled, but PSK or passphrase " 755 "is not configured."); 756 return -1; 757 } 758 759 if (full_config && hostapd_mac_comp_empty(bss->bssid) != 0) { 760 size_t i; 761 762 for (i = 0; i < conf->num_bss; i++) { 763 if (conf->bss[i] != bss && 764 (hostapd_mac_comp(conf->bss[i]->bssid, 765 bss->bssid) == 0)) { 766 wpa_printf(MSG_ERROR, "Duplicate BSSID " MACSTR 767 " on interface '%s' and '%s'.", 768 MAC2STR(bss->bssid), 769 conf->bss[i]->iface, bss->iface); 770 return -1; 771 } 772 } 773 } 774 775 #ifdef CONFIG_IEEE80211R 776 if (full_config && wpa_key_mgmt_ft(bss->wpa_key_mgmt) && 777 (bss->nas_identifier == NULL || 778 os_strlen(bss->nas_identifier) < 1 || 779 os_strlen(bss->nas_identifier) > FT_R0KH_ID_MAX_LEN)) { 780 wpa_printf(MSG_ERROR, "FT (IEEE 802.11r) requires " 781 "nas_identifier to be configured as a 1..48 octet " 782 "string"); 783 return -1; 784 } 785 #endif /* CONFIG_IEEE80211R */ 786 787 #ifdef CONFIG_IEEE80211N 788 if (full_config && conf->ieee80211n && 789 conf->hw_mode == HOSTAPD_MODE_IEEE80211B) { 790 bss->disable_11n = 1; 791 wpa_printf(MSG_ERROR, "HT (IEEE 802.11n) in 11b mode is not " 792 "allowed, disabling HT capabilities"); 793 } 794 795 if (full_config && conf->ieee80211n && 796 bss->ssid.security_policy == SECURITY_STATIC_WEP) { 797 bss->disable_11n = 1; 798 wpa_printf(MSG_ERROR, "HT (IEEE 802.11n) with WEP is not " 799 "allowed, disabling HT capabilities"); 800 } 801 802 if (full_config && conf->ieee80211n && bss->wpa && 803 !(bss->wpa_pairwise & WPA_CIPHER_CCMP) && 804 !(bss->rsn_pairwise & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP | 805 WPA_CIPHER_CCMP_256 | WPA_CIPHER_GCMP_256))) 806 { 807 bss->disable_11n = 1; 808 wpa_printf(MSG_ERROR, "HT (IEEE 802.11n) with WPA/WPA2 " 809 "requires CCMP/GCMP to be enabled, disabling HT " 810 "capabilities"); 811 } 812 #endif /* CONFIG_IEEE80211N */ 813 814 #ifdef CONFIG_WPS 815 if (full_config && bss->wps_state && bss->ignore_broadcast_ssid) { 816 wpa_printf(MSG_INFO, "WPS: ignore_broadcast_ssid " 817 "configuration forced WPS to be disabled"); 818 bss->wps_state = 0; 819 } 820 821 if (full_config && bss->wps_state && 822 bss->ssid.wep.keys_set && bss->wpa == 0) { 823 wpa_printf(MSG_INFO, "WPS: WEP configuration forced WPS to be " 824 "disabled"); 825 bss->wps_state = 0; 826 } 827 828 if (full_config && bss->wps_state && bss->wpa && 829 (!(bss->wpa & 2) || 830 !(bss->rsn_pairwise & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP)))) { 831 wpa_printf(MSG_INFO, "WPS: WPA/TKIP configuration without " 832 "WPA2/CCMP/GCMP forced WPS to be disabled"); 833 bss->wps_state = 0; 834 } 835 #endif /* CONFIG_WPS */ 836 837 #ifdef CONFIG_HS20 838 if (full_config && bss->hs20 && 839 (!(bss->wpa & 2) || 840 !(bss->rsn_pairwise & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP | 841 WPA_CIPHER_CCMP_256 | 842 WPA_CIPHER_GCMP_256)))) { 843 wpa_printf(MSG_ERROR, "HS 2.0: WPA2-Enterprise/CCMP " 844 "configuration is required for Hotspot 2.0 " 845 "functionality"); 846 return -1; 847 } 848 #endif /* CONFIG_HS20 */ 849 850 return 0; 851 } 852 853 854 static int hostapd_config_check_cw(struct hostapd_config *conf, int queue) 855 { 856 int tx_cwmin = conf->tx_queue[queue].cwmin; 857 int tx_cwmax = conf->tx_queue[queue].cwmax; 858 int ac_cwmin = conf->wmm_ac_params[queue].cwmin; 859 int ac_cwmax = conf->wmm_ac_params[queue].cwmax; 860 861 if (tx_cwmin > tx_cwmax) { 862 wpa_printf(MSG_ERROR, 863 "Invalid TX queue cwMin/cwMax values. cwMin(%d) greater than cwMax(%d)", 864 tx_cwmin, tx_cwmax); 865 return -1; 866 } 867 if (ac_cwmin > ac_cwmax) { 868 wpa_printf(MSG_ERROR, 869 "Invalid WMM AC cwMin/cwMax values. cwMin(%d) greater than cwMax(%d)", 870 ac_cwmin, ac_cwmax); 871 return -1; 872 } 873 return 0; 874 } 875 876 877 int hostapd_config_check(struct hostapd_config *conf, int full_config) 878 { 879 size_t i; 880 881 if (full_config && conf->ieee80211d && 882 (!conf->country[0] || !conf->country[1])) { 883 wpa_printf(MSG_ERROR, "Cannot enable IEEE 802.11d without " 884 "setting the country_code"); 885 return -1; 886 } 887 888 if (full_config && conf->ieee80211h && !conf->ieee80211d) { 889 wpa_printf(MSG_ERROR, "Cannot enable IEEE 802.11h without " 890 "IEEE 802.11d enabled"); 891 return -1; 892 } 893 894 if (full_config && conf->local_pwr_constraint != -1 && 895 !conf->ieee80211d) { 896 wpa_printf(MSG_ERROR, "Cannot add Power Constraint element without Country element"); 897 return -1; 898 } 899 900 if (full_config && conf->spectrum_mgmt_required && 901 conf->local_pwr_constraint == -1) { 902 wpa_printf(MSG_ERROR, "Cannot set Spectrum Management bit without Country and Power Constraint elements"); 903 return -1; 904 } 905 906 for (i = 0; i < NUM_TX_QUEUES; i++) { 907 if (hostapd_config_check_cw(conf, i)) 908 return -1; 909 } 910 911 for (i = 0; i < conf->num_bss; i++) { 912 if (hostapd_config_check_bss(conf->bss[i], conf, full_config)) 913 return -1; 914 } 915 916 return 0; 917 } 918 919 920 void hostapd_set_security_params(struct hostapd_bss_config *bss, 921 int full_config) 922 { 923 if (bss->individual_wep_key_len == 0) { 924 /* individual keys are not use; can use key idx0 for 925 * broadcast keys */ 926 bss->broadcast_key_idx_min = 0; 927 } 928 929 if ((bss->wpa & 2) && bss->rsn_pairwise == 0) 930 bss->rsn_pairwise = bss->wpa_pairwise; 931 bss->wpa_group = wpa_select_ap_group_cipher(bss->wpa, bss->wpa_pairwise, 932 bss->rsn_pairwise); 933 934 if (full_config) { 935 bss->radius->auth_server = bss->radius->auth_servers; 936 bss->radius->acct_server = bss->radius->acct_servers; 937 } 938 939 if (bss->wpa && bss->ieee802_1x) { 940 bss->ssid.security_policy = SECURITY_WPA; 941 } else if (bss->wpa) { 942 bss->ssid.security_policy = SECURITY_WPA_PSK; 943 } else if (bss->ieee802_1x) { 944 int cipher = WPA_CIPHER_NONE; 945 bss->ssid.security_policy = SECURITY_IEEE_802_1X; 946 bss->ssid.wep.default_len = bss->default_wep_key_len; 947 if (full_config && bss->default_wep_key_len) { 948 cipher = bss->default_wep_key_len >= 13 ? 949 WPA_CIPHER_WEP104 : WPA_CIPHER_WEP40; 950 } else if (full_config && bss->ssid.wep.keys_set) { 951 if (bss->ssid.wep.len[0] >= 13) 952 cipher = WPA_CIPHER_WEP104; 953 else 954 cipher = WPA_CIPHER_WEP40; 955 } 956 bss->wpa_group = cipher; 957 bss->wpa_pairwise = cipher; 958 bss->rsn_pairwise = cipher; 959 if (full_config) 960 bss->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA; 961 } else if (bss->ssid.wep.keys_set) { 962 int cipher = WPA_CIPHER_WEP40; 963 if (bss->ssid.wep.len[0] >= 13) 964 cipher = WPA_CIPHER_WEP104; 965 bss->ssid.security_policy = SECURITY_STATIC_WEP; 966 bss->wpa_group = cipher; 967 bss->wpa_pairwise = cipher; 968 bss->rsn_pairwise = cipher; 969 if (full_config) 970 bss->wpa_key_mgmt = WPA_KEY_MGMT_NONE; 971 } else if (bss->osen) { 972 bss->ssid.security_policy = SECURITY_OSEN; 973 bss->wpa_group = WPA_CIPHER_CCMP; 974 bss->wpa_pairwise = 0; 975 bss->rsn_pairwise = WPA_CIPHER_CCMP; 976 } else { 977 bss->ssid.security_policy = SECURITY_PLAINTEXT; 978 if (full_config) { 979 bss->wpa_group = WPA_CIPHER_NONE; 980 bss->wpa_pairwise = WPA_CIPHER_NONE; 981 bss->rsn_pairwise = WPA_CIPHER_NONE; 982 bss->wpa_key_mgmt = WPA_KEY_MGMT_NONE; 983 } 984 } 985 } 986