1 /* 2 * Authentication server setup 3 * Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "utils/includes.h" 10 11 #include "utils/common.h" 12 #include "crypto/tls.h" 13 #include "eap_server/eap.h" 14 #include "eap_server/eap_sim_db.h" 15 #include "eapol_auth/eapol_auth_sm.h" 16 #include "radius/radius_server.h" 17 #include "hostapd.h" 18 #include "ap_config.h" 19 #include "sta_info.h" 20 #include "authsrv.h" 21 22 23 #if defined(EAP_SERVER_SIM) || defined(EAP_SERVER_AKA) 24 #define EAP_SIM_DB 25 #endif /* EAP_SERVER_SIM || EAP_SERVER_AKA */ 26 27 28 #ifdef EAP_SIM_DB 29 static int hostapd_sim_db_cb_sta(struct hostapd_data *hapd, 30 struct sta_info *sta, void *ctx) 31 { 32 if (eapol_auth_eap_pending_cb(sta->eapol_sm, ctx) == 0) 33 return 1; 34 return 0; 35 } 36 37 38 static void hostapd_sim_db_cb(void *ctx, void *session_ctx) 39 { 40 struct hostapd_data *hapd = ctx; 41 if (ap_for_each_sta(hapd, hostapd_sim_db_cb_sta, session_ctx) == 0) { 42 #ifdef RADIUS_SERVER 43 radius_server_eap_pending_cb(hapd->radius_srv, session_ctx); 44 #endif /* RADIUS_SERVER */ 45 } 46 } 47 #endif /* EAP_SIM_DB */ 48 49 50 #ifdef RADIUS_SERVER 51 52 static int hostapd_radius_get_eap_user(void *ctx, const u8 *identity, 53 size_t identity_len, int phase2, 54 struct eap_user *user) 55 { 56 const struct hostapd_eap_user *eap_user; 57 int i; 58 int rv = -1; 59 60 eap_user = hostapd_get_eap_user(ctx, identity, identity_len, phase2); 61 if (eap_user == NULL) 62 goto out; 63 64 if (user == NULL) 65 return 0; 66 67 os_memset(user, 0, sizeof(*user)); 68 for (i = 0; i < EAP_MAX_METHODS; i++) { 69 user->methods[i].vendor = eap_user->methods[i].vendor; 70 user->methods[i].method = eap_user->methods[i].method; 71 } 72 73 if (eap_user->password) { 74 user->password = os_memdup(eap_user->password, 75 eap_user->password_len); 76 if (user->password == NULL) 77 goto out; 78 user->password_len = eap_user->password_len; 79 user->password_hash = eap_user->password_hash; 80 if (eap_user->salt && eap_user->salt_len) { 81 user->salt = os_memdup(eap_user->salt, 82 eap_user->salt_len); 83 if (!user->salt) 84 goto out; 85 user->salt_len = eap_user->salt_len; 86 } 87 } 88 user->force_version = eap_user->force_version; 89 user->macacl = eap_user->macacl; 90 user->ttls_auth = eap_user->ttls_auth; 91 user->remediation = eap_user->remediation; 92 user->accept_attr = eap_user->accept_attr; 93 user->t_c_timestamp = eap_user->t_c_timestamp; 94 rv = 0; 95 96 out: 97 if (rv) 98 wpa_printf(MSG_DEBUG, "%s: Failed to find user", __func__); 99 100 return rv; 101 } 102 103 104 static int hostapd_setup_radius_srv(struct hostapd_data *hapd) 105 { 106 struct radius_server_conf srv; 107 struct hostapd_bss_config *conf = hapd->conf; 108 os_memset(&srv, 0, sizeof(srv)); 109 srv.client_file = conf->radius_server_clients; 110 srv.auth_port = conf->radius_server_auth_port; 111 srv.acct_port = conf->radius_server_acct_port; 112 srv.conf_ctx = hapd; 113 srv.ipv6 = conf->radius_server_ipv6; 114 srv.get_eap_user = hostapd_radius_get_eap_user; 115 srv.eap_req_id_text = conf->eap_req_id_text; 116 srv.eap_req_id_text_len = conf->eap_req_id_text_len; 117 srv.sqlite_file = conf->eap_user_sqlite; 118 #ifdef CONFIG_RADIUS_TEST 119 srv.dump_msk_file = conf->dump_msk_file; 120 #endif /* CONFIG_RADIUS_TEST */ 121 #ifdef CONFIG_HS20 122 srv.subscr_remediation_url = conf->subscr_remediation_url; 123 srv.subscr_remediation_method = conf->subscr_remediation_method; 124 srv.hs20_sim_provisioning_url = conf->hs20_sim_provisioning_url; 125 srv.t_c_server_url = conf->t_c_server_url; 126 #endif /* CONFIG_HS20 */ 127 srv.erp_domain = conf->erp_domain; 128 srv.eap_cfg = hapd->eap_cfg; 129 130 hapd->radius_srv = radius_server_init(&srv); 131 if (hapd->radius_srv == NULL) { 132 wpa_printf(MSG_ERROR, "RADIUS server initialization failed."); 133 return -1; 134 } 135 136 return 0; 137 } 138 139 #endif /* RADIUS_SERVER */ 140 141 142 #ifdef EAP_TLS_FUNCS 143 static void authsrv_tls_event(void *ctx, enum tls_event ev, 144 union tls_event_data *data) 145 { 146 switch (ev) { 147 case TLS_CERT_CHAIN_SUCCESS: 148 wpa_printf(MSG_DEBUG, "authsrv: remote certificate verification success"); 149 break; 150 case TLS_CERT_CHAIN_FAILURE: 151 wpa_printf(MSG_INFO, "authsrv: certificate chain failure: reason=%d depth=%d subject='%s' err='%s'", 152 data->cert_fail.reason, 153 data->cert_fail.depth, 154 data->cert_fail.subject, 155 data->cert_fail.reason_txt); 156 break; 157 case TLS_PEER_CERTIFICATE: 158 wpa_printf(MSG_DEBUG, "authsrv: peer certificate: depth=%d serial_num=%s subject=%s", 159 data->peer_cert.depth, 160 data->peer_cert.serial_num ? data->peer_cert.serial_num : "N/A", 161 data->peer_cert.subject); 162 break; 163 case TLS_ALERT: 164 if (data->alert.is_local) 165 wpa_printf(MSG_DEBUG, "authsrv: local TLS alert: %s", 166 data->alert.description); 167 else 168 wpa_printf(MSG_DEBUG, "authsrv: remote TLS alert: %s", 169 data->alert.description); 170 break; 171 } 172 } 173 #endif /* EAP_TLS_FUNCS */ 174 175 176 static struct eap_config * authsrv_eap_config(struct hostapd_data *hapd) 177 { 178 struct eap_config *cfg; 179 180 cfg = os_zalloc(sizeof(*cfg)); 181 if (!cfg) 182 return NULL; 183 184 cfg->eap_server = hapd->conf->eap_server; 185 cfg->ssl_ctx = hapd->ssl_ctx; 186 cfg->msg_ctx = hapd->msg_ctx; 187 cfg->eap_sim_db_priv = hapd->eap_sim_db_priv; 188 cfg->tls_session_lifetime = hapd->conf->tls_session_lifetime; 189 cfg->tls_flags = hapd->conf->tls_flags; 190 cfg->max_auth_rounds = hapd->conf->max_auth_rounds; 191 cfg->max_auth_rounds_short = hapd->conf->max_auth_rounds_short; 192 if (hapd->conf->pac_opaque_encr_key) 193 cfg->pac_opaque_encr_key = 194 os_memdup(hapd->conf->pac_opaque_encr_key, 16); 195 if (hapd->conf->eap_fast_a_id) { 196 cfg->eap_fast_a_id = os_memdup(hapd->conf->eap_fast_a_id, 197 hapd->conf->eap_fast_a_id_len); 198 cfg->eap_fast_a_id_len = hapd->conf->eap_fast_a_id_len; 199 } 200 if (hapd->conf->eap_fast_a_id_info) 201 cfg->eap_fast_a_id_info = 202 os_strdup(hapd->conf->eap_fast_a_id_info); 203 cfg->eap_fast_prov = hapd->conf->eap_fast_prov; 204 cfg->pac_key_lifetime = hapd->conf->pac_key_lifetime; 205 cfg->pac_key_refresh_time = hapd->conf->pac_key_refresh_time; 206 cfg->eap_teap_auth = hapd->conf->eap_teap_auth; 207 cfg->eap_teap_pac_no_inner = hapd->conf->eap_teap_pac_no_inner; 208 cfg->eap_teap_separate_result = hapd->conf->eap_teap_separate_result; 209 cfg->eap_teap_id = hapd->conf->eap_teap_id; 210 cfg->eap_sim_aka_result_ind = hapd->conf->eap_sim_aka_result_ind; 211 cfg->eap_sim_id = hapd->conf->eap_sim_id; 212 cfg->tnc = hapd->conf->tnc; 213 cfg->wps = hapd->wps; 214 cfg->fragment_size = hapd->conf->fragment_size; 215 cfg->pwd_group = hapd->conf->pwd_group; 216 cfg->pbc_in_m1 = hapd->conf->pbc_in_m1; 217 if (hapd->conf->server_id) { 218 cfg->server_id = (u8 *) os_strdup(hapd->conf->server_id); 219 cfg->server_id_len = os_strlen(hapd->conf->server_id); 220 } else { 221 cfg->server_id = (u8 *) os_strdup("hostapd"); 222 cfg->server_id_len = 7; 223 } 224 cfg->erp = hapd->conf->eap_server_erp; 225 226 return cfg; 227 } 228 229 230 int authsrv_init(struct hostapd_data *hapd) 231 { 232 #ifdef EAP_TLS_FUNCS 233 if (hapd->conf->eap_server && 234 (hapd->conf->ca_cert || hapd->conf->server_cert || 235 hapd->conf->private_key || hapd->conf->dh_file || 236 hapd->conf->server_cert2 || hapd->conf->private_key2)) { 237 struct tls_config conf; 238 struct tls_connection_params params; 239 240 os_memset(&conf, 0, sizeof(conf)); 241 conf.tls_session_lifetime = hapd->conf->tls_session_lifetime; 242 if (hapd->conf->crl_reload_interval > 0 && 243 hapd->conf->check_crl <= 0) { 244 wpa_printf(MSG_INFO, 245 "Cannot enable CRL reload functionality - it depends on check_crl being set"); 246 } else if (hapd->conf->crl_reload_interval > 0) { 247 conf.crl_reload_interval = 248 hapd->conf->crl_reload_interval; 249 wpa_printf(MSG_INFO, 250 "Enabled CRL reload functionality"); 251 } 252 conf.tls_flags = hapd->conf->tls_flags; 253 conf.event_cb = authsrv_tls_event; 254 conf.cb_ctx = hapd; 255 hapd->ssl_ctx = tls_init(&conf); 256 if (hapd->ssl_ctx == NULL) { 257 wpa_printf(MSG_ERROR, "Failed to initialize TLS"); 258 authsrv_deinit(hapd); 259 return -1; 260 } 261 262 os_memset(¶ms, 0, sizeof(params)); 263 params.ca_cert = hapd->conf->ca_cert; 264 params.client_cert = hapd->conf->server_cert; 265 params.client_cert2 = hapd->conf->server_cert2; 266 params.private_key = hapd->conf->private_key; 267 params.private_key2 = hapd->conf->private_key2; 268 params.private_key_passwd = hapd->conf->private_key_passwd; 269 params.private_key_passwd2 = hapd->conf->private_key_passwd2; 270 params.dh_file = hapd->conf->dh_file; 271 params.openssl_ciphers = hapd->conf->openssl_ciphers; 272 params.openssl_ecdh_curves = hapd->conf->openssl_ecdh_curves; 273 params.ocsp_stapling_response = 274 hapd->conf->ocsp_stapling_response; 275 params.ocsp_stapling_response_multi = 276 hapd->conf->ocsp_stapling_response_multi; 277 params.check_cert_subject = hapd->conf->check_cert_subject; 278 279 if (tls_global_set_params(hapd->ssl_ctx, ¶ms)) { 280 wpa_printf(MSG_ERROR, "Failed to set TLS parameters"); 281 authsrv_deinit(hapd); 282 return -1; 283 } 284 285 if (tls_global_set_verify(hapd->ssl_ctx, 286 hapd->conf->check_crl, 287 hapd->conf->check_crl_strict)) { 288 wpa_printf(MSG_ERROR, "Failed to enable check_crl"); 289 authsrv_deinit(hapd); 290 return -1; 291 } 292 } 293 #endif /* EAP_TLS_FUNCS */ 294 295 #ifdef EAP_SIM_DB 296 if (hapd->conf->eap_sim_db) { 297 hapd->eap_sim_db_priv = 298 eap_sim_db_init(hapd->conf->eap_sim_db, 299 hapd->conf->eap_sim_db_timeout, 300 hostapd_sim_db_cb, hapd); 301 if (hapd->eap_sim_db_priv == NULL) { 302 wpa_printf(MSG_ERROR, "Failed to initialize EAP-SIM " 303 "database interface"); 304 authsrv_deinit(hapd); 305 return -1; 306 } 307 } 308 #endif /* EAP_SIM_DB */ 309 310 hapd->eap_cfg = authsrv_eap_config(hapd); 311 if (!hapd->eap_cfg) { 312 wpa_printf(MSG_ERROR, 313 "Failed to build EAP server configuration"); 314 authsrv_deinit(hapd); 315 return -1; 316 } 317 318 #ifdef RADIUS_SERVER 319 if (hapd->conf->radius_server_clients && 320 hostapd_setup_radius_srv(hapd)) 321 return -1; 322 #endif /* RADIUS_SERVER */ 323 324 return 0; 325 } 326 327 328 void authsrv_deinit(struct hostapd_data *hapd) 329 { 330 #ifdef RADIUS_SERVER 331 radius_server_deinit(hapd->radius_srv); 332 hapd->radius_srv = NULL; 333 #endif /* RADIUS_SERVER */ 334 335 #ifdef EAP_TLS_FUNCS 336 if (hapd->ssl_ctx) { 337 tls_deinit(hapd->ssl_ctx); 338 hapd->ssl_ctx = NULL; 339 } 340 #endif /* EAP_TLS_FUNCS */ 341 342 #ifdef EAP_SIM_DB 343 if (hapd->eap_sim_db_priv) { 344 eap_sim_db_deinit(hapd->eap_sim_db_priv); 345 hapd->eap_sim_db_priv = NULL; 346 } 347 #endif /* EAP_SIM_DB */ 348 349 eap_server_config_free(hapd->eap_cfg); 350 hapd->eap_cfg = NULL; 351 } 352