xref: /freebsd/contrib/wpa/src/ap/ieee802_11_auth.c (revision 5b56413d04e608379c9a306373554a8e4d321bc0)
1 /*
2  * hostapd / IEEE 802.11 authentication (ACL)
3  * Copyright (c) 2003-2022, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  *
8  * Access control list for IEEE 802.11 authentication can uses statically
9  * configured ACL from configuration files or an external RADIUS server.
10  * Results from external RADIUS queries are cached to allow faster
11  * authentication frame processing.
12  */
13 
14 #include "utils/includes.h"
15 
16 #include "utils/common.h"
17 #include "utils/eloop.h"
18 #include "radius/radius.h"
19 #include "radius/radius_client.h"
20 #include "hostapd.h"
21 #include "ap_config.h"
22 #include "ap_drv_ops.h"
23 #include "sta_info.h"
24 #include "wpa_auth.h"
25 #include "ieee802_11.h"
26 #include "ieee802_1x.h"
27 #include "ieee802_11_auth.h"
28 
29 #define RADIUS_ACL_TIMEOUT 30
30 
31 
32 struct hostapd_cached_radius_acl {
33 	struct os_reltime timestamp;
34 	macaddr addr;
35 	int accepted; /* HOSTAPD_ACL_* */
36 	struct hostapd_cached_radius_acl *next;
37 	struct radius_sta info;
38 };
39 
40 
41 struct hostapd_acl_query_data {
42 	struct os_reltime timestamp;
43 	u8 radius_id;
44 	macaddr addr;
45 	u8 *auth_msg; /* IEEE 802.11 authentication frame from station */
46 	size_t auth_msg_len;
47 	struct hostapd_acl_query_data *next;
48 	bool radius_psk;
49 	int akm;
50 	u8 *anonce;
51 	u8 *eapol;
52 	size_t eapol_len;
53 };
54 
55 
56 #ifndef CONFIG_NO_RADIUS
57 static void hostapd_acl_cache_free_entry(struct hostapd_cached_radius_acl *e)
58 {
59 	os_free(e->info.identity);
60 	os_free(e->info.radius_cui);
61 	hostapd_free_psk_list(e->info.psk);
62 	os_free(e);
63 }
64 
65 
66 static void hostapd_acl_cache_free(struct hostapd_cached_radius_acl *acl_cache)
67 {
68 	struct hostapd_cached_radius_acl *prev;
69 
70 	while (acl_cache) {
71 		prev = acl_cache;
72 		acl_cache = acl_cache->next;
73 		hostapd_acl_cache_free_entry(prev);
74 	}
75 }
76 
77 
78 static int hostapd_acl_cache_get(struct hostapd_data *hapd, const u8 *addr,
79 				 struct radius_sta *out)
80 {
81 	struct hostapd_cached_radius_acl *entry;
82 	struct os_reltime now;
83 
84 	os_get_reltime(&now);
85 
86 	for (entry = hapd->acl_cache; entry; entry = entry->next) {
87 		if (!ether_addr_equal(entry->addr, addr))
88 			continue;
89 
90 		if (os_reltime_expired(&now, &entry->timestamp,
91 				       RADIUS_ACL_TIMEOUT))
92 			return -1; /* entry has expired */
93 		*out = entry->info;
94 
95 		return entry->accepted;
96 	}
97 
98 	return -1;
99 }
100 #endif /* CONFIG_NO_RADIUS */
101 
102 
103 static void hostapd_acl_query_free(struct hostapd_acl_query_data *query)
104 {
105 	if (!query)
106 		return;
107 	os_free(query->auth_msg);
108 	os_free(query->anonce);
109 	os_free(query->eapol);
110 	os_free(query);
111 }
112 
113 
114 #ifndef CONFIG_NO_RADIUS
115 static int hostapd_radius_acl_query(struct hostapd_data *hapd, const u8 *addr,
116 				    struct hostapd_acl_query_data *query)
117 {
118 	struct radius_msg *msg;
119 	char buf[128];
120 
121 	query->radius_id = radius_client_get_id(hapd->radius);
122 	msg = radius_msg_new(RADIUS_CODE_ACCESS_REQUEST, query->radius_id);
123 	if (!msg)
124 		return -1;
125 
126 	if (radius_msg_make_authenticator(msg) < 0) {
127 		wpa_printf(MSG_INFO, "Could not make Request Authenticator");
128 		goto fail;
129 	}
130 
131 	if (!radius_msg_add_msg_auth(msg))
132 		goto fail;
133 
134 	os_snprintf(buf, sizeof(buf), RADIUS_ADDR_FORMAT, MAC2STR(addr));
135 	if (!radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME, (u8 *) buf,
136 				 os_strlen(buf))) {
137 		wpa_printf(MSG_DEBUG, "Could not add User-Name");
138 		goto fail;
139 	}
140 
141 	if (!radius_msg_add_attr_user_password(
142 		    msg, (u8 *) buf, os_strlen(buf),
143 		    hapd->conf->radius->auth_server->shared_secret,
144 		    hapd->conf->radius->auth_server->shared_secret_len)) {
145 		wpa_printf(MSG_DEBUG, "Could not add User-Password");
146 		goto fail;
147 	}
148 
149 	if (add_common_radius_attr(hapd, hapd->conf->radius_auth_req_attr,
150 				   NULL, msg) < 0)
151 		goto fail;
152 
153 	os_snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT,
154 		    MAC2STR(addr));
155 	if (!radius_msg_add_attr(msg, RADIUS_ATTR_CALLING_STATION_ID,
156 				 (u8 *) buf, os_strlen(buf))) {
157 		wpa_printf(MSG_DEBUG, "Could not add Calling-Station-Id");
158 		goto fail;
159 	}
160 
161 	os_snprintf(buf, sizeof(buf), "CONNECT 11Mbps 802.11b");
162 	if (!radius_msg_add_attr(msg, RADIUS_ATTR_CONNECT_INFO,
163 				 (u8 *) buf, os_strlen(buf))) {
164 		wpa_printf(MSG_DEBUG, "Could not add Connect-Info");
165 		goto fail;
166 	}
167 
168 	if (query->akm &&
169 	    !radius_msg_add_attr_int32(msg, RADIUS_ATTR_WLAN_AKM_SUITE,
170 				       wpa_akm_to_suite(query->akm))) {
171 		wpa_printf(MSG_DEBUG, "Could not add WLAN-AKM-Suite");
172 		goto fail;
173 	}
174 
175 	if (query->anonce &&
176 	    !radius_msg_add_ext_vs(msg, RADIUS_ATTR_EXT_VENDOR_SPECIFIC_5,
177 				   RADIUS_VENDOR_ID_FREERADIUS,
178 				   RADIUS_VENDOR_ATTR_FREERADIUS_802_1X_ANONCE,
179 				   query->anonce, WPA_NONCE_LEN)) {
180 		wpa_printf(MSG_DEBUG, "Could not add FreeRADIUS-802.1X-Anonce");
181 		goto fail;
182 	}
183 
184 	if (query->eapol &&
185 	    !radius_msg_add_ext_vs(msg, RADIUS_ATTR_EXT_VENDOR_SPECIFIC_5,
186 				   RADIUS_VENDOR_ID_FREERADIUS,
187 				   RADIUS_VENDOR_ATTR_FREERADIUS_802_1X_EAPOL_KEY_MSG,
188 				   query->eapol, query->eapol_len)) {
189 		wpa_printf(MSG_DEBUG, "Could not add FreeRADIUS-802.1X-EAPoL-Key-Msg");
190 		goto fail;
191 	}
192 
193 	if (radius_client_send(hapd->radius, msg, RADIUS_AUTH, addr) < 0)
194 		goto fail;
195 	return 0;
196 
197  fail:
198 	radius_msg_free(msg);
199 	return -1;
200 }
201 #endif /* CONFIG_NO_RADIUS */
202 
203 
204 /**
205  * hostapd_check_acl - Check a specified STA against accept/deny ACLs
206  * @hapd: hostapd BSS data
207  * @addr: MAC address of the STA
208  * @vlan_id: Buffer for returning VLAN ID
209  * Returns: HOSTAPD_ACL_ACCEPT, HOSTAPD_ACL_REJECT, or HOSTAPD_ACL_PENDING
210  */
211 int hostapd_check_acl(struct hostapd_data *hapd, const u8 *addr,
212 		      struct vlan_description *vlan_id)
213 {
214 	if (hostapd_maclist_found(hapd->conf->accept_mac,
215 				  hapd->conf->num_accept_mac, addr, vlan_id))
216 		return HOSTAPD_ACL_ACCEPT;
217 
218 	if (hostapd_maclist_found(hapd->conf->deny_mac,
219 				  hapd->conf->num_deny_mac, addr, vlan_id))
220 		return HOSTAPD_ACL_REJECT;
221 
222 	if (hapd->conf->macaddr_acl == ACCEPT_UNLESS_DENIED)
223 		return HOSTAPD_ACL_ACCEPT;
224 	if (hapd->conf->macaddr_acl == DENY_UNLESS_ACCEPTED)
225 		return HOSTAPD_ACL_REJECT;
226 
227 	return HOSTAPD_ACL_PENDING;
228 }
229 
230 
231 /**
232  * hostapd_allowed_address - Check whether a specified STA can be authenticated
233  * @hapd: hostapd BSS data
234  * @addr: MAC address of the STA
235  * @msg: Authentication message
236  * @len: Length of msg in octets
237  * @out.session_timeout: Buffer for returning session timeout (from RADIUS)
238  * @out.acct_interim_interval: Buffer for returning account interval (from
239  *	RADIUS)
240  * @out.vlan_id: Buffer for returning VLAN ID
241  * @out.psk: Linked list buffer for returning WPA PSK
242  * @out.identity: Buffer for returning identity (from RADIUS)
243  * @out.radius_cui: Buffer for returning CUI (from RADIUS)
244  * @is_probe_req: Whether this query for a Probe Request frame
245  * Returns: HOSTAPD_ACL_ACCEPT, HOSTAPD_ACL_REJECT, or HOSTAPD_ACL_PENDING
246  *
247  * The caller is responsible for properly cloning the returned out->identity and
248  * out->radius_cui and out->psk values.
249  */
250 int hostapd_allowed_address(struct hostapd_data *hapd, const u8 *addr,
251 			    const u8 *msg, size_t len, struct radius_sta *out,
252 			    int is_probe_req)
253 {
254 	int res;
255 
256 	os_memset(out, 0, sizeof(*out));
257 
258 	res = hostapd_check_acl(hapd, addr, &out->vlan_id);
259 	if (res != HOSTAPD_ACL_PENDING)
260 		return res;
261 
262 	if (hapd->conf->macaddr_acl == USE_EXTERNAL_RADIUS_AUTH) {
263 #ifdef CONFIG_NO_RADIUS
264 		return HOSTAPD_ACL_REJECT;
265 #else /* CONFIG_NO_RADIUS */
266 		struct hostapd_acl_query_data *query;
267 
268 		if (is_probe_req) {
269 			/* Skip RADIUS queries for Probe Request frames to avoid
270 			 * excessive load on the authentication server. */
271 			return HOSTAPD_ACL_ACCEPT;
272 		};
273 
274 		if (hapd->conf->ssid.dynamic_vlan == DYNAMIC_VLAN_DISABLED)
275 			os_memset(&out->vlan_id, 0, sizeof(out->vlan_id));
276 
277 		/* Check whether ACL cache has an entry for this station */
278 		res = hostapd_acl_cache_get(hapd, addr, out);
279 		if (res == HOSTAPD_ACL_ACCEPT ||
280 		    res == HOSTAPD_ACL_ACCEPT_TIMEOUT)
281 			return res;
282 		if (res == HOSTAPD_ACL_REJECT)
283 			return HOSTAPD_ACL_REJECT;
284 
285 		query = hapd->acl_queries;
286 		while (query) {
287 			if (ether_addr_equal(query->addr, addr)) {
288 				/* pending query in RADIUS retransmit queue;
289 				 * do not generate a new one */
290 				return HOSTAPD_ACL_PENDING;
291 			}
292 			query = query->next;
293 		}
294 
295 		if (!hapd->conf->radius->auth_server)
296 			return HOSTAPD_ACL_REJECT;
297 
298 		/* No entry in the cache - query external RADIUS server */
299 		query = os_zalloc(sizeof(*query));
300 		if (!query) {
301 			wpa_printf(MSG_ERROR, "malloc for query data failed");
302 			return HOSTAPD_ACL_REJECT;
303 		}
304 		os_get_reltime(&query->timestamp);
305 		os_memcpy(query->addr, addr, ETH_ALEN);
306 		if (hostapd_radius_acl_query(hapd, addr, query)) {
307 			wpa_printf(MSG_DEBUG,
308 				   "Failed to send Access-Request for ACL query.");
309 			hostapd_acl_query_free(query);
310 			return HOSTAPD_ACL_REJECT;
311 		}
312 
313 		query->auth_msg = os_memdup(msg, len);
314 		if (!query->auth_msg) {
315 			wpa_printf(MSG_ERROR,
316 				   "Failed to allocate memory for auth frame.");
317 			hostapd_acl_query_free(query);
318 			return HOSTAPD_ACL_REJECT;
319 		}
320 		query->auth_msg_len = len;
321 		query->next = hapd->acl_queries;
322 		hapd->acl_queries = query;
323 
324 		/* Queued data will be processed in hostapd_acl_recv_radius()
325 		 * when RADIUS server replies to the sent Access-Request. */
326 		return HOSTAPD_ACL_PENDING;
327 #endif /* CONFIG_NO_RADIUS */
328 	}
329 
330 	return HOSTAPD_ACL_REJECT;
331 }
332 
333 
334 #ifndef CONFIG_NO_RADIUS
335 static void hostapd_acl_expire_cache(struct hostapd_data *hapd,
336 				     struct os_reltime *now)
337 {
338 	struct hostapd_cached_radius_acl *prev, *entry, *tmp;
339 
340 	prev = NULL;
341 	entry = hapd->acl_cache;
342 
343 	while (entry) {
344 		if (os_reltime_expired(now, &entry->timestamp,
345 				       RADIUS_ACL_TIMEOUT)) {
346 			wpa_printf(MSG_DEBUG, "Cached ACL entry for " MACSTR
347 				   " has expired.", MAC2STR(entry->addr));
348 			if (prev)
349 				prev->next = entry->next;
350 			else
351 				hapd->acl_cache = entry->next;
352 			hostapd_drv_set_radius_acl_expire(hapd, entry->addr);
353 			tmp = entry;
354 			entry = entry->next;
355 			hostapd_acl_cache_free_entry(tmp);
356 			continue;
357 		}
358 
359 		prev = entry;
360 		entry = entry->next;
361 	}
362 }
363 
364 
365 static void hostapd_acl_expire_queries(struct hostapd_data *hapd,
366 				       struct os_reltime *now)
367 {
368 	struct hostapd_acl_query_data *prev, *entry, *tmp;
369 
370 	prev = NULL;
371 	entry = hapd->acl_queries;
372 
373 	while (entry) {
374 		if (os_reltime_expired(now, &entry->timestamp,
375 				       RADIUS_ACL_TIMEOUT)) {
376 			wpa_printf(MSG_DEBUG, "ACL query for " MACSTR
377 				   " has expired.", MAC2STR(entry->addr));
378 			if (prev)
379 				prev->next = entry->next;
380 			else
381 				hapd->acl_queries = entry->next;
382 
383 			tmp = entry;
384 			entry = entry->next;
385 			hostapd_acl_query_free(tmp);
386 			continue;
387 		}
388 
389 		prev = entry;
390 		entry = entry->next;
391 	}
392 }
393 
394 
395 /**
396  * hostapd_acl_expire - ACL cache expiration callback
397  * @hapd: struct hostapd_data *
398  */
399 void hostapd_acl_expire(struct hostapd_data *hapd)
400 {
401 	struct os_reltime now;
402 
403 	os_get_reltime(&now);
404 	hostapd_acl_expire_cache(hapd, &now);
405 	hostapd_acl_expire_queries(hapd, &now);
406 }
407 
408 
409 static void decode_tunnel_passwords(struct hostapd_data *hapd,
410 				    const u8 *shared_secret,
411 				    size_t shared_secret_len,
412 				    struct radius_msg *msg,
413 				    struct radius_msg *req,
414 				    struct hostapd_cached_radius_acl *cache)
415 {
416 	int passphraselen;
417 	char *passphrase;
418 	size_t i;
419 	struct hostapd_sta_wpa_psk_short *psk;
420 
421 	/*
422 	 * Decode all tunnel passwords as PSK and save them into a linked list.
423 	 */
424 	for (i = 0; ; i++) {
425 		passphrase = radius_msg_get_tunnel_password(
426 			msg, &passphraselen, shared_secret, shared_secret_len,
427 			req, i);
428 		/*
429 		 * Passphrase is NULL iff there is no i-th Tunnel-Password
430 		 * attribute in msg.
431 		 */
432 		if (!passphrase)
433 			break;
434 
435 		/*
436 		 * Passphase should be 8..63 chars (to be hashed with SSID)
437 		 * or 64 chars hex string (no separate hashing with SSID).
438 		 */
439 
440 		if (passphraselen < MIN_PASSPHRASE_LEN ||
441 		    passphraselen > MAX_PASSPHRASE_LEN + 1)
442 			goto free_pass;
443 
444 		/*
445 		 * passphrase does not contain the NULL termination.
446 		 * Add it here as pbkdf2_sha1() requires it.
447 		 */
448 		psk = os_zalloc(sizeof(struct hostapd_sta_wpa_psk_short));
449 		if (psk) {
450 			if ((passphraselen == MAX_PASSPHRASE_LEN + 1) &&
451 			    (hexstr2bin(passphrase, psk->psk, PMK_LEN) < 0)) {
452 				hostapd_logger(hapd, cache->addr,
453 					       HOSTAPD_MODULE_RADIUS,
454 					       HOSTAPD_LEVEL_WARNING,
455 					       "invalid hex string (%d chars) in Tunnel-Password",
456 					       passphraselen);
457 				goto skip;
458 			} else if (passphraselen <= MAX_PASSPHRASE_LEN) {
459 				os_memcpy(psk->passphrase, passphrase,
460 					  passphraselen);
461 				psk->is_passphrase = 1;
462 			}
463 			psk->next = cache->info.psk;
464 			cache->info.psk = psk;
465 			psk = NULL;
466 		}
467 skip:
468 		os_free(psk);
469 free_pass:
470 		os_free(passphrase);
471 	}
472 }
473 
474 
475 /**
476  * hostapd_acl_recv_radius - Process incoming RADIUS Authentication messages
477  * @msg: RADIUS response message
478  * @req: RADIUS request message
479  * @shared_secret: RADIUS shared secret
480  * @shared_secret_len: Length of shared_secret in octets
481  * @data: Context data (struct hostapd_data *)
482  * Returns: RADIUS_RX_PROCESSED if RADIUS message was a reply to ACL query (and
483  * was processed here) or RADIUS_RX_UNKNOWN if not.
484  */
485 static RadiusRxResult
486 hostapd_acl_recv_radius(struct radius_msg *msg, struct radius_msg *req,
487 			const u8 *shared_secret, size_t shared_secret_len,
488 			void *data)
489 {
490 	struct hostapd_data *hapd = data;
491 	struct hostapd_acl_query_data *query, *prev;
492 	struct hostapd_cached_radius_acl *cache;
493 	struct radius_sta *info;
494 	struct radius_hdr *hdr = radius_msg_get_hdr(msg);
495 
496 	query = hapd->acl_queries;
497 	prev = NULL;
498 	while (query) {
499 		if (query->radius_id == hdr->identifier)
500 			break;
501 		prev = query;
502 		query = query->next;
503 	}
504 	if (!query)
505 		return RADIUS_RX_UNKNOWN;
506 
507 	wpa_printf(MSG_DEBUG,
508 		   "Found matching Access-Request for RADIUS message (id=%d)",
509 		   query->radius_id);
510 
511 	if (radius_msg_verify(
512 		    msg, shared_secret, shared_secret_len, req,
513 		    hapd->conf->radius_require_message_authenticator)) {
514 		wpa_printf(MSG_INFO,
515 			   "Incoming RADIUS packet did not have correct authenticator - dropped");
516 		return RADIUS_RX_INVALID_AUTHENTICATOR;
517 	}
518 
519 	if (hdr->code != RADIUS_CODE_ACCESS_ACCEPT &&
520 	    hdr->code != RADIUS_CODE_ACCESS_REJECT) {
521 		wpa_printf(MSG_DEBUG,
522 			   "Unknown RADIUS message code %d to ACL query",
523 			   hdr->code);
524 		return RADIUS_RX_UNKNOWN;
525 	}
526 
527 	/* Insert Accept/Reject info into ACL cache */
528 	cache = os_zalloc(sizeof(*cache));
529 	if (!cache) {
530 		wpa_printf(MSG_DEBUG, "Failed to add ACL cache entry");
531 		goto done;
532 	}
533 	os_get_reltime(&cache->timestamp);
534 	os_memcpy(cache->addr, query->addr, sizeof(cache->addr));
535 	info = &cache->info;
536 	if (hdr->code == RADIUS_CODE_ACCESS_ACCEPT) {
537 		u8 *buf;
538 		size_t len;
539 
540 		if (radius_msg_get_attr_int32(msg, RADIUS_ATTR_SESSION_TIMEOUT,
541 					      &info->session_timeout) == 0)
542 			cache->accepted = HOSTAPD_ACL_ACCEPT_TIMEOUT;
543 		else
544 			cache->accepted = HOSTAPD_ACL_ACCEPT;
545 
546 		if (radius_msg_get_attr_int32(
547 			    msg, RADIUS_ATTR_ACCT_INTERIM_INTERVAL,
548 			    &info->acct_interim_interval) == 0 &&
549 		    info->acct_interim_interval < 60) {
550 			wpa_printf(MSG_DEBUG,
551 				   "Ignored too small Acct-Interim-Interval %d for STA "
552 				   MACSTR,
553 				   info->acct_interim_interval,
554 				   MAC2STR(query->addr));
555 			info->acct_interim_interval = 0;
556 		}
557 
558 		if (hapd->conf->ssid.dynamic_vlan != DYNAMIC_VLAN_DISABLED)
559 			info->vlan_id.notempty = !!radius_msg_get_vlanid(
560 				msg, &info->vlan_id.untagged,
561 				MAX_NUM_TAGGED_VLAN, info->vlan_id.tagged);
562 
563 		decode_tunnel_passwords(hapd, shared_secret, shared_secret_len,
564 					msg, req, cache);
565 
566 		if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_USER_NAME,
567 					    &buf, &len, NULL) == 0) {
568 			info->identity = os_zalloc(len + 1);
569 			if (info->identity)
570 				os_memcpy(info->identity, buf, len);
571 		}
572 		if (radius_msg_get_attr_ptr(
573 			    msg, RADIUS_ATTR_CHARGEABLE_USER_IDENTITY,
574 			    &buf, &len, NULL) == 0) {
575 			info->radius_cui = os_zalloc(len + 1);
576 			if (info->radius_cui)
577 				os_memcpy(info->radius_cui, buf, len);
578 		}
579 
580 		if (hapd->conf->wpa_psk_radius == PSK_RADIUS_REQUIRED &&
581 		    !info->psk)
582 			cache->accepted = HOSTAPD_ACL_REJECT;
583 
584 		if (info->vlan_id.notempty &&
585 		    !hostapd_vlan_valid(hapd->conf->vlan, &info->vlan_id)) {
586 			hostapd_logger(hapd, query->addr,
587 				       HOSTAPD_MODULE_RADIUS,
588 				       HOSTAPD_LEVEL_INFO,
589 				       "Invalid VLAN %d%s received from RADIUS server",
590 				       info->vlan_id.untagged,
591 				       info->vlan_id.tagged[0] ? "+" : "");
592 			os_memset(&info->vlan_id, 0, sizeof(info->vlan_id));
593 		}
594 		if (hapd->conf->ssid.dynamic_vlan == DYNAMIC_VLAN_REQUIRED &&
595 		    !info->vlan_id.notempty)
596 			cache->accepted = HOSTAPD_ACL_REJECT;
597 	} else
598 		cache->accepted = HOSTAPD_ACL_REJECT;
599 	cache->next = hapd->acl_cache;
600 	hapd->acl_cache = cache;
601 
602 	if (query->radius_psk) {
603 		struct sta_info *sta;
604 		bool success = cache->accepted == HOSTAPD_ACL_ACCEPT ||
605 			cache->accepted == HOSTAPD_ACL_ACCEPT_TIMEOUT;
606 
607 		sta = ap_get_sta(hapd, query->addr);
608 		if (!sta || !sta->wpa_sm) {
609 			wpa_printf(MSG_DEBUG,
610 				   "No STA/SM entry found for the RADIUS PSK response");
611 			goto done;
612 		}
613 #ifdef NEED_AP_MLME
614 		if (success &&
615 		    (ieee802_11_set_radius_info(hapd, sta, cache->accepted,
616 						info) < 0 ||
617 		     ap_sta_bind_vlan(hapd, sta) < 0))
618 			success = false;
619 #endif /* NEED_AP_MLME */
620 		wpa_auth_sta_radius_psk_resp(sta->wpa_sm, success);
621 	} else {
622 #ifdef CONFIG_DRIVER_RADIUS_ACL
623 		hostapd_drv_set_radius_acl_auth(hapd, query->addr,
624 						cache->accepted,
625 						info->session_timeout);
626 #else /* CONFIG_DRIVER_RADIUS_ACL */
627 #ifdef NEED_AP_MLME
628 		/* Re-send original authentication frame for 802.11 processing
629 		 */
630 		wpa_printf(MSG_DEBUG,
631 			   "Re-sending authentication frame after successful RADIUS ACL query");
632 		ieee802_11_mgmt(hapd, query->auth_msg, query->auth_msg_len,
633 				NULL);
634 #endif /* NEED_AP_MLME */
635 #endif /* CONFIG_DRIVER_RADIUS_ACL */
636 	}
637 
638  done:
639 	if (!prev)
640 		hapd->acl_queries = query->next;
641 	else
642 		prev->next = query->next;
643 
644 	hostapd_acl_query_free(query);
645 
646 	return RADIUS_RX_PROCESSED;
647 }
648 #endif /* CONFIG_NO_RADIUS */
649 
650 
651 /**
652  * hostapd_acl_init: Initialize IEEE 802.11 ACL
653  * @hapd: hostapd BSS data
654  * Returns: 0 on success, -1 on failure
655  */
656 int hostapd_acl_init(struct hostapd_data *hapd)
657 {
658 #ifndef CONFIG_NO_RADIUS
659 	if (radius_client_register(hapd->radius, RADIUS_AUTH,
660 				   hostapd_acl_recv_radius, hapd))
661 		return -1;
662 #endif /* CONFIG_NO_RADIUS */
663 
664 	return 0;
665 }
666 
667 
668 /**
669  * hostapd_acl_deinit - Deinitialize IEEE 802.11 ACL
670  * @hapd: hostapd BSS data
671  */
672 void hostapd_acl_deinit(struct hostapd_data *hapd)
673 {
674 	struct hostapd_acl_query_data *query, *prev;
675 
676 #ifndef CONFIG_NO_RADIUS
677 	hostapd_acl_cache_free(hapd->acl_cache);
678 	hapd->acl_cache = NULL;
679 #endif /* CONFIG_NO_RADIUS */
680 
681 	query = hapd->acl_queries;
682 	hapd->acl_queries = NULL;
683 	while (query) {
684 		prev = query;
685 		query = query->next;
686 		hostapd_acl_query_free(prev);
687 	}
688 }
689 
690 
691 void hostapd_copy_psk_list(struct hostapd_sta_wpa_psk_short **psk,
692 			   struct hostapd_sta_wpa_psk_short *src)
693 {
694 	if (!psk)
695 		return;
696 
697 	if (src)
698 		src->ref++;
699 
700 	*psk = src;
701 }
702 
703 
704 void hostapd_free_psk_list(struct hostapd_sta_wpa_psk_short *psk)
705 {
706 	if (psk && psk->ref) {
707 		/* This will be freed when the last reference is dropped. */
708 		psk->ref--;
709 		return;
710 	}
711 
712 	while (psk) {
713 		struct hostapd_sta_wpa_psk_short *prev = psk;
714 		psk = psk->next;
715 		bin_clear_free(prev, sizeof(*prev));
716 	}
717 }
718 
719 
720 #ifndef CONFIG_NO_RADIUS
721 void hostapd_acl_req_radius_psk(struct hostapd_data *hapd, const u8 *addr,
722 				int key_mgmt, const u8 *anonce,
723 				const u8 *eapol, size_t eapol_len)
724 {
725 	struct hostapd_acl_query_data *query;
726 
727 	query = os_zalloc(sizeof(*query));
728 	if (!query)
729 		return;
730 
731 	query->radius_psk = true;
732 	query->akm = key_mgmt;
733 	os_get_reltime(&query->timestamp);
734 	os_memcpy(query->addr, addr, ETH_ALEN);
735 	if (anonce)
736 		query->anonce = os_memdup(anonce, WPA_NONCE_LEN);
737 	if (eapol) {
738 		query->eapol = os_memdup(eapol, eapol_len);
739 		query->eapol_len = eapol_len;
740 	}
741 	if (hostapd_radius_acl_query(hapd, addr, query)) {
742 		wpa_printf(MSG_DEBUG,
743 			   "Failed to send Access-Request for RADIUS PSK/ACL query");
744 		hostapd_acl_query_free(query);
745 		return;
746 	}
747 
748 	query->next = hapd->acl_queries;
749 	hapd->acl_queries = query;
750 }
751 #endif /* CONFIG_NO_RADIUS */
752