Disconnect hostapd from building in base
[dragonfly.git] / contrib / hostapd / src / ap / authsrv.c
1 /*
2  * Authentication server setup
3  * Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8
9 #include "utils/includes.h"
10
11 #include "utils/common.h"
12 #include "crypto/tls.h"
13 #include "eap_server/eap.h"
14 #include "eap_server/eap_sim_db.h"
15 #include "eapol_auth/eapol_auth_sm.h"
16 #include "radius/radius_server.h"
17 #include "hostapd.h"
18 #include "ap_config.h"
19 #include "sta_info.h"
20 #include "authsrv.h"
21
22
23 #if defined(EAP_SERVER_SIM) || defined(EAP_SERVER_AKA)
24 #define EAP_SIM_DB
25 #endif /* EAP_SERVER_SIM || EAP_SERVER_AKA */
26
27
28 #ifdef EAP_SIM_DB
29 static int hostapd_sim_db_cb_sta(struct hostapd_data *hapd,
30                                  struct sta_info *sta, void *ctx)
31 {
32         if (eapol_auth_eap_pending_cb(sta->eapol_sm, ctx) == 0)
33                 return 1;
34         return 0;
35 }
36
37
38 static void hostapd_sim_db_cb(void *ctx, void *session_ctx)
39 {
40         struct hostapd_data *hapd = ctx;
41         if (ap_for_each_sta(hapd, hostapd_sim_db_cb_sta, session_ctx) == 0) {
42 #ifdef RADIUS_SERVER
43                 radius_server_eap_pending_cb(hapd->radius_srv, session_ctx);
44 #endif /* RADIUS_SERVER */
45         }
46 }
47 #endif /* EAP_SIM_DB */
48
49
50 #ifdef RADIUS_SERVER
51
52 static int hostapd_radius_get_eap_user(void *ctx, const u8 *identity,
53                                        size_t identity_len, int phase2,
54                                        struct eap_user *user)
55 {
56         const struct hostapd_eap_user *eap_user;
57         int i;
58
59         eap_user = hostapd_get_eap_user(ctx, identity, identity_len, phase2);
60         if (eap_user == NULL)
61                 return -1;
62
63         if (user == NULL)
64                 return 0;
65
66         os_memset(user, 0, sizeof(*user));
67         for (i = 0; i < EAP_MAX_METHODS; i++) {
68                 user->methods[i].vendor = eap_user->methods[i].vendor;
69                 user->methods[i].method = eap_user->methods[i].method;
70         }
71
72         if (eap_user->password) {
73                 user->password = os_malloc(eap_user->password_len);
74                 if (user->password == NULL)
75                         return -1;
76                 os_memcpy(user->password, eap_user->password,
77                           eap_user->password_len);
78                 user->password_len = eap_user->password_len;
79                 user->password_hash = eap_user->password_hash;
80         }
81         user->force_version = eap_user->force_version;
82         user->ttls_auth = eap_user->ttls_auth;
83
84         return 0;
85 }
86
87
88 static int hostapd_setup_radius_srv(struct hostapd_data *hapd)
89 {
90         struct radius_server_conf srv;
91         struct hostapd_bss_config *conf = hapd->conf;
92         os_memset(&srv, 0, sizeof(srv));
93         srv.client_file = conf->radius_server_clients;
94         srv.auth_port = conf->radius_server_auth_port;
95         srv.conf_ctx = hapd;
96         srv.eap_sim_db_priv = hapd->eap_sim_db_priv;
97         srv.ssl_ctx = hapd->ssl_ctx;
98         srv.msg_ctx = hapd->msg_ctx;
99         srv.pac_opaque_encr_key = conf->pac_opaque_encr_key;
100         srv.eap_fast_a_id = conf->eap_fast_a_id;
101         srv.eap_fast_a_id_len = conf->eap_fast_a_id_len;
102         srv.eap_fast_a_id_info = conf->eap_fast_a_id_info;
103         srv.eap_fast_prov = conf->eap_fast_prov;
104         srv.pac_key_lifetime = conf->pac_key_lifetime;
105         srv.pac_key_refresh_time = conf->pac_key_refresh_time;
106         srv.eap_sim_aka_result_ind = conf->eap_sim_aka_result_ind;
107         srv.tnc = conf->tnc;
108         srv.wps = hapd->wps;
109         srv.ipv6 = conf->radius_server_ipv6;
110         srv.get_eap_user = hostapd_radius_get_eap_user;
111         srv.eap_req_id_text = conf->eap_req_id_text;
112         srv.eap_req_id_text_len = conf->eap_req_id_text_len;
113         srv.pwd_group = conf->pwd_group;
114         srv.server_id = conf->server_id ? conf->server_id : "hostapd";
115 #ifdef CONFIG_RADIUS_TEST
116         srv.dump_msk_file = conf->dump_msk_file;
117 #endif /* CONFIG_RADIUS_TEST */
118
119         hapd->radius_srv = radius_server_init(&srv);
120         if (hapd->radius_srv == NULL) {
121                 wpa_printf(MSG_ERROR, "RADIUS server initialization failed.");
122                 return -1;
123         }
124
125         return 0;
126 }
127
128 #endif /* RADIUS_SERVER */
129
130
131 int authsrv_init(struct hostapd_data *hapd)
132 {
133 #ifdef EAP_TLS_FUNCS
134         if (hapd->conf->eap_server &&
135             (hapd->conf->ca_cert || hapd->conf->server_cert ||
136              hapd->conf->private_key || hapd->conf->dh_file)) {
137                 struct tls_connection_params params;
138
139                 hapd->ssl_ctx = tls_init(NULL);
140                 if (hapd->ssl_ctx == NULL) {
141                         wpa_printf(MSG_ERROR, "Failed to initialize TLS");
142                         authsrv_deinit(hapd);
143                         return -1;
144                 }
145
146                 os_memset(&params, 0, sizeof(params));
147                 params.ca_cert = hapd->conf->ca_cert;
148                 params.client_cert = hapd->conf->server_cert;
149                 params.private_key = hapd->conf->private_key;
150                 params.private_key_passwd = hapd->conf->private_key_passwd;
151                 params.dh_file = hapd->conf->dh_file;
152                 params.ocsp_stapling_response =
153                         hapd->conf->ocsp_stapling_response;
154
155                 if (tls_global_set_params(hapd->ssl_ctx, &params)) {
156                         wpa_printf(MSG_ERROR, "Failed to set TLS parameters");
157                         authsrv_deinit(hapd);
158                         return -1;
159                 }
160
161                 if (tls_global_set_verify(hapd->ssl_ctx,
162                                           hapd->conf->check_crl)) {
163                         wpa_printf(MSG_ERROR, "Failed to enable check_crl");
164                         authsrv_deinit(hapd);
165                         return -1;
166                 }
167         }
168 #endif /* EAP_TLS_FUNCS */
169
170 #ifdef EAP_SIM_DB
171         if (hapd->conf->eap_sim_db) {
172                 hapd->eap_sim_db_priv =
173                         eap_sim_db_init(hapd->conf->eap_sim_db,
174                                         hostapd_sim_db_cb, hapd);
175                 if (hapd->eap_sim_db_priv == NULL) {
176                         wpa_printf(MSG_ERROR, "Failed to initialize EAP-SIM "
177                                    "database interface");
178                         authsrv_deinit(hapd);
179                         return -1;
180                 }
181         }
182 #endif /* EAP_SIM_DB */
183
184 #ifdef RADIUS_SERVER
185         if (hapd->conf->radius_server_clients &&
186             hostapd_setup_radius_srv(hapd))
187                 return -1;
188 #endif /* RADIUS_SERVER */
189
190         return 0;
191 }
192
193
194 void authsrv_deinit(struct hostapd_data *hapd)
195 {
196 #ifdef RADIUS_SERVER
197         radius_server_deinit(hapd->radius_srv);
198         hapd->radius_srv = NULL;
199 #endif /* RADIUS_SERVER */
200
201 #ifdef EAP_TLS_FUNCS
202         if (hapd->ssl_ctx) {
203                 tls_deinit(hapd->ssl_ctx);
204                 hapd->ssl_ctx = NULL;
205         }
206 #endif /* EAP_TLS_FUNCS */
207
208 #ifdef EAP_SIM_DB
209         if (hapd->eap_sim_db_priv) {
210                 eap_sim_db_deinit(hapd->eap_sim_db_priv);
211                 hapd->eap_sim_db_priv = NULL;
212         }
213 #endif /* EAP_SIM_DB */
214 }