1 /*
2  * Authentication server setup
3  * Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "utils/includes.h"
10 
11 #include "utils/common.h"
12 #include "crypto/tls.h"
13 #include "eap_server/eap.h"
14 #include "eap_server/eap_sim_db.h"
15 #include "eapol_auth/eapol_auth_sm.h"
16 #include "radius/radius_server.h"
17 #include "hostapd.h"
18 #include "ap_config.h"
19 #include "sta_info.h"
20 #include "authsrv.h"
21 
22 
23 #if defined(EAP_SERVER_SIM) || defined(EAP_SERVER_AKA)
24 #define EAP_SIM_DB
25 #endif /* EAP_SERVER_SIM || EAP_SERVER_AKA */
26 
27 
28 #ifdef EAP_SIM_DB
hostapd_sim_db_cb_sta(struct hostapd_data * hapd,struct sta_info * sta,void * ctx)29 static int hostapd_sim_db_cb_sta(struct hostapd_data *hapd,
30 				 struct sta_info *sta, void *ctx)
31 {
32 	if (eapol_auth_eap_pending_cb(sta->eapol_sm, ctx) == 0)
33 		return 1;
34 	return 0;
35 }
36 
37 
hostapd_sim_db_cb(void * ctx,void * session_ctx)38 static void hostapd_sim_db_cb(void *ctx, void *session_ctx)
39 {
40 	struct hostapd_data *hapd = ctx;
41 	if (ap_for_each_sta(hapd, hostapd_sim_db_cb_sta, session_ctx) == 0) {
42 #ifdef RADIUS_SERVER
43 		radius_server_eap_pending_cb(hapd->radius_srv, session_ctx);
44 #endif /* RADIUS_SERVER */
45 	}
46 }
47 #endif /* EAP_SIM_DB */
48 
49 
50 #ifdef RADIUS_SERVER
51 
hostapd_radius_get_eap_user(void * ctx,const u8 * identity,size_t identity_len,int phase2,struct eap_user * user)52 static int hostapd_radius_get_eap_user(void *ctx, const u8 *identity,
53 				       size_t identity_len, int phase2,
54 				       struct eap_user *user)
55 {
56 	const struct hostapd_eap_user *eap_user;
57 	int i;
58 	int rv = -1;
59 
60 	eap_user = hostapd_get_eap_user(ctx, identity, identity_len, phase2);
61 	if (eap_user == NULL)
62 		goto out;
63 
64 	if (user == NULL)
65 		return 0;
66 
67 	os_memset(user, 0, sizeof(*user));
68 	for (i = 0; i < EAP_MAX_METHODS; i++) {
69 		user->methods[i].vendor = eap_user->methods[i].vendor;
70 		user->methods[i].method = eap_user->methods[i].method;
71 	}
72 
73 	if (eap_user->password) {
74 		user->password = os_memdup(eap_user->password,
75 					   eap_user->password_len);
76 		if (user->password == NULL)
77 			goto out;
78 		user->password_len = eap_user->password_len;
79 		user->password_hash = eap_user->password_hash;
80 		if (eap_user->salt && eap_user->salt_len) {
81 			user->salt = os_memdup(eap_user->salt,
82 					       eap_user->salt_len);
83 			if (!user->salt)
84 				goto out;
85 			user->salt_len = eap_user->salt_len;
86 		}
87 	}
88 	user->force_version = eap_user->force_version;
89 	user->macacl = eap_user->macacl;
90 	user->ttls_auth = eap_user->ttls_auth;
91 	user->remediation = eap_user->remediation;
92 	user->accept_attr = eap_user->accept_attr;
93 	user->t_c_timestamp = eap_user->t_c_timestamp;
94 	rv = 0;
95 
96 out:
97 	if (rv)
98 		wpa_printf(MSG_DEBUG, "%s: Failed to find user", __func__);
99 
100 	return rv;
101 }
102 
103 
hostapd_setup_radius_srv(struct hostapd_data * hapd)104 static int hostapd_setup_radius_srv(struct hostapd_data *hapd)
105 {
106 	struct radius_server_conf srv;
107 	struct hostapd_bss_config *conf = hapd->conf;
108 	os_memset(&srv, 0, sizeof(srv));
109 	srv.client_file = conf->radius_server_clients;
110 	srv.auth_port = conf->radius_server_auth_port;
111 	srv.acct_port = conf->radius_server_acct_port;
112 	srv.conf_ctx = hapd;
113 	srv.ipv6 = conf->radius_server_ipv6;
114 	srv.get_eap_user = hostapd_radius_get_eap_user;
115 	srv.eap_req_id_text = conf->eap_req_id_text;
116 	srv.eap_req_id_text_len = conf->eap_req_id_text_len;
117 	srv.sqlite_file = conf->eap_user_sqlite;
118 #ifdef CONFIG_RADIUS_TEST
119 	srv.dump_msk_file = conf->dump_msk_file;
120 #endif /* CONFIG_RADIUS_TEST */
121 #ifdef CONFIG_HS20
122 	srv.subscr_remediation_url = conf->subscr_remediation_url;
123 	srv.subscr_remediation_method = conf->subscr_remediation_method;
124 	srv.hs20_sim_provisioning_url = conf->hs20_sim_provisioning_url;
125 	srv.t_c_server_url = conf->t_c_server_url;
126 #endif /* CONFIG_HS20 */
127 	srv.erp_domain = conf->erp_domain;
128 	srv.eap_cfg = hapd->eap_cfg;
129 
130 	hapd->radius_srv = radius_server_init(&srv);
131 	if (hapd->radius_srv == NULL) {
132 		wpa_printf(MSG_ERROR, "RADIUS server initialization failed.");
133 		return -1;
134 	}
135 
136 	return 0;
137 }
138 
139 #endif /* RADIUS_SERVER */
140 
141 
142 #ifdef EAP_TLS_FUNCS
authsrv_tls_event(void * ctx,enum tls_event ev,union tls_event_data * data)143 static void authsrv_tls_event(void *ctx, enum tls_event ev,
144 			      union tls_event_data *data)
145 {
146 	switch (ev) {
147 	case TLS_CERT_CHAIN_SUCCESS:
148 		wpa_printf(MSG_DEBUG, "authsrv: remote certificate verification success");
149 		break;
150 	case TLS_CERT_CHAIN_FAILURE:
151 		wpa_printf(MSG_INFO, "authsrv: certificate chain failure: reason=%d depth=%d subject='%s' err='%s'",
152 			   data->cert_fail.reason,
153 			   data->cert_fail.depth,
154 			   data->cert_fail.subject,
155 			   data->cert_fail.reason_txt);
156 		break;
157 	case TLS_PEER_CERTIFICATE:
158 		wpa_printf(MSG_DEBUG, "authsrv: peer certificate: depth=%d serial_num=%s subject=%s",
159 			   data->peer_cert.depth,
160 			   data->peer_cert.serial_num ? data->peer_cert.serial_num : "N/A",
161 			   data->peer_cert.subject);
162 		break;
163 	case TLS_ALERT:
164 		if (data->alert.is_local)
165 			wpa_printf(MSG_DEBUG, "authsrv: local TLS alert: %s",
166 				   data->alert.description);
167 		else
168 			wpa_printf(MSG_DEBUG, "authsrv: remote TLS alert: %s",
169 				   data->alert.description);
170 		break;
171 	}
172 }
173 #endif /* EAP_TLS_FUNCS */
174 
175 
authsrv_eap_config(struct hostapd_data * hapd)176 static struct eap_config * authsrv_eap_config(struct hostapd_data *hapd)
177 {
178 	struct eap_config *cfg;
179 
180 	cfg = os_zalloc(sizeof(*cfg));
181 	if (!cfg)
182 		return NULL;
183 
184 	cfg->eap_server = hapd->conf->eap_server;
185 	cfg->ssl_ctx = hapd->ssl_ctx;
186 	cfg->msg_ctx = hapd->msg_ctx;
187 	cfg->eap_sim_db_priv = hapd->eap_sim_db_priv;
188 	cfg->tls_session_lifetime = hapd->conf->tls_session_lifetime;
189 	cfg->tls_flags = hapd->conf->tls_flags;
190 	cfg->max_auth_rounds = hapd->conf->max_auth_rounds;
191 	cfg->max_auth_rounds_short = hapd->conf->max_auth_rounds_short;
192 	if (hapd->conf->pac_opaque_encr_key)
193 		cfg->pac_opaque_encr_key =
194 			os_memdup(hapd->conf->pac_opaque_encr_key, 16);
195 	if (hapd->conf->eap_fast_a_id) {
196 		cfg->eap_fast_a_id = os_memdup(hapd->conf->eap_fast_a_id,
197 					       hapd->conf->eap_fast_a_id_len);
198 		cfg->eap_fast_a_id_len = hapd->conf->eap_fast_a_id_len;
199 	}
200 	if (hapd->conf->eap_fast_a_id_info)
201 		cfg->eap_fast_a_id_info =
202 			os_strdup(hapd->conf->eap_fast_a_id_info);
203 	cfg->eap_fast_prov = hapd->conf->eap_fast_prov;
204 	cfg->pac_key_lifetime = hapd->conf->pac_key_lifetime;
205 	cfg->pac_key_refresh_time = hapd->conf->pac_key_refresh_time;
206 	cfg->eap_teap_auth = hapd->conf->eap_teap_auth;
207 	cfg->eap_teap_pac_no_inner = hapd->conf->eap_teap_pac_no_inner;
208 	cfg->eap_teap_separate_result = hapd->conf->eap_teap_separate_result;
209 	cfg->eap_teap_id = hapd->conf->eap_teap_id;
210 	cfg->eap_sim_aka_result_ind = hapd->conf->eap_sim_aka_result_ind;
211 	cfg->eap_sim_id = hapd->conf->eap_sim_id;
212 	cfg->tnc = hapd->conf->tnc;
213 	cfg->wps = hapd->wps;
214 	cfg->fragment_size = hapd->conf->fragment_size;
215 	cfg->pwd_group = hapd->conf->pwd_group;
216 	cfg->pbc_in_m1 = hapd->conf->pbc_in_m1;
217 	if (hapd->conf->server_id) {
218 		cfg->server_id = (u8 *) os_strdup(hapd->conf->server_id);
219 		cfg->server_id_len = os_strlen(hapd->conf->server_id);
220 	} else {
221 		cfg->server_id = (u8 *) os_strdup("hostapd");
222 		cfg->server_id_len = 7;
223 	}
224 	cfg->erp = hapd->conf->eap_server_erp;
225 
226 	return cfg;
227 }
228 
229 
authsrv_init(struct hostapd_data * hapd)230 int authsrv_init(struct hostapd_data *hapd)
231 {
232 #ifdef EAP_TLS_FUNCS
233 	if (hapd->conf->eap_server &&
234 	    (hapd->conf->ca_cert || hapd->conf->server_cert ||
235 	     hapd->conf->private_key || hapd->conf->dh_file ||
236 	     hapd->conf->server_cert2 || hapd->conf->private_key2)) {
237 		struct tls_config conf;
238 		struct tls_connection_params params;
239 
240 		os_memset(&conf, 0, sizeof(conf));
241 		conf.tls_session_lifetime = hapd->conf->tls_session_lifetime;
242 		if (hapd->conf->crl_reload_interval > 0 &&
243 		    hapd->conf->check_crl <= 0) {
244 			wpa_printf(MSG_INFO,
245 				   "Cannot enable CRL reload functionality - it depends on check_crl being set");
246 		} else if (hapd->conf->crl_reload_interval > 0) {
247 			conf.crl_reload_interval =
248 				hapd->conf->crl_reload_interval;
249 			wpa_printf(MSG_INFO,
250 				   "Enabled CRL reload functionality");
251 		}
252 		conf.tls_flags = hapd->conf->tls_flags;
253 		conf.event_cb = authsrv_tls_event;
254 		conf.cb_ctx = hapd;
255 		hapd->ssl_ctx = tls_init(&conf);
256 		if (hapd->ssl_ctx == NULL) {
257 			wpa_printf(MSG_ERROR, "Failed to initialize TLS");
258 			authsrv_deinit(hapd);
259 			return -1;
260 		}
261 
262 		os_memset(&params, 0, sizeof(params));
263 		params.ca_cert = hapd->conf->ca_cert;
264 		params.client_cert = hapd->conf->server_cert;
265 		params.client_cert2 = hapd->conf->server_cert2;
266 		params.private_key = hapd->conf->private_key;
267 		params.private_key2 = hapd->conf->private_key2;
268 		params.private_key_passwd = hapd->conf->private_key_passwd;
269 		params.private_key_passwd2 = hapd->conf->private_key_passwd2;
270 		params.dh_file = hapd->conf->dh_file;
271 		params.openssl_ciphers = hapd->conf->openssl_ciphers;
272 		params.openssl_ecdh_curves = hapd->conf->openssl_ecdh_curves;
273 		params.ocsp_stapling_response =
274 			hapd->conf->ocsp_stapling_response;
275 		params.ocsp_stapling_response_multi =
276 			hapd->conf->ocsp_stapling_response_multi;
277 		params.check_cert_subject = hapd->conf->check_cert_subject;
278 
279 		if (tls_global_set_params(hapd->ssl_ctx, &params)) {
280 			wpa_printf(MSG_ERROR, "Failed to set TLS parameters");
281 			authsrv_deinit(hapd);
282 			return -1;
283 		}
284 
285 		if (tls_global_set_verify(hapd->ssl_ctx,
286 					  hapd->conf->check_crl,
287 					  hapd->conf->check_crl_strict)) {
288 			wpa_printf(MSG_ERROR, "Failed to enable check_crl");
289 			authsrv_deinit(hapd);
290 			return -1;
291 		}
292 	}
293 #endif /* EAP_TLS_FUNCS */
294 
295 #ifdef EAP_SIM_DB
296 	if (hapd->conf->eap_sim_db) {
297 		hapd->eap_sim_db_priv =
298 			eap_sim_db_init(hapd->conf->eap_sim_db,
299 					hapd->conf->eap_sim_db_timeout,
300 					hostapd_sim_db_cb, hapd);
301 		if (hapd->eap_sim_db_priv == NULL) {
302 			wpa_printf(MSG_ERROR, "Failed to initialize EAP-SIM "
303 				   "database interface");
304 			authsrv_deinit(hapd);
305 			return -1;
306 		}
307 	}
308 #endif /* EAP_SIM_DB */
309 
310 	hapd->eap_cfg = authsrv_eap_config(hapd);
311 	if (!hapd->eap_cfg) {
312 		wpa_printf(MSG_ERROR,
313 			   "Failed to build EAP server configuration");
314 		authsrv_deinit(hapd);
315 		return -1;
316 	}
317 
318 #ifdef RADIUS_SERVER
319 	if (hapd->conf->radius_server_clients &&
320 	    hostapd_setup_radius_srv(hapd))
321 		return -1;
322 #endif /* RADIUS_SERVER */
323 
324 	return 0;
325 }
326 
327 
authsrv_deinit(struct hostapd_data * hapd)328 void authsrv_deinit(struct hostapd_data *hapd)
329 {
330 #ifdef RADIUS_SERVER
331 	radius_server_deinit(hapd->radius_srv);
332 	hapd->radius_srv = NULL;
333 #endif /* RADIUS_SERVER */
334 
335 #ifdef EAP_TLS_FUNCS
336 	if (hapd->ssl_ctx) {
337 		tls_deinit(hapd->ssl_ctx);
338 		hapd->ssl_ctx = NULL;
339 	}
340 #endif /* EAP_TLS_FUNCS */
341 
342 #ifdef EAP_SIM_DB
343 	if (hapd->eap_sim_db_priv) {
344 		eap_sim_db_deinit(hapd->eap_sim_db_priv);
345 		hapd->eap_sim_db_priv = NULL;
346 	}
347 #endif /* EAP_SIM_DB */
348 
349 	eap_server_config_free(hapd->eap_cfg);
350 	hapd->eap_cfg = NULL;
351 }
352