jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
hostap/src/ap/wpa_auth_ie.c

1099 lines
30 KiB
C
Raw Normal View History

Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
/*
* hostapd - WPA/RSN IE and KDE definitions
FT: SHA384-based AKM in RSNE processing This defines key lengths for SHA384-based FT AKM and handles writing and parsing for RSNE AKMs with the new value. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-06-04 14:16:54 +02:00
* Copyright (c) 2004-2018, Jouni Malinen <j@w1.fi>
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
*
Remove the GPL notification from files contributed by Jouni Malinen Remove the GPL notification text from the files that were initially contributed by myself. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-02-11 15:46:35 +01:00
* This software may be distributed under the terms of the BSD license.
* See README for more details.
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
*/
Rename some src/ap files to avoid duplicate file names Doxygen and some build tools may get a bit confused about same file name being used in different directories. Clean this up a bit by renaming some of the duplicated file names in src/ap.
2009-12-25 23:05:40 +01:00
#include "utils/includes.h"
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
Rename some src/ap files to avoid duplicate file names Doxygen and some build tools may get a bit confused about same file name being used in different directories. Clean this up a bit by renaming some of the duplicated file names in src/ap.
2009-12-25 23:05:40 +01:00
#include "utils/common.h"
Include header files explicitly in *.c, not via header files
2009-12-25 23:31:51 +01:00
#include "common/ieee802_11_defs.h"
Move EAPOL authenticator state machine into src/eapol_auth This is now completely independent from hostapd-specific code, so it can be moved to be under the src tree.
2009-11-29 19:03:28 +01:00
#include "eapol_auth/eapol_auth_sm.h"
Rename some src/ap files to avoid duplicate file names Doxygen and some build tools may get a bit confused about same file name being used in different directories. Clean this up a bit by renaming some of the duplicated file names in src/ap.
2009-12-25 23:05:40 +01:00
#include "ap_config.h"
#include "ieee802_11.h"
#include "wpa_auth.h"
#include "pmksa_cache_auth.h"
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
#include "wpa_auth_ie.h"
#include "wpa_auth_i.h"
hostapd: Add testing mode for RSN element extensions CFLAGS += -DCONFIG_RSN_TESTING in .config and rsn_testing=1 in hostapd.conf can now be used to enable a testing mode that adds extensions to RSN element. This can be used to check whether station implementations are incompatible with future extensions to the RSN element.
2011-03-21 12:59:05 +01:00
#ifdef CONFIG_RSN_TESTING
int rsn_testing = 0;
#endif /* CONFIG_RSN_TESTING */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
static int wpa_write_wpa_ie(struct wpa_auth_config *conf, u8 *buf, size_t len)
{
struct wpa_ie_hdr *hdr;
int num_suites;
u8 *pos, *count;
Move WPA cipher information into a shared location Try to share most of the cipher information like key and RSC lengths and suite selector conversions, etc. in wpa_common.c to avoid having similar code throughout the WPA implementation for handling cipher specific behavior. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-30 10:53:54 +02:00
u32 suite;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
hdr = (struct wpa_ie_hdr *) buf;
hdr->elem_id = WLAN_EID_VENDOR_SPECIFIC;
RSN_SELECTOR_PUT(hdr->oui, WPA_OUI_TYPE);
WPA_PUT_LE16(hdr->version, WPA_VERSION);
pos = (u8 *) (hdr + 1);
Move WPA cipher information into a shared location Try to share most of the cipher information like key and RSC lengths and suite selector conversions, etc. in wpa_common.c to avoid having similar code throughout the WPA implementation for handling cipher specific behavior. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-30 10:53:54 +02:00
suite = wpa_cipher_to_suite(WPA_PROTO_WPA, conf->wpa_group);
if (suite == 0) {
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
wpa_printf(MSG_DEBUG, "Invalid group cipher (%d).",
conf->wpa_group);
return -1;
}
Move WPA cipher information into a shared location Try to share most of the cipher information like key and RSC lengths and suite selector conversions, etc. in wpa_common.c to avoid having similar code throughout the WPA implementation for handling cipher specific behavior. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-30 10:53:54 +02:00
RSN_SELECTOR_PUT(pos, suite);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
pos += WPA_SELECTOR_LEN;
count = pos;
pos += 2;
Move WPA cipher information into a shared location Try to share most of the cipher information like key and RSC lengths and suite selector conversions, etc. in wpa_common.c to avoid having similar code throughout the WPA implementation for handling cipher specific behavior. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-30 10:53:54 +02:00
num_suites = wpa_cipher_put_suites(pos, conf->wpa_pairwise);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (num_suites == 0) {
wpa_printf(MSG_DEBUG, "Invalid pairwise cipher (%d).",
conf->wpa_pairwise);
return -1;
}
Move WPA cipher information into a shared location Try to share most of the cipher information like key and RSC lengths and suite selector conversions, etc. in wpa_common.c to avoid having similar code throughout the WPA implementation for handling cipher specific behavior. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-30 10:53:54 +02:00
pos += num_suites * WPA_SELECTOR_LEN;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
WPA_PUT_LE16(count, num_suites);
num_suites = 0;
count = pos;
pos += 2;
if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) {
RSN_SELECTOR_PUT(pos, WPA_AUTH_KEY_MGMT_UNSPEC_802_1X);
pos += WPA_SELECTOR_LEN;
num_suites++;
}
if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) {
RSN_SELECTOR_PUT(pos, WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X);
pos += WPA_SELECTOR_LEN;
num_suites++;
}
if (num_suites == 0) {
wpa_printf(MSG_DEBUG, "Invalid key management type (%d).",
conf->wpa_key_mgmt);
return -1;
}
WPA_PUT_LE16(count, num_suites);
/* WPA Capabilities; use defaults, so no need to include it */
hdr->len = (pos - buf) - 2;
return pos - buf;
}
int wpa_write_rsn_ie(struct wpa_auth_config *conf, u8 *buf, size_t len,
const u8 *pmkid)
{
struct rsn_ie_hdr *hdr;
Move WPA cipher information into a shared location Try to share most of the cipher information like key and RSC lengths and suite selector conversions, etc. in wpa_common.c to avoid having similar code throughout the WPA implementation for handling cipher specific behavior. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-30 10:53:54 +02:00
int num_suites, res;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
u8 *pos, *count;
u16 capab;
Move WPA cipher information into a shared location Try to share most of the cipher information like key and RSC lengths and suite selector conversions, etc. in wpa_common.c to avoid having similar code throughout the WPA implementation for handling cipher specific behavior. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-30 10:53:54 +02:00
u32 suite;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
hdr = (struct rsn_ie_hdr *) buf;
hdr->elem_id = WLAN_EID_RSN;
WPA_PUT_LE16(hdr->version, RSN_VERSION);
pos = (u8 *) (hdr + 1);
Move WPA cipher information into a shared location Try to share most of the cipher information like key and RSC lengths and suite selector conversions, etc. in wpa_common.c to avoid having similar code throughout the WPA implementation for handling cipher specific behavior. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-30 10:53:54 +02:00
suite = wpa_cipher_to_suite(WPA_PROTO_RSN, conf->wpa_group);
if (suite == 0) {
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
wpa_printf(MSG_DEBUG, "Invalid group cipher (%d).",
conf->wpa_group);
return -1;
}
Move WPA cipher information into a shared location Try to share most of the cipher information like key and RSC lengths and suite selector conversions, etc. in wpa_common.c to avoid having similar code throughout the WPA implementation for handling cipher specific behavior. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-30 10:53:54 +02:00
RSN_SELECTOR_PUT(pos, suite);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
pos += RSN_SELECTOR_LEN;
num_suites = 0;
count = pos;
pos += 2;
hostapd: Add testing mode for RSN element extensions CFLAGS += -DCONFIG_RSN_TESTING in .config and rsn_testing=1 in hostapd.conf can now be used to enable a testing mode that adds extensions to RSN element. This can be used to check whether station implementations are incompatible with future extensions to the RSN element.
2011-03-21 12:59:05 +01:00
#ifdef CONFIG_RSN_TESTING
if (rsn_testing) {
RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 1));
pos += RSN_SELECTOR_LEN;
num_suites++;
}
#endif /* CONFIG_RSN_TESTING */
Move WPA cipher information into a shared location Try to share most of the cipher information like key and RSC lengths and suite selector conversions, etc. in wpa_common.c to avoid having similar code throughout the WPA implementation for handling cipher specific behavior. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-30 10:53:54 +02:00
res = rsn_cipher_put_suites(pos, conf->rsn_pairwise);
num_suites += res;
pos += res * RSN_SELECTOR_LEN;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
hostapd: Add testing mode for RSN element extensions CFLAGS += -DCONFIG_RSN_TESTING in .config and rsn_testing=1 in hostapd.conf can now be used to enable a testing mode that adds extensions to RSN element. This can be used to check whether station implementations are incompatible with future extensions to the RSN element.
2011-03-21 12:59:05 +01:00
#ifdef CONFIG_RSN_TESTING
if (rsn_testing) {
RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 2));
pos += RSN_SELECTOR_LEN;
num_suites++;
}
#endif /* CONFIG_RSN_TESTING */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (num_suites == 0) {
wpa_printf(MSG_DEBUG, "Invalid pairwise cipher (%d).",
conf->rsn_pairwise);
return -1;
}
WPA_PUT_LE16(count, num_suites);
num_suites = 0;
count = pos;
pos += 2;
hostapd: Add testing mode for RSN element extensions CFLAGS += -DCONFIG_RSN_TESTING in .config and rsn_testing=1 in hostapd.conf can now be used to enable a testing mode that adds extensions to RSN element. This can be used to check whether station implementations are incompatible with future extensions to the RSN element.
2011-03-21 12:59:05 +01:00
#ifdef CONFIG_RSN_TESTING
if (rsn_testing) {
RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 1));
pos += RSN_SELECTOR_LEN;
num_suites++;
}
#endif /* CONFIG_RSN_TESTING */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) {
RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_UNSPEC_802_1X);
pos += RSN_SELECTOR_LEN;
num_suites++;
}
if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) {
RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X);
pos += RSN_SELECTOR_LEN;
num_suites++;
}
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#ifdef CONFIG_IEEE80211R_AP
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) {
RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_802_1X);
pos += RSN_SELECTOR_LEN;
num_suites++;
}
FT: SHA384-based AKM in RSNE processing This defines key lengths for SHA384-based FT AKM and handles writing and parsing for RSNE AKMs with the new value. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-06-04 14:16:54 +02:00
#ifdef CONFIG_SHA384
if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X_SHA384) {
RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384);
pos += RSN_SELECTOR_LEN;
num_suites++;
}
#endif /* CONFIG_SHA384 */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_PSK) {
RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_PSK);
pos += RSN_SELECTOR_LEN;
num_suites++;
}
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#endif /* CONFIG_IEEE80211R_AP */
Added support for using SHA256-based stronger key derivation for WPA2 IEEE 802.11w/D6.0 defines new AKMPs to indicate SHA256-based algorithms for key derivation (and AES-CMAC for EAPOL-Key MIC). Add support for using new AKMPs and clean up AKMP processing with helper functions in defs.h.
2008-08-31 21:57:28 +02:00
if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) {
RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SHA256);
pos += RSN_SELECTOR_LEN;
num_suites++;
}
if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK_SHA256) {
RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PSK_SHA256);
pos += RSN_SELECTOR_LEN;
num_suites++;
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
if (conf->wpa_key_mgmt & WPA_KEY_MGMT_SAE) {
RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_SAE);
pos += RSN_SELECTOR_LEN;
num_suites++;
}
if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_SAE) {
RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_SAE);
pos += RSN_SELECTOR_LEN;
num_suites++;
}
#endif /* CONFIG_SAE */
Suite B: Add AKM 00-0F-AC:11 This adds definitions for the 128-bit level Suite B AKM 00-0F-AC:11. The functionality itself is not yet complete, i.e., this commit only includes parts to negotiate the new AKM. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-11-16 12:20:51 +01:00
if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SUITE_B);
pos += RSN_SELECTOR_LEN;
num_suites++;
}
Add Suite B 192-bit AKM WPA-EAP-SUITE-B-192 can now be used to select 192-bit level Suite B into use as the key management method. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-25 22:32:01 +01:00
if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192);
pos += RSN_SELECTOR_LEN;
num_suites++;
}
FILS: Add AKM definitions This adds definitions for the new AKM suite values from P802.11ai/D11.0. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-01 16:50:04 +02:00
#ifdef CONFIG_FILS
if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FILS_SHA256) {
RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FILS_SHA256);
pos += RSN_SELECTOR_LEN;
num_suites++;
}
if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FILS_SHA384) {
RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FILS_SHA384);
pos += RSN_SELECTOR_LEN;
num_suites++;
}
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#ifdef CONFIG_IEEE80211R_AP
FILS: Add AKM definitions This adds definitions for the new AKM suite values from P802.11ai/D11.0. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-01 16:50:04 +02:00
if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA256) {
RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_FILS_SHA256);
pos += RSN_SELECTOR_LEN;
num_suites++;
}
if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA384) {
RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_FILS_SHA384);
pos += RSN_SELECTOR_LEN;
num_suites++;
}
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#endif /* CONFIG_IEEE80211R_AP */
FILS: Add AKM definitions This adds definitions for the new AKM suite values from P802.11ai/D11.0. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-01 16:50:04 +02:00
#endif /* CONFIG_FILS */
OWE: Define and parse OWE AKM selector This adds a new RSN AKM "OWE". Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-11 23:32:23 +01:00
#ifdef CONFIG_OWE
if (conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE) {
RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_OWE);
pos += RSN_SELECTOR_LEN;
num_suites++;
}
#endif /* CONFIG_OWE */
DPP: Add new AKM This new AKM is used with DPP when using the signed Connector to derive a PMK. Since the KCK, KEK, and MIC lengths are variable within a single AKM, this needs number of additional changes to get the PMK length delivered to places that need to figure out the lengths of the PTK components. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-06-17 22:48:52 +02:00
#ifdef CONFIG_DPP
if (conf->wpa_key_mgmt & WPA_KEY_MGMT_DPP) {
RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_DPP);
pos += RSN_SELECTOR_LEN;
num_suites++;
}
#endif /* CONFIG_DPP */
HS 2.0: Allow OSEN connection to be enabled in an RSN BSS This allows a single BSS/SSID to be used for both data connection and OSU. Instead of hostapd configuration osen=1, wpa_key_mgmt=OSEN (or more likely, wpa_key_mgmt=WPA-EAP OSEN) is used to enable this new option. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-29 19:09:53 +02:00
#ifdef CONFIG_HS20
if (conf->wpa_key_mgmt & WPA_KEY_MGMT_OSEN) {
RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_OSEN);
pos += RSN_SELECTOR_LEN;
num_suites++;
}
#endif /* CONFIG_HS20 */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
hostapd: Add testing mode for RSN element extensions CFLAGS += -DCONFIG_RSN_TESTING in .config and rsn_testing=1 in hostapd.conf can now be used to enable a testing mode that adds extensions to RSN element. This can be used to check whether station implementations are incompatible with future extensions to the RSN element.
2011-03-21 12:59:05 +01:00
#ifdef CONFIG_RSN_TESTING
if (rsn_testing) {
RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 2));
pos += RSN_SELECTOR_LEN;
num_suites++;
}
#endif /* CONFIG_RSN_TESTING */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (num_suites == 0) {
wpa_printf(MSG_DEBUG, "Invalid key management type (%d).",
conf->wpa_key_mgmt);
return -1;
}
WPA_PUT_LE16(count, num_suites);
/* RSN Capabilities */
capab = 0;
if (conf->rsn_preauth)
capab |= WPA_CAPABILITY_PREAUTH;
WMM cleanup (WME -> WMM rename, comments, etc.) This updates the terminogy to match with the final WMM specification. In addition, some of the WMM TSPEC structure fields were in incorrect order and used without byte order swapping. Those are also taken care of this cleanup patch.
2009-03-04 11:33:24 +01:00
if (conf->wmm_enabled) {
/* 4 PTKSA replay counters when using WMM */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
capab |= (RSN_NUM_REPLAY_COUNTERS_16 << 2);
}
Share the same enum for MFP configuration The three existing enums were already depending on using the same values in couple of places and it is just simpler to standardize on one of these to avoid need for mapping between different enums for the exact same thing.
2010-01-03 20:02:51 +01:00
if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) {
Updated MFP defines based on IEEE 802.11w/D6.0 and use new MFPC/MFPR This adds most of the new frame format and identifier definitions from IEEE 802.11w/D6.0. In addition, the RSN IE capability field values for MFP is replaced with the new two-bit version with MFPC (capable) and MFPR (required) processing.
2008-08-30 13:59:39 +02:00
capab |= WPA_CAPABILITY_MFPC;
Share the same enum for MFP configuration The three existing enums were already depending on using the same values in couple of places and it is just simpler to standardize on one of these to avoid need for mapping between different enums for the exact same thing.
2010-01-03 20:02:51 +01:00
if (conf->ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED)
Updated MFP defines based on IEEE 802.11w/D6.0 and use new MFPC/MFPR This adds most of the new frame format and identifier definitions from IEEE 802.11w/D6.0. In addition, the RSN IE capability field values for MFP is replaced with the new two-bit version with MFPC (capable) and MFPR (required) processing.
2008-08-30 13:59:39 +02:00
capab |= WPA_CAPABILITY_MFPR;
}
OCV: Advertise OCV capability in RSN capabilities (AP) Set the OCV bit in RSN capabilities (RSNE) based on AP mode configuration. Do the same for OSEN since it follows the RSNE field definitions. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:25 +02:00
#ifdef CONFIG_OCV
if (conf->ocv)
capab |= WPA_CAPABILITY_OCVC;
#endif /* CONFIG_OCV */
hostapd: Add testing mode for RSN element extensions CFLAGS += -DCONFIG_RSN_TESTING in .config and rsn_testing=1 in hostapd.conf can now be used to enable a testing mode that adds extensions to RSN element. This can be used to check whether station implementations are incompatible with future extensions to the RSN element.
2011-03-21 12:59:05 +01:00
#ifdef CONFIG_RSN_TESTING
if (rsn_testing)
OCV: Advertise OCV capability in RSN capabilities (AP) Set the OCV bit in RSN capabilities (RSNE) based on AP mode configuration. Do the same for OSEN since it follows the RSNE field definitions. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:25 +02:00
capab |= BIT(8) | BIT(15);
hostapd: Add testing mode for RSN element extensions CFLAGS += -DCONFIG_RSN_TESTING in .config and rsn_testing=1 in hostapd.conf can now be used to enable a testing mode that adds extensions to RSN element. This can be used to check whether station implementations are incompatible with future extensions to the RSN element.
2011-03-21 12:59:05 +01:00
#endif /* CONFIG_RSN_TESTING */
AP: Support Extended Key ID Support Extended Key ID in hostapd according to IEEE Std 802.11-2016. Extended Key ID allows to rekey pairwise keys without the otherwise unavoidable MPDU losses on a busy link. The standard is fully backward compatible, allowing an AP to serve STAs with and without Extended Key ID support in the same BSS. Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2020-03-20 20:04:31 +01:00
if (conf->extended_key_id)
capab |= WPA_CAPABILITY_EXT_KEY_ID_FOR_UNICAST;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
WPA_PUT_LE16(pos, capab);
pos += 2;
if (pmkid) {
RSN auth: Avoid undefined behavior in pointer arithmetic Reorder terms in a way that no invalid pointers are generated with pos+len operations. end-pos is always defined (with a valid pos pointer) while pos+len could end up pointing beyond the end pointer which would be undefined behavior. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-10-18 17:43:44 +02:00
if (2 + PMKID_LEN > buf + len - pos)
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
return -1;
/* PMKID Count */
WPA_PUT_LE16(pos, 1);
pos += 2;
os_memcpy(pos, pmkid, PMKID_LEN);
pos += PMKID_LEN;
}
FT: Remove optional fields from RSNE when using PMF The PMKIDCount, PMKID List, and Group Management Cipher Suite fields are optional to include in the RSNE in cases where these would not have values that are different from the default values. In practice, PMKIDCount is always 0 in Beacon and Probe Response frames, so the only field of these that could have a non-default value is Group Management Cipher Suite. When BIP is used, that field is not needed either due to BIP being the default cipher when PMF is enabled. Remove these fields from RSNE when BIP is used to save six octets in Beacon and Probe Response frames. In addition to reduced frame length, this is a workaround for interoperability issues with iOS 8.4 in cases where FT and PMF are enabled. iOS seems to be rejecting EAPOL-Key msg 3/4 during FT initial mobility domain association if the RSNE includes the PMKIDCount field. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-08-06 15:41:38 +02:00
if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION &&
conf->group_mgmt_cipher != WPA_CIPHER_AES_128_CMAC) {
RSN auth: Avoid undefined behavior in pointer arithmetic Reorder terms in a way that no invalid pointers are generated with pos+len operations. end-pos is always defined (with a valid pos pointer) while pos+len could end up pointing beyond the end pointer which would be undefined behavior. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-10-18 17:43:44 +02:00
if (2 + 4 > buf + len - pos)
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
return -1;
if (pmkid == NULL) {
/* PMKID Count */
WPA_PUT_LE16(pos, 0);
pos += 2;
}
/* Management Group Cipher Suite */
Allow management group cipher to be configured This allows hostapd to set a different management group cipher than the previously hardcoded default BIP (AES-128-CMAC). The new configuration file parameter group_mgmt_cipher can be set to BIP-GMAC-128, BIP-GMAC-256, or BIP-CMAC-256 to select one of the ciphers defined in IEEE Std 802.11ac-2013. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-12 19:26:37 +01:00
switch (conf->group_mgmt_cipher) {
case WPA_CIPHER_AES_128_CMAC:
RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC);
break;
case WPA_CIPHER_BIP_GMAC_128:
RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_BIP_GMAC_128);
break;
case WPA_CIPHER_BIP_GMAC_256:
RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_BIP_GMAC_256);
break;
case WPA_CIPHER_BIP_CMAC_256:
RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_BIP_CMAC_256);
break;
default:
wpa_printf(MSG_DEBUG,
"Invalid group management cipher (0x%x)",
conf->group_mgmt_cipher);
return -1;
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
pos += RSN_SELECTOR_LEN;
}
hostapd: Add testing mode for RSN element extensions CFLAGS += -DCONFIG_RSN_TESTING in .config and rsn_testing=1 in hostapd.conf can now be used to enable a testing mode that adds extensions to RSN element. This can be used to check whether station implementations are incompatible with future extensions to the RSN element.
2011-03-21 12:59:05 +01:00
#ifdef CONFIG_RSN_TESTING
if (rsn_testing) {
/*
* Fill in any defined fields and add extra data to the end of
* the element.
*/
int pmkid_count_set = pmkid != NULL;
if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION)
pmkid_count_set = 1;
/* PMKID Count */
WPA_PUT_LE16(pos, 0);
pos += 2;
if (conf->ieee80211w == NO_MGMT_FRAME_PROTECTION) {
/* Management Group Cipher Suite */
RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC);
pos += RSN_SELECTOR_LEN;
}
os_memset(pos, 0x12, 17);
pos += 17;
}
#endif /* CONFIG_RSN_TESTING */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
hdr->len = (pos - buf) - 2;
return pos - buf;
}
SAE: Advertise Extended RSN Capabilities when H2E is enabled Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-05 11:05:58 +02:00
int wpa_write_rsnxe(struct wpa_auth_config *conf, u8 *buf, size_t len)
{
u8 *pos = buf;
if (conf->sae_pwe != 1 && conf->sae_pwe != 2)
return 0; /* no supported extended RSN capabilities */
if (len < 3)
return -1;
*pos++ = WLAN_EID_RSNX;
*pos++ = 1;
/* bits 0-3 = 0 since only one octet of Extended RSN Capabilities is
* used for now */
*pos++ = BIT(WLAN_RSNX_CAPAB_SAE_H2E);
return pos - buf;
}
HS 2.0R2 AP: Add OSEN implementation Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2013-07-23 20:25:21 +02:00
static u8 * wpa_write_osen(struct wpa_auth_config *conf, u8 *eid)
{
u8 *len;
u16 capab;
*eid++ = WLAN_EID_VENDOR_SPECIFIC;
len = eid++; /* to be filled */
WPA_PUT_BE24(eid, OUI_WFA);
eid += 3;
*eid++ = HS20_OSEN_OUI_TYPE;
/* Group Data Cipher Suite */
RSN_SELECTOR_PUT(eid, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
eid += RSN_SELECTOR_LEN;
/* Pairwise Cipher Suite Count and List */
WPA_PUT_LE16(eid, 1);
eid += 2;
RSN_SELECTOR_PUT(eid, RSN_CIPHER_SUITE_CCMP);
eid += RSN_SELECTOR_LEN;
/* AKM Suite Count and List */
WPA_PUT_LE16(eid, 1);
eid += 2;
RSN_SELECTOR_PUT(eid, RSN_AUTH_KEY_MGMT_OSEN);
eid += RSN_SELECTOR_LEN;
/* RSN Capabilities */
capab = 0;
if (conf->wmm_enabled) {
/* 4 PTKSA replay counters when using WMM */
capab |= (RSN_NUM_REPLAY_COUNTERS_16 << 2);
}
if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) {
capab |= WPA_CAPABILITY_MFPC;
if (conf->ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED)
capab |= WPA_CAPABILITY_MFPR;
}
OCV: Advertise OCV capability in RSN capabilities (AP) Set the OCV bit in RSN capabilities (RSNE) based on AP mode configuration. Do the same for OSEN since it follows the RSNE field definitions. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:25 +02:00
#ifdef CONFIG_OCV
if (conf->ocv)
capab |= WPA_CAPABILITY_OCVC;
#endif /* CONFIG_OCV */
HS 2.0R2 AP: Add OSEN implementation Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2013-07-23 20:25:21 +02:00
WPA_PUT_LE16(eid, capab);
eid += 2;
*len = eid - len - 1;
return eid;
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
int wpa_auth_gen_wpa_ie(struct wpa_authenticator *wpa_auth)
{
u8 *pos, buf[128];
int res;
hostapd: Add testing option to override own WPA/RSN IE(s) This allows the new own_ie_override=<hexdump> configuration parameter to be used to replace the normally generated WPA/RSN IE(s) for testing purposes in CONFIG_TESTING_OPTIONS=y builds. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-08 17:18:03 +02:00
#ifdef CONFIG_TESTING_OPTIONS
if (wpa_auth->conf.own_ie_override_len) {
wpa_hexdump(MSG_DEBUG, "WPA: Forced own IE(s) for testing",
wpa_auth->conf.own_ie_override,
wpa_auth->conf.own_ie_override_len);
os_free(wpa_auth->wpa_ie);
wpa_auth->wpa_ie =
os_malloc(wpa_auth->conf.own_ie_override_len);
if (wpa_auth->wpa_ie == NULL)
return -1;
os_memcpy(wpa_auth->wpa_ie, wpa_auth->conf.own_ie_override,
wpa_auth->conf.own_ie_override_len);
wpa_auth->wpa_ie_len = wpa_auth->conf.own_ie_override_len;
return 0;
}
#endif /* CONFIG_TESTING_OPTIONS */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
pos = buf;
HS 2.0R2 AP: Add OSEN implementation Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2013-07-23 20:25:21 +02:00
if (wpa_auth->conf.wpa == WPA_PROTO_OSEN) {
pos = wpa_write_osen(&wpa_auth->conf, pos);
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (wpa_auth->conf.wpa & WPA_PROTO_RSN) {
res = wpa_write_rsn_ie(&wpa_auth->conf,
pos, buf + sizeof(buf) - pos, NULL);
if (res < 0)
return res;
pos += res;
SAE: Advertise Extended RSN Capabilities when H2E is enabled Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-05 11:05:58 +02:00
res = wpa_write_rsnxe(&wpa_auth->conf, pos,
buf + sizeof(buf) - pos);
if (res < 0)
return res;
pos += res;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#ifdef CONFIG_IEEE80211R_AP
Use wpa_key_mgmt_*() helpers This cleans up the source code and makes it less likely that new AKM addition misses some needed changes in the future. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-24 21:46:14 +01:00
if (wpa_key_mgmt_ft(wpa_auth->conf.wpa_key_mgmt)) {
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
res = wpa_write_mdie(&wpa_auth->conf, pos,
buf + sizeof(buf) - pos);
if (res < 0)
return res;
pos += res;
}
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#endif /* CONFIG_IEEE80211R_AP */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (wpa_auth->conf.wpa & WPA_PROTO_WPA) {
res = wpa_write_wpa_ie(&wpa_auth->conf,
pos, buf + sizeof(buf) - pos);
if (res < 0)
return res;
pos += res;
}
os_free(wpa_auth->wpa_ie);
wpa_auth->wpa_ie = os_malloc(pos - buf);
if (wpa_auth->wpa_ie == NULL)
return -1;
os_memcpy(wpa_auth->wpa_ie, buf, pos - buf);
wpa_auth->wpa_ie_len = pos - buf;
return 0;
}
u8 * wpa_add_kde(u8 *pos, u32 kde, const u8 *data, size_t data_len,
const u8 *data2, size_t data2_len)
{
*pos++ = WLAN_EID_VENDOR_SPECIFIC;
*pos++ = RSN_SELECTOR_LEN + data_len + data2_len;
RSN_SELECTOR_PUT(pos, kde);
pos += RSN_SELECTOR_LEN;
os_memcpy(pos, data, data_len);
pos += data_len;
if (data2) {
os_memcpy(pos, data2, data2_len);
pos += data2_len;
}
return pos;
}
Added support for opportunistic key caching (OKC) This allows hostapd to share the PMKSA caches internally when multiple BSSes or radios are being controlled by the same hostapd process.
2008-08-03 19:17:58 +02:00
struct wpa_auth_okc_iter_data {
struct rsn_pmksa_cache_entry *pmksa;
const u8 *aa;
const u8 *spa;
const u8 *pmkid;
};
static int wpa_auth_okc_iter(struct wpa_authenticator *a, void *ctx)
{
struct wpa_auth_okc_iter_data *data = ctx;
data->pmksa = pmksa_cache_get_okc(a->pmksa, data->aa, data->spa,
data->pmkid);
if (data->pmksa)
return 1;
return 0;
}
Return an enum from wpa_validate_wpa_ie() This is more specific then returning a generic int and also allows the compiler to do more checks. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 11:22:28 +01:00
enum wpa_validate_result
wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth,
struct wpa_state_machine *sm, int freq,
const u8 *wpa_ie, size_t wpa_ie_len,
const u8 *rsnxe, size_t rsnxe_len,
const u8 *mdie, size_t mdie_len,
const u8 *owe_dh, size_t owe_dh_len)
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
{
AP: Support Extended Key ID Support Extended Key ID in hostapd according to IEEE Std 802.11-2016. Extended Key ID allows to rekey pairwise keys without the otherwise unavoidable MPDU losses on a busy link. The standard is fully backward compatible, allowing an AP to serve STAs with and without Extended Key ID support in the same BSS. Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2020-03-20 20:04:31 +01:00
struct wpa_auth_config *conf = &wpa_auth->conf;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
struct wpa_ie_data data;
int ciphers, key_mgmt, res, version;
u32 selector;
size_t i;
Added support for opportunistic key caching (OKC) This allows hostapd to share the PMKSA caches internally when multiple BSSes or radios are being controlled by the same hostapd process.
2008-08-03 19:17:58 +02:00
const u8 *pmkid = NULL;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (wpa_auth == NULL || sm == NULL)
return WPA_NOT_ENABLED;
if (wpa_ie == NULL || wpa_ie_len < 1)
return WPA_INVALID_IE;
if (wpa_ie[0] == WLAN_EID_RSN)
version = WPA_PROTO_RSN;
else
version = WPA_PROTO_WPA;
Fixed WPA/RSN IE validation to verify the proto (WPA vs. WPA2) is enabled Previous version could have allowed a broken client to complete WPA (or WPA2) authentication even if the selected proto was not enabled in hostapd configuration.
2008-10-15 05:34:39 +02:00
if (!(wpa_auth->conf.wpa & version)) {
wpa_printf(MSG_DEBUG, "Invalid WPA proto (%d) from " MACSTR,
version, MAC2STR(sm->addr));
return WPA_INVALID_PROTO;
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (version == WPA_PROTO_RSN) {
res = wpa_parse_wpa_ie_rsn(wpa_ie, wpa_ie_len, &data);
Fix cipher suite selector default value in RSNE for DMG According to IEEE Std 802.11-2016, 9.4.2.25 when fields of an RSNE are not included, the default values are used. The cipher suite defaults were hardcoded to CCMP in the previous implementation, but the default is actually different for DMG: GCMP (per 9.4.2.25.2). It is not possible to find out from the RSNE if the network is non-DMG or DMG, so callers of wpa_parse_wpa_ie_rsn() need to handle this case based on context, which can be different for each caller. In order to fix this issue, add flags to the wpa_ie_data indicating whether pairwise/group ciphers were included in the RSNE. Callers can check these flags and fill in the appropriate ciphers. The wpa_parse_wpa_ie_rsn() function still initializes the ciphers to CCMP by default so existing callers will not break. This change also fixes some callers which need to handle the DMG network case. Signed-off-by: Lior David <liord@codeaurora.org>
2019-02-06 11:33:35 +01:00
if (!data.has_pairwise)
data.pairwise_cipher = wpa_default_rsn_cipher(freq);
if (!data.has_group)
data.group_cipher = wpa_default_rsn_cipher(freq);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
hostapd: Work around an interop connection issue in FT-PSK + WPA-PSK While the AP is configured to enable both FT-PSK and WPA-PSK, an HP printer request both AKMs (copied from AP?) in Association Request frame, but don't add MDIE and don't use FT. This results in the connection failing. Next in logs we see: RSN: Trying to use FT, but MDIE not included IE - hexdump(len=26): 30 18 01 00 00 0f ac 04 01 00 00 0f ac 04 02 00 00 0f ac 02 00 0f ac 04 00 00 This is seen with some HP and Epson printers. Work around this by stripping FT AKM(s) when MDE is not present and there is still a non-FT AKM available. Signed-off-by: Janusz Dziedzic <janusz@plumewifi.com>
2018-03-05 15:37:10 +01:00
if (wpa_key_mgmt_ft(data.key_mgmt) && !mdie &&
!wpa_key_mgmt_only_ft(data.key_mgmt)) {
/* Workaround for some HP and Epson printers that seem
* to incorrectly copy the FT-PSK + WPA-PSK AKMs from AP
* advertised RSNE to Association Request frame. */
wpa_printf(MSG_DEBUG,
"RSN: FT set in RSNE AKM but MDE is missing from "
MACSTR
" - ignore FT AKM(s) because there's also a non-FT AKM",
MAC2STR(sm->addr));
data.key_mgmt &= ~WPA_KEY_MGMT_FT;
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X;
if (0) {
}
Add Suite B 192-bit AKM WPA-EAP-SUITE-B-192 can now be used to select 192-bit level Suite B into use as the key management method. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-25 22:32:01 +01:00
else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
selector = RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192;
Suite B: Add AKM 00-0F-AC:11 This adds definitions for the 128-bit level Suite B AKM 00-0F-AC:11. The functionality itself is not yet complete, i.e., this commit only includes parts to negotiate the new AKM. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-11-16 12:20:51 +01:00
else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B)
selector = RSN_AUTH_KEY_MGMT_802_1X_SUITE_B;
FILS: Allow hostapd to select FILS AKM for connection Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-02 14:58:23 +02:00
#ifdef CONFIG_FILS
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#ifdef CONFIG_IEEE80211R_AP
FILS: Allow hostapd to select FILS AKM for connection Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-02 14:58:23 +02:00
else if (data.key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA384)
selector = RSN_AUTH_KEY_MGMT_FT_FILS_SHA384;
else if (data.key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA256)
selector = RSN_AUTH_KEY_MGMT_FT_FILS_SHA256;
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#endif /* CONFIG_IEEE80211R_AP */
FILS: Allow hostapd to select FILS AKM for connection Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-02 14:58:23 +02:00
else if (data.key_mgmt & WPA_KEY_MGMT_FILS_SHA384)
selector = RSN_AUTH_KEY_MGMT_FILS_SHA384;
else if (data.key_mgmt & WPA_KEY_MGMT_FILS_SHA256)
selector = RSN_AUTH_KEY_MGMT_FILS_SHA256;
#endif /* CONFIG_FILS */
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#ifdef CONFIG_IEEE80211R_AP
FT: SHA384-based AKM in RSNE processing This defines key lengths for SHA384-based FT AKM and handles writing and parsing for RSNE AKMs with the new value. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-06-04 14:16:54 +02:00
#ifdef CONFIG_SHA384
else if (data.key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X_SHA384)
selector = RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384;
#endif /* CONFIG_SHA384 */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
else if (data.key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X)
selector = RSN_AUTH_KEY_MGMT_FT_802_1X;
else if (data.key_mgmt & WPA_KEY_MGMT_FT_PSK)
selector = RSN_AUTH_KEY_MGMT_FT_PSK;
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#endif /* CONFIG_IEEE80211R_AP */
Added support for using SHA256-based stronger key derivation for WPA2 IEEE 802.11w/D6.0 defines new AKMPs to indicate SHA256-based algorithms for key derivation (and AES-CMAC for EAPOL-Key MIC). Add support for using new AKMPs and clean up AKMP processing with helper functions in defs.h.
2008-08-31 21:57:28 +02:00
else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256)
selector = RSN_AUTH_KEY_MGMT_802_1X_SHA256;
else if (data.key_mgmt & WPA_KEY_MGMT_PSK_SHA256)
selector = RSN_AUTH_KEY_MGMT_PSK_SHA256;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
else if (data.key_mgmt & WPA_KEY_MGMT_SAE)
selector = RSN_AUTH_KEY_MGMT_SAE;
else if (data.key_mgmt & WPA_KEY_MGMT_FT_SAE)
selector = RSN_AUTH_KEY_MGMT_FT_SAE;
#endif /* CONFIG_SAE */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X)
selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X;
else if (data.key_mgmt & WPA_KEY_MGMT_PSK)
selector = RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X;
OWE: Define and parse OWE AKM selector This adds a new RSN AKM "OWE". Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-11 23:32:23 +01:00
#ifdef CONFIG_OWE
else if (data.key_mgmt & WPA_KEY_MGMT_OWE)
selector = RSN_AUTH_KEY_MGMT_OWE;
#endif /* CONFIG_OWE */
DPP: Add new AKM This new AKM is used with DPP when using the signed Connector to derive a PMK. Since the KCK, KEK, and MIC lengths are variable within a single AKM, this needs number of additional changes to get the PMK length delivered to places that need to figure out the lengths of the PTK components. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-06-17 22:48:52 +02:00
#ifdef CONFIG_DPP
else if (data.key_mgmt & WPA_KEY_MGMT_DPP)
selector = RSN_AUTH_KEY_MGMT_DPP;
#endif /* CONFIG_DPP */
HS 2.0: Allow OSEN connection to be enabled in an RSN BSS This allows a single BSS/SSID to be used for both data connection and OSU. Instead of hostapd configuration osen=1, wpa_key_mgmt=OSEN (or more likely, wpa_key_mgmt=WPA-EAP OSEN) is used to enable this new option. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-29 19:09:53 +02:00
#ifdef CONFIG_HS20
else if (data.key_mgmt & WPA_KEY_MGMT_OSEN)
selector = RSN_AUTH_KEY_MGMT_OSEN;
#endif /* CONFIG_HS20 */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
wpa_auth->dot11RSNAAuthenticationSuiteSelected = selector;
Move WPA cipher information into a shared location Try to share most of the cipher information like key and RSC lengths and suite selector conversions, etc. in wpa_common.c to avoid having similar code throughout the WPA implementation for handling cipher specific behavior. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-30 10:53:54 +02:00
selector = wpa_cipher_to_suite(WPA_PROTO_RSN,
data.pairwise_cipher);
if (!selector)
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
selector = RSN_CIPHER_SUITE_CCMP;
wpa_auth->dot11RSNAPairwiseCipherSelected = selector;
Move WPA cipher information into a shared location Try to share most of the cipher information like key and RSC lengths and suite selector conversions, etc. in wpa_common.c to avoid having similar code throughout the WPA implementation for handling cipher specific behavior. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-30 10:53:54 +02:00
selector = wpa_cipher_to_suite(WPA_PROTO_RSN,
data.group_cipher);
if (!selector)
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
selector = RSN_CIPHER_SUITE_CCMP;
wpa_auth->dot11RSNAGroupCipherSelected = selector;
} else {
res = wpa_parse_wpa_ie_wpa(wpa_ie, wpa_ie_len, &data);
selector = WPA_AUTH_KEY_MGMT_UNSPEC_802_1X;
if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X)
selector = WPA_AUTH_KEY_MGMT_UNSPEC_802_1X;
else if (data.key_mgmt & WPA_KEY_MGMT_PSK)
selector = WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X;
wpa_auth->dot11RSNAAuthenticationSuiteSelected = selector;
Move WPA cipher information into a shared location Try to share most of the cipher information like key and RSC lengths and suite selector conversions, etc. in wpa_common.c to avoid having similar code throughout the WPA implementation for handling cipher specific behavior. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-30 10:53:54 +02:00
selector = wpa_cipher_to_suite(WPA_PROTO_WPA,
data.pairwise_cipher);
if (!selector)
selector = RSN_CIPHER_SUITE_TKIP;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
wpa_auth->dot11RSNAPairwiseCipherSelected = selector;
Move WPA cipher information into a shared location Try to share most of the cipher information like key and RSC lengths and suite selector conversions, etc. in wpa_common.c to avoid having similar code throughout the WPA implementation for handling cipher specific behavior. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-30 10:53:54 +02:00
selector = wpa_cipher_to_suite(WPA_PROTO_WPA,
data.group_cipher);
if (!selector)
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
selector = WPA_CIPHER_SUITE_TKIP;
wpa_auth->dot11RSNAGroupCipherSelected = selector;
}
if (res) {
wpa_printf(MSG_DEBUG, "Failed to parse WPA/RSN IE from "
MACSTR " (res=%d)", MAC2STR(sm->addr), res);
wpa_hexdump(MSG_DEBUG, "WPA/RSN IE", wpa_ie, wpa_ie_len);
return WPA_INVALID_IE;
}
if (data.group_cipher != wpa_auth->conf.wpa_group) {
wpa_printf(MSG_DEBUG, "Invalid WPA group cipher (0x%x) from "
MACSTR, data.group_cipher, MAC2STR(sm->addr));
return WPA_INVALID_GROUP;
}
key_mgmt = data.key_mgmt & wpa_auth->conf.wpa_key_mgmt;
if (!key_mgmt) {
wpa_printf(MSG_DEBUG, "Invalid WPA key mgmt (0x%x) from "
MACSTR, data.key_mgmt, MAC2STR(sm->addr));
return WPA_INVALID_AKMP;
}
if (0) {
}
Add Suite B 192-bit AKM WPA-EAP-SUITE-B-192 can now be used to select 192-bit level Suite B into use as the key management method. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-25 22:32:01 +01:00
else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
Suite B: Add AKM 00-0F-AC:11 This adds definitions for the 128-bit level Suite B AKM 00-0F-AC:11. The functionality itself is not yet complete, i.e., this commit only includes parts to negotiate the new AKM. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-11-16 12:20:51 +01:00
else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B)
sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
FILS: Allow hostapd to select FILS AKM for connection Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-02 14:58:23 +02:00
#ifdef CONFIG_FILS
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#ifdef CONFIG_IEEE80211R_AP
FILS: Allow hostapd to select FILS AKM for connection Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-02 14:58:23 +02:00
else if (key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA384)
sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_FILS_SHA384;
else if (data.key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA256)
sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_FILS_SHA256;
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#endif /* CONFIG_IEEE80211R_AP */
FILS: Allow hostapd to select FILS AKM for connection Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-02 14:58:23 +02:00
else if (key_mgmt & WPA_KEY_MGMT_FILS_SHA384)
sm->wpa_key_mgmt = WPA_KEY_MGMT_FILS_SHA384;
else if (key_mgmt & WPA_KEY_MGMT_FILS_SHA256)
sm->wpa_key_mgmt = WPA_KEY_MGMT_FILS_SHA256;
#endif /* CONFIG_FILS */
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#ifdef CONFIG_IEEE80211R_AP
FT: SHA384-based AKM in RSNE processing This defines key lengths for SHA384-based FT AKM and handles writing and parsing for RSNE AKMs with the new value. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-06-04 14:16:54 +02:00
#ifdef CONFIG_SHA384
else if (key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X_SHA384)
sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X_SHA384;
#endif /* CONFIG_SHA384 */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
else if (key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X)
sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
else if (key_mgmt & WPA_KEY_MGMT_FT_PSK)
sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_PSK;
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#endif /* CONFIG_IEEE80211R_AP */
Added support for using SHA256-based stronger key derivation for WPA2 IEEE 802.11w/D6.0 defines new AKMPs to indicate SHA256-based algorithms for key derivation (and AES-CMAC for EAPOL-Key MIC). Add support for using new AKMPs and clean up AKMP processing with helper functions in defs.h.
2008-08-31 21:57:28 +02:00
else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256)
sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
else if (key_mgmt & WPA_KEY_MGMT_PSK_SHA256)
sm->wpa_key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
else if (key_mgmt & WPA_KEY_MGMT_SAE)
sm->wpa_key_mgmt = WPA_KEY_MGMT_SAE;
else if (key_mgmt & WPA_KEY_MGMT_FT_SAE)
sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_SAE;
#endif /* CONFIG_SAE */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X)
sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X;
OWE: Define and parse OWE AKM selector This adds a new RSN AKM "OWE". Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-11 23:32:23 +01:00
#ifdef CONFIG_OWE
else if (key_mgmt & WPA_KEY_MGMT_OWE)
sm->wpa_key_mgmt = WPA_KEY_MGMT_OWE;
#endif /* CONFIG_OWE */
DPP: Add new AKM This new AKM is used with DPP when using the signed Connector to derive a PMK. Since the KCK, KEK, and MIC lengths are variable within a single AKM, this needs number of additional changes to get the PMK length delivered to places that need to figure out the lengths of the PTK components. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-06-17 22:48:52 +02:00
#ifdef CONFIG_DPP
else if (key_mgmt & WPA_KEY_MGMT_DPP)
sm->wpa_key_mgmt = WPA_KEY_MGMT_DPP;
#endif /* CONFIG_DPP */
HS 2.0: Allow OSEN connection to be enabled in an RSN BSS This allows a single BSS/SSID to be used for both data connection and OSU. Instead of hostapd configuration osen=1, wpa_key_mgmt=OSEN (or more likely, wpa_key_mgmt=WPA-EAP OSEN) is used to enable this new option. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-29 19:09:53 +02:00
#ifdef CONFIG_HS20
else if (key_mgmt & WPA_KEY_MGMT_OSEN)
sm->wpa_key_mgmt = WPA_KEY_MGMT_OSEN;
#endif /* CONFIG_HS20 */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
else
sm->wpa_key_mgmt = WPA_KEY_MGMT_PSK;
if (version == WPA_PROTO_RSN)
ciphers = data.pairwise_cipher & wpa_auth->conf.rsn_pairwise;
else
ciphers = data.pairwise_cipher & wpa_auth->conf.wpa_pairwise;
if (!ciphers) {
wpa_printf(MSG_DEBUG, "Invalid %s pairwise cipher (0x%x) "
"from " MACSTR,
version == WPA_PROTO_RSN ? "RSN" : "WPA",
data.pairwise_cipher, MAC2STR(sm->addr));
return WPA_INVALID_PAIRWISE;
}
Share the same enum for MFP configuration The three existing enums were already depending on using the same values in couple of places and it is just simpler to standardize on one of these to avoid need for mapping between different enums for the exact same thing.
2010-01-03 20:02:51 +01:00
if (wpa_auth->conf.ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED) {
Updated MFP defines based on IEEE 802.11w/D6.0 and use new MFPC/MFPR This adds most of the new frame format and identifier definitions from IEEE 802.11w/D6.0. In addition, the RSN IE capability field values for MFP is replaced with the new two-bit version with MFPC (capable) and MFPR (required) processing.
2008-08-30 13:59:39 +02:00
if (!(data.capabilities & WPA_CAPABILITY_MFPC)) {
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
wpa_printf(MSG_DEBUG, "Management frame protection "
"required, but client did not enable it");
return WPA_MGMT_FRAME_PROTECTION_VIOLATION;
}
Allow management group cipher to be configured This allows hostapd to set a different management group cipher than the previously hardcoded default BIP (AES-128-CMAC). The new configuration file parameter group_mgmt_cipher can be set to BIP-GMAC-128, BIP-GMAC-256, or BIP-CMAC-256 to select one of the ciphers defined in IEEE Std 802.11ac-2013. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-12 19:26:37 +01:00
if (data.mgmt_group_cipher != wpa_auth->conf.group_mgmt_cipher)
{
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
wpa_printf(MSG_DEBUG, "Unsupported management group "
"cipher %d", data.mgmt_group_cipher);
return WPA_INVALID_MGMT_GROUP_CIPHER;
}
}
SAE: Add option to require MFP for SAE associations The new hostapd.conf parameter sae_require_pmf=<0/1> can now be used to enforce negotiation of MFP for all associations that negotiate use of SAE. This is used in cases where SAE-capable devices are known to be MFP-capable and the BSS is configured with optional MFP (ieee80211w=1) for legacy support. The non-SAE stations can connect without MFP while SAE stations are required to negotiate MFP if sae_require_mfp=1. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-27 17:26:31 +01:00
#ifdef CONFIG_SAE
if (wpa_auth->conf.ieee80211w == MGMT_FRAME_PROTECTION_OPTIONAL &&
SAE: Do not ignore option sae_require_mfp Without this patch sae_require_mfp is always activate, when ieee80211w is set to optional all stations negotiating SAEs are being rejected when they do not support PMF. With this patch hostapd only rejects these stations in case sae_require_mfp is set to some value and not null. Fixes ba3d435fe43 ("SAE: Add option to require MFP for SAE associations") Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2018-10-10 23:43:07 +02:00
wpa_auth->conf.sae_require_mfp &&
SAE: Add option to require MFP for SAE associations The new hostapd.conf parameter sae_require_pmf=<0/1> can now be used to enforce negotiation of MFP for all associations that negotiate use of SAE. This is used in cases where SAE-capable devices are known to be MFP-capable and the BSS is configured with optional MFP (ieee80211w=1) for legacy support. The non-SAE stations can connect without MFP while SAE stations are required to negotiate MFP if sae_require_mfp=1. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-27 17:26:31 +01:00
wpa_key_mgmt_sae(sm->wpa_key_mgmt) &&
!(data.capabilities & WPA_CAPABILITY_MFPC)) {
wpa_printf(MSG_DEBUG,
"Management frame protection required with SAE, but client did not enable it");
return WPA_MGMT_FRAME_PROTECTION_VIOLATION;
}
#endif /* CONFIG_SAE */
OCV: Track STA OCV capability in AP mode Check and store OCV capability indication for each STA. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:25 +02:00
#ifdef CONFIG_OCV
if ((data.capabilities & WPA_CAPABILITY_OCVC) &&
!(data.capabilities & WPA_CAPABILITY_MFPC)) {
wpa_printf(MSG_DEBUG,
"Management frame protection required with OCV, but client did not enable it");
return WPA_MGMT_FRAME_PROTECTION_VIOLATION;
}
wpa_auth_set_ocv(sm, wpa_auth->conf.ocv &&
(data.capabilities & WPA_CAPABILITY_OCVC));
#endif /* CONFIG_OCV */
Share the same enum for MFP configuration The three existing enums were already depending on using the same values in couple of places and it is just simpler to standardize on one of these to avoid need for mapping between different enums for the exact same thing.
2010-01-03 20:02:51 +01:00
if (wpa_auth->conf.ieee80211w == NO_MGMT_FRAME_PROTECTION ||
Updated MFP defines based on IEEE 802.11w/D6.0 and use new MFPC/MFPR This adds most of the new frame format and identifier definitions from IEEE 802.11w/D6.0. In addition, the RSN IE capability field values for MFP is replaced with the new two-bit version with MFPC (capable) and MFPR (required) processing.
2008-08-30 13:59:39 +02:00
!(data.capabilities & WPA_CAPABILITY_MFPC))
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
sm->mgmt_frame_prot = 0;
else
sm->mgmt_frame_prot = 1;
Fix MFP-enabled test for disallowed TKIP The test against use of TKIP was done only in MFP-required (ieee80211w=2) configuration. Fix this to check the pairwise cipher for MFP-enabled (ieee80211w=1) case as well. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-27 17:38:12 +01:00
if (sm->mgmt_frame_prot && (ciphers & WPA_CIPHER_TKIP)) {
wpa_printf(MSG_DEBUG,
"Management frame protection cannot use TKIP");
return WPA_MGMT_FRAME_PROTECTION_VIOLATION;
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#ifdef CONFIG_IEEE80211R_AP
Added support for using SHA256-based stronger key derivation for WPA2 IEEE 802.11w/D6.0 defines new AKMPs to indicate SHA256-based algorithms for key derivation (and AES-CMAC for EAPOL-Key MIC). Add support for using new AKMPs and clean up AKMP processing with helper functions in defs.h.
2008-08-31 21:57:28 +02:00
if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) {
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (mdie == NULL || mdie_len < MOBILITY_DOMAIN_ID_LEN + 1) {
wpa_printf(MSG_DEBUG, "RSN: Trying to use FT, but "
"MDIE not included");
return WPA_INVALID_MDIE;
}
if (os_memcmp(mdie, wpa_auth->conf.mobility_domain,
MOBILITY_DOMAIN_ID_LEN) != 0) {
wpa_hexdump(MSG_DEBUG, "RSN: Attempted to use unknown "
"MDIE", mdie, MOBILITY_DOMAIN_ID_LEN);
return WPA_INVALID_MDIE;
}
FT: Explicitly check for MDE not present in non-FT association IEEE Std 802.11-2012, 12.4.2 states that if an MDE is present in an (Re)Association Request frame but the RSNE uses a non-FT AKM suite, the AP shall reject the association using status code 43 ("Invalid AKMP"). wpa_validate_wpa_ie() now explicitly checks for this condition to meet this requirement instead of simply ignoring the MDE based on non-FT AKM. Signed-off-by: Will Glynn <will@willglynn.com>
2016-11-26 03:39:12 +01:00
} else if (mdie != NULL) {
wpa_printf(MSG_DEBUG,
"RSN: Trying to use non-FT AKM suite, but MDIE included");
return WPA_INVALID_AKMP;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#endif /* CONFIG_IEEE80211R_AP */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
#ifdef CONFIG_OWE
if (sm->wpa_key_mgmt == WPA_KEY_MGMT_OWE && !owe_dh) {
wpa_printf(MSG_DEBUG,
"OWE: No Diffie-Hellman Parameter element");
return WPA_INVALID_AKMP;
}
#endif /* CONFIG_OWE */
DPP2: Allow AP to require or reject PFS The new hostapd configuration parameter dpp_pfs can be used to specify how PFS is applied to associations. The default behavior (dpp_pfs=0) remains same as it was previously, i.e., allow the station to decide whether to use PFS. PFS use can now be required (dpp_pfs=1) or rejected (dpp_pfs=2). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 11:33:48 +01:00
#ifdef CONFIG_DPP2
if (sm->wpa_key_mgmt == WPA_KEY_MGMT_DPP &&
((conf->dpp_pfs == 1 && !owe_dh) ||
(conf->dpp_pfs == 2 && owe_dh))) {
wpa_printf(MSG_DEBUG, "DPP: PFS %s",
conf->dpp_pfs == 1 ? "required" : "not allowed");
return WPA_DENIED_OTHER_REASON;
}
#endif /* CONFIG_DPP2 */
Move cipher suite selection into common helper functions Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-13 15:58:54 +01:00
sm->pairwise = wpa_pick_pairwise_cipher(ciphers, 0);
if (sm->pairwise < 0)
return WPA_INVALID_PAIRWISE;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
/* TODO: clear WPA/WPA2 state if STA changes from one to another */
if (wpa_ie[0] == WLAN_EID_RSN)
sm->wpa = WPA_VERSION_WPA2;
else
sm->wpa = WPA_VERSION_WPA;
FILS+FT: AP mode processing of PMKR1Name in initial MD association Derive PMKR1Name during the FILS authentication step, verify that the station uses matching PMKR1Name in (Re)Association Request frame, and add RSNE[PMKR1Name] into (Re)Association Response frame when going through FT initial mobility domain association using FILS. These steps were missed from the initial implementation, but are needed to match the IEEE 802.11ai requirements for explicit confirmation of the FT key hierarchy (similarly to what is done in FT 4-way handshake when FILS is not used). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-13 16:24:29 +01:00
#if defined(CONFIG_IEEE80211R_AP) && defined(CONFIG_FILS)
if ((sm->wpa_key_mgmt == WPA_KEY_MGMT_FT_FILS_SHA256 ||
sm->wpa_key_mgmt == WPA_KEY_MGMT_FT_FILS_SHA384) &&
(sm->auth_alg == WLAN_AUTH_FILS_SK ||
sm->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
sm->auth_alg == WLAN_AUTH_FILS_PK) &&
(data.num_pmkid != 1 || !data.pmkid || !sm->pmk_r1_name_valid ||
os_memcmp_const(data.pmkid, sm->pmk_r1_name,
WPA_PMK_NAME_LEN) != 0)) {
wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
"No PMKR1Name match for FILS+FT");
return WPA_INVALID_PMKID;
}
#endif /* CONFIG_IEEE80211R_AP && CONFIG_FILS */
Added support for opportunistic key caching (OKC) This allows hostapd to share the PMKSA caches internally when multiple BSSes or radios are being controlled by the same hostapd process.
2008-08-03 19:17:58 +02:00
sm->pmksa = NULL;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
for (i = 0; i < data.num_pmkid; i++) {
wpa_hexdump(MSG_DEBUG, "RSN IE: STA PMKID",
&data.pmkid[i * PMKID_LEN], PMKID_LEN);
Renamed PMKSA cache functions to avoid duplicate symbols with supplicant This allows hostapd/pmksa_cache.c and src/rsn_supp/pmksa_cache.c to be linked into the same program.
2009-01-14 21:01:26 +01:00
sm->pmksa = pmksa_cache_auth_get(wpa_auth->pmksa, sm->addr,
&data.pmkid[i * PMKID_LEN]);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (sm->pmksa) {
Added support for opportunistic key caching (OKC) This allows hostapd to share the PMKSA caches internally when multiple BSSes or radios are being controlled by the same hostapd process.
2008-08-03 19:17:58 +02:00
pmkid = sm->pmksa->pmkid;
break;
}
}
for (i = 0; sm->pmksa == NULL && wpa_auth->conf.okc &&
i < data.num_pmkid; i++) {
struct wpa_auth_okc_iter_data idata;
idata.pmksa = NULL;
idata.aa = wpa_auth->addr;
idata.spa = sm->addr;
idata.pmkid = &data.pmkid[i * PMKID_LEN];
wpa_auth_for_each_auth(wpa_auth, wpa_auth_okc_iter, &idata);
if (idata.pmksa) {
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
Added support for opportunistic key caching (OKC) This allows hostapd to share the PMKSA caches internally when multiple BSSes or radios are being controlled by the same hostapd process.
2008-08-03 19:17:58 +02:00
"OKC match for PMKID");
sm->pmksa = pmksa_cache_add_okc(wpa_auth->pmksa,
idata.pmksa,
wpa_auth->addr,
idata.pmkid);
pmkid = idata.pmkid;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
break;
}
}
Make PMKID check easier for static analyzers Checking sm->pmksa is sufficient here, but that seems to be too difficult for static analyzers to follow, so avoid false reports by explicitly checking pmkid as well. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-04-26 10:20:37 +02:00
if (sm->pmksa && pmkid) {
radius: Add tagged VLAN parsing 1. Add tagged VLAN to struct vlan_description (compile limited number of tagged VLANs per description) For k tagged VLANs, the first k entries in vlan_description.tagged are used. They are sorted in ascending order. All other entries are zero. This way os_memcmp() can find identical configurations. 2. Let tagged VLANs be parsed from RADIUS Access-Accept 3. Print VLAN %d+ with %d=untagged VID if tagged VLANs are set 4. Select an unused vlan_id > 4096 for new tagged VLAN configurations 5. Add EGRESS_VLAN RADIUS attribute parsing also for untagged VLANs Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2016-01-21 14:51:57 +01:00
struct vlan_description *vlan;
VLAN: Separate station grouping and uplink configuration Separate uplink configuration (IEEE 802.1q VID) and grouping of stations into AP_VLAN interfaces. The int vlan_id will continue to identify the AP_VLAN interface the station should be assigned to. Each AP_VLAN interface corresponds to an instance of struct hostapd_vlan that is uniquely identified by int vlan_id within an BSS. New: Each station and struct hostapd_vlan holds a struct vlan_description vlan_desc member that describes the uplink configuration requested. Currently this is just an int untagged IEEE 802.1q VID, but can be extended to tagged VLANs and other settings easily. When the station was about to be assigned its vlan_id, vlan_desc and vlan_id will now be set simultaneously by ap_sta_set_vlan(). So sta->vlan_id can still be tested for whether the station needs to be moved to an AP_VLAN interface. To ease addition of tagged VLAN support, a member notempty is added to struct vlan_description. Is is set to 1 if an untagged or tagged VLAN assignment is requested and needs to be validated. The inverted form allows os_zalloc() to initialize an empty description. Though not depended on by the code, vlan_id assignment ensures: * vlan_id = 0 will continue to mean no AP_VLAN interface * vlan_id < 4096 will continue to mean vlan_id = untagged vlan id with no per_sta_vif and no extra tagged vlan. * vlan_id > 4096 will be used for per_sta_vif and/or tagged vlans. This way struct wpa_group and drivers API do not need to be changed in order to implement tagged VLANs or per_sta_vif support. DYNAMIC_VLAN_* will refer to (struct vlan_description).notempty only, thus grouping of the stations for per_sta_vif can be used with DYNAMIC_VLAN_DISABLED, but not with CONFIG_NO_VLAN, as struct hostapd_vlan is still used to manage AP_VLAN interfaces. MAX_VLAN_ID will be checked in hostapd_vlan_valid and during setup of VLAN interfaces and refer to IEEE 802.1q VID. VLAN_ID_WILDCARD will continue to refer to int vlan_id. Renaming vlan_id to vlan_desc when type changed from int to struct vlan_description was avoided when vlan_id was also used in a way that did not depend on its type (for example, when passed to another function). Output of "VLAN ID %d" continues to refer to int vlan_id, while "VLAN %d" will refer to untagged IEEE 802.1q VID. Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2016-01-21 14:51:56 +01:00
radius: Add tagged VLAN parsing 1. Add tagged VLAN to struct vlan_description (compile limited number of tagged VLANs per description) For k tagged VLANs, the first k entries in vlan_description.tagged are used. They are sorted in ascending order. All other entries are zero. This way os_memcmp() can find identical configurations. 2. Let tagged VLANs be parsed from RADIUS Access-Accept 3. Print VLAN %d+ with %d=untagged VID if tagged VLANs are set 4. Select an unused vlan_id > 4096 for new tagged VLAN configurations 5. Add EGRESS_VLAN RADIUS attribute parsing also for untagged VLANs Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2016-01-21 14:51:57 +01:00
vlan = sm->pmksa->vlan_desc;
Added support for opportunistic key caching (OKC) This allows hostapd to share the PMKSA caches internally when multiple BSSes or radios are being controlled by the same hostapd process.
2008-08-03 19:17:58 +02:00
wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
radius: Add tagged VLAN parsing 1. Add tagged VLAN to struct vlan_description (compile limited number of tagged VLANs per description) For k tagged VLANs, the first k entries in vlan_description.tagged are used. They are sorted in ascending order. All other entries are zero. This way os_memcmp() can find identical configurations. 2. Let tagged VLANs be parsed from RADIUS Access-Accept 3. Print VLAN %d+ with %d=untagged VID if tagged VLANs are set 4. Select an unused vlan_id > 4096 for new tagged VLAN configurations 5. Add EGRESS_VLAN RADIUS attribute parsing also for untagged VLANs Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2016-01-21 14:51:57 +01:00
"PMKID found from PMKSA cache eap_type=%d vlan=%d%s",
Added support for opportunistic key caching (OKC) This allows hostapd to share the PMKSA caches internally when multiple BSSes or radios are being controlled by the same hostapd process.
2008-08-03 19:17:58 +02:00
sm->pmksa->eap_type_authsrv,
radius: Add tagged VLAN parsing 1. Add tagged VLAN to struct vlan_description (compile limited number of tagged VLANs per description) For k tagged VLANs, the first k entries in vlan_description.tagged are used. They are sorted in ascending order. All other entries are zero. This way os_memcmp() can find identical configurations. 2. Let tagged VLANs be parsed from RADIUS Access-Accept 3. Print VLAN %d+ with %d=untagged VID if tagged VLANs are set 4. Select an unused vlan_id > 4096 for new tagged VLAN configurations 5. Add EGRESS_VLAN RADIUS attribute parsing also for untagged VLANs Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2016-01-21 14:51:57 +01:00
vlan ? vlan->untagged : 0,
(vlan && vlan->tagged[0]) ? "+" : "");
Added support for opportunistic key caching (OKC) This allows hostapd to share the PMKSA caches internally when multiple BSSes or radios are being controlled by the same hostapd process.
2008-08-03 19:17:58 +02:00
os_memcpy(wpa_auth->dot11RSNAPMKIDUsed, pmkid, PMKID_LEN);
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
SAE: Reject request with mismatching PMKID (no PMKSA cache entry) Reject SAE association request when PMKID is included in the RSNE, but the corresponding PMKSA is not available in the AP. Signed-off-by: Ashok Ponnaiah <aponnaia@codeaurora.org>
2018-02-07 11:16:20 +01:00
#ifdef CONFIG_SAE
if (sm->wpa_key_mgmt == WPA_KEY_MGMT_SAE && data.num_pmkid &&
!sm->pmksa) {
wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
"No PMKSA cache entry found for SAE");
return WPA_INVALID_PMKID;
}
#endif /* CONFIG_SAE */
DPP: Add new AKM This new AKM is used with DPP when using the signed Connector to derive a PMK. Since the KCK, KEK, and MIC lengths are variable within a single AKM, this needs number of additional changes to get the PMK length delivered to places that need to figure out the lengths of the PTK components. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-06-17 22:48:52 +02:00
#ifdef CONFIG_DPP
if (sm->wpa_key_mgmt == WPA_KEY_MGMT_DPP && !sm->pmksa) {
wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
"No PMKSA cache entry found for DPP");
return WPA_INVALID_PMKID;
}
#endif /* CONFIG_DPP */
AP: Support Extended Key ID Support Extended Key ID in hostapd according to IEEE Std 802.11-2016. Extended Key ID allows to rekey pairwise keys without the otherwise unavoidable MPDU losses on a busy link. The standard is fully backward compatible, allowing an AP to serve STAs with and without Extended Key ID support in the same BSS. Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2020-03-20 20:04:31 +01:00
if (conf->extended_key_id && sm->wpa == WPA_VERSION_WPA2 &&
sm->pairwise != WPA_CIPHER_TKIP &&
(data.capabilities & WPA_CAPABILITY_EXT_KEY_ID_FOR_UNICAST)) {
sm->use_ext_key_id = TRUE;
if (conf->extended_key_id == 2 &&
!wpa_key_mgmt_ft(sm->wpa_key_mgmt) &&
!wpa_key_mgmt_fils(sm->wpa_key_mgmt))
sm->keyidx_active = 1;
else
sm->keyidx_active = 0;
wpa_printf(MSG_DEBUG,
"RSN: Extended Key ID supported (start with %d)",
sm->keyidx_active);
} else {
sm->use_ext_key_id = FALSE;
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (sm->wpa_ie == NULL || sm->wpa_ie_len < wpa_ie_len) {
os_free(sm->wpa_ie);
sm->wpa_ie = os_malloc(wpa_ie_len);
if (sm->wpa_ie == NULL)
return WPA_ALLOC_FAIL;
}
os_memcpy(sm->wpa_ie, wpa_ie, wpa_ie_len);
sm->wpa_ie_len = wpa_ie_len;
Store a copy of Association Request RSNXE in AP mode for later use This is needed to be able to compare the received RSNXE to a protected version in EAPOL-Key msg 2/4. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-17 23:11:24 +02:00
if (rsnxe && rsnxe_len) {
if (!sm->rsnxe || sm->rsnxe_len < rsnxe_len) {
os_free(sm->rsnxe);
sm->rsnxe = os_malloc(rsnxe_len);
if (!sm->rsnxe)
return WPA_ALLOC_FAIL;
}
os_memcpy(sm->rsnxe, rsnxe, rsnxe_len);
sm->rsnxe_len = rsnxe_len;
} else {
os_free(sm->rsnxe);
sm->rsnxe = NULL;
sm->rsnxe_len = 0;
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
return WPA_IE_OK;
}
HS 2.0R2 AP: Add OSEN implementation Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2013-07-23 20:25:21 +02:00
#ifdef CONFIG_HS20
int wpa_validate_osen(struct wpa_authenticator *wpa_auth,
struct wpa_state_machine *sm,
const u8 *osen_ie, size_t osen_ie_len)
{
if (wpa_auth == NULL || sm == NULL)
return -1;
/* TODO: parse OSEN element */
sm->wpa_key_mgmt = WPA_KEY_MGMT_OSEN;
sm->mgmt_frame_prot = 1;
sm->pairwise = WPA_CIPHER_CCMP;
sm->wpa = WPA_VERSION_WPA2;
if (sm->wpa_ie == NULL || sm->wpa_ie_len < osen_ie_len) {
os_free(sm->wpa_ie);
sm->wpa_ie = os_malloc(osen_ie_len);
if (sm->wpa_ie == NULL)
return -1;
}
os_memcpy(sm->wpa_ie, osen_ie, osen_ie_len);
sm->wpa_ie_len = osen_ie_len;
return 0;
}
#endif /* CONFIG_HS20 */
Added WLAN_STA_MFP flag for driver wrappers so that they can configure the driver to enable MFP (IEEE 802.11w) processing for the STA.
2008-06-17 10:21:11 +02:00
int wpa_auth_uses_mfp(struct wpa_state_machine *sm)
{
return sm ? sm->mgmt_frame_prot : 0;
}
OWE: Include RSNE in (Re)Association Response frame This is not normally done in RSN, but RFC 8110 seems to imply that AP has to include OWE AKM in the RSNE within these frames. So, add the RSNE to (Re)Association Response frames when OWE is being negotiated. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 12:49:45 +02:00
OCV: Track STA OCV capability in AP mode Check and store OCV capability indication for each STA. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:25 +02:00
#ifdef CONFIG_OCV
void wpa_auth_set_ocv(struct wpa_state_machine *sm, int ocv)
{
if (sm)
sm->ocv_enabled = ocv;
}
int wpa_auth_uses_ocv(struct wpa_state_machine *sm)
{
return sm ? sm->ocv_enabled : 0;
}
#endif /* CONFIG_OCV */
OWE: Include RSNE in (Re)Association Response frame This is not normally done in RSN, but RFC 8110 seems to imply that AP has to include OWE AKM in the RSNE within these frames. So, add the RSNE to (Re)Association Response frames when OWE is being negotiated. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 12:49:45 +02:00
#ifdef CONFIG_OWE
u8 * wpa_auth_write_assoc_resp_owe(struct wpa_state_machine *sm,
u8 *pos, size_t max_len,
const u8 *req_ies, size_t req_ies_len)
{
int res;
OWE: Fix association rejection behavior If association failed for any non-OWE specific reason, the previous implementation tried to add the OWE related IEs into the (Re)Association Response frame. This is not needed and could actually result in dereferencing a NULL pointer. Fix this by adding those OWE related IEs only for successful association and only if the RSN state machine has been initialized. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-02 19:21:21 +01:00
struct wpa_auth_config *conf;
if (!sm)
return pos;
conf = &sm->wpa_auth->conf;
OWE: Add testing RSNE for OWE assoc response with driver SME/MLME Allow RSNE to be overwritten for testing purposes also in the driver-based SME/MLME case. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-12 12:57:12 +01:00
#ifdef CONFIG_TESTING_OPTIONS
if (conf->own_ie_override_len) {
if (max_len < conf->own_ie_override_len)
OWE: Clean up pointer check in a testing code path Check wpa_auth_write_assoc_resp_owe() return value to keep static analyzers happier. The code path where this could happen is not really reachable due to the separate hapd->conf->own_ie_override check and wpa_auth_write_assoc_resp_owe() returning NULL only in an error case in the override path. Furthermore, clean up the pointer return value to use a proper pointer (NULL vs. 0). Signed-off-by: Ashok Ponnaiah <aponnaia@codeaurora.org>
2018-03-05 06:29:18 +01:00
return NULL;
OWE: Add testing RSNE for OWE assoc response with driver SME/MLME Allow RSNE to be overwritten for testing purposes also in the driver-based SME/MLME case. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-12 12:57:12 +01:00
wpa_hexdump(MSG_DEBUG, "WPA: Forced own IE(s) for testing",
conf->own_ie_override, conf->own_ie_override_len);
os_memcpy(pos, conf->own_ie_override,
conf->own_ie_override_len);
return pos + conf->own_ie_override_len;
}
#endif /* CONFIG_TESTING_OPTIONS */
OWE: Include RSNE in (Re)Association Response frame This is not normally done in RSN, but RFC 8110 seems to imply that AP has to include OWE AKM in the RSNE within these frames. So, add the RSNE to (Re)Association Response frames when OWE is being negotiated. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 12:49:45 +02:00
OWE: Fix a compiler warning in non-testing build The new conf variable was used only within the CONFIG_TESTING_OPTIONS block and as such, added a warning about unused variable into non-testing builds. Fix that by using that variable outside the conditional block as well. Fixes: a22e235fd0df ("OWE: Add testing RSNE for OWE assoc response with driver SME/MLME") Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-11-27 19:49:53 +01:00
res = wpa_write_rsn_ie(conf, pos, max_len,
OWE: PMKSA caching in AP mode This extends OWE support in hostapd to allow PMKSA caching to be used. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-09 11:08:12 +02:00
sm->pmksa ? sm->pmksa->pmkid : NULL);
OWE: Include RSNE in (Re)Association Response frame This is not normally done in RSN, but RFC 8110 seems to imply that AP has to include OWE AKM in the RSNE within these frames. So, add the RSNE to (Re)Association Response frames when OWE is being negotiated. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 12:49:45 +02:00
if (res < 0)
return pos;
return pos + res;
}
#endif /* CONFIG_OWE */
FILS: Add RSNE into (Re)Association Response frame This AP behavior was missing from IEEE Std 802.11ai-2016, but it is needed for the RSNE validation to work correctly and for a FILS STA to be able to perform the mandatory check for RSNE matching when processing the (Re)Association Response frame (as described in 802.11ai). REVmd will be updating the standard to cover this AP case, so prepare the implementation to match that. Without this, a FILS STA might reject association whenever using FILS authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-05-22 16:26:55 +02:00
#ifdef CONFIG_FILS
u8 * wpa_auth_write_assoc_resp_fils(struct wpa_state_machine *sm,
u8 *pos, size_t max_len,
const u8 *req_ies, size_t req_ies_len)
{
int res;
if (!sm ||
sm->wpa_key_mgmt & (WPA_KEY_MGMT_FT_FILS_SHA256 |
WPA_KEY_MGMT_FT_FILS_SHA384))
return pos;
res = wpa_write_rsn_ie(&sm->wpa_auth->conf, pos, max_len, NULL);
if (res < 0)
return pos;
return pos + res;
}
#endif /* CONFIG_FILS */
Reference in a new issue Copy permalink