From patchwork Wed May 30 21:09:01 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nils Nieuwejaar X-Patchwork-Id: 923029 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:e::133; helo=bombadil.infradead.org; envelope-from=hostap-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="hrBr6qQ7"; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="RmOYAJTx"; dkim-atps=neutral Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:e::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 40x3BT0pL3z9s08 for ; Thu, 31 May 2018 07:09:37 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=R/dQaxncP4X5zrtuhFXvt/sbM0VkraRHc3l7yqJ5JCs=; b=hrB r6qQ7en/K5hTDM9XPdbEBHOkZgbIfDZ9OwWJ5KqL30YezuARD69VIKEjOyrJKsu2globfs29DYYXx 3kiQ2nmQjz/ciZZ2pTtikJJIfeViT/WSdSii0vuuoSu4NmKxvcKWresd0p8G6l5Yt1Xld3NRR/sGI 2Y6xaLlUQvLB79GsdgbvMEBbwQV4HhUkuzXPToMWKBpD4Jbv1dlIXNgQQMNCM6QfyZLWA25LXxuGx EUf/aRPLc6T18QxRzFObRhSsTVd9GRfpb0vLtDeS+RzWQkNtQBoKRJ80cgvcKiGUSBGRDPq6HBN+i YromutBMhZNTIiPuqF3wAv48Fgk41Wg==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1fO8LT-0004LB-6Y; Wed, 30 May 2018 21:09:23 +0000 Received: from mail-pl0-x229.google.com ([2607:f8b0:400e:c01::229]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1fO8LM-0004HP-Si for hostap@lists.infradead.org; Wed, 30 May 2018 21:09:18 +0000 Received: by mail-pl0-x229.google.com with SMTP id c23-v6so525651plz.12 for ; Wed, 30 May 2018 14:09:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=1yta+GPeV+AOeN2tcYgPAnVbc1u8y6d5/f68/kR1CPk=; b=RmOYAJTxo0MRyVW1x3DzcWqqEg0bVxveGjoDdYBbiAHYvTplQWtVCpEVKAse5bvxdK Hz9y/0DGJABxq+xdcWA85GBRHmOarArWOuxEnWJBX35kNWU7B1br+d8y4poM2ujggbQ2 kGey8No0Ji+424b4TZ88MMwvYDN6MpcDzpOLqdecDQWrRqa6Rub1RDQxHF3QCh5z2cZg maKOe4r5MAJNl4C1D7fLgEQmDIXTv7CPbyMCd0x1ilnw5cp6/xb5Qplg+kyWGSqLUZXz KcKTiIA90ef/1j/PR9ioiP5dPeHOrXSPqgPelvSuqXGlfZKorBc8M2V7dYTFKCLAqckN hXRw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=1yta+GPeV+AOeN2tcYgPAnVbc1u8y6d5/f68/kR1CPk=; b=PNh8I8Jyve6CP2JCv3oUvefLd5WPt1xmZ3mF6m+hCkg8TN3oHgUGEjcuFQvKsk6GVi 00/6h52LaUk99Qenxw7Bpbcj06fOSjN46gAX8RZe8xg8O1FjXX2x9geAER/Ag5+OAZRV +xTBybvPTeGQWa0SWLu8gtR9pMk7u9MndYSVHF29JMElP6v2SYjlLca8g9H/0WAbTSgf cioNnjEjZE0AJQWBgqHSbaEimemcv7HG9Of/kS0Hi8vz0oivMFhz4WOSNLyVyt2aKe8s eqSYBLFUemtQuieCLlCSGaVeGjK40j9gXHh3rvDYVIZ/ivzdEibyyCcH0tt9ihcQaIWM IVJg== X-Gm-Message-State: ALKqPwfEod68HYpLZsXJrWoD2n2eQa+S4WdFRUl8wx/F9stEzt/pe5yh xyIlPhKFzV0mdZuS/0KcMagIQMQh X-Google-Smtp-Source: ADUXVKJc0Htwbp/eHY/8BIIBYx9PRTBeWQZK5eU7PLcY6NeiFf31Qs5W0142/iYcpESw7KR6vSgOVw== X-Received: by 2002:a17:902:7209:: with SMTP id ba9-v6mr4380692plb.119.1527714545435; Wed, 30 May 2018 14:09:05 -0700 (PDT) Received: from moosew.7410.brightgate.net (c-24-130-129-211.hsd1.ca.comcast.net. [24.130.129.211]) by smtp.gmail.com with ESMTPSA id n10-v6sm81506655pfk.145.2018.05.30.14.09.04 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 30 May 2018 14:09:04 -0700 (PDT) From: Nils Nieuwejaar To: hostap@lists.infradead.org Subject: [PATCH RESEND] Allow remote RADIUS authentication with local VLAN management Date: Wed, 30 May 2018 14:09:01 -0700 Message-Id: <20180530210901.84865-1-nils.nieuwejaar@gmail.com> X-Mailer: git-send-email 2.15.1 (Apple Git-101) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180530_140916_949671_12E9C15B X-CRM114-Status: GOOD ( 17.26 ) X-Spam-Score: -0.1 (/) X-Spam-Report: SpamAssassin version 3.4.1 on bombadil.infradead.org summary: Content analysis details: (-0.1 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [2607:f8b0:400e:c01:0:0:0:229 listed in] [list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (nils.nieuwejaar[at]gmail.com) -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature X-BeenThere: hostap@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Nils Nieuwejaar MIME-Version: 1.0 Sender: "Hostap" Errors-To: hostap-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org ( This is a resubmission of a patch I first sent last month. Jouni asked for some formatting changes. ) If dynamic_vlan=0 (disabled), then vlan assignments will be managed using the local accept_mac_file ACL file, even if a RADIUS server is being used for user authentication. This allows us to manage users and devices independently. Signed-off-by: Nils Nieuwejaar --- hostapd/hostapd.conf | 2 +- src/ap/ieee802_11_auth.c | 17 +++++---- src/ap/ieee802_1x.c | 90 +++++++++++++++++++++++++----------------------- src/ap/sta_info.c | 3 -- 4 files changed, 58 insertions(+), 54 deletions(-) diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf index 220625651..7f13b147d 100644 --- a/hostapd/hostapd.conf +++ b/hostapd/hostapd.conf @@ -1104,7 +1104,7 @@ own_ip_addr=127.0.0.1 # Tunnel-Medium-Type (value 6 = IEEE 802), Tunnel-Private-Group-ID (value # VLANID as a string). Optionally, the local MAC ACL list (accept_mac_file) can # be used to set static client MAC address to VLAN ID mapping. -# 0 = disabled (default) +# 0 = disabled (default); only VLAN IDs from accept_mac_file will be used # 1 = option; use default interface if RADIUS server does not include VLAN ID # 2 = required; reject authentication if RADIUS server does not include VLAN ID #dynamic_vlan=0 diff --git a/src/ap/ieee802_11_auth.c b/src/ap/ieee802_11_auth.c index 5cb7fb145..b2ea12c3a 100644 --- a/src/ap/ieee802_11_auth.c +++ b/src/ap/ieee802_11_auth.c @@ -289,6 +289,9 @@ int hostapd_allowed_address(struct hostapd_data *hapd, const u8 *addr, return HOSTAPD_ACL_ACCEPT; }; + if (hapd->conf->ssid.dynamic_vlan == DYNAMIC_VLAN_DISABLED) + vlan_id = NULL; + /* Check whether ACL cache has an entry for this station */ res = hostapd_acl_cache_get(hapd, addr, session_timeout, acct_interim_interval, vlan_id, psk, @@ -574,12 +577,14 @@ hostapd_acl_recv_radius(struct radius_msg *msg, struct radius_msg *req, cache->acct_interim_interval = 0; } - notempty = &cache->vlan_id.notempty; - untagged = &cache->vlan_id.untagged; - tagged = cache->vlan_id.tagged; - *notempty = !!radius_msg_get_vlanid(msg, untagged, - MAX_NUM_TAGGED_VLAN, - tagged); + if (hapd->conf->ssid.dynamic_vlan != DYNAMIC_VLAN_DISABLED) { + notempty = &cache->vlan_id.notempty; + untagged = &cache->vlan_id.untagged; + tagged = cache->vlan_id.tagged; + *notempty = !!radius_msg_get_vlanid(msg, untagged, + MAX_NUM_TAGGED_VLAN, + tagged); + } decode_tunnel_passwords(hapd, shared_secret, shared_secret_len, msg, req, cache); diff --git a/src/ap/ieee802_1x.c b/src/ap/ieee802_1x.c index 4fcccce72..ffff58d55 100644 --- a/src/ap/ieee802_1x.c +++ b/src/ap/ieee802_1x.c @@ -1683,6 +1683,49 @@ ieee802_1x_search_radius_identifier(struct hostapd_data *hapd, u8 identifier) } +#ifndef CONFIG_NO_VLAN +static int +ieee802_1x_update_vlan(struct radius_msg *msg, + struct hostapd_data *hapd, + struct sta_info *sta) +{ + struct vlan_description vlan_desc; + int *untagged, *tagged, *notempty; + + os_memset(&vlan_desc, 0, sizeof(vlan_desc)); + notempty = &vlan_desc.notempty; + untagged = &vlan_desc.untagged; + tagged = vlan_desc.tagged; + *notempty = !!radius_msg_get_vlanid(msg, untagged, MAX_NUM_TAGGED_VLAN, + tagged); + + if (vlan_desc.notempty && + !hostapd_vlan_valid(hapd->conf->vlan, &vlan_desc)) { + sta->eapol_sm->authFail = TRUE; + hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS, + HOSTAPD_LEVEL_INFO, + "Invalid VLAN %d%s received from RADIUS server", + vlan_desc.untagged, + vlan_desc.tagged[0] ? "+" : ""); + os_memset(&vlan_desc, 0, sizeof(vlan_desc)); + ap_sta_set_vlan(hapd, sta, &vlan_desc); + return -1; + } + + if (hapd->conf->ssid.dynamic_vlan == DYNAMIC_VLAN_REQUIRED && + !vlan_desc.notempty) { + sta->eapol_sm->authFail = TRUE; + hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X, + HOSTAPD_LEVEL_INFO, "authentication server did " + "not include required VLAN ID in Access-Accept"); + return -1; + } + + return (ap_sta_set_vlan(hapd, sta, &vlan_desc)); +} +#endif /* CONFIG_NO_VLAN */ + + /** * ieee802_1x_receive_auth - Process RADIUS frames from Authentication Server * @msg: RADIUS response message @@ -1705,12 +1748,6 @@ ieee802_1x_receive_auth(struct radius_msg *msg, struct radius_msg *req, struct eapol_state_machine *sm; int override_eapReq = 0; struct radius_hdr *hdr = radius_msg_get_hdr(msg); - struct vlan_description vlan_desc; -#ifndef CONFIG_NO_VLAN - int *untagged, *tagged, *notempty; -#endif /* CONFIG_NO_VLAN */ - - os_memset(&vlan_desc, 0, sizeof(vlan_desc)); sm = ieee802_1x_search_radius_identifier(hapd, hdr->identifier); if (sm == NULL) { @@ -1775,56 +1812,21 @@ ieee802_1x_receive_auth(struct radius_msg *msg, struct radius_msg *req, switch (hdr->code) { case RADIUS_CODE_ACCESS_ACCEPT: #ifndef CONFIG_NO_VLAN - if (hapd->conf->ssid.dynamic_vlan != DYNAMIC_VLAN_DISABLED) { - notempty = &vlan_desc.notempty; - untagged = &vlan_desc.untagged; - tagged = vlan_desc.tagged; - *notempty = !!radius_msg_get_vlanid(msg, untagged, - MAX_NUM_TAGGED_VLAN, - tagged); - } - - if (vlan_desc.notempty && - !hostapd_vlan_valid(hapd->conf->vlan, &vlan_desc)) { - sta->eapol_sm->authFail = TRUE; - hostapd_logger(hapd, sta->addr, - HOSTAPD_MODULE_RADIUS, - HOSTAPD_LEVEL_INFO, - "Invalid VLAN %d%s received from RADIUS server", - vlan_desc.untagged, - vlan_desc.tagged[0] ? "+" : ""); - os_memset(&vlan_desc, 0, sizeof(vlan_desc)); - ap_sta_set_vlan(hapd, sta, &vlan_desc); - break; - } - - if (hapd->conf->ssid.dynamic_vlan == DYNAMIC_VLAN_REQUIRED && - !vlan_desc.notempty) { - sta->eapol_sm->authFail = TRUE; - hostapd_logger(hapd, sta->addr, - HOSTAPD_MODULE_IEEE8021X, - HOSTAPD_LEVEL_INFO, "authentication " - "server did not include required VLAN " - "ID in Access-Accept"); - break; - } -#endif /* CONFIG_NO_VLAN */ - - if (ap_sta_set_vlan(hapd, sta, &vlan_desc) < 0) + if (hapd->conf->ssid.dynamic_vlan != DYNAMIC_VLAN_DISABLED && + ieee802_1x_update_vlan(msg, hapd, sta) < 0) break; -#ifndef CONFIG_NO_VLAN if (sta->vlan_id > 0) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS, HOSTAPD_LEVEL_INFO, "VLAN ID %d", sta->vlan_id); } -#endif /* CONFIG_NO_VLAN */ if ((sta->flags & WLAN_STA_ASSOC) && ap_sta_bind_vlan(hapd, sta) < 0) break; +#endif /* CONFIG_NO_VLAN */ sta->session_timeout_set = !!session_timeout_set; os_get_reltime(&sta->session_timeout); diff --git a/src/ap/sta_info.c b/src/ap/sta_info.c index cb9be2832..94833ee1e 100644 --- a/src/ap/sta_info.c +++ b/src/ap/sta_info.c @@ -893,9 +893,6 @@ int ap_sta_set_vlan(struct hostapd_data *hapd, struct sta_info *sta, struct hostapd_vlan *vlan = NULL, *wildcard_vlan = NULL; int old_vlan_id, vlan_id = 0, ret = 0; - if (hapd->conf->ssid.dynamic_vlan == DYNAMIC_VLAN_DISABLED) - vlan_desc = NULL; - /* Check if there is something to do */ if (hapd->conf->ssid.per_sta_vif && !sta->vlan_id) { /* This sta is lacking its own vif */