contrib/wpa/src/radius/radius_server.c

   1 /*
   2  * RADIUS authentication server
   3  * Copyright (c) 2005-2009, 2011-2019, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10 #include <net/if.h>
  11 #ifdef CONFIG_SQLITE
  12 #include <sqlite3.h>
  13 #endif /* CONFIG_SQLITE */
  14
  15 #include "common.h"
  16 #include "radius.h"
  17 #include "eloop.h"
  18 #include "eap_server/eap.h"
  19 #include "ap/ap_config.h"
  20 #include "crypto/tls.h"
  21 #include "radius_server.h"
  22
  23 /**
  24  * RADIUS_SESSION_TIMEOUT - Session timeout in seconds
  25  */
  26 #define RADIUS_SESSION_TIMEOUT 60
  27
  28 /**
  29  * RADIUS_SESSION_MAINTAIN - Completed session expiration timeout in seconds
  30  */
  31 #define RADIUS_SESSION_MAINTAIN 5
  32
  33 /**
  34  * RADIUS_MAX_SESSION - Maximum number of active sessions
  35  */
  36 #define RADIUS_MAX_SESSION 1000
  37
  38 /**
  39  * RADIUS_MAX_MSG_LEN - Maximum message length for incoming RADIUS messages
  40  */
  41 #define RADIUS_MAX_MSG_LEN 3000
  42
  43 static const struct eapol_callbacks radius_server_eapol_cb;
  44
  45 struct radius_client;
  46 struct radius_server_data;
  47
  48 /**
  49  * struct radius_server_counters - RADIUS server statistics counters
  50  */
  51 struct radius_server_counters {
  52         u32 access_requests;
  53         u32 invalid_requests;
  54         u32 dup_access_requests;
  55         u32 access_accepts;
  56         u32 access_rejects;
  57         u32 access_challenges;
  58         u32 malformed_access_requests;
  59         u32 bad_authenticators;
  60         u32 packets_dropped;
  61         u32 unknown_types;
  62
  63         u32 acct_requests;
  64         u32 invalid_acct_requests;
  65         u32 acct_responses;
  66         u32 malformed_acct_requests;
  67         u32 acct_bad_authenticators;
  68         u32 unknown_acct_types;
  69 };
  70
  71 /**
  72  * struct radius_session - Internal RADIUS server data for a session
  73  */
  74 struct radius_session {
  75         struct radius_session *next;
  76         struct radius_client *client;
  77         struct radius_server_data *server;
  78         unsigned int sess_id;
  79         struct eap_sm *eap;
  80         struct eap_eapol_interface *eap_if;
  81         char *username; /* from User-Name attribute */
  82         char *nas_ip;
  83         u8 mac_addr[ETH_ALEN]; /* from Calling-Station-Id attribute */
  84
  85         struct radius_msg *last_msg;
  86         char *last_from_addr;
  87         int last_from_port;
  88         struct sockaddr_storage last_from;
  89         socklen_t last_fromlen;
  90         u8 last_identifier;
  91         struct radius_msg *last_reply;
  92         u8 last_authenticator[16];
  93
  94         unsigned int remediation:1;
  95         unsigned int macacl:1;
  96         unsigned int t_c_filtering:1;
  97
  98         struct hostapd_radius_attr *accept_attr;
  99
 100         u32 t_c_timestamp; /* Last read T&C timestamp from user DB */
 101 };
 102
 103 /**
 104  * struct radius_client - Internal RADIUS server data for a client
 105  */
 106 struct radius_client {
 107         struct radius_client *next;
 108         struct in_addr addr;
 109         struct in_addr mask;
 110 #ifdef CONFIG_IPV6
 111         struct in6_addr addr6;
 112         struct in6_addr mask6;
 113 #endif /* CONFIG_IPV6 */
 114         char *shared_secret;
 115         int shared_secret_len;
 116         struct radius_session *sessions;
 117         struct radius_server_counters counters;
 118
 119         u8 next_dac_identifier;
 120         struct radius_msg *pending_dac_coa_req;
 121         u8 pending_dac_coa_id;
 122         u8 pending_dac_coa_addr[ETH_ALEN];
 123         struct radius_msg *pending_dac_disconnect_req;
 124         u8 pending_dac_disconnect_id;
 125         u8 pending_dac_disconnect_addr[ETH_ALEN];
 126 };
 127
 128 /**
 129  * struct radius_server_data - Internal RADIUS server data
 130  */
 131 struct radius_server_data {
 132         /**
 133          * auth_sock - Socket for RADIUS authentication messages
 134          */
 135         int auth_sock;
 136
 137         /**
 138          * acct_sock - Socket for RADIUS accounting messages
 139          */
 140         int acct_sock;
 141
 142         /**
 143          * clients - List of authorized RADIUS clients
 144          */
 145         struct radius_client *clients;
 146
 147         /**
 148          * next_sess_id - Next session identifier
 149          */
 150         unsigned int next_sess_id;
 151
 152         /**
 153          * conf_ctx - Context pointer for callbacks
 154          *
 155          * This is used as the ctx argument in get_eap_user() calls.
 156          */
 157         void *conf_ctx;
 158
 159         /**
 160          * num_sess - Number of active sessions
 161          */
 162         int num_sess;
 163
 164         /**
 165          * eap_sim_db_priv - EAP-SIM/AKA database context
 166          *
 167          * This is passed to the EAP-SIM/AKA server implementation as a
 168          * callback context.
 169          */
 170         void *eap_sim_db_priv;
 171
 172         /**
 173          * ssl_ctx - TLS context
 174          *
 175          * This is passed to the EAP server implementation as a callback
 176          * context for TLS operations.
 177          */
 178         void *ssl_ctx;
 179
 180         /**
 181          * pac_opaque_encr_key - PAC-Opaque encryption key for EAP-FAST
 182          *
 183          * This parameter is used to set a key for EAP-FAST to encrypt the
 184          * PAC-Opaque data. It can be set to %NULL if EAP-FAST is not used. If
 185          * set, must point to a 16-octet key.
 186          */
 187         u8 *pac_opaque_encr_key;
 188
 189         /**
 190          * eap_fast_a_id - EAP-FAST authority identity (A-ID)
 191          *
 192          * If EAP-FAST is not used, this can be set to %NULL. In theory, this
 193          * is a variable length field, but due to some existing implementations
 194          * requiring A-ID to be 16 octets in length, it is recommended to use
 195          * that length for the field to provide interoperability with deployed
 196          * peer implementations.
 197          */
 198         u8 *eap_fast_a_id;
 199
 200         /**
 201          * eap_fast_a_id_len - Length of eap_fast_a_id buffer in octets
 202          */
 203         size_t eap_fast_a_id_len;
 204
 205         /**
 206          * eap_fast_a_id_info - EAP-FAST authority identifier information
 207          *
 208          * This A-ID-Info contains a user-friendly name for the A-ID. For
 209          * example, this could be the enterprise and server names in
 210          * human-readable format. This field is encoded as UTF-8. If EAP-FAST
 211          * is not used, this can be set to %NULL.
 212          */
 213         char *eap_fast_a_id_info;
 214
 215         /**
 216          * eap_fast_prov - EAP-FAST provisioning modes
 217          *
 218          * 0 = provisioning disabled, 1 = only anonymous provisioning allowed,
 219          * 2 = only authenticated provisioning allowed, 3 = both provisioning
 220          * modes allowed.
 221          */
 222         int eap_fast_prov;
 223
 224         /**
 225          * pac_key_lifetime - EAP-FAST PAC-Key lifetime in seconds
 226          *
 227          * This is the hard limit on how long a provisioned PAC-Key can be
 228          * used.
 229          */
 230         int pac_key_lifetime;
 231
 232         /**
 233          * pac_key_refresh_time - EAP-FAST PAC-Key refresh time in seconds
 234          *
 235          * This is a soft limit on the PAC-Key. The server will automatically
 236          * generate a new PAC-Key when this number of seconds (or fewer) of the
 237          * lifetime remains.
 238          */
 239         int pac_key_refresh_time;
 240
 241         /**
 242          * eap_sim_aka_result_ind - EAP-SIM/AKA protected success indication
 243          *
 244          * This controls whether the protected success/failure indication
 245          * (AT_RESULT_IND) is used with EAP-SIM and EAP-AKA.
 246          */
 247         int eap_sim_aka_result_ind;
 248
 249         /**
 250          * tnc - Trusted Network Connect (TNC)
 251          *
 252          * This controls whether TNC is enabled and will be required before the
 253          * peer is allowed to connect. Note: This is only used with EAP-TTLS
 254          * and EAP-FAST. If any other EAP method is enabled, the peer will be
 255          * allowed to connect without TNC.
 256          */
 257         int tnc;
 258
 259         /**
 260          * pwd_group - The D-H group assigned for EAP-pwd
 261          *
 262          * If EAP-pwd is not used it can be set to zero.
 263          */
 264         u16 pwd_group;
 265
 266         /**
 267          * server_id - Server identity
 268          */
 269         const char *server_id;
 270
 271         /**
 272          * erp - Whether EAP Re-authentication Protocol (ERP) is enabled
 273          *
 274          * This controls whether the authentication server derives ERP key
 275          * hierarchy (rRK and rIK) from full EAP authentication and allows
 276          * these keys to be used to perform ERP to derive rMSK instead of full
 277          * EAP authentication to derive MSK.
 278          */
 279         int erp;
 280
 281         const char *erp_domain;
 282
 283         struct dl_list erp_keys; /* struct eap_server_erp_key */
 284
 285         unsigned int tls_session_lifetime;
 286
 287         unsigned int tls_flags;
 288
 289         /**
 290          * wps - Wi-Fi Protected Setup context
 291          *
 292          * If WPS is used with an external RADIUS server (which is quite
 293          * unlikely configuration), this is used to provide a pointer to WPS
 294          * context data. Normally, this can be set to %NULL.
 295          */
 296         struct wps_context *wps;
 297
 298         /**
 299          * ipv6 - Whether to enable IPv6 support in the RADIUS server
 300          */
 301         int ipv6;
 302
 303         /**
 304          * start_time - Timestamp of server start
 305          */
 306         struct os_reltime start_time;
 307
 308         /**
 309          * counters - Statistics counters for server operations
 310          *
 311          * These counters are the sum over all clients.
 312          */
 313         struct radius_server_counters counters;
 314
 315         /**
 316          * get_eap_user - Callback for fetching EAP user information
 317          * @ctx: Context data from conf_ctx
 318          * @identity: User identity
 319          * @identity_len: identity buffer length in octets
 320          * @phase2: Whether this is for Phase 2 identity
 321          * @user: Data structure for filling in the user information
 322          * Returns: 0 on success, -1 on failure
 323          *
 324          * This is used to fetch information from user database. The callback
 325          * will fill in information about allowed EAP methods and the user
 326          * password. The password field will be an allocated copy of the
 327          * password data and RADIUS server will free it after use.
 328          */
 329         int (*get_eap_user)(void *ctx, const u8 *identity, size_t identity_len,
 330                             int phase2, struct eap_user *user);
 331
 332         /**
 333          * eap_req_id_text - Optional data for EAP-Request/Identity
 334          *
 335          * This can be used to configure an optional, displayable message that
 336          * will be sent in EAP-Request/Identity. This string can contain an
 337          * ASCII-0 character (nul) to separate network infromation per RFC
 338          * 4284. The actual string length is explicit provided in
 339          * eap_req_id_text_len since nul character will not be used as a string
 340          * terminator.
 341          */
 342         char *eap_req_id_text;
 343
 344         /**
 345          * eap_req_id_text_len - Length of eap_req_id_text buffer in octets
 346          */
 347         size_t eap_req_id_text_len;
 348
 349         /*
 350          * msg_ctx - Context data for wpa_msg() calls
 351          */
 352         void *msg_ctx;
 353
 354 #ifdef CONFIG_RADIUS_TEST
 355         char *dump_msk_file;
 356 #endif /* CONFIG_RADIUS_TEST */
 357
 358         char *subscr_remediation_url;
 359         u8 subscr_remediation_method;
 360         char *hs20_sim_provisioning_url;
 361
 362         char *t_c_server_url;
 363
 364 #ifdef CONFIG_SQLITE
 365         sqlite3 *db;
 366 #endif /* CONFIG_SQLITE */
 367 };
 368
 369
 370 #define RADIUS_DEBUG(args...) \
 371 wpa_printf(MSG_DEBUG, "RADIUS SRV: " args)
 372 #define RADIUS_ERROR(args...) \
 373 wpa_printf(MSG_ERROR, "RADIUS SRV: " args)
 374 #define RADIUS_DUMP(args...) \
 375 wpa_hexdump(MSG_MSGDUMP, "RADIUS SRV: " args)
 376 #define RADIUS_DUMP_ASCII(args...) \
 377 wpa_hexdump_ascii(MSG_MSGDUMP, "RADIUS SRV: " args)
 378
 379
 380 static void radius_server_session_timeout(void *eloop_ctx, void *timeout_ctx);
 381 static void radius_server_session_remove_timeout(void *eloop_ctx,
 382                                                  void *timeout_ctx);
 383
 384 #ifdef CONFIG_SQLITE
 385 #ifdef CONFIG_HS20
 386
 387 static int db_table_exists(sqlite3 *db, const char *name)
 388 {
 389         char cmd[128];
 390
 391         os_snprintf(cmd, sizeof(cmd), "SELECT 1 FROM %s;", name);
 392         return sqlite3_exec(db, cmd, NULL, NULL, NULL) == SQLITE_OK;
 393 }
 394
 395
 396 static int db_table_create_sim_provisioning(sqlite3 *db)
 397 {
 398         char *err = NULL;
 399         const char *sql =
 400                 "CREATE TABLE sim_provisioning("
 401                 " mobile_identifier_hash TEXT PRIMARY KEY,"
 402                 " imsi TEXT,"
 403                 " mac_addr TEXT,"
 404                 " eap_method TEXT,"
 405                 " timestamp TEXT"
 406                 ");";
 407
 408         RADIUS_DEBUG("Adding database table for SIM provisioning information");
 409         if (sqlite3_exec(db, sql, NULL, NULL, &err) != SQLITE_OK) {
 410                 RADIUS_ERROR("SQLite error: %s", err);
 411                 sqlite3_free(err);
 412                 return -1;
 413         }
 414
 415         return 0;
 416 }
 417
 418 #endif /* CONFIG_HS20 */
 419 #endif /* CONFIG_SQLITE */
 420
 421
 422 void srv_log(struct radius_session *sess, const char *fmt, ...)
 423 PRINTF_FORMAT(2, 3);
 424
 425 void srv_log(struct radius_session *sess, const char *fmt, ...)
 426 {
 427         va_list ap;
 428         char *buf;
 429         int buflen;
 430
 431         va_start(ap, fmt);
 432         buflen = vsnprintf(NULL, 0, fmt, ap) + 1;
 433         va_end(ap);
 434
 435         buf = os_malloc(buflen);
 436         if (buf == NULL)
 437                 return;
 438         va_start(ap, fmt);
 439         vsnprintf(buf, buflen, fmt, ap);
 440         va_end(ap);
 441
 442         RADIUS_DEBUG("[0x%x %s] %s", sess->sess_id, sess->nas_ip, buf);
 443
 444 #ifdef CONFIG_SQLITE
 445         if (sess->server->db) {
 446                 char *sql;
 447                 sql = sqlite3_mprintf("INSERT INTO authlog"
 448                                       "(timestamp,session,nas_ip,username,note)"
 449                                       " VALUES ("
 450                                       "strftime('%%Y-%%m-%%d %%H:%%M:%%f',"
 451                                       "'now'),%u,%Q,%Q,%Q)",
 452                                       sess->sess_id, sess->nas_ip,
 453                                       sess->username, buf);
 454                 if (sql) {
 455                         if (sqlite3_exec(sess->server->db, sql, NULL, NULL,
 456                                          NULL) != SQLITE_OK) {
 457                                 RADIUS_ERROR("Failed to add authlog entry into sqlite database: %s",
 458                                              sqlite3_errmsg(sess->server->db));
 459                         }
 460                         sqlite3_free(sql);
 461                 }
 462         }
 463 #endif /* CONFIG_SQLITE */
 464
 465         os_free(buf);
 466 }
 467
 468
 469 static struct radius_client *
 470 radius_server_get_client(struct radius_server_data *data, struct in_addr *addr,
 471                          int ipv6)
 472 {
 473         struct radius_client *client = data->clients;
 474
 475         while (client) {
 476 #ifdef CONFIG_IPV6
 477                 if (ipv6) {
 478                         struct in6_addr *addr6;
 479                         int i;
 480
 481                         addr6 = (struct in6_addr *) addr;
 482                         for (i = 0; i < 16; i++) {
 483                                 if ((addr6->s6_addr[i] &
 484                                      client->mask6.s6_addr[i]) !=
 485                                     (client->addr6.s6_addr[i] &
 486                                      client->mask6.s6_addr[i])) {
 487                                         i = 17;
 488                                         break;
 489                                 }
 490                         }
 491                         if (i == 16) {
 492                                 break;
 493                         }
 494                 }
 495 #endif /* CONFIG_IPV6 */
 496                 if (!ipv6 && (client->addr.s_addr & client->mask.s_addr) ==
 497                     (addr->s_addr & client->mask.s_addr)) {
 498                         break;
 499                 }
 500
 501                 client = client->next;
 502         }
 503
 504         return client;
 505 }
 506
 507
 508 static struct radius_session *
 509 radius_server_get_session(struct radius_client *client, unsigned int sess_id)
 510 {
 511         struct radius_session *sess = client->sessions;
 512
 513         while (sess) {
 514                 if (sess->sess_id == sess_id) {
 515                         break;
 516                 }
 517                 sess = sess->next;
 518         }
 519
 520         return sess;
 521 }
 522
 523
 524 static void radius_server_session_free(struct radius_server_data *data,
 525                                        struct radius_session *sess)
 526 {
 527         eloop_cancel_timeout(radius_server_session_timeout, data, sess);
 528         eloop_cancel_timeout(radius_server_session_remove_timeout, data, sess);
 529         eap_server_sm_deinit(sess->eap);
 530         radius_msg_free(sess->last_msg);
 531         os_free(sess->last_from_addr);
 532         radius_msg_free(sess->last_reply);
 533         os_free(sess->username);
 534         os_free(sess->nas_ip);
 535         os_free(sess);
 536         data->num_sess--;
 537 }
 538
 539
 540 static void radius_server_session_remove(struct radius_server_data *data,
 541                                          struct radius_session *sess)
 542 {
 543         struct radius_client *client = sess->client;
 544         struct radius_session *session, *prev;
 545
 546         eloop_cancel_timeout(radius_server_session_remove_timeout, data, sess);
 547
 548         prev = NULL;
 549         session = client->sessions;
 550         while (session) {
 551                 if (session == sess) {
 552                         if (prev == NULL) {
 553                                 client->sessions = sess->next;
 554                         } else {
 555                                 prev->next = sess->next;
 556                         }
 557                         radius_server_session_free(data, sess);
 558                         break;
 559                 }
 560                 prev = session;
 561                 session = session->next;
 562         }
 563 }
 564
 565
 566 static void radius_server_session_remove_timeout(void *eloop_ctx,
 567                                                  void *timeout_ctx)
 568 {
 569         struct radius_server_data *data = eloop_ctx;
 570         struct radius_session *sess = timeout_ctx;
 571         RADIUS_DEBUG("Removing completed session 0x%x", sess->sess_id);
 572         radius_server_session_remove(data, sess);
 573 }
 574
 575
 576 static void radius_server_session_timeout(void *eloop_ctx, void *timeout_ctx)
 577 {
 578         struct radius_server_data *data = eloop_ctx;
 579         struct radius_session *sess = timeout_ctx;
 580
 581         RADIUS_DEBUG("Timing out authentication session 0x%x", sess->sess_id);
 582         radius_server_session_remove(data, sess);
 583 }
 584
 585
 586 static struct radius_session *
 587 radius_server_new_session(struct radius_server_data *data,
 588                           struct radius_client *client)
 589 {
 590         struct radius_session *sess;
 591
 592         if (data->num_sess >= RADIUS_MAX_SESSION) {
 593                 RADIUS_DEBUG("Maximum number of existing session - no room "
 594                              "for a new session");
 595                 return NULL;
 596         }
 597
 598         sess = os_zalloc(sizeof(*sess));
 599         if (sess == NULL)
 600                 return NULL;
 601
 602         sess->server = data;
 603         sess->client = client;
 604         sess->sess_id = data->next_sess_id++;
 605         sess->next = client->sessions;
 606         client->sessions = sess;
 607         eloop_register_timeout(RADIUS_SESSION_TIMEOUT, 0,
 608                                radius_server_session_timeout, data, sess);
 609         data->num_sess++;
 610         return sess;
 611 }
 612
 613
 614 #ifdef CONFIG_TESTING_OPTIONS
 615 static void radius_server_testing_options_tls(struct radius_session *sess,
 616                                               const char *tls,
 617                                               struct eap_config *eap_conf)
 618 {
 619         int test = atoi(tls);
 620
 621         switch (test) {
 622         case 1:
 623                 srv_log(sess, "TLS test - break VerifyData");
 624                 eap_conf->tls_test_flags = TLS_BREAK_VERIFY_DATA;
 625                 break;
 626         case 2:
 627                 srv_log(sess, "TLS test - break ServerKeyExchange ServerParams hash");
 628                 eap_conf->tls_test_flags = TLS_BREAK_SRV_KEY_X_HASH;
 629                 break;
 630         case 3:
 631                 srv_log(sess, "TLS test - break ServerKeyExchange ServerParams Signature");
 632                 eap_conf->tls_test_flags = TLS_BREAK_SRV_KEY_X_SIGNATURE;
 633                 break;
 634         case 4:
 635                 srv_log(sess, "TLS test - RSA-DHE using a short 511-bit prime");
 636                 eap_conf->tls_test_flags = TLS_DHE_PRIME_511B;
 637                 break;
 638         case 5:
 639                 srv_log(sess, "TLS test - RSA-DHE using a short 767-bit prime");
 640                 eap_conf->tls_test_flags = TLS_DHE_PRIME_767B;
 641                 break;
 642         case 6:
 643                 srv_log(sess, "TLS test - RSA-DHE using a bogus 15 \"prime\"");
 644                 eap_conf->tls_test_flags = TLS_DHE_PRIME_15;
 645                 break;
 646         case 7:
 647                 srv_log(sess, "TLS test - RSA-DHE using a short 58-bit prime in long container");
 648                 eap_conf->tls_test_flags = TLS_DHE_PRIME_58B;
 649                 break;
 650         case 8:
 651                 srv_log(sess, "TLS test - RSA-DHE using a non-prime");
 652                 eap_conf->tls_test_flags = TLS_DHE_NON_PRIME;
 653                 break;
 654         default:
 655                 srv_log(sess, "Unrecognized TLS test");
 656                 break;
 657         }
 658 }
 659 #endif /* CONFIG_TESTING_OPTIONS */
 660
 661 static void radius_server_testing_options(struct radius_session *sess,
 662                                           struct eap_config *eap_conf)
 663 {
 664 #ifdef CONFIG_TESTING_OPTIONS
 665         const char *pos;
 666
 667         pos = os_strstr(sess->username, "@test-");
 668         if (pos == NULL)
 669                 return;
 670         pos += 6;
 671         if (os_strncmp(pos, "tls-", 4) == 0)
 672                 radius_server_testing_options_tls(sess, pos + 4, eap_conf);
 673         else
 674                 srv_log(sess, "Unrecognized test: %s", pos);
 675 #endif /* CONFIG_TESTING_OPTIONS */
 676 }
 677
 678
 679 #ifdef CONFIG_ERP
 680 static struct eap_server_erp_key *
 681 radius_server_erp_find_key(struct radius_server_data *data, const char *keyname)
 682 {
 683         struct eap_server_erp_key *erp;
 684
 685         dl_list_for_each(erp, &data->erp_keys, struct eap_server_erp_key,
 686                          list) {
 687                 if (os_strcmp(erp->keyname_nai, keyname) == 0)
 688                         return erp;
 689         }
 690
 691         return NULL;
 692 }
 693 #endif /* CONFIG_ERP */
 694
 695
 696 static struct radius_session *
 697 radius_server_get_new_session(struct radius_server_data *data,
 698                               struct radius_client *client,
 699                               struct radius_msg *msg, const char *from_addr)
 700 {
 701         u8 *user, *id;
 702         size_t user_len, id_len;
 703         int res;
 704         struct radius_session *sess;
 705         struct eap_config eap_conf;
 706         struct eap_user *tmp;
 707
 708         RADIUS_DEBUG("Creating a new session");
 709
 710         if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_USER_NAME, &user,
 711                                     &user_len, NULL) < 0) {
 712                 RADIUS_DEBUG("Could not get User-Name");
 713                 return NULL;
 714         }
 715         RADIUS_DUMP_ASCII("User-Name", user, user_len);
 716
 717         tmp = os_zalloc(sizeof(*tmp));
 718         if (!tmp)
 719                 return NULL;
 720
 721         res = data->get_eap_user(data->conf_ctx, user, user_len, 0, tmp);
 722 #ifdef CONFIG_ERP
 723         if (res != 0 && data->erp) {
 724                 char *username;
 725
 726                 username = os_zalloc(user_len + 1);
 727                 if (username) {
 728                         os_memcpy(username, user, user_len);
 729                         if (radius_server_erp_find_key(data, username))
 730                                 res = 0;
 731                         os_free(username);
 732                 }
 733         }
 734 #endif /* CONFIG_ERP */
 735         if (res != 0) {
 736                 RADIUS_DEBUG("User-Name not found from user database");
 737                 eap_user_free(tmp);
 738                 return NULL;
 739         }
 740
 741         RADIUS_DEBUG("Matching user entry found");
 742         sess = radius_server_new_session(data, client);
 743         if (sess == NULL) {
 744                 RADIUS_DEBUG("Failed to create a new session");
 745                 eap_user_free(tmp);
 746                 return NULL;
 747         }
 748         sess->accept_attr = tmp->accept_attr;
 749         sess->macacl = tmp->macacl;
 750         eap_user_free(tmp);
 751
 752         sess->username = os_malloc(user_len * 4 + 1);
 753         if (sess->username == NULL) {
 754                 radius_server_session_remove(data, sess);
 755                 return NULL;
 756         }
 757         printf_encode(sess->username, user_len * 4 + 1, user, user_len);
 758
 759         sess->nas_ip = os_strdup(from_addr);
 760         if (sess->nas_ip == NULL) {
 761                 radius_server_session_remove(data, sess);
 762                 return NULL;
 763         }
 764
 765         if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_CALLING_STATION_ID, &id,
 766                                     &id_len, NULL) == 0) {
 767                 char buf[3 * ETH_ALEN];
 768
 769                 os_memset(buf, 0, sizeof(buf));
 770                 if (id_len >= sizeof(buf))
 771                         id_len = sizeof(buf) - 1;
 772                 os_memcpy(buf, id, id_len);
 773                 if (hwaddr_aton2(buf, sess->mac_addr) < 0)
 774                         os_memset(sess->mac_addr, 0, ETH_ALEN);
 775                 else
 776                         RADIUS_DEBUG("Calling-Station-Id: " MACSTR,
 777                                      MAC2STR(sess->mac_addr));
 778         }
 779
 780         srv_log(sess, "New session created");
 781
 782         os_memset(&eap_conf, 0, sizeof(eap_conf));
 783         eap_conf.ssl_ctx = data->ssl_ctx;
 784         eap_conf.msg_ctx = data->msg_ctx;
 785         eap_conf.eap_sim_db_priv = data->eap_sim_db_priv;
 786         eap_conf.backend_auth = TRUE;
 787         eap_conf.eap_server = 1;
 788         eap_conf.pac_opaque_encr_key = data->pac_opaque_encr_key;
 789         eap_conf.eap_fast_a_id = data->eap_fast_a_id;
 790         eap_conf.eap_fast_a_id_len = data->eap_fast_a_id_len;
 791         eap_conf.eap_fast_a_id_info = data->eap_fast_a_id_info;
 792         eap_conf.eap_fast_prov = data->eap_fast_prov;
 793         eap_conf.pac_key_lifetime = data->pac_key_lifetime;
 794         eap_conf.pac_key_refresh_time = data->pac_key_refresh_time;
 795         eap_conf.eap_sim_aka_result_ind = data->eap_sim_aka_result_ind;
 796         eap_conf.tnc = data->tnc;
 797         eap_conf.wps = data->wps;
 798         eap_conf.pwd_group = data->pwd_group;
 799         eap_conf.server_id = (const u8 *) data->server_id;
 800         eap_conf.server_id_len = os_strlen(data->server_id);
 801         eap_conf.erp = data->erp;
 802         eap_conf.tls_session_lifetime = data->tls_session_lifetime;
 803         eap_conf.tls_flags = data->tls_flags;
 804         radius_server_testing_options(sess, &eap_conf);
 805         sess->eap = eap_server_sm_init(sess, &radius_server_eapol_cb,
 806                                        &eap_conf);
 807         if (sess->eap == NULL) {
 808                 RADIUS_DEBUG("Failed to initialize EAP state machine for the "
 809                              "new session");
 810                 radius_server_session_remove(data, sess);
 811                 return NULL;
 812         }
 813         sess->eap_if = eap_get_interface(sess->eap);
 814         sess->eap_if->eapRestart = TRUE;
 815         sess->eap_if->portEnabled = TRUE;
 816
 817         RADIUS_DEBUG("New session 0x%x initialized", sess->sess_id);
 818
 819         return sess;
 820 }
 821
 822
 823 #ifdef CONFIG_HS20
 824 static void radius_srv_hs20_t_c_pending(struct radius_session *sess)
 825 {
 826 #ifdef CONFIG_SQLITE
 827         char *sql;
 828         char addr[3 * ETH_ALEN], *id_str;
 829         const u8 *id;
 830         size_t id_len;
 831
 832         if (!sess->server->db || !sess->eap ||
 833             is_zero_ether_addr(sess->mac_addr))
 834                 return;
 835
 836         os_snprintf(addr, sizeof(addr), MACSTR, MAC2STR(sess->mac_addr));
 837
 838         id = eap_get_identity(sess->eap, &id_len);
 839         if (!id)
 840                 return;
 841         id_str = os_malloc(id_len + 1);
 842         if (!id_str)
 843                 return;
 844         os_memcpy(id_str, id, id_len);
 845         id_str[id_len] = '\0';
 846
 847         sql = sqlite3_mprintf("INSERT OR REPLACE INTO pending_tc (mac_addr,identity) VALUES (%Q,%Q)",
 848                               addr, id_str);
 849         os_free(id_str);
 850         if (!sql)
 851                 return;
 852
 853         if (sqlite3_exec(sess->server->db, sql, NULL, NULL, NULL) !=
 854             SQLITE_OK) {
 855                 RADIUS_ERROR("Failed to add pending_tc entry into sqlite database: %s",
 856                              sqlite3_errmsg(sess->server->db));
 857         }
 858         sqlite3_free(sql);
 859 #endif /* CONFIG_SQLITE */
 860 }
 861 #endif /* CONFIG_HS20 */
 862
 863
 864 static void radius_server_add_session(struct radius_session *sess)
 865 {
 866 #ifdef CONFIG_SQLITE
 867         char *sql;
 868         char addr_txt[ETH_ALEN * 3];
 869         struct os_time now;
 870
 871         if (!sess->server->db)
 872                 return;
 873
 874
 875         os_snprintf(addr_txt, sizeof(addr_txt), MACSTR,
 876                     MAC2STR(sess->mac_addr));
 877
 878         os_get_time(&now);
 879         sql = sqlite3_mprintf("INSERT OR REPLACE INTO current_sessions(mac_addr,identity,start_time,nas,hs20_t_c_filtering) VALUES (%Q,%Q,%d,%Q,%u)",
 880                               addr_txt, sess->username, now.sec,
 881                               sess->nas_ip, sess->t_c_filtering);
 882         if (sql) {
 883                         if (sqlite3_exec(sess->server->db, sql, NULL, NULL,
 884                                          NULL) != SQLITE_OK) {
 885                                 RADIUS_ERROR("Failed to add current_sessions entry into sqlite database: %s",
 886                                              sqlite3_errmsg(sess->server->db));
 887                         }
 888                         sqlite3_free(sql);
 889         }
 890 #endif /* CONFIG_SQLITE */
 891 }
 892
 893
 894 static void db_update_last_msk(struct radius_session *sess, const char *msk)
 895 {
 896 #ifdef CONFIG_RADIUS_TEST
 897 #ifdef CONFIG_SQLITE
 898         char *sql = NULL;
 899         char *id_str = NULL;
 900         const u8 *id;
 901         size_t id_len;
 902         const char *serial_num;
 903
 904         if (!sess->server->db)
 905                 return;
 906
 907         serial_num = eap_get_serial_num(sess->eap);
 908         if (serial_num) {
 909                 id_len = 5 + os_strlen(serial_num) + 1;
 910                 id_str = os_malloc(id_len);
 911                 if (!id_str)
 912                         return;
 913                 os_snprintf(id_str, id_len, "cert-%s", serial_num);
 914         } else {
 915                 id = eap_get_identity(sess->eap, &id_len);
 916                 if (!id)
 917                         return;
 918                 id_str = os_malloc(id_len + 1);
 919                 if (!id_str)
 920                         return;
 921                 os_memcpy(id_str, id, id_len);
 922                 id_str[id_len] = '\0';
 923         }
 924
 925         sql = sqlite3_mprintf("UPDATE users SET last_msk=%Q WHERE identity=%Q",
 926                               msk, id_str);
 927         os_free(id_str);
 928         if (!sql)
 929                 return;
 930
 931         if (sqlite3_exec(sess->server->db, sql, NULL, NULL, NULL) !=
 932             SQLITE_OK) {
 933                 RADIUS_DEBUG("Failed to update last_msk: %s",
 934                              sqlite3_errmsg(sess->server->db));
 935         }
 936         sqlite3_free(sql);
 937 #endif /* CONFIG_SQLITE */
 938 #endif /* CONFIG_RADIUS_TEST */
 939 }
 940
 941
 942 #ifdef CONFIG_HS20
 943
 944 static int radius_server_is_sim_method(struct radius_session *sess)
 945 {
 946         const char *name;
 947
 948         name = eap_get_method(sess->eap);
 949         return name &&
 950                 (os_strcmp(name, "SIM") == 0 ||
 951                  os_strcmp(name, "AKA") == 0 ||
 952                  os_strcmp(name, "AKA'") == 0);
 953 }
 954
 955
 956 static int radius_server_hs20_missing_sim_pps(struct radius_msg *request)
 957 {
 958         u8 *buf, *pos, *end, type, sublen;
 959         size_t len;
 960
 961         buf = NULL;
 962         for (;;) {
 963                 if (radius_msg_get_attr_ptr(request,
 964                                             RADIUS_ATTR_VENDOR_SPECIFIC,
 965                                             &buf, &len, buf) < 0)
 966                         return 0;
 967                 if (len < 6)
 968                         continue;
 969                 pos = buf;
 970                 end = buf + len;
 971                 if (WPA_GET_BE32(pos) != RADIUS_VENDOR_ID_WFA)
 972                         continue;
 973                 pos += 4;
 974
 975                 type = *pos++;
 976                 sublen = *pos++;
 977                 if (sublen < 2)
 978                         continue; /* invalid length */
 979                 sublen -= 2; /* skip header */
 980                 if (pos + sublen > end)
 981                         continue; /* invalid WFA VSA */
 982
 983                 if (type != RADIUS_VENDOR_ATTR_WFA_HS20_STA_VERSION)
 984                         continue;
 985
 986                 RADIUS_DUMP("HS2.0 mobile device version", pos, sublen);
 987                 if (sublen < 1 + 2)
 988                         continue;
 989                 if (pos[0] == 0)
 990                         continue; /* Release 1 STA does not support provisioning
 991
 992                                    */
 993                 /* UpdateIdentifier 0 indicates no PPS MO */
 994                 return WPA_GET_BE16(pos + 1) == 0;
 995         }
 996 }
 997
 998
 999 #define HS20_MOBILE_ID_HASH_LEN 16
1000
1001 static int radius_server_sim_provisioning_session(struct radius_session *sess,
1002                                                   const u8 *hash)
1003 {
1004 #ifdef CONFIG_SQLITE
1005         char *sql;
1006         char addr_txt[ETH_ALEN * 3];
1007         char hash_txt[2 * HS20_MOBILE_ID_HASH_LEN + 1];
1008         struct os_time now;
1009         int res;
1010         const char *imsi, *eap_method;
1011
1012         if (!sess->server->db ||
1013             (!db_table_exists(sess->server->db, "sim_provisioning") &&
1014              db_table_create_sim_provisioning(sess->server->db) < 0))
1015                 return -1;
1016
1017         imsi = eap_get_imsi(sess->eap);
1018         if (!imsi)
1019                 return -1;
1020
1021         eap_method = eap_get_method(sess->eap);
1022         if (!eap_method)
1023                 return -1;
1024
1025         os_snprintf(addr_txt, sizeof(addr_txt), MACSTR,
1026                     MAC2STR(sess->mac_addr));
1027         wpa_snprintf_hex(hash_txt, sizeof(hash_txt), hash,
1028                          HS20_MOBILE_ID_HASH_LEN);
1029
1030         os_get_time(&now);
1031         sql = sqlite3_mprintf("INSERT INTO sim_provisioning(mobile_identifier_hash,imsi,mac_addr,eap_method,timestamp) VALUES (%Q,%Q,%Q,%Q,%u)",
1032                               hash_txt, imsi, addr_txt, eap_method, now.sec);
1033         if (!sql)
1034                 return -1;
1035
1036         if (sqlite3_exec(sess->server->db, sql, NULL, NULL, NULL) !=
1037             SQLITE_OK) {
1038                 RADIUS_ERROR("Failed to add SIM provisioning entry into sqlite database: %s",
1039                              sqlite3_errmsg(sess->server->db));
1040                 res = -1;
1041         } else {
1042                 res = 0;
1043         }
1044         sqlite3_free(sql);
1045         return res;
1046 #endif /* CONFIG_SQLITE */
1047         return -1;
1048 }
1049
1050 #endif /* CONFIG_HS20 */
1051
1052
1053 static struct radius_msg *
1054 radius_server_encapsulate_eap(struct radius_server_data *data,
1055                               struct radius_client *client,
1056                               struct radius_session *sess,
1057                               struct radius_msg *request)
1058 {
1059         struct radius_msg *msg;
1060         int code;
1061         unsigned int sess_id;
1062         struct radius_hdr *hdr = radius_msg_get_hdr(request);
1063         u16 reason = WLAN_REASON_IEEE_802_1X_AUTH_FAILED;
1064
1065         if (sess->eap_if->eapFail) {
1066                 sess->eap_if->eapFail = FALSE;
1067                 code = RADIUS_CODE_ACCESS_REJECT;
1068         } else if (sess->eap_if->eapSuccess) {
1069                 sess->eap_if->eapSuccess = FALSE;
1070                 code = RADIUS_CODE_ACCESS_ACCEPT;
1071         } else {
1072                 sess->eap_if->eapReq = FALSE;
1073                 code = RADIUS_CODE_ACCESS_CHALLENGE;
1074         }
1075
1076         msg = radius_msg_new(code, hdr->identifier);
1077         if (msg == NULL) {
1078                 RADIUS_DEBUG("Failed to allocate reply message");
1079                 return NULL;
1080         }
1081
1082         sess_id = htonl(sess->sess_id);
1083         if (code == RADIUS_CODE_ACCESS_CHALLENGE &&
1084             !radius_msg_add_attr(msg, RADIUS_ATTR_STATE,
1085                                  (u8 *) &sess_id, sizeof(sess_id))) {
1086                 RADIUS_DEBUG("Failed to add State attribute");
1087         }
1088
1089         if (sess->eap_if->eapReqData &&
1090             !radius_msg_add_eap(msg, wpabuf_head(sess->eap_if->eapReqData),
1091                                 wpabuf_len(sess->eap_if->eapReqData))) {
1092                 RADIUS_DEBUG("Failed to add EAP-Message attribute");
1093         }
1094
1095         if (code == RADIUS_CODE_ACCESS_ACCEPT && sess->eap_if->eapKeyData) {
1096                 int len;
1097 #ifdef CONFIG_RADIUS_TEST
1098                 char buf[2 * 64 + 1];
1099
1100                 len = sess->eap_if->eapKeyDataLen;
1101                 if (len > 64)
1102                         len = 64;
1103                 len = wpa_snprintf_hex(buf, sizeof(buf),
1104                                        sess->eap_if->eapKeyData, len);
1105                 buf[len] = '\0';
1106
1107                 if (data->dump_msk_file) {
1108                         FILE *f;
1109
1110                         f = fopen(data->dump_msk_file, "a");
1111                         if (f) {
1112                                 len = sess->eap_if->eapKeyDataLen;
1113                                 if (len > 64)
1114                                         len = 64;
1115                                 len = wpa_snprintf_hex(
1116                                         buf, sizeof(buf),
1117                                         sess->eap_if->eapKeyData, len);
1118                                 buf[len] = '\0';
1119                                 fprintf(f, "%s\n", buf);
1120                                 fclose(f);
1121                         }
1122                 }
1123
1124                 db_update_last_msk(sess, buf);
1125 #endif /* CONFIG_RADIUS_TEST */
1126                 if (sess->eap_if->eapKeyDataLen > 64) {
1127                         len = 32;
1128                 } else {
1129                         len = sess->eap_if->eapKeyDataLen / 2;
1130                 }
1131                 if (!radius_msg_add_mppe_keys(msg, hdr->authenticator,
1132                                               (u8 *) client->shared_secret,
1133                                               client->shared_secret_len,
1134                                               sess->eap_if->eapKeyData + len,
1135                                               len, sess->eap_if->eapKeyData,
1136                                               len)) {
1137                         RADIUS_DEBUG("Failed to add MPPE key attributes");
1138                 }
1139         }
1140
1141 #ifdef CONFIG_HS20
1142         if (code == RADIUS_CODE_ACCESS_ACCEPT && sess->remediation &&
1143             data->subscr_remediation_url) {
1144                 u8 *buf;
1145                 size_t url_len = os_strlen(data->subscr_remediation_url);
1146                 buf = os_malloc(1 + url_len);
1147                 if (buf == NULL) {
1148                         radius_msg_free(msg);
1149                         return NULL;
1150                 }
1151                 buf[0] = data->subscr_remediation_method;
1152                 os_memcpy(&buf[1], data->subscr_remediation_url, url_len);
1153                 if (!radius_msg_add_wfa(
1154                             msg, RADIUS_VENDOR_ATTR_WFA_HS20_SUBSCR_REMEDIATION,
1155                             buf, 1 + url_len)) {
1156                         RADIUS_DEBUG("Failed to add WFA-HS20-SubscrRem");
1157                 }
1158                 os_free(buf);
1159         } else if (code == RADIUS_CODE_ACCESS_ACCEPT && sess->remediation) {
1160                 u8 buf[1];
1161                 if (!radius_msg_add_wfa(
1162                             msg, RADIUS_VENDOR_ATTR_WFA_HS20_SUBSCR_REMEDIATION,
1163                             buf, 0)) {
1164                         RADIUS_DEBUG("Failed to add WFA-HS20-SubscrRem");
1165                 }
1166         } else if (code == RADIUS_CODE_ACCESS_ACCEPT &&
1167                    data->hs20_sim_provisioning_url &&
1168                    radius_server_is_sim_method(sess) &&
1169                    radius_server_hs20_missing_sim_pps(request)) {
1170                 u8 *buf, *pos, hash[HS20_MOBILE_ID_HASH_LEN];
1171                 size_t prefix_len, url_len;
1172
1173                 RADIUS_DEBUG("Device needs HS 2.0 SIM provisioning");
1174
1175                 if (os_get_random(hash, HS20_MOBILE_ID_HASH_LEN) < 0) {
1176                         radius_msg_free(msg);
1177                         return NULL;
1178                 }
1179                 RADIUS_DUMP("hotspot2dot0-mobile-identifier-hash",
1180                             hash, HS20_MOBILE_ID_HASH_LEN);
1181
1182                 if (radius_server_sim_provisioning_session(sess, hash) < 0) {
1183                         radius_msg_free(msg);
1184                         return NULL;
1185                 }
1186
1187                 prefix_len = os_strlen(data->hs20_sim_provisioning_url);
1188                 url_len = prefix_len + 2 * HS20_MOBILE_ID_HASH_LEN;
1189                 buf = os_malloc(1 + url_len + 1);
1190                 if (!buf) {
1191                         radius_msg_free(msg);
1192                         return NULL;
1193                 }
1194                 pos = buf;
1195                 *pos++ = data->subscr_remediation_method;
1196                 os_memcpy(pos, data->hs20_sim_provisioning_url, prefix_len);
1197                 pos += prefix_len;
1198                 wpa_snprintf_hex((char *) pos, 2 * HS20_MOBILE_ID_HASH_LEN + 1,
1199                                  hash, HS20_MOBILE_ID_HASH_LEN);
1200                 RADIUS_DEBUG("HS 2.0 subscription remediation URL: %s",
1201                              (char *) &buf[1]);
1202                 if (!radius_msg_add_wfa(
1203                             msg, RADIUS_VENDOR_ATTR_WFA_HS20_SUBSCR_REMEDIATION,
1204                             buf, 1 + url_len)) {
1205                         RADIUS_DEBUG("Failed to add WFA-HS20-SubscrRem");
1206                 }
1207                 os_free(buf);
1208         }
1209
1210         if (code == RADIUS_CODE_ACCESS_ACCEPT && sess->t_c_filtering) {
1211                 u8 buf[4] = { 0x01, 0x00, 0x00, 0x00 }; /* E=1 */
1212                 const char *url = data->t_c_server_url, *pos;
1213                 char *url2, *end2, *pos2;
1214                 size_t url_len;
1215
1216                 if (!radius_msg_add_wfa(
1217                             msg, RADIUS_VENDOR_ATTR_WFA_HS20_T_C_FILTERING,
1218                             buf, sizeof(buf))) {
1219                         RADIUS_DEBUG("Failed to add WFA-HS20-T-C-Filtering");
1220                         radius_msg_free(msg);
1221                         return NULL;
1222                 }
1223
1224                 if (!url) {
1225                         RADIUS_DEBUG("No t_c_server_url configured");
1226                         radius_msg_free(msg);
1227                         return NULL;
1228                 }
1229
1230                 pos = os_strstr(url, "@1@");
1231                 if (!pos) {
1232                         RADIUS_DEBUG("No @1@ macro in t_c_server_url");
1233                         radius_msg_free(msg);
1234                         return NULL;
1235                 }
1236
1237                 url_len = os_strlen(url) + ETH_ALEN * 3 - 1 - 3;
1238                 url2 = os_malloc(url_len + 1);
1239                 if (!url2) {
1240                         RADIUS_DEBUG("Failed to allocate room for T&C Server URL");
1241                         os_free(url2);
1242                         radius_msg_free(msg);
1243                         return NULL;
1244                 }
1245                 pos2 = url2;
1246                 end2 = url2 + url_len + 1;
1247                 os_memcpy(pos2, url, pos - url);
1248                 pos2 += pos - url;
1249                 os_snprintf(pos2, end2 - pos2, MACSTR, MAC2STR(sess->mac_addr));
1250                 pos2 += ETH_ALEN * 3 - 1;
1251                 os_memcpy(pos2, pos + 3, os_strlen(pos + 3));
1252                 if (!radius_msg_add_wfa(msg,
1253                                         RADIUS_VENDOR_ATTR_WFA_HS20_T_C_URL,
1254                                         (const u8 *) url2, url_len)) {
1255                         RADIUS_DEBUG("Failed to add WFA-HS20-T-C-URL");
1256                         os_free(url2);
1257                         radius_msg_free(msg);
1258                         return NULL;
1259                 }
1260                 os_free(url2);
1261
1262                 radius_srv_hs20_t_c_pending(sess);
1263         }
1264 #endif /* CONFIG_HS20 */
1265
1266         if (radius_msg_copy_attr(msg, request, RADIUS_ATTR_PROXY_STATE) < 0) {
1267                 RADIUS_DEBUG("Failed to copy Proxy-State attribute(s)");
1268                 radius_msg_free(msg);
1269                 return NULL;
1270         }
1271
1272         if (code == RADIUS_CODE_ACCESS_ACCEPT) {
1273                 struct hostapd_radius_attr *attr;
1274                 for (attr = sess->accept_attr; attr; attr = attr->next) {
1275                         if (!radius_msg_add_attr(msg, attr->type,
1276                                                  wpabuf_head(attr->val),
1277                                                  wpabuf_len(attr->val))) {
1278                                 wpa_printf(MSG_ERROR, "Could not add RADIUS attribute");
1279                                 radius_msg_free(msg);
1280                                 return NULL;
1281                         }
1282                 }
1283         }
1284
1285         if (code == RADIUS_CODE_ACCESS_REJECT) {
1286                 if (radius_msg_add_attr_int32(msg, RADIUS_ATTR_WLAN_REASON_CODE,
1287                                               reason) < 0) {
1288                         RADIUS_DEBUG("Failed to add WLAN-Reason-Code attribute");
1289                         radius_msg_free(msg);
1290                         return NULL;
1291                 }
1292         }
1293
1294         if (radius_msg_finish_srv(msg, (u8 *) client->shared_secret,
1295                                   client->shared_secret_len,
1296                                   hdr->authenticator) < 0) {
1297                 RADIUS_DEBUG("Failed to add Message-Authenticator attribute");
1298         }
1299
1300         if (code == RADIUS_CODE_ACCESS_ACCEPT)
1301                 radius_server_add_session(sess);
1302
1303         return msg;
1304 }
1305
1306
1307 static struct radius_msg *
1308 radius_server_macacl(struct radius_server_data *data,
1309                      struct radius_client *client,
1310                      struct radius_session *sess,
1311                      struct radius_msg *request)
1312 {
1313         struct radius_msg *msg;
1314         int code;
1315         struct radius_hdr *hdr = radius_msg_get_hdr(request);
1316         u8 *pw;
1317         size_t pw_len;
1318
1319         code = RADIUS_CODE_ACCESS_ACCEPT;
1320
1321         if (radius_msg_get_attr_ptr(request, RADIUS_ATTR_USER_PASSWORD, &pw,
1322                                     &pw_len, NULL) < 0) {
1323                 RADIUS_DEBUG("Could not get User-Password");
1324                 code = RADIUS_CODE_ACCESS_REJECT;
1325         } else {
1326                 int res;
1327                 struct eap_user tmp;
1328
1329                 os_memset(&tmp, 0, sizeof(tmp));
1330                 res = data->get_eap_user(data->conf_ctx, (u8 *) sess->username,
1331                                          os_strlen(sess->username), 0, &tmp);
1332                 if (res || !tmp.macacl || tmp.password == NULL) {
1333                         RADIUS_DEBUG("No MAC ACL user entry");
1334                         bin_clear_free(tmp.password, tmp.password_len);
1335                         code = RADIUS_CODE_ACCESS_REJECT;
1336                 } else {
1337                         u8 buf[128];
1338                         res = radius_user_password_hide(
1339                                 request, tmp.password, tmp.password_len,
1340                                 (u8 *) client->shared_secret,
1341                                 client->shared_secret_len,
1342                                 buf, sizeof(buf));
1343                         bin_clear_free(tmp.password, tmp.password_len);
1344
1345                         if (res < 0 || pw_len != (size_t) res ||
1346                             os_memcmp_const(pw, buf, res) != 0) {
1347                                 RADIUS_DEBUG("Incorrect User-Password");
1348                                 code = RADIUS_CODE_ACCESS_REJECT;
1349                         }
1350                 }
1351         }
1352
1353         msg = radius_msg_new(code, hdr->identifier);
1354         if (msg == NULL) {
1355                 RADIUS_DEBUG("Failed to allocate reply message");
1356                 return NULL;
1357         }
1358
1359         if (radius_msg_copy_attr(msg, request, RADIUS_ATTR_PROXY_STATE) < 0) {
1360                 RADIUS_DEBUG("Failed to copy Proxy-State attribute(s)");
1361                 radius_msg_free(msg);
1362                 return NULL;
1363         }
1364
1365         if (code == RADIUS_CODE_ACCESS_ACCEPT) {
1366                 struct hostapd_radius_attr *attr;
1367                 for (attr = sess->accept_attr; attr; attr = attr->next) {
1368                         if (!radius_msg_add_attr(msg, attr->type,
1369                                                  wpabuf_head(attr->val),
1370                                                  wpabuf_len(attr->val))) {
1371                                 wpa_printf(MSG_ERROR, "Could not add RADIUS attribute");
1372                                 radius_msg_free(msg);
1373                                 return NULL;
1374                         }
1375                 }
1376         }
1377
1378         if (radius_msg_finish_srv(msg, (u8 *) client->shared_secret,
1379                                   client->shared_secret_len,
1380                                   hdr->authenticator) < 0) {
1381                 RADIUS_DEBUG("Failed to add Message-Authenticator attribute");
1382         }
1383
1384         return msg;
1385 }
1386
1387
1388 static int radius_server_reject(struct radius_server_data *data,
1389                                 struct radius_client *client,
1390                                 struct radius_msg *request,
1391                                 struct sockaddr *from, socklen_t fromlen,
1392                                 const char *from_addr, int from_port)
1393 {
1394         struct radius_msg *msg;
1395         int ret = 0;
1396         struct eap_hdr eapfail;
1397         struct wpabuf *buf;
1398         struct radius_hdr *hdr = radius_msg_get_hdr(request);
1399
1400         RADIUS_DEBUG("Reject invalid request from %s:%d",
1401                      from_addr, from_port);
1402
1403         msg = radius_msg_new(RADIUS_CODE_ACCESS_REJECT, hdr->identifier);
1404         if (msg == NULL) {
1405                 return -1;
1406         }
1407
1408         os_memset(&eapfail, 0, sizeof(eapfail));
1409         eapfail.code = EAP_CODE_FAILURE;
1410         eapfail.identifier = 0;
1411         eapfail.length = host_to_be16(sizeof(eapfail));
1412
1413         if (!radius_msg_add_eap(msg, (u8 *) &eapfail, sizeof(eapfail))) {
1414                 RADIUS_DEBUG("Failed to add EAP-Message attribute");
1415         }
1416
1417         if (radius_msg_copy_attr(msg, request, RADIUS_ATTR_PROXY_STATE) < 0) {
1418                 RADIUS_DEBUG("Failed to copy Proxy-State attribute(s)");
1419                 radius_msg_free(msg);
1420                 return -1;
1421         }
1422
1423         if (radius_msg_finish_srv(msg, (u8 *) client->shared_secret,
1424                                   client->shared_secret_len,
1425                                   hdr->authenticator) <
1426             0) {
1427                 RADIUS_DEBUG("Failed to add Message-Authenticator attribute");
1428         }
1429
1430         if (wpa_debug_level <= MSG_MSGDUMP) {
1431                 radius_msg_dump(msg);
1432         }
1433
1434         data->counters.access_rejects++;
1435         client->counters.access_rejects++;
1436         buf = radius_msg_get_buf(msg);
1437         if (sendto(data->auth_sock, wpabuf_head(buf), wpabuf_len(buf), 0,
1438                    (struct sockaddr *) from, sizeof(*from)) < 0) {
1439                 wpa_printf(MSG_INFO, "sendto[RADIUS SRV]: %s", strerror(errno));
1440                 ret = -1;
1441         }
1442
1443         radius_msg_free(msg);
1444
1445         return ret;
1446 }
1447
1448
1449 static void radius_server_hs20_t_c_check(struct radius_session *sess,
1450                                          struct radius_msg *msg)
1451 {
1452 #ifdef CONFIG_HS20
1453         u8 *buf, *pos, *end, type, sublen, *timestamp = NULL;
1454         size_t len;
1455
1456         buf = NULL;
1457         for (;;) {
1458                 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_VENDOR_SPECIFIC,
1459                                             &buf, &len, buf) < 0)
1460                         break;
1461                 if (len < 6)
1462                         continue;
1463                 pos = buf;
1464                 end = buf + len;
1465                 if (WPA_GET_BE32(pos) != RADIUS_VENDOR_ID_WFA)
1466                         continue;
1467                 pos += 4;
1468
1469                 type = *pos++;
1470                 sublen = *pos++;
1471                 if (sublen < 2)
1472                         continue; /* invalid length */
1473                 sublen -= 2; /* skip header */
1474                 if (pos + sublen > end)
1475                         continue; /* invalid WFA VSA */
1476
1477                 if (type == RADIUS_VENDOR_ATTR_WFA_HS20_TIMESTAMP && len >= 4) {
1478                         timestamp = pos;
1479                         break;
1480                 }
1481         }
1482
1483         if (!timestamp)
1484                 return;
1485         RADIUS_DEBUG("HS20-Timestamp: %u", WPA_GET_BE32(timestamp));
1486         if (sess->t_c_timestamp != WPA_GET_BE32(timestamp)) {
1487                 RADIUS_DEBUG("Last read T&C timestamp does not match HS20-Timestamp --> require filtering");
1488                 sess->t_c_filtering = 1;
1489         }
1490 #endif /* CONFIG_HS20 */
1491 }
1492
1493
1494 static int radius_server_request(struct radius_server_data *data,
1495                                  struct radius_msg *msg,
1496                                  struct sockaddr *from, socklen_t fromlen,
1497                                  struct radius_client *client,
1498                                  const char *from_addr, int from_port,
1499                                  struct radius_session *force_sess)
1500 {
1501         struct wpabuf *eap = NULL;
1502         int res, state_included = 0;
1503         u8 statebuf[4];
1504         unsigned int state;
1505         struct radius_session *sess;
1506         struct radius_msg *reply;
1507         int is_complete = 0;
1508
1509         if (force_sess)
1510                 sess = force_sess;
1511         else {
1512                 res = radius_msg_get_attr(msg, RADIUS_ATTR_STATE, statebuf,
1513                                           sizeof(statebuf));
1514                 state_included = res >= 0;
1515                 if (res == sizeof(statebuf)) {
1516                         state = WPA_GET_BE32(statebuf);
1517                         sess = radius_server_get_session(client, state);
1518                 } else {
1519                         sess = NULL;
1520                 }
1521         }
1522
1523         if (sess) {
1524                 RADIUS_DEBUG("Request for session 0x%x", sess->sess_id);
1525         } else if (state_included) {
1526                 RADIUS_DEBUG("State attribute included but no session found");
1527                 radius_server_reject(data, client, msg, from, fromlen,
1528                                      from_addr, from_port);
1529                 return -1;
1530         } else {
1531                 sess = radius_server_get_new_session(data, client, msg,
1532                                                      from_addr);
1533                 if (sess == NULL) {
1534                         RADIUS_DEBUG("Could not create a new session");
1535                         radius_server_reject(data, client, msg, from, fromlen,
1536                                              from_addr, from_port);
1537                         return -1;
1538                 }
1539         }
1540
1541         if (sess->last_from_port == from_port &&
1542             sess->last_identifier == radius_msg_get_hdr(msg)->identifier &&
1543             os_memcmp(sess->last_authenticator,
1544                       radius_msg_get_hdr(msg)->authenticator, 16) == 0) {
1545                 RADIUS_DEBUG("Duplicate message from %s", from_addr);
1546                 data->counters.dup_access_requests++;
1547                 client->counters.dup_access_requests++;
1548
1549                 if (sess->last_reply) {
1550                         struct wpabuf *buf;
1551                         buf = radius_msg_get_buf(sess->last_reply);
1552                         res = sendto(data->auth_sock, wpabuf_head(buf),
1553                                      wpabuf_len(buf), 0,
1554                                      (struct sockaddr *) from, fromlen);
1555                         if (res < 0) {
1556                                 wpa_printf(MSG_INFO, "sendto[RADIUS SRV]: %s",
1557                                            strerror(errno));
1558                         }
1559                         return 0;
1560                 }
1561
1562                 RADIUS_DEBUG("No previous reply available for duplicate "
1563                              "message");
1564                 return -1;
1565         }
1566
1567         eap = radius_msg_get_eap(msg);
1568         if (eap == NULL && sess->macacl) {
1569                 reply = radius_server_macacl(data, client, sess, msg);
1570                 if (reply == NULL)
1571                         return -1;
1572                 goto send_reply;
1573         }
1574         if (eap == NULL) {
1575                 RADIUS_DEBUG("No EAP-Message in RADIUS packet from %s",
1576                              from_addr);
1577                 data->counters.packets_dropped++;
1578                 client->counters.packets_dropped++;
1579                 return -1;
1580         }
1581
1582         RADIUS_DUMP("Received EAP data", wpabuf_head(eap), wpabuf_len(eap));
1583
1584         /* FIX: if Code is Request, Success, or Failure, send Access-Reject;
1585          * RFC3579 Sect. 2.6.2.
1586          * Include EAP-Response/Nak with no preferred method if
1587          * code == request.
1588          * If code is not 1-4, discard the packet silently.
1589          * Or is this already done by the EAP state machine? */
1590
1591         wpabuf_free(sess->eap_if->eapRespData);
1592         sess->eap_if->eapRespData = eap;
1593         sess->eap_if->eapResp = TRUE;
1594         eap_server_sm_step(sess->eap);
1595
1596         if ((sess->eap_if->eapReq || sess->eap_if->eapSuccess ||
1597              sess->eap_if->eapFail) && sess->eap_if->eapReqData) {
1598                 RADIUS_DUMP("EAP data from the state machine",
1599                             wpabuf_head(sess->eap_if->eapReqData),
1600                             wpabuf_len(sess->eap_if->eapReqData));
1601         } else if (sess->eap_if->eapFail) {
1602                 RADIUS_DEBUG("No EAP data from the state machine, but eapFail "
1603                              "set");
1604         } else if (eap_sm_method_pending(sess->eap)) {
1605                 radius_msg_free(sess->last_msg);
1606                 sess->last_msg = msg;
1607                 sess->last_from_port = from_port;
1608                 os_free(sess->last_from_addr);
1609                 sess->last_from_addr = os_strdup(from_addr);
1610                 sess->last_fromlen = fromlen;
1611                 os_memcpy(&sess->last_from, from, fromlen);
1612                 return -2;
1613         } else {
1614                 RADIUS_DEBUG("No EAP data from the state machine - ignore this"
1615                              " Access-Request silently (assuming it was a "
1616                              "duplicate)");
1617                 data->counters.packets_dropped++;
1618                 client->counters.packets_dropped++;
1619                 return -1;
1620         }
1621
1622         if (sess->eap_if->eapSuccess || sess->eap_if->eapFail)
1623                 is_complete = 1;
1624         if (sess->eap_if->eapFail) {
1625                 srv_log(sess, "EAP authentication failed");
1626                 db_update_last_msk(sess, "FAIL");
1627         } else if (sess->eap_if->eapSuccess) {
1628                 srv_log(sess, "EAP authentication succeeded");
1629         }
1630
1631         if (sess->eap_if->eapSuccess)
1632                 radius_server_hs20_t_c_check(sess, msg);
1633
1634         reply = radius_server_encapsulate_eap(data, client, sess, msg);
1635
1636 send_reply:
1637         if (reply) {
1638                 struct wpabuf *buf;
1639                 struct radius_hdr *hdr;
1640
1641                 RADIUS_DEBUG("Reply to %s:%d", from_addr, from_port);
1642                 if (wpa_debug_level <= MSG_MSGDUMP) {
1643                         radius_msg_dump(reply);
1644                 }
1645
1646                 switch (radius_msg_get_hdr(reply)->code) {
1647                 case RADIUS_CODE_ACCESS_ACCEPT:
1648                         srv_log(sess, "Sending Access-Accept");
1649                         data->counters.access_accepts++;
1650                         client->counters.access_accepts++;
1651                         break;
1652                 case RADIUS_CODE_ACCESS_REJECT:
1653                         srv_log(sess, "Sending Access-Reject");
1654                         data->counters.access_rejects++;
1655                         client->counters.access_rejects++;
1656                         break;
1657                 case RADIUS_CODE_ACCESS_CHALLENGE:
1658                         data->counters.access_challenges++;
1659                         client->counters.access_challenges++;
1660                         break;
1661                 }
1662                 buf = radius_msg_get_buf(reply);
1663                 res = sendto(data->auth_sock, wpabuf_head(buf),
1664                              wpabuf_len(buf), 0,
1665                              (struct sockaddr *) from, fromlen);
1666                 if (res < 0) {
1667                         wpa_printf(MSG_INFO, "sendto[RADIUS SRV]: %s",
1668                                    strerror(errno));
1669                 }
1670                 radius_msg_free(sess->last_reply);
1671                 sess->last_reply = reply;
1672                 sess->last_from_port = from_port;
1673                 hdr = radius_msg_get_hdr(msg);
1674                 sess->last_identifier = hdr->identifier;
1675                 os_memcpy(sess->last_authenticator, hdr->authenticator, 16);
1676         } else {
1677                 data->counters.packets_dropped++;
1678                 client->counters.packets_dropped++;
1679         }
1680
1681         if (is_complete) {
1682                 RADIUS_DEBUG("Removing completed session 0x%x after timeout",
1683                              sess->sess_id);
1684                 eloop_cancel_timeout(radius_server_session_remove_timeout,
1685                                      data, sess);
1686                 eloop_register_timeout(RADIUS_SESSION_MAINTAIN, 0,
1687                                        radius_server_session_remove_timeout,
1688                                        data, sess);
1689         }
1690
1691         return 0;
1692 }
1693
1694
1695 static void
1696 radius_server_receive_disconnect_resp(struct radius_server_data *data,
1697                                       struct radius_client *client,
1698                                       struct radius_msg *msg, int ack)
1699 {
1700         struct radius_hdr *hdr;
1701
1702         if (!client->pending_dac_disconnect_req) {
1703                 RADIUS_DEBUG("Ignore unexpected Disconnect response");
1704                 radius_msg_free(msg);
1705                 return;
1706         }
1707
1708         hdr = radius_msg_get_hdr(msg);
1709         if (hdr->identifier != client->pending_dac_disconnect_id) {
1710                 RADIUS_DEBUG("Ignore unexpected Disconnect response with unexpected identifier %u (expected %u)",
1711                              hdr->identifier,
1712                              client->pending_dac_disconnect_id);
1713                 radius_msg_free(msg);
1714                 return;
1715         }
1716
1717         if (radius_msg_verify(msg, (const u8 *) client->shared_secret,
1718                               client->shared_secret_len,
1719                               client->pending_dac_disconnect_req, 0)) {
1720                 RADIUS_DEBUG("Ignore Disconnect response with invalid authenticator");
1721                 radius_msg_free(msg);
1722                 return;
1723         }
1724
1725         RADIUS_DEBUG("Disconnect-%s received for " MACSTR,
1726                      ack ? "ACK" : "NAK",
1727                      MAC2STR(client->pending_dac_disconnect_addr));
1728
1729         radius_msg_free(msg);
1730         radius_msg_free(client->pending_dac_disconnect_req);
1731         client->pending_dac_disconnect_req = NULL;
1732 }
1733
1734
1735 static void radius_server_receive_coa_resp(struct radius_server_data *data,
1736                                            struct radius_client *client,
1737                                            struct radius_msg *msg, int ack)
1738 {
1739         struct radius_hdr *hdr;
1740 #ifdef CONFIG_SQLITE
1741         char addrtxt[3 * ETH_ALEN];
1742         char *sql;
1743         int res;
1744 #endif /* CONFIG_SQLITE */
1745
1746         if (!client->pending_dac_coa_req) {
1747                 RADIUS_DEBUG("Ignore unexpected CoA response");
1748                 radius_msg_free(msg);
1749                 return;
1750         }
1751
1752         hdr = radius_msg_get_hdr(msg);
1753         if (hdr->identifier != client->pending_dac_coa_id) {
1754                 RADIUS_DEBUG("Ignore unexpected CoA response with unexpected identifier %u (expected %u)",
1755                              hdr->identifier,
1756                              client->pending_dac_coa_id);
1757                 radius_msg_free(msg);
1758                 return;
1759         }
1760
1761         if (radius_msg_verify(msg, (const u8 *) client->shared_secret,
1762                               client->shared_secret_len,
1763                               client->pending_dac_coa_req, 0)) {
1764                 RADIUS_DEBUG("Ignore CoA response with invalid authenticator");
1765                 radius_msg_free(msg);
1766                 return;
1767         }
1768
1769         RADIUS_DEBUG("CoA-%s received for " MACSTR,
1770                      ack ? "ACK" : "NAK",
1771                      MAC2STR(client->pending_dac_coa_addr));
1772
1773         radius_msg_free(msg);
1774         radius_msg_free(client->pending_dac_coa_req);
1775         client->pending_dac_coa_req = NULL;
1776
1777 #ifdef CONFIG_SQLITE
1778         if (!data->db)
1779                 return;
1780
1781         os_snprintf(addrtxt, sizeof(addrtxt), MACSTR,
1782                     MAC2STR(client->pending_dac_coa_addr));
1783
1784         if (ack) {
1785                 sql = sqlite3_mprintf("UPDATE current_sessions SET hs20_t_c_filtering=0, waiting_coa_ack=0, coa_ack_received=1 WHERE mac_addr=%Q",
1786                                       addrtxt);
1787         } else {
1788                 sql = sqlite3_mprintf("UPDATE current_sessions SET waiting_coa_ack=0 WHERE mac_addr=%Q",
1789                                       addrtxt);
1790         }
1791         if (!sql)
1792                 return;
1793
1794         res = sqlite3_exec(data->db, sql, NULL, NULL, NULL);
1795         sqlite3_free(sql);
1796         if (res != SQLITE_OK) {
1797                 RADIUS_ERROR("Failed to update current_sessions entry: %s",
1798                              sqlite3_errmsg(data->db));
1799                 return;
1800         }
1801 #endif /* CONFIG_SQLITE */
1802 }
1803
1804
1805 static void radius_server_receive_auth(int sock, void *eloop_ctx,
1806                                        void *sock_ctx)
1807 {
1808         struct radius_server_data *data = eloop_ctx;
1809         u8 *buf = NULL;
1810         union {
1811                 struct sockaddr_storage ss;
1812                 struct sockaddr_in sin;
1813 #ifdef CONFIG_IPV6
1814                 struct sockaddr_in6 sin6;
1815 #endif /* CONFIG_IPV6 */
1816         } from;
1817         socklen_t fromlen;
1818         int len;
1819         struct radius_client *client = NULL;
1820         struct radius_msg *msg = NULL;
1821         char abuf[50];
1822         int from_port = 0;
1823
1824         buf = os_malloc(RADIUS_MAX_MSG_LEN);
1825         if (buf == NULL) {
1826                 goto fail;
1827         }
1828
1829         fromlen = sizeof(from);
1830         len = recvfrom(sock, buf, RADIUS_MAX_MSG_LEN, 0,
1831                        (struct sockaddr *) &from.ss, &fromlen);
1832         if (len < 0) {
1833                 wpa_printf(MSG_INFO, "recvfrom[radius_server]: %s",
1834                            strerror(errno));
1835                 goto fail;
1836         }
1837
1838 #ifdef CONFIG_IPV6
1839         if (data->ipv6) {
1840                 if (inet_ntop(AF_INET6, &from.sin6.sin6_addr, abuf,
1841                               sizeof(abuf)) == NULL)
1842                         abuf[0] = '\0';
1843                 from_port = ntohs(from.sin6.sin6_port);
1844                 RADIUS_DEBUG("Received %d bytes from %s:%d",
1845                              len, abuf, from_port);
1846
1847                 client = radius_server_get_client(data,
1848                                                   (struct in_addr *)
1849                                                   &from.sin6.sin6_addr, 1);
1850         }
1851 #endif /* CONFIG_IPV6 */
1852
1853         if (!data->ipv6) {
1854                 os_strlcpy(abuf, inet_ntoa(from.sin.sin_addr), sizeof(abuf));
1855                 from_port = ntohs(from.sin.sin_port);
1856                 RADIUS_DEBUG("Received %d bytes from %s:%d",
1857                              len, abuf, from_port);
1858
1859                 client = radius_server_get_client(data, &from.sin.sin_addr, 0);
1860         }
1861
1862         RADIUS_DUMP("Received data", buf, len);
1863
1864         if (client == NULL) {
1865                 RADIUS_DEBUG("Unknown client %s - packet ignored", abuf);
1866                 data->counters.invalid_requests++;
1867                 goto fail;
1868         }
1869
1870         msg = radius_msg_parse(buf, len);
1871         if (msg == NULL) {
1872                 RADIUS_DEBUG("Parsing incoming RADIUS frame failed");
1873                 data->counters.malformed_access_requests++;
1874                 client->counters.malformed_access_requests++;
1875                 goto fail;
1876         }
1877
1878         os_free(buf);
1879         buf = NULL;
1880
1881         if (wpa_debug_level <= MSG_MSGDUMP) {
1882                 radius_msg_dump(msg);
1883         }
1884
1885         if (radius_msg_get_hdr(msg)->code == RADIUS_CODE_DISCONNECT_ACK) {
1886                 radius_server_receive_disconnect_resp(data, client, msg, 1);
1887                 return;
1888         }
1889
1890         if (radius_msg_get_hdr(msg)->code == RADIUS_CODE_DISCONNECT_NAK) {
1891                 radius_server_receive_disconnect_resp(data, client, msg, 0);
1892                 return;
1893         }
1894
1895         if (radius_msg_get_hdr(msg)->code == RADIUS_CODE_COA_ACK) {
1896                 radius_server_receive_coa_resp(data, client, msg, 1);
1897                 return;
1898         }
1899
1900         if (radius_msg_get_hdr(msg)->code == RADIUS_CODE_COA_NAK) {
1901                 radius_server_receive_coa_resp(data, client, msg, 0);
1902                 return;
1903         }
1904
1905         if (radius_msg_get_hdr(msg)->code != RADIUS_CODE_ACCESS_REQUEST) {
1906                 RADIUS_DEBUG("Unexpected RADIUS code %d",
1907                              radius_msg_get_hdr(msg)->code);
1908                 data->counters.unknown_types++;
1909                 client->counters.unknown_types++;
1910                 goto fail;
1911         }
1912
1913         data->counters.access_requests++;
1914         client->counters.access_requests++;
1915
1916         if (radius_msg_verify_msg_auth(msg, (u8 *) client->shared_secret,
1917                                        client->shared_secret_len, NULL)) {
1918                 RADIUS_DEBUG("Invalid Message-Authenticator from %s", abuf);
1919                 data->counters.bad_authenticators++;
1920                 client->counters.bad_authenticators++;
1921                 goto fail;
1922         }
1923
1924         if (radius_server_request(data, msg, (struct sockaddr *) &from,
1925                                   fromlen, client, abuf, from_port, NULL) ==
1926             -2)
1927                 return; /* msg was stored with the session */
1928
1929 fail:
1930         radius_msg_free(msg);
1931         os_free(buf);
1932 }
1933
1934
1935 static void radius_server_receive_acct(int sock, void *eloop_ctx,
1936                                        void *sock_ctx)
1937 {
1938         struct radius_server_data *data = eloop_ctx;
1939         u8 *buf = NULL;
1940         union {
1941                 struct sockaddr_storage ss;
1942                 struct sockaddr_in sin;
1943 #ifdef CONFIG_IPV6
1944                 struct sockaddr_in6 sin6;
1945 #endif /* CONFIG_IPV6 */
1946         } from;
1947         socklen_t fromlen;
1948         int len, res;
1949         struct radius_client *client = NULL;
1950         struct radius_msg *msg = NULL, *resp = NULL;
1951         char abuf[50];
1952         int from_port = 0;
1953         struct radius_hdr *hdr;
1954         struct wpabuf *rbuf;
1955
1956         buf = os_malloc(RADIUS_MAX_MSG_LEN);
1957         if (buf == NULL) {
1958                 goto fail;
1959         }
1960
1961         fromlen = sizeof(from);
1962         len = recvfrom(sock, buf, RADIUS_MAX_MSG_LEN, 0,
1963                        (struct sockaddr *) &from.ss, &fromlen);
1964         if (len < 0) {
1965                 wpa_printf(MSG_INFO, "recvfrom[radius_server]: %s",
1966                            strerror(errno));
1967                 goto fail;
1968         }
1969
1970 #ifdef CONFIG_IPV6
1971         if (data->ipv6) {
1972                 if (inet_ntop(AF_INET6, &from.sin6.sin6_addr, abuf,
1973                               sizeof(abuf)) == NULL)
1974                         abuf[0] = '\0';
1975                 from_port = ntohs(from.sin6.sin6_port);
1976                 RADIUS_DEBUG("Received %d bytes from %s:%d",
1977                              len, abuf, from_port);
1978
1979                 client = radius_server_get_client(data,
1980                                                   (struct in_addr *)
1981                                                   &from.sin6.sin6_addr, 1);
1982         }
1983 #endif /* CONFIG_IPV6 */
1984
1985         if (!data->ipv6) {
1986                 os_strlcpy(abuf, inet_ntoa(from.sin.sin_addr), sizeof(abuf));
1987                 from_port = ntohs(from.sin.sin_port);
1988                 RADIUS_DEBUG("Received %d bytes from %s:%d",
1989                              len, abuf, from_port);
1990
1991                 client = radius_server_get_client(data, &from.sin.sin_addr, 0);
1992         }
1993
1994         RADIUS_DUMP("Received data", buf, len);
1995
1996         if (client == NULL) {
1997                 RADIUS_DEBUG("Unknown client %s - packet ignored", abuf);
1998                 data->counters.invalid_acct_requests++;
1999                 goto fail;
2000         }
2001
2002         msg = radius_msg_parse(buf, len);
2003         if (msg == NULL) {
2004                 RADIUS_DEBUG("Parsing incoming RADIUS frame failed");
2005                 data->counters.malformed_acct_requests++;
2006                 client->counters.malformed_acct_requests++;
2007                 goto fail;
2008         }
2009
2010         os_free(buf);
2011         buf = NULL;
2012
2013         if (wpa_debug_level <= MSG_MSGDUMP) {
2014                 radius_msg_dump(msg);
2015         }
2016
2017         if (radius_msg_get_hdr(msg)->code != RADIUS_CODE_ACCOUNTING_REQUEST) {
2018                 RADIUS_DEBUG("Unexpected RADIUS code %d",
2019                              radius_msg_get_hdr(msg)->code);
2020                 data->counters.unknown_acct_types++;
2021                 client->counters.unknown_acct_types++;
2022                 goto fail;
2023         }
2024
2025         data->counters.acct_requests++;
2026         client->counters.acct_requests++;
2027
2028         if (radius_msg_verify_acct_req(msg, (u8 *) client->shared_secret,
2029                                        client->shared_secret_len)) {
2030                 RADIUS_DEBUG("Invalid Authenticator from %s", abuf);
2031                 data->counters.acct_bad_authenticators++;
2032                 client->counters.acct_bad_authenticators++;
2033                 goto fail;
2034         }
2035
2036         /* TODO: Write accounting information to a file or database */
2037
2038         hdr = radius_msg_get_hdr(msg);
2039
2040         resp = radius_msg_new(RADIUS_CODE_ACCOUNTING_RESPONSE, hdr->identifier);
2041         if (resp == NULL)
2042                 goto fail;
2043
2044         radius_msg_finish_acct_resp(resp, (u8 *) client->shared_secret,
2045                                     client->shared_secret_len,
2046                                     hdr->authenticator);
2047
2048         RADIUS_DEBUG("Reply to %s:%d", abuf, from_port);
2049         if (wpa_debug_level <= MSG_MSGDUMP) {
2050                 radius_msg_dump(resp);
2051         }
2052         rbuf = radius_msg_get_buf(resp);
2053         data->counters.acct_responses++;
2054         client->counters.acct_responses++;
2055         res = sendto(data->acct_sock, wpabuf_head(rbuf), wpabuf_len(rbuf), 0,
2056                      (struct sockaddr *) &from.ss, fromlen);
2057         if (res < 0) {
2058                 wpa_printf(MSG_INFO, "sendto[RADIUS SRV]: %s",
2059                            strerror(errno));
2060         }
2061
2062 fail:
2063         radius_msg_free(resp);
2064         radius_msg_free(msg);
2065         os_free(buf);
2066 }
2067
2068
2069 static int radius_server_disable_pmtu_discovery(int s)
2070 {
2071         int r = -1;
2072 #if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT)
2073         /* Turn off Path MTU discovery on IPv4/UDP sockets. */
2074         int action = IP_PMTUDISC_DONT;
2075         r = setsockopt(s, IPPROTO_IP, IP_MTU_DISCOVER, &action,
2076                        sizeof(action));
2077         if (r == -1)
2078                 wpa_printf(MSG_ERROR, "Failed to set IP_MTU_DISCOVER: "
2079                            "%s", strerror(errno));
2080 #endif
2081         return r;
2082 }
2083
2084
2085 static int radius_server_open_socket(int port)
2086 {
2087         int s;
2088         struct sockaddr_in addr;
2089
2090         s = socket(PF_INET, SOCK_DGRAM, 0);
2091         if (s < 0) {
2092                 wpa_printf(MSG_INFO, "RADIUS: socket: %s", strerror(errno));
2093                 return -1;
2094         }
2095
2096         radius_server_disable_pmtu_discovery(s);
2097
2098         os_memset(&addr, 0, sizeof(addr));
2099         addr.sin_family = AF_INET;
2100         addr.sin_port = htons(port);
2101         if (bind(s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
2102                 wpa_printf(MSG_INFO, "RADIUS: bind: %s", strerror(errno));
2103                 close(s);
2104                 return -1;
2105         }
2106
2107         return s;
2108 }
2109
2110
2111 #ifdef CONFIG_IPV6
2112 static int radius_server_open_socket6(int port)
2113 {
2114         int s;
2115         struct sockaddr_in6 addr;
2116
2117         s = socket(PF_INET6, SOCK_DGRAM, 0);
2118         if (s < 0) {
2119                 wpa_printf(MSG_INFO, "RADIUS: socket[IPv6]: %s",
2120                            strerror(errno));
2121                 return -1;
2122         }
2123
2124         os_memset(&addr, 0, sizeof(addr));
2125         addr.sin6_family = AF_INET6;
2126         os_memcpy(&addr.sin6_addr, &in6addr_any, sizeof(in6addr_any));
2127         addr.sin6_port = htons(port);
2128         if (bind(s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
2129                 wpa_printf(MSG_INFO, "RADIUS: bind: %s", strerror(errno));
2130                 close(s);
2131                 return -1;
2132         }
2133
2134         return s;
2135 }
2136 #endif /* CONFIG_IPV6 */
2137
2138
2139 static void radius_server_free_sessions(struct radius_server_data *data,
2140                                         struct radius_session *sessions)
2141 {
2142         struct radius_session *session, *prev;
2143
2144         session = sessions;
2145         while (session) {
2146                 prev = session;
2147                 session = session->next;
2148                 radius_server_session_free(data, prev);
2149         }
2150 }
2151
2152
2153 static void radius_server_free_clients(struct radius_server_data *data,
2154                                        struct radius_client *clients)
2155 {
2156         struct radius_client *client, *prev;
2157
2158         client = clients;
2159         while (client) {
2160                 prev = client;
2161                 client = client->next;
2162
2163                 radius_server_free_sessions(data, prev->sessions);
2164                 os_free(prev->shared_secret);
2165                 radius_msg_free(prev->pending_dac_coa_req);
2166                 radius_msg_free(prev->pending_dac_disconnect_req);
2167                 os_free(prev);
2168         }
2169 }
2170
2171
2172 static struct radius_client *
2173 radius_server_read_clients(const char *client_file, int ipv6)
2174 {
2175         FILE *f;
2176         const int buf_size = 1024;
2177         char *buf, *pos;
2178         struct radius_client *clients, *tail, *entry;
2179         int line = 0, mask, failed = 0, i;
2180         struct in_addr addr;
2181 #ifdef CONFIG_IPV6
2182         struct in6_addr addr6;
2183 #endif /* CONFIG_IPV6 */
2184         unsigned int val;
2185
2186         f = fopen(client_file, "r");
2187         if (f == NULL) {
2188                 RADIUS_ERROR("Could not open client file '%s'", client_file);
2189                 return NULL;
2190         }
2191
2192         buf = os_malloc(buf_size);
2193         if (buf == NULL) {
2194                 fclose(f);
2195                 return NULL;
2196         }
2197
2198         clients = tail = NULL;
2199         while (fgets(buf, buf_size, f)) {
2200                 /* Configuration file format:
2201                  * 192.168.1.0/24 secret
2202                  * 192.168.1.2 secret
2203                  * fe80::211:22ff:fe33:4455/64 secretipv6
2204                  */
2205                 line++;
2206                 buf[buf_size - 1] = '\0';
2207                 pos = buf;
2208                 while (*pos != '\0' && *pos != '\n')
2209                         pos++;
2210                 if (*pos == '\n')
2211                         *pos = '\0';
2212                 if (*buf == '\0' || *buf == '#')
2213                         continue;
2214
2215                 pos = buf;
2216                 while ((*pos >= '0' && *pos <= '9') || *pos == '.' ||
2217                        (*pos >= 'a' && *pos <= 'f') || *pos == ':' ||
2218                        (*pos >= 'A' && *pos <= 'F')) {
2219                         pos++;
2220                 }
2221
2222                 if (*pos == '\0') {
2223                         failed = 1;
2224                         break;
2225                 }
2226
2227                 if (*pos == '/') {
2228                         char *end;
2229                         *pos++ = '\0';
2230                         mask = strtol(pos, &end, 10);
2231                         if ((pos == end) ||
2232                             (mask < 0 || mask > (ipv6 ? 128 : 32))) {
2233                                 failed = 1;
2234                                 break;
2235                         }
2236                         pos = end;
2237                 } else {
2238                         mask = ipv6 ? 128 : 32;
2239                         *pos++ = '\0';
2240                 }
2241
2242                 if (!ipv6 && inet_aton(buf, &addr) == 0) {
2243                         failed = 1;
2244                         break;
2245                 }
2246 #ifdef CONFIG_IPV6
2247                 if (ipv6 && inet_pton(AF_INET6, buf, &addr6) <= 0) {
2248                         if (inet_pton(AF_INET, buf, &addr) <= 0) {
2249                                 failed = 1;
2250                                 break;
2251                         }
2252                         /* Convert IPv4 address to IPv6 */
2253                         if (mask <= 32)
2254                                 mask += (128 - 32);
2255                         os_memset(addr6.s6_addr, 0, 10);
2256                         addr6.s6_addr[10] = 0xff;
2257                         addr6.s6_addr[11] = 0xff;
2258                         os_memcpy(addr6.s6_addr + 12, (char *) &addr.s_addr,
2259                                   4);
2260                 }
2261 #endif /* CONFIG_IPV6 */
2262
2263                 while (*pos == ' ' || *pos == '\t') {
2264                         pos++;
2265                 }
2266
2267                 if (*pos == '\0') {
2268                         failed = 1;
2269                         break;
2270                 }
2271
2272                 entry = os_zalloc(sizeof(*entry));
2273                 if (entry == NULL) {
2274                         failed = 1;
2275                         break;
2276                 }
2277                 entry->shared_secret = os_strdup(pos);
2278                 if (entry->shared_secret == NULL) {
2279                         failed = 1;
2280                         os_free(entry);
2281                         break;
2282                 }
2283                 entry->shared_secret_len = os_strlen(entry->shared_secret);
2284                 if (!ipv6) {
2285                         entry->addr.s_addr = addr.s_addr;
2286                         val = 0;
2287                         for (i = 0; i < mask; i++)
2288                                 val |= 1U << (31 - i);
2289                         entry->mask.s_addr = htonl(val);
2290                 }
2291 #ifdef CONFIG_IPV6
2292                 if (ipv6) {
2293                         int offset = mask / 8;
2294
2295                         os_memcpy(entry->addr6.s6_addr, addr6.s6_addr, 16);
2296                         os_memset(entry->mask6.s6_addr, 0xff, offset);
2297                         val = 0;
2298                         for (i = 0; i < (mask % 8); i++)
2299                                 val |= 1 << (7 - i);
2300                         if (offset < 16)
2301                                 entry->mask6.s6_addr[offset] = val;
2302                 }
2303 #endif /* CONFIG_IPV6 */
2304
2305                 if (tail == NULL) {
2306                         clients = tail = entry;
2307                 } else {
2308                         tail->next = entry;
2309                         tail = entry;
2310                 }
2311         }
2312
2313         if (failed) {
2314                 RADIUS_ERROR("Invalid line %d in '%s'", line, client_file);
2315                 radius_server_free_clients(NULL, clients);
2316                 clients = NULL;
2317         }
2318
2319         os_free(buf);
2320         fclose(f);
2321
2322         return clients;
2323 }
2324
2325
2326 /**
2327  * radius_server_init - Initialize RADIUS server
2328  * @conf: Configuration for the RADIUS server
2329  * Returns: Pointer to private RADIUS server context or %NULL on failure
2330  *
2331  * This initializes a RADIUS server instance and returns a context pointer that
2332  * will be used in other calls to the RADIUS server module. The server can be
2333  * deinitialize by calling radius_server_deinit().
2334  */
2335 struct radius_server_data *
2336 radius_server_init(struct radius_server_conf *conf)
2337 {
2338         struct radius_server_data *data;
2339
2340 #ifndef CONFIG_IPV6
2341         if (conf->ipv6) {
2342                 wpa_printf(MSG_ERROR, "RADIUS server compiled without IPv6 support");
2343                 return NULL;
2344         }
2345 #endif /* CONFIG_IPV6 */
2346
2347         data = os_zalloc(sizeof(*data));
2348         if (data == NULL)
2349                 return NULL;
2350
2351         dl_list_init(&data->erp_keys);
2352         os_get_reltime(&data->start_time);
2353         data->conf_ctx = conf->conf_ctx;
2354         data->eap_sim_db_priv = conf->eap_sim_db_priv;
2355         data->ssl_ctx = conf->ssl_ctx;
2356         data->msg_ctx = conf->msg_ctx;
2357         data->ipv6 = conf->ipv6;
2358         if (conf->pac_opaque_encr_key) {
2359                 data->pac_opaque_encr_key = os_malloc(16);
2360                 if (data->pac_opaque_encr_key) {
2361                         os_memcpy(data->pac_opaque_encr_key,
2362                                   conf->pac_opaque_encr_key, 16);
2363                 }
2364         }
2365         if (conf->eap_fast_a_id) {
2366                 data->eap_fast_a_id = os_malloc(conf->eap_fast_a_id_len);
2367                 if (data->eap_fast_a_id) {
2368                         os_memcpy(data->eap_fast_a_id, conf->eap_fast_a_id,
2369                                   conf->eap_fast_a_id_len);
2370                         data->eap_fast_a_id_len = conf->eap_fast_a_id_len;
2371                 }
2372         }
2373         if (conf->eap_fast_a_id_info)
2374                 data->eap_fast_a_id_info = os_strdup(conf->eap_fast_a_id_info);
2375         data->eap_fast_prov = conf->eap_fast_prov;
2376         data->pac_key_lifetime = conf->pac_key_lifetime;
2377         data->pac_key_refresh_time = conf->pac_key_refresh_time;
2378         data->get_eap_user = conf->get_eap_user;
2379         data->eap_sim_aka_result_ind = conf->eap_sim_aka_result_ind;
2380         data->tnc = conf->tnc;
2381         data->wps = conf->wps;
2382         data->pwd_group = conf->pwd_group;
2383         data->server_id = conf->server_id;
2384         if (conf->eap_req_id_text) {
2385                 data->eap_req_id_text = os_malloc(conf->eap_req_id_text_len);
2386                 if (data->eap_req_id_text) {
2387                         os_memcpy(data->eap_req_id_text, conf->eap_req_id_text,
2388                                   conf->eap_req_id_text_len);
2389                         data->eap_req_id_text_len = conf->eap_req_id_text_len;
2390                 }
2391         }
2392         data->erp = conf->erp;
2393         data->erp_domain = conf->erp_domain;
2394         data->tls_session_lifetime = conf->tls_session_lifetime;
2395         data->tls_flags = conf->tls_flags;
2396
2397         if (conf->subscr_remediation_url) {
2398                 data->subscr_remediation_url =
2399                         os_strdup(conf->subscr_remediation_url);
2400         }
2401         data->subscr_remediation_method = conf->subscr_remediation_method;
2402         if (conf->hs20_sim_provisioning_url)
2403                 data->hs20_sim_provisioning_url =
2404                         os_strdup(conf->hs20_sim_provisioning_url);
2405
2406         if (conf->t_c_server_url)
2407                 data->t_c_server_url = os_strdup(conf->t_c_server_url);
2408
2409 #ifdef CONFIG_SQLITE
2410         if (conf->sqlite_file) {
2411                 if (sqlite3_open(conf->sqlite_file, &data->db)) {
2412                         RADIUS_ERROR("Could not open SQLite file '%s'",
2413                                      conf->sqlite_file);
2414                         radius_server_deinit(data);
2415                         return NULL;
2416                 }
2417         }
2418 #endif /* CONFIG_SQLITE */
2419
2420 #ifdef CONFIG_RADIUS_TEST
2421         if (conf->dump_msk_file)
2422                 data->dump_msk_file = os_strdup(conf->dump_msk_file);
2423 #endif /* CONFIG_RADIUS_TEST */
2424
2425         data->clients = radius_server_read_clients(conf->client_file,
2426                                                    conf->ipv6);
2427         if (data->clients == NULL) {
2428                 wpa_printf(MSG_ERROR, "No RADIUS clients configured");
2429                 radius_server_deinit(data);
2430                 return NULL;
2431         }
2432
2433 #ifdef CONFIG_IPV6
2434         if (conf->ipv6)
2435                 data->auth_sock = radius_server_open_socket6(conf->auth_port);
2436         else
2437 #endif /* CONFIG_IPV6 */
2438         data->auth_sock = radius_server_open_socket(conf->auth_port);
2439         if (data->auth_sock < 0) {
2440                 wpa_printf(MSG_ERROR, "Failed to open UDP socket for RADIUS authentication server");
2441                 radius_server_deinit(data);
2442                 return NULL;
2443         }
2444         if (eloop_register_read_sock(data->auth_sock,
2445                                      radius_server_receive_auth,
2446                                      data, NULL)) {
2447                 radius_server_deinit(data);
2448                 return NULL;
2449         }
2450
2451         if (conf->acct_port) {
2452 #ifdef CONFIG_IPV6
2453                 if (conf->ipv6)
2454                         data->acct_sock = radius_server_open_socket6(
2455                                 conf->acct_port);
2456                 else
2457 #endif /* CONFIG_IPV6 */
2458                 data->acct_sock = radius_server_open_socket(conf->acct_port);
2459                 if (data->acct_sock < 0) {
2460                         wpa_printf(MSG_ERROR, "Failed to open UDP socket for RADIUS accounting server");
2461                         radius_server_deinit(data);
2462                         return NULL;
2463                 }
2464                 if (eloop_register_read_sock(data->acct_sock,
2465                                              radius_server_receive_acct,
2466                                              data, NULL)) {
2467                         radius_server_deinit(data);
2468                         return NULL;
2469                 }
2470         } else {
2471                 data->acct_sock = -1;
2472         }
2473
2474         return data;
2475 }
2476
2477
2478 /**
2479  * radius_server_erp_flush - Flush all ERP keys
2480  * @data: RADIUS server context from radius_server_init()
2481  */
2482 void radius_server_erp_flush(struct radius_server_data *data)
2483 {
2484         struct eap_server_erp_key *erp;
2485
2486         if (data == NULL)
2487                 return;
2488         while ((erp = dl_list_first(&data->erp_keys, struct eap_server_erp_key,
2489                                     list)) != NULL) {
2490                 dl_list_del(&erp->list);
2491                 bin_clear_free(erp, sizeof(*erp));
2492         }
2493 }
2494
2495
2496 /**
2497  * radius_server_deinit - Deinitialize RADIUS server
2498  * @data: RADIUS server context from radius_server_init()
2499  */
2500 void radius_server_deinit(struct radius_server_data *data)
2501 {
2502         if (data == NULL)
2503                 return;
2504
2505         if (data->auth_sock >= 0) {
2506                 eloop_unregister_read_sock(data->auth_sock);
2507                 close(data->auth_sock);
2508         }
2509
2510         if (data->acct_sock >= 0) {
2511                 eloop_unregister_read_sock(data->acct_sock);
2512                 close(data->acct_sock);
2513         }
2514
2515         radius_server_free_clients(data, data->clients);
2516
2517         os_free(data->pac_opaque_encr_key);
2518         os_free(data->eap_fast_a_id);
2519         os_free(data->eap_fast_a_id_info);
2520         os_free(data->eap_req_id_text);
2521 #ifdef CONFIG_RADIUS_TEST
2522         os_free(data->dump_msk_file);
2523 #endif /* CONFIG_RADIUS_TEST */
2524         os_free(data->subscr_remediation_url);
2525         os_free(data->hs20_sim_provisioning_url);
2526         os_free(data->t_c_server_url);
2527
2528 #ifdef CONFIG_SQLITE
2529         if (data->db)
2530                 sqlite3_close(data->db);
2531 #endif /* CONFIG_SQLITE */
2532
2533         radius_server_erp_flush(data);
2534
2535         os_free(data);
2536 }
2537
2538
2539 /**
2540  * radius_server_get_mib - Get RADIUS server MIB information
2541  * @data: RADIUS server context from radius_server_init()
2542  * @buf: Buffer for returning the MIB data in text format
2543  * @buflen: buf length in octets
2544  * Returns: Number of octets written into buf
2545  */
2546 int radius_server_get_mib(struct radius_server_data *data, char *buf,
2547                           size_t buflen)
2548 {
2549         int ret, uptime;
2550         unsigned int idx;
2551         char *end, *pos;
2552         struct os_reltime now;
2553         struct radius_client *cli;
2554
2555         /* RFC 2619 - RADIUS Authentication Server MIB */
2556
2557         if (data == NULL || buflen == 0)
2558                 return 0;
2559
2560         pos = buf;
2561         end = buf + buflen;
2562
2563         os_get_reltime(&now);
2564         uptime = (now.sec - data->start_time.sec) * 100 +
2565                 ((now.usec - data->start_time.usec) / 10000) % 100;
2566         ret = os_snprintf(pos, end - pos,
2567                           "RADIUS-AUTH-SERVER-MIB\n"
2568                           "radiusAuthServIdent=hostapd\n"
2569                           "radiusAuthServUpTime=%d\n"
2570                           "radiusAuthServResetTime=0\n"
2571                           "radiusAuthServConfigReset=4\n",
2572                           uptime);
2573         if (os_snprintf_error(end - pos, ret)) {
2574                 *pos = '\0';
2575                 return pos - buf;
2576         }
2577         pos += ret;
2578
2579         ret = os_snprintf(pos, end - pos,
2580                           "radiusAuthServTotalAccessRequests=%u\n"
2581                           "radiusAuthServTotalInvalidRequests=%u\n"
2582                           "radiusAuthServTotalDupAccessRequests=%u\n"
2583                           "radiusAuthServTotalAccessAccepts=%u\n"
2584                           "radiusAuthServTotalAccessRejects=%u\n"
2585                           "radiusAuthServTotalAccessChallenges=%u\n"
2586                           "radiusAuthServTotalMalformedAccessRequests=%u\n"
2587                           "radiusAuthServTotalBadAuthenticators=%u\n"
2588                           "radiusAuthServTotalPacketsDropped=%u\n"
2589                           "radiusAuthServTotalUnknownTypes=%u\n"
2590                           "radiusAccServTotalRequests=%u\n"
2591                           "radiusAccServTotalInvalidRequests=%u\n"
2592                           "radiusAccServTotalResponses=%u\n"
2593                           "radiusAccServTotalMalformedRequests=%u\n"
2594                           "radiusAccServTotalBadAuthenticators=%u\n"
2595                           "radiusAccServTotalUnknownTypes=%u\n",
2596                           data->counters.access_requests,
2597                           data->counters.invalid_requests,
2598                           data->counters.dup_access_requests,
2599                           data->counters.access_accepts,
2600                           data->counters.access_rejects,
2601                           data->counters.access_challenges,
2602                           data->counters.malformed_access_requests,
2603                           data->counters.bad_authenticators,
2604                           data->counters.packets_dropped,
2605                           data->counters.unknown_types,
2606                           data->counters.acct_requests,
2607                           data->counters.invalid_acct_requests,
2608                           data->counters.acct_responses,
2609                           data->counters.malformed_acct_requests,
2610                           data->counters.acct_bad_authenticators,
2611                           data->counters.unknown_acct_types);
2612         if (os_snprintf_error(end - pos, ret)) {
2613                 *pos = '\0';
2614                 return pos - buf;
2615         }
2616         pos += ret;
2617
2618         for (cli = data->clients, idx = 0; cli; cli = cli->next, idx++) {
2619                 char abuf[50], mbuf[50];
2620 #ifdef CONFIG_IPV6
2621                 if (data->ipv6) {
2622                         if (inet_ntop(AF_INET6, &cli->addr6, abuf,
2623                                       sizeof(abuf)) == NULL)
2624                                 abuf[0] = '\0';
2625                         if (inet_ntop(AF_INET6, &cli->mask6, mbuf,
2626                                       sizeof(mbuf)) == NULL)
2627                                 mbuf[0] = '\0';
2628                 }
2629 #endif /* CONFIG_IPV6 */
2630                 if (!data->ipv6) {
2631                         os_strlcpy(abuf, inet_ntoa(cli->addr), sizeof(abuf));
2632                         os_strlcpy(mbuf, inet_ntoa(cli->mask), sizeof(mbuf));
2633                 }
2634
2635                 ret = os_snprintf(pos, end - pos,
2636                                   "radiusAuthClientIndex=%u\n"
2637                                   "radiusAuthClientAddress=%s/%s\n"
2638                                   "radiusAuthServAccessRequests=%u\n"
2639                                   "radiusAuthServDupAccessRequests=%u\n"
2640                                   "radiusAuthServAccessAccepts=%u\n"
2641                                   "radiusAuthServAccessRejects=%u\n"
2642                                   "radiusAuthServAccessChallenges=%u\n"
2643                                   "radiusAuthServMalformedAccessRequests=%u\n"
2644                                   "radiusAuthServBadAuthenticators=%u\n"
2645                                   "radiusAuthServPacketsDropped=%u\n"
2646                                   "radiusAuthServUnknownTypes=%u\n"
2647                                   "radiusAccServTotalRequests=%u\n"
2648                                   "radiusAccServTotalInvalidRequests=%u\n"
2649                                   "radiusAccServTotalResponses=%u\n"
2650                                   "radiusAccServTotalMalformedRequests=%u\n"
2651                                   "radiusAccServTotalBadAuthenticators=%u\n"
2652                                   "radiusAccServTotalUnknownTypes=%u\n",
2653                                   idx,
2654                                   abuf, mbuf,
2655                                   cli->counters.access_requests,
2656                                   cli->counters.dup_access_requests,
2657                                   cli->counters.access_accepts,
2658                                   cli->counters.access_rejects,
2659                                   cli->counters.access_challenges,
2660                                   cli->counters.malformed_access_requests,
2661                                   cli->counters.bad_authenticators,
2662                                   cli->counters.packets_dropped,
2663                                   cli->counters.unknown_types,
2664                                   cli->counters.acct_requests,
2665                                   cli->counters.invalid_acct_requests,
2666                                   cli->counters.acct_responses,
2667                                   cli->counters.malformed_acct_requests,
2668                                   cli->counters.acct_bad_authenticators,
2669                                   cli->counters.unknown_acct_types);
2670                 if (os_snprintf_error(end - pos, ret)) {
2671                         *pos = '\0';
2672                         return pos - buf;
2673                 }
2674                 pos += ret;
2675         }
2676
2677         return pos - buf;
2678 }
2679
2680
2681 static int radius_server_get_eap_user(void *ctx, const u8 *identity,
2682                                       size_t identity_len, int phase2,
2683                                       struct eap_user *user)
2684 {
2685         struct radius_session *sess = ctx;
2686         struct radius_server_data *data = sess->server;
2687         int ret;
2688
2689         ret = data->get_eap_user(data->conf_ctx, identity, identity_len,
2690                                  phase2, user);
2691         if (ret == 0 && user) {
2692                 sess->accept_attr = user->accept_attr;
2693                 sess->remediation = user->remediation;
2694                 sess->macacl = user->macacl;
2695                 sess->t_c_timestamp = user->t_c_timestamp;
2696         }
2697
2698         if (ret) {
2699                 RADIUS_DEBUG("%s: User-Name not found from user database",
2700                              __func__);
2701         }
2702
2703         return ret;
2704 }
2705
2706
2707 static const char * radius_server_get_eap_req_id_text(void *ctx, size_t *len)
2708 {
2709         struct radius_session *sess = ctx;
2710         struct radius_server_data *data = sess->server;
2711         *len = data->eap_req_id_text_len;
2712         return data->eap_req_id_text;
2713 }
2714
2715
2716 static void radius_server_log_msg(void *ctx, const char *msg)
2717 {
2718         struct radius_session *sess = ctx;
2719         srv_log(sess, "EAP: %s", msg);
2720 }
2721
2722
2723 #ifdef CONFIG_ERP
2724
2725 static const char * radius_server_get_erp_domain(void *ctx)
2726 {
2727         struct radius_session *sess = ctx;
2728         struct radius_server_data *data = sess->server;
2729
2730         return data->erp_domain;
2731 }
2732
2733
2734 static struct eap_server_erp_key *
2735 radius_server_erp_get_key(void *ctx, const char *keyname)
2736 {
2737         struct radius_session *sess = ctx;
2738         struct radius_server_data *data = sess->server;
2739
2740         return radius_server_erp_find_key(data, keyname);
2741 }
2742
2743
2744 static int radius_server_erp_add_key(void *ctx, struct eap_server_erp_key *erp)
2745 {
2746         struct radius_session *sess = ctx;
2747         struct radius_server_data *data = sess->server;
2748
2749         dl_list_add(&data->erp_keys, &erp->list);
2750         return 0;
2751 }
2752
2753 #endif /* CONFIG_ERP */
2754
2755
2756 static const struct eapol_callbacks radius_server_eapol_cb =
2757 {
2758         .get_eap_user = radius_server_get_eap_user,
2759         .get_eap_req_id_text = radius_server_get_eap_req_id_text,
2760         .log_msg = radius_server_log_msg,
2761 #ifdef CONFIG_ERP
2762         .get_erp_send_reauth_start = NULL,
2763         .get_erp_domain = radius_server_get_erp_domain,
2764         .erp_get_key = radius_server_erp_get_key,
2765         .erp_add_key = radius_server_erp_add_key,
2766 #endif /* CONFIG_ERP */
2767 };
2768
2769
2770 /**
2771  * radius_server_eap_pending_cb - Pending EAP data notification
2772  * @data: RADIUS server context from radius_server_init()
2773  * @ctx: Pending EAP context pointer
2774  *
2775  * This function is used to notify EAP server module that a pending operation
2776  * has been completed and processing of the EAP session can proceed.
2777  */
2778 void radius_server_eap_pending_cb(struct radius_server_data *data, void *ctx)
2779 {
2780         struct radius_client *cli;
2781         struct radius_session *s, *sess = NULL;
2782         struct radius_msg *msg;
2783
2784         if (data == NULL)
2785                 return;
2786
2787         for (cli = data->clients; cli; cli = cli->next) {
2788                 for (s = cli->sessions; s; s = s->next) {
2789                         if (s->eap == ctx && s->last_msg) {
2790                                 sess = s;
2791                                 break;
2792                         }
2793                 }
2794                 if (sess)
2795                         break;
2796         }
2797
2798         if (sess == NULL) {
2799                 RADIUS_DEBUG("No session matched callback ctx");
2800                 return;
2801         }
2802
2803         msg = sess->last_msg;
2804         sess->last_msg = NULL;
2805         eap_sm_pending_cb(sess->eap);
2806         if (radius_server_request(data, msg,
2807                                   (struct sockaddr *) &sess->last_from,
2808                                   sess->last_fromlen, cli,
2809                                   sess->last_from_addr,
2810                                   sess->last_from_port, sess) == -2)
2811                 return; /* msg was stored with the session */
2812
2813         radius_msg_free(msg);
2814 }
2815
2816
2817 #ifdef CONFIG_SQLITE
2818
2819 struct db_session_fields {
2820         char *identity;
2821         char *nas;
2822         int hs20_t_c_filtering;
2823         int waiting_coa_ack;
2824         int coa_ack_received;
2825 };
2826
2827
2828 static int get_db_session_fields(void *ctx, int argc, char *argv[], char *col[])
2829 {
2830         struct db_session_fields *fields = ctx;
2831         int i;
2832
2833         for (i = 0; i < argc; i++) {
2834                 if (!argv[i])
2835                         continue;
2836
2837                 RADIUS_DEBUG("Session DB: %s=%s", col[i], argv[i]);
2838
2839                 if (os_strcmp(col[i], "identity") == 0) {
2840                         os_free(fields->identity);
2841                         fields->identity = os_strdup(argv[i]);
2842                 } else if (os_strcmp(col[i], "nas") == 0) {
2843                         os_free(fields->nas);
2844                         fields->nas = os_strdup(argv[i]);
2845                 } else if (os_strcmp(col[i], "hs20_t_c_filtering") == 0) {
2846                         fields->hs20_t_c_filtering = atoi(argv[i]);
2847                 } else if (os_strcmp(col[i], "waiting_coa_ack") == 0) {
2848                         fields->waiting_coa_ack = atoi(argv[i]);
2849                 } else if (os_strcmp(col[i], "coa_ack_received") == 0) {
2850                         fields->coa_ack_received = atoi(argv[i]);
2851                 }
2852         }
2853
2854         return 0;
2855 }
2856
2857
2858 static void free_db_session_fields(struct db_session_fields *fields)
2859 {
2860         os_free(fields->identity);
2861         fields->identity = NULL;
2862         os_free(fields->nas);
2863         fields->nas = NULL;
2864 }
2865
2866 #endif /* CONFIG_SQLITE */
2867
2868
2869 int radius_server_dac_request(struct radius_server_data *data, const char *req)
2870 {
2871 #ifdef CONFIG_SQLITE
2872         char *sql;
2873         int res;
2874         int disconnect;
2875         const char *pos = req;
2876         u8 addr[ETH_ALEN];
2877         char addrtxt[3 * ETH_ALEN];
2878         int t_c_clear = 0;
2879         struct db_session_fields fields;
2880         struct sockaddr_in das;
2881         struct radius_client *client;
2882         struct radius_msg *msg;
2883         struct wpabuf *buf;
2884         u8 identifier;
2885         struct os_time now;
2886
2887         if (!data)
2888                 return -1;
2889
2890         /* req: <disconnect|coa> <MAC Address> [t_c_clear] */
2891
2892         if (os_strncmp(pos, "disconnect ", 11) == 0) {
2893                 disconnect = 1;
2894                 pos += 11;
2895         } else if (os_strncmp(req, "coa ", 4) == 0) {
2896                 disconnect = 0;
2897                 pos += 4;
2898         } else {
2899                 return -1;
2900         }
2901
2902         if (hwaddr_aton(pos, addr))
2903                 return -1;
2904         pos = os_strchr(pos, ' ');
2905         if (pos) {
2906                 if (os_strstr(pos, "t_c_clear"))
2907                         t_c_clear = 1;
2908         }
2909
2910         if (!disconnect && !t_c_clear) {
2911                 RADIUS_ERROR("DAC request for CoA without any authorization change");
2912                 return -1;
2913         }
2914
2915         if (!data->db) {
2916                 RADIUS_ERROR("SQLite database not in use");
2917                 return -1;
2918         }
2919
2920         os_snprintf(addrtxt, sizeof(addrtxt), MACSTR, MAC2STR(addr));
2921
2922         sql = sqlite3_mprintf("SELECT * FROM current_sessions WHERE mac_addr=%Q",
2923                               addrtxt);
2924         if (!sql)
2925                 return -1;
2926
2927         os_memset(&fields, 0, sizeof(fields));
2928         res = sqlite3_exec(data->db, sql, get_db_session_fields, &fields, NULL);
2929         sqlite3_free(sql);
2930         if (res != SQLITE_OK) {
2931                 RADIUS_ERROR("Failed to find matching current_sessions entry from sqlite database: %s",
2932                              sqlite3_errmsg(data->db));
2933                 free_db_session_fields(&fields);
2934                 return -1;
2935         }
2936
2937         if (!fields.nas) {
2938                 RADIUS_ERROR("No NAS information found from current_sessions");
2939                 free_db_session_fields(&fields);
2940                 return -1;
2941         }
2942
2943         os_memset(&das, 0, sizeof(das));
2944         das.sin_family = AF_INET;
2945         das.sin_addr.s_addr = inet_addr(fields.nas);
2946         das.sin_port = htons(3799);
2947
2948         free_db_session_fields(&fields);
2949
2950         client = radius_server_get_client(data, &das.sin_addr, 0);
2951         if (!client) {
2952                 RADIUS_ERROR("No NAS information available to protect the packet");
2953                 return -1;
2954         }
2955
2956         identifier = client->next_dac_identifier++;
2957
2958         msg = radius_msg_new(disconnect ? RADIUS_CODE_DISCONNECT_REQUEST :
2959                              RADIUS_CODE_COA_REQUEST, identifier);
2960         if (!msg)
2961                 return -1;
2962
2963         os_snprintf(addrtxt, sizeof(addrtxt), RADIUS_802_1X_ADDR_FORMAT,
2964                     MAC2STR(addr));
2965         if (!radius_msg_add_attr(msg, RADIUS_ATTR_CALLING_STATION_ID,
2966                                  (u8 *) addrtxt, os_strlen(addrtxt))) {
2967                 RADIUS_ERROR("Could not add Calling-Station-Id");
2968                 radius_msg_free(msg);
2969                 return -1;
2970         }
2971
2972         if (!disconnect && t_c_clear) {
2973                 u8 val[4] = { 0x00, 0x00, 0x00, 0x00 }; /* E=0 */
2974
2975                 if (!radius_msg_add_wfa(
2976                             msg, RADIUS_VENDOR_ATTR_WFA_HS20_T_C_FILTERING,
2977                             val, sizeof(val))) {
2978                         RADIUS_DEBUG("Failed to add WFA-HS20-T-C-Filtering");
2979                         radius_msg_free(msg);
2980                         return -1;
2981                 }
2982         }
2983
2984         os_get_time(&now);
2985         if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_EVENT_TIMESTAMP,
2986                                        now.sec)) {
2987                 RADIUS_ERROR("Failed to add Event-Timestamp attribute");
2988                 radius_msg_free(msg);
2989                 return -1;
2990         }
2991
2992         radius_msg_finish_acct(msg, (u8 *) client->shared_secret,
2993                                client->shared_secret_len);
2994
2995         if (wpa_debug_level <= MSG_MSGDUMP)
2996                 radius_msg_dump(msg);
2997
2998         buf = radius_msg_get_buf(msg);
2999         if (sendto(data->auth_sock, wpabuf_head(buf), wpabuf_len(buf), 0,
3000                    (struct sockaddr *) &das, sizeof(das)) < 0) {
3001                 RADIUS_ERROR("Failed to send packet - sendto: %s",
3002                              strerror(errno));
3003                 radius_msg_free(msg);
3004                 return -1;
3005         }
3006
3007         if (disconnect) {
3008                 radius_msg_free(client->pending_dac_disconnect_req);
3009                 client->pending_dac_disconnect_req = msg;
3010                 client->pending_dac_disconnect_id = identifier;
3011                 os_memcpy(client->pending_dac_disconnect_addr, addr, ETH_ALEN);
3012         } else {
3013                 radius_msg_free(client->pending_dac_coa_req);
3014                 client->pending_dac_coa_req = msg;
3015                 client->pending_dac_coa_id = identifier;
3016                 os_memcpy(client->pending_dac_coa_addr, addr, ETH_ALEN);
3017         }
3018
3019         return 0;
3020 #else /* CONFIG_SQLITE */
3021         return -1;
3022 #endif /* CONFIG_SQLITE */
3023 }