1 /*
2 * Authentication server setup
3 * Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "utils/includes.h"
10
11 #include "utils/common.h"
12 #include "crypto/crypto.h"
13 #include "crypto/tls.h"
14 #include "eap_server/eap.h"
15 #include "eap_server/eap_sim_db.h"
16 #include "eapol_auth/eapol_auth_sm.h"
17 #include "radius/radius_server.h"
18 #include "hostapd.h"
19 #include "ap_config.h"
20 #include "sta_info.h"
21 #include "authsrv.h"
22
23
24 #if defined(EAP_SERVER_SIM) || defined(EAP_SERVER_AKA)
25 #define EAP_SIM_DB
26 #endif /* EAP_SERVER_SIM || EAP_SERVER_AKA */
27
28
29 #ifdef EAP_SIM_DB
hostapd_sim_db_cb_sta(struct hostapd_data * hapd,struct sta_info * sta,void * ctx)30 static int hostapd_sim_db_cb_sta(struct hostapd_data *hapd,
31 struct sta_info *sta, void *ctx)
32 {
33 if (eapol_auth_eap_pending_cb(sta->eapol_sm, ctx) == 0)
34 return 1;
35 return 0;
36 }
37
38
hostapd_sim_db_cb(void * ctx,void * session_ctx)39 static void hostapd_sim_db_cb(void *ctx, void *session_ctx)
40 {
41 struct hostapd_data *hapd = ctx;
42 if (ap_for_each_sta(hapd, hostapd_sim_db_cb_sta, session_ctx) == 0) {
43 #ifdef RADIUS_SERVER
44 radius_server_eap_pending_cb(hapd->radius_srv, session_ctx);
45 #endif /* RADIUS_SERVER */
46 }
47 }
48 #endif /* EAP_SIM_DB */
49
50
51 #ifdef RADIUS_SERVER
52
hostapd_radius_get_eap_user(void * ctx,const u8 * identity,size_t identity_len,int phase2,struct eap_user * user)53 static int hostapd_radius_get_eap_user(void *ctx, const u8 *identity,
54 size_t identity_len, int phase2,
55 struct eap_user *user)
56 {
57 const struct hostapd_eap_user *eap_user;
58 int i;
59 int rv = -1;
60
61 eap_user = hostapd_get_eap_user(ctx, identity, identity_len, phase2);
62 if (eap_user == NULL)
63 goto out;
64
65 if (user == NULL)
66 return 0;
67
68 os_memset(user, 0, sizeof(*user));
69 for (i = 0; i < EAP_MAX_METHODS; i++) {
70 user->methods[i].vendor = eap_user->methods[i].vendor;
71 user->methods[i].method = eap_user->methods[i].method;
72 }
73
74 if (eap_user->password) {
75 user->password = os_memdup(eap_user->password,
76 eap_user->password_len);
77 if (user->password == NULL)
78 goto out;
79 user->password_len = eap_user->password_len;
80 user->password_hash = eap_user->password_hash;
81 if (eap_user->salt && eap_user->salt_len) {
82 user->salt = os_memdup(eap_user->salt,
83 eap_user->salt_len);
84 if (!user->salt)
85 goto out;
86 user->salt_len = eap_user->salt_len;
87 }
88 }
89 user->force_version = eap_user->force_version;
90 user->macacl = eap_user->macacl;
91 user->ttls_auth = eap_user->ttls_auth;
92 user->remediation = eap_user->remediation;
93 user->accept_attr = eap_user->accept_attr;
94 user->t_c_timestamp = eap_user->t_c_timestamp;
95 rv = 0;
96
97 out:
98 if (rv)
99 wpa_printf(MSG_DEBUG, "%s: Failed to find user", __func__);
100
101 return rv;
102 }
103
104
hostapd_setup_radius_srv(struct hostapd_data * hapd)105 static int hostapd_setup_radius_srv(struct hostapd_data *hapd)
106 {
107 struct radius_server_conf srv;
108 struct hostapd_bss_config *conf = hapd->conf;
109
110 if (hapd->mld_first_bss) {
111 wpa_printf(MSG_DEBUG,
112 "MLD: Using RADIUS server of the first BSS");
113
114 hapd->radius_srv = hapd->mld_first_bss->radius_srv;
115 return 0;
116 }
117
118 os_memset(&srv, 0, sizeof(srv));
119 srv.client_file = conf->radius_server_clients;
120 srv.auth_port = conf->radius_server_auth_port;
121 srv.acct_port = conf->radius_server_acct_port;
122 srv.conf_ctx = hapd;
123 srv.ipv6 = conf->radius_server_ipv6;
124 srv.get_eap_user = hostapd_radius_get_eap_user;
125 srv.eap_req_id_text = conf->eap_req_id_text;
126 srv.eap_req_id_text_len = conf->eap_req_id_text_len;
127 srv.sqlite_file = conf->eap_user_sqlite;
128 #ifdef CONFIG_RADIUS_TEST
129 srv.dump_msk_file = conf->dump_msk_file;
130 #endif /* CONFIG_RADIUS_TEST */
131 #ifdef CONFIG_HS20
132 srv.subscr_remediation_url = conf->subscr_remediation_url;
133 srv.subscr_remediation_method = conf->subscr_remediation_method;
134 srv.hs20_sim_provisioning_url = conf->hs20_sim_provisioning_url;
135 srv.t_c_server_url = conf->t_c_server_url;
136 #endif /* CONFIG_HS20 */
137 srv.erp_domain = conf->erp_domain;
138 srv.eap_cfg = hapd->eap_cfg;
139
140 hapd->radius_srv = radius_server_init(&srv);
141 if (hapd->radius_srv == NULL) {
142 wpa_printf(MSG_ERROR, "RADIUS server initialization failed.");
143 return -1;
144 }
145
146 return 0;
147 }
148
149 #endif /* RADIUS_SERVER */
150
151
152 #ifdef EAP_TLS_FUNCS
authsrv_tls_event(void * ctx,enum tls_event ev,union tls_event_data * data)153 static void authsrv_tls_event(void *ctx, enum tls_event ev,
154 union tls_event_data *data)
155 {
156 switch (ev) {
157 case TLS_CERT_CHAIN_SUCCESS:
158 wpa_printf(MSG_DEBUG, "authsrv: remote certificate verification success");
159 break;
160 case TLS_CERT_CHAIN_FAILURE:
161 wpa_printf(MSG_INFO, "authsrv: certificate chain failure: reason=%d depth=%d subject='%s' err='%s'",
162 data->cert_fail.reason,
163 data->cert_fail.depth,
164 data->cert_fail.subject,
165 data->cert_fail.reason_txt);
166 break;
167 case TLS_PEER_CERTIFICATE:
168 wpa_printf(MSG_DEBUG, "authsrv: peer certificate: depth=%d serial_num=%s subject=%s",
169 data->peer_cert.depth,
170 data->peer_cert.serial_num ? data->peer_cert.serial_num : "N/A",
171 data->peer_cert.subject);
172 break;
173 case TLS_ALERT:
174 if (data->alert.is_local)
175 wpa_printf(MSG_DEBUG, "authsrv: local TLS alert: %s",
176 data->alert.description);
177 else
178 wpa_printf(MSG_DEBUG, "authsrv: remote TLS alert: %s",
179 data->alert.description);
180 break;
181 case TLS_UNSAFE_RENEGOTIATION_DISABLED:
182 /* Not applicable to TLS server */
183 break;
184 }
185 }
186 #endif /* EAP_TLS_FUNCS */
187
188
authsrv_eap_config(struct hostapd_data * hapd)189 static struct eap_config * authsrv_eap_config(struct hostapd_data *hapd)
190 {
191 struct eap_config *cfg;
192
193 cfg = os_zalloc(sizeof(*cfg));
194 if (!cfg)
195 return NULL;
196
197 cfg->eap_server = hapd->conf->eap_server;
198 cfg->ssl_ctx = hapd->ssl_ctx;
199 cfg->msg_ctx = hapd->msg_ctx;
200 cfg->eap_sim_db_priv = hapd->eap_sim_db_priv;
201 cfg->tls_session_lifetime = hapd->conf->tls_session_lifetime;
202 cfg->tls_flags = hapd->conf->tls_flags;
203 cfg->max_auth_rounds = hapd->conf->max_auth_rounds;
204 cfg->max_auth_rounds_short = hapd->conf->max_auth_rounds_short;
205 if (hapd->conf->pac_opaque_encr_key)
206 cfg->pac_opaque_encr_key =
207 os_memdup(hapd->conf->pac_opaque_encr_key, 16);
208 if (hapd->conf->eap_fast_a_id) {
209 cfg->eap_fast_a_id = os_memdup(hapd->conf->eap_fast_a_id,
210 hapd->conf->eap_fast_a_id_len);
211 cfg->eap_fast_a_id_len = hapd->conf->eap_fast_a_id_len;
212 }
213 if (hapd->conf->eap_fast_a_id_info)
214 cfg->eap_fast_a_id_info =
215 os_strdup(hapd->conf->eap_fast_a_id_info);
216 cfg->eap_fast_prov = hapd->conf->eap_fast_prov;
217 cfg->pac_key_lifetime = hapd->conf->pac_key_lifetime;
218 cfg->pac_key_refresh_time = hapd->conf->pac_key_refresh_time;
219 cfg->eap_teap_auth = hapd->conf->eap_teap_auth;
220 cfg->eap_teap_pac_no_inner = hapd->conf->eap_teap_pac_no_inner;
221 cfg->eap_teap_separate_result = hapd->conf->eap_teap_separate_result;
222 cfg->eap_teap_id = hapd->conf->eap_teap_id;
223 cfg->eap_teap_method_sequence = hapd->conf->eap_teap_method_sequence;
224 cfg->eap_sim_aka_result_ind = hapd->conf->eap_sim_aka_result_ind;
225 cfg->eap_sim_id = hapd->conf->eap_sim_id;
226 cfg->imsi_privacy_key = hapd->imsi_privacy_key;
227 cfg->eap_sim_aka_fast_reauth_limit =
228 hapd->conf->eap_sim_aka_fast_reauth_limit;
229 cfg->tnc = hapd->conf->tnc;
230 cfg->wps = hapd->wps;
231 cfg->fragment_size = hapd->conf->fragment_size;
232 cfg->pwd_group = hapd->conf->pwd_group;
233 cfg->pbc_in_m1 = hapd->conf->pbc_in_m1;
234 if (hapd->conf->server_id) {
235 cfg->server_id = (u8 *) os_strdup(hapd->conf->server_id);
236 cfg->server_id_len = os_strlen(hapd->conf->server_id);
237 } else {
238 cfg->server_id = (u8 *) os_strdup("hostapd");
239 cfg->server_id_len = 7;
240 }
241 cfg->erp = hapd->conf->eap_server_erp;
242 #ifdef CONFIG_TESTING_OPTIONS
243 cfg->skip_prot_success = hapd->conf->eap_skip_prot_success;
244 #endif /* CONFIG_TESTING_OPTIONS */
245
246 return cfg;
247 }
248
249
authsrv_init(struct hostapd_data * hapd)250 int authsrv_init(struct hostapd_data *hapd)
251 {
252 if (hapd->mld_first_bss) {
253 wpa_printf(MSG_DEBUG, "MLD: Using auth_serv of the first BSS");
254
255 #ifdef EAP_TLS_FUNCS
256 hapd->ssl_ctx = hapd->mld_first_bss->ssl_ctx;
257 #endif /* EAP_TLS_FUNCS */
258 hapd->eap_cfg = hapd->mld_first_bss->eap_cfg;
259 #ifdef EAP_SIM_DB
260 hapd->eap_sim_db_priv = hapd->mld_first_bss->eap_sim_db_priv;
261 #endif /* EAP_SIM_DB */
262 return 0;
263 }
264
265 #ifdef EAP_TLS_FUNCS
266 if (hapd->conf->eap_server &&
267 (hapd->conf->ca_cert || hapd->conf->server_cert ||
268 hapd->conf->private_key || hapd->conf->dh_file ||
269 hapd->conf->server_cert2 || hapd->conf->private_key2)) {
270 struct tls_config conf;
271 struct tls_connection_params params;
272
273 os_memset(&conf, 0, sizeof(conf));
274 conf.tls_session_lifetime = hapd->conf->tls_session_lifetime;
275 if (hapd->conf->crl_reload_interval > 0 &&
276 hapd->conf->check_crl <= 0) {
277 wpa_printf(MSG_INFO,
278 "Cannot enable CRL reload functionality - it depends on check_crl being set");
279 } else if (hapd->conf->crl_reload_interval > 0) {
280 conf.crl_reload_interval =
281 hapd->conf->crl_reload_interval;
282 wpa_printf(MSG_INFO,
283 "Enabled CRL reload functionality");
284 }
285 conf.tls_flags = hapd->conf->tls_flags;
286 conf.event_cb = authsrv_tls_event;
287 conf.cb_ctx = hapd;
288 hapd->ssl_ctx = tls_init(&conf);
289 if (hapd->ssl_ctx == NULL) {
290 wpa_printf(MSG_ERROR, "Failed to initialize TLS");
291 authsrv_deinit(hapd);
292 return -1;
293 }
294
295 os_memset(¶ms, 0, sizeof(params));
296 params.ca_cert = hapd->conf->ca_cert;
297 params.client_cert = hapd->conf->server_cert;
298 params.client_cert2 = hapd->conf->server_cert2;
299 params.private_key = hapd->conf->private_key;
300 params.private_key2 = hapd->conf->private_key2;
301 params.private_key_passwd = hapd->conf->private_key_passwd;
302 params.private_key_passwd2 = hapd->conf->private_key_passwd2;
303 params.dh_file = hapd->conf->dh_file;
304 params.openssl_ciphers = hapd->conf->openssl_ciphers;
305 params.openssl_ecdh_curves = hapd->conf->openssl_ecdh_curves;
306 params.ocsp_stapling_response =
307 hapd->conf->ocsp_stapling_response;
308 params.ocsp_stapling_response_multi =
309 hapd->conf->ocsp_stapling_response_multi;
310 params.check_cert_subject = hapd->conf->check_cert_subject;
311
312 if (tls_global_set_params(hapd->ssl_ctx, ¶ms)) {
313 wpa_printf(MSG_ERROR, "Failed to set TLS parameters");
314 authsrv_deinit(hapd);
315 return -1;
316 }
317
318 if (tls_global_set_verify(hapd->ssl_ctx,
319 hapd->conf->check_crl,
320 hapd->conf->check_crl_strict)) {
321 wpa_printf(MSG_ERROR, "Failed to enable check_crl");
322 authsrv_deinit(hapd);
323 return -1;
324 }
325 }
326 #endif /* EAP_TLS_FUNCS */
327
328 #ifdef CRYPTO_RSA_OAEP_SHA256
329 crypto_rsa_key_free(hapd->imsi_privacy_key);
330 hapd->imsi_privacy_key = NULL;
331 if (hapd->conf->imsi_privacy_key) {
332 hapd->imsi_privacy_key = crypto_rsa_key_read(
333 hapd->conf->imsi_privacy_key, true);
334 if (!hapd->imsi_privacy_key) {
335 wpa_printf(MSG_ERROR,
336 "Failed to read/parse IMSI privacy key %s",
337 hapd->conf->imsi_privacy_key);
338 authsrv_deinit(hapd);
339 return -1;
340 }
341 }
342 #endif /* CRYPTO_RSA_OAEP_SHA256 */
343
344 #ifdef EAP_SIM_DB
345 if (hapd->conf->eap_sim_db) {
346 hapd->eap_sim_db_priv =
347 eap_sim_db_init(hapd->conf->eap_sim_db,
348 hapd->conf->eap_sim_db_timeout,
349 hostapd_sim_db_cb, hapd);
350 if (hapd->eap_sim_db_priv == NULL) {
351 wpa_printf(MSG_ERROR, "Failed to initialize EAP-SIM "
352 "database interface");
353 authsrv_deinit(hapd);
354 return -1;
355 }
356 }
357 #endif /* EAP_SIM_DB */
358
359 hapd->eap_cfg = authsrv_eap_config(hapd);
360 if (!hapd->eap_cfg) {
361 wpa_printf(MSG_ERROR,
362 "Failed to build EAP server configuration");
363 authsrv_deinit(hapd);
364 return -1;
365 }
366
367 #ifdef RADIUS_SERVER
368 if (hapd->conf->radius_server_clients &&
369 hostapd_setup_radius_srv(hapd))
370 return -1;
371 #endif /* RADIUS_SERVER */
372
373 return 0;
374 }
375
376
authsrv_deinit(struct hostapd_data * hapd)377 void authsrv_deinit(struct hostapd_data *hapd)
378 {
379 if (hapd->mld_first_bss) {
380 wpa_printf(MSG_DEBUG,
381 "MLD: Deinit auth_serv of a non-first BSS");
382
383 hapd->radius_srv = NULL;
384 hapd->eap_cfg = NULL;
385 #ifdef EAP_SIM_DB
386 hapd->eap_sim_db_priv = NULL;
387 #endif /* EAP_SIM_DB */
388 #ifdef EAP_TLS_FUNCS
389 hapd->ssl_ctx = NULL;
390 #endif /* EAP_TLS_FUNCS */
391 return;
392 }
393
394 #ifdef RADIUS_SERVER
395 radius_server_deinit(hapd->radius_srv);
396 hapd->radius_srv = NULL;
397 #endif /* RADIUS_SERVER */
398
399 #ifdef CRYPTO_RSA_OAEP_SHA256
400 crypto_rsa_key_free(hapd->imsi_privacy_key);
401 hapd->imsi_privacy_key = NULL;
402 #endif /* CRYPTO_RSA_OAEP_SHA256 */
403
404 #ifdef EAP_TLS_FUNCS
405 if (hapd->ssl_ctx) {
406 tls_deinit(hapd->ssl_ctx);
407 hapd->ssl_ctx = NULL;
408 }
409 #endif /* EAP_TLS_FUNCS */
410
411 #ifdef EAP_SIM_DB
412 if (hapd->eap_sim_db_priv) {
413 eap_sim_db_deinit(hapd->eap_sim_db_priv);
414 hapd->eap_sim_db_priv = NULL;
415 }
416 #endif /* EAP_SIM_DB */
417
418 eap_server_config_free(hapd->eap_cfg);
419 hapd->eap_cfg = NULL;
420 }
421