2 * Authentication server setup
3 * Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi>
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
9 #include "utils/includes.h"
11 #include "utils/common.h"
12 #include "crypto/tls.h"
13 #include "eap_server/eap.h"
14 #include "eap_server/eap_sim_db.h"
15 #include "eapol_auth/eapol_auth_sm.h"
16 #include "radius/radius_server.h"
18 #include "ap_config.h"
23 #if defined(EAP_SERVER_SIM) || defined(EAP_SERVER_AKA)
25 #endif /* EAP_SERVER_SIM || EAP_SERVER_AKA */
29 static int hostapd_sim_db_cb_sta(struct hostapd_data *hapd,
30 struct sta_info *sta, void *ctx)
32 if (eapol_auth_eap_pending_cb(sta->eapol_sm, ctx) == 0)
38 static void hostapd_sim_db_cb(void *ctx, void *session_ctx)
40 struct hostapd_data *hapd = ctx;
41 if (ap_for_each_sta(hapd, hostapd_sim_db_cb_sta, session_ctx) == 0) {
43 radius_server_eap_pending_cb(hapd->radius_srv, session_ctx);
44 #endif /* RADIUS_SERVER */
47 #endif /* EAP_SIM_DB */
52 static int hostapd_radius_get_eap_user(void *ctx, const u8 *identity,
53 size_t identity_len, int phase2,
54 struct eap_user *user)
56 const struct hostapd_eap_user *eap_user;
59 eap_user = hostapd_get_eap_user(ctx, identity, identity_len, phase2);
66 os_memset(user, 0, sizeof(*user));
67 for (i = 0; i < EAP_MAX_METHODS; i++) {
68 user->methods[i].vendor = eap_user->methods[i].vendor;
69 user->methods[i].method = eap_user->methods[i].method;
72 if (eap_user->password) {
73 user->password = os_malloc(eap_user->password_len);
74 if (user->password == NULL)
76 os_memcpy(user->password, eap_user->password,
77 eap_user->password_len);
78 user->password_len = eap_user->password_len;
79 user->password_hash = eap_user->password_hash;
81 user->force_version = eap_user->force_version;
82 user->ttls_auth = eap_user->ttls_auth;
88 static int hostapd_setup_radius_srv(struct hostapd_data *hapd)
90 struct radius_server_conf srv;
91 struct hostapd_bss_config *conf = hapd->conf;
92 os_memset(&srv, 0, sizeof(srv));
93 srv.client_file = conf->radius_server_clients;
94 srv.auth_port = conf->radius_server_auth_port;
96 srv.eap_sim_db_priv = hapd->eap_sim_db_priv;
97 srv.ssl_ctx = hapd->ssl_ctx;
98 srv.msg_ctx = hapd->msg_ctx;
99 srv.pac_opaque_encr_key = conf->pac_opaque_encr_key;
100 srv.eap_fast_a_id = conf->eap_fast_a_id;
101 srv.eap_fast_a_id_len = conf->eap_fast_a_id_len;
102 srv.eap_fast_a_id_info = conf->eap_fast_a_id_info;
103 srv.eap_fast_prov = conf->eap_fast_prov;
104 srv.pac_key_lifetime = conf->pac_key_lifetime;
105 srv.pac_key_refresh_time = conf->pac_key_refresh_time;
106 srv.eap_sim_aka_result_ind = conf->eap_sim_aka_result_ind;
109 srv.ipv6 = conf->radius_server_ipv6;
110 srv.get_eap_user = hostapd_radius_get_eap_user;
111 srv.eap_req_id_text = conf->eap_req_id_text;
112 srv.eap_req_id_text_len = conf->eap_req_id_text_len;
113 srv.pwd_group = conf->pwd_group;
114 #ifdef CONFIG_RADIUS_TEST
115 srv.dump_msk_file = conf->dump_msk_file;
116 #endif /* CONFIG_RADIUS_TEST */
118 hapd->radius_srv = radius_server_init(&srv);
119 if (hapd->radius_srv == NULL) {
120 wpa_printf(MSG_ERROR, "RADIUS server initialization failed.");
127 #endif /* RADIUS_SERVER */
130 int authsrv_init(struct hostapd_data *hapd)
133 if (hapd->conf->eap_server &&
134 (hapd->conf->ca_cert || hapd->conf->server_cert ||
135 hapd->conf->dh_file)) {
136 struct tls_connection_params params;
138 hapd->ssl_ctx = tls_init(NULL);
139 if (hapd->ssl_ctx == NULL) {
140 wpa_printf(MSG_ERROR, "Failed to initialize TLS");
141 authsrv_deinit(hapd);
145 os_memset(¶ms, 0, sizeof(params));
146 params.ca_cert = hapd->conf->ca_cert;
147 params.client_cert = hapd->conf->server_cert;
148 params.private_key = hapd->conf->private_key;
149 params.private_key_passwd = hapd->conf->private_key_passwd;
150 params.dh_file = hapd->conf->dh_file;
152 if (tls_global_set_params(hapd->ssl_ctx, ¶ms)) {
153 wpa_printf(MSG_ERROR, "Failed to set TLS parameters");
154 authsrv_deinit(hapd);
158 if (tls_global_set_verify(hapd->ssl_ctx,
159 hapd->conf->check_crl)) {
160 wpa_printf(MSG_ERROR, "Failed to enable check_crl");
161 authsrv_deinit(hapd);
165 #endif /* EAP_TLS_FUNCS */
168 if (hapd->conf->eap_sim_db) {
169 hapd->eap_sim_db_priv =
170 eap_sim_db_init(hapd->conf->eap_sim_db,
171 hostapd_sim_db_cb, hapd);
172 if (hapd->eap_sim_db_priv == NULL) {
173 wpa_printf(MSG_ERROR, "Failed to initialize EAP-SIM "
174 "database interface");
175 authsrv_deinit(hapd);
179 #endif /* EAP_SIM_DB */
182 if (hapd->conf->radius_server_clients &&
183 hostapd_setup_radius_srv(hapd))
185 #endif /* RADIUS_SERVER */
191 void authsrv_deinit(struct hostapd_data *hapd)
194 radius_server_deinit(hapd->radius_srv);
195 hapd->radius_srv = NULL;
196 #endif /* RADIUS_SERVER */
200 tls_deinit(hapd->ssl_ctx);
201 hapd->ssl_ctx = NULL;
203 #endif /* EAP_TLS_FUNCS */
206 if (hapd->eap_sim_db_priv) {
207 eap_sim_db_deinit(hapd->eap_sim_db_priv);
208 hapd->eap_sim_db_priv = NULL;
210 #endif /* EAP_SIM_DB */