xref: /freebsd/contrib/wpa/src/ap/authsrv.c (revision 87b759f0fa1f7554d50ce640c40138512bbded44)
1 /*
2  * Authentication server setup
3  * Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "utils/includes.h"
10 
11 #include "utils/common.h"
12 #include "crypto/crypto.h"
13 #include "crypto/tls.h"
14 #include "eap_server/eap.h"
15 #include "eap_server/eap_sim_db.h"
16 #include "eapol_auth/eapol_auth_sm.h"
17 #include "radius/radius_server.h"
18 #include "hostapd.h"
19 #include "ap_config.h"
20 #include "sta_info.h"
21 #include "authsrv.h"
22 
23 
24 #if defined(EAP_SERVER_SIM) || defined(EAP_SERVER_AKA)
25 #define EAP_SIM_DB
26 #endif /* EAP_SERVER_SIM || EAP_SERVER_AKA */
27 
28 
29 #ifdef EAP_SIM_DB
30 static int hostapd_sim_db_cb_sta(struct hostapd_data *hapd,
31 				 struct sta_info *sta, void *ctx)
32 {
33 	if (eapol_auth_eap_pending_cb(sta->eapol_sm, ctx) == 0)
34 		return 1;
35 	return 0;
36 }
37 
38 
39 static void hostapd_sim_db_cb(void *ctx, void *session_ctx)
40 {
41 	struct hostapd_data *hapd = ctx;
42 	if (ap_for_each_sta(hapd, hostapd_sim_db_cb_sta, session_ctx) == 0) {
43 #ifdef RADIUS_SERVER
44 		radius_server_eap_pending_cb(hapd->radius_srv, session_ctx);
45 #endif /* RADIUS_SERVER */
46 	}
47 }
48 #endif /* EAP_SIM_DB */
49 
50 
51 #ifdef RADIUS_SERVER
52 
53 static int hostapd_radius_get_eap_user(void *ctx, const u8 *identity,
54 				       size_t identity_len, int phase2,
55 				       struct eap_user *user)
56 {
57 	const struct hostapd_eap_user *eap_user;
58 	int i;
59 	int rv = -1;
60 
61 	eap_user = hostapd_get_eap_user(ctx, identity, identity_len, phase2);
62 	if (eap_user == NULL)
63 		goto out;
64 
65 	if (user == NULL)
66 		return 0;
67 
68 	os_memset(user, 0, sizeof(*user));
69 	for (i = 0; i < EAP_MAX_METHODS; i++) {
70 		user->methods[i].vendor = eap_user->methods[i].vendor;
71 		user->methods[i].method = eap_user->methods[i].method;
72 	}
73 
74 	if (eap_user->password) {
75 		user->password = os_memdup(eap_user->password,
76 					   eap_user->password_len);
77 		if (user->password == NULL)
78 			goto out;
79 		user->password_len = eap_user->password_len;
80 		user->password_hash = eap_user->password_hash;
81 		if (eap_user->salt && eap_user->salt_len) {
82 			user->salt = os_memdup(eap_user->salt,
83 					       eap_user->salt_len);
84 			if (!user->salt)
85 				goto out;
86 			user->salt_len = eap_user->salt_len;
87 		}
88 	}
89 	user->force_version = eap_user->force_version;
90 	user->macacl = eap_user->macacl;
91 	user->ttls_auth = eap_user->ttls_auth;
92 	user->remediation = eap_user->remediation;
93 	user->accept_attr = eap_user->accept_attr;
94 	user->t_c_timestamp = eap_user->t_c_timestamp;
95 	rv = 0;
96 
97 out:
98 	if (rv)
99 		wpa_printf(MSG_DEBUG, "%s: Failed to find user", __func__);
100 
101 	return rv;
102 }
103 
104 
105 static int hostapd_setup_radius_srv(struct hostapd_data *hapd)
106 {
107 	struct radius_server_conf srv;
108 	struct hostapd_bss_config *conf = hapd->conf;
109 
110 #ifdef CONFIG_IEEE80211BE
111 	if (!hostapd_mld_is_first_bss(hapd)) {
112 		struct hostapd_data *first;
113 
114 		wpa_printf(MSG_DEBUG,
115 			   "MLD: Using RADIUS server of the first BSS");
116 
117 		first = hostapd_mld_get_first_bss(hapd);
118 		if (!first)
119 			return -1;
120 		hapd->radius_srv = first->radius_srv;
121 		return 0;
122 	}
123 #endif /* CONFIG_IEEE80211BE */
124 
125 	os_memset(&srv, 0, sizeof(srv));
126 	srv.client_file = conf->radius_server_clients;
127 	srv.auth_port = conf->radius_server_auth_port;
128 	srv.acct_port = conf->radius_server_acct_port;
129 	srv.conf_ctx = hapd;
130 	srv.ipv6 = conf->radius_server_ipv6;
131 	srv.get_eap_user = hostapd_radius_get_eap_user;
132 	srv.eap_req_id_text = conf->eap_req_id_text;
133 	srv.eap_req_id_text_len = conf->eap_req_id_text_len;
134 	srv.sqlite_file = conf->eap_user_sqlite;
135 #ifdef CONFIG_RADIUS_TEST
136 	srv.dump_msk_file = conf->dump_msk_file;
137 #endif /* CONFIG_RADIUS_TEST */
138 #ifdef CONFIG_HS20
139 	srv.subscr_remediation_url = conf->subscr_remediation_url;
140 	srv.subscr_remediation_method = conf->subscr_remediation_method;
141 	srv.hs20_sim_provisioning_url = conf->hs20_sim_provisioning_url;
142 	srv.t_c_server_url = conf->t_c_server_url;
143 #endif /* CONFIG_HS20 */
144 	srv.erp_domain = conf->erp_domain;
145 	srv.eap_cfg = hapd->eap_cfg;
146 
147 	hapd->radius_srv = radius_server_init(&srv);
148 	if (hapd->radius_srv == NULL) {
149 		wpa_printf(MSG_ERROR, "RADIUS server initialization failed.");
150 		return -1;
151 	}
152 
153 	return 0;
154 }
155 
156 #endif /* RADIUS_SERVER */
157 
158 
159 #ifdef EAP_TLS_FUNCS
160 static void authsrv_tls_event(void *ctx, enum tls_event ev,
161 			      union tls_event_data *data)
162 {
163 	switch (ev) {
164 	case TLS_CERT_CHAIN_SUCCESS:
165 		wpa_printf(MSG_DEBUG, "authsrv: remote certificate verification success");
166 		break;
167 	case TLS_CERT_CHAIN_FAILURE:
168 		wpa_printf(MSG_INFO, "authsrv: certificate chain failure: reason=%d depth=%d subject='%s' err='%s'",
169 			   data->cert_fail.reason,
170 			   data->cert_fail.depth,
171 			   data->cert_fail.subject,
172 			   data->cert_fail.reason_txt);
173 		break;
174 	case TLS_PEER_CERTIFICATE:
175 		wpa_printf(MSG_DEBUG, "authsrv: peer certificate: depth=%d serial_num=%s subject=%s",
176 			   data->peer_cert.depth,
177 			   data->peer_cert.serial_num ? data->peer_cert.serial_num : "N/A",
178 			   data->peer_cert.subject);
179 		break;
180 	case TLS_ALERT:
181 		if (data->alert.is_local)
182 			wpa_printf(MSG_DEBUG, "authsrv: local TLS alert: %s",
183 				   data->alert.description);
184 		else
185 			wpa_printf(MSG_DEBUG, "authsrv: remote TLS alert: %s",
186 				   data->alert.description);
187 		break;
188 	case TLS_UNSAFE_RENEGOTIATION_DISABLED:
189 		/* Not applicable to TLS server */
190 		break;
191 	}
192 }
193 #endif /* EAP_TLS_FUNCS */
194 
195 
196 static struct eap_config * authsrv_eap_config(struct hostapd_data *hapd)
197 {
198 	struct eap_config *cfg;
199 
200 	cfg = os_zalloc(sizeof(*cfg));
201 	if (!cfg)
202 		return NULL;
203 
204 	cfg->eap_server = hapd->conf->eap_server;
205 	cfg->ssl_ctx = hapd->ssl_ctx;
206 	cfg->msg_ctx = hapd->msg_ctx;
207 	cfg->eap_sim_db_priv = hapd->eap_sim_db_priv;
208 	cfg->tls_session_lifetime = hapd->conf->tls_session_lifetime;
209 	cfg->tls_flags = hapd->conf->tls_flags;
210 	cfg->max_auth_rounds = hapd->conf->max_auth_rounds;
211 	cfg->max_auth_rounds_short = hapd->conf->max_auth_rounds_short;
212 	if (hapd->conf->pac_opaque_encr_key)
213 		cfg->pac_opaque_encr_key =
214 			os_memdup(hapd->conf->pac_opaque_encr_key, 16);
215 	if (hapd->conf->eap_fast_a_id) {
216 		cfg->eap_fast_a_id = os_memdup(hapd->conf->eap_fast_a_id,
217 					       hapd->conf->eap_fast_a_id_len);
218 		cfg->eap_fast_a_id_len = hapd->conf->eap_fast_a_id_len;
219 	}
220 	if (hapd->conf->eap_fast_a_id_info)
221 		cfg->eap_fast_a_id_info =
222 			os_strdup(hapd->conf->eap_fast_a_id_info);
223 	cfg->eap_fast_prov = hapd->conf->eap_fast_prov;
224 	cfg->pac_key_lifetime = hapd->conf->pac_key_lifetime;
225 	cfg->pac_key_refresh_time = hapd->conf->pac_key_refresh_time;
226 	cfg->eap_teap_auth = hapd->conf->eap_teap_auth;
227 	cfg->eap_teap_pac_no_inner = hapd->conf->eap_teap_pac_no_inner;
228 	cfg->eap_teap_separate_result = hapd->conf->eap_teap_separate_result;
229 	cfg->eap_teap_id = hapd->conf->eap_teap_id;
230 	cfg->eap_teap_method_sequence = hapd->conf->eap_teap_method_sequence;
231 	cfg->eap_sim_aka_result_ind = hapd->conf->eap_sim_aka_result_ind;
232 	cfg->eap_sim_id = hapd->conf->eap_sim_id;
233 	cfg->imsi_privacy_key = hapd->imsi_privacy_key;
234 	cfg->eap_sim_aka_fast_reauth_limit =
235 		hapd->conf->eap_sim_aka_fast_reauth_limit;
236 	cfg->tnc = hapd->conf->tnc;
237 	cfg->wps = hapd->wps;
238 	cfg->fragment_size = hapd->conf->fragment_size;
239 	cfg->pwd_group = hapd->conf->pwd_group;
240 	cfg->pbc_in_m1 = hapd->conf->pbc_in_m1;
241 	if (hapd->conf->server_id) {
242 		cfg->server_id = (u8 *) os_strdup(hapd->conf->server_id);
243 		cfg->server_id_len = os_strlen(hapd->conf->server_id);
244 	} else {
245 		cfg->server_id = (u8 *) os_strdup("hostapd");
246 		cfg->server_id_len = 7;
247 	}
248 	cfg->erp = hapd->conf->eap_server_erp;
249 #ifdef CONFIG_TESTING_OPTIONS
250 	cfg->skip_prot_success = hapd->conf->eap_skip_prot_success;
251 #endif /* CONFIG_TESTING_OPTIONS */
252 
253 	return cfg;
254 }
255 
256 
257 int authsrv_init(struct hostapd_data *hapd)
258 {
259 #ifdef CONFIG_IEEE80211BE
260 	if (!hostapd_mld_is_first_bss(hapd)) {
261 		struct hostapd_data *first;
262 
263 		first = hostapd_mld_get_first_bss(hapd);
264 		if (!first)
265 			return -1;
266 
267 		if (!first->eap_cfg) {
268 			wpa_printf(MSG_DEBUG,
269 				   "MLD: First BSS auth_serv does not exist. Init on its behalf");
270 
271 			if (authsrv_init(first))
272 				return -1;
273 		}
274 
275 		wpa_printf(MSG_DEBUG, "MLD: Using auth_serv of the first BSS");
276 
277 #ifdef EAP_TLS_FUNCS
278 		hapd->ssl_ctx = first->ssl_ctx;
279 #endif /* EAP_TLS_FUNCS */
280 		hapd->eap_cfg = first->eap_cfg;
281 #ifdef EAP_SIM_DB
282 		hapd->eap_sim_db_priv = first->eap_sim_db_priv;
283 #endif /* EAP_SIM_DB */
284 		return 0;
285 	}
286 #endif /* CONFIG_IEEE80211BE */
287 
288 #ifdef EAP_TLS_FUNCS
289 	if (hapd->conf->eap_server &&
290 	    (hapd->conf->ca_cert || hapd->conf->server_cert ||
291 	     hapd->conf->private_key || hapd->conf->dh_file ||
292 	     hapd->conf->server_cert2 || hapd->conf->private_key2)) {
293 		struct tls_config conf;
294 		struct tls_connection_params params;
295 
296 		os_memset(&conf, 0, sizeof(conf));
297 		conf.tls_session_lifetime = hapd->conf->tls_session_lifetime;
298 		if (hapd->conf->crl_reload_interval > 0 &&
299 		    hapd->conf->check_crl <= 0) {
300 			wpa_printf(MSG_INFO,
301 				   "Cannot enable CRL reload functionality - it depends on check_crl being set");
302 		} else if (hapd->conf->crl_reload_interval > 0) {
303 			conf.crl_reload_interval =
304 				hapd->conf->crl_reload_interval;
305 			wpa_printf(MSG_INFO,
306 				   "Enabled CRL reload functionality");
307 		}
308 		conf.tls_flags = hapd->conf->tls_flags;
309 		conf.event_cb = authsrv_tls_event;
310 		conf.cb_ctx = hapd;
311 		hapd->ssl_ctx = tls_init(&conf);
312 		if (hapd->ssl_ctx == NULL) {
313 			wpa_printf(MSG_ERROR, "Failed to initialize TLS");
314 			authsrv_deinit(hapd);
315 			return -1;
316 		}
317 
318 		os_memset(&params, 0, sizeof(params));
319 		params.ca_cert = hapd->conf->ca_cert;
320 		params.client_cert = hapd->conf->server_cert;
321 		params.client_cert2 = hapd->conf->server_cert2;
322 		params.private_key = hapd->conf->private_key;
323 		params.private_key2 = hapd->conf->private_key2;
324 		params.private_key_passwd = hapd->conf->private_key_passwd;
325 		params.private_key_passwd2 = hapd->conf->private_key_passwd2;
326 		params.dh_file = hapd->conf->dh_file;
327 		params.openssl_ciphers = hapd->conf->openssl_ciphers;
328 		params.openssl_ecdh_curves = hapd->conf->openssl_ecdh_curves;
329 		params.ocsp_stapling_response =
330 			hapd->conf->ocsp_stapling_response;
331 		params.ocsp_stapling_response_multi =
332 			hapd->conf->ocsp_stapling_response_multi;
333 		params.check_cert_subject = hapd->conf->check_cert_subject;
334 
335 		if (tls_global_set_params(hapd->ssl_ctx, &params)) {
336 			wpa_printf(MSG_ERROR, "Failed to set TLS parameters");
337 			authsrv_deinit(hapd);
338 			return -1;
339 		}
340 
341 		if (tls_global_set_verify(hapd->ssl_ctx,
342 					  hapd->conf->check_crl,
343 					  hapd->conf->check_crl_strict)) {
344 			wpa_printf(MSG_ERROR, "Failed to enable check_crl");
345 			authsrv_deinit(hapd);
346 			return -1;
347 		}
348 	}
349 #endif /* EAP_TLS_FUNCS */
350 
351 #ifdef CRYPTO_RSA_OAEP_SHA256
352 	crypto_rsa_key_free(hapd->imsi_privacy_key);
353 	hapd->imsi_privacy_key = NULL;
354 	if (hapd->conf->imsi_privacy_key) {
355 		hapd->imsi_privacy_key = crypto_rsa_key_read(
356 			hapd->conf->imsi_privacy_key, true);
357 		if (!hapd->imsi_privacy_key) {
358 			wpa_printf(MSG_ERROR,
359 				   "Failed to read/parse IMSI privacy key %s",
360 				   hapd->conf->imsi_privacy_key);
361 			authsrv_deinit(hapd);
362 			return -1;
363 		}
364 	}
365 #endif /* CRYPTO_RSA_OAEP_SHA256 */
366 
367 #ifdef EAP_SIM_DB
368 	if (hapd->conf->eap_sim_db) {
369 		hapd->eap_sim_db_priv =
370 			eap_sim_db_init(hapd->conf->eap_sim_db,
371 					hapd->conf->eap_sim_db_timeout,
372 					hostapd_sim_db_cb, hapd);
373 		if (hapd->eap_sim_db_priv == NULL) {
374 			wpa_printf(MSG_ERROR, "Failed to initialize EAP-SIM "
375 				   "database interface");
376 			authsrv_deinit(hapd);
377 			return -1;
378 		}
379 	}
380 #endif /* EAP_SIM_DB */
381 
382 	hapd->eap_cfg = authsrv_eap_config(hapd);
383 	if (!hapd->eap_cfg) {
384 		wpa_printf(MSG_ERROR,
385 			   "Failed to build EAP server configuration");
386 		authsrv_deinit(hapd);
387 		return -1;
388 	}
389 
390 #ifdef RADIUS_SERVER
391 	if (hapd->conf->radius_server_clients &&
392 	    hostapd_setup_radius_srv(hapd))
393 		return -1;
394 #endif /* RADIUS_SERVER */
395 
396 	return 0;
397 }
398 
399 
400 void authsrv_deinit(struct hostapd_data *hapd)
401 {
402 #ifdef CONFIG_IEEE80211BE
403 	if (!hostapd_mld_is_first_bss(hapd)) {
404 		wpa_printf(MSG_DEBUG,
405 			   "MLD: Deinit auth_serv of a non-first BSS");
406 
407 		hapd->radius_srv = NULL;
408 		hapd->eap_cfg = NULL;
409 #ifdef EAP_SIM_DB
410 		hapd->eap_sim_db_priv = NULL;
411 #endif /* EAP_SIM_DB */
412 #ifdef EAP_TLS_FUNCS
413 		hapd->ssl_ctx = NULL;
414 #endif /* EAP_TLS_FUNCS */
415 		return;
416 	}
417 #endif /* CONFIG_IEEE80211BE */
418 
419 #ifdef RADIUS_SERVER
420 	radius_server_deinit(hapd->radius_srv);
421 	hapd->radius_srv = NULL;
422 #endif /* RADIUS_SERVER */
423 
424 #ifdef CRYPTO_RSA_OAEP_SHA256
425 	crypto_rsa_key_free(hapd->imsi_privacy_key);
426 	hapd->imsi_privacy_key = NULL;
427 #endif /* CRYPTO_RSA_OAEP_SHA256 */
428 
429 #ifdef EAP_TLS_FUNCS
430 	if (hapd->ssl_ctx) {
431 		tls_deinit(hapd->ssl_ctx);
432 		hapd->ssl_ctx = NULL;
433 	}
434 #endif /* EAP_TLS_FUNCS */
435 
436 #ifdef EAP_SIM_DB
437 	if (hapd->eap_sim_db_priv) {
438 		eap_sim_db_deinit(hapd->eap_sim_db_priv);
439 		hapd->eap_sim_db_priv = NULL;
440 	}
441 #endif /* EAP_SIM_DB */
442 
443 	eap_server_config_free(hapd->eap_cfg);
444 	hapd->eap_cfg = NULL;
445 }
446