1 /* 2 * Authentication server setup 3 * Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "utils/includes.h" 10 11 #include "utils/common.h" 12 #include "crypto/tls.h" 13 #include "eap_server/eap.h" 14 #include "eap_server/eap_sim_db.h" 15 #include "eapol_auth/eapol_auth_sm.h" 16 #include "radius/radius_server.h" 17 #include "hostapd.h" 18 #include "ap_config.h" 19 #include "sta_info.h" 20 #include "authsrv.h" 21 22 23 #if defined(EAP_SERVER_SIM) || defined(EAP_SERVER_AKA) 24 #define EAP_SIM_DB 25 #endif /* EAP_SERVER_SIM || EAP_SERVER_AKA */ 26 27 28 #ifdef EAP_SIM_DB 29 static int hostapd_sim_db_cb_sta(struct hostapd_data *hapd, 30 struct sta_info *sta, void *ctx) 31 { 32 if (eapol_auth_eap_pending_cb(sta->eapol_sm, ctx) == 0) 33 return 1; 34 return 0; 35 } 36 37 38 static void hostapd_sim_db_cb(void *ctx, void *session_ctx) 39 { 40 struct hostapd_data *hapd = ctx; 41 if (ap_for_each_sta(hapd, hostapd_sim_db_cb_sta, session_ctx) == 0) { 42 #ifdef RADIUS_SERVER 43 radius_server_eap_pending_cb(hapd->radius_srv, session_ctx); 44 #endif /* RADIUS_SERVER */ 45 } 46 } 47 #endif /* EAP_SIM_DB */ 48 49 50 #ifdef RADIUS_SERVER 51 52 static int hostapd_radius_get_eap_user(void *ctx, const u8 *identity, 53 size_t identity_len, int phase2, 54 struct eap_user *user) 55 { 56 const struct hostapd_eap_user *eap_user; 57 int i; 58 59 eap_user = hostapd_get_eap_user(ctx, identity, identity_len, phase2); 60 if (eap_user == NULL) 61 return -1; 62 63 if (user == NULL) 64 return 0; 65 66 os_memset(user, 0, sizeof(*user)); 67 for (i = 0; i < EAP_MAX_METHODS; i++) { 68 user->methods[i].vendor = eap_user->methods[i].vendor; 69 user->methods[i].method = eap_user->methods[i].method; 70 } 71 72 if (eap_user->password) { 73 user->password = os_malloc(eap_user->password_len); 74 if (user->password == NULL) 75 return -1; 76 os_memcpy(user->password, eap_user->password, 77 eap_user->password_len); 78 user->password_len = eap_user->password_len; 79 user->password_hash = eap_user->password_hash; 80 } 81 user->force_version = eap_user->force_version; 82 user->ttls_auth = eap_user->ttls_auth; 83 84 return 0; 85 } 86 87 88 static int hostapd_setup_radius_srv(struct hostapd_data *hapd) 89 { 90 struct radius_server_conf srv; 91 struct hostapd_bss_config *conf = hapd->conf; 92 os_memset(&srv, 0, sizeof(srv)); 93 srv.client_file = conf->radius_server_clients; 94 srv.auth_port = conf->radius_server_auth_port; 95 srv.conf_ctx = hapd; 96 srv.eap_sim_db_priv = hapd->eap_sim_db_priv; 97 srv.ssl_ctx = hapd->ssl_ctx; 98 srv.msg_ctx = hapd->msg_ctx; 99 srv.pac_opaque_encr_key = conf->pac_opaque_encr_key; 100 srv.eap_fast_a_id = conf->eap_fast_a_id; 101 srv.eap_fast_a_id_len = conf->eap_fast_a_id_len; 102 srv.eap_fast_a_id_info = conf->eap_fast_a_id_info; 103 srv.eap_fast_prov = conf->eap_fast_prov; 104 srv.pac_key_lifetime = conf->pac_key_lifetime; 105 srv.pac_key_refresh_time = conf->pac_key_refresh_time; 106 srv.eap_sim_aka_result_ind = conf->eap_sim_aka_result_ind; 107 srv.tnc = conf->tnc; 108 srv.wps = hapd->wps; 109 srv.ipv6 = conf->radius_server_ipv6; 110 srv.get_eap_user = hostapd_radius_get_eap_user; 111 srv.eap_req_id_text = conf->eap_req_id_text; 112 srv.eap_req_id_text_len = conf->eap_req_id_text_len; 113 srv.pwd_group = conf->pwd_group; 114 srv.server_id = conf->server_id ? conf->server_id : "hostapd"; 115 #ifdef CONFIG_RADIUS_TEST 116 srv.dump_msk_file = conf->dump_msk_file; 117 #endif /* CONFIG_RADIUS_TEST */ 118 119 hapd->radius_srv = radius_server_init(&srv); 120 if (hapd->radius_srv == NULL) { 121 wpa_printf(MSG_ERROR, "RADIUS server initialization failed."); 122 return -1; 123 } 124 125 return 0; 126 } 127 128 #endif /* RADIUS_SERVER */ 129 130 131 int authsrv_init(struct hostapd_data *hapd) 132 { 133 #ifdef EAP_TLS_FUNCS 134 if (hapd->conf->eap_server && 135 (hapd->conf->ca_cert || hapd->conf->server_cert || 136 hapd->conf->private_key || hapd->conf->dh_file)) { 137 struct tls_connection_params params; 138 139 hapd->ssl_ctx = tls_init(NULL); 140 if (hapd->ssl_ctx == NULL) { 141 wpa_printf(MSG_ERROR, "Failed to initialize TLS"); 142 authsrv_deinit(hapd); 143 return -1; 144 } 145 146 os_memset(¶ms, 0, sizeof(params)); 147 params.ca_cert = hapd->conf->ca_cert; 148 params.client_cert = hapd->conf->server_cert; 149 params.private_key = hapd->conf->private_key; 150 params.private_key_passwd = hapd->conf->private_key_passwd; 151 params.dh_file = hapd->conf->dh_file; 152 params.ocsp_stapling_response = 153 hapd->conf->ocsp_stapling_response; 154 155 if (tls_global_set_params(hapd->ssl_ctx, ¶ms)) { 156 wpa_printf(MSG_ERROR, "Failed to set TLS parameters"); 157 authsrv_deinit(hapd); 158 return -1; 159 } 160 161 if (tls_global_set_verify(hapd->ssl_ctx, 162 hapd->conf->check_crl)) { 163 wpa_printf(MSG_ERROR, "Failed to enable check_crl"); 164 authsrv_deinit(hapd); 165 return -1; 166 } 167 } 168 #endif /* EAP_TLS_FUNCS */ 169 170 #ifdef EAP_SIM_DB 171 if (hapd->conf->eap_sim_db) { 172 hapd->eap_sim_db_priv = 173 eap_sim_db_init(hapd->conf->eap_sim_db, 174 hostapd_sim_db_cb, hapd); 175 if (hapd->eap_sim_db_priv == NULL) { 176 wpa_printf(MSG_ERROR, "Failed to initialize EAP-SIM " 177 "database interface"); 178 authsrv_deinit(hapd); 179 return -1; 180 } 181 } 182 #endif /* EAP_SIM_DB */ 183 184 #ifdef RADIUS_SERVER 185 if (hapd->conf->radius_server_clients && 186 hostapd_setup_radius_srv(hapd)) 187 return -1; 188 #endif /* RADIUS_SERVER */ 189 190 return 0; 191 } 192 193 194 void authsrv_deinit(struct hostapd_data *hapd) 195 { 196 #ifdef RADIUS_SERVER 197 radius_server_deinit(hapd->radius_srv); 198 hapd->radius_srv = NULL; 199 #endif /* RADIUS_SERVER */ 200 201 #ifdef EAP_TLS_FUNCS 202 if (hapd->ssl_ctx) { 203 tls_deinit(hapd->ssl_ctx); 204 hapd->ssl_ctx = NULL; 205 } 206 #endif /* EAP_TLS_FUNCS */ 207 208 #ifdef EAP_SIM_DB 209 if (hapd->eap_sim_db_priv) { 210 eap_sim_db_deinit(hapd->eap_sim_db_priv); 211 hapd->eap_sim_db_priv = NULL; 212 } 213 #endif /* EAP_SIM_DB */ 214 } 215