blob: 86f1cbe1fdd809e649d298d72f8997f796428cb1 [file] [log] [blame]
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001/*
2 * Authentication server setup
3 * Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi>
4 *
Dmitry Shmidtc5ec7f52012-03-06 16:33:24 -08005 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07007 */
8
9#include "utils/includes.h"
10
11#include "utils/common.h"
12#include "crypto/tls.h"
13#include "eap_server/eap.h"
14#include "eap_server/eap_sim_db.h"
15#include "eapol_auth/eapol_auth_sm.h"
16#include "radius/radius_server.h"
17#include "hostapd.h"
18#include "ap_config.h"
19#include "sta_info.h"
20#include "authsrv.h"
21
22
23#if defined(EAP_SERVER_SIM) || defined(EAP_SERVER_AKA)
24#define EAP_SIM_DB
25#endif /* EAP_SERVER_SIM || EAP_SERVER_AKA */
26
27
28#ifdef EAP_SIM_DB
29static int hostapd_sim_db_cb_sta(struct hostapd_data *hapd,
30 struct sta_info *sta, void *ctx)
31{
32 if (eapol_auth_eap_pending_cb(sta->eapol_sm, ctx) == 0)
33 return 1;
34 return 0;
35}
36
37
38static void hostapd_sim_db_cb(void *ctx, void *session_ctx)
39{
40 struct hostapd_data *hapd = ctx;
41 if (ap_for_each_sta(hapd, hostapd_sim_db_cb_sta, session_ctx) == 0) {
42#ifdef RADIUS_SERVER
43 radius_server_eap_pending_cb(hapd->radius_srv, session_ctx);
44#endif /* RADIUS_SERVER */
45 }
46}
47#endif /* EAP_SIM_DB */
48
49
50#ifdef RADIUS_SERVER
51
52static int hostapd_radius_get_eap_user(void *ctx, const u8 *identity,
53 size_t identity_len, int phase2,
54 struct eap_user *user)
55{
56 const struct hostapd_eap_user *eap_user;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -080057 int i;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070058
59 eap_user = hostapd_get_eap_user(ctx, identity, identity_len, phase2);
60 if (eap_user == NULL)
61 return -1;
62
63 if (user == NULL)
64 return 0;
65
66 os_memset(user, 0, sizeof(*user));
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -080067 for (i = 0; i < EAP_MAX_METHODS; i++) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070068 user->methods[i].vendor = eap_user->methods[i].vendor;
69 user->methods[i].method = eap_user->methods[i].method;
70 }
71
72 if (eap_user->password) {
73 user->password = os_malloc(eap_user->password_len);
74 if (user->password == NULL)
75 return -1;
76 os_memcpy(user->password, eap_user->password,
77 eap_user->password_len);
78 user->password_len = eap_user->password_len;
79 user->password_hash = eap_user->password_hash;
80 }
81 user->force_version = eap_user->force_version;
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -070082 user->macacl = eap_user->macacl;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070083 user->ttls_auth = eap_user->ttls_auth;
Dmitry Shmidtf21452a2014-02-26 10:55:25 -080084 user->remediation = eap_user->remediation;
Dmitry Shmidt818ea482014-03-10 13:15:21 -070085 user->accept_attr = eap_user->accept_attr;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070086
87 return 0;
88}
89
90
91static int hostapd_setup_radius_srv(struct hostapd_data *hapd)
92{
93 struct radius_server_conf srv;
94 struct hostapd_bss_config *conf = hapd->conf;
95 os_memset(&srv, 0, sizeof(srv));
96 srv.client_file = conf->radius_server_clients;
97 srv.auth_port = conf->radius_server_auth_port;
Dmitry Shmidtbd14a572014-02-18 10:33:49 -080098 srv.acct_port = conf->radius_server_acct_port;
Dmitry Shmidtd5e49232012-12-03 15:08:10 -080099 srv.conf_ctx = hapd;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700100 srv.eap_sim_db_priv = hapd->eap_sim_db_priv;
101 srv.ssl_ctx = hapd->ssl_ctx;
102 srv.msg_ctx = hapd->msg_ctx;
103 srv.pac_opaque_encr_key = conf->pac_opaque_encr_key;
104 srv.eap_fast_a_id = conf->eap_fast_a_id;
105 srv.eap_fast_a_id_len = conf->eap_fast_a_id_len;
106 srv.eap_fast_a_id_info = conf->eap_fast_a_id_info;
107 srv.eap_fast_prov = conf->eap_fast_prov;
108 srv.pac_key_lifetime = conf->pac_key_lifetime;
109 srv.pac_key_refresh_time = conf->pac_key_refresh_time;
110 srv.eap_sim_aka_result_ind = conf->eap_sim_aka_result_ind;
111 srv.tnc = conf->tnc;
112 srv.wps = hapd->wps;
113 srv.ipv6 = conf->radius_server_ipv6;
114 srv.get_eap_user = hostapd_radius_get_eap_user;
115 srv.eap_req_id_text = conf->eap_req_id_text;
116 srv.eap_req_id_text_len = conf->eap_req_id_text_len;
117 srv.pwd_group = conf->pwd_group;
Dmitry Shmidt34af3062013-07-11 10:46:32 -0700118 srv.server_id = conf->server_id ? conf->server_id : "hostapd";
Dmitry Shmidt818ea482014-03-10 13:15:21 -0700119 srv.sqlite_file = conf->eap_user_sqlite;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800120#ifdef CONFIG_RADIUS_TEST
121 srv.dump_msk_file = conf->dump_msk_file;
122#endif /* CONFIG_RADIUS_TEST */
Dmitry Shmidtf21452a2014-02-26 10:55:25 -0800123#ifdef CONFIG_HS20
124 srv.subscr_remediation_url = conf->subscr_remediation_url;
125 srv.subscr_remediation_method = conf->subscr_remediation_method;
126#endif /* CONFIG_HS20 */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700127
128 hapd->radius_srv = radius_server_init(&srv);
129 if (hapd->radius_srv == NULL) {
130 wpa_printf(MSG_ERROR, "RADIUS server initialization failed.");
131 return -1;
132 }
133
134 return 0;
135}
136
137#endif /* RADIUS_SERVER */
138
139
140int authsrv_init(struct hostapd_data *hapd)
141{
142#ifdef EAP_TLS_FUNCS
143 if (hapd->conf->eap_server &&
144 (hapd->conf->ca_cert || hapd->conf->server_cert ||
Dmitry Shmidt01904cf2013-12-05 11:08:35 -0800145 hapd->conf->private_key || hapd->conf->dh_file)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700146 struct tls_connection_params params;
147
148 hapd->ssl_ctx = tls_init(NULL);
149 if (hapd->ssl_ctx == NULL) {
150 wpa_printf(MSG_ERROR, "Failed to initialize TLS");
151 authsrv_deinit(hapd);
152 return -1;
153 }
154
155 os_memset(&params, 0, sizeof(params));
156 params.ca_cert = hapd->conf->ca_cert;
157 params.client_cert = hapd->conf->server_cert;
158 params.private_key = hapd->conf->private_key;
159 params.private_key_passwd = hapd->conf->private_key_passwd;
160 params.dh_file = hapd->conf->dh_file;
Dmitry Shmidt34af3062013-07-11 10:46:32 -0700161 params.ocsp_stapling_response =
162 hapd->conf->ocsp_stapling_response;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700163
164 if (tls_global_set_params(hapd->ssl_ctx, &params)) {
165 wpa_printf(MSG_ERROR, "Failed to set TLS parameters");
166 authsrv_deinit(hapd);
167 return -1;
168 }
169
170 if (tls_global_set_verify(hapd->ssl_ctx,
171 hapd->conf->check_crl)) {
172 wpa_printf(MSG_ERROR, "Failed to enable check_crl");
173 authsrv_deinit(hapd);
174 return -1;
175 }
176 }
177#endif /* EAP_TLS_FUNCS */
178
179#ifdef EAP_SIM_DB
180 if (hapd->conf->eap_sim_db) {
181 hapd->eap_sim_db_priv =
182 eap_sim_db_init(hapd->conf->eap_sim_db,
183 hostapd_sim_db_cb, hapd);
184 if (hapd->eap_sim_db_priv == NULL) {
185 wpa_printf(MSG_ERROR, "Failed to initialize EAP-SIM "
186 "database interface");
187 authsrv_deinit(hapd);
188 return -1;
189 }
190 }
191#endif /* EAP_SIM_DB */
192
193#ifdef RADIUS_SERVER
194 if (hapd->conf->radius_server_clients &&
195 hostapd_setup_radius_srv(hapd))
196 return -1;
197#endif /* RADIUS_SERVER */
198
199 return 0;
200}
201
202
203void authsrv_deinit(struct hostapd_data *hapd)
204{
205#ifdef RADIUS_SERVER
206 radius_server_deinit(hapd->radius_srv);
207 hapd->radius_srv = NULL;
208#endif /* RADIUS_SERVER */
209
210#ifdef EAP_TLS_FUNCS
211 if (hapd->ssl_ctx) {
212 tls_deinit(hapd->ssl_ctx);
213 hapd->ssl_ctx = NULL;
214 }
215#endif /* EAP_TLS_FUNCS */
216
217#ifdef EAP_SIM_DB
218 if (hapd->eap_sim_db_priv) {
219 eap_sim_db_deinit(hapd->eap_sim_db_priv);
220 hapd->eap_sim_db_priv = NULL;
221 }
222#endif /* EAP_SIM_DB */
223}