[PATCH v2] Define a new config option, nas-identifier-use-bssid

Nick Lowe nick.lowe at lugatech.com
Sun Feb 28 06:34:55 PST 2016


Corrects commit message to include example forms of NAS-Identifier.

Defines a new config option, nas-identifier-use-bssid to include the
BSSID in the NAS-Identifier attribute value of RADIUS packets. This
value defaults to 0, maintaining backwards compatibility, and is set
to the value 1 in the supplied hostapd.conf

This new configuration option works in combination with the
nas-identifier option.

Where the nas-identifier is unset, the default in hostapd.conf, the
BSSID will be used to populate this value in the form
“00-10-A4-23-19-C0” in all cases, irrespective of the value of
nas-identifier-use-bssid.
Omitting the NAS-Identifier in RADIUS packets causes significant
problems in the RADIUS protocol so this is not allowed to ever occur.
(Accounting-On and Accounting-Off forms of RADIUS accounting packets
are allowed to be sent in this case.)

Where the nas-identifier is set and the nas-identifier-use-bssid is
set to 1, the BSSID will be included in the value used for the
NAS-Identifier in the form “00-10-A4-23-19-C0:ap.example.com”.
(Accounting-On and Accounting-Off forms of RADIUS accounting packets
are allowed to be sent in this case.)

Where the nas-identifier is set and the nas-identifier-use-bssid is
set to 0, the BSSID will not be included in the value used for the
NAS-Identifier.
(Accounting-On and Accounting-Off forms of RADIUS accounting packets
will not be sent in this case.)

Range checks for nas-identifier now require this string value to be,
inclusive, between 3 and 104 characters in length.

Signed-off-by: Nick Lowe <nick.lowe at lugatech.com>
---
 hostapd/config_file.c  | 13 +++++++++++--
 hostapd/hostapd.conf   | 24 ++++++++++++++++++++----
 src/ap/accounting.c    |  3 ++-
 src/ap/ap_config.c     |  8 ++++----
 src/ap/ap_config.h     |  4 +++-
 src/ap/hostapd.c       | 40 ++++++++++++++++++++++++++++++++--------
 src/ap/ieee802_1x.c    | 35 ++++++++++++++++++++++++++++-------
 src/ap/wpa_auth_glue.c |  6 +++---
 8 files changed, 103 insertions(+), 30 deletions(-)

diff --git a/hostapd/config_file.c b/hostapd/config_file.c
index 76f02ca..edb500d 100644
--- a/hostapd/config_file.c
+++ b/hostapd/config_file.c
@@ -2282,9 +2282,18 @@ static int hostapd_config_fill(struct
hostapd_config *conf,
             return 1;
         }
     } else if (os_strcmp(buf, "nas_identifier") == 0) {
-        os_free(bss->nas_identifier);
-        bss->nas_identifier = os_strdup(pos);
+        os_free(bss->nas_identifier_base);
+        bss->nas_identifier_base = os_strdup(pos);
+        bss->nas_identifier_base_len = os_strlen(bss->nas_identifier_base);
+        if (bss->nas_identifier_base_len < 3 ||
bss->nas_identifier_base_len > 104) {
+            wpa_printf(MSG_ERROR, "Line %d: invalid nas_identifier len %lu",
+                   line,
+                   (unsigned long) bss->nas_identifier_base_len);
+            return 1;
+        }
 #ifndef CONFIG_NO_RADIUS
+    } else if (os_strcmp(buf, "nas_identifier_use_bssid") == 0) {
+        bss->nas_identifier_use_bssid = atoi(pos);
     } else if (os_strcmp(buf, "radius_client_addr") == 0) {
         if (hostapd_parse_ip_addr(pos, &bss->radius->client_addr)) {
             wpa_printf(MSG_ERROR,
diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
index d535eec..c780a47 100644
--- a/hostapd/hostapd.conf
+++ b/hostapd/hostapd.conf
@@ -909,13 +909,29 @@ eap_server=0
 # The own IP address of the access point (used as NAS-IP-Address)
 own_ip_addr=127.0.0.1

-# Optional NAS-Identifier string for RADIUS messages. When used, this should be
-# a unique to the NAS within the scope of the RADIUS server. For example, a
-# fully qualified domain name can be used here.
-# When using IEEE 802.11r, nas_identifier must be set and must be between 1 and
+# Optional NAS-Identifier, containing a string value used to identify the NAS
+# originating RADIUS packets.  This must be unique to the NAS within the
+# scope of a RADIUS server.  For example, a fully qualified domain name can be
+# used here appended with the .
+# Where nas_identifier has not been set, the BSSID will used.
+# This will be of the form "00-10-A4-23-19-C0".
+# When using IEEE 802.11r, nas_identifier must be set and be between 1 and
 # 48 octets long.
 #nas_identifier=ap.example.com

+# Whether to use the BSSID in the NAS-Identifier sent in RADIUS packets.
+# For example, where the nas_identifier is configured as ap.example.com, a
+# value of the form "00-10-A4-23-19-C0:ap.example.com" will be used.
+# Where mutiple BSSes are offered by a NAS, each BSS for which RADIUS
accounting
+# is occuring must be presented as being an individual NAS for
Accounting-On and
+# Accounting-Off to be handled correctly by a RADIUS server.
+# This option has no effect where the nas_identifier has not been set.
+# Where this is the case, the BSSID will always be sent.
+# This will be of the form "00-10-A4-23-19-C0".
+# 0 = disabled (default, for backwards compatiblity)
+# 1 = enabled (best practice)
+nas_identifier_use_bssid=1
+
 # RADIUS client forced local IP address for the access point
 # Normally the local IP address is determined automatically based on configured
 # IP addresses, but this field can be used to force a specific address to be
diff --git a/src/ap/accounting.c b/src/ap/accounting.c
index 9357a46..e13f94b 100644
--- a/src/ap/accounting.c
+++ b/src/ap/accounting.c
@@ -424,7 +424,8 @@ static void accounting_report_state(struct
hostapd_data *hapd, int on)
 {
     struct radius_msg *msg;

-    if (!hapd->conf->radius->acct_server || hapd->radius == NULL)
+    if (!hapd->conf->radius->acct_server || hapd->radius == NULL ||
+            (hapd->conf->nas_identifier_use_bssid != 1 &&
hapd->conf->nas_identifier_base))
         return;

     /* Inform RADIUS server that accounting will start/stop so that the
diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
index 458faa4..62d74db 100644
--- a/src/ap/ap_config.c
+++ b/src/ap/ap_config.c
@@ -455,7 +455,7 @@ void hostapd_config_free_bss(struct
hostapd_bss_config *conf)
     os_free(conf->erp_domain);
     os_free(conf->accept_mac);
     os_free(conf->deny_mac);
-    os_free(conf->nas_identifier);
+    os_free(conf->nas_identifier_base);
     if (conf->radius) {
         hostapd_config_free_radius(conf->radius->auth_servers,
                        conf->radius->num_auth_servers);
@@ -808,9 +808,9 @@ static int hostapd_config_check_bss(struct
hostapd_bss_config *bss,

 #ifdef CONFIG_IEEE80211R
     if (full_config && wpa_key_mgmt_ft(bss->wpa_key_mgmt) &&
-        (bss->nas_identifier == NULL ||
-         os_strlen(bss->nas_identifier) < 1 ||
-         os_strlen(bss->nas_identifier) > FT_R0KH_ID_MAX_LEN)) {
+        (bss->nas_identifier_base == NULL ||
+         os_strlen(bss->nas_identifier_base) < 1 ||
+         os_strlen(bss->nas_identifier_base) > FT_R0KH_ID_MAX_LEN)) {
         wpa_printf(MSG_ERROR, "FT (IEEE 802.11r) requires "
                "nas_identifier to be configured as a 1..48 octet "
                "string");
diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
index 763eaaa..9f6118d 100644
--- a/src/ap/ap_config.h
+++ b/src/ap/ap_config.h
@@ -245,7 +245,9 @@ struct hostapd_bss_config {
     unsigned int eap_sim_db_timeout;
     int eap_server_erp; /* Whether ERP is enabled on internal EAP server */
     struct hostapd_ip_addr own_ip_addr;
-    char *nas_identifier;
+    char *nas_identifier_base;
+    size_t nas_identifier_base_len;
+    int nas_identifier_use_bssid;
     struct hostapd_radius_servers *radius;
     int acct_interim_interval;
     int radius_request_cui;
diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
index dd2dc17..834464a 100644
--- a/src/ap/hostapd.c
+++ b/src/ap/hostapd.c
@@ -608,14 +608,38 @@ static int mac_in_conf(struct hostapd_config
*conf, const void *a)
 static int hostapd_das_nas_mismatch(struct hostapd_data *hapd,
                     struct radius_das_attrs *attr)
 {
-    if (attr->nas_identifier &&
-        (!hapd->conf->nas_identifier ||
-         os_strlen(hapd->conf->nas_identifier) !=
-         attr->nas_identifier_len ||
-         os_memcmp(hapd->conf->nas_identifier, attr->nas_identifier,
-               attr->nas_identifier_len) != 0)) {
-        wpa_printf(MSG_DEBUG, "RADIUS DAS: NAS-Identifier mismatch");
-        return 1;
+    char buf[128];
+    int len;
+
+    if (attr->nas_identifier) {
+        if (hapd->conf->nas_identifier_base) {
+            if (hapd->conf->nas_identifier_use_bssid == 1) {
+                len = os_snprintf(buf, sizeof(buf),
+                    RADIUS_802_1X_ADDR_FORMAT ":",
+                    MAC2STR(hapd->own_addr));
+                os_memcpy(&buf[len],
+                    hapd->conf->nas_identifier_base,
+                    hapd->conf->nas_identifier_base_len);
+                len += hapd->conf->nas_identifier_base_len;
+            }
+            else {
+                os_memcpy(&buf[0],
+                    hapd->conf->nas_identifier_base,
+                    hapd->conf->nas_identifier_base_len);
+                len = hapd->conf->nas_identifier_base_len;
+            }
+        }
+        else
+            len = os_snprintf(buf, sizeof(buf),
+                RADIUS_802_1X_ADDR_FORMAT,
+                MAC2STR(hapd->own_addr));
+
+        if (len != attr->nas_identifier_len ||
+                os_memcmp(buf, attr->nas_identifier,
+                len) != 0) {
+            wpa_printf(MSG_DEBUG, "RADIUS DAS: NAS-Identifier mismatch");
+            return 1;
+        }
     }

     if (attr->nas_ip_addr &&
diff --git a/src/ap/ieee802_1x.c b/src/ap/ieee802_1x.c
index c774d5c..badb09c 100644
--- a/src/ap/ieee802_1x.c
+++ b/src/ap/ieee802_1x.c
@@ -524,13 +524,34 @@ int add_common_radius_attr(struct hostapd_data *hapd,
 #endif /* CONFIG_IPV6 */

     if (!hostapd_config_get_radius_attr(req_attr,
-                        RADIUS_ATTR_NAS_IDENTIFIER) &&
-        hapd->conf->nas_identifier &&
-        !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IDENTIFIER,
-                 (u8 *) hapd->conf->nas_identifier,
-                 os_strlen(hapd->conf->nas_identifier))) {
-        wpa_printf(MSG_ERROR, "Could not add NAS-Identifier");
-        return -1;
+                    RADIUS_ATTR_NAS_IDENTIFIER)) {
+        if (hapd->conf->nas_identifier_base) {
+            if (hapd->conf->nas_identifier_use_bssid == 1) {
+                len = os_snprintf(buf, sizeof(buf),
+                    RADIUS_802_1X_ADDR_FORMAT ":",
+                    MAC2STR(hapd->own_addr));
+                os_memcpy(&buf[len],
+                    hapd->conf->nas_identifier_base,
+                    hapd->conf->nas_identifier_base_len);
+                len += hapd->conf->nas_identifier_base_len;
+            }
+            else {
+                os_memcpy(&buf[0],
+                    hapd->conf->nas_identifier_base,
+                    hapd->conf->nas_identifier_base_len);
+                len = hapd->conf->nas_identifier_base_len;
+            }
+        }
+        else
+            len = os_snprintf(buf, sizeof(buf),
+                RADIUS_802_1X_ADDR_FORMAT,
+                MAC2STR(hapd->own_addr));
+
+        if (!radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IDENTIFIER,
+                 (u8 *) buf, len)) {
+            wpa_printf(MSG_ERROR, "Could not add NAS-Identifier");
+            return -1;
+        }
     }

     len = os_snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT ":",
diff --git a/src/ap/wpa_auth_glue.c b/src/ap/wpa_auth_glue.c
index ffd0790..8e363a3 100644
--- a/src/ap/wpa_auth_glue.c
+++ b/src/ap/wpa_auth_glue.c
@@ -59,9 +59,9 @@ static void hostapd_wpa_auth_conf(struct
hostapd_bss_config *conf,
     os_memcpy(wconf->ssid, conf->ssid.ssid, wconf->ssid_len);
     os_memcpy(wconf->mobility_domain, conf->mobility_domain,
           MOBILITY_DOMAIN_ID_LEN);
-    if (conf->nas_identifier &&
-        os_strlen(conf->nas_identifier) <= FT_R0KH_ID_MAX_LEN) {
-        wconf->r0_key_holder_len = os_strlen(conf->nas_identifier);
+    if (conf->nas_identifier_base &&
+        conf->nas_identifier_base_len <= FT_R0KH_ID_MAX_LEN) {
+        wconf->r0_key_holder_len = conf->nas_identifier_base_len;
         os_memcpy(wconf->r0_key_holder, conf->nas_identifier,
               wconf->r0_key_holder_len);
     }
-- 
2.7.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Defines-a-new-config-option-nas-identifier-use-bssid.patch
Type: text/x-patch
Size: 11422 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/hostap/attachments/20160228/6cedddfe/attachment-0001.bin>


More information about the Hostap mailing list