contrib/hostapd/hostapd/ieee802_11_auth.c

   1 /*
   2  * hostapd / IEEE 802.11 authentication (ACL)
   3  * Copyright (c) 2003-2007, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  *
  14  * Access control list for IEEE 802.11 authentication can uses statically
  15  * configured ACL from configuration files or an external RADIUS server.
  16  * Results from external RADIUS queries are cached to allow faster
  17  * authentication frame processing.
  18  */
  19
  20 #include "includes.h"
  21
  22 #ifndef CONFIG_NATIVE_WINDOWS
  23
  24 #include "hostapd.h"
  25 #include "ieee802_11.h"
  26 #include "ieee802_11_auth.h"
  27 #include "radius/radius.h"
  28 #include "radius/radius_client.h"
  29 #include "eloop.h"
  30 #include "driver.h"
  31
  32 #define RADIUS_ACL_TIMEOUT 30
  33
  34
  35 struct hostapd_cached_radius_acl {
  36         time_t timestamp;
  37         macaddr addr;
  38         int accepted; /* HOSTAPD_ACL_* */
  39         struct hostapd_cached_radius_acl *next;
  40         u32 session_timeout;
  41         u32 acct_interim_interval;
  42         int vlan_id;
  43 };
  44
  45
  46 struct hostapd_acl_query_data {
  47         time_t timestamp;
  48         u8 radius_id;
  49         macaddr addr;
  50         u8 *auth_msg; /* IEEE 802.11 authentication frame from station */
  51         size_t auth_msg_len;
  52         struct hostapd_acl_query_data *next;
  53 };
  54
  55
  56 static void hostapd_acl_cache_free(struct hostapd_cached_radius_acl *acl_cache)
  57 {
  58         struct hostapd_cached_radius_acl *prev;
  59
  60         while (acl_cache) {
  61                 prev = acl_cache;
  62                 acl_cache = acl_cache->next;
  63                 os_free(prev);
  64         }
  65 }
  66
  67
  68 static int hostapd_acl_cache_get(struct hostapd_data *hapd, const u8 *addr,
  69                                  u32 *session_timeout,
  70                                  u32 *acct_interim_interval, int *vlan_id)
  71 {
  72         struct hostapd_cached_radius_acl *entry;
  73         time_t now;
  74
  75         time(&now);
  76         entry = hapd->acl_cache;
  77
  78         while (entry) {
  79                 if (os_memcmp(entry->addr, addr, ETH_ALEN) == 0) {
  80                         if (now - entry->timestamp > RADIUS_ACL_TIMEOUT)
  81                                 return -1; /* entry has expired */
  82                         if (entry->accepted == HOSTAPD_ACL_ACCEPT_TIMEOUT)
  83                                 if (session_timeout)
  84                                         *session_timeout =
  85                                                 entry->session_timeout;
  86                         if (acct_interim_interval)
  87                                 *acct_interim_interval =
  88                                         entry->acct_interim_interval;
  89                         if (vlan_id)
  90                                 *vlan_id = entry->vlan_id;
  91                         return entry->accepted;
  92                 }
  93
  94                 entry = entry->next;
  95         }
  96
  97         return -1;
  98 }
  99
 100
 101 static void hostapd_acl_query_free(struct hostapd_acl_query_data *query)
 102 {
 103         if (query == NULL)
 104                 return;
 105         os_free(query->auth_msg);
 106         os_free(query);
 107 }
 108
 109
 110 static int hostapd_radius_acl_query(struct hostapd_data *hapd, const u8 *addr,
 111                                     struct hostapd_acl_query_data *query)
 112 {
 113         struct radius_msg *msg;
 114         char buf[128];
 115
 116         query->radius_id = radius_client_get_id(hapd->radius);
 117         msg = radius_msg_new(RADIUS_CODE_ACCESS_REQUEST, query->radius_id);
 118         if (msg == NULL)
 119                 return -1;
 120
 121         radius_msg_make_authenticator(msg, addr, ETH_ALEN);
 122
 123         os_snprintf(buf, sizeof(buf), RADIUS_ADDR_FORMAT, MAC2STR(addr));
 124         if (!radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME, (u8 *) buf,
 125                                  os_strlen(buf))) {
 126                 wpa_printf(MSG_DEBUG, "Could not add User-Name");
 127                 goto fail;
 128         }
 129
 130         if (!radius_msg_add_attr_user_password(
 131                     msg, (u8 *) buf, os_strlen(buf),
 132                     hapd->conf->radius->auth_server->shared_secret,
 133                     hapd->conf->radius->auth_server->shared_secret_len)) {
 134                 wpa_printf(MSG_DEBUG, "Could not add User-Password");
 135                 goto fail;
 136         }
 137
 138         if (hapd->conf->own_ip_addr.af == AF_INET &&
 139             !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IP_ADDRESS,
 140                                  (u8 *) &hapd->conf->own_ip_addr.u.v4, 4)) {
 141                 wpa_printf(MSG_DEBUG, "Could not add NAS-IP-Address");
 142                 goto fail;
 143         }
 144
 145 #ifdef CONFIG_IPV6
 146         if (hapd->conf->own_ip_addr.af == AF_INET6 &&
 147             !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IPV6_ADDRESS,
 148                                  (u8 *) &hapd->conf->own_ip_addr.u.v6, 16)) {
 149                 wpa_printf(MSG_DEBUG, "Could not add NAS-IPv6-Address");
 150                 goto fail;
 151         }
 152 #endif /* CONFIG_IPV6 */
 153
 154         if (hapd->conf->nas_identifier &&
 155             !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IDENTIFIER,
 156                                  (u8 *) hapd->conf->nas_identifier,
 157                                  os_strlen(hapd->conf->nas_identifier))) {
 158                 wpa_printf(MSG_DEBUG, "Could not add NAS-Identifier");
 159                 goto fail;
 160         }
 161
 162         os_snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT ":%s",
 163                     MAC2STR(hapd->own_addr), hapd->conf->ssid.ssid);
 164         if (!radius_msg_add_attr(msg, RADIUS_ATTR_CALLED_STATION_ID,
 165                                  (u8 *) buf, os_strlen(buf))) {
 166                 wpa_printf(MSG_DEBUG, "Could not add Called-Station-Id");
 167                 goto fail;
 168         }
 169
 170         os_snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT,
 171                     MAC2STR(addr));
 172         if (!radius_msg_add_attr(msg, RADIUS_ATTR_CALLING_STATION_ID,
 173                                  (u8 *) buf, os_strlen(buf))) {
 174                 wpa_printf(MSG_DEBUG, "Could not add Calling-Station-Id");
 175                 goto fail;
 176         }
 177
 178         if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_NAS_PORT_TYPE,
 179                                        RADIUS_NAS_PORT_TYPE_IEEE_802_11)) {
 180                 wpa_printf(MSG_DEBUG, "Could not add NAS-Port-Type");
 181                 goto fail;
 182         }
 183
 184         os_snprintf(buf, sizeof(buf), "CONNECT 11Mbps 802.11b");
 185         if (!radius_msg_add_attr(msg, RADIUS_ATTR_CONNECT_INFO,
 186                                  (u8 *) buf, os_strlen(buf))) {
 187                 wpa_printf(MSG_DEBUG, "Could not add Connect-Info");
 188                 goto fail;
 189         }
 190
 191         radius_client_send(hapd->radius, msg, RADIUS_AUTH, addr);
 192         return 0;
 193
 194  fail:
 195         radius_msg_free(msg);
 196         os_free(msg);
 197         return -1;
 198 }
 199
 200
 201 /**
 202  * hostapd_allowed_address - Check whether a specified STA can be authenticated
 203  * @hapd: hostapd BSS data
 204  * @addr: MAC address of the STA
 205  * @msg: Authentication message
 206  * @len: Length of msg in octets
 207  * @session_timeout: Buffer for returning session timeout (from RADIUS)
 208  * @acct_interim_interval: Buffer for returning account interval (from RADIUS)
 209  * @vlan_id: Buffer for returning VLAN ID
 210  * Returns: HOSTAPD_ACL_ACCEPT, HOSTAPD_ACL_REJECT, or HOSTAPD_ACL_PENDING
 211  */
 212 int hostapd_allowed_address(struct hostapd_data *hapd, const u8 *addr,
 213                             const u8 *msg, size_t len, u32 *session_timeout,
 214                             u32 *acct_interim_interval, int *vlan_id)
 215 {
 216         if (session_timeout)
 217                 *session_timeout = 0;
 218         if (acct_interim_interval)
 219                 *acct_interim_interval = 0;
 220         if (vlan_id)
 221                 *vlan_id = 0;
 222
 223         if (hostapd_maclist_found(hapd->conf->accept_mac,
 224                                   hapd->conf->num_accept_mac, addr, vlan_id))
 225                 return HOSTAPD_ACL_ACCEPT;
 226
 227         if (hostapd_maclist_found(hapd->conf->deny_mac,
 228                                   hapd->conf->num_deny_mac, addr, vlan_id))
 229                 return HOSTAPD_ACL_REJECT;
 230
 231         if (hapd->conf->macaddr_acl == ACCEPT_UNLESS_DENIED)
 232                 return HOSTAPD_ACL_ACCEPT;
 233         if (hapd->conf->macaddr_acl == DENY_UNLESS_ACCEPTED)
 234                 return HOSTAPD_ACL_REJECT;
 235
 236         if (hapd->conf->macaddr_acl == USE_EXTERNAL_RADIUS_AUTH) {
 237                 struct hostapd_acl_query_data *query;
 238
 239                 /* Check whether ACL cache has an entry for this station */
 240                 int res = hostapd_acl_cache_get(hapd, addr, session_timeout,
 241                                                 acct_interim_interval,
 242                                                 vlan_id);
 243                 if (res == HOSTAPD_ACL_ACCEPT ||
 244                     res == HOSTAPD_ACL_ACCEPT_TIMEOUT)
 245                         return res;
 246                 if (res == HOSTAPD_ACL_REJECT)
 247                         return HOSTAPD_ACL_REJECT;
 248
 249                 query = hapd->acl_queries;
 250                 while (query) {
 251                         if (os_memcmp(query->addr, addr, ETH_ALEN) == 0) {
 252                                 /* pending query in RADIUS retransmit queue;
 253                                  * do not generate a new one */
 254                                 return HOSTAPD_ACL_PENDING;
 255                         }
 256                         query = query->next;
 257                 }
 258
 259                 if (!hapd->conf->radius->auth_server)
 260                         return HOSTAPD_ACL_REJECT;
 261
 262                 /* No entry in the cache - query external RADIUS server */
 263                 query = os_zalloc(sizeof(*query));
 264                 if (query == NULL) {
 265                         wpa_printf(MSG_ERROR, "malloc for query data failed");
 266                         return HOSTAPD_ACL_REJECT;
 267                 }
 268                 time(&query->timestamp);
 269                 os_memcpy(query->addr, addr, ETH_ALEN);
 270                 if (hostapd_radius_acl_query(hapd, addr, query)) {
 271                         wpa_printf(MSG_DEBUG, "Failed to send Access-Request "
 272                                    "for ACL query.");
 273                         hostapd_acl_query_free(query);
 274                         return HOSTAPD_ACL_REJECT;
 275                 }
 276
 277                 query->auth_msg = os_malloc(len);
 278                 if (query->auth_msg == NULL) {
 279                         wpa_printf(MSG_ERROR, "Failed to allocate memory for "
 280                                    "auth frame.");
 281                         hostapd_acl_query_free(query);
 282                         return HOSTAPD_ACL_REJECT;
 283                 }
 284                 os_memcpy(query->auth_msg, msg, len);
 285                 query->auth_msg_len = len;
 286                 query->next = hapd->acl_queries;
 287                 hapd->acl_queries = query;
 288
 289                 /* Queued data will be processed in hostapd_acl_recv_radius()
 290                  * when RADIUS server replies to the sent Access-Request. */
 291                 return HOSTAPD_ACL_PENDING;
 292         }
 293
 294         return HOSTAPD_ACL_REJECT;
 295 }
 296
 297
 298 static void hostapd_acl_expire_cache(struct hostapd_data *hapd, time_t now)
 299 {
 300         struct hostapd_cached_radius_acl *prev, *entry, *tmp;
 301
 302         prev = NULL;
 303         entry = hapd->acl_cache;
 304
 305         while (entry) {
 306                 if (now - entry->timestamp > RADIUS_ACL_TIMEOUT) {
 307                         wpa_printf(MSG_DEBUG, "Cached ACL entry for " MACSTR
 308                                    " has expired.", MAC2STR(entry->addr));
 309                         if (prev)
 310                                 prev->next = entry->next;
 311                         else
 312                                 hapd->acl_cache = entry->next;
 313 #ifdef CONFIG_DRIVER_RADIUS_ACL
 314                         hostapd_set_radius_acl_expire(hapd, entry->addr);
 315 #endif /* CONFIG_DRIVER_RADIUS_ACL */
 316                         tmp = entry;
 317                         entry = entry->next;
 318                         os_free(tmp);
 319                         continue;
 320                 }
 321
 322                 prev = entry;
 323                 entry = entry->next;
 324         }
 325 }
 326
 327
 328 static void hostapd_acl_expire_queries(struct hostapd_data *hapd, time_t now)
 329 {
 330         struct hostapd_acl_query_data *prev, *entry, *tmp;
 331
 332         prev = NULL;
 333         entry = hapd->acl_queries;
 334
 335         while (entry) {
 336                 if (now - entry->timestamp > RADIUS_ACL_TIMEOUT) {
 337                         wpa_printf(MSG_DEBUG, "ACL query for " MACSTR
 338                                    " has expired.", MAC2STR(entry->addr));
 339                         if (prev)
 340                                 prev->next = entry->next;
 341                         else
 342                                 hapd->acl_queries = entry->next;
 343
 344                         tmp = entry;
 345                         entry = entry->next;
 346                         hostapd_acl_query_free(tmp);
 347                         continue;
 348                 }
 349
 350                 prev = entry;
 351                 entry = entry->next;
 352         }
 353 }
 354
 355
 356 /**
 357  * hostapd_acl_expire - ACL cache expiration callback
 358  * @eloop_ctx: struct hostapd_data *
 359  * @timeout_ctx: Not used
 360  */
 361 static void hostapd_acl_expire(void *eloop_ctx, void *timeout_ctx)
 362 {
 363         struct hostapd_data *hapd = eloop_ctx;
 364         time_t now;
 365
 366         time(&now);
 367         hostapd_acl_expire_cache(hapd, now);
 368         hostapd_acl_expire_queries(hapd, now);
 369
 370         eloop_register_timeout(10, 0, hostapd_acl_expire, hapd, NULL);
 371 }
 372
 373
 374 /**
 375  * hostapd_acl_recv_radius - Process incoming RADIUS Authentication messages
 376  * @msg: RADIUS response message
 377  * @req: RADIUS request message
 378  * @shared_secret: RADIUS shared secret
 379  * @shared_secret_len: Length of shared_secret in octets
 380  * @data: Context data (struct hostapd_data *)
 381  * Returns: RADIUS_RX_PROCESSED if RADIUS message was a reply to ACL query (and
 382  * was processed here) or RADIUS_RX_UNKNOWN if not.
 383  */
 384 static RadiusRxResult
 385 hostapd_acl_recv_radius(struct radius_msg *msg, struct radius_msg *req,
 386                         const u8 *shared_secret, size_t shared_secret_len,
 387                         void *data)
 388 {
 389         struct hostapd_data *hapd = data;
 390         struct hostapd_acl_query_data *query, *prev;
 391         struct hostapd_cached_radius_acl *cache;
 392
 393         query = hapd->acl_queries;
 394         prev = NULL;
 395         while (query) {
 396                 if (query->radius_id == msg->hdr->identifier)
 397                         break;
 398                 prev = query;
 399                 query = query->next;
 400         }
 401         if (query == NULL)
 402                 return RADIUS_RX_UNKNOWN;
 403
 404         wpa_printf(MSG_DEBUG, "Found matching Access-Request for RADIUS "
 405                    "message (id=%d)", query->radius_id);
 406
 407         if (radius_msg_verify(msg, shared_secret, shared_secret_len, req, 0)) {
 408                 wpa_printf(MSG_INFO, "Incoming RADIUS packet did not have "
 409                            "correct authenticator - dropped\n");
 410                 return RADIUS_RX_INVALID_AUTHENTICATOR;
 411         }
 412
 413         if (msg->hdr->code != RADIUS_CODE_ACCESS_ACCEPT &&
 414             msg->hdr->code != RADIUS_CODE_ACCESS_REJECT) {
 415                 wpa_printf(MSG_DEBUG, "Unknown RADIUS message code %d to ACL "
 416                            "query", msg->hdr->code);
 417                 return RADIUS_RX_UNKNOWN;
 418         }
 419
 420         /* Insert Accept/Reject info into ACL cache */
 421         cache = os_zalloc(sizeof(*cache));
 422         if (cache == NULL) {
 423                 wpa_printf(MSG_DEBUG, "Failed to add ACL cache entry");
 424                 goto done;
 425         }
 426         time(&cache->timestamp);
 427         os_memcpy(cache->addr, query->addr, sizeof(cache->addr));
 428         if (msg->hdr->code == RADIUS_CODE_ACCESS_ACCEPT) {
 429                 if (radius_msg_get_attr_int32(msg, RADIUS_ATTR_SESSION_TIMEOUT,
 430                                               &cache->session_timeout) == 0)
 431                         cache->accepted = HOSTAPD_ACL_ACCEPT_TIMEOUT;
 432                 else
 433                         cache->accepted = HOSTAPD_ACL_ACCEPT;
 434
 435                 if (radius_msg_get_attr_int32(
 436                             msg, RADIUS_ATTR_ACCT_INTERIM_INTERVAL,
 437                             &cache->acct_interim_interval) == 0 &&
 438                     cache->acct_interim_interval < 60) {
 439                         wpa_printf(MSG_DEBUG, "Ignored too small "
 440                                    "Acct-Interim-Interval %d for STA " MACSTR,
 441                                    cache->acct_interim_interval,
 442                                    MAC2STR(query->addr));
 443                         cache->acct_interim_interval = 0;
 444                 }
 445
 446                 cache->vlan_id = radius_msg_get_vlanid(msg);
 447         } else
 448                 cache->accepted = HOSTAPD_ACL_REJECT;
 449         cache->next = hapd->acl_cache;
 450         hapd->acl_cache = cache;
 451
 452 #ifdef CONFIG_DRIVER_RADIUS_ACL
 453         hostapd_set_radius_acl_auth(hapd, query->addr, cache->accepted,
 454                                     cache->session_timeout);
 455 #else /* CONFIG_DRIVER_RADIUS_ACL */
 456         /* Re-send original authentication frame for 802.11 processing */
 457         wpa_printf(MSG_DEBUG, "Re-sending authentication frame after "
 458                    "successful RADIUS ACL query");
 459         ieee802_11_mgmt(hapd, query->auth_msg, query->auth_msg_len,
 460                         WLAN_FC_STYPE_AUTH, NULL);
 461 #endif /* CONFIG_DRIVER_RADIUS_ACL */
 462
 463  done:
 464         if (prev == NULL)
 465                 hapd->acl_queries = query->next;
 466         else
 467                 prev->next = query->next;
 468
 469         hostapd_acl_query_free(query);
 470
 471         return RADIUS_RX_PROCESSED;
 472 }
 473
 474
 475 /**
 476  * hostapd_acl_init: Initialize IEEE 802.11 ACL
 477  * @hapd: hostapd BSS data
 478  * Returns: 0 on success, -1 on failure
 479  */
 480 int hostapd_acl_init(struct hostapd_data *hapd)
 481 {
 482         if (radius_client_register(hapd->radius, RADIUS_AUTH,
 483                                    hostapd_acl_recv_radius, hapd))
 484                 return -1;
 485
 486         eloop_register_timeout(10, 0, hostapd_acl_expire, hapd, NULL);
 487
 488         return 0;
 489 }
 490
 491
 492 /**
 493  * hostapd_acl_deinit - Deinitialize IEEE 802.11 ACL
 494  * @hapd: hostapd BSS data
 495  */
 496 void hostapd_acl_deinit(struct hostapd_data *hapd)
 497 {
 498         struct hostapd_acl_query_data *query, *prev;
 499
 500         eloop_cancel_timeout(hostapd_acl_expire, hapd, NULL);
 501
 502         hostapd_acl_cache_free(hapd->acl_cache);
 503
 504         query = hapd->acl_queries;
 505         while (query) {
 506                 prev = query;
 507                 query = query->next;
 508                 hostapd_acl_query_free(prev);
 509         }
 510 }
 511
 512
 513 int hostapd_acl_reconfig(struct hostapd_data *hapd,
 514                          struct hostapd_config *oldconf)
 515 {
 516         if (!hapd->radius_client_reconfigured)
 517                 return 0;
 518
 519         hostapd_acl_deinit(hapd);
 520         return hostapd_acl_init(hapd);
 521 }
 522
 523 #endif /* CONFIG_NATIVE_WINDOWS */