jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
hostap/wpa_supplicant/mesh_rsn.h

46 lines
1.4 KiB
C
Raw Permalink Normal View History

mesh: Add mesh robust security network This implementation provides: - Mesh SAE authentication mechanism - Key management (set/get PSK) - Cryptographic key establishment - Enhanced protection mechanisms for robust management frames Signed-off-by: Javier Lopez <jlopex@gmail.com> Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: Jason Mobarak <x@jason.mobarak.name> Signed-off-by: Thomas Pedersen <thomas@noack.us>
2014-09-01 06:23:29 +02:00
/*
* WPA Supplicant - Mesh RSN routines
* Copyright (c) 2013-2014, cozybit, Inc. All rights reserved.
*
* This software may be distributed under the terms of the BSD license.
* See README for more details.
*/
#ifndef MESH_RSN_H
#define MESH_RSN_H
struct mesh_rsn {
struct wpa_supplicant *wpa_s;
struct wpa_authenticator *auth;
mesh: Avoid use of hardcoded cipher This moves pairwise, group, and management group ciphers to various mesh data structures to avoid having to hardcode cipher in number of places through the code. While CCMP and BIP are still the hardcoded ciphers, these are now set only in one location. Signed-off-by: Jouni Malinen <j@w1.fi>
2016-06-18 21:14:37 +02:00
unsigned int pairwise_cipher;
unsigned int group_cipher;
mesh: Support variable length TX MGTK This is an initial step in supporting multiple cipher suites. Signed-off-by: Jouni Malinen <j@w1.fi>
2016-06-18 13:39:43 +02:00
u8 mgtk[WPA_TK_MAX_LEN];
size_t mgtk_len;
mesh: Clean up AMPE element encoding and parsing The AMPE element includes number of optional and variable length fields and those cannot really be represented by a fixed struct ieee80211_ampe_ie. Remove the optional fields from the struct and build/parse these fields separately. This is also adding support for IGTKdata that was completely missing from the previous implementation. In addition, Key RSC for MGTK is now filled in and used when configuring the RX MGTK for a peer. Signed-off-by: Jouni Malinen <j@w1.fi>
2016-06-18 13:11:23 +02:00
u8 mgtk_key_id;
mesh: Avoid use of hardcoded cipher This moves pairwise, group, and management group ciphers to various mesh data structures to avoid having to hardcode cipher in number of places through the code. While CCMP and BIP are still the hardcoded ciphers, these are now set only in one location. Signed-off-by: Jouni Malinen <j@w1.fi>
2016-06-18 21:14:37 +02:00
unsigned int mgmt_group_cipher;
mesh: Clean up AMPE element encoding and parsing The AMPE element includes number of optional and variable length fields and those cannot really be represented by a fixed struct ieee80211_ampe_ie. Remove the optional fields from the struct and build/parse these fields separately. This is also adding support for IGTKdata that was completely missing from the previous implementation. In addition, Key RSC for MGTK is now filled in and used when configuring the RX MGTK for a peer. Signed-off-by: Jouni Malinen <j@w1.fi>
2016-06-18 13:11:23 +02:00
u8 igtk_key_id;
mesh: Generate a separate TX IGTK if PMF is enabled Previous implementation was incorrectly using MGTK also as the IGTK and doing this regardless of whether PMF was enabled. IGTK needs to be a independent key and this commit does that at the local TX side. The current AMPE element construction and parsing is quite broken, so this does not get add the IGTKdata field there. Signed-off-by: Jouni Malinen <j@w1.fi>
2016-06-18 13:41:59 +02:00
u8 igtk[WPA_TK_MAX_LEN];
size_t igtk_len;
mesh: Add mesh robust security network This implementation provides: - Mesh SAE authentication mechanism - Key management (set/get PSK) - Cryptographic key establishment - Enhanced protection mechanisms for robust management frames Signed-off-by: Javier Lopez <jlopex@gmail.com> Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: Jason Mobarak <x@jason.mobarak.name> Signed-off-by: Thomas Pedersen <thomas@noack.us>
2014-09-01 06:23:29 +02:00
#ifdef CONFIG_SAE
struct wpabuf *sae_token;
int sae_group_index;
#endif /* CONFIG_SAE */
};
struct mesh_rsn * mesh_rsn_auth_init(struct wpa_supplicant *wpa_s,
struct mesh_conf *conf);
int mesh_rsn_auth_sae_sta(struct wpa_supplicant *wpa_s, struct sta_info *sta);
int mesh_rsn_derive_mtk(struct wpa_supplicant *wpa_s, struct sta_info *sta);
void mesh_rsn_get_pmkid(struct mesh_rsn *rsn, struct sta_info *sta, u8 *pmkid);
void mesh_rsn_init_ampe_sta(struct wpa_supplicant *wpa_s,
struct sta_info *sta);
int mesh_rsn_protect_frame(struct mesh_rsn *rsn, struct sta_info *sta,
const u8 *cat, struct wpabuf *buf);
int mesh_rsn_process_ampe(struct wpa_supplicant *wpa_s, struct sta_info *sta,
struct ieee802_11_elems *elems, const u8 *cat,
mesh: Check PMKID in AMPE Action frames From IEEE Std 802.11-2012 13.3.5: If the incoming Mesh Peering Management frame is for AMPE and the Chosen PMK from the received frame contains a PMKID that does not identify a valid mesh PMKSA, the frame shall be silently discarded. We were not checking the PMKID previously, and we also weren't parsing it correctly, so fix both. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-12-27 03:20:52 +01:00
const u8 *chosen_pmk,
mesh: Add mesh robust security network This implementation provides: - Mesh SAE authentication mechanism - Key management (set/get PSK) - Cryptographic key establishment - Enhanced protection mechanisms for robust management frames Signed-off-by: Javier Lopez <jlopex@gmail.com> Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: Jason Mobarak <x@jason.mobarak.name> Signed-off-by: Thomas Pedersen <thomas@noack.us>
2014-09-01 06:23:29 +02:00
const u8 *start, size_t elems_len);
mesh: Add timer for SAE authentication in RSN mesh Add timer to do SAE re-authentication with number of tries defined by MESH_AUTH_RETRY and timeout defined by MESH_AUTH_TIMEOUT. Ignoring the sending of reply message on "SAE confirm before commit" to avoid "ping-pong" issues with other mesh nodes. This is obvious when number of mesh nodes in MBSS reaching 6. Signed-off-by: Chun-Yeow Yeoh <yeohchunyeow@gmail.com> Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:31 +02:00
void mesh_auth_timer(void *eloop_ctx, void *user_data);
mesh: Add mesh robust security network This implementation provides: - Mesh SAE authentication mechanism - Key management (set/get PSK) - Cryptographic key establishment - Enhanced protection mechanisms for robust management frames Signed-off-by: Javier Lopez <jlopex@gmail.com> Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: Jason Mobarak <x@jason.mobarak.name> Signed-off-by: Thomas Pedersen <thomas@noack.us>
2014-09-01 06:23:29 +02:00
#endif /* MESH_RSN_H */
Reference in a new issue Copy permalink