1 /* 2 * Authentication server setup 3 * Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "utils/includes.h" 10 11 #include "utils/common.h" 12 #include "crypto/crypto.h" 13 #include "crypto/tls.h" 14 #include "eap_server/eap.h" 15 #include "eap_server/eap_sim_db.h" 16 #include "eapol_auth/eapol_auth_sm.h" 17 #include "radius/radius_server.h" 18 #include "hostapd.h" 19 #include "ap_config.h" 20 #include "sta_info.h" 21 #include "authsrv.h" 22 23 24 #if defined(EAP_SERVER_SIM) || defined(EAP_SERVER_AKA) 25 #define EAP_SIM_DB 26 #endif /* EAP_SERVER_SIM || EAP_SERVER_AKA */ 27 28 29 #ifdef EAP_SIM_DB 30 static int hostapd_sim_db_cb_sta(struct hostapd_data *hapd, 31 struct sta_info *sta, void *ctx) 32 { 33 if (eapol_auth_eap_pending_cb(sta->eapol_sm, ctx) == 0) 34 return 1; 35 return 0; 36 } 37 38 39 static void hostapd_sim_db_cb(void *ctx, void *session_ctx) 40 { 41 struct hostapd_data *hapd = ctx; 42 if (ap_for_each_sta(hapd, hostapd_sim_db_cb_sta, session_ctx) == 0) { 43 #ifdef RADIUS_SERVER 44 radius_server_eap_pending_cb(hapd->radius_srv, session_ctx); 45 #endif /* RADIUS_SERVER */ 46 } 47 } 48 #endif /* EAP_SIM_DB */ 49 50 51 #ifdef RADIUS_SERVER 52 53 static int hostapd_radius_get_eap_user(void *ctx, const u8 *identity, 54 size_t identity_len, int phase2, 55 struct eap_user *user) 56 { 57 const struct hostapd_eap_user *eap_user; 58 int i; 59 int rv = -1; 60 61 eap_user = hostapd_get_eap_user(ctx, identity, identity_len, phase2); 62 if (eap_user == NULL) 63 goto out; 64 65 if (user == NULL) 66 return 0; 67 68 os_memset(user, 0, sizeof(*user)); 69 for (i = 0; i < EAP_MAX_METHODS; i++) { 70 user->methods[i].vendor = eap_user->methods[i].vendor; 71 user->methods[i].method = eap_user->methods[i].method; 72 } 73 74 if (eap_user->password) { 75 user->password = os_memdup(eap_user->password, 76 eap_user->password_len); 77 if (user->password == NULL) 78 goto out; 79 user->password_len = eap_user->password_len; 80 user->password_hash = eap_user->password_hash; 81 if (eap_user->salt && eap_user->salt_len) { 82 user->salt = os_memdup(eap_user->salt, 83 eap_user->salt_len); 84 if (!user->salt) 85 goto out; 86 user->salt_len = eap_user->salt_len; 87 } 88 } 89 user->force_version = eap_user->force_version; 90 user->macacl = eap_user->macacl; 91 user->ttls_auth = eap_user->ttls_auth; 92 user->remediation = eap_user->remediation; 93 user->accept_attr = eap_user->accept_attr; 94 user->t_c_timestamp = eap_user->t_c_timestamp; 95 rv = 0; 96 97 out: 98 if (rv) 99 wpa_printf(MSG_DEBUG, "%s: Failed to find user", __func__); 100 101 return rv; 102 } 103 104 105 static int hostapd_setup_radius_srv(struct hostapd_data *hapd) 106 { 107 struct radius_server_conf srv; 108 struct hostapd_bss_config *conf = hapd->conf; 109 110 #ifdef CONFIG_IEEE80211BE 111 if (!hostapd_mld_is_first_bss(hapd)) { 112 struct hostapd_data *first; 113 114 wpa_printf(MSG_DEBUG, 115 "MLD: Using RADIUS server of the first BSS"); 116 117 first = hostapd_mld_get_first_bss(hapd); 118 if (!first) 119 return -1; 120 hapd->radius_srv = first->radius_srv; 121 return 0; 122 } 123 #endif /* CONFIG_IEEE80211BE */ 124 125 os_memset(&srv, 0, sizeof(srv)); 126 srv.client_file = conf->radius_server_clients; 127 srv.auth_port = conf->radius_server_auth_port; 128 srv.acct_port = conf->radius_server_acct_port; 129 srv.conf_ctx = hapd; 130 srv.ipv6 = conf->radius_server_ipv6; 131 srv.get_eap_user = hostapd_radius_get_eap_user; 132 srv.eap_req_id_text = conf->eap_req_id_text; 133 srv.eap_req_id_text_len = conf->eap_req_id_text_len; 134 srv.sqlite_file = conf->eap_user_sqlite; 135 #ifdef CONFIG_RADIUS_TEST 136 srv.dump_msk_file = conf->dump_msk_file; 137 #endif /* CONFIG_RADIUS_TEST */ 138 #ifdef CONFIG_HS20 139 srv.subscr_remediation_url = conf->subscr_remediation_url; 140 srv.subscr_remediation_method = conf->subscr_remediation_method; 141 srv.hs20_sim_provisioning_url = conf->hs20_sim_provisioning_url; 142 srv.t_c_server_url = conf->t_c_server_url; 143 #endif /* CONFIG_HS20 */ 144 srv.erp_domain = conf->erp_domain; 145 srv.eap_cfg = hapd->eap_cfg; 146 147 hapd->radius_srv = radius_server_init(&srv); 148 if (hapd->radius_srv == NULL) { 149 wpa_printf(MSG_ERROR, "RADIUS server initialization failed."); 150 return -1; 151 } 152 153 return 0; 154 } 155 156 #endif /* RADIUS_SERVER */ 157 158 159 #ifdef EAP_TLS_FUNCS 160 static void authsrv_tls_event(void *ctx, enum tls_event ev, 161 union tls_event_data *data) 162 { 163 switch (ev) { 164 case TLS_CERT_CHAIN_SUCCESS: 165 wpa_printf(MSG_DEBUG, "authsrv: remote certificate verification success"); 166 break; 167 case TLS_CERT_CHAIN_FAILURE: 168 wpa_printf(MSG_INFO, "authsrv: certificate chain failure: reason=%d depth=%d subject='%s' err='%s'", 169 data->cert_fail.reason, 170 data->cert_fail.depth, 171 data->cert_fail.subject, 172 data->cert_fail.reason_txt); 173 break; 174 case TLS_PEER_CERTIFICATE: 175 wpa_printf(MSG_DEBUG, "authsrv: peer certificate: depth=%d serial_num=%s subject=%s", 176 data->peer_cert.depth, 177 data->peer_cert.serial_num ? data->peer_cert.serial_num : "N/A", 178 data->peer_cert.subject); 179 break; 180 case TLS_ALERT: 181 if (data->alert.is_local) 182 wpa_printf(MSG_DEBUG, "authsrv: local TLS alert: %s", 183 data->alert.description); 184 else 185 wpa_printf(MSG_DEBUG, "authsrv: remote TLS alert: %s", 186 data->alert.description); 187 break; 188 case TLS_UNSAFE_RENEGOTIATION_DISABLED: 189 /* Not applicable to TLS server */ 190 break; 191 } 192 } 193 #endif /* EAP_TLS_FUNCS */ 194 195 196 static struct eap_config * authsrv_eap_config(struct hostapd_data *hapd) 197 { 198 struct eap_config *cfg; 199 200 cfg = os_zalloc(sizeof(*cfg)); 201 if (!cfg) 202 return NULL; 203 204 cfg->eap_server = hapd->conf->eap_server; 205 cfg->ssl_ctx = hapd->ssl_ctx; 206 cfg->msg_ctx = hapd->msg_ctx; 207 cfg->eap_sim_db_priv = hapd->eap_sim_db_priv; 208 cfg->tls_session_lifetime = hapd->conf->tls_session_lifetime; 209 cfg->tls_flags = hapd->conf->tls_flags; 210 cfg->max_auth_rounds = hapd->conf->max_auth_rounds; 211 cfg->max_auth_rounds_short = hapd->conf->max_auth_rounds_short; 212 if (hapd->conf->pac_opaque_encr_key) 213 cfg->pac_opaque_encr_key = 214 os_memdup(hapd->conf->pac_opaque_encr_key, 16); 215 if (hapd->conf->eap_fast_a_id) { 216 cfg->eap_fast_a_id = os_memdup(hapd->conf->eap_fast_a_id, 217 hapd->conf->eap_fast_a_id_len); 218 cfg->eap_fast_a_id_len = hapd->conf->eap_fast_a_id_len; 219 } 220 if (hapd->conf->eap_fast_a_id_info) 221 cfg->eap_fast_a_id_info = 222 os_strdup(hapd->conf->eap_fast_a_id_info); 223 cfg->eap_fast_prov = hapd->conf->eap_fast_prov; 224 cfg->pac_key_lifetime = hapd->conf->pac_key_lifetime; 225 cfg->pac_key_refresh_time = hapd->conf->pac_key_refresh_time; 226 cfg->eap_teap_auth = hapd->conf->eap_teap_auth; 227 cfg->eap_teap_pac_no_inner = hapd->conf->eap_teap_pac_no_inner; 228 cfg->eap_teap_separate_result = hapd->conf->eap_teap_separate_result; 229 cfg->eap_teap_id = hapd->conf->eap_teap_id; 230 cfg->eap_teap_method_sequence = hapd->conf->eap_teap_method_sequence; 231 cfg->eap_sim_aka_result_ind = hapd->conf->eap_sim_aka_result_ind; 232 cfg->eap_sim_id = hapd->conf->eap_sim_id; 233 cfg->imsi_privacy_key = hapd->imsi_privacy_key; 234 cfg->eap_sim_aka_fast_reauth_limit = 235 hapd->conf->eap_sim_aka_fast_reauth_limit; 236 cfg->tnc = hapd->conf->tnc; 237 cfg->wps = hapd->wps; 238 cfg->fragment_size = hapd->conf->fragment_size; 239 cfg->pwd_group = hapd->conf->pwd_group; 240 cfg->pbc_in_m1 = hapd->conf->pbc_in_m1; 241 if (hapd->conf->server_id) { 242 cfg->server_id = (u8 *) os_strdup(hapd->conf->server_id); 243 cfg->server_id_len = os_strlen(hapd->conf->server_id); 244 } else { 245 cfg->server_id = (u8 *) os_strdup("hostapd"); 246 cfg->server_id_len = 7; 247 } 248 cfg->erp = hapd->conf->eap_server_erp; 249 #ifdef CONFIG_TESTING_OPTIONS 250 cfg->skip_prot_success = hapd->conf->eap_skip_prot_success; 251 #endif /* CONFIG_TESTING_OPTIONS */ 252 253 return cfg; 254 } 255 256 257 int authsrv_init(struct hostapd_data *hapd) 258 { 259 #ifdef CONFIG_IEEE80211BE 260 if (!hostapd_mld_is_first_bss(hapd)) { 261 struct hostapd_data *first; 262 263 first = hostapd_mld_get_first_bss(hapd); 264 if (!first) 265 return -1; 266 267 if (!first->eap_cfg) { 268 wpa_printf(MSG_DEBUG, 269 "MLD: First BSS auth_serv does not exist. Init on its behalf"); 270 271 if (authsrv_init(first)) 272 return -1; 273 } 274 275 wpa_printf(MSG_DEBUG, "MLD: Using auth_serv of the first BSS"); 276 277 #ifdef EAP_TLS_FUNCS 278 hapd->ssl_ctx = first->ssl_ctx; 279 #endif /* EAP_TLS_FUNCS */ 280 hapd->eap_cfg = first->eap_cfg; 281 #ifdef EAP_SIM_DB 282 hapd->eap_sim_db_priv = first->eap_sim_db_priv; 283 #endif /* EAP_SIM_DB */ 284 return 0; 285 } 286 #endif /* CONFIG_IEEE80211BE */ 287 288 #ifdef EAP_TLS_FUNCS 289 if (hapd->conf->eap_server && 290 (hapd->conf->ca_cert || hapd->conf->server_cert || 291 hapd->conf->private_key || hapd->conf->dh_file || 292 hapd->conf->server_cert2 || hapd->conf->private_key2)) { 293 struct tls_config conf; 294 struct tls_connection_params params; 295 296 os_memset(&conf, 0, sizeof(conf)); 297 conf.tls_session_lifetime = hapd->conf->tls_session_lifetime; 298 if (hapd->conf->crl_reload_interval > 0 && 299 hapd->conf->check_crl <= 0) { 300 wpa_printf(MSG_INFO, 301 "Cannot enable CRL reload functionality - it depends on check_crl being set"); 302 } else if (hapd->conf->crl_reload_interval > 0) { 303 conf.crl_reload_interval = 304 hapd->conf->crl_reload_interval; 305 wpa_printf(MSG_INFO, 306 "Enabled CRL reload functionality"); 307 } 308 conf.tls_flags = hapd->conf->tls_flags; 309 conf.event_cb = authsrv_tls_event; 310 conf.cb_ctx = hapd; 311 hapd->ssl_ctx = tls_init(&conf); 312 if (hapd->ssl_ctx == NULL) { 313 wpa_printf(MSG_ERROR, "Failed to initialize TLS"); 314 authsrv_deinit(hapd); 315 return -1; 316 } 317 318 os_memset(¶ms, 0, sizeof(params)); 319 params.ca_cert = hapd->conf->ca_cert; 320 params.client_cert = hapd->conf->server_cert; 321 params.client_cert2 = hapd->conf->server_cert2; 322 params.private_key = hapd->conf->private_key; 323 params.private_key2 = hapd->conf->private_key2; 324 params.private_key_passwd = hapd->conf->private_key_passwd; 325 params.private_key_passwd2 = hapd->conf->private_key_passwd2; 326 params.dh_file = hapd->conf->dh_file; 327 params.openssl_ciphers = hapd->conf->openssl_ciphers; 328 params.openssl_ecdh_curves = hapd->conf->openssl_ecdh_curves; 329 params.ocsp_stapling_response = 330 hapd->conf->ocsp_stapling_response; 331 params.ocsp_stapling_response_multi = 332 hapd->conf->ocsp_stapling_response_multi; 333 params.check_cert_subject = hapd->conf->check_cert_subject; 334 335 if (tls_global_set_params(hapd->ssl_ctx, ¶ms)) { 336 wpa_printf(MSG_ERROR, "Failed to set TLS parameters"); 337 authsrv_deinit(hapd); 338 return -1; 339 } 340 341 if (tls_global_set_verify(hapd->ssl_ctx, 342 hapd->conf->check_crl, 343 hapd->conf->check_crl_strict)) { 344 wpa_printf(MSG_ERROR, "Failed to enable check_crl"); 345 authsrv_deinit(hapd); 346 return -1; 347 } 348 } 349 #endif /* EAP_TLS_FUNCS */ 350 351 #ifdef CRYPTO_RSA_OAEP_SHA256 352 crypto_rsa_key_free(hapd->imsi_privacy_key); 353 hapd->imsi_privacy_key = NULL; 354 if (hapd->conf->imsi_privacy_key) { 355 hapd->imsi_privacy_key = crypto_rsa_key_read( 356 hapd->conf->imsi_privacy_key, true); 357 if (!hapd->imsi_privacy_key) { 358 wpa_printf(MSG_ERROR, 359 "Failed to read/parse IMSI privacy key %s", 360 hapd->conf->imsi_privacy_key); 361 authsrv_deinit(hapd); 362 return -1; 363 } 364 } 365 #endif /* CRYPTO_RSA_OAEP_SHA256 */ 366 367 #ifdef EAP_SIM_DB 368 if (hapd->conf->eap_sim_db) { 369 hapd->eap_sim_db_priv = 370 eap_sim_db_init(hapd->conf->eap_sim_db, 371 hapd->conf->eap_sim_db_timeout, 372 hostapd_sim_db_cb, hapd); 373 if (hapd->eap_sim_db_priv == NULL) { 374 wpa_printf(MSG_ERROR, "Failed to initialize EAP-SIM " 375 "database interface"); 376 authsrv_deinit(hapd); 377 return -1; 378 } 379 } 380 #endif /* EAP_SIM_DB */ 381 382 hapd->eap_cfg = authsrv_eap_config(hapd); 383 if (!hapd->eap_cfg) { 384 wpa_printf(MSG_ERROR, 385 "Failed to build EAP server configuration"); 386 authsrv_deinit(hapd); 387 return -1; 388 } 389 390 #ifdef RADIUS_SERVER 391 if (hapd->conf->radius_server_clients && 392 hostapd_setup_radius_srv(hapd)) 393 return -1; 394 #endif /* RADIUS_SERVER */ 395 396 return 0; 397 } 398 399 400 void authsrv_deinit(struct hostapd_data *hapd) 401 { 402 #ifdef CONFIG_IEEE80211BE 403 if (!hostapd_mld_is_first_bss(hapd)) { 404 wpa_printf(MSG_DEBUG, 405 "MLD: Deinit auth_serv of a non-first BSS"); 406 407 hapd->radius_srv = NULL; 408 hapd->eap_cfg = NULL; 409 #ifdef EAP_SIM_DB 410 hapd->eap_sim_db_priv = NULL; 411 #endif /* EAP_SIM_DB */ 412 #ifdef EAP_TLS_FUNCS 413 hapd->ssl_ctx = NULL; 414 #endif /* EAP_TLS_FUNCS */ 415 return; 416 } 417 #endif /* CONFIG_IEEE80211BE */ 418 419 #ifdef RADIUS_SERVER 420 radius_server_deinit(hapd->radius_srv); 421 hapd->radius_srv = NULL; 422 #endif /* RADIUS_SERVER */ 423 424 #ifdef CRYPTO_RSA_OAEP_SHA256 425 crypto_rsa_key_free(hapd->imsi_privacy_key); 426 hapd->imsi_privacy_key = NULL; 427 #endif /* CRYPTO_RSA_OAEP_SHA256 */ 428 429 #ifdef EAP_TLS_FUNCS 430 if (hapd->ssl_ctx) { 431 tls_deinit(hapd->ssl_ctx); 432 hapd->ssl_ctx = NULL; 433 } 434 #endif /* EAP_TLS_FUNCS */ 435 436 #ifdef EAP_SIM_DB 437 if (hapd->eap_sim_db_priv) { 438 eap_sim_db_deinit(hapd->eap_sim_db_priv); 439 hapd->eap_sim_db_priv = NULL; 440 } 441 #endif /* EAP_SIM_DB */ 442 443 eap_server_config_free(hapd->eap_cfg); 444 hapd->eap_cfg = NULL; 445 } 446