Commit graph

47 commits

Author SHA1 Message Date
Ben Greear
e0fb468a7d HS 2.0 server: Add a note on OCSP server hostname
Signed-off-by: Ben Greear <greearb@candelatech.com>
2020-03-13 16:52:29 +02:00
Jouni Malinen
87998f80e7 HS 2.0 server: Allow OCSP responder to continue running after errors
By default, 'openssl ocsp' exits upon receiving a malformed request.
That's not really ideal for a server, so configure openssl to not do
that and instead, continue running to process other requests.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-07 13:26:56 +02:00
Didier Raboud
8155b36fae Fix VERSION_STR printf() calls in case the postfix strings include %
Do not use VERSION_STR directly as the format string to printf() since
it is possible for that string to contain '%'.

Signed-off-by: Didier Raboud <odyx@debian.org>
2020-02-17 19:17:10 +02:00
Jouni Malinen
8e5e36a184 Clean up base64_{encode,decode} pointer types
Allow any pointer to be used as source for encoding and use char * as
the return value from encoding and input value for decoding to reduce
number of type casts needed in the callers.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-28 16:39:09 +02:00
Jouni Malinen
dd2aedeb55 HS 2.0 server: Add X-WFA-Hotspot20-Filtering header line to T&C
When filtering is successfully disabled at the end of the terms and
conditions acceptance sequence, add the "X-WFA-Hotspot20-Filtering:
remove" header line to the HTTP response.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-02-14 12:09:09 +02:00
Jouni Malinen
59c6930641 HS 2.0 server: Command line option to fetch the version information
This can be used to report automatically generated version strings from
the SPP server.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-01-24 00:20:44 +02:00
Jouni Malinen
2d1762fa4a HS 2.0 server: Alternative subrem updateNode for certificate credentials
The new subrem field in the users database can now be used to issue an
alternative subscription remediation updateNode for clients using
certificate credentials. The data file for this case is similar to the
policy update files, but it starts with the managementTreeURI value in
the first line.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-01-23 01:03:46 +02:00
Jouni Malinen
d97cf2a117 HS 2.0 server: Use noMOUpdate in client certificate subrem
There is no point in trying to update the Credential node with the
existing contents in case of subscription remediation using a client
certificate instead of a username/password credential, so use the
noMOUpdate in that case.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-01-22 23:31:06 +02:00
Jouni Malinen
8c70c30472 HS 2.0 server: Log new username in eventlog for cert reenroll
Make it easier to find the new username (and the new serial number from
it) when a user entry is renamed at the conclusion of client certificate
re-enrollment sequence.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-01-10 00:47:04 +02:00
Jouni Malinen
183a6c93cd HS 2.0 server: Allow policy to be set for SIM provisioning
A new osu_config field "sim_policy" can now be used to specify the
policy template for SIM provisioning.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-12-16 18:33:11 +02:00
Jouni Malinen
89ae35833b HS 2.0 server: SIM provisioning exchange
Support SIM provisioning exchange with SPP. This uses the
hotspot2dot0-mobile-identifier-hash value from the AAA server to allow
subscription registration through subscription remediation exchange.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-12-15 18:15:01 +02:00
Jouni Malinen
7bd8c76a4f HS 2.0 server: RADIUS server support for SIM provisioning
This adds support for hostapd-as-RADIUS-authentication-server to request
subscription remediation for SIM-based credentials. The new hostapd.conf
parameter hs20_sim_provisioning_url is used to set the URL prefix for
the remediation server for SIM provisioning. The random
hotspot2dot0-mobile-identifier-hash value will be added to the end of
this URL prefix and the same value is stored in a new SQLite database
table sim_provisioning for the subscription server implementation to
use.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-12-15 18:01:38 +02:00
Jouni Malinen
0e1ab324cc HS 2.0 server: Fix couple of memory leaks
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-12-04 14:12:44 +02:00
Jouni Malinen
718346775d HS 2.0 server: Client certificate reenrollment
This adds support for the SPP server to request certificate reenrollment
and for the EST server to support the simplereenroll version.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-12-04 14:11:39 +02:00
Jouni Malinen
d726f4da54 HS 2.0 server: Document client certificate related Apache configuration
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-12-04 00:34:10 +02:00
Jouni Malinen
2166651b0c HS 2.0 server: Clear remediation requirement for certificate credentials
Previous implementation updated user database only for username/password
credentials. While client certificates do not need the updated password
to be written, they do need the remediation requirement to be cleared,
so fix that.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-12-04 00:34:10 +02:00
Jouni Malinen
34341b09b4 HS 2.0 server: Do not set phase2=1 for certificate-based users
These are not really using Phase 2, so use more appropriate
configuration when going through online signup for client certificates.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-12-04 00:34:00 +02:00
Jouni Malinen
6ff4241797 HS 2.0 server: Include phase2=0 users for TLS in the user list
EAP-TLS users are not really using phase2, so do not require the
database to be set in a way that claim that inaccurately.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-12-03 23:38:20 +02:00
Jouni Malinen
ba7d3fe920 HS 2.0: Record policy update into users table
This makes it easier to track whether a policy update has been
successfully completed.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-19 19:00:37 +03:00
Jouni Malinen
4939e2bb97 HS 2.0: Rename PPS/Credential1 node to Cred01
This makes it a bit easier to use existing hardcoded PPS MO files for
testing purposes when the subscription remediation and policy update
operations target the same path.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-19 18:07:37 +03:00
Jouni Malinen
950cafafb2 HS 2.0: Fix SubscriptionUpdate UpdateMethod value in OSU server
This node was modified long time ago to include "SPP-" prefix. Fix the
OSU server implementation to use the correct value.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-19 18:00:02 +03:00
Jouni Malinen
55e5084d9e HS 2.0: OSU server test functionality for incorrect behavior (policy)
Extend test=<value> special incorrect behavior testing capabilities in
the OSU server to include the fingerprint of the policy update trust
root: test=corrupt_polupd_hash.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-19 17:57:39 +03:00
Jouni Malinen
a9574f0f99 HS 2.0: OSU server test functionality for incorrect behavior
Add a mechanism to allow special incorrect behavior to be requested from
OSU server by adding an optional parameter test=<value> to the initial
signup URL. This is for protocol testing purposes for the OSU client.

This commit adds two special behavior cases: corrupt_aaa_hash and
corrupt_subrem_hash. These can be used to generate PPS MO with invalid
CertSHA256Fingerprint values for AAAServerTrustRoot and
SubscriptionUpdate nodes.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-17 19:08:12 +03:00
Jouni Malinen
cc5f797593 HS 2.0 server: Subscription remediation with user selected new password
Add support for user remediation to request a new password from the user
for username/password credentials that have been configured not use use
machine managed password.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
f718e5e22c HS 2.0 server: Show whether credential is machine managed
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
eb83e81e31 HS 2.0 server: Make user list more readable
Order the rows based on identity and use a bit smaller font for some of
the fields to make the table fit on the screen more easily.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
af284f8a8e HS 2.0 server: Clarify signup page options
Make it clearer that there are three different types of credentials that
can be provisioned.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
dd76afff65 HS 2.0 server: Do not perform subrem if not requested to
Instead of defaulting to machine remediation, reject a request to do
subscription remediation if that has not been configured to be required.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
ee598e431b HS 2.0 server: Add last_msk into users table setup
This field is used for debugging purposes.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-07 12:47:21 +03:00
Jouni Malinen
cc6263ef60 HS 2.0 server: Store device MAC address into database
This is needed for tracking status of certificate enrollment cases.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-15 05:17:54 +03:00
Jouni Malinen
1d73531fdb HS 2.0: Fix T&C server database check
It was possible for the wait loop to exit early due to the $row[0] == 1
check returning false if the database value was not yet set. Fix this by
updated the $waiting default value only if the database actually has a
value for this field.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-13 01:04:40 +03:00
Jouni Malinen
ad5c385db9 HS 2.0 server: Replace deprecated PHP function split()
Use explode() instead of split() because split() has been removed from
PHP 7.0.0 and there is no need for using full regular expression here.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-10 23:41:35 +03:00
Jouni Malinen
73d3f88418 HS 2.0: CoA-Request from Terms and Conditions server
This extends the terms.php implementation of Hotspot 2.0 Terms and
Conditions server to allow it to interact with hostapd(AS) to clear the
filtering rules from the AP. After requesting hostapd to send out the
CoA-Request, terms.php waits for up to 10 seconds to see whether the
current_sessions table gets an update to indicate that filtering has
been successfully disabled.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-06-22 20:22:40 +03:00
Jouni Malinen
c456e6e3f7 HS 2.0: Terms and Conditions server and management
Add minimal Terms and Conditions server for testing purposes. This can
be used to test user interaction for Terms and Conditions acceptance.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-04-30 21:04:11 +03:00
Jouni Malinen
42f4169166 HS 2.0: Update server SQL DB initialization to cover new fields
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-04-30 20:19:32 +03:00
Jouni Malinen
5bd5eb54d1 HS 2.0: Update server instructions for Ubuntu 16.04
Some of the Ubuntu package names have changed for PHP.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-04-30 20:19:32 +03:00
Masashi Honma
e37c0aa5d1 OSU server: Remove invalid options from documentation
Remove -d and -I options which causes "Illegal option" error.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2017-02-11 12:55:19 +02:00
Maneesh Jain
ea06a08f85 HS 2.0 server: Remove redundant NULL check
Both devinfo and devdetail are non-NULL here due to the earlier check
within the same function.

Signed-off-by: Maneesh Jain <maneesh.jain@samsung.com>
2016-10-28 19:08:32 +03:00
Cedric Izoard
a9c52e8066 HS 2.0R2: No longer use HTTP_RAW_POST_DATA
As HTTP_RAW_POST_DATA is deprecated, use php://input instead.

Signed-off-by: Cedric Izoard <cedric.izoard@ceva-dsp.com>
2016-06-19 22:27:36 +03:00
Ben Greear
dba68f2be2 HS 2.0: Fix hs20_spp_server compile error
Need to add a new -I path to get it to compile.

Signed-off-by: Ben Greear <greearb@candelatech.com>
2015-05-27 11:56:11 +03:00
Ben Greear
93c2e60b36 HS 2.0R2 CA: Improve setup.sh and .conf for more flexibility
This gives more flexibility when generating keys so that users do not
have to edit files to generate their own specific keys.

Update HS 2.0 OSU server notes as well.

Signed-off-by: Ben Greear <greearb@candelatech.com>
2015-04-01 20:33:23 +03:00
Ben Greear
8e31cd2cf6 OSU server: Improve logging for SPP schema validation failures
Signed-off-by: Ben Greear <greearb@candelatech.com>
2015-03-28 11:25:32 +02:00
Ben Greear
e7d285ca5c OSU server: Print out signup ID if there is some problem with it
Signed-off-by: Ben Greear <greearb@candelatech.com>
2015-03-28 11:15:47 +02:00
Sreenath S
6a6569b8bd HS 2.0R2: Add password to DB in case of machine managed subscription
Add password and machine_managed flag to database in case of machine
managed subscription to fix EAP-TTLS connection failure to production
AP. In case of user managed subscription, the entered password is added
to DB from the PHP script. However in machine managed subscription,
machine generated password is added only in SOAP messages and PPS MO. So
connection to production will fail as the generated password is not
present in the database used by AAA server.

Signed-off-by: Sreenath Sharma <sreenath.mailing.lists@gmail.com>
2015-02-01 22:21:01 +02:00
Jouni Malinen
013359147d HS 2.0 SPP server: Fix aaa_trust_root_cert_url example to use DER
The trust roots in the PPS MO point to a DER encoded X.509 certificate.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-04-11 18:55:42 +03:00
Jouni Malinen
0b2c59e315 OSU server: Add example scripts for Hotspot 2.0 PKI
These can be used to generate certificates for developer testing of the
OSU protocol.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-31 12:25:25 +03:00
Jouni Malinen
0f27c20d8d HS 2.0R2: Add example OSU SPP server implementation
This is meant mainly for testing purposes and as a reference
implementation showing how OSU SPP server could be implemented. This is
not suitable for any real production use in its current form.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-31 12:25:17 +03:00