src/radius/radius_server.c

   1 /*
   2  * hostapd / RADIUS authentication server
   3  * Copyright (c) 2005-2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16 #include <net/if.h>
  17
  18 #include "common.h"
  19 #include "radius.h"
  20 #include "eloop.h"
  21 #include "defs.h"
  22 #include "eap_server/eap.h"
  23 #include "radius_server.h"
  24
  25 #define RADIUS_SESSION_TIMEOUT 60
  26 #define RADIUS_MAX_SESSION 100
  27 #define RADIUS_MAX_MSG_LEN 3000
  28
  29 static struct eapol_callbacks radius_server_eapol_cb;
  30
  31 struct radius_client;
  32 struct radius_server_data;
  33
  34 struct radius_server_counters {
  35         u32 access_requests;
  36         u32 invalid_requests;
  37         u32 dup_access_requests;
  38         u32 access_accepts;
  39         u32 access_rejects;
  40         u32 access_challenges;
  41         u32 malformed_access_requests;
  42         u32 bad_authenticators;
  43         u32 packets_dropped;
  44         u32 unknown_types;
  45 };
  46
  47 struct radius_session {
  48         struct radius_session *next;
  49         struct radius_client *client;
  50         struct radius_server_data *server;
  51         unsigned int sess_id;
  52         struct eap_sm *eap;
  53         struct eap_eapol_interface *eap_if;
  54
  55         struct radius_msg *last_msg;
  56         char *last_from_addr;
  57         int last_from_port;
  58         struct sockaddr_storage last_from;
  59         socklen_t last_fromlen;
  60         u8 last_identifier;
  61         struct radius_msg *last_reply;
  62         u8 last_authenticator[16];
  63 };
  64
  65 struct radius_client {
  66         struct radius_client *next;
  67         struct in_addr addr;
  68         struct in_addr mask;
  69 #ifdef CONFIG_IPV6
  70         struct in6_addr addr6;
  71         struct in6_addr mask6;
  72 #endif /* CONFIG_IPV6 */
  73         char *shared_secret;
  74         int shared_secret_len;
  75         struct radius_session *sessions;
  76         struct radius_server_counters counters;
  77 };
  78
  79 struct radius_server_data {
  80         int auth_sock;
  81         struct radius_client *clients;
  82         unsigned int next_sess_id;
  83         void *conf_ctx;
  84         int num_sess;
  85         void *eap_sim_db_priv;
  86         void *ssl_ctx;
  87         u8 *pac_opaque_encr_key;
  88         char *eap_fast_a_id;
  89         int eap_sim_aka_result_ind;
  90         int tnc;
  91         int ipv6;
  92         struct os_time start_time;
  93         struct radius_server_counters counters;
  94         int (*get_eap_user)(void *ctx, const u8 *identity, size_t identity_len,
  95                             int phase2, struct eap_user *user);
  96 };
  97
  98
  99 extern int wpa_debug_level;
 100
 101 #define RADIUS_DEBUG(args...) \
 102 wpa_printf(MSG_DEBUG, "RADIUS SRV: " args)
 103 #define RADIUS_ERROR(args...) \
 104 wpa_printf(MSG_ERROR, "RADIUS SRV: " args)
 105 #define RADIUS_DUMP(args...) \
 106 wpa_hexdump(MSG_MSGDUMP, "RADIUS SRV: " args)
 107 #define RADIUS_DUMP_ASCII(args...) \
 108 wpa_hexdump_ascii(MSG_MSGDUMP, "RADIUS SRV: " args)
 109
 110
 111 static void radius_server_session_timeout(void *eloop_ctx, void *timeout_ctx);
 112
 113
 114
 115 static struct radius_client *
 116 radius_server_get_client(struct radius_server_data *data, struct in_addr *addr,
 117                          int ipv6)
 118 {
 119         struct radius_client *client = data->clients;
 120
 121         while (client) {
 122 #ifdef CONFIG_IPV6
 123                 if (ipv6) {
 124                         struct in6_addr *addr6;
 125                         int i;
 126
 127                         addr6 = (struct in6_addr *) addr;
 128                         for (i = 0; i < 16; i++) {
 129                                 if ((addr6->s6_addr[i] &
 130                                      client->mask6.s6_addr[i]) !=
 131                                     (client->addr6.s6_addr[i] &
 132                                      client->mask6.s6_addr[i])) {
 133                                         i = 17;
 134                                         break;
 135                                 }
 136                         }
 137                         if (i == 16) {
 138                                 break;
 139                         }
 140                 }
 141 #endif /* CONFIG_IPV6 */
 142                 if (!ipv6 && (client->addr.s_addr & client->mask.s_addr) ==
 143                     (addr->s_addr & client->mask.s_addr)) {
 144                         break;
 145                 }
 146
 147                 client = client->next;
 148         }
 149
 150         return client;
 151 }
 152
 153
 154 static struct radius_session *
 155 radius_server_get_session(struct radius_client *client, unsigned int sess_id)
 156 {
 157         struct radius_session *sess = client->sessions;
 158
 159         while (sess) {
 160                 if (sess->sess_id == sess_id) {
 161                         break;
 162                 }
 163                 sess = sess->next;
 164         }
 165
 166         return sess;
 167 }
 168
 169
 170 static void radius_server_session_free(struct radius_server_data *data,
 171                                        struct radius_session *sess)
 172 {
 173         eloop_cancel_timeout(radius_server_session_timeout, data, sess);
 174         eap_server_sm_deinit(sess->eap);
 175         if (sess->last_msg) {
 176                 radius_msg_free(sess->last_msg);
 177                 os_free(sess->last_msg);
 178         }
 179         os_free(sess->last_from_addr);
 180         if (sess->last_reply) {
 181                 radius_msg_free(sess->last_reply);
 182                 os_free(sess->last_reply);
 183         }
 184         os_free(sess);
 185         data->num_sess--;
 186 }
 187
 188
 189 static void radius_server_session_remove_timeout(void *eloop_ctx,
 190                                                  void *timeout_ctx);
 191
 192 static void radius_server_session_remove(struct radius_server_data *data,
 193                                          struct radius_session *sess)
 194 {
 195         struct radius_client *client = sess->client;
 196         struct radius_session *session, *prev;
 197
 198         eloop_cancel_timeout(radius_server_session_remove_timeout, data, sess);
 199
 200         prev = NULL;
 201         session = client->sessions;
 202         while (session) {
 203                 if (session == sess) {
 204                         if (prev == NULL) {
 205                                 client->sessions = sess->next;
 206                         } else {
 207                                 prev->next = sess->next;
 208                         }
 209                         radius_server_session_free(data, sess);
 210                         break;
 211                 }
 212                 prev = session;
 213                 session = session->next;
 214         }
 215 }
 216
 217
 218 static void radius_server_session_remove_timeout(void *eloop_ctx,
 219                                                  void *timeout_ctx)
 220 {
 221         struct radius_server_data *data = eloop_ctx;
 222         struct radius_session *sess = timeout_ctx;
 223         RADIUS_DEBUG("Removing completed session 0x%x", sess->sess_id);
 224         radius_server_session_remove(data, sess);
 225 }
 226
 227
 228 static void radius_server_session_timeout(void *eloop_ctx, void *timeout_ctx)
 229 {
 230         struct radius_server_data *data = eloop_ctx;
 231         struct radius_session *sess = timeout_ctx;
 232
 233         RADIUS_DEBUG("Timing out authentication session 0x%x", sess->sess_id);
 234         radius_server_session_remove(data, sess);
 235 }
 236
 237
 238 static struct radius_session *
 239 radius_server_new_session(struct radius_server_data *data,
 240                           struct radius_client *client)
 241 {
 242         struct radius_session *sess;
 243
 244         if (data->num_sess >= RADIUS_MAX_SESSION) {
 245                 RADIUS_DEBUG("Maximum number of existing session - no room "
 246                              "for a new session");
 247                 return NULL;
 248         }
 249
 250         sess = os_zalloc(sizeof(*sess));
 251         if (sess == NULL)
 252                 return NULL;
 253
 254         sess->server = data;
 255         sess->client = client;
 256         sess->sess_id = data->next_sess_id++;
 257         sess->next = client->sessions;
 258         client->sessions = sess;
 259         eloop_register_timeout(RADIUS_SESSION_TIMEOUT, 0,
 260                                radius_server_session_timeout, data, sess);
 261         data->num_sess++;
 262         return sess;
 263 }
 264
 265
 266 static struct radius_session *
 267 radius_server_get_new_session(struct radius_server_data *data,
 268                               struct radius_client *client,
 269                               struct radius_msg *msg)
 270 {
 271         u8 *user;
 272         size_t user_len;
 273         int res;
 274         struct radius_session *sess;
 275         struct eap_config eap_conf;
 276
 277         RADIUS_DEBUG("Creating a new session");
 278
 279         user = os_malloc(256);
 280         if (user == NULL) {
 281                 return NULL;
 282         }
 283         res = radius_msg_get_attr(msg, RADIUS_ATTR_USER_NAME, user, 256);
 284         if (res < 0 || res > 256) {
 285                 RADIUS_DEBUG("Could not get User-Name");
 286                 os_free(user);
 287                 return NULL;
 288         }
 289         user_len = res;
 290         RADIUS_DUMP_ASCII("User-Name", user, user_len);
 291
 292         res = data->get_eap_user(data->conf_ctx, user, user_len, 0, NULL);
 293         os_free(user);
 294
 295         if (res == 0) {
 296                 RADIUS_DEBUG("Matching user entry found");
 297                 sess = radius_server_new_session(data, client);
 298                 if (sess == NULL) {
 299                         RADIUS_DEBUG("Failed to create a new session");
 300                         return NULL;
 301                 }
 302         } else {
 303                 RADIUS_DEBUG("User-Name not found from user database");
 304                 return NULL;
 305         }
 306
 307         os_memset(&eap_conf, 0, sizeof(eap_conf));
 308         eap_conf.ssl_ctx = data->ssl_ctx;
 309         eap_conf.eap_sim_db_priv = data->eap_sim_db_priv;
 310         eap_conf.backend_auth = TRUE;
 311         eap_conf.eap_server = 1;
 312         eap_conf.pac_opaque_encr_key = data->pac_opaque_encr_key;
 313         eap_conf.eap_fast_a_id = data->eap_fast_a_id;
 314         eap_conf.eap_sim_aka_result_ind = data->eap_sim_aka_result_ind;
 315         eap_conf.tnc = data->tnc;
 316         sess->eap = eap_server_sm_init(sess, &radius_server_eapol_cb,
 317                                        &eap_conf);
 318         if (sess->eap == NULL) {
 319                 RADIUS_DEBUG("Failed to initialize EAP state machine for the "
 320                              "new session");
 321                 radius_server_session_free(data, sess);
 322                 return NULL;
 323         }
 324         sess->eap_if = eap_get_interface(sess->eap);
 325         sess->eap_if->eapRestart = TRUE;
 326         sess->eap_if->portEnabled = TRUE;
 327
 328         RADIUS_DEBUG("New session 0x%x initialized", sess->sess_id);
 329
 330         return sess;
 331 }
 332
 333
 334 static struct radius_msg *
 335 radius_server_encapsulate_eap(struct radius_server_data *data,
 336                               struct radius_client *client,
 337                               struct radius_session *sess,
 338                               struct radius_msg *request)
 339 {
 340         struct radius_msg *msg;
 341         int code;
 342         unsigned int sess_id;
 343
 344         if (sess->eap_if->eapFail) {
 345                 sess->eap_if->eapFail = FALSE;
 346                 code = RADIUS_CODE_ACCESS_REJECT;
 347         } else if (sess->eap_if->eapSuccess) {
 348                 sess->eap_if->eapSuccess = FALSE;
 349                 code = RADIUS_CODE_ACCESS_ACCEPT;
 350         } else {
 351                 sess->eap_if->eapReq = FALSE;
 352                 code = RADIUS_CODE_ACCESS_CHALLENGE;
 353         }
 354
 355         msg = radius_msg_new(code, request->hdr->identifier);
 356         if (msg == NULL) {
 357                 RADIUS_DEBUG("Failed to allocate reply message");
 358                 return NULL;
 359         }
 360
 361         sess_id = htonl(sess->sess_id);
 362         if (code == RADIUS_CODE_ACCESS_CHALLENGE &&
 363             !radius_msg_add_attr(msg, RADIUS_ATTR_STATE,
 364                                  (u8 *) &sess_id, sizeof(sess_id))) {
 365                 RADIUS_DEBUG("Failed to add State attribute");
 366         }
 367
 368         if (sess->eap_if->eapReqData &&
 369             !radius_msg_add_eap(msg, wpabuf_head(sess->eap_if->eapReqData),
 370                                 wpabuf_len(sess->eap_if->eapReqData))) {
 371                 RADIUS_DEBUG("Failed to add EAP-Message attribute");
 372         }
 373
 374         if (code == RADIUS_CODE_ACCESS_ACCEPT && sess->eap_if->eapKeyData) {
 375                 int len;
 376                 if (sess->eap_if->eapKeyDataLen > 64) {
 377                         len = 32;
 378                 } else {
 379                         len = sess->eap_if->eapKeyDataLen / 2;
 380                 }
 381                 if (!radius_msg_add_mppe_keys(msg, request->hdr->authenticator,
 382                                               (u8 *) client->shared_secret,
 383                                               client->shared_secret_len,
 384                                               sess->eap_if->eapKeyData + len,
 385                                               len, sess->eap_if->eapKeyData,
 386                                               len)) {
 387                         RADIUS_DEBUG("Failed to add MPPE key attributes");
 388                 }
 389         }
 390
 391         if (radius_msg_copy_attr(msg, request, RADIUS_ATTR_PROXY_STATE) < 0) {
 392                 RADIUS_DEBUG("Failed to copy Proxy-State attribute(s)");
 393                 radius_msg_free(msg);
 394                 os_free(msg);
 395                 return NULL;
 396         }
 397
 398         if (radius_msg_finish_srv(msg, (u8 *) client->shared_secret,
 399                                   client->shared_secret_len,
 400                                   request->hdr->authenticator) < 0) {
 401                 RADIUS_DEBUG("Failed to add Message-Authenticator attribute");
 402         }
 403
 404         return msg;
 405 }
 406
 407
 408 static int radius_server_reject(struct radius_server_data *data,
 409                                 struct radius_client *client,
 410                                 struct radius_msg *request,
 411                                 struct sockaddr *from, socklen_t fromlen,
 412                                 const char *from_addr, int from_port)
 413 {
 414         struct radius_msg *msg;
 415         int ret = 0;
 416         struct eap_hdr eapfail;
 417
 418         RADIUS_DEBUG("Reject invalid request from %s:%d",
 419                      from_addr, from_port);
 420
 421         msg = radius_msg_new(RADIUS_CODE_ACCESS_REJECT,
 422                              request->hdr->identifier);
 423         if (msg == NULL) {
 424                 return -1;
 425         }
 426
 427         os_memset(&eapfail, 0, sizeof(eapfail));
 428         eapfail.code = EAP_CODE_FAILURE;
 429         eapfail.identifier = 0;
 430         eapfail.length = host_to_be16(sizeof(eapfail));
 431
 432         if (!radius_msg_add_eap(msg, (u8 *) &eapfail, sizeof(eapfail))) {
 433                 RADIUS_DEBUG("Failed to add EAP-Message attribute");
 434         }
 435
 436         if (radius_msg_copy_attr(msg, request, RADIUS_ATTR_PROXY_STATE) < 0) {
 437                 RADIUS_DEBUG("Failed to copy Proxy-State attribute(s)");
 438                 radius_msg_free(msg);
 439                 os_free(msg);
 440                 return -1;
 441         }
 442
 443         if (radius_msg_finish_srv(msg, (u8 *) client->shared_secret,
 444                                   client->shared_secret_len,
 445                                   request->hdr->authenticator) < 0) {
 446                 RADIUS_DEBUG("Failed to add Message-Authenticator attribute");
 447         }
 448
 449         if (wpa_debug_level <= MSG_MSGDUMP) {
 450                 radius_msg_dump(msg);
 451         }
 452
 453         data->counters.access_rejects++;
 454         client->counters.access_rejects++;
 455         if (sendto(data->auth_sock, msg->buf, msg->buf_used, 0,
 456                    (struct sockaddr *) from, sizeof(*from)) < 0) {
 457                 perror("sendto[RADIUS SRV]");
 458                 ret = -1;
 459         }
 460
 461         radius_msg_free(msg);
 462         os_free(msg);
 463
 464         return ret;
 465 }
 466
 467
 468 static int radius_server_request(struct radius_server_data *data,
 469                                  struct radius_msg *msg,
 470                                  struct sockaddr *from, socklen_t fromlen,
 471                                  struct radius_client *client,
 472                                  const char *from_addr, int from_port,
 473                                  struct radius_session *force_sess)
 474 {
 475         u8 *eap = NULL;
 476         size_t eap_len;
 477         int res, state_included = 0;
 478         u8 statebuf[4];
 479         unsigned int state;
 480         struct radius_session *sess;
 481         struct radius_msg *reply;
 482
 483         if (force_sess)
 484                 sess = force_sess;
 485         else {
 486                 res = radius_msg_get_attr(msg, RADIUS_ATTR_STATE, statebuf,
 487                                           sizeof(statebuf));
 488                 state_included = res >= 0;
 489                 if (res == sizeof(statebuf)) {
 490                         state = WPA_GET_BE32(statebuf);
 491                         sess = radius_server_get_session(client, state);
 492                 } else {
 493                         sess = NULL;
 494                 }
 495         }
 496
 497         if (sess) {
 498                 RADIUS_DEBUG("Request for session 0x%x", sess->sess_id);
 499         } else if (state_included) {
 500                 RADIUS_DEBUG("State attribute included but no session found");
 501                 radius_server_reject(data, client, msg, from, fromlen,
 502                                      from_addr, from_port);
 503                 return -1;
 504         } else {
 505                 sess = radius_server_get_new_session(data, client, msg);
 506                 if (sess == NULL) {
 507                         RADIUS_DEBUG("Could not create a new session");
 508                         radius_server_reject(data, client, msg, from, fromlen,
 509                                              from_addr, from_port);
 510                         return -1;
 511                 }
 512         }
 513
 514         if (sess->last_from_port == from_port &&
 515             sess->last_identifier == msg->hdr->identifier &&
 516             os_memcmp(sess->last_authenticator, msg->hdr->authenticator, 16) ==
 517             0) {
 518                 RADIUS_DEBUG("Duplicate message from %s", from_addr);
 519                 data->counters.dup_access_requests++;
 520                 client->counters.dup_access_requests++;
 521
 522                 if (sess->last_reply) {
 523                         res = sendto(data->auth_sock, sess->last_reply->buf,
 524                                      sess->last_reply->buf_used, 0,
 525                                      (struct sockaddr *) from, fromlen);
 526                         if (res < 0) {
 527                                 perror("sendto[RADIUS SRV]");
 528                         }
 529                         return 0;
 530                 }
 531
 532                 RADIUS_DEBUG("No previous reply available for duplicate "
 533                              "message");
 534                 return -1;
 535         }
 536
 537         eap = radius_msg_get_eap(msg, &eap_len);
 538         if (eap == NULL) {
 539                 RADIUS_DEBUG("No EAP-Message in RADIUS packet from %s",
 540                              from_addr);
 541                 data->counters.packets_dropped++;
 542                 client->counters.packets_dropped++;
 543                 return -1;
 544         }
 545
 546         RADIUS_DUMP("Received EAP data", eap, eap_len);
 547
 548         /* FIX: if Code is Request, Success, or Failure, send Access-Reject;
 549          * RFC3579 Sect. 2.6.2.
 550          * Include EAP-Response/Nak with no preferred method if
 551          * code == request.
 552          * If code is not 1-4, discard the packet silently.
 553          * Or is this already done by the EAP state machine? */
 554
 555         wpabuf_free(sess->eap_if->eapRespData);
 556         sess->eap_if->eapRespData = wpabuf_alloc_ext_data(eap, eap_len);
 557         if (sess->eap_if->eapRespData == NULL)
 558                 os_free(eap);
 559         eap = NULL;
 560         sess->eap_if->eapResp = TRUE;
 561         eap_server_sm_step(sess->eap);
 562
 563         if ((sess->eap_if->eapReq || sess->eap_if->eapSuccess ||
 564              sess->eap_if->eapFail) && sess->eap_if->eapReqData) {
 565                 RADIUS_DUMP("EAP data from the state machine",
 566                             wpabuf_head(sess->eap_if->eapReqData),
 567                             wpabuf_len(sess->eap_if->eapReqData));
 568         } else if (sess->eap_if->eapFail) {
 569                 RADIUS_DEBUG("No EAP data from the state machine, but eapFail "
 570                              "set");
 571         } else if (eap_sm_method_pending(sess->eap)) {
 572                 if (sess->last_msg) {
 573                         radius_msg_free(sess->last_msg);
 574                         os_free(sess->last_msg);
 575                 }
 576                 sess->last_msg = msg;
 577                 sess->last_from_port = from_port;
 578                 os_free(sess->last_from_addr);
 579                 sess->last_from_addr = os_strdup(from_addr);
 580                 sess->last_fromlen = fromlen;
 581                 os_memcpy(&sess->last_from, from, fromlen);
 582                 return -2;
 583         } else {
 584                 RADIUS_DEBUG("No EAP data from the state machine - ignore this"
 585                              " Access-Request silently (assuming it was a "
 586                              "duplicate)");
 587                 data->counters.packets_dropped++;
 588                 client->counters.packets_dropped++;
 589                 return -1;
 590         }
 591
 592         reply = radius_server_encapsulate_eap(data, client, sess, msg);
 593
 594         if (reply) {
 595                 RADIUS_DEBUG("Reply to %s:%d", from_addr, from_port);
 596                 if (wpa_debug_level <= MSG_MSGDUMP) {
 597                         radius_msg_dump(reply);
 598                 }
 599
 600                 switch (reply->hdr->code) {
 601                 case RADIUS_CODE_ACCESS_ACCEPT:
 602                         data->counters.access_accepts++;
 603                         client->counters.access_accepts++;
 604                         break;
 605                 case RADIUS_CODE_ACCESS_REJECT:
 606                         data->counters.access_rejects++;
 607                         client->counters.access_rejects++;
 608                         break;
 609                 case RADIUS_CODE_ACCESS_CHALLENGE:
 610                         data->counters.access_challenges++;
 611                         client->counters.access_challenges++;
 612                         break;
 613                 }
 614                 res = sendto(data->auth_sock, reply->buf, reply->buf_used, 0,
 615                              (struct sockaddr *) from, fromlen);
 616                 if (res < 0) {
 617                         perror("sendto[RADIUS SRV]");
 618                 }
 619                 if (sess->last_reply) {
 620                         radius_msg_free(sess->last_reply);
 621                         os_free(sess->last_reply);
 622                 }
 623                 sess->last_reply = reply;
 624                 sess->last_from_port = from_port;
 625                 sess->last_identifier = msg->hdr->identifier;
 626                 os_memcpy(sess->last_authenticator, msg->hdr->authenticator,
 627                           16);
 628         } else {
 629                 data->counters.packets_dropped++;
 630                 client->counters.packets_dropped++;
 631         }
 632
 633         if (sess->eap_if->eapSuccess || sess->eap_if->eapFail) {
 634                 RADIUS_DEBUG("Removing completed session 0x%x after timeout",
 635                              sess->sess_id);
 636                 eloop_cancel_timeout(radius_server_session_remove_timeout,
 637                                      data, sess);
 638                 eloop_register_timeout(10, 0,
 639                                        radius_server_session_remove_timeout,
 640                                        data, sess);
 641         }
 642
 643         return 0;
 644 }
 645
 646
 647 static void radius_server_receive_auth(int sock, void *eloop_ctx,
 648                                        void *sock_ctx)
 649 {
 650         struct radius_server_data *data = eloop_ctx;
 651         u8 *buf = NULL;
 652         struct sockaddr_storage from;
 653         socklen_t fromlen;
 654         int len;
 655         struct radius_client *client = NULL;
 656         struct radius_msg *msg = NULL;
 657         char abuf[50];
 658         int from_port = 0;
 659
 660         buf = os_malloc(RADIUS_MAX_MSG_LEN);
 661         if (buf == NULL) {
 662                 goto fail;
 663         }
 664
 665         fromlen = sizeof(from);
 666         len = recvfrom(sock, buf, RADIUS_MAX_MSG_LEN, 0,
 667                        (struct sockaddr *) &from, &fromlen);
 668         if (len < 0) {
 669                 perror("recvfrom[radius_server]");
 670                 goto fail;
 671         }
 672
 673 #ifdef CONFIG_IPV6
 674         if (data->ipv6) {
 675                 struct sockaddr_in6 *from6 = (struct sockaddr_in6 *) &from;
 676                 if (inet_ntop(AF_INET6, &from6->sin6_addr, abuf, sizeof(abuf))
 677                     == NULL)
 678                         abuf[0] = '\0';
 679                 from_port = ntohs(from6->sin6_port);
 680                 RADIUS_DEBUG("Received %d bytes from %s:%d",
 681                              len, abuf, from_port);
 682
 683                 client = radius_server_get_client(data,
 684                                                   (struct in_addr *)
 685                                                   &from6->sin6_addr, 1);
 686         }
 687 #endif /* CONFIG_IPV6 */
 688
 689         if (!data->ipv6) {
 690                 struct sockaddr_in *from4 = (struct sockaddr_in *) &from;
 691                 os_strlcpy(abuf, inet_ntoa(from4->sin_addr), sizeof(abuf));
 692                 from_port = ntohs(from4->sin_port);
 693                 RADIUS_DEBUG("Received %d bytes from %s:%d",
 694                              len, abuf, from_port);
 695
 696                 client = radius_server_get_client(data, &from4->sin_addr, 0);
 697         }
 698
 699         RADIUS_DUMP("Received data", buf, len);
 700
 701         if (client == NULL) {
 702                 RADIUS_DEBUG("Unknown client %s - packet ignored", abuf);
 703                 data->counters.invalid_requests++;
 704                 goto fail;
 705         }
 706
 707         msg = radius_msg_parse(buf, len);
 708         if (msg == NULL) {
 709                 RADIUS_DEBUG("Parsing incoming RADIUS frame failed");
 710                 data->counters.malformed_access_requests++;
 711                 client->counters.malformed_access_requests++;
 712                 goto fail;
 713         }
 714
 715         os_free(buf);
 716         buf = NULL;
 717
 718         if (wpa_debug_level <= MSG_MSGDUMP) {
 719                 radius_msg_dump(msg);
 720         }
 721
 722         if (msg->hdr->code != RADIUS_CODE_ACCESS_REQUEST) {
 723                 RADIUS_DEBUG("Unexpected RADIUS code %d", msg->hdr->code);
 724                 data->counters.unknown_types++;
 725                 client->counters.unknown_types++;
 726                 goto fail;
 727         }
 728
 729         data->counters.access_requests++;
 730         client->counters.access_requests++;
 731
 732         if (radius_msg_verify_msg_auth(msg, (u8 *) client->shared_secret,
 733                                        client->shared_secret_len, NULL)) {
 734                 RADIUS_DEBUG("Invalid Message-Authenticator from %s", abuf);
 735                 data->counters.bad_authenticators++;
 736                 client->counters.bad_authenticators++;
 737                 goto fail;
 738         }
 739
 740         if (radius_server_request(data, msg, (struct sockaddr *) &from,
 741                                   fromlen, client, abuf, from_port, NULL) ==
 742             -2)
 743                 return; /* msg was stored with the session */
 744
 745 fail:
 746         if (msg) {
 747                 radius_msg_free(msg);
 748                 os_free(msg);
 749         }
 750         os_free(buf);
 751 }
 752
 753
 754 static int radius_server_open_socket(int port)
 755 {
 756         int s;
 757         struct sockaddr_in addr;
 758
 759         s = socket(PF_INET, SOCK_DGRAM, 0);
 760         if (s < 0) {
 761                 perror("socket");
 762                 return -1;
 763         }
 764
 765         os_memset(&addr, 0, sizeof(addr));
 766         addr.sin_family = AF_INET;
 767         addr.sin_port = htons(port);
 768         if (bind(s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
 769                 perror("bind");
 770                 close(s);
 771                 return -1;
 772         }
 773
 774         return s;
 775 }
 776
 777
 778 #ifdef CONFIG_IPV6
 779 static int radius_server_open_socket6(int port)
 780 {
 781         int s;
 782         struct sockaddr_in6 addr;
 783
 784         s = socket(PF_INET6, SOCK_DGRAM, 0);
 785         if (s < 0) {
 786                 perror("socket[IPv6]");
 787                 return -1;
 788         }
 789
 790         os_memset(&addr, 0, sizeof(addr));
 791         addr.sin6_family = AF_INET6;
 792         os_memcpy(&addr.sin6_addr, &in6addr_any, sizeof(in6addr_any));
 793         addr.sin6_port = htons(port);
 794         if (bind(s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
 795                 perror("bind");
 796                 close(s);
 797                 return -1;
 798         }
 799
 800         return s;
 801 }
 802 #endif /* CONFIG_IPV6 */
 803
 804
 805 static void radius_server_free_sessions(struct radius_server_data *data,
 806                                         struct radius_session *sessions)
 807 {
 808         struct radius_session *session, *prev;
 809
 810         session = sessions;
 811         while (session) {
 812                 prev = session;
 813                 session = session->next;
 814                 radius_server_session_free(data, prev);
 815         }
 816 }
 817
 818
 819 static void radius_server_free_clients(struct radius_server_data *data,
 820                                        struct radius_client *clients)
 821 {
 822         struct radius_client *client, *prev;
 823
 824         client = clients;
 825         while (client) {
 826                 prev = client;
 827                 client = client->next;
 828
 829                 radius_server_free_sessions(data, prev->sessions);
 830                 os_free(prev->shared_secret);
 831                 os_free(prev);
 832         }
 833 }
 834
 835
 836 static struct radius_client *
 837 radius_server_read_clients(const char *client_file, int ipv6)
 838 {
 839         FILE *f;
 840         const int buf_size = 1024;
 841         char *buf, *pos;
 842         struct radius_client *clients, *tail, *entry;
 843         int line = 0, mask, failed = 0, i;
 844         struct in_addr addr;
 845 #ifdef CONFIG_IPV6
 846         struct in6_addr addr6;
 847 #endif /* CONFIG_IPV6 */
 848         unsigned int val;
 849
 850         f = fopen(client_file, "r");
 851         if (f == NULL) {
 852                 RADIUS_ERROR("Could not open client file '%s'", client_file);
 853                 return NULL;
 854         }
 855
 856         buf = os_malloc(buf_size);
 857         if (buf == NULL) {
 858                 fclose(f);
 859                 return NULL;
 860         }
 861
 862         clients = tail = NULL;
 863         while (fgets(buf, buf_size, f)) {
 864                 /* Configuration file format:
 865                  * 192.168.1.0/24 secret
 866                  * 192.168.1.2 secret
 867                  * fe80::211:22ff:fe33:4455/64 secretipv6
 868                  */
 869                 line++;
 870                 buf[buf_size - 1] = '\0';
 871                 pos = buf;
 872                 while (*pos != '\0' && *pos != '\n')
 873                         pos++;
 874                 if (*pos == '\n')
 875                         *pos = '\0';
 876                 if (*buf == '\0' || *buf == '#')
 877                         continue;
 878
 879                 pos = buf;
 880                 while ((*pos >= '0' && *pos <= '9') || *pos == '.' ||
 881                        (*pos >= 'a' && *pos <= 'f') || *pos == ':' ||
 882                        (*pos >= 'A' && *pos <= 'F')) {
 883                         pos++;
 884                 }
 885
 886                 if (*pos == '\0') {
 887                         failed = 1;
 888                         break;
 889                 }
 890
 891                 if (*pos == '/') {
 892                         char *end;
 893                         *pos++ = '\0';
 894                         mask = strtol(pos, &end, 10);
 895                         if ((pos == end) ||
 896                             (mask < 0 || mask > (ipv6 ? 128 : 32))) {
 897                                 failed = 1;
 898                                 break;
 899                         }
 900                         pos = end;
 901                 } else {
 902                         mask = ipv6 ? 128 : 32;
 903                         *pos++ = '\0';
 904                 }
 905
 906                 if (!ipv6 && inet_aton(buf, &addr) == 0) {
 907                         failed = 1;
 908                         break;
 909                 }
 910 #ifdef CONFIG_IPV6
 911                 if (ipv6 && inet_pton(AF_INET6, buf, &addr6) <= 0) {
 912                         if (inet_pton(AF_INET, buf, &addr) <= 0) {
 913                                 failed = 1;
 914                                 break;
 915                         }
 916                         /* Convert IPv4 address to IPv6 */
 917                         if (mask <= 32)
 918                                 mask += (128 - 32);
 919                         os_memset(addr6.s6_addr, 0, 10);
 920                         addr6.s6_addr[10] = 0xff;
 921                         addr6.s6_addr[11] = 0xff;
 922                         os_memcpy(addr6.s6_addr + 12, (char *) &addr.s_addr,
 923                                   4);
 924                 }
 925 #endif /* CONFIG_IPV6 */
 926
 927                 while (*pos == ' ' || *pos == '\t') {
 928                         pos++;
 929                 }
 930
 931                 if (*pos == '\0') {
 932                         failed = 1;
 933                         break;
 934                 }
 935
 936                 entry = os_zalloc(sizeof(*entry));
 937                 if (entry == NULL) {
 938                         failed = 1;
 939                         break;
 940                 }
 941                 entry->shared_secret = os_strdup(pos);
 942                 if (entry->shared_secret == NULL) {
 943                         failed = 1;
 944                         os_free(entry);
 945                         break;
 946                 }
 947                 entry->shared_secret_len = os_strlen(entry->shared_secret);
 948                 entry->addr.s_addr = addr.s_addr;
 949                 if (!ipv6) {
 950                         val = 0;
 951                         for (i = 0; i < mask; i++)
 952                                 val |= 1 << (31 - i);
 953                         entry->mask.s_addr = htonl(val);
 954                 }
 955 #ifdef CONFIG_IPV6
 956                 if (ipv6) {
 957                         int offset = mask / 8;
 958
 959                         os_memcpy(entry->addr6.s6_addr, addr6.s6_addr, 16);
 960                         os_memset(entry->mask6.s6_addr, 0xff, offset);
 961                         val = 0;
 962                         for (i = 0; i < (mask % 8); i++)
 963                                 val |= 1 << (7 - i);
 964                         if (offset < 16)
 965                                 entry->mask6.s6_addr[offset] = val;
 966                 }
 967 #endif /* CONFIG_IPV6 */
 968
 969                 if (tail == NULL) {
 970                         clients = tail = entry;
 971                 } else {
 972                         tail->next = entry;
 973                         tail = entry;
 974                 }
 975         }
 976
 977         if (failed) {
 978                 RADIUS_ERROR("Invalid line %d in '%s'", line, client_file);
 979                 radius_server_free_clients(NULL, clients);
 980                 clients = NULL;
 981         }
 982
 983         os_free(buf);
 984         fclose(f);
 985
 986         return clients;
 987 }
 988
 989
 990 struct radius_server_data *
 991 radius_server_init(struct radius_server_conf *conf)
 992 {
 993         struct radius_server_data *data;
 994
 995 #ifndef CONFIG_IPV6
 996         if (conf->ipv6) {
 997                 fprintf(stderr, "RADIUS server compiled without IPv6 "
 998                         "support.\n");
 999                 return NULL;
1000         }
1001 #endif /* CONFIG_IPV6 */
1002
1003         data = os_zalloc(sizeof(*data));
1004         if (data == NULL)
1005                 return NULL;
1006
1007         os_get_time(&data->start_time);
1008         data->conf_ctx = conf->conf_ctx;
1009         data->eap_sim_db_priv = conf->eap_sim_db_priv;
1010         data->ssl_ctx = conf->ssl_ctx;
1011         data->ipv6 = conf->ipv6;
1012         if (conf->pac_opaque_encr_key) {
1013                 data->pac_opaque_encr_key = os_malloc(16);
1014                 os_memcpy(data->pac_opaque_encr_key, conf->pac_opaque_encr_key,
1015                           16);
1016         }
1017         if (conf->eap_fast_a_id)
1018                 data->eap_fast_a_id = os_strdup(conf->eap_fast_a_id);
1019         data->get_eap_user = conf->get_eap_user;
1020         data->eap_sim_aka_result_ind = conf->eap_sim_aka_result_ind;
1021         data->tnc = conf->tnc;
1022
1023         data->clients = radius_server_read_clients(conf->client_file,
1024                                                    conf->ipv6);
1025         if (data->clients == NULL) {
1026                 printf("No RADIUS clients configured.\n");
1027                 radius_server_deinit(data);
1028                 return NULL;
1029         }
1030
1031 #ifdef CONFIG_IPV6
1032         if (conf->ipv6)
1033                 data->auth_sock = radius_server_open_socket6(conf->auth_port);
1034         else
1035 #endif /* CONFIG_IPV6 */
1036         data->auth_sock = radius_server_open_socket(conf->auth_port);
1037         if (data->auth_sock < 0) {
1038                 printf("Failed to open UDP socket for RADIUS authentication "
1039                        "server\n");
1040                 radius_server_deinit(data);
1041                 return NULL;
1042         }
1043         if (eloop_register_read_sock(data->auth_sock,
1044                                      radius_server_receive_auth,
1045                                      data, NULL)) {
1046                 radius_server_deinit(data);
1047                 return NULL;
1048         }
1049
1050         return data;
1051 }
1052
1053
1054 void radius_server_deinit(struct radius_server_data *data)
1055 {
1056         if (data == NULL)
1057                 return;
1058
1059         if (data->auth_sock >= 0) {
1060                 eloop_unregister_read_sock(data->auth_sock);
1061                 close(data->auth_sock);
1062         }
1063
1064         radius_server_free_clients(data, data->clients);
1065
1066         os_free(data->pac_opaque_encr_key);
1067         os_free(data->eap_fast_a_id);
1068         os_free(data);
1069 }
1070
1071
1072 int radius_server_get_mib(struct radius_server_data *data, char *buf,
1073                           size_t buflen)
1074 {
1075         int ret, uptime;
1076         unsigned int idx;
1077         char *end, *pos;
1078         struct os_time now;
1079         struct radius_client *cli;
1080
1081         /* RFC 2619 - RADIUS Authentication Server MIB */
1082
1083         if (data == NULL || buflen == 0)
1084                 return 0;
1085
1086         pos = buf;
1087         end = buf + buflen;
1088
1089         os_get_time(&now);
1090         uptime = (now.sec - data->start_time.sec) * 100 +
1091                 ((now.usec - data->start_time.usec) / 10000) % 100;
1092         ret = os_snprintf(pos, end - pos,
1093                           "RADIUS-AUTH-SERVER-MIB\n"
1094                           "radiusAuthServIdent=hostapd\n"
1095                           "radiusAuthServUpTime=%d\n"
1096                           "radiusAuthServResetTime=0\n"
1097                           "radiusAuthServConfigReset=4\n",
1098                           uptime);
1099         if (ret < 0 || ret >= end - pos) {
1100                 *pos = '\0';
1101                 return pos - buf;
1102         }
1103         pos += ret;
1104
1105         ret = os_snprintf(pos, end - pos,
1106                           "radiusAuthServTotalAccessRequests=%u\n"
1107                           "radiusAuthServTotalInvalidRequests=%u\n"
1108                           "radiusAuthServTotalDupAccessRequests=%u\n"
1109                           "radiusAuthServTotalAccessAccepts=%u\n"
1110                           "radiusAuthServTotalAccessRejects=%u\n"
1111                           "radiusAuthServTotalAccessChallenges=%u\n"
1112                           "radiusAuthServTotalMalformedAccessRequests=%u\n"
1113                           "radiusAuthServTotalBadAuthenticators=%u\n"
1114                           "radiusAuthServTotalPacketsDropped=%u\n"
1115                           "radiusAuthServTotalUnknownTypes=%u\n",
1116                           data->counters.access_requests,
1117                           data->counters.invalid_requests,
1118                           data->counters.dup_access_requests,
1119                           data->counters.access_accepts,
1120                           data->counters.access_rejects,
1121                           data->counters.access_challenges,
1122                           data->counters.malformed_access_requests,
1123                           data->counters.bad_authenticators,
1124                           data->counters.packets_dropped,
1125                           data->counters.unknown_types);
1126         if (ret < 0 || ret >= end - pos) {
1127                 *pos = '\0';
1128                 return pos - buf;
1129         }
1130         pos += ret;
1131
1132         for (cli = data->clients, idx = 0; cli; cli = cli->next, idx++) {
1133                 char abuf[50], mbuf[50];
1134 #ifdef CONFIG_IPV6
1135                 if (data->ipv6) {
1136                         if (inet_ntop(AF_INET6, &cli->addr6, abuf,
1137                                       sizeof(abuf)) == NULL)
1138                                 abuf[0] = '\0';
1139                         if (inet_ntop(AF_INET6, &cli->mask6, abuf,
1140                                       sizeof(mbuf)) == NULL)
1141                                 mbuf[0] = '\0';
1142                 }
1143 #endif /* CONFIG_IPV6 */
1144                 if (!data->ipv6) {
1145                         os_strlcpy(abuf, inet_ntoa(cli->addr), sizeof(abuf));
1146                         os_strlcpy(mbuf, inet_ntoa(cli->mask), sizeof(mbuf));
1147                 }
1148
1149                 ret = os_snprintf(pos, end - pos,
1150                                   "radiusAuthClientIndex=%u\n"
1151                                   "radiusAuthClientAddress=%s/%s\n"
1152                                   "radiusAuthServAccessRequests=%u\n"
1153                                   "radiusAuthServDupAccessRequests=%u\n"
1154                                   "radiusAuthServAccessAccepts=%u\n"
1155                                   "radiusAuthServAccessRejects=%u\n"
1156                                   "radiusAuthServAccessChallenges=%u\n"
1157                                   "radiusAuthServMalformedAccessRequests=%u\n"
1158                                   "radiusAuthServBadAuthenticators=%u\n"
1159                                   "radiusAuthServPacketsDropped=%u\n"
1160                                   "radiusAuthServUnknownTypes=%u\n",
1161                                   idx,
1162                                   abuf, mbuf,
1163                                   cli->counters.access_requests,
1164                                   cli->counters.dup_access_requests,
1165                                   cli->counters.access_accepts,
1166                                   cli->counters.access_rejects,
1167                                   cli->counters.access_challenges,
1168                                   cli->counters.malformed_access_requests,
1169                                   cli->counters.bad_authenticators,
1170                                   cli->counters.packets_dropped,
1171                                   cli->counters.unknown_types);
1172                 if (ret < 0 || ret >= end - pos) {
1173                         *pos = '\0';
1174                         return pos - buf;
1175                 }
1176                 pos += ret;
1177         }
1178
1179         return pos - buf;
1180 }
1181
1182
1183 static int radius_server_get_eap_user(void *ctx, const u8 *identity,
1184                                       size_t identity_len, int phase2,
1185                                       struct eap_user *user)
1186 {
1187         struct radius_session *sess = ctx;
1188         struct radius_server_data *data = sess->server;
1189
1190         return data->get_eap_user(data->conf_ctx, identity, identity_len,
1191                                   phase2, user);
1192 }
1193
1194
1195 static struct eapol_callbacks radius_server_eapol_cb =
1196 {
1197         .get_eap_user = radius_server_get_eap_user,
1198 };
1199
1200
1201 void radius_server_eap_pending_cb(struct radius_server_data *data, void *ctx)
1202 {
1203         struct radius_client *cli;
1204         struct radius_session *s, *sess = NULL;
1205         struct radius_msg *msg;
1206
1207         if (data == NULL)
1208                 return;
1209
1210         for (cli = data->clients; cli; cli = cli->next) {
1211                 for (s = cli->sessions; s; s = s->next) {
1212                         if (s->eap == ctx && s->last_msg) {
1213                                 sess = s;
1214                                 break;
1215                         }
1216                         if (sess)
1217                                 break;
1218                 }
1219                 if (sess)
1220                         break;
1221         }
1222
1223         if (sess == NULL) {
1224                 RADIUS_DEBUG("No session matched callback ctx");
1225                 return;
1226         }
1227
1228         msg = sess->last_msg;
1229         sess->last_msg = NULL;
1230         eap_sm_pending_cb(sess->eap);
1231         if (radius_server_request(data, msg,
1232                                   (struct sockaddr *) &sess->last_from,
1233                                   sess->last_fromlen, cli,
1234                                   sess->last_from_addr,
1235                                   sess->last_from_port, sess) == -2)
1236                 return; /* msg was stored with the session */
1237
1238         radius_msg_free(msg);
1239         os_free(msg);
1240 }