1 From: Felix Fietkau <nbd@nbd.name>
2 Date: Thu, 16 Mar 2023 11:35:50 +0100
3 Subject: [PATCH] hostapd: add experimental radius server
5 This can be used to run a standalone EAP server that can be used from
6 other APs. It uses json as user database format and can automatically
10 +++ b/hostapd/Makefile
11 @@ -63,6 +63,10 @@ endif
15 +ifdef CONFIG_RADIUS_SERVER
19 OBJS += ../src/ap/hostapd.o
20 OBJS += ../src/ap/wpa_auth_glue.o
21 OBJS += ../src/ap/drv_callbacks.o
24 @@ -40,6 +40,7 @@ struct hapd_global {
26 static struct hapd_global global;
28 +extern int radius_main(int argc, char **argv);
30 #ifndef CONFIG_NO_HOSTAPD_LOGGER
31 static void hostapd_logger_cb(void *ctx, const u8 *addr, unsigned int module,
32 @@ -793,6 +794,11 @@ int main(int argc, char *argv[])
33 if (os_program_init())
37 + if (strstr(argv[0], "radius"))
38 + return radius_main(argc, argv);
41 os_memset(&interfaces, 0, sizeof(interfaces));
42 interfaces.reload_config = hostapd_reload_config;
43 interfaces.config_read_cb = hostapd_config_read;
44 --- a/src/radius/radius_server.c
45 +++ b/src/radius/radius_server.c
46 @@ -63,6 +63,12 @@ struct radius_server_counters {
47 u32 unknown_acct_types;
50 +struct radius_accept_attr {
57 * struct radius_session - Internal RADIUS server data for a session
59 @@ -90,7 +96,7 @@ struct radius_session {
60 unsigned int macacl:1;
61 unsigned int t_c_filtering:1;
63 - struct hostapd_radius_attr *accept_attr;
64 + struct radius_accept_attr *accept_attr;
66 u32 t_c_timestamp; /* Last read T&C timestamp from user DB */
68 @@ -394,6 +400,7 @@ static void radius_server_session_free(s
69 radius_msg_free(sess->last_reply);
70 os_free(sess->username);
71 os_free(sess->nas_ip);
72 + os_free(sess->accept_attr);
76 @@ -554,6 +561,36 @@ radius_server_erp_find_key(struct radius
78 #endif /* CONFIG_ERP */
80 +static struct radius_accept_attr *
81 +radius_server_copy_attr(const struct hostapd_radius_attr *data)
83 + const struct hostapd_radius_attr *attr;
84 + struct radius_accept_attr *attr_new;
85 + size_t data_size = 0;
89 + for (attr = data; attr; attr = attr->next) {
91 + data_size += wpabuf_len(attr->val);
94 + attr_new = os_zalloc(n_attr * sizeof(*attr) + data_size);
98 + data_buf = &attr_new[n_attr];
99 + for (n_attr = 0, attr = data; attr; attr = attr->next) {
100 + struct radius_accept_attr *cur = &attr_new[n_attr++];
102 + cur->type = attr->type;
103 + cur->len = wpabuf_len(attr->val);
104 + cur->data = memcpy(data_buf, wpabuf_head(attr->val), cur->len);
105 + data_buf += cur->len;
111 static struct radius_session *
112 radius_server_get_new_session(struct radius_server_data *data,
113 @@ -607,7 +644,7 @@ radius_server_get_new_session(struct rad
117 - sess->accept_attr = tmp->accept_attr;
118 + sess->accept_attr = radius_server_copy_attr(tmp->accept_attr);
119 sess->macacl = tmp->macacl;
122 @@ -1123,11 +1160,10 @@ radius_server_encapsulate_eap(struct rad
125 if (code == RADIUS_CODE_ACCESS_ACCEPT) {
126 - struct hostapd_radius_attr *attr;
127 - for (attr = sess->accept_attr; attr; attr = attr->next) {
128 - if (!radius_msg_add_attr(msg, attr->type,
129 - wpabuf_head(attr->val),
130 - wpabuf_len(attr->val))) {
131 + struct radius_accept_attr *attr;
132 + for (attr = sess->accept_attr; attr->data; attr++) {
133 + if (!radius_msg_add_attr(msg, attr->type, attr->data,
135 wpa_printf(MSG_ERROR, "Could not add RADIUS attribute");
136 radius_msg_free(msg);
138 @@ -1221,11 +1257,10 @@ radius_server_macacl(struct radius_serve
141 if (code == RADIUS_CODE_ACCESS_ACCEPT) {
142 - struct hostapd_radius_attr *attr;
143 - for (attr = sess->accept_attr; attr; attr = attr->next) {
144 - if (!radius_msg_add_attr(msg, attr->type,
145 - wpabuf_head(attr->val),
146 - wpabuf_len(attr->val))) {
147 + struct radius_accept_attr *attr;
148 + for (attr = sess->accept_attr; attr->data; attr++) {
149 + if (!radius_msg_add_attr(msg, attr->type, attr->data,
151 wpa_printf(MSG_ERROR, "Could not add RADIUS attribute");
152 radius_msg_free(msg);
154 @@ -2527,7 +2562,7 @@ static int radius_server_get_eap_user(vo
155 ret = data->get_eap_user(data->conf_ctx, identity, identity_len,
157 if (ret == 0 && user) {
158 - sess->accept_attr = user->accept_attr;
159 + sess->accept_attr = radius_server_copy_attr(user->accept_attr);
160 sess->remediation = user->remediation;
161 sess->macacl = user->macacl;
162 sess->t_c_timestamp = user->t_c_timestamp;