eap_example/eap_example_server.c

   1 /*
   2  * Example application showing how EAP server code from hostapd can be used as
   3  * a library.
   4  * Copyright (c) 2007, Jouni Malinen <j@w1.fi>
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 as
   8  * published by the Free Software Foundation.
   9  *
  10  * Alternatively, this software may be distributed under the terms of BSD
  11  * license.
  12  *
  13  * See README and COPYING for more details.
  14  */
  15
  16 #include "includes.h"
  17
  18 #include "common.h"
  19 #include "crypto/tls.h"
  20 #include "eap_server/eap.h"
  21 #include "wpabuf.h"
  22
  23 void eap_example_peer_rx(const u8 *data, size_t data_len);
  24
  25
  26 struct eap_server_ctx {
  27         struct eap_eapol_interface *eap_if;
  28         struct eap_sm *eap;
  29         void *tls_ctx;
  30 };
  31
  32 static struct eap_server_ctx eap_ctx;
  33
  34
  35 static int server_get_eap_user(void *ctx, const u8 *identity,
  36                                size_t identity_len, int phase2,
  37                                struct eap_user *user)
  38 {
  39         os_memset(user, 0, sizeof(*user));
  40
  41         if (!phase2) {
  42                 /* Only allow EAP-PEAP as the Phase 1 method */
  43                 user->methods[0].vendor = EAP_VENDOR_IETF;
  44                 user->methods[0].method = EAP_TYPE_PEAP;
  45                 return 0;
  46         }
  47
  48         if (identity_len != 4 || identity == NULL ||
  49             os_memcmp(identity, "user", 4) != 0) {
  50                 printf("Unknown user\n");
  51                 return -1;
  52         }
  53
  54         /* Only allow EAP-MSCHAPv2 as the Phase 2 method */
  55         user->methods[0].vendor = EAP_VENDOR_IETF;
  56         user->methods[0].method = EAP_TYPE_MSCHAPV2;
  57         user->password = (u8 *) os_strdup("password");
  58         user->password_len = 8;
  59
  60         return 0;
  61 }
  62
  63
  64 static const char * server_get_eap_req_id_text(void *ctx, size_t *len)
  65 {
  66         *len = 0;
  67         return NULL;
  68 }
  69
  70
  71 static struct eapol_callbacks eap_cb;
  72 static struct eap_config eap_conf;
  73
  74 static int eap_example_server_init_tls(void)
  75 {
  76         struct tls_config tconf;
  77         struct tls_connection_params tparams;
  78
  79         os_memset(&tconf, 0, sizeof(tconf));
  80         eap_ctx.tls_ctx = tls_init(&tconf);
  81         if (eap_ctx.tls_ctx == NULL)
  82                 return -1;
  83
  84         os_memset(&tparams, 0, sizeof(tparams));
  85         tparams.ca_cert = "ca.pem";
  86         tparams.client_cert = "server.pem";
  87         /* tparams.private_key = "server.key"; */
  88         tparams.private_key = "server-key.pem";
  89         /* tparams.private_key_passwd = "whatever"; */
  90
  91         if (tls_global_set_params(eap_ctx.tls_ctx, &tparams)) {
  92                 printf("Failed to set TLS parameters\n");
  93                 return -1;
  94         }
  95
  96         if (tls_global_set_verify(eap_ctx.tls_ctx, 0)) {
  97                 printf("Failed to set check_crl\n");
  98                 return -1;
  99         }
 100
 101         return 0;
 102 }
 103
 104
 105 static int eap_server_register_methods(void)
 106 {
 107         int ret = 0;
 108
 109 #ifdef EAP_SERVER_IDENTITY
 110         if (ret == 0)
 111                 ret = eap_server_identity_register();
 112 #endif /* EAP_SERVER_IDENTITY */
 113
 114 #ifdef EAP_SERVER_MD5
 115         if (ret == 0)
 116                 ret = eap_server_md5_register();
 117 #endif /* EAP_SERVER_MD5 */
 118
 119 #ifdef EAP_SERVER_TLS
 120         if (ret == 0)
 121                 ret = eap_server_tls_register();
 122 #endif /* EAP_SERVER_TLS */
 123
 124 #ifdef EAP_SERVER_MSCHAPV2
 125         if (ret == 0)
 126                 ret = eap_server_mschapv2_register();
 127 #endif /* EAP_SERVER_MSCHAPV2 */
 128
 129 #ifdef EAP_SERVER_PEAP
 130         if (ret == 0)
 131                 ret = eap_server_peap_register();
 132 #endif /* EAP_SERVER_PEAP */
 133
 134 #ifdef EAP_SERVER_TLV
 135         if (ret == 0)
 136                 ret = eap_server_tlv_register();
 137 #endif /* EAP_SERVER_TLV */
 138
 139 #ifdef EAP_SERVER_GTC
 140         if (ret == 0)
 141                 ret = eap_server_gtc_register();
 142 #endif /* EAP_SERVER_GTC */
 143
 144 #ifdef EAP_SERVER_TTLS
 145         if (ret == 0)
 146                 ret = eap_server_ttls_register();
 147 #endif /* EAP_SERVER_TTLS */
 148
 149 #ifdef EAP_SERVER_SIM
 150         if (ret == 0)
 151                 ret = eap_server_sim_register();
 152 #endif /* EAP_SERVER_SIM */
 153
 154 #ifdef EAP_SERVER_AKA
 155         if (ret == 0)
 156                 ret = eap_server_aka_register();
 157 #endif /* EAP_SERVER_AKA */
 158
 159 #ifdef EAP_SERVER_AKA_PRIME
 160         if (ret == 0)
 161                 ret = eap_server_aka_prime_register();
 162 #endif /* EAP_SERVER_AKA_PRIME */
 163
 164 #ifdef EAP_SERVER_PAX
 165         if (ret == 0)
 166                 ret = eap_server_pax_register();
 167 #endif /* EAP_SERVER_PAX */
 168
 169 #ifdef EAP_SERVER_PSK
 170         if (ret == 0)
 171                 ret = eap_server_psk_register();
 172 #endif /* EAP_SERVER_PSK */
 173
 174 #ifdef EAP_SERVER_SAKE
 175         if (ret == 0)
 176                 ret = eap_server_sake_register();
 177 #endif /* EAP_SERVER_SAKE */
 178
 179 #ifdef EAP_SERVER_GPSK
 180         if (ret == 0)
 181                 ret = eap_server_gpsk_register();
 182 #endif /* EAP_SERVER_GPSK */
 183
 184 #ifdef EAP_SERVER_VENDOR_TEST
 185         if (ret == 0)
 186                 ret = eap_server_vendor_test_register();
 187 #endif /* EAP_SERVER_VENDOR_TEST */
 188
 189 #ifdef EAP_SERVER_FAST
 190         if (ret == 0)
 191                 ret = eap_server_fast_register();
 192 #endif /* EAP_SERVER_FAST */
 193
 194 #ifdef EAP_SERVER_WSC
 195         if (ret == 0)
 196                 ret = eap_server_wsc_register();
 197 #endif /* EAP_SERVER_WSC */
 198
 199 #ifdef EAP_SERVER_IKEV2
 200         if (ret == 0)
 201                 ret = eap_server_ikev2_register();
 202 #endif /* EAP_SERVER_IKEV2 */
 203
 204 #ifdef EAP_SERVER_TNC
 205         if (ret == 0)
 206                 ret = eap_server_tnc_register();
 207 #endif /* EAP_SERVER_TNC */
 208
 209         return ret;
 210 }
 211
 212
 213 int eap_example_server_init(void)
 214 {
 215         if (eap_server_register_methods() < 0)
 216                 return -1;
 217
 218         os_memset(&eap_ctx, 0, sizeof(eap_ctx));
 219
 220         if (eap_example_server_init_tls() < 0)
 221                 return -1;
 222
 223         os_memset(&eap_cb, 0, sizeof(eap_cb));
 224         eap_cb.get_eap_user = server_get_eap_user;
 225         eap_cb.get_eap_req_id_text = server_get_eap_req_id_text;
 226
 227         os_memset(&eap_conf, 0, sizeof(eap_conf));
 228         eap_conf.eap_server = 1;
 229         eap_conf.ssl_ctx = eap_ctx.tls_ctx;
 230
 231         eap_ctx.eap = eap_server_sm_init(&eap_ctx, &eap_cb, &eap_conf);
 232         if (eap_ctx.eap == NULL)
 233                 return -1;
 234
 235         eap_ctx.eap_if = eap_get_interface(eap_ctx.eap);
 236
 237         /* Enable "port" and request EAP to start authentication. */
 238         eap_ctx.eap_if->portEnabled = TRUE;
 239         eap_ctx.eap_if->eapRestart = TRUE;
 240
 241         return 0;
 242 }
 243
 244
 245 void eap_example_server_deinit(void)
 246 {
 247         eap_server_sm_deinit(eap_ctx.eap);
 248         eap_server_unregister_methods();
 249         tls_deinit(eap_ctx.tls_ctx);
 250 }
 251
 252
 253 int eap_example_server_step(void)
 254 {
 255         int res, process = 0;
 256
 257         res = eap_server_sm_step(eap_ctx.eap);
 258
 259         if (eap_ctx.eap_if->eapReq) {
 260                 printf("==> Request\n");
 261                 process = 1;
 262                 eap_ctx.eap_if->eapReq = 0;
 263         }
 264
 265         if (eap_ctx.eap_if->eapSuccess) {
 266                 printf("==> Success\n");
 267                 process = 1;
 268                 res = 0;
 269                 eap_ctx.eap_if->eapSuccess = 0;
 270
 271                 if (eap_ctx.eap_if->eapKeyAvailable) {
 272                         wpa_hexdump(MSG_DEBUG, "EAP keying material",
 273                                     eap_ctx.eap_if->eapKeyData,
 274                                     eap_ctx.eap_if->eapKeyDataLen);
 275                 }
 276         }
 277
 278         if (eap_ctx.eap_if->eapFail) {
 279                 printf("==> Fail\n");
 280                 process = 1;
 281                 eap_ctx.eap_if->eapFail = 0;
 282         }
 283
 284         if (process && eap_ctx.eap_if->eapReqData) {
 285                 /* Send EAP response to the server */
 286                 eap_example_peer_rx(wpabuf_head(eap_ctx.eap_if->eapReqData),
 287                                     wpabuf_len(eap_ctx.eap_if->eapReqData));
 288         }
 289
 290         return res;
 291 }
 292
 293
 294 void eap_example_server_rx(const u8 *data, size_t data_len)
 295 {
 296         /* Make received EAP message available to the EAP library */
 297         wpabuf_free(eap_ctx.eap_if->eapRespData);
 298         eap_ctx.eap_if->eapRespData = wpabuf_alloc_copy(data, data_len);
 299         if (eap_ctx.eap_if->eapRespData)
 300                 eap_ctx.eap_if->eapResp = TRUE;
 301 }