jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
hostap/src/ap/ieee802_11.c

7073 lines
195 KiB
C
Raw Normal View History

Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
/*
* hostapd / IEEE 802.11 Management
Report beacon request TX status as control interface event The new BEACON-REQ-TX-STATUS control interface event is now used to report whether a beacon request (from REQ_BEACON command) was delivered successfully. This event has the following parameters: <STA address> <dialog token> <ack=0/1>. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-01-01 23:54:44 +01:00
* Copyright (c) 2002-2017, Jouni Malinen <j@w1.fi>
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
*
Remove the GPL notification from files contributed by Jouni Malinen Remove the GPL notification text from the files that were initially contributed by myself. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-02-11 15:46:35 +01:00
* This software may be distributed under the terms of the BSD license.
* See README for more details.
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
*/
Move generic AP functionality implementation into src/ap This code can be shared by both hostapd and wpa_supplicant and this is an initial step in getting the generic code moved to be under the src directories. Couple of generic files still remain under the hostapd directory due to direct dependencies to files there. Once the dependencies have been removed, they will also be moved to the src/ap directory to allow wpa_supplicant to be built without requiring anything from the hostapd directory.
2009-12-25 00:12:50 +01:00
#include "utils/includes.h"
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
#ifndef CONFIG_NATIVE_WINDOWS
Move generic AP functionality implementation into src/ap This code can be shared by both hostapd and wpa_supplicant and this is an initial step in getting the generic code moved to be under the src directories. Couple of generic files still remain under the hostapd directory due to direct dependencies to files there. Once the dependencies have been removed, they will also be moved to the src/ap directory to allow wpa_supplicant to be built without requiring anything from the hostapd directory.
2009-12-25 00:12:50 +01:00
#include "utils/common.h"
#include "utils/eloop.h"
Remove src/crypto from default include path In addition, start ordering header file includes to be in more consistent order: system header files, src/utils, src/*, same directory as the *.c file.
2009-11-29 22:04:43 +01:00
#include "crypto/crypto.h"
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
#include "crypto/sha256.h"
OWE: Support DH groups 20 (NIST P-384) and 21 (NIST P-521) in AP mode This extends OWE support in hostapd to allow DH groups 20 and 21 to be used in addition to the mandatory group 19 (NIST P-256). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 15:37:32 +02:00
#include "crypto/sha384.h"
#include "crypto/sha512.h"
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
#include "crypto/random.h"
Include header files explicitly in *.c, not via header files
2009-12-25 23:31:51 +01:00
#include "common/ieee802_11_defs.h"
#include "common/ieee802_11_common.h"
Remove src/crypto from default include path In addition, start ordering header file includes to be in more consistent order: system header files, src/utils, src/*, same directory as the *.c file.
2009-11-29 22:04:43 +01:00
#include "common/wpa_ctrl.h"
SAE: Use a shared data structure for AP and station This makes it easier to share common functions for both roles. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 20:48:19 +01:00
#include "common/sae.h"
DPP2: PFS for PTK derivation Use Diffie-Hellman key exchange to derivate additional material for PMK-to-PTK derivation to get PFS. The Diffie-Hellman Parameter element (defined in OWE RFC 8110) is used in association frames to exchange the DH public keys. For backwards compatibility, ignore missing request/response DH parameter and fall back to no PFS in such cases. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-17 22:51:53 +01:00
#include "common/dpp.h"
OCV: Include and verify OCI in the FILS handshake Include and verify the OCI element in FILS (Re)Association Request and Response frames. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:36 +02:00
#include "common/ocv.h"
hostapd: Process OWE IE and update DH IE to the driver if needed This implements the required functionality in hostapd to facilitate OWE connection with the AP SME-in-driver cases. Stations can either send DH IE or PMKID (in RSNE) (or both) in Association Request frame during the OWE handshake. The drivers that use this offload mechanism do not interpret this information and instead, pass the same to hostapd for further processing. hostapd will either validate the PMKID obtained from the STA or generate DH IE and further indicate the same to the driver. The driver further sends this information in the Association Response frame. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org> Signed-off-by: Liangwei Dong <liangwei@codeaurora.org> Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-05-29 11:11:48 +02:00
#include "common/wpa_common.h"
OCV: Report validation errors for (Re)Association Request frames Add the OCV-FAILURE control interface event to notify upper layers of OCV validation issues in FT and FILS (Re)Association Request frames. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-25 19:46:32 +02:00
#include "common/wpa_ctrl.h"
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
#include "common/ptksa_cache.h"
Remove src/crypto from default include path In addition, start ordering header file includes to be in more consistent order: system header files, src/utils, src/*, same directory as the *.c file.
2009-11-29 22:04:43 +01:00
#include "radius/radius.h"
#include "radius/radius_client.h"
P2P: Add P2P configuration and callbacks in hostapd code
2010-07-18 23:30:25 +02:00
#include "p2p/p2p.h"
Add WPS IE into (Re)Association Response frame if WPS is used If the associating station indicates that it is intents to use WPS by including WPS IE in (Re)Association Request frame, include WPS IE in (Re)Association Response frame.
2010-05-26 17:46:08 +02:00
#include "wps/wps.h"
FST: Send FST Action frames to AP mode processing Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-21 14:30:48 +01:00
#include "fst/fst.h"
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
#include "hostapd.h"
#include "beacon.h"
#include "ieee802_11_auth.h"
#include "sta_info.h"
#include "ieee802_1x.h"
Rename some src/ap files to avoid duplicate file names Doxygen and some build tools may get a bit confused about same file name being used in different directories. Clean this up a bit by renaming some of the duplicated file names in src/ap.
2009-12-25 23:05:40 +01:00
#include "wpa_auth.h"
SAE: Add support for PMKSA caching on the AP side This makes hostapd create PMKSA cache entries from SAE authentication and allow PMKSA caching to be used with the SAE AKM. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-10-18 12:00:29 +02:00
#include "pmksa_cache_auth.h"
Move generic AP functionality implementation into src/ap This code can be shared by both hostapd and wpa_supplicant and this is an initial step in getting the generic code moved to be under the src directories. Couple of generic files still remain under the hostapd directory due to direct dependencies to files there. Once the dependencies have been removed, they will also be moved to the src/ap directory to allow wpa_supplicant to be built without requiring anything from the hostapd directory.
2009-12-25 00:12:50 +01:00
#include "wmm.h"
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
#include "ap_list.h"
#include "accounting.h"
Rename some src/ap files to avoid duplicate file names Doxygen and some build tools may get a bit confused about same file name being used in different directories. Clean this up a bit by renaming some of the duplicated file names in src/ap.
2009-12-25 23:05:40 +01:00
#include "ap_config.h"
#include "ap_mlme.h"
P2P: Extend P2P manager functionality to work with driver MLME Add P2P IE into Beacon, Probe Response, and (Re)Association Request frames for drivers that generate this frames internally.
2010-10-08 17:16:07 +02:00
#include "p2p_hostapd.h"
hostapd: Start removing struct hostapd_driver_ops abstraction Commit bf65bc638fe438b96f2986580ad167d5e276ef4c started the path to add this new abstraction for driver operations in AP mode to allow wpa_supplicant to control AP mode operations. At that point, the extra abstraction was needed, but it is not needed anymore since hostapd and wpa_supplicant share the same struct wpa_driver_ops. Start removing the unneeded abstraction by converting send_mgmt_frame() to an inline function, hostapd_drv_send_mlme(). This is similar to the design that is used in wpa_supplicant and that was used in hostapd in the past (hostapd_send_mgmt_frame() inline function).
2010-11-24 14:19:50 +01:00
#include "ap_drv_ops.h"
WNM: Enable WNM-Sleep Mode configuration with hostapd SME/MLME This allows hostapd to process WNM-Sleep Mode Request when using the internal SME/MLME. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-16 18:16:17 +01:00
#include "wnm_ap.h"
Add option to reject authentication on 2.4 GHz from dualband STA The new no_auth_if_seen_on=<ifname> parameter can now be used to configure hostapd to reject authentication from a station that was seen on another radio. This can be used with enabled track_sta_max_num configuration on another interface controlled by the same hostapd process to reject authentication attempts from a station that has been detected to be capable of operating on another band, e.g., to try to reduce likelihood of the station selecting a 2.4 GHz BSS when the AP operates both a 2.4 GHz and 5 GHz BSS concurrently. Note: Enabling this can cause connectivity issues and increase latency for connecting with the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 18:00:03 +02:00
#include "hw_features.h"
Rename some src/ap files to avoid duplicate file names Doxygen and some build tools may get a bit confused about same file name being used in different directories. Clean this up a bit by renaming some of the duplicated file names in src/ap.
2009-12-25 23:05:40 +01:00
#include "ieee802_11.h"
hostapd: Configure spectrum management capability Add configuration of Spectrum Management subfield in the Capability Information of Beacon, Probe Response, and Association Response frames. Spectrum Management bit is set when directly requested by new configuration option spectrum_mgmt_required=1 or when AP is running on DFS channels. In the future, also TPC shall require this bit to be set. Signed-hostap: Srinivasan <srinivasanb@posedge.com> Signed-hostap: Chaitanya T K <chaitanyatk@posedge.com> Signed-hostap: Marek Puzyniak <marek.puzyniak@tieto.com>
2014-02-21 14:42:18 +01:00
#include "dfs.h"
MBO: Track STA cellular data capability from association request This makes hostapd parse the MBO attribute in (Re)Association Request frame and track the cellular data capability (mbo_cell_capa=<val> in STA control interface command). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-02-22 12:03:28 +01:00
#include "mbo_ap.h"
hostapd: Handle Neighbor Report Request frame Process Neighbor Report Request frame and send Neighbor Report Response frame based on the configured neighbor report data. Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-04-06 18:42:09 +02:00
#include "rrm.h"
Passive Client Taxonomy Implement the signature mechanism described in the paper "Passive Taxonomy of Wifi Clients using MLME Frame Contents" published by Denton Gentry and Avery Pennarun. http://research.google.com/pubs/pub45429.html https://arxiv.org/abs/1608.01725 This involves: 1. Add a CONFIG_TAXONOMY compile option. Enabling taxonomy incurs a memory overhead of up to several kilobytes per associated station. 2. If enabled, store the Probe Request and (Re)Associate Request frame in struct sta_info. 3. Implement code to extract the ID of each Information Element, plus selected fields and bitmasks from certain IEs, into a descriptive text string. This is done in a new source file, src/ap/taxonomy.c. 4. Implement a "signature qq:rr:ss:tt:uu:vv" command in hostapd_cli to retrieve the signature. Signatures take the form of a text string. For example, a signature for the Nexus 5X is: wifi4|probe:0,1,127,45,191,htcap:01ef,htagg:03,htmcs:0000ffff,vhtcap:338061b2, vhtrxmcs:030cfffa,vhttxmcs:030cfffa,extcap:00000a0201000040|assoc:0,1,48,45, 221(0050f2,2),191,127,htcap:01ef,htagg:03,htmcs:0000ffff,vhtcap:339071b2, vhtrxmcs:030cfffa,vhttxmcs:030cfffa,extcap:0000000000000040 Signed-off-by: dgentry@google.com (Denton Gentry) Signed-off-by: denny@geekhold.com (Denton Gentry) Signed-off-by: rofrankel@google.com (Richard Frankel) Signed-off-by: richard@frankel.tv (Richard Frankel)
2016-08-15 06:42:48 +02:00
#include "taxonomy.h"
FILS: Move HLP request handling into a separate file This is independent functionality from the core IEEE 802.11 management handling and will increase significantly in size, so it is cleaner to maintain this in a separate source code file. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:00:12 +01:00
#include "fils_hlp.h"
DPP: Integration for hostapd This adds DPP bootstrapping, authentication, and configuration into hostapd similarly to how the design was integrated in wpa_supplicant. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-06-15 21:16:45 +02:00
#include "dpp_hostapd.h"
#include "gas_query_ap.h"
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
FILS: Move authentication response handling into a helper function This can be reused when splitting handle_auth_fils() to support the driver-based AP SME case. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
#ifdef CONFIG_FILS
static struct wpabuf *
prepare_auth_resp_fils(struct hostapd_data *hapd,
struct sta_info *sta, u16 *resp,
struct rsn_pmksa_cache_entry *pmksa,
struct wpabuf *erp_resp,
const u8 *msk, size_t msk_len,
int *is_pub);
#endif /* CONFIG_FILS */
AP: Support PASN with FILS key derivation As the PASN FILS authentication is only defined for FILS SK without PFS, and to support PASN authentication with FILS, implement the PASN with FILS processing as part of the PASN handling and not as part of the WPA Authenticator state machine. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:56 +01:00
#ifdef CONFIG_PASN
static int handle_auth_pasn_resp(struct hostapd_data *hapd,
struct sta_info *sta,
struct rsn_pmksa_cache_entry *pmksa,
u16 status);
#ifdef CONFIG_FILS
static void pasn_fils_auth_resp(struct hostapd_data *hapd,
struct sta_info *sta, u16 status,
struct wpabuf *erp_resp,
const u8 *msk, size_t msk_len);
#endif /* CONFIG_FILS */
#endif /* CONFIG_PASN */
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
static void handle_auth(struct hostapd_data *hapd,
const struct ieee80211_mgmt *mgmt, size_t len,
int rssi, int from_queue);
FILS: Move authentication response handling into a helper function This can be reused when splitting handle_auth_fils() to support the driver-based AP SME case. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
hostapd: Add Multi-AP protocol support The purpose of Multi-AP specification is to enable inter-operability across Wi-Fi access points (APs) from different vendors. This patch introduces one new configuration parameter 'multi_ap' to enable Multi-AP functionality and to configure the BSS as a backhaul and/or fronthaul BSS. Advertise vendor specific Multi-AP capabilities in (Re)Association Response frame, if Multi-AP functionality is enabled through the configuration parameter. A backhaul AP must support receiving both 3addr and 4addr frames from a backhaul STA, so create a VLAN for it just like is done for WDS, i.e., by calling hostapd_set_wds_sta(). Since Multi-AP requires WPA2 (never WEP), we can safely call hostapd_set_wds_encryption() as well and we can reuse the entire WDS condition. To parse the Multi-AP Extension subelement, we use get_ie(): even though that function is meant for parsing IEs, it works for subelements. Signed-off-by: Venkateswara Naralasetty <vnaralas@codeaurora.org> Signed-off-by: Jouni Malinen <jouni@codeaurora.org> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2018-12-05 11:23:51 +01:00
u8 * hostapd_eid_multi_ap(struct hostapd_data *hapd, u8 *eid)
{
u8 multi_ap_val = 0;
if (!hapd->conf->multi_ap)
return eid;
if (hapd->conf->multi_ap & BACKHAUL_BSS)
multi_ap_val |= MULTI_AP_BACKHAUL_BSS;
if (hapd->conf->multi_ap & FRONTHAUL_BSS)
multi_ap_val |= MULTI_AP_FRONTHAUL_BSS;
return eid + add_multi_ap_ie(eid, 9, multi_ap_val);
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
u8 * hostapd_eid_supp_rates(struct hostapd_data *hapd, u8 *eid)
{
u8 *pos = eid;
int i, num, count;
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
int h2e_required;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (hapd->iface->current_rates == NULL)
return eid;
*pos++ = WLAN_EID_SUPP_RATES;
num = hapd->iface->num_rates;
hostapd: Add require_ht configuration parameter This can be used to configure hostapd to reject association with any station that does not support HT PHY.
2011-02-09 14:08:47 +01:00
if (hapd->iconf->ieee80211n && hapd->iconf->require_ht)
num++;
hostapd: Add VHT PHY selector if VHT is required If VHT is required, add the VHT PHY selector to the (extended) supported rates IE. Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2012-11-24 16:27:16 +01:00
if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht)
num++;
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
h2e_required = (hapd->conf->sae_pwe == 1 ||
hostapd_sae_pw_id_in_use(hapd->conf) == 2) &&
SAE: Special test mode sae_pwe=3 for looping with password identifier The new sae_pwe=3 mode can be used to test non-compliant behavior with SAE Password Identifiers. This can be used to force use of hunting-and-pecking loop for PWE derivation when Password Identifier is used. This is not allowed by the standard and as such, this functionality is aimed at compliance testing. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-02-10 03:59:10 +01:00
hapd->conf->sae_pwe != 3 &&
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt);
if (h2e_required)
SAE: Advertise BSS membership selector for H2E-only case If hostapd is configured to enable only the hash-to-element version of SAE PWE derivation (sae_pwe=1), advertise BSS membership selector to indicate this. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-05 10:54:47 +02:00
num++;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (num > 8) {
/* rest of the rates are encoded in Extended supported
* rates element */
num = 8;
}
*pos++ = num;
for (i = 0, count = 0; i < hapd->iface->num_rates && count < num;
i++) {
count++;
*pos = hapd->iface->current_rates[i].rate / 5;
if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
*pos |= 0x80;
pos++;
}
hostapd: Add VHT PHY selector if VHT is required If VHT is required, add the VHT PHY selector to the (extended) supported rates IE. Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2012-11-24 16:27:16 +01:00
if (hapd->iconf->ieee80211n && hapd->iconf->require_ht && count < 8) {
count++;
hostapd: Add require_ht configuration parameter This can be used to configure hostapd to reject association with any station that does not support HT PHY.
2011-02-09 14:08:47 +01:00
*pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY;
hostapd: Add VHT PHY selector if VHT is required If VHT is required, add the VHT PHY selector to the (extended) supported rates IE. Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2012-11-24 16:27:16 +01:00
}
if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht && count < 8) {
count++;
*pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY;
}
hostapd: Add require_ht configuration parameter This can be used to configure hostapd to reject association with any station that does not support HT PHY.
2011-02-09 14:08:47 +01:00
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
if (h2e_required && count < 8) {
SAE: Advertise BSS membership selector for H2E-only case If hostapd is configured to enable only the hash-to-element version of SAE PWE derivation (sae_pwe=1), advertise BSS membership selector to indicate this. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-05 10:54:47 +02:00
count++;
*pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_SAE_H2E_ONLY;
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
return pos;
}
u8 * hostapd_eid_ext_supp_rates(struct hostapd_data *hapd, u8 *eid)
{
u8 *pos = eid;
int i, num, count;
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
int h2e_required;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (hapd->iface->current_rates == NULL)
return eid;
num = hapd->iface->num_rates;
hostapd: Add require_ht configuration parameter This can be used to configure hostapd to reject association with any station that does not support HT PHY.
2011-02-09 14:08:47 +01:00
if (hapd->iconf->ieee80211n && hapd->iconf->require_ht)
num++;
hostapd: Add VHT PHY selector if VHT is required If VHT is required, add the VHT PHY selector to the (extended) supported rates IE. Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2012-11-24 16:27:16 +01:00
if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht)
num++;
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
h2e_required = (hapd->conf->sae_pwe == 1 ||
hostapd_sae_pw_id_in_use(hapd->conf) == 2) &&
SAE: Special test mode sae_pwe=3 for looping with password identifier The new sae_pwe=3 mode can be used to test non-compliant behavior with SAE Password Identifiers. This can be used to force use of hunting-and-pecking loop for PWE derivation when Password Identifier is used. This is not allowed by the standard and as such, this functionality is aimed at compliance testing. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-02-10 03:59:10 +01:00
hapd->conf->sae_pwe != 3 &&
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt);
if (h2e_required)
SAE: Advertise BSS membership selector for H2E-only case If hostapd is configured to enable only the hash-to-element version of SAE PWE derivation (sae_pwe=1), advertise BSS membership selector to indicate this. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-05 10:54:47 +02:00
num++;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (num <= 8)
return eid;
num -= 8;
*pos++ = WLAN_EID_EXT_SUPP_RATES;
*pos++ = num;
for (i = 0, count = 0; i < hapd->iface->num_rates && count < num + 8;
i++) {
count++;
if (count <= 8)
continue; /* already in SuppRates IE */
*pos = hapd->iface->current_rates[i].rate / 5;
if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
*pos |= 0x80;
pos++;
}
hostapd: Add VHT PHY selector if VHT is required If VHT is required, add the VHT PHY selector to the (extended) supported rates IE. Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2012-11-24 16:27:16 +01:00
if (hapd->iconf->ieee80211n && hapd->iconf->require_ht) {
count++;
if (count > 8)
*pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY;
}
if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht) {
count++;
if (count > 8)
*pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY;
}
hostapd: Add require_ht configuration parameter This can be used to configure hostapd to reject association with any station that does not support HT PHY.
2011-02-09 14:08:47 +01:00
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
if (h2e_required) {
SAE: Advertise BSS membership selector for H2E-only case If hostapd is configured to enable only the hash-to-element version of SAE PWE derivation (sae_pwe=1), advertise BSS membership selector to indicate this. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-05 10:54:47 +02:00
count++;
if (count > 8)
*pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_SAE_H2E_ONLY;
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
return pos;
}
Send RM Enabled Capabilities element in (Re)Association Response frame (Re)Association Response frames should include radio measurement capabilities in order to let stations know if they can, e.g., use neighbor requests. I tested this commit with a Samsung S8, which does not send neighbor requests without this commit and sends them afterwards. Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
2020-01-24 17:24:53 +01:00
u8 * hostapd_eid_rm_enabled_capab(struct hostapd_data *hapd, u8 *eid,
size_t len)
{
size_t i;
for (i = 0; i < RRM_CAPABILITIES_IE_LEN; i++) {
if (hapd->conf->radio_measurements[i])
break;
}
if (i == RRM_CAPABILITIES_IE_LEN || len < 2 + RRM_CAPABILITIES_IE_LEN)
return eid;
*eid++ = WLAN_EID_RRM_ENABLED_CAPABILITIES;
*eid++ = RRM_CAPABILITIES_IE_LEN;
os_memcpy(eid, hapd->conf->radio_measurements, RRM_CAPABILITIES_IE_LEN);
return eid + RRM_CAPABILITIES_IE_LEN;
}
Remove unused leftover from multi-SSID design The multi-SSID design that used a single beaconing BSSID with multiple SSIDs was never completed in this repository, so there is no need to maintain the per-STA ssid/ssid_probe pointers that could only point to &hapd->conf->ssid. Save some memory and reduce code complexity by removing this unused partial capability. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-04-20 23:33:25 +02:00
u16 hostapd_own_capab_info(struct hostapd_data *hapd)
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
{
int capab = WLAN_CAPABILITY_ESS;
Make WEP functionality an optional build parameter WEP should not be used for anything anymore. As a step towards removing it completely, move all WEP related functionality to be within CONFIG_WEP blocks. This will be included in builds only if CONFIG_WEP=y is explicitly set in build configuration. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-02-29 15:52:39 +01:00
int privacy = 0;
hostapd: Configure spectrum management capability Add configuration of Spectrum Management subfield in the Capability Information of Beacon, Probe Response, and Association Response frames. Spectrum Management bit is set when directly requested by new configuration option spectrum_mgmt_required=1 or when AP is running on DFS channels. In the future, also TPC shall require this bit to be set. Signed-hostap: Srinivasan <srinivasanb@posedge.com> Signed-hostap: Chaitanya T K <chaitanyatk@posedge.com> Signed-hostap: Marek Puzyniak <marek.puzyniak@tieto.com>
2014-02-21 14:42:18 +01:00
int dfs;
hostapd: Extend the configuration of RRM capabilities Extend the radio_measurements parameter to save all the supported RRM capabilities as it's used in RM enabled capabilities element. Make this parameter not directly configurable via config file (though, keep the radio_measurements parameter for some time for backwards compatibility). Instead, add a configuration option to enable neighbor report via radio measurements. Other features can be added later as well. Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-04-06 18:42:06 +02:00
int i;
hostapd: Configure spectrum management capability Add configuration of Spectrum Management subfield in the Capability Information of Beacon, Probe Response, and Association Response frames. Spectrum Management bit is set when directly requested by new configuration option spectrum_mgmt_required=1 or when AP is running on DFS channels. In the future, also TPC shall require this bit to be set. Signed-hostap: Srinivasan <srinivasanb@posedge.com> Signed-hostap: Chaitanya T K <chaitanyatk@posedge.com> Signed-hostap: Marek Puzyniak <marek.puzyniak@tieto.com>
2014-02-21 14:42:18 +01:00
/* Check if any of configured channels require DFS */
dfs = hostapd_is_dfs_required(hapd->iface);
if (dfs < 0) {
wpa_printf(MSG_WARNING, "Failed to check if DFS is required; ret=%d",
dfs);
dfs = 0;
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (hapd->iface->num_sta_no_short_preamble == 0 &&
hapd->iconf->preamble == SHORT_PREAMBLE)
capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
Make WEP functionality an optional build parameter WEP should not be used for anything anymore. As a step towards removing it completely, move all WEP related functionality to be within CONFIG_WEP blocks. This will be included in builds only if CONFIG_WEP=y is explicitly set in build configuration. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-02-29 15:52:39 +01:00
#ifdef CONFIG_WEP
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
privacy = hapd->conf->ssid.wep.keys_set;
if (hapd->conf->ieee802_1x &&
(hapd->conf->default_wep_key_len ||
hapd->conf->individual_wep_key_len))
privacy = 1;
Make WEP functionality an optional build parameter WEP should not be used for anything anymore. As a step towards removing it completely, move all WEP related functionality to be within CONFIG_WEP blocks. This will be included in builds only if CONFIG_WEP=y is explicitly set in build configuration. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-02-29 15:52:39 +01:00
#endif /* CONFIG_WEP */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (hapd->conf->wpa)
privacy = 1;
HS 2.0R2 AP: Add OSEN implementation Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2013-07-23 20:25:21 +02:00
#ifdef CONFIG_HS20
if (hapd->conf->osen)
privacy = 1;
#endif /* CONFIG_HS20 */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (privacy)
capab |= WLAN_CAPABILITY_PRIVACY;
if (hapd->iface->current_mode &&
hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G &&
hapd->iface->num_sta_no_short_slot_time == 0)
capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
hostapd: Configure spectrum management capability Add configuration of Spectrum Management subfield in the Capability Information of Beacon, Probe Response, and Association Response frames. Spectrum Management bit is set when directly requested by new configuration option spectrum_mgmt_required=1 or when AP is running on DFS channels. In the future, also TPC shall require this bit to be set. Signed-hostap: Srinivasan <srinivasanb@posedge.com> Signed-hostap: Chaitanya T K <chaitanyatk@posedge.com> Signed-hostap: Marek Puzyniak <marek.puzyniak@tieto.com>
2014-02-21 14:42:18 +01:00
/*
* Currently, Spectrum Management capability bit is set when directly
* requested in configuration by spectrum_mgmt_required or when AP is
* running on DFS channel.
* TODO: Also consider driver support for TPC to set Spectrum Mgmt bit
*/
if (hapd->iface->current_mode &&
hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211A &&
(hapd->iconf->spectrum_mgmt_required || dfs))
capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
hostapd: Extend the configuration of RRM capabilities Extend the radio_measurements parameter to save all the supported RRM capabilities as it's used in RM enabled capabilities element. Make this parameter not directly configurable via config file (though, keep the radio_measurements parameter for some time for backwards compatibility). Instead, add a configuration option to enable neighbor report via radio measurements. Other features can be added later as well. Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-04-06 18:42:06 +02:00
for (i = 0; i < RRM_CAPABILITIES_IE_LEN; i++) {
if (hapd->conf->radio_measurements[i]) {
capab |= IEEE80211_CAP_RRM;
break;
}
}
RRM: Add AP mode minimal advertisement support for testing The new hostapd.conf radio_measurements parameter can now be used to configure a test build to advertise support for radio measurements with neighbor report enabled. There is no real functionality that would actually process the request, i.e., this only for the purpose of minimal STA side testing for now. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-12 19:45:31 +01:00
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
return capab;
}
Make WEP functionality an optional build parameter WEP should not be used for anything anymore. As a step towards removing it completely, move all WEP related functionality to be within CONFIG_WEP blocks. This will be included in builds only if CONFIG_WEP=y is explicitly set in build configuration. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-02-29 15:52:39 +01:00
#ifdef CONFIG_WEP
Add build option to remove all internal RC4 uses The new CONFIG_NO_RC4=y build option can be used to remove all internal hostapd and wpa_supplicant uses of RC4. It should be noted that external uses (e.g., within a TLS library) do not get disabled when doing this. This removes capability of supporting WPA/TKIP, dynamic WEP keys with IEEE 802.1X, WEP shared key authentication, and MSCHAPv2 password changes. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-01 22:37:07 +02:00
#ifndef CONFIG_NO_RC4
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
static u16 auth_shared_key(struct hostapd_data *hapd, struct sta_info *sta,
Mark management frame processing functions to use const buffer
2009-12-13 22:25:30 +01:00
u16 auth_transaction, const u8 *challenge,
int iswep)
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
{
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
"authentication (shared key, transaction %d)",
auth_transaction);
if (auth_transaction == 1) {
if (!sta->challenge) {
/* Generate a pseudo-random challenge */
u8 key[8];
Use os_get_random() for Shared Key authentication challenge Do not use the system clock or os_random() that uses a low quality PRNG as part of the pseudo-random challenge in auth_shared_key(). The construction can be improved upon by replacing it with a call to os_get_random(), which uses a high quality PRNG. Signed-off-by: Nick Lowe <nick.lowe@lugatech.com>
2016-02-09 15:43:21 +01:00
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
sta->challenge = os_zalloc(WLAN_AUTH_CHALLENGE_LEN);
if (sta->challenge == NULL)
return WLAN_STATUS_UNSPECIFIED_FAILURE;
Use os_get_random() for Shared Key authentication challenge Do not use the system clock or os_random() that uses a low quality PRNG as part of the pseudo-random challenge in auth_shared_key(). The construction can be improved upon by replacing it with a call to os_get_random(), which uses a high quality PRNG. Signed-off-by: Nick Lowe <nick.lowe@lugatech.com>
2016-02-09 15:43:21 +01:00
if (os_get_random(key, sizeof(key)) < 0) {
os_free(sta->challenge);
sta->challenge = NULL;
return WLAN_STATUS_UNSPECIFIED_FAILURE;
}
Remove rc4() wrapper This is not really of that much use since rc4_skip() can be used as easily. In addition, rc4 has caused some symbol conflicts in the past, so it is easier to live without that as an exported symbol.
2009-08-16 18:57:50 +02:00
rc4_skip(key, sizeof(key), 0,
sta->challenge, WLAN_AUTH_CHALLENGE_LEN);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
return 0;
}
if (auth_transaction != 3)
return WLAN_STATUS_UNSPECIFIED_FAILURE;
/* Transaction 3 */
if (!iswep || !sta->challenge || !challenge ||
WEP shared key: Use os_memcmp_const() for hash/password comparisons This makes the implementation less likely to provide useful timing information to potential attackers from comparisons of information received from a remote device and private material known only by the authorized devices. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-06-29 19:27:45 +02:00
os_memcmp_const(sta->challenge, challenge,
WLAN_AUTH_CHALLENGE_LEN)) {
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO,
"shared key authentication - invalid "
"challenge-response");
return WLAN_STATUS_CHALLENGE_FAIL;
}
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
"authentication OK (shared key)");
sta->flags |= WLAN_STA_AUTH;
wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
os_free(sta->challenge);
sta->challenge = NULL;
return 0;
}
Add build option to remove all internal RC4 uses The new CONFIG_NO_RC4=y build option can be used to remove all internal hostapd and wpa_supplicant uses of RC4. It should be noted that external uses (e.g., within a TLS library) do not get disabled when doing this. This removes capability of supporting WPA/TKIP, dynamic WEP keys with IEEE 802.1X, WEP shared key authentication, and MSCHAPv2 password changes. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-01 22:37:07 +02:00
#endif /* CONFIG_NO_RC4 */
Make WEP functionality an optional build parameter WEP should not be used for anything anymore. As a step towards removing it completely, move all WEP related functionality to be within CONFIG_WEP blocks. This will be included in builds only if CONFIG_WEP=y is explicitly set in build configuration. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-02-29 15:52:39 +01:00
#endif /* CONFIG_WEP */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
SAE: A bit optimized sae_confirm_immediate=2 for testing purposes sae_confirm_immediate=2 can now be used in CONFIG_TESTING_OPTIONS=y builds to minimize the latency between SAE Commit and SAE Confirm by postponing transmission of SAE Commit until the SAE Confirm frame is generated. This does not have significant impact, but can get the frames tiny bit closer to each other over the air to increase testing coverage. The only difference between sae_confirm_immediate 1 and 2 is in the former deriving KCK, PMK, PMKID, and CN between transmission of the frames (i.e., a small number of hash operations). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-08 19:52:26 +01:00
static int send_auth_reply(struct hostapd_data *hapd, struct sta_info *sta,
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
const u8 *dst, const u8 *bssid,
u16 auth_alg, u16 auth_transaction, u16 resp,
hostapd: Add send_auth_reply() caller info in debug logging This can help one understand better what happens during the authentication exchange. Signed-off-by: Ben Greear <greearb@candelatech.com>
2017-12-07 18:14:49 +01:00
const u8 *ies, size_t ies_len, const char *dbg)
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
{
struct ieee80211_mgmt *reply;
u8 *buf;
size_t rlen;
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
int reply_res = WLAN_STATUS_UNSPECIFIED_FAILURE;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
rlen = IEEE80211_HDRLEN + sizeof(reply->u.auth) + ies_len;
buf = os_zalloc(rlen);
if (buf == NULL)
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
return -1;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
reply = (struct ieee80211_mgmt *) buf;
reply->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
WLAN_FC_STYPE_AUTH);
os_memcpy(reply->da, dst, ETH_ALEN);
os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
os_memcpy(reply->bssid, bssid, ETH_ALEN);
reply->u.auth.auth_alg = host_to_le16(auth_alg);
reply->u.auth.auth_transaction = host_to_le16(auth_transaction);
reply->u.auth.status_code = host_to_le16(resp);
if (ies && ies_len)
os_memcpy(reply->u.auth.variable, ies, ies_len);
wpa_printf(MSG_DEBUG, "authentication reply: STA=" MACSTR
hostapd: Add send_auth_reply() caller info in debug logging This can help one understand better what happens during the authentication exchange. Signed-off-by: Ben Greear <greearb@candelatech.com>
2017-12-07 18:14:49 +01:00
" auth_alg=%d auth_transaction=%d resp=%d (IE len=%lu) (dbg=%s)",
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
MAC2STR(dst), auth_alg, auth_transaction,
hostapd: Add send_auth_reply() caller info in debug logging This can help one understand better what happens during the authentication exchange. Signed-off-by: Ben Greear <greearb@candelatech.com>
2017-12-07 18:14:49 +01:00
resp, (unsigned long) ies_len, dbg);
SAE: A bit optimized sae_confirm_immediate=2 for testing purposes sae_confirm_immediate=2 can now be used in CONFIG_TESTING_OPTIONS=y builds to minimize the latency between SAE Commit and SAE Confirm by postponing transmission of SAE Commit until the SAE Confirm frame is generated. This does not have significant impact, but can get the frames tiny bit closer to each other over the air to increase testing coverage. The only difference between sae_confirm_immediate 1 and 2 is in the former deriving KCK, PMK, PMKID, and CN between transmission of the frames (i.e., a small number of hash operations). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-08 19:52:26 +01:00
#ifdef CONFIG_TESTING_OPTIONS
#ifdef CONFIG_SAE
if (hapd->conf->sae_confirm_immediate == 2 &&
auth_alg == WLAN_AUTH_SAE) {
SAE: Check sta pointer more consistently in testing code send_auth_reply() could be called with sta == NULL in certain error conditions. While that is not applicable for this special test functionality for SAE, the inconsistent checks for the sta pointer could result in warnings from static analyzers. Address this by explicitly checking the sta pointer here. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-08 15:32:47 +01:00
if (auth_transaction == 1 && sta &&
SAE: A bit optimized sae_confirm_immediate=2 for testing purposes sae_confirm_immediate=2 can now be used in CONFIG_TESTING_OPTIONS=y builds to minimize the latency between SAE Commit and SAE Confirm by postponing transmission of SAE Commit until the SAE Confirm frame is generated. This does not have significant impact, but can get the frames tiny bit closer to each other over the air to increase testing coverage. The only difference between sae_confirm_immediate 1 and 2 is in the former deriving KCK, PMK, PMKID, and CN between transmission of the frames (i.e., a small number of hash operations). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-08 19:52:26 +01:00
(resp == WLAN_STATUS_SUCCESS ||
SAE-PK: AP functionality This adds AP side functionality for SAE-PK. The new sae_password configuration parameters can now be used to enable SAE-PK mode whenever SAE is enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
resp == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
resp == WLAN_STATUS_SAE_PK)) {
SAE: A bit optimized sae_confirm_immediate=2 for testing purposes sae_confirm_immediate=2 can now be used in CONFIG_TESTING_OPTIONS=y builds to minimize the latency between SAE Commit and SAE Confirm by postponing transmission of SAE Commit until the SAE Confirm frame is generated. This does not have significant impact, but can get the frames tiny bit closer to each other over the air to increase testing coverage. The only difference between sae_confirm_immediate 1 and 2 is in the former deriving KCK, PMK, PMKID, and CN between transmission of the frames (i.e., a small number of hash operations). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-08 19:52:26 +01:00
wpa_printf(MSG_DEBUG,
"TESTING: Postpone SAE Commit transmission until Confirm is ready");
os_free(sta->sae_postponed_commit);
sta->sae_postponed_commit = buf;
sta->sae_postponed_commit_len = rlen;
return WLAN_STATUS_SUCCESS;
}
if (auth_transaction == 2 && sta && sta->sae_postponed_commit) {
wpa_printf(MSG_DEBUG,
"TESTING: Send postponed SAE Commit first, immediately followed by SAE Confirm");
if (hostapd_drv_send_mlme(hapd,
sta->sae_postponed_commit,
sta->sae_postponed_commit_len,
0, NULL, 0, 0) < 0)
wpa_printf(MSG_INFO, "send_auth_reply: send failed");
os_free(sta->sae_postponed_commit);
sta->sae_postponed_commit = NULL;
sta->sae_postponed_commit_len = 0;
}
}
#endif /* CONFIG_SAE */
#endif /* CONFIG_TESTING_OPTIONS */
Make hostapd_drv_send_mlme() more generic Merge hostapd_drv_send_mlme_csa() functionality into hostapd_drv_send_mlme() to get a single driver ops handler function for hostapd. In addition, add a new no_encrypt parameter in preparation for functionality that is needed to get rid of the separate send_frame() driver op. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-01-03 12:34:37 +01:00
if (hostapd_drv_send_mlme(hapd, reply, rlen, 0, NULL, 0, 0) < 0)
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
wpa_printf(MSG_INFO, "send_auth_reply: send failed");
else
reply_res = WLAN_STATUS_SUCCESS;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
os_free(buf);
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
return reply_res;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#ifdef CONFIG_IEEE80211R_AP
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
static void handle_auth_ft_finish(void *ctx, const u8 *dst, const u8 *bssid,
u16 auth_transaction, u16 status,
const u8 *ies, size_t ies_len)
{
struct hostapd_data *hapd = ctx;
struct sta_info *sta;
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
int reply_res;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
SAE: A bit optimized sae_confirm_immediate=2 for testing purposes sae_confirm_immediate=2 can now be used in CONFIG_TESTING_OPTIONS=y builds to minimize the latency between SAE Commit and SAE Confirm by postponing transmission of SAE Commit until the SAE Confirm frame is generated. This does not have significant impact, but can get the frames tiny bit closer to each other over the air to increase testing coverage. The only difference between sae_confirm_immediate 1 and 2 is in the former deriving KCK, PMK, PMKID, and CN between transmission of the frames (i.e., a small number of hash operations). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-08 19:52:26 +01:00
reply_res = send_auth_reply(hapd, NULL, dst, bssid, WLAN_AUTH_FT,
hostapd: Add send_auth_reply() caller info in debug logging This can help one understand better what happens during the authentication exchange. Signed-off-by: Ben Greear <greearb@candelatech.com>
2017-12-07 18:14:49 +01:00
auth_transaction, status, ies, ies_len,
"auth-ft-finish");
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
sta = ap_get_sta(hapd, dst);
if (sta == NULL)
return;
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
if (sta->added_unassoc && (reply_res != WLAN_STATUS_SUCCESS ||
status != WLAN_STATUS_SUCCESS)) {
hostapd_drv_sta_remove(hapd, sta->addr);
sta->added_unassoc = 0;
return;
}
if (status != WLAN_STATUS_SUCCESS)
return;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
hostapd_logger(hapd, dst, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG, "authentication OK (FT)");
sta->flags |= WLAN_STA_AUTH;
mlme_authenticate_indication(hapd, sta);
}
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#endif /* CONFIG_IEEE80211R_AP */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
SAE: Print state changes in debug log This makes it easier to follow state changes in SAE protocol instances. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-26 23:07:42 +01:00
static void sae_set_state(struct sta_info *sta, enum sae_state state,
const char *reason)
{
wpa_printf(MSG_DEBUG, "SAE: State %s -> %s for peer " MACSTR " (%s)",
sae_state_txt(sta->sae->state), sae_state_txt(state),
MAC2STR(sta->addr), reason);
sta->sae->state = state;
}
AP: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:53 +01:00
static const char * sae_get_password(struct hostapd_data *hapd,
struct sta_info *sta,
const char *rx_id,
struct sae_password_entry **pw_entry,
struct sae_pt **s_pt,
const struct sae_pk **s_pk)
{
const char *password = NULL;
struct sae_password_entry *pw;
struct sae_pt *pt = NULL;
const struct sae_pk *pk = NULL;
for (pw = hapd->conf->sae_passwords; pw; pw = pw->next) {
if (!is_broadcast_ether_addr(pw->peer_addr) &&
os_memcmp(pw->peer_addr, sta->addr, ETH_ALEN) != 0)
continue;
if ((rx_id && !pw->identifier) || (!rx_id && pw->identifier))
continue;
if (rx_id && pw->identifier &&
os_strcmp(rx_id, pw->identifier) != 0)
continue;
password = pw->password;
pt = pw->pt;
if (!(hapd->conf->mesh & MESH_ENABLED))
pk = pw->pk;
break;
}
if (!password) {
password = hapd->conf->ssid.wpa_passphrase;
pt = hapd->conf->ssid.pt;
}
if (pw_entry)
*pw_entry = pw;
if (s_pt)
*s_pt = pt;
if (s_pk)
*s_pk = pk;
return password;
}
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
static struct wpabuf * auth_build_sae_commit(struct hostapd_data *hapd,
SAE: Determine H2E vs. looping when restarting SAE auth in AP mode If hostapd had existing STA SAE state, e.g., from a previously completed SAE authentication, a new start of a separate SAE authentication (i.e., receiving of a new SAE commit) ended up using some of the previous state. This is problematic for determining whether to H2E vs. looping since the STA is allowed (even if not really expected to) to change between these two alternatives. This could result in trying to use H2E when STA was using looping to derive PWE and that would result in SAE confirm failing. Fix this by determining whether to use H2E or looping for the restarted authentication based on the Status Code in the new SAE commit message instead of previously cached state information. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-25 14:54:11 +02:00
struct sta_info *sta, int update,
int status_code)
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
{
struct wpabuf *buf;
SAE: Add support for using the optional Password Identifier This extends the SAE implementation in both infrastructure and mesh BSS cases to allow an optional Password Identifier to be used. This uses the mechanism added in P802.11REVmd/D1.0. The Password Identifier is configured in a wpa_supplicant network profile as a new string parameter sae_password_id. In hostapd configuration, the existing sae_password parameter has been extended to allow the password identifier (and also a peer MAC address) to be set. In addition, multiple sae_password entries can now be provided to hostapd to allow multiple per-peer and per-identifier passwords to be set. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-19 16:28:01 +02:00
const char *password = NULL;
struct sae_password_entry *pw;
const char *rx_id = NULL;
SAE: H2E version of SAE commit message handling for AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
int use_pt = 0;
struct sae_pt *pt = NULL;
SAE-PK: AP functionality This adds AP side functionality for SAE-PK. The new sae_password configuration parameters can now be used to enable SAE-PK mode whenever SAE is enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
const struct sae_pk *pk = NULL;
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
SAE: H2E version of SAE commit message handling for AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
if (sta->sae->tmp) {
SAE: Add support for using the optional Password Identifier This extends the SAE implementation in both infrastructure and mesh BSS cases to allow an optional Password Identifier to be used. This uses the mechanism added in P802.11REVmd/D1.0. The Password Identifier is configured in a wpa_supplicant network profile as a new string parameter sae_password_id. In hostapd configuration, the existing sae_password parameter has been extended to allow the password identifier (and also a peer MAC address) to be set. In addition, multiple sae_password entries can now be provided to hostapd to allow multiple per-peer and per-identifier passwords to be set. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-19 16:28:01 +02:00
rx_id = sta->sae->tmp->pw_id;
SAE: Move H2E and PK flags to main sae_data This maintains knowledge of whether H2E or PK was used as part of the SAE authentication beyond the removal of temporary state needed during that authentication. This makes it easier to use information about which kind of SAE authentication was used at higher layer functionality. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 11:08:37 +02:00
use_pt = sta->sae->h2e;
SAE-PK: AP functionality This adds AP side functionality for SAE-PK. The new sae_password configuration parameters can now be used to enable SAE-PK mode whenever SAE is enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
#ifdef CONFIG_SAE_PK
os_memcpy(sta->sae->tmp->own_addr, hapd->own_addr, ETH_ALEN);
os_memcpy(sta->sae->tmp->peer_addr, sta->addr, ETH_ALEN);
#endif /* CONFIG_SAE_PK */
SAE: H2E version of SAE commit message handling for AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
}
SAE: Add support for using the optional Password Identifier This extends the SAE implementation in both infrastructure and mesh BSS cases to allow an optional Password Identifier to be used. This uses the mechanism added in P802.11REVmd/D1.0. The Password Identifier is configured in a wpa_supplicant network profile as a new string parameter sae_password_id. In hostapd configuration, the existing sae_password parameter has been extended to allow the password identifier (and also a peer MAC address) to be set. In addition, multiple sae_password entries can now be provided to hostapd to allow multiple per-peer and per-identifier passwords to be set. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-19 16:28:01 +02:00
SAE: Special test mode sae_pwe=3 for looping with password identifier The new sae_pwe=3 mode can be used to test non-compliant behavior with SAE Password Identifiers. This can be used to force use of hunting-and-pecking loop for PWE derivation when Password Identifier is used. This is not allowed by the standard and as such, this functionality is aimed at compliance testing. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-02-10 03:59:10 +01:00
if (rx_id && hapd->conf->sae_pwe != 3)
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
use_pt = 1;
else if (status_code == WLAN_STATUS_SUCCESS)
SAE: Determine H2E vs. looping when restarting SAE auth in AP mode If hostapd had existing STA SAE state, e.g., from a previously completed SAE authentication, a new start of a separate SAE authentication (i.e., receiving of a new SAE commit) ended up using some of the previous state. This is problematic for determining whether to H2E vs. looping since the STA is allowed (even if not really expected to) to change between these two alternatives. This could result in trying to use H2E when STA was using looping to derive PWE and that would result in SAE confirm failing. Fix this by determining whether to use H2E or looping for the restarted authentication based on the Status Code in the new SAE commit message instead of previously cached state information. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-25 14:54:11 +02:00
use_pt = 0;
SAE-PK: AP functionality This adds AP side functionality for SAE-PK. The new sae_password configuration parameters can now be used to enable SAE-PK mode whenever SAE is enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
else if (status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
status_code == WLAN_STATUS_SAE_PK)
SAE: Determine H2E vs. looping when restarting SAE auth in AP mode If hostapd had existing STA SAE state, e.g., from a previously completed SAE authentication, a new start of a separate SAE authentication (i.e., receiving of a new SAE commit) ended up using some of the previous state. This is problematic for determining whether to H2E vs. looping since the STA is allowed (even if not really expected to) to change between these two alternatives. This could result in trying to use H2E when STA was using looping to derive PWE and that would result in SAE confirm failing. Fix this by determining whether to use H2E or looping for the restarted authentication based on the Status Code in the new SAE commit message instead of previously cached state information. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-25 14:54:11 +02:00
use_pt = 1;
AP: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:53 +01:00
password = sae_get_password(hapd, sta, rx_id, &pw, &pt, &pk);
SAE: H2E version of SAE commit message handling for AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
if (!password || (use_pt && !pt)) {
SAE: Add processing of the commit message This adds validation of the received commit messages and key derivation for SAE. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:16:18 +01:00
wpa_printf(MSG_DEBUG, "SAE: No password available");
return NULL;
}
SAE: H2E version of SAE commit message handling for AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
if (update && use_pt &&
sae_prepare_commit_pt(sta->sae, pt, hapd->own_addr, sta->addr,
SAE-PK: AP functionality This adds AP side functionality for SAE-PK. The new sae_password configuration parameters can now be used to enable SAE-PK mode whenever SAE is enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
NULL, pk) < 0)
SAE: H2E version of SAE commit message handling for AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
return NULL;
if (update && !use_pt &&
mesh: Fix SAE anti-clogging functionality for mesh The mesh anti-clogging functionality is implemented partially. This patch fixes to parse anti-clogging request frame and use anti-clogging token. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:40 +01:00
sae_prepare_commit(hapd->own_addr, sta->addr,
SAE: Remove now unused password identifier argument from non-H2E case IEEE Std 802.11-2020 mandates H2E to be used whenever an SAE password identifier is used. While this was already covered in the implementation, the sae_prepare_commit() function still included an argument for specifying the password identifier since that was used in an old test vector. Now that that test vector has been updated, there is no more need for this argument anymore. Simplify the older non-H2E case to not pass through a pointer to the (not really used) password identifier. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-04-09 21:17:29 +02:00
(u8 *) password, os_strlen(password),
SAE: Add generation of the commit message fields This adds derivation of PWE and the needed commit values so that the full SAE commit message can be built. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:06:11 +01:00
sta->sae) < 0) {
wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE");
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
return NULL;
SAE: Add generation of the commit message fields This adds derivation of PWE and the needed commit values so that the full SAE commit message can be built. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:06:11 +01:00
}
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
SAE: VLAN assignment based on SAE Password Identifier The new sae_password parameter [|vlanid=<VLAN ID>] can now be used to assign stations to a specific VLAN based on which SAE Password Identifier they use. This is similar to the WPA2-Enterprise case where the RADIUS server can assign stations to different VLANs and the WPA2-Personal case where vlanid parameter in wpa_psk_file is used. Signed-off-by: Jouni Malinen <j@w1.fi>
2019-02-17 16:22:37 +01:00
if (pw && pw->vlan_id) {
if (!sta->sae->tmp) {
wpa_printf(MSG_INFO,
"SAE: No temporary data allocated - cannot store VLAN ID");
return NULL;
}
sta->sae->tmp->vlan_id = pw->vlan_id;
}
SAE: Add support for using the optional Password Identifier This extends the SAE implementation in both infrastructure and mesh BSS cases to allow an optional Password Identifier to be used. This uses the mechanism added in P802.11REVmd/D1.0. The Password Identifier is configured in a wpa_supplicant network profile as a new string parameter sae_password_id. In hostapd configuration, the existing sae_password parameter has been extended to allow the password identifier (and also a peer MAC address) to be set. In addition, multiple sae_password entries can now be provided to hostapd to allow multiple per-peer and per-identifier passwords to be set. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-19 16:28:01 +02:00
buf = wpabuf_alloc(SAE_COMMIT_MAX_LEN +
(rx_id ? 3 + os_strlen(rx_id) : 0));
SAE: Expose sae_write_commit() error cases to callers Check whether an error is reported from any of the functions that could in theory fail and if so, do not proceed with the partially filled SAE commit buffer. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-08 15:59:42 +01:00
if (buf &&
sae_write_commit(sta->sae, buf, sta->sae->tmp ?
sta->sae->tmp->anti_clogging_token : NULL,
rx_id) < 0) {
wpabuf_free(buf);
buf = NULL;
}
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
return buf;
}
static struct wpabuf * auth_build_sae_confirm(struct hostapd_data *hapd,
struct sta_info *sta)
{
struct wpabuf *buf;
SAE: Add generation of the confirm message fields Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:28:57 +01:00
buf = wpabuf_alloc(SAE_CONFIRM_MAX_LEN);
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
if (buf == NULL)
return NULL;
SAE-PK: Testing functionality to allow behavior overrides The new sae_commit_status and sae_pk_omit configuration parameters and an extra key at the end of sae_password pk argument can be used to override SAE-PK behavior for testing purposes. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-08 13:00:28 +02:00
#ifdef CONFIG_SAE_PK
#ifdef CONFIG_TESTING_OPTIONS
if (sta->sae->tmp)
sta->sae->tmp->omit_pk_elem = hapd->conf->sae_pk_omit;
#endif /* CONFIG_TESTING_OPTIONS */
#endif /* CONFIG_SAE_PK */
SAE-PK: AP functionality This adds AP side functionality for SAE-PK. The new sae_password configuration parameters can now be used to enable SAE-PK mode whenever SAE is enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
if (sae_write_confirm(sta->sae, buf) < 0) {
wpabuf_free(buf);
return NULL;
}
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
return buf;
}
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
static int auth_sae_send_commit(struct hostapd_data *hapd,
struct sta_info *sta,
SAE: Determine H2E vs. looping when restarting SAE auth in AP mode If hostapd had existing STA SAE state, e.g., from a previously completed SAE authentication, a new start of a separate SAE authentication (i.e., receiving of a new SAE commit) ended up using some of the previous state. This is problematic for determining whether to H2E vs. looping since the STA is allowed (even if not really expected to) to change between these two alternatives. This could result in trying to use H2E when STA was using looping to derive PWE and that would result in SAE confirm failing. Fix this by determining whether to use H2E or looping for the restarted authentication based on the Status Code in the new SAE commit message instead of previously cached state information. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-25 14:54:11 +02:00
const u8 *bssid, int update, int status_code)
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
{
struct wpabuf *data;
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
int reply_res;
SAE: H2E version of SAE commit message handling for AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
u16 status;
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
SAE: Determine H2E vs. looping when restarting SAE auth in AP mode If hostapd had existing STA SAE state, e.g., from a previously completed SAE authentication, a new start of a separate SAE authentication (i.e., receiving of a new SAE commit) ended up using some of the previous state. This is problematic for determining whether to H2E vs. looping since the STA is allowed (even if not really expected to) to change between these two alternatives. This could result in trying to use H2E when STA was using looping to derive PWE and that would result in SAE confirm failing. Fix this by determining whether to use H2E or looping for the restarted authentication based on the Status Code in the new SAE commit message instead of previously cached state information. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-25 14:54:11 +02:00
data = auth_build_sae_commit(hapd, sta, update, status_code);
SAE: Add support for using the optional Password Identifier This extends the SAE implementation in both infrastructure and mesh BSS cases to allow an optional Password Identifier to be used. This uses the mechanism added in P802.11REVmd/D1.0. The Password Identifier is configured in a wpa_supplicant network profile as a new string parameter sae_password_id. In hostapd configuration, the existing sae_password parameter has been extended to allow the password identifier (and also a peer MAC address) to be set. In addition, multiple sae_password entries can now be provided to hostapd to allow multiple per-peer and per-identifier passwords to be set. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-19 16:28:01 +02:00
if (!data && sta->sae->tmp && sta->sae->tmp->pw_id)
return WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER;
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
if (data == NULL)
return WLAN_STATUS_UNSPECIFIED_FAILURE;
SAE: Move H2E and PK flags to main sae_data This maintains knowledge of whether H2E or PK was used as part of the SAE authentication beyond the removal of temporary state needed during that authentication. This makes it easier to use information about which kind of SAE authentication was used at higher layer functionality. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 11:08:37 +02:00
if (sta->sae->tmp && sta->sae->pk)
SAE-PK: AP functionality This adds AP side functionality for SAE-PK. The new sae_password configuration parameters can now be used to enable SAE-PK mode whenever SAE is enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
status = WLAN_STATUS_SAE_PK;
SAE: Move H2E and PK flags to main sae_data This maintains knowledge of whether H2E or PK was used as part of the SAE authentication beyond the removal of temporary state needed during that authentication. This makes it easier to use information about which kind of SAE authentication was used at higher layer functionality. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 11:08:37 +02:00
else if (sta->sae->tmp && sta->sae->h2e)
SAE-PK: AP functionality This adds AP side functionality for SAE-PK. The new sae_password configuration parameters can now be used to enable SAE-PK mode whenever SAE is enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
status = WLAN_STATUS_SAE_HASH_TO_ELEMENT;
else
status = WLAN_STATUS_SUCCESS;
SAE-PK: Testing functionality to allow behavior overrides The new sae_commit_status and sae_pk_omit configuration parameters and an extra key at the end of sae_password pk argument can be used to override SAE-PK behavior for testing purposes. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-08 13:00:28 +02:00
#ifdef CONFIG_TESTING_OPTIONS
if (hapd->conf->sae_commit_status >= 0 &&
hapd->conf->sae_commit_status != status) {
wpa_printf(MSG_INFO,
"TESTING: Override SAE commit status code %u --> %d",
status, hapd->conf->sae_commit_status);
status = hapd->conf->sae_commit_status;
}
#endif /* CONFIG_TESTING_OPTIONS */
SAE: A bit optimized sae_confirm_immediate=2 for testing purposes sae_confirm_immediate=2 can now be used in CONFIG_TESTING_OPTIONS=y builds to minimize the latency between SAE Commit and SAE Confirm by postponing transmission of SAE Commit until the SAE Confirm frame is generated. This does not have significant impact, but can get the frames tiny bit closer to each other over the air to increase testing coverage. The only difference between sae_confirm_immediate 1 and 2 is in the former deriving KCK, PMK, PMKID, and CN between transmission of the frames (i.e., a small number of hash operations). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-08 19:52:26 +01:00
reply_res = send_auth_reply(hapd, sta, sta->addr, bssid,
WLAN_AUTH_SAE, 1,
SAE: H2E version of SAE commit message handling for AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
status, wpabuf_head(data),
hostapd: Add send_auth_reply() caller info in debug logging This can help one understand better what happens during the authentication exchange. Signed-off-by: Ben Greear <greearb@candelatech.com>
2017-12-07 18:14:49 +01:00
wpabuf_len(data), "sae-send-commit");
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
wpabuf_free(data);
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
return reply_res;
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
}
static int auth_sae_send_confirm(struct hostapd_data *hapd,
struct sta_info *sta,
const u8 *bssid)
{
struct wpabuf *data;
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
int reply_res;
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
data = auth_build_sae_confirm(hapd, sta);
if (data == NULL)
return WLAN_STATUS_UNSPECIFIED_FAILURE;
SAE: A bit optimized sae_confirm_immediate=2 for testing purposes sae_confirm_immediate=2 can now be used in CONFIG_TESTING_OPTIONS=y builds to minimize the latency between SAE Commit and SAE Confirm by postponing transmission of SAE Commit until the SAE Confirm frame is generated. This does not have significant impact, but can get the frames tiny bit closer to each other over the air to increase testing coverage. The only difference between sae_confirm_immediate 1 and 2 is in the former deriving KCK, PMK, PMKID, and CN between transmission of the frames (i.e., a small number of hash operations). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-08 19:52:26 +01:00
reply_res = send_auth_reply(hapd, sta, sta->addr, bssid,
WLAN_AUTH_SAE, 2,
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
WLAN_STATUS_SUCCESS, wpabuf_head(data),
hostapd: Add send_auth_reply() caller info in debug logging This can help one understand better what happens during the authentication exchange. Signed-off-by: Ben Greear <greearb@candelatech.com>
2017-12-07 18:14:49 +01:00
wpabuf_len(data), "sae-send-confirm");
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
wpabuf_free(data);
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
return reply_res;
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
}
AP: Enable anti clogging handling code in PASN builds without SAE The anti-clogging code was under CONFIG_SAE. Change this so it can be used both with CONFIG_SAE and CONFIG_PASN. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:06 +01:00
#endif /* CONFIG_SAE */
#if defined(CONFIG_SAE) || defined(CONFIG_PASN)
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
AP: Rename SAE anti clogging variables and functions PASN authentication mandates support for comeback flow, which among others can be used for anti-clogging purposes. As the SAE support for anti clogging can also be used for PASN, start modifying the source code so the anti clogging support can be used for both SAE and PASN. As a start, rename some variables/functions etc. so that they would not be SAE specific. The configuration variable is also renamed, but the old version remains available for backwards compatibility. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:05 +01:00
static int use_anti_clogging(struct hostapd_data *hapd)
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
{
struct sta_info *sta;
unsigned int open = 0;
AP: Rename SAE anti clogging variables and functions PASN authentication mandates support for comeback flow, which among others can be used for anti-clogging purposes. As the SAE support for anti clogging can also be used for PASN, start modifying the source code so the anti clogging support can be used for both SAE and PASN. As a start, rename some variables/functions etc. so that they would not be SAE specific. The configuration variable is also renamed, but the old version remains available for backwards compatibility. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:05 +01:00
if (hapd->conf->anti_clogging_threshold == 0)
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
return 1;
for (sta = hapd->sta_list; sta; sta = sta->next) {
AP: Enable anti clogging handling code in PASN builds without SAE The anti-clogging code was under CONFIG_SAE. Change this so it can be used both with CONFIG_SAE and CONFIG_PASN. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:06 +01:00
#ifdef CONFIG_SAE
PASN: Add support for comeback flow in AP mode Reuse the SAE anti-clogging token implementation to support similar design with the PASN comeback cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:08 +01:00
if (sta->sae &&
(sta->sae->state == SAE_COMMITTED ||
sta->sae->state == SAE_CONFIRMED))
open++;
AP: Enable anti clogging handling code in PASN builds without SAE The anti-clogging code was under CONFIG_SAE. Change this so it can be used both with CONFIG_SAE and CONFIG_PASN. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:06 +01:00
#endif /* CONFIG_SAE */
PASN: Add support for comeback flow in AP mode Reuse the SAE anti-clogging token implementation to support similar design with the PASN comeback cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:08 +01:00
#ifdef CONFIG_PASN
if (sta->pasn && sta->pasn->ecdh)
open++;
#endif /* CONFIG_PASN */
AP: Rename SAE anti clogging variables and functions PASN authentication mandates support for comeback flow, which among others can be used for anti-clogging purposes. As the SAE support for anti clogging can also be used for PASN, start modifying the source code so the anti clogging support can be used for both SAE and PASN. As a start, rename some variables/functions etc. so that they would not be SAE specific. The configuration variable is also renamed, but the old version remains available for backwards compatibility. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:05 +01:00
if (open >= hapd->conf->anti_clogging_threshold)
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
return 1;
}
AP: Enable anti clogging handling code in PASN builds without SAE The anti-clogging code was under CONFIG_SAE. Change this so it can be used both with CONFIG_SAE and CONFIG_PASN. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:06 +01:00
#ifdef CONFIG_SAE
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
/* In addition to already existing open SAE sessions, check whether
* there are enough pending commit messages in the processing queue to
* potentially result in too many open sessions. */
if (open + dl_list_len(&hapd->sae_commit_queue) >=
AP: Rename SAE anti clogging variables and functions PASN authentication mandates support for comeback flow, which among others can be used for anti-clogging purposes. As the SAE support for anti clogging can also be used for PASN, start modifying the source code so the anti clogging support can be used for both SAE and PASN. As a start, rename some variables/functions etc. so that they would not be SAE specific. The configuration variable is also renamed, but the old version remains available for backwards compatibility. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:05 +01:00
hapd->conf->anti_clogging_threshold)
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
return 1;
AP: Enable anti clogging handling code in PASN builds without SAE The anti-clogging code was under CONFIG_SAE. Change this so it can be used both with CONFIG_SAE and CONFIG_PASN. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:06 +01:00
#endif /* CONFIG_SAE */
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
return 0;
}
AP: Rename SAE anti clogging variables and functions PASN authentication mandates support for comeback flow, which among others can be used for anti-clogging purposes. As the SAE support for anti clogging can also be used for PASN, start modifying the source code so the anti clogging support can be used for both SAE and PASN. As a start, rename some variables/functions etc. so that they would not be SAE specific. The configuration variable is also renamed, but the old version remains available for backwards compatibility. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:05 +01:00
static int comeback_token_hash(struct hostapd_data *hapd, const u8 *addr,
u8 *idx)
SAE: Enforce single use for anti-clogging tokens Add a 16-bit token index into the anti-clogging token. This can be used to enforce only a single use of each issued anti-clogging token request. The token value is now token-index | last-30-octets-of(HMAC-SHA256(sae_token_key, STA-MAC-address | token-index)), i.e., the first two octets of the SHA256 hash value are replaced with the token-index and token-index itself is protected as part of the HMAC context data. Track the used 16-bit token index values and accept received tokens only if they use an index value that has been requested, but has not yet been used. This makes it a bit more difficult for an attacker to perform DoS attacks against the heavy CPU operations needed for processing SAE commit since the attacker cannot simply replay the same frame multiple times and instead, needs to request each token separately. While this does not add significant extra processing/CPU need for the attacker, this can be helpful in combination with the queued processing of SAE commit messages in enforcing more delay during flooding of SAE commit messages since the new anti-clogging token values are not returned before the new message goes through the processing queue. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 21:05:52 +01:00
{
u8 hash[SHA256_MAC_LEN];
AP: Rename SAE anti clogging variables and functions PASN authentication mandates support for comeback flow, which among others can be used for anti-clogging purposes. As the SAE support for anti clogging can also be used for PASN, start modifying the source code so the anti clogging support can be used for both SAE and PASN. As a start, rename some variables/functions etc. so that they would not be SAE specific. The configuration variable is also renamed, but the old version remains available for backwards compatibility. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:05 +01:00
if (hmac_sha256(hapd->comeback_key, sizeof(hapd->comeback_key),
SAE: Check hmac_sha256() result in sae_token_hash() In theory, hmac_sha256() might fail, so check for that possibility instead of continuing with undetermined index value that could point to an arbitrary token entry. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-08 15:51:30 +01:00
addr, ETH_ALEN, hash) < 0)
return -1;
*idx = hash[0];
return 0;
SAE: Enforce single use for anti-clogging tokens Add a 16-bit token index into the anti-clogging token. This can be used to enforce only a single use of each issued anti-clogging token request. The token value is now token-index | last-30-octets-of(HMAC-SHA256(sae_token_key, STA-MAC-address | token-index)), i.e., the first two octets of the SHA256 hash value are replaced with the token-index and token-index itself is protected as part of the HMAC context data. Track the used 16-bit token index values and accept received tokens only if they use an index value that has been requested, but has not yet been used. This makes it a bit more difficult for an attacker to perform DoS attacks against the heavy CPU operations needed for processing SAE commit since the attacker cannot simply replay the same frame multiple times and instead, needs to request each token separately. While this does not add significant extra processing/CPU need for the attacker, this can be helpful in combination with the queued processing of SAE commit messages in enforcing more delay during flooding of SAE commit messages since the new anti-clogging token values are not returned before the new message goes through the processing queue. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 21:05:52 +01:00
}
AP: Rename SAE anti clogging variables and functions PASN authentication mandates support for comeback flow, which among others can be used for anti-clogging purposes. As the SAE support for anti clogging can also be used for PASN, start modifying the source code so the anti clogging support can be used for both SAE and PASN. As a start, rename some variables/functions etc. so that they would not be SAE specific. The configuration variable is also renamed, but the old version remains available for backwards compatibility. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:05 +01:00
static int check_comeback_token(struct hostapd_data *hapd, const u8 *addr,
const u8 *token, size_t token_len)
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
{
u8 mac[SHA256_MAC_LEN];
SAE: Enforce single use for anti-clogging tokens Add a 16-bit token index into the anti-clogging token. This can be used to enforce only a single use of each issued anti-clogging token request. The token value is now token-index | last-30-octets-of(HMAC-SHA256(sae_token_key, STA-MAC-address | token-index)), i.e., the first two octets of the SHA256 hash value are replaced with the token-index and token-index itself is protected as part of the HMAC context data. Track the used 16-bit token index values and accept received tokens only if they use an index value that has been requested, but has not yet been used. This makes it a bit more difficult for an attacker to perform DoS attacks against the heavy CPU operations needed for processing SAE commit since the attacker cannot simply replay the same frame multiple times and instead, needs to request each token separately. While this does not add significant extra processing/CPU need for the attacker, this can be helpful in combination with the queued processing of SAE commit messages in enforcing more delay during flooding of SAE commit messages since the new anti-clogging token values are not returned before the new message goes through the processing queue. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 21:05:52 +01:00
const u8 *addrs[2];
size_t len[2];
u16 token_idx;
u8 idx;
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
AP: Rename SAE anti clogging variables and functions PASN authentication mandates support for comeback flow, which among others can be used for anti-clogging purposes. As the SAE support for anti clogging can also be used for PASN, start modifying the source code so the anti clogging support can be used for both SAE and PASN. As a start, rename some variables/functions etc. so that they would not be SAE specific. The configuration variable is also renamed, but the old version remains available for backwards compatibility. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:05 +01:00
if (token_len != SHA256_MAC_LEN ||
comeback_token_hash(hapd, addr, &idx) < 0)
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
return -1;
AP: Rename SAE anti clogging variables and functions PASN authentication mandates support for comeback flow, which among others can be used for anti-clogging purposes. As the SAE support for anti clogging can also be used for PASN, start modifying the source code so the anti clogging support can be used for both SAE and PASN. As a start, rename some variables/functions etc. so that they would not be SAE specific. The configuration variable is also renamed, but the old version remains available for backwards compatibility. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:05 +01:00
token_idx = hapd->comeback_pending_idx[idx];
SAE: Enforce single use for anti-clogging tokens Add a 16-bit token index into the anti-clogging token. This can be used to enforce only a single use of each issued anti-clogging token request. The token value is now token-index | last-30-octets-of(HMAC-SHA256(sae_token_key, STA-MAC-address | token-index)), i.e., the first two octets of the SHA256 hash value are replaced with the token-index and token-index itself is protected as part of the HMAC context data. Track the used 16-bit token index values and accept received tokens only if they use an index value that has been requested, but has not yet been used. This makes it a bit more difficult for an attacker to perform DoS attacks against the heavy CPU operations needed for processing SAE commit since the attacker cannot simply replay the same frame multiple times and instead, needs to request each token separately. While this does not add significant extra processing/CPU need for the attacker, this can be helpful in combination with the queued processing of SAE commit messages in enforcing more delay during flooding of SAE commit messages since the new anti-clogging token values are not returned before the new message goes through the processing queue. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 21:05:52 +01:00
if (token_idx == 0 || token_idx != WPA_GET_BE16(token)) {
AP: Rename SAE anti clogging variables and functions PASN authentication mandates support for comeback flow, which among others can be used for anti-clogging purposes. As the SAE support for anti clogging can also be used for PASN, start modifying the source code so the anti clogging support can be used for both SAE and PASN. As a start, rename some variables/functions etc. so that they would not be SAE specific. The configuration variable is also renamed, but the old version remains available for backwards compatibility. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:05 +01:00
wpa_printf(MSG_DEBUG,
"Comeback: Invalid anti-clogging token from "
SAE: Enforce single use for anti-clogging tokens Add a 16-bit token index into the anti-clogging token. This can be used to enforce only a single use of each issued anti-clogging token request. The token value is now token-index | last-30-octets-of(HMAC-SHA256(sae_token_key, STA-MAC-address | token-index)), i.e., the first two octets of the SHA256 hash value are replaced with the token-index and token-index itself is protected as part of the HMAC context data. Track the used 16-bit token index values and accept received tokens only if they use an index value that has been requested, but has not yet been used. This makes it a bit more difficult for an attacker to perform DoS attacks against the heavy CPU operations needed for processing SAE commit since the attacker cannot simply replay the same frame multiple times and instead, needs to request each token separately. While this does not add significant extra processing/CPU need for the attacker, this can be helpful in combination with the queued processing of SAE commit messages in enforcing more delay during flooding of SAE commit messages since the new anti-clogging token values are not returned before the new message goes through the processing queue. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 21:05:52 +01:00
MACSTR " - token_idx 0x%04x, expected 0x%04x",
MAC2STR(addr), WPA_GET_BE16(token), token_idx);
return -1;
}
addrs[0] = addr;
len[0] = ETH_ALEN;
addrs[1] = token;
len[1] = 2;
AP: Rename SAE anti clogging variables and functions PASN authentication mandates support for comeback flow, which among others can be used for anti-clogging purposes. As the SAE support for anti clogging can also be used for PASN, start modifying the source code so the anti clogging support can be used for both SAE and PASN. As a start, rename some variables/functions etc. so that they would not be SAE specific. The configuration variable is also renamed, but the old version remains available for backwards compatibility. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:05 +01:00
if (hmac_sha256_vector(hapd->comeback_key, sizeof(hapd->comeback_key),
SAE: Enforce single use for anti-clogging tokens Add a 16-bit token index into the anti-clogging token. This can be used to enforce only a single use of each issued anti-clogging token request. The token value is now token-index | last-30-octets-of(HMAC-SHA256(sae_token_key, STA-MAC-address | token-index)), i.e., the first two octets of the SHA256 hash value are replaced with the token-index and token-index itself is protected as part of the HMAC context data. Track the used 16-bit token index values and accept received tokens only if they use an index value that has been requested, but has not yet been used. This makes it a bit more difficult for an attacker to perform DoS attacks against the heavy CPU operations needed for processing SAE commit since the attacker cannot simply replay the same frame multiple times and instead, needs to request each token separately. While this does not add significant extra processing/CPU need for the attacker, this can be helpful in combination with the queued processing of SAE commit messages in enforcing more delay during flooding of SAE commit messages since the new anti-clogging token values are not returned before the new message goes through the processing queue. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 21:05:52 +01:00
2, addrs, len, mac) < 0 ||
os_memcmp_const(token + 2, &mac[2], SHA256_MAC_LEN - 2) != 0)
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
return -1;
AP: Rename SAE anti clogging variables and functions PASN authentication mandates support for comeback flow, which among others can be used for anti-clogging purposes. As the SAE support for anti clogging can also be used for PASN, start modifying the source code so the anti clogging support can be used for both SAE and PASN. As a start, rename some variables/functions etc. so that they would not be SAE specific. The configuration variable is also renamed, but the old version remains available for backwards compatibility. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:05 +01:00
hapd->comeback_pending_idx[idx] = 0; /* invalidate used token */
SAE: Enforce single use for anti-clogging tokens Add a 16-bit token index into the anti-clogging token. This can be used to enforce only a single use of each issued anti-clogging token request. The token value is now token-index | last-30-octets-of(HMAC-SHA256(sae_token_key, STA-MAC-address | token-index)), i.e., the first two octets of the SHA256 hash value are replaced with the token-index and token-index itself is protected as part of the HMAC context data. Track the used 16-bit token index values and accept received tokens only if they use an index value that has been requested, but has not yet been used. This makes it a bit more difficult for an attacker to perform DoS attacks against the heavy CPU operations needed for processing SAE commit since the attacker cannot simply replay the same frame multiple times and instead, needs to request each token separately. While this does not add significant extra processing/CPU need for the attacker, this can be helpful in combination with the queued processing of SAE commit messages in enforcing more delay during flooding of SAE commit messages since the new anti-clogging token values are not returned before the new message goes through the processing queue. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 21:05:52 +01:00
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
return 0;
}
static struct wpabuf * auth_build_token_req(struct hostapd_data *hapd,
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
int group, const u8 *addr, int h2e)
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
{
struct wpabuf *buf;
u8 *token;
Use monotonic clock for last_sae_token_key_update Just the usual, with a new function os_reltime_initialized() thrown in that checks whether time has ever been retrieved (time can't be completely zero). Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2013-11-25 21:56:07 +01:00
struct os_reltime now;
SAE: Enforce single use for anti-clogging tokens Add a 16-bit token index into the anti-clogging token. This can be used to enforce only a single use of each issued anti-clogging token request. The token value is now token-index | last-30-octets-of(HMAC-SHA256(sae_token_key, STA-MAC-address | token-index)), i.e., the first two octets of the SHA256 hash value are replaced with the token-index and token-index itself is protected as part of the HMAC context data. Track the used 16-bit token index values and accept received tokens only if they use an index value that has been requested, but has not yet been used. This makes it a bit more difficult for an attacker to perform DoS attacks against the heavy CPU operations needed for processing SAE commit since the attacker cannot simply replay the same frame multiple times and instead, needs to request each token separately. While this does not add significant extra processing/CPU need for the attacker, this can be helpful in combination with the queued processing of SAE commit messages in enforcing more delay during flooding of SAE commit messages since the new anti-clogging token values are not returned before the new message goes through the processing queue. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 21:05:52 +01:00
u8 idx[2];
const u8 *addrs[2];
size_t len[2];
u8 p_idx;
u16 token_idx;
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
Use monotonic clock for last_sae_token_key_update Just the usual, with a new function os_reltime_initialized() thrown in that checks whether time has ever been retrieved (time can't be completely zero). Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2013-11-25 21:56:07 +01:00
os_get_reltime(&now);
AP: Rename SAE anti clogging variables and functions PASN authentication mandates support for comeback flow, which among others can be used for anti-clogging purposes. As the SAE support for anti clogging can also be used for PASN, start modifying the source code so the anti clogging support can be used for both SAE and PASN. As a start, rename some variables/functions etc. so that they would not be SAE specific. The configuration variable is also renamed, but the old version remains available for backwards compatibility. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:05 +01:00
if (!os_reltime_initialized(&hapd->last_comeback_key_update) ||
os_reltime_expired(&now, &hapd->last_comeback_key_update, 60) ||
hapd->comeback_idx == 0xffff) {
if (random_get_bytes(hapd->comeback_key,
sizeof(hapd->comeback_key)) < 0)
SAE: Check random_get_bytes() return value Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 19:25:38 +01:00
return NULL;
AP: Rename SAE anti clogging variables and functions PASN authentication mandates support for comeback flow, which among others can be used for anti-clogging purposes. As the SAE support for anti clogging can also be used for PASN, start modifying the source code so the anti clogging support can be used for both SAE and PASN. As a start, rename some variables/functions etc. so that they would not be SAE specific. The configuration variable is also renamed, but the old version remains available for backwards compatibility. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:05 +01:00
wpa_hexdump(MSG_DEBUG, "Comeback: Updated token key",
hapd->comeback_key, sizeof(hapd->comeback_key));
hapd->last_comeback_key_update = now;
hapd->comeback_idx = 0;
os_memset(hapd->comeback_pending_idx, 0,
sizeof(hapd->comeback_pending_idx));
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
}
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
buf = wpabuf_alloc(sizeof(le16) + 3 + SHA256_MAC_LEN);
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
if (buf == NULL)
return NULL;
PASN: Add support for comeback flow in AP mode Reuse the SAE anti-clogging token implementation to support similar design with the PASN comeback cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:08 +01:00
if (group)
wpabuf_put_le16(buf, group); /* Finite Cyclic Group */
SAE: Fix Anti-Clogging Token request frame format This commit inserts Finite Cyclic Group to Anti-Clogging Token request frame because IEEE Std 802.11-2012, Table 8-29 says "Finite Cyclic Group is present if Status is zero or 76". Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:41 +01:00
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
if (h2e) {
/* Encapsulate Anti-clogging Token field in a container IE */
wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
wpabuf_put_u8(buf, 1 + SHA256_MAC_LEN);
wpabuf_put_u8(buf, WLAN_EID_EXT_ANTI_CLOGGING_TOKEN);
}
AP: Rename SAE anti clogging variables and functions PASN authentication mandates support for comeback flow, which among others can be used for anti-clogging purposes. As the SAE support for anti clogging can also be used for PASN, start modifying the source code so the anti clogging support can be used for both SAE and PASN. As a start, rename some variables/functions etc. so that they would not be SAE specific. The configuration variable is also renamed, but the old version remains available for backwards compatibility. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:05 +01:00
if (comeback_token_hash(hapd, addr, &p_idx) < 0) {
SAE: Check hmac_sha256() result in sae_token_hash() In theory, hmac_sha256() might fail, so check for that possibility instead of continuing with undetermined index value that could point to an arbitrary token entry. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-08 15:51:30 +01:00
wpabuf_free(buf);
return NULL;
}
AP: Rename SAE anti clogging variables and functions PASN authentication mandates support for comeback flow, which among others can be used for anti-clogging purposes. As the SAE support for anti clogging can also be used for PASN, start modifying the source code so the anti clogging support can be used for both SAE and PASN. As a start, rename some variables/functions etc. so that they would not be SAE specific. The configuration variable is also renamed, but the old version remains available for backwards compatibility. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:05 +01:00
token_idx = hapd->comeback_pending_idx[p_idx];
SAE: Enforce single use for anti-clogging tokens Add a 16-bit token index into the anti-clogging token. This can be used to enforce only a single use of each issued anti-clogging token request. The token value is now token-index | last-30-octets-of(HMAC-SHA256(sae_token_key, STA-MAC-address | token-index)), i.e., the first two octets of the SHA256 hash value are replaced with the token-index and token-index itself is protected as part of the HMAC context data. Track the used 16-bit token index values and accept received tokens only if they use an index value that has been requested, but has not yet been used. This makes it a bit more difficult for an attacker to perform DoS attacks against the heavy CPU operations needed for processing SAE commit since the attacker cannot simply replay the same frame multiple times and instead, needs to request each token separately. While this does not add significant extra processing/CPU need for the attacker, this can be helpful in combination with the queued processing of SAE commit messages in enforcing more delay during flooding of SAE commit messages since the new anti-clogging token values are not returned before the new message goes through the processing queue. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 21:05:52 +01:00
if (!token_idx) {
AP: Rename SAE anti clogging variables and functions PASN authentication mandates support for comeback flow, which among others can be used for anti-clogging purposes. As the SAE support for anti clogging can also be used for PASN, start modifying the source code so the anti clogging support can be used for both SAE and PASN. As a start, rename some variables/functions etc. so that they would not be SAE specific. The configuration variable is also renamed, but the old version remains available for backwards compatibility. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:05 +01:00
hapd->comeback_idx++;
token_idx = hapd->comeback_idx;
hapd->comeback_pending_idx[p_idx] = token_idx;
SAE: Enforce single use for anti-clogging tokens Add a 16-bit token index into the anti-clogging token. This can be used to enforce only a single use of each issued anti-clogging token request. The token value is now token-index | last-30-octets-of(HMAC-SHA256(sae_token_key, STA-MAC-address | token-index)), i.e., the first two octets of the SHA256 hash value are replaced with the token-index and token-index itself is protected as part of the HMAC context data. Track the used 16-bit token index values and accept received tokens only if they use an index value that has been requested, but has not yet been used. This makes it a bit more difficult for an attacker to perform DoS attacks against the heavy CPU operations needed for processing SAE commit since the attacker cannot simply replay the same frame multiple times and instead, needs to request each token separately. While this does not add significant extra processing/CPU need for the attacker, this can be helpful in combination with the queued processing of SAE commit messages in enforcing more delay during flooding of SAE commit messages since the new anti-clogging token values are not returned before the new message goes through the processing queue. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 21:05:52 +01:00
}
WPA_PUT_BE16(idx, token_idx);
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
token = wpabuf_put(buf, SHA256_MAC_LEN);
SAE: Enforce single use for anti-clogging tokens Add a 16-bit token index into the anti-clogging token. This can be used to enforce only a single use of each issued anti-clogging token request. The token value is now token-index | last-30-octets-of(HMAC-SHA256(sae_token_key, STA-MAC-address | token-index)), i.e., the first two octets of the SHA256 hash value are replaced with the token-index and token-index itself is protected as part of the HMAC context data. Track the used 16-bit token index values and accept received tokens only if they use an index value that has been requested, but has not yet been used. This makes it a bit more difficult for an attacker to perform DoS attacks against the heavy CPU operations needed for processing SAE commit since the attacker cannot simply replay the same frame multiple times and instead, needs to request each token separately. While this does not add significant extra processing/CPU need for the attacker, this can be helpful in combination with the queued processing of SAE commit messages in enforcing more delay during flooding of SAE commit messages since the new anti-clogging token values are not returned before the new message goes through the processing queue. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 21:05:52 +01:00
addrs[0] = addr;
len[0] = ETH_ALEN;
addrs[1] = idx;
len[1] = sizeof(idx);
AP: Rename SAE anti clogging variables and functions PASN authentication mandates support for comeback flow, which among others can be used for anti-clogging purposes. As the SAE support for anti clogging can also be used for PASN, start modifying the source code so the anti clogging support can be used for both SAE and PASN. As a start, rename some variables/functions etc. so that they would not be SAE specific. The configuration variable is also renamed, but the old version remains available for backwards compatibility. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:05 +01:00
if (hmac_sha256_vector(hapd->comeback_key, sizeof(hapd->comeback_key),
SAE: Enforce single use for anti-clogging tokens Add a 16-bit token index into the anti-clogging token. This can be used to enforce only a single use of each issued anti-clogging token request. The token value is now token-index | last-30-octets-of(HMAC-SHA256(sae_token_key, STA-MAC-address | token-index)), i.e., the first two octets of the SHA256 hash value are replaced with the token-index and token-index itself is protected as part of the HMAC context data. Track the used 16-bit token index values and accept received tokens only if they use an index value that has been requested, but has not yet been used. This makes it a bit more difficult for an attacker to perform DoS attacks against the heavy CPU operations needed for processing SAE commit since the attacker cannot simply replay the same frame multiple times and instead, needs to request each token separately. While this does not add significant extra processing/CPU need for the attacker, this can be helpful in combination with the queued processing of SAE commit messages in enforcing more delay during flooding of SAE commit messages since the new anti-clogging token values are not returned before the new message goes through the processing queue. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 21:05:52 +01:00
2, addrs, len, token) < 0) {
wpabuf_free(buf);
return NULL;
}
WPA_PUT_BE16(token, token_idx);
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
return buf;
}
AP: Enable anti clogging handling code in PASN builds without SAE The anti-clogging code was under CONFIG_SAE. Change this so it can be used both with CONFIG_SAE and CONFIG_PASN. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:06 +01:00
#endif /* defined(CONFIG_SAE) || defined(CONFIG_PASN) */
#ifdef CONFIG_SAE
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
SAE: Make dot11RSNASAESync configurable The new hostapd.conf parameter sae_sync (default: 5) can now be used to configure the dot11RSNASAESync value to specify the maximum number of synchronization errors that are allowed to happen prior to disassociation of the offending SAE peer. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-26 11:46:22 +01:00
static int sae_check_big_sync(struct hostapd_data *hapd, struct sta_info *sta)
SAE: Implement retransmission timer Add the t0 retransmission timer as specified by IEEE Std 802.11-2012, 11.3.8.4. This makes SAE much more likely to succeed in the case of lost frames. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:57 +01:00
{
SAE: Make dot11RSNASAESync configurable The new hostapd.conf parameter sae_sync (default: 5) can now be used to configure the dot11RSNASAESync value to specify the maximum number of synchronization errors that are allowed to happen prior to disassociation of the offending SAE peer. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-26 11:46:22 +01:00
if (sta->sae->sync > hapd->conf->sae_sync) {
SAE: Print state changes in debug log This makes it easier to follow state changes in SAE protocol instances. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-26 23:07:42 +01:00
sae_set_state(sta, SAE_NOTHING, "Sync > dot11RSNASAESync");
SAE: Implement retransmission timer Add the t0 retransmission timer as specified by IEEE Std 802.11-2012, 11.3.8.4. This makes SAE much more likely to succeed in the case of lost frames. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:57 +01:00
sta->sae->sync = 0;
return -1;
}
return 0;
}
static void auth_sae_retransmit_timer(void *eloop_ctx, void *eloop_data)
{
struct hostapd_data *hapd = eloop_ctx;
struct sta_info *sta = eloop_data;
int ret;
SAE: Make dot11RSNASAESync configurable The new hostapd.conf parameter sae_sync (default: 5) can now be used to configure the dot11RSNASAESync value to specify the maximum number of synchronization errors that are allowed to happen prior to disassociation of the offending SAE peer. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-26 11:46:22 +01:00
if (sae_check_big_sync(hapd, sta))
SAE: Implement retransmission timer Add the t0 retransmission timer as specified by IEEE Std 802.11-2012, 11.3.8.4. This makes SAE much more likely to succeed in the case of lost frames. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:57 +01:00
return;
sta->sae->sync++;
mesh: Support simple SAE group negotiation case This allows the simplest case of SAE group negotiation to occur by selecting the next available group if the peer STA indicates the previous one was not supported. This is not yet sufficient to cover all cases, e.g., when both STAs need to change their groups, but at least some cases are no covered. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-30 20:14:08 +02:00
wpa_printf(MSG_DEBUG, "SAE: Auth SAE retransmit timer for " MACSTR
SAE: Print state changes in debug log This makes it easier to follow state changes in SAE protocol instances. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-26 23:07:42 +01:00
" (sync=%d state=%s)",
MAC2STR(sta->addr), sta->sae->sync,
sae_state_txt(sta->sae->state));
SAE: Implement retransmission timer Add the t0 retransmission timer as specified by IEEE Std 802.11-2012, 11.3.8.4. This makes SAE much more likely to succeed in the case of lost frames. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:57 +01:00
switch (sta->sae->state) {
case SAE_COMMITTED:
SAE: Determine H2E vs. looping when restarting SAE auth in AP mode If hostapd had existing STA SAE state, e.g., from a previously completed SAE authentication, a new start of a separate SAE authentication (i.e., receiving of a new SAE commit) ended up using some of the previous state. This is problematic for determining whether to H2E vs. looping since the STA is allowed (even if not really expected to) to change between these two alternatives. This could result in trying to use H2E when STA was using looping to derive PWE and that would result in SAE confirm failing. Fix this by determining whether to use H2E or looping for the restarted authentication based on the Status Code in the new SAE commit message instead of previously cached state information. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-25 14:54:11 +02:00
ret = auth_sae_send_commit(hapd, sta, hapd->own_addr, 0, -1);
mesh: Fix mesh SAE auth on low spec devices The mesh SAE auth often fails with master branch. By bisect I found commit eb5fee0bf50444419ac12d3c7f38f27a47523a47 ('SAE: Add side-channel protection to PWE derivation with ECC') causes this issue. This does not mean the commit has a bug. This is just a CPU resource issue. After the commit, sae_derive_pwe_ecc() spends 101(msec) on my PC (Intel Atom N270 1.6GHz). But dot11RSNASAERetransPeriod is 40(msec). So auth_sae_retransmit_timer() is always called and it can causes continuous frame exchanges. Before the commit, it was 23(msec). On the IEEE 802.11 spec, the default value of dot11RSNASAERetransPeriod is defined as 40(msec). But it looks short because generally mesh functionality will be used on low spec devices. Indeed Raspberry Pi B+ (ARM ARM1176JZF-S 700MHz) requires 287(msec) for new sae_derive_pwe_ecc(). So this patch makes the default to 1000(msec) and makes it configurable. This issue does not occur on infrastructure SAE because the dot11RSNASAERetransPeriod is not used on it. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2015-07-08 15:41:36 +02:00
eloop_register_timeout(0,
hapd->dot11RSNASAERetransPeriod * 1000,
SAE: Implement retransmission timer Add the t0 retransmission timer as specified by IEEE Std 802.11-2012, 11.3.8.4. This makes SAE much more likely to succeed in the case of lost frames. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:57 +01:00
auth_sae_retransmit_timer, hapd, sta);
break;
case SAE_CONFIRMED:
ret = auth_sae_send_confirm(hapd, sta, hapd->own_addr);
mesh: Fix mesh SAE auth on low spec devices The mesh SAE auth often fails with master branch. By bisect I found commit eb5fee0bf50444419ac12d3c7f38f27a47523a47 ('SAE: Add side-channel protection to PWE derivation with ECC') causes this issue. This does not mean the commit has a bug. This is just a CPU resource issue. After the commit, sae_derive_pwe_ecc() spends 101(msec) on my PC (Intel Atom N270 1.6GHz). But dot11RSNASAERetransPeriod is 40(msec). So auth_sae_retransmit_timer() is always called and it can causes continuous frame exchanges. Before the commit, it was 23(msec). On the IEEE 802.11 spec, the default value of dot11RSNASAERetransPeriod is defined as 40(msec). But it looks short because generally mesh functionality will be used on low spec devices. Indeed Raspberry Pi B+ (ARM ARM1176JZF-S 700MHz) requires 287(msec) for new sae_derive_pwe_ecc(). So this patch makes the default to 1000(msec) and makes it configurable. This issue does not occur on infrastructure SAE because the dot11RSNASAERetransPeriod is not used on it. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2015-07-08 15:41:36 +02:00
eloop_register_timeout(0,
hapd->dot11RSNASAERetransPeriod * 1000,
SAE: Implement retransmission timer Add the t0 retransmission timer as specified by IEEE Std 802.11-2012, 11.3.8.4. This makes SAE much more likely to succeed in the case of lost frames. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:57 +01:00
auth_sae_retransmit_timer, hapd, sta);
break;
default:
ret = -1;
break;
}
if (ret != WLAN_STATUS_SUCCESS)
wpa_printf(MSG_INFO, "SAE: Failed to retransmit: ret=%d", ret);
}
void sae_clear_retransmit_timer(struct hostapd_data *hapd, struct sta_info *sta)
{
eloop_cancel_timeout(auth_sae_retransmit_timer, hapd, sta);
}
static void sae_set_retransmit_timer(struct hostapd_data *hapd,
struct sta_info *sta)
{
if (!(hapd->conf->mesh & MESH_ENABLED))
return;
eloop_cancel_timeout(auth_sae_retransmit_timer, hapd, sta);
mesh: Fix mesh SAE auth on low spec devices The mesh SAE auth often fails with master branch. By bisect I found commit eb5fee0bf50444419ac12d3c7f38f27a47523a47 ('SAE: Add side-channel protection to PWE derivation with ECC') causes this issue. This does not mean the commit has a bug. This is just a CPU resource issue. After the commit, sae_derive_pwe_ecc() spends 101(msec) on my PC (Intel Atom N270 1.6GHz). But dot11RSNASAERetransPeriod is 40(msec). So auth_sae_retransmit_timer() is always called and it can causes continuous frame exchanges. Before the commit, it was 23(msec). On the IEEE 802.11 spec, the default value of dot11RSNASAERetransPeriod is defined as 40(msec). But it looks short because generally mesh functionality will be used on low spec devices. Indeed Raspberry Pi B+ (ARM ARM1176JZF-S 700MHz) requires 287(msec) for new sae_derive_pwe_ecc(). So this patch makes the default to 1000(msec) and makes it configurable. This issue does not occur on infrastructure SAE because the dot11RSNASAERetransPeriod is not used on it. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2015-07-08 15:41:36 +02:00
eloop_register_timeout(0, hapd->dot11RSNASAERetransPeriod * 1000,
SAE: Implement retransmission timer Add the t0 retransmission timer as specified by IEEE Std 802.11-2012, 11.3.8.4. This makes SAE much more likely to succeed in the case of lost frames. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:57 +01:00
auth_sae_retransmit_timer, hapd, sta);
}
hostapd: Support external authentication offload in AP mode Extend commit 5ff39c1380d9 ("SAE: Support external authentication offload for driver-SME cases") to support external authentication with drivers that implement AP SME by notifying the status of SAE authentication to the driver after SAE handshake as the driver acts as a pass through for the SAE Authentication frames. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
2019-03-18 10:34:04 +01:00
static void sae_sme_send_external_auth_status(struct hostapd_data *hapd,
struct sta_info *sta, u16 status)
{
struct external_auth params;
os_memset(&params, 0, sizeof(params));
params.status = status;
Remove unnecessary copying of SSID and BSSID for external_auth The external authentication command and event does not need to copy the BSSID/SSID values into struct external_auth since those values are used before returning from the call. Simplify this by using const u8 * to external data instead of the array with a copy of the external data. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-04-12 19:38:08 +02:00
params.bssid = sta->addr;
SAE: Do not send PMKID to the driver if PMKSA caching is disabled External auth status to the driver includes the PMKID derived as part of SAE authentication, but this is not valid if PMKSA caching is disabled. Drivers might not be expecting PMKID when it is not valid. Do not send the PMKID to the driver in such cases. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
2019-05-16 11:31:14 +02:00
if (status == WLAN_STATUS_SUCCESS && sta->sae &&
!hapd->conf->disable_pmksa_caching)
hostapd: Support external authentication offload in AP mode Extend commit 5ff39c1380d9 ("SAE: Support external authentication offload for driver-SME cases") to support external authentication with drivers that implement AP SME by notifying the status of SAE authentication to the driver after SAE handshake as the driver acts as a pass through for the SAE Authentication frames. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
2019-03-18 10:34:04 +01:00
params.pmkid = sta->sae->pmkid;
hostapd_drv_send_external_auth_status(hapd, &params);
}
mesh: Add support for PMKSA caching This patch add functionality of mesh SAE PMKSA caching. If the local STA already has peer's PMKSA entry in the cache, skip SAE authentication and start AMPE with the cached value. If the peer does not support PMKSA caching or does not have the local STA's PMKSA entry in the cache, AMPE will fail and the PMKSA cache entry of the peer will be removed. Then STA retries with ordinary SAE authentication. If the peer does not support PMKSA caching and the local STA uses no_auto_peer=1, the local STA can not retry SAE authentication because NEW_PEER_CANDIDATE event cannot start SAE authentication when no_auto_peer=1. So this patch extends MESH_PEER_ADD command to use duration(sec). Throughout the duration, the local STA can start SAE authentication triggered by NEW_PEER_CANDIDATE even though no_auto_peer=1. This commit requires commit 70c93963edefa37ef84b73efb9d04ea10268341c ('SAE: Fix PMKID calculation for PMKSA cache'). Without that commit, chosen PMK comparison will fail. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-03-09 10:16:14 +01:00
void sae_accept_sta(struct hostapd_data *hapd, struct sta_info *sta)
{
SAE: VLAN assignment based on SAE Password Identifier The new sae_password parameter [|vlanid=<VLAN ID>] can now be used to assign stations to a specific VLAN based on which SAE Password Identifier they use. This is similar to the WPA2-Enterprise case where the RADIUS server can assign stations to different VLANs and the WPA2-Personal case where vlanid parameter in wpa_psk_file is used. Signed-off-by: Jouni Malinen <j@w1.fi>
2019-02-17 16:22:37 +01:00
#ifndef CONFIG_NO_VLAN
struct vlan_description vlan_desc;
if (sta->sae->tmp && sta->sae->tmp->vlan_id > 0) {
wpa_printf(MSG_DEBUG, "SAE: Assign STA " MACSTR
" to VLAN ID %d",
MAC2STR(sta->addr), sta->sae->tmp->vlan_id);
os_memset(&vlan_desc, 0, sizeof(vlan_desc));
vlan_desc.notempty = 1;
vlan_desc.untagged = sta->sae->tmp->vlan_id;
if (!hostapd_vlan_valid(hapd->conf->vlan, &vlan_desc)) {
wpa_printf(MSG_INFO,
"Invalid VLAN ID %d in sae_password",
sta->sae->tmp->vlan_id);
return;
}
if (ap_sta_set_vlan(hapd, sta, &vlan_desc) < 0 ||
ap_sta_bind_vlan(hapd, sta) < 0) {
wpa_printf(MSG_INFO,
"Failed to assign VLAN ID %d from sae_password to "
MACSTR, sta->sae->tmp->vlan_id,
MAC2STR(sta->addr));
return;
}
}
#endif /* CONFIG_NO_VLAN */
mesh: Add support for PMKSA caching This patch add functionality of mesh SAE PMKSA caching. If the local STA already has peer's PMKSA entry in the cache, skip SAE authentication and start AMPE with the cached value. If the peer does not support PMKSA caching or does not have the local STA's PMKSA entry in the cache, AMPE will fail and the PMKSA cache entry of the peer will be removed. Then STA retries with ordinary SAE authentication. If the peer does not support PMKSA caching and the local STA uses no_auto_peer=1, the local STA can not retry SAE authentication because NEW_PEER_CANDIDATE event cannot start SAE authentication when no_auto_peer=1. So this patch extends MESH_PEER_ADD command to use duration(sec). Throughout the duration, the local STA can start SAE authentication triggered by NEW_PEER_CANDIDATE even though no_auto_peer=1. This commit requires commit 70c93963edefa37ef84b73efb9d04ea10268341c ('SAE: Fix PMKID calculation for PMKSA cache'). Without that commit, chosen PMK comparison will fail. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-03-09 10:16:14 +01:00
sta->flags |= WLAN_STA_AUTH;
sta->auth_alg = WLAN_AUTH_SAE;
mlme_authenticate_indication(hapd, sta);
wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
SAE: Print state changes in debug log This makes it easier to follow state changes in SAE protocol instances. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-26 23:07:42 +01:00
sae_set_state(sta, SAE_ACCEPTED, "Accept Confirm");
SAE: Fix peer-commit-scalar reuse check Only one peer-commit-scalar value was stored for a specific STA (i.e., one per MAC address) and that value got replaced when the next SAE Authentication exchange was started. This ended up breaking the check against re-use of peer-commit-scalar from an Accepted instance when anti-clogging token was requested. The first SAE commit message (the one without anti-clogging token) ended up overwriting the cached peer-commit-scalar value while leaving that instance in Accepted state. The second SAE commit message (with anti-clogging token) added ended up getting rejected if it used the same value again (and re-use is expected in this particular case where the value was not used in Accepted instance). Fix this by using a separate pointer for storing the peer-commit-scalar value that was used in an Accepted instance. There is no need to allocate memory for two values, i.e., it is sufficient to maintain separate pointers to the value and move the stored value to the special Accepted state pointer when moving to the Accepted state. This fixes issues where a peer STA ends up running back-to-back SAE authentication within couple of seconds, i.e., without hostapd timing out the STA entry for a case where anti-clogging token is required. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-02-05 01:06:27 +01:00
crypto_bignum_deinit(sta->sae->peer_commit_scalar_accepted, 0);
sta->sae->peer_commit_scalar_accepted = sta->sae->peer_commit_scalar;
sta->sae->peer_commit_scalar = NULL;
mesh: Add support for PMKSA caching This patch add functionality of mesh SAE PMKSA caching. If the local STA already has peer's PMKSA entry in the cache, skip SAE authentication and start AMPE with the cached value. If the peer does not support PMKSA caching or does not have the local STA's PMKSA entry in the cache, AMPE will fail and the PMKSA cache entry of the peer will be removed. Then STA retries with ordinary SAE authentication. If the peer does not support PMKSA caching and the local STA uses no_auto_peer=1, the local STA can not retry SAE authentication because NEW_PEER_CANDIDATE event cannot start SAE authentication when no_auto_peer=1. So this patch extends MESH_PEER_ADD command to use duration(sec). Throughout the duration, the local STA can start SAE authentication triggered by NEW_PEER_CANDIDATE even though no_auto_peer=1. This commit requires commit 70c93963edefa37ef84b73efb9d04ea10268341c ('SAE: Fix PMKID calculation for PMKSA cache'). Without that commit, chosen PMK comparison will fail. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-03-09 10:16:14 +01:00
wpa_auth_pmksa_add_sae(hapd->wpa_auth, sta->addr,
sta->sae->pmk, sta->sae->pmkid);
hostapd: Support external authentication offload in AP mode Extend commit 5ff39c1380d9 ("SAE: Support external authentication offload for driver-SME cases") to support external authentication with drivers that implement AP SME by notifying the status of SAE authentication to the driver after SAE handshake as the driver acts as a pass through for the SAE Authentication frames. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
2019-03-18 10:34:04 +01:00
sae_sme_send_external_auth_status(hapd, sta, WLAN_STATUS_SUCCESS);
mesh: Add support for PMKSA caching This patch add functionality of mesh SAE PMKSA caching. If the local STA already has peer's PMKSA entry in the cache, skip SAE authentication and start AMPE with the cached value. If the peer does not support PMKSA caching or does not have the local STA's PMKSA entry in the cache, AMPE will fail and the PMKSA cache entry of the peer will be removed. Then STA retries with ordinary SAE authentication. If the peer does not support PMKSA caching and the local STA uses no_auto_peer=1, the local STA can not retry SAE authentication because NEW_PEER_CANDIDATE event cannot start SAE authentication when no_auto_peer=1. So this patch extends MESH_PEER_ADD command to use duration(sec). Throughout the duration, the local STA can start SAE authentication triggered by NEW_PEER_CANDIDATE even though no_auto_peer=1. This commit requires commit 70c93963edefa37ef84b73efb9d04ea10268341c ('SAE: Fix PMKID calculation for PMKSA cache'). Without that commit, chosen PMK comparison will fail. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-03-09 10:16:14 +01:00
}
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
static int sae_sm_step(struct hostapd_data *hapd, struct sta_info *sta,
SAE: H2E version of SAE commit message handling for AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
const u8 *bssid, u16 auth_transaction, u16 status_code,
int allow_reuse, int *sta_removed)
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
{
int ret;
mesh: Fix operations after SAE state machine removing the STA It is possible for the SAE state machine to remove the STA and free the sta pointer in the mesh use cases. handle_auth_sae() could have dereferenced that pointer and used freed memory in some cases. Fix that by explicitly checking whether the STA was removed. Fixes: bb598c3bdd06 ("AP: Add support for full station state") Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-04-15 21:09:12 +02:00
*sta_removed = 0;
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
if (auth_transaction != 1 && auth_transaction != 2)
return WLAN_STATUS_UNSPECIFIED_FAILURE;
SAE: Print state changes in debug log This makes it easier to follow state changes in SAE protocol instances. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-26 23:07:42 +01:00
wpa_printf(MSG_DEBUG, "SAE: Peer " MACSTR " state=%s auth_trans=%u",
MAC2STR(sta->addr), sae_state_txt(sta->sae->state),
auth_transaction);
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
switch (sta->sae->state) {
case SAE_NOTHING:
if (auth_transaction == 1) {
SAE-PK: AP functionality This adds AP side functionality for SAE-PK. The new sae_password configuration parameters can now be used to enable SAE-PK mode whenever SAE is enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
if (sta->sae->tmp) {
SAE: Move H2E and PK flags to main sae_data This maintains knowledge of whether H2E or PK was used as part of the SAE authentication beyond the removal of temporary state needed during that authentication. This makes it easier to use information about which kind of SAE authentication was used at higher layer functionality. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 11:08:37 +02:00
sta->sae->h2e =
SAE-PK: AP functionality This adds AP side functionality for SAE-PK. The new sae_password configuration parameters can now be used to enable SAE-PK mode whenever SAE is enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
(status_code ==
WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
status_code == WLAN_STATUS_SAE_PK);
SAE: Move H2E and PK flags to main sae_data This maintains knowledge of whether H2E or PK was used as part of the SAE authentication beyond the removal of temporary state needed during that authentication. This makes it easier to use information about which kind of SAE authentication was used at higher layer functionality. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 11:08:37 +02:00
sta->sae->pk =
SAE-PK: AP functionality This adds AP side functionality for SAE-PK. The new sae_password configuration parameters can now be used to enable SAE-PK mode whenever SAE is enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
status_code == WLAN_STATUS_SAE_PK;
}
SAE: Reuse previously generated PWE on a retry with the same STA Do not start SAE authentication from scratch if a STA starts a new attempt for the same group while we still have previously generated PWE available. Instead, use the previously generated PWE as-is and skip anti-clogging token exchange since the heavy processing is already completed. This saves unnecessary processing on the AP side in case the STA failed to complete authentication on the first attempt (e.g., due to heavy SAE load on the AP causing a timeout) and makes it more likely for a valid STA to be able to complete SAE authentication during a DoS attack. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-03 15:56:14 +01:00
ret = auth_sae_send_commit(hapd, sta, bssid,
SAE: Determine H2E vs. looping when restarting SAE auth in AP mode If hostapd had existing STA SAE state, e.g., from a previously completed SAE authentication, a new start of a separate SAE authentication (i.e., receiving of a new SAE commit) ended up using some of the previous state. This is problematic for determining whether to H2E vs. looping since the STA is allowed (even if not really expected to) to change between these two alternatives. This could result in trying to use H2E when STA was using looping to derive PWE and that would result in SAE confirm failing. Fix this by determining whether to use H2E or looping for the restarted authentication based on the Status Code in the new SAE commit message instead of previously cached state information. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-25 14:54:11 +02:00
!allow_reuse, status_code);
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
if (ret)
return ret;
SAE: Print state changes in debug log This makes it easier to follow state changes in SAE protocol instances. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-26 23:07:42 +01:00
sae_set_state(sta, SAE_COMMITTED, "Sent Commit");
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
if (sae_process_commit(sta->sae) < 0)
return WLAN_STATUS_UNSPECIFIED_FAILURE;
/*
SAE: Allow AP behavior for SAE Confirm to be configured hostapd is by default waiting STA to send SAE Confirm before sending the SAE Confirm. This can now be configured with sae_confirm_immediate=1 resulting in hostapd sending out SAE Confirm immediately after sending SAE Commit. These are the two different message sequences: sae_confirm_immediate=0 STA->AP: SAE Commit AP->STA: SAE Commit STA->AP: SAE Confirm AP->STA: SAE Confirm STA->AP: Association Request AP->STA: Association Response sae_confirm_immediate=1 STA->AP: SAE Commit AP->STA: SAE Commit AP->STA: SAE Confirm STA->AP: SAE Confirm STA->AP: Association Request AP->STA: Association Response Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-10 14:38:26 +02:00
* In mesh case, both Commit and Confirm are sent
* immediately. In infrastructure BSS, by default, only
* a single Authentication frame (Commit) is expected
* from the AP here and the second one (Confirm) will
* be sent once the STA has sent its second
* Authentication frame (Confirm). This behavior can be
* overridden with explicit configuration so that the
* infrastructure BSS case sends both frames together.
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
*/
SAE: Allow AP behavior for SAE Confirm to be configured hostapd is by default waiting STA to send SAE Confirm before sending the SAE Confirm. This can now be configured with sae_confirm_immediate=1 resulting in hostapd sending out SAE Confirm immediately after sending SAE Commit. These are the two different message sequences: sae_confirm_immediate=0 STA->AP: SAE Commit AP->STA: SAE Commit STA->AP: SAE Confirm AP->STA: SAE Confirm STA->AP: Association Request AP->STA: Association Response sae_confirm_immediate=1 STA->AP: SAE Commit AP->STA: SAE Commit AP->STA: SAE Confirm STA->AP: SAE Confirm STA->AP: Association Request AP->STA: Association Response Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-10 14:38:26 +02:00
if ((hapd->conf->mesh & MESH_ENABLED) ||
hapd->conf->sae_confirm_immediate) {
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
/*
* Send both Commit and Confirm immediately
* based on SAE finite state machine
* Nothing -> Confirm transition.
*/
ret = auth_sae_send_confirm(hapd, sta, bssid);
if (ret)
return ret;
SAE: Print state changes in debug log This makes it easier to follow state changes in SAE protocol instances. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-26 23:07:42 +01:00
sae_set_state(sta, SAE_CONFIRMED,
"Sent Confirm (mesh)");
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
} else {
/*
* For infrastructure BSS, send only the Commit
* message now to get alternating sequence of
* Authentication frames between the AP and STA.
* Confirm will be sent in
Fix spelling mistakes in number of comments Signed-off-by: Nishant Chaprana <n.chaprana@samsung.com>
2016-09-30 12:06:36 +02:00
* Committed -> Confirmed/Accepted transition
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
* when receiving Confirm from STA.
*/
}
SAE: Implement retransmission timer Add the t0 retransmission timer as specified by IEEE Std 802.11-2012, 11.3.8.4. This makes SAE much more likely to succeed in the case of lost frames. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:57 +01:00
sta->sae->sync = 0;
sae_set_retransmit_timer(hapd, sta);
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
} else {
hostapd_logger(hapd, sta->addr,
HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
"SAE confirm before commit");
}
break;
case SAE_COMMITTED:
SAE: Implement retransmission timer Add the t0 retransmission timer as specified by IEEE Std 802.11-2012, 11.3.8.4. This makes SAE much more likely to succeed in the case of lost frames. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:57 +01:00
sae_clear_retransmit_timer(hapd, sta);
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
if (auth_transaction == 1) {
if (sae_process_commit(sta->sae) < 0)
return WLAN_STATUS_UNSPECIFIED_FAILURE;
ret = auth_sae_send_confirm(hapd, sta, bssid);
if (ret)
return ret;
SAE: Print state changes in debug log This makes it easier to follow state changes in SAE protocol instances. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-26 23:07:42 +01:00
sae_set_state(sta, SAE_CONFIRMED, "Sent Confirm");
SAE: Implement retransmission timer Add the t0 retransmission timer as specified by IEEE Std 802.11-2012, 11.3.8.4. This makes SAE much more likely to succeed in the case of lost frames. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:57 +01:00
sta->sae->sync = 0;
sae_set_retransmit_timer(hapd, sta);
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
} else if (hapd->conf->mesh & MESH_ENABLED) {
/*
* In mesh case, follow SAE finite state machine and
SAE: Implement retransmission timer Add the t0 retransmission timer as specified by IEEE Std 802.11-2012, 11.3.8.4. This makes SAE much more likely to succeed in the case of lost frames. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:57 +01:00
* send Commit now, if sync count allows.
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
*/
SAE: Make dot11RSNASAESync configurable The new hostapd.conf parameter sae_sync (default: 5) can now be used to configure the dot11RSNASAESync value to specify the maximum number of synchronization errors that are allowed to happen prior to disassociation of the offending SAE peer. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-26 11:46:22 +01:00
if (sae_check_big_sync(hapd, sta))
SAE: Implement retransmission timer Add the t0 retransmission timer as specified by IEEE Std 802.11-2012, 11.3.8.4. This makes SAE much more likely to succeed in the case of lost frames. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:57 +01:00
return WLAN_STATUS_SUCCESS;
sta->sae->sync++;
SAE: Determine H2E vs. looping when restarting SAE auth in AP mode If hostapd had existing STA SAE state, e.g., from a previously completed SAE authentication, a new start of a separate SAE authentication (i.e., receiving of a new SAE commit) ended up using some of the previous state. This is problematic for determining whether to H2E vs. looping since the STA is allowed (even if not really expected to) to change between these two alternatives. This could result in trying to use H2E when STA was using looping to derive PWE and that would result in SAE confirm failing. Fix this by determining whether to use H2E or looping for the restarted authentication based on the Status Code in the new SAE commit message instead of previously cached state information. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-25 14:54:11 +02:00
ret = auth_sae_send_commit(hapd, sta, bssid, 0,
status_code);
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
if (ret)
return ret;
SAE: Implement retransmission timer Add the t0 retransmission timer as specified by IEEE Std 802.11-2012, 11.3.8.4. This makes SAE much more likely to succeed in the case of lost frames. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:57 +01:00
sae_set_retransmit_timer(hapd, sta);
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
} else {
/*
* For instructure BSS, send the postponed Confirm from
* Nothing -> Confirmed transition that was reduced to
* Nothing -> Committed above.
*/
ret = auth_sae_send_confirm(hapd, sta, bssid);
if (ret)
return ret;
SAE: Print state changes in debug log This makes it easier to follow state changes in SAE protocol instances. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-26 23:07:42 +01:00
sae_set_state(sta, SAE_CONFIRMED, "Sent Confirm");
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
/*
* Since this was triggered on Confirm RX, run another
* step to get to Accepted without waiting for
* additional events.
*/
SAE: Reuse previously generated PWE on a retry with the same STA Do not start SAE authentication from scratch if a STA starts a new attempt for the same group while we still have previously generated PWE available. Instead, use the previously generated PWE as-is and skip anti-clogging token exchange since the heavy processing is already completed. This saves unnecessary processing on the AP side in case the STA failed to complete authentication on the first attempt (e.g., due to heavy SAE load on the AP causing a timeout) and makes it more likely for a valid STA to be able to complete SAE authentication during a DoS attack. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-03 15:56:14 +01:00
return sae_sm_step(hapd, sta, bssid, auth_transaction,
SAE: H2E version of SAE commit message handling for AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
WLAN_STATUS_SUCCESS, 0, sta_removed);
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
}
break;
case SAE_CONFIRMED:
SAE: Implement retransmission timer Add the t0 retransmission timer as specified by IEEE Std 802.11-2012, 11.3.8.4. This makes SAE much more likely to succeed in the case of lost frames. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:57 +01:00
sae_clear_retransmit_timer(hapd, sta);
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
if (auth_transaction == 1) {
SAE: Make dot11RSNASAESync configurable The new hostapd.conf parameter sae_sync (default: 5) can now be used to configure the dot11RSNASAESync value to specify the maximum number of synchronization errors that are allowed to happen prior to disassociation of the offending SAE peer. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-26 11:46:22 +01:00
if (sae_check_big_sync(hapd, sta))
SAE: Implement retransmission timer Add the t0 retransmission timer as specified by IEEE Std 802.11-2012, 11.3.8.4. This makes SAE much more likely to succeed in the case of lost frames. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:57 +01:00
return WLAN_STATUS_SUCCESS;
sta->sae->sync++;
SAE: Determine H2E vs. looping when restarting SAE auth in AP mode If hostapd had existing STA SAE state, e.g., from a previously completed SAE authentication, a new start of a separate SAE authentication (i.e., receiving of a new SAE commit) ended up using some of the previous state. This is problematic for determining whether to H2E vs. looping since the STA is allowed (even if not really expected to) to change between these two alternatives. This could result in trying to use H2E when STA was using looping to derive PWE and that would result in SAE confirm failing. Fix this by determining whether to use H2E or looping for the restarted authentication based on the Status Code in the new SAE commit message instead of previously cached state information. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-25 14:54:11 +02:00
ret = auth_sae_send_commit(hapd, sta, bssid, 1,
status_code);
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
if (ret)
return ret;
if (sae_process_commit(sta->sae) < 0)
return WLAN_STATUS_UNSPECIFIED_FAILURE;
ret = auth_sae_send_confirm(hapd, sta, bssid);
if (ret)
return ret;
SAE: Implement retransmission timer Add the t0 retransmission timer as specified by IEEE Std 802.11-2012, 11.3.8.4. This makes SAE much more likely to succeed in the case of lost frames. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:57 +01:00
sae_set_retransmit_timer(hapd, sta);
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
} else {
SAE: Set special Sc value when moving to Accepted state Set Sc to 2^16-1 when moving to Accepted state per IEEE Std 802.11-2016, 12.4.8.6.5 (Protocol instance behavior - Confirmed state). This allows the peer in Accepted state to silently ignore unnecessary retransmissions of the Confirm message. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-27 11:17:44 +01:00
sta->sae->send_confirm = 0xffff;
mesh: Add support for PMKSA caching This patch add functionality of mesh SAE PMKSA caching. If the local STA already has peer's PMKSA entry in the cache, skip SAE authentication and start AMPE with the cached value. If the peer does not support PMKSA caching or does not have the local STA's PMKSA entry in the cache, AMPE will fail and the PMKSA cache entry of the peer will be removed. Then STA retries with ordinary SAE authentication. If the peer does not support PMKSA caching and the local STA uses no_auto_peer=1, the local STA can not retry SAE authentication because NEW_PEER_CANDIDATE event cannot start SAE authentication when no_auto_peer=1. So this patch extends MESH_PEER_ADD command to use duration(sec). Throughout the duration, the local STA can start SAE authentication triggered by NEW_PEER_CANDIDATE even though no_auto_peer=1. This commit requires commit 70c93963edefa37ef84b73efb9d04ea10268341c ('SAE: Fix PMKID calculation for PMKSA cache'). Without that commit, chosen PMK comparison will fail. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-03-09 10:16:14 +01:00
sae_accept_sta(hapd, sta);
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
}
break;
case SAE_ACCEPTED:
SAE: Do not drop STA entry on reauthentication in infrastructure BSS A new SAE Commit message should not be allowed to drop an existing STA entry since the sender of that Commit message cannot be authenticated before receiving the Confirm message. This is important in particular when PMF is used since this would provide a potential new path for forcing a connection to be dropped. Fix this by allowing a new SAE Authentication instance to be started when the old instance is in Accepted state and the new Commit message does not use the same peer-scalar value (checked in sae_parse_commit_scalar()). When PMF is used, the AP will use SA Query procedure when receiving the (Re)Association Request frame. In theory, that step could be skipped in case of SAE Authentication since the non-AP STA is demonstrating knowledge of the password. Anyway, there is no allowance for that exception in the IEEE 802.11 standard, so at least for now, leave this using SA Query procedure just like any other PMF case. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-06-06 00:22:01 +02:00
if (auth_transaction == 1 &&
(hapd->conf->mesh & MESH_ENABLED)) {
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
wpa_printf(MSG_DEBUG, "SAE: remove the STA (" MACSTR
") doing reauthentication",
MAC2STR(sta->addr));
mesh: Add support for PMKSA caching This patch add functionality of mesh SAE PMKSA caching. If the local STA already has peer's PMKSA entry in the cache, skip SAE authentication and start AMPE with the cached value. If the peer does not support PMKSA caching or does not have the local STA's PMKSA entry in the cache, AMPE will fail and the PMKSA cache entry of the peer will be removed. Then STA retries with ordinary SAE authentication. If the peer does not support PMKSA caching and the local STA uses no_auto_peer=1, the local STA can not retry SAE authentication because NEW_PEER_CANDIDATE event cannot start SAE authentication when no_auto_peer=1. So this patch extends MESH_PEER_ADD command to use duration(sec). Throughout the duration, the local STA can start SAE authentication triggered by NEW_PEER_CANDIDATE even though no_auto_peer=1. This commit requires commit 70c93963edefa37ef84b73efb9d04ea10268341c ('SAE: Fix PMKID calculation for PMKSA cache'). Without that commit, chosen PMK comparison will fail. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-03-09 10:16:14 +01:00
wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
mesh: Fix SAE reauthentication processing ap_free_sta() frees the sta entry, so sta->addr cannot be used after that call. Fix the sequence of these two calls to avoid use of freed memory to determine which PMKSA cache entry to remove. Fixes: 9f2cf23e2e0d ("mesh: Add support for PMKSA caching") Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-04-15 20:57:58 +02:00
ap_free_sta(hapd, sta);
mesh: Fix operations after SAE state machine removing the STA It is possible for the SAE state machine to remove the STA and free the sta pointer in the mesh use cases. handle_auth_sae() could have dereferenced that pointer and used freed memory in some cases. Fix that by explicitly checking whether the STA was removed. Fixes: bb598c3bdd06 ("AP: Add support for full station state") Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-04-15 21:09:12 +02:00
*sta_removed = 1;
SAE: Do not drop STA entry on reauthentication in infrastructure BSS A new SAE Commit message should not be allowed to drop an existing STA entry since the sender of that Commit message cannot be authenticated before receiving the Confirm message. This is important in particular when PMF is used since this would provide a potential new path for forcing a connection to be dropped. Fix this by allowing a new SAE Authentication instance to be started when the old instance is in Accepted state and the new Commit message does not use the same peer-scalar value (checked in sae_parse_commit_scalar()). When PMF is used, the AP will use SA Query procedure when receiving the (Re)Association Request frame. In theory, that step could be skipped in case of SAE Authentication since the non-AP STA is demonstrating knowledge of the password. Anyway, there is no allowance for that exception in the IEEE 802.11 standard, so at least for now, leave this using SA Query procedure just like any other PMF case. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-06-06 00:22:01 +02:00
} else if (auth_transaction == 1) {
wpa_printf(MSG_DEBUG, "SAE: Start reauthentication");
SAE: Determine H2E vs. looping when restarting SAE auth in AP mode If hostapd had existing STA SAE state, e.g., from a previously completed SAE authentication, a new start of a separate SAE authentication (i.e., receiving of a new SAE commit) ended up using some of the previous state. This is problematic for determining whether to H2E vs. looping since the STA is allowed (even if not really expected to) to change between these two alternatives. This could result in trying to use H2E when STA was using looping to derive PWE and that would result in SAE confirm failing. Fix this by determining whether to use H2E or looping for the restarted authentication based on the Status Code in the new SAE commit message instead of previously cached state information. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-25 14:54:11 +02:00
ret = auth_sae_send_commit(hapd, sta, bssid, 1,
status_code);
SAE: Do not drop STA entry on reauthentication in infrastructure BSS A new SAE Commit message should not be allowed to drop an existing STA entry since the sender of that Commit message cannot be authenticated before receiving the Confirm message. This is important in particular when PMF is used since this would provide a potential new path for forcing a connection to be dropped. Fix this by allowing a new SAE Authentication instance to be started when the old instance is in Accepted state and the new Commit message does not use the same peer-scalar value (checked in sae_parse_commit_scalar()). When PMF is used, the AP will use SA Query procedure when receiving the (Re)Association Request frame. In theory, that step could be skipped in case of SAE Authentication since the non-AP STA is demonstrating knowledge of the password. Anyway, there is no allowance for that exception in the IEEE 802.11 standard, so at least for now, leave this using SA Query procedure just like any other PMF case. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-06-06 00:22:01 +02:00
if (ret)
return ret;
sae_set_state(sta, SAE_COMMITTED, "Sent Commit");
if (sae_process_commit(sta->sae) < 0)
return WLAN_STATUS_UNSPECIFIED_FAILURE;
sta->sae->sync = 0;
sae_set_retransmit_timer(hapd, sta);
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
} else {
SAE: Make dot11RSNASAESync configurable The new hostapd.conf parameter sae_sync (default: 5) can now be used to configure the dot11RSNASAESync value to specify the maximum number of synchronization errors that are allowed to happen prior to disassociation of the offending SAE peer. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-26 11:46:22 +01:00
if (sae_check_big_sync(hapd, sta))
SAE: Implement retransmission timer Add the t0 retransmission timer as specified by IEEE Std 802.11-2012, 11.3.8.4. This makes SAE much more likely to succeed in the case of lost frames. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:57 +01:00
return WLAN_STATUS_SUCCESS;
sta->sae->sync++;
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
ret = auth_sae_send_confirm(hapd, sta, bssid);
sae_clear_temp_data(sta->sae);
if (ret)
return ret;
}
break;
default:
wpa_printf(MSG_ERROR, "SAE: invalid state %d",
sta->sae->state);
return WLAN_STATUS_UNSPECIFIED_FAILURE;
}
return WLAN_STATUS_SUCCESS;
}
mesh: Support simple SAE group negotiation case This allows the simplest case of SAE group negotiation to occur by selecting the next available group if the peer STA indicates the previous one was not supported. This is not yet sufficient to cover all cases, e.g., when both STAs need to change their groups, but at least some cases are no covered. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-30 20:14:08 +02:00
static void sae_pick_next_group(struct hostapd_data *hapd, struct sta_info *sta)
{
struct sae_data *sae = sta->sae;
int i, *groups = hapd->conf->sae_groups;
SAE: Enable only group 19 by default in AP mode Change the AP mode default for SAE to enable only the group 19 instead of enabling all ECC groups that are supported by the used crypto library and the SAE implementations. The main reason for this is to avoid enabling groups that are not as strong as the mandatory-to-support group 19 (i.e., groups 25 and 26). In addition, this disables heavier groups by default. In addition, add a warning about MODP groups 1, 2, 5, 22, 23, and 24 based on "MUST NOT" or "SHOULD NOT" categorization in RFC 8247. All the MODP groups were already disabled by default and would have needed explicit configuration to be allowed. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-05 16:18:11 +01:00
int default_groups[] = { 19, 0 };
mesh: Support simple SAE group negotiation case This allows the simplest case of SAE group negotiation to occur by selecting the next available group if the peer STA indicates the previous one was not supported. This is not yet sufficient to cover all cases, e.g., when both STAs need to change their groups, but at least some cases are no covered. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-30 20:14:08 +02:00
if (sae->state != SAE_COMMITTED)
return;
wpa_printf(MSG_DEBUG, "SAE: Previously selected group: %d", sae->group);
SAE: Enable only group 19 by default in AP mode Change the AP mode default for SAE to enable only the group 19 instead of enabling all ECC groups that are supported by the used crypto library and the SAE implementations. The main reason for this is to avoid enabling groups that are not as strong as the mandatory-to-support group 19 (i.e., groups 25 and 26). In addition, this disables heavier groups by default. In addition, add a warning about MODP groups 1, 2, 5, 22, 23, and 24 based on "MUST NOT" or "SHOULD NOT" categorization in RFC 8247. All the MODP groups were already disabled by default and would have needed explicit configuration to be allowed. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-05 16:18:11 +01:00
if (!groups)
groups = default_groups;
for (i = 0; groups[i] > 0; i++) {
mesh: Support simple SAE group negotiation case This allows the simplest case of SAE group negotiation to occur by selecting the next available group if the peer STA indicates the previous one was not supported. This is not yet sufficient to cover all cases, e.g., when both STAs need to change their groups, but at least some cases are no covered. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-30 20:14:08 +02:00
if (sae->group == groups[i])
break;
}
SAE: Enable only group 19 by default in AP mode Change the AP mode default for SAE to enable only the group 19 instead of enabling all ECC groups that are supported by the used crypto library and the SAE implementations. The main reason for this is to avoid enabling groups that are not as strong as the mandatory-to-support group 19 (i.e., groups 25 and 26). In addition, this disables heavier groups by default. In addition, add a warning about MODP groups 1, 2, 5, 22, 23, and 24 based on "MUST NOT" or "SHOULD NOT" categorization in RFC 8247. All the MODP groups were already disabled by default and would have needed explicit configuration to be allowed. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-05 16:18:11 +01:00
if (groups[i] <= 0) {
mesh: Support simple SAE group negotiation case This allows the simplest case of SAE group negotiation to occur by selecting the next available group if the peer STA indicates the previous one was not supported. This is not yet sufficient to cover all cases, e.g., when both STAs need to change their groups, but at least some cases are no covered. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-30 20:14:08 +02:00
wpa_printf(MSG_DEBUG,
"SAE: Previously selected group not found from the current configuration");
return;
}
for (;;) {
i++;
if (groups[i] <= 0) {
wpa_printf(MSG_DEBUG,
"SAE: No alternative group enabled");
return;
}
if (sae_set_group(sae, groups[i]) < 0)
continue;
break;
}
wpa_printf(MSG_DEBUG, "SAE: Selected new group: %d", groups[i]);
}
SAE: H2E version of SAE commit message handling for AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
static int sae_status_success(struct hostapd_data *hapd, u16 status_code)
{
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
int sae_pwe = hapd->conf->sae_pwe;
int id_in_use;
SAE-PK: Do not accept SAE-PK status code when no PK is configured Make sae_status_success() more explicit by rejecting SAE-PK status code when the AP is not configured with PK. Fixes: 20ccf97b3dc1 ("SAE-PK: AP functionality") Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-10-19 22:35:00 +02:00
bool sae_pk = false;
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
id_in_use = hostapd_sae_pw_id_in_use(hapd->conf);
SAE: Special test mode sae_pwe=3 for looping with password identifier The new sae_pwe=3 mode can be used to test non-compliant behavior with SAE Password Identifiers. This can be used to force use of hunting-and-pecking loop for PWE derivation when Password Identifier is used. This is not allowed by the standard and as such, this functionality is aimed at compliance testing. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-02-10 03:59:10 +01:00
if (id_in_use == 2 && sae_pwe != 3)
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
sae_pwe = 1;
else if (id_in_use == 1 && sae_pwe == 0)
sae_pwe = 2;
SAE-PK: AP functionality This adds AP side functionality for SAE-PK. The new sae_password configuration parameters can now be used to enable SAE-PK mode whenever SAE is enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
#ifdef CONFIG_SAE_PK
SAE-PK: Do not accept SAE-PK status code when no PK is configured Make sae_status_success() more explicit by rejecting SAE-PK status code when the AP is not configured with PK. Fixes: 20ccf97b3dc1 ("SAE-PK: AP functionality") Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-10-19 22:35:00 +02:00
sae_pk = hostapd_sae_pk_in_use(hapd->conf);
if (sae_pwe == 0 && sae_pk)
SAE-PK: AP functionality This adds AP side functionality for SAE-PK. The new sae_password configuration parameters can now be used to enable SAE-PK mode whenever SAE is enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
sae_pwe = 2;
#endif /* CONFIG_SAE_PK */
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
SAE: Special test mode sae_pwe=3 for looping with password identifier The new sae_pwe=3 mode can be used to test non-compliant behavior with SAE Password Identifiers. This can be used to force use of hunting-and-pecking loop for PWE derivation when Password Identifier is used. This is not allowed by the standard and as such, this functionality is aimed at compliance testing. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-02-10 03:59:10 +01:00
return ((sae_pwe == 0 || sae_pwe == 3) &&
SAE: H2E version of SAE commit message handling for AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
status_code == WLAN_STATUS_SUCCESS) ||
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
(sae_pwe == 1 &&
SAE-PK: AP functionality This adds AP side functionality for SAE-PK. The new sae_password configuration parameters can now be used to enable SAE-PK mode whenever SAE is enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
(status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
SAE-PK: Do not accept SAE-PK status code when no PK is configured Make sae_status_success() more explicit by rejecting SAE-PK status code when the AP is not configured with PK. Fixes: 20ccf97b3dc1 ("SAE-PK: AP functionality") Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-10-19 22:35:00 +02:00
(sae_pk && status_code == WLAN_STATUS_SAE_PK))) ||
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
(sae_pwe == 2 &&
SAE: H2E version of SAE commit message handling for AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
(status_code == WLAN_STATUS_SUCCESS ||
SAE-PK: AP functionality This adds AP side functionality for SAE-PK. The new sae_password configuration parameters can now be used to enable SAE-PK mode whenever SAE is enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
SAE-PK: Do not accept SAE-PK status code when no PK is configured Make sae_status_success() more explicit by rejecting SAE-PK status code when the AP is not configured with PK. Fixes: 20ccf97b3dc1 ("SAE-PK: AP functionality") Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-10-19 22:35:00 +02:00
(sae_pk && status_code == WLAN_STATUS_SAE_PK)));
SAE: H2E version of SAE commit message handling for AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
}
SAE: Check that peer's rejected groups are not enabled in AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
static int sae_is_group_enabled(struct hostapd_data *hapd, int group)
{
int *groups = hapd->conf->sae_groups;
int default_groups[] = { 19, 0 };
int i;
if (!groups)
groups = default_groups;
for (i = 0; groups[i] > 0; i++) {
if (groups[i] == group)
return 1;
}
return 0;
}
static int check_sae_rejected_groups(struct hostapd_data *hapd,
SAE-PK: Remove requirement of SAE group matching SAE-PK (K_AP) group This was clarified in the draft specification to not be a mandatory requirement for the AP and STA to enforce, i.e., matching security level is a recommendation for AP configuration rather than a protocol requirement. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-09 21:32:38 +02:00
struct sae_data *sae)
SAE: Check that peer's rejected groups are not enabled in AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
{
SAE-PK: AP functionality This adds AP side functionality for SAE-PK. The new sae_password configuration parameters can now be used to enable SAE-PK mode whenever SAE is enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
const struct wpabuf *groups;
SAE: Check that peer's rejected groups are not enabled in AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
size_t i, count;
const u8 *pos;
SAE-PK: AP functionality This adds AP side functionality for SAE-PK. The new sae_password configuration parameters can now be used to enable SAE-PK mode whenever SAE is enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
if (!sae->tmp)
return 0;
groups = sae->tmp->peer_rejected_groups;
SAE: Check that peer's rejected groups are not enabled in AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
if (!groups)
return 0;
pos = wpabuf_head(groups);
count = wpabuf_len(groups) / 2;
for (i = 0; i < count; i++) {
int enabled;
u16 group;
group = WPA_GET_LE16(pos);
pos += 2;
enabled = sae_is_group_enabled(hapd, group);
SAE-PK: Remove requirement of SAE group matching SAE-PK (K_AP) group This was clarified in the draft specification to not be a mandatory requirement for the AP and STA to enforce, i.e., matching security level is a recommendation for AP configuration rather than a protocol requirement. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-09 21:32:38 +02:00
wpa_printf(MSG_DEBUG, "SAE: Rejected group %u is %s",
group, enabled ? "enabled" : "disabled");
SAE: Check that peer's rejected groups are not enabled in AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
if (enabled)
return 1;
}
return 0;
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
static void handle_auth_sae(struct hostapd_data *hapd, struct sta_info *sta,
const struct ieee80211_mgmt *mgmt, size_t len,
SAE: Check Status Code in Authentication frames While other authentication algorithms mark Status Code as being Reserved in the case of the transaction number 1, SAE does not. Check that the Status Code indicates success before creating SAE state. In addition, fix the mesh anti-clogging token request parsing on big endian CPUs. Transaction number 2 (confirm) can also have non-zero Status Code to report an error. Those should be processed, but not replied to with yet another error message. This could happen in mesh case. Avoid a loop of error messages by dropping the non-success case without additional response. In addition, don't reply to unknown transaction numbers if the status code is non-zero. This avoids a loop of error messages if an invalid frame where to be injected (or unlikely corruption were to occur). Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-14 22:52:02 +01:00
u16 auth_transaction, u16 status_code)
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
{
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
int resp = WLAN_STATUS_SUCCESS;
SAE: Move related operations next to each other There is no need to keep the two SAE steps separated from each other. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 20:54:16 +01:00
struct wpabuf *data = NULL;
SAE: Enable only group 19 by default in AP mode Change the AP mode default for SAE to enable only the group 19 instead of enabling all ECC groups that are supported by the used crypto library and the SAE implementations. The main reason for this is to avoid enabling groups that are not as strong as the mandatory-to-support group 19 (i.e., groups 25 and 26). In addition, this disables heavier groups by default. In addition, add a warning about MODP groups 1, 2, 5, 22, 23, and 24 based on "MUST NOT" or "SHOULD NOT" categorization in RFC 8247. All the MODP groups were already disabled by default and would have needed explicit configuration to be allowed. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-05 16:18:11 +01:00
int *groups = hapd->conf->sae_groups;
int default_groups[] = { 19, 0 };
SAE: Add Finite Cyclic Group field in status code 77 response Copy the Finite Cyclic Group field value from the request to the response Authentication frame if we end up rejecting the request due to unsupported group. IEEE Std 802.11-2016 has conflicting statements about this behavior. Table 9-36 (Presence of fields and elements in Authentication frames) indicates that the Finite Cyclic Group field is only included with status code values 0 (success) and 76 (anti-clogging token request) while SAE protocol description implying that the Finite Cyclic Group field is set to the rejected group (12.4.8.6.3 and 12.4.8.6.4). The standard language needs to cleaned up to describe this unambiguously, but since it looks safe to add the field into the rejection case and since there is desire to have the field present to be able to implement what exactly is stated in 12.4.8.6.4, it looks reasonable to move ahead with the AP mode implementation change. There is no change in wpa_supplicant for now to modify its behavior based on whether this field is present, i.e., wpa_supplicant will continue to work with both the old and new hostapd behavior for SAE group negotiation. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-08 15:21:03 +01:00
const u8 *pos, *end;
mesh: Fix operations after SAE state machine removing the STA It is possible for the SAE state machine to remove the STA and free the sta pointer in the mesh use cases. handle_auth_sae() could have dereferenced that pointer and used freed memory in some cases. Fix that by explicitly checking whether the STA was removed. Fixes: bb598c3bdd06 ("AP: Add support for full station state") Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-04-15 21:09:12 +02:00
int sta_removed = 0;
SAE: Avoid driver STA entry removal unnecessarily when using H2E/PK The new status code values for SAE H2E and PK resulted in the sta->added_unassoc cases incorrectly removing the STA entry after successful SAE commit messages. Fix this by using sae_status_success() instead of direct check for WLAN_STATUS_SUCCESS when processing SAE commit messages before removing station entry. Signed-off-by: Aloka Dixit <alokad@codeaurora.org> Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
2021-02-08 03:49:17 +01:00
bool success_status;
SAE: Enable only group 19 by default in AP mode Change the AP mode default for SAE to enable only the group 19 instead of enabling all ECC groups that are supported by the used crypto library and the SAE implementations. The main reason for this is to avoid enabling groups that are not as strong as the mandatory-to-support group 19 (i.e., groups 25 and 26). In addition, this disables heavier groups by default. In addition, add a warning about MODP groups 1, 2, 5, 22, 23, and 24 based on "MUST NOT" or "SHOULD NOT" categorization in RFC 8247. All the MODP groups were already disabled by default and would have needed explicit configuration to be allowed. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-05 16:18:11 +01:00
if (!groups)
groups = default_groups;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
SAE: Add testing code for reflection attack Allow hostapd to be configured to perform SAE reflection attack for SAE testing purposes with sae_reflection_attack=1 configuration parameter. This is included only in CONFIG_TESTING_OPTIONS=y builds. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-09-02 00:31:47 +02:00
#ifdef CONFIG_TESTING_OPTIONS
if (hapd->conf->sae_reflection_attack && auth_transaction == 1) {
wpa_printf(MSG_DEBUG, "SAE: TESTING - reflection attack");
pos = mgmt->u.auth.variable;
end = ((const u8 *) mgmt) + len;
AP: Reflect status code in SAE reflection attack test When testing SAE reflection, the incoming commit may have the H2E status code (126) or SAE-PK (127), but the test code in the AP was always sending back status code 0. The STA would then reject the commit response due to expecting H2E/SAE-PK status code. Just reflect the incoming status code so the commit can be rejected based on the SAE contents regardless of which variant of SAE was used. Signed-off-by: Thomas Pedersen <thomas@adapt-ip.com>
2020-08-25 17:48:06 +02:00
resp = status_code;
SAE: A bit optimized sae_confirm_immediate=2 for testing purposes sae_confirm_immediate=2 can now be used in CONFIG_TESTING_OPTIONS=y builds to minimize the latency between SAE Commit and SAE Confirm by postponing transmission of SAE Commit until the SAE Confirm frame is generated. This does not have significant impact, but can get the frames tiny bit closer to each other over the air to increase testing coverage. The only difference between sae_confirm_immediate 1 and 2 is in the former deriving KCK, PMK, PMKID, and CN between transmission of the frames (i.e., a small number of hash operations). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-08 19:52:26 +01:00
send_auth_reply(hapd, sta, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE,
hostapd: Add send_auth_reply() caller info in debug logging This can help one understand better what happens during the authentication exchange. Signed-off-by: Ben Greear <greearb@candelatech.com>
2017-12-07 18:14:49 +01:00
auth_transaction, resp, pos, end - pos,
"auth-sae-reflection-attack");
SAE: Add testing code for reflection attack Allow hostapd to be configured to perform SAE reflection attack for SAE testing purposes with sae_reflection_attack=1 configuration parameter. This is included only in CONFIG_TESTING_OPTIONS=y builds. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-09-02 00:31:47 +02:00
goto remove_sta;
}
SAE: Allow commit fields to be overridden for testing purposes The new sae_commit_override=<hexdump> parameter can be used to force hostapd to override SAE commit message fields for testing purposes. This is included only in CONFIG_TESTING_OPTIONS=y builds. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-09-02 00:52:15 +02:00
if (hapd->conf->sae_commit_override && auth_transaction == 1) {
wpa_printf(MSG_DEBUG, "SAE: TESTING - commit override");
SAE: A bit optimized sae_confirm_immediate=2 for testing purposes sae_confirm_immediate=2 can now be used in CONFIG_TESTING_OPTIONS=y builds to minimize the latency between SAE Commit and SAE Confirm by postponing transmission of SAE Commit until the SAE Confirm frame is generated. This does not have significant impact, but can get the frames tiny bit closer to each other over the air to increase testing coverage. The only difference between sae_confirm_immediate 1 and 2 is in the former deriving KCK, PMK, PMKID, and CN between transmission of the frames (i.e., a small number of hash operations). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-08 19:52:26 +01:00
send_auth_reply(hapd, sta, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE,
SAE: Allow commit fields to be overridden for testing purposes The new sae_commit_override=<hexdump> parameter can be used to force hostapd to override SAE commit message fields for testing purposes. This is included only in CONFIG_TESTING_OPTIONS=y builds. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-09-02 00:52:15 +02:00
auth_transaction, resp,
wpabuf_head(hapd->conf->sae_commit_override),
hostapd: Add send_auth_reply() caller info in debug logging This can help one understand better what happens during the authentication exchange. Signed-off-by: Ben Greear <greearb@candelatech.com>
2017-12-07 18:14:49 +01:00
wpabuf_len(hapd->conf->sae_commit_override),
"sae-commit-override");
SAE: Allow commit fields to be overridden for testing purposes The new sae_commit_override=<hexdump> parameter can be used to force hostapd to override SAE commit message fields for testing purposes. This is included only in CONFIG_TESTING_OPTIONS=y builds. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-09-02 00:52:15 +02:00
goto remove_sta;
}
SAE: Add testing code for reflection attack Allow hostapd to be configured to perform SAE reflection attack for SAE testing purposes with sae_reflection_attack=1 configuration parameter. This is included only in CONFIG_TESTING_OPTIONS=y builds. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-09-02 00:31:47 +02:00
#endif /* CONFIG_TESTING_OPTIONS */
SAE: Use a shared data structure for AP and station This makes it easier to share common functions for both roles. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 20:48:19 +01:00
if (!sta->sae) {
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
if (auth_transaction != 1 ||
SAE: H2E version of SAE commit message handling for AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
!sae_status_success(hapd, status_code)) {
SAE: Reject unexpected Status Code in SAE commit explicitly (AP) Previously, this case was ignored silently in AP mode. While that could be a reasonable approach for an unexpected condition, it would be fine to reject this case explicitly as well. This makes it somewhat easier to test unexpected SAE H2E vs. looping behavior. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-06 16:26:57 +01:00
wpa_printf(MSG_DEBUG, "SAE: Unexpected Status Code %u",
status_code);
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto reply;
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
}
SAE: Use a shared data structure for AP and station This makes it easier to share common functions for both roles. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 20:48:19 +01:00
sta->sae = os_zalloc(sizeof(*sta->sae));
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
if (!sta->sae) {
resp = -1;
goto remove_sta;
}
SAE: Print state changes in debug log This makes it easier to follow state changes in SAE protocol instances. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-26 23:07:42 +01:00
sae_set_state(sta, SAE_NOTHING, "Init");
SAE: Implement retransmission timer Add the t0 retransmission timer as specified by IEEE Std 802.11-2012, 11.3.8.4. This makes SAE much more likely to succeed in the case of lost frames. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:57 +01:00
sta->sae->sync = 0;
SAE: Use a shared data structure for AP and station This makes it easier to share common functions for both roles. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 20:48:19 +01:00
}
mesh: Add support for PMKSA caching This patch add functionality of mesh SAE PMKSA caching. If the local STA already has peer's PMKSA entry in the cache, skip SAE authentication and start AMPE with the cached value. If the peer does not support PMKSA caching or does not have the local STA's PMKSA entry in the cache, AMPE will fail and the PMKSA cache entry of the peer will be removed. Then STA retries with ordinary SAE authentication. If the peer does not support PMKSA caching and the local STA uses no_auto_peer=1, the local STA can not retry SAE authentication because NEW_PEER_CANDIDATE event cannot start SAE authentication when no_auto_peer=1. So this patch extends MESH_PEER_ADD command to use duration(sec). Throughout the duration, the local STA can start SAE authentication triggered by NEW_PEER_CANDIDATE even though no_auto_peer=1. This commit requires commit 70c93963edefa37ef84b73efb9d04ea10268341c ('SAE: Fix PMKID calculation for PMKSA cache'). Without that commit, chosen PMK comparison will fail. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-03-09 10:16:14 +01:00
if (sta->mesh_sae_pmksa_caching) {
wpa_printf(MSG_DEBUG,
"SAE: Cancel use of mesh PMKSA caching because peer starts SAE authentication");
wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
sta->mesh_sae_pmksa_caching = 0;
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
if (auth_transaction == 1) {
SAE: Add Finite Cyclic Group field in status code 77 response Copy the Finite Cyclic Group field value from the request to the response Authentication frame if we end up rejecting the request due to unsupported group. IEEE Std 802.11-2016 has conflicting statements about this behavior. Table 9-36 (Presence of fields and elements in Authentication frames) indicates that the Finite Cyclic Group field is only included with status code values 0 (success) and 76 (anti-clogging token request) while SAE protocol description implying that the Finite Cyclic Group field is set to the rejected group (12.4.8.6.3 and 12.4.8.6.4). The standard language needs to cleaned up to describe this unambiguously, but since it looks safe to add the field into the rejection case and since there is desire to have the field present to be able to implement what exactly is stated in 12.4.8.6.4, it looks reasonable to move ahead with the AP mode implementation change. There is no change in wpa_supplicant for now to modify its behavior based on whether this field is present, i.e., wpa_supplicant will continue to work with both the old and new hostapd behavior for SAE group negotiation. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-08 15:21:03 +01:00
const u8 *token = NULL;
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
size_t token_len = 0;
SAE: Reuse previously generated PWE on a retry with the same STA Do not start SAE authentication from scratch if a STA starts a new attempt for the same group while we still have previously generated PWE available. Instead, use the previously generated PWE as-is and skip anti-clogging token exchange since the heavy processing is already completed. This saves unnecessary processing on the AP side in case the STA failed to complete authentication on the first attempt (e.g., due to heavy SAE load on the AP causing a timeout) and makes it more likely for a valid STA to be able to complete SAE authentication during a DoS attack. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-03 15:56:14 +01:00
int allow_reuse = 0;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
Add 802.11 status code strings Logs involving IEEE 802.11 Status Codes output the Status Code value, but do not provide any explanation of what the value means. This change provides a terse explanation of each status code using the latter part of the Status Code #define names. Signed-off-by: Alex Khouderchah <akhouderchah@chromium.org>
2019-04-18 20:03:21 +02:00
"start SAE authentication (RX commit, status=%u (%s))",
status_code, status2str(status_code));
mesh: Fix SAE anti-clogging functionality for mesh The mesh anti-clogging functionality is implemented partially. This patch fixes to parse anti-clogging request frame and use anti-clogging token. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:40 +01:00
if ((hapd->conf->mesh & MESH_ENABLED) &&
SAE: Check Status Code in Authentication frames While other authentication algorithms mark Status Code as being Reserved in the case of the transaction number 1, SAE does not. Check that the Status Code indicates success before creating SAE state. In addition, fix the mesh anti-clogging token request parsing on big endian CPUs. Transaction number 2 (confirm) can also have non-zero Status Code to report an error. Those should be processed, but not replied to with yet another error message. This could happen in mesh case. Avoid a loop of error messages by dropping the non-success case without additional response. In addition, don't reply to unknown transaction numbers if the status code is non-zero. This avoids a loop of error messages if an invalid frame where to be injected (or unlikely corruption were to occur). Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-14 22:52:02 +01:00
status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ &&
sta->sae->tmp) {
SAE: Fix Anti-Clogging Token request frame format This commit inserts Finite Cyclic Group to Anti-Clogging Token request frame because IEEE Std 802.11-2012, Table 8-29 says "Finite Cyclic Group is present if Status is zero or 76". Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:41 +01:00
pos = mgmt->u.auth.variable;
end = ((const u8 *) mgmt) + len;
if (pos + sizeof(le16) > end) {
wpa_printf(MSG_ERROR,
"SAE: Too short anti-clogging token request");
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto reply;
}
SAE: Enable only group 19 by default in AP mode Change the AP mode default for SAE to enable only the group 19 instead of enabling all ECC groups that are supported by the used crypto library and the SAE implementations. The main reason for this is to avoid enabling groups that are not as strong as the mandatory-to-support group 19 (i.e., groups 25 and 26). In addition, this disables heavier groups by default. In addition, add a warning about MODP groups 1, 2, 5, 22, 23, and 24 based on "MUST NOT" or "SHOULD NOT" categorization in RFC 8247. All the MODP groups were already disabled by default and would have needed explicit configuration to be allowed. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-05 16:18:11 +01:00
resp = sae_group_allowed(sta->sae, groups,
SAE: Fix Anti-Clogging Token request frame format This commit inserts Finite Cyclic Group to Anti-Clogging Token request frame because IEEE Std 802.11-2012, Table 8-29 says "Finite Cyclic Group is present if Status is zero or 76". Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:41 +01:00
WPA_GET_LE16(pos));
if (resp != WLAN_STATUS_SUCCESS) {
wpa_printf(MSG_ERROR,
"SAE: Invalid group in anti-clogging token request");
goto reply;
}
pos += sizeof(le16);
mesh: Fix SAE anti-clogging functionality for mesh The mesh anti-clogging functionality is implemented partially. This patch fixes to parse anti-clogging request frame and use anti-clogging token. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:40 +01:00
wpabuf_free(sta->sae->tmp->anti_clogging_token);
sta->sae->tmp->anti_clogging_token =
SAE: Fix Anti-Clogging Token request frame format This commit inserts Finite Cyclic Group to Anti-Clogging Token request frame because IEEE Std 802.11-2012, Table 8-29 says "Finite Cyclic Group is present if Status is zero or 76". Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:41 +01:00
wpabuf_alloc_copy(pos, end - pos);
mesh: Fix SAE anti-clogging functionality for mesh The mesh anti-clogging functionality is implemented partially. This patch fixes to parse anti-clogging request frame and use anti-clogging token. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:40 +01:00
if (sta->sae->tmp->anti_clogging_token == NULL) {
wpa_printf(MSG_ERROR,
"SAE: Failed to alloc for anti-clogging token");
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto remove_sta;
mesh: Fix SAE anti-clogging functionality for mesh The mesh anti-clogging functionality is implemented partially. This patch fixes to parse anti-clogging request frame and use anti-clogging token. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:40 +01:00
}
/*
* IEEE Std 802.11-2012, 11.3.8.6.4: If the Status code
* is 76, a new Commit Message shall be constructed
* with the Anti-Clogging Token from the received
* Authentication frame, and the commit-scalar and
* COMMIT-ELEMENT previously sent.
*/
SAE: Determine H2E vs. looping when restarting SAE auth in AP mode If hostapd had existing STA SAE state, e.g., from a previously completed SAE authentication, a new start of a separate SAE authentication (i.e., receiving of a new SAE commit) ended up using some of the previous state. This is problematic for determining whether to H2E vs. looping since the STA is allowed (even if not really expected to) to change between these two alternatives. This could result in trying to use H2E when STA was using looping to derive PWE and that would result in SAE confirm failing. Fix this by determining whether to use H2E or looping for the restarted authentication based on the Status Code in the new SAE commit message instead of previously cached state information. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-25 14:54:11 +02:00
resp = auth_sae_send_commit(hapd, sta, mgmt->bssid, 0,
status_code);
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
if (resp != WLAN_STATUS_SUCCESS) {
mesh: Fix SAE anti-clogging functionality for mesh The mesh anti-clogging functionality is implemented partially. This patch fixes to parse anti-clogging request frame and use anti-clogging token. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:40 +01:00
wpa_printf(MSG_ERROR,
"SAE: Failed to send commit message");
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
goto remove_sta;
mesh: Fix SAE anti-clogging functionality for mesh The mesh anti-clogging functionality is implemented partially. This patch fixes to parse anti-clogging request frame and use anti-clogging token. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:40 +01:00
}
SAE: Print state changes in debug log This makes it easier to follow state changes in SAE protocol instances. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-26 23:07:42 +01:00
sae_set_state(sta, SAE_COMMITTED,
"Sent Commit (anti-clogging token case in mesh)");
SAE: Implement retransmission timer Add the t0 retransmission timer as specified by IEEE Std 802.11-2012, 11.3.8.4. This makes SAE much more likely to succeed in the case of lost frames. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:57 +01:00
sta->sae->sync = 0;
sae_set_retransmit_timer(hapd, sta);
mesh: Fix SAE anti-clogging functionality for mesh The mesh anti-clogging functionality is implemented partially. This patch fixes to parse anti-clogging request frame and use anti-clogging token. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:40 +01:00
return;
}
mesh: Support simple SAE group negotiation case This allows the simplest case of SAE group negotiation to occur by selecting the next available group if the peer STA indicates the previous one was not supported. This is not yet sufficient to cover all cases, e.g., when both STAs need to change their groups, but at least some cases are no covered. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-30 20:14:08 +02:00
if ((hapd->conf->mesh & MESH_ENABLED) &&
status_code ==
WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED &&
sta->sae->tmp) {
wpa_printf(MSG_DEBUG,
"SAE: Peer did not accept our SAE group");
sae_pick_next_group(hapd, sta);
goto remove_sta;
}
SAE: H2E version of SAE commit message handling for AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
if (!sae_status_success(hapd, status_code))
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
goto remove_sta;
SAE: Check Status Code in Authentication frames While other authentication algorithms mark Status Code as being Reserved in the case of the transaction number 1, SAE does not. Check that the Status Code indicates success before creating SAE state. In addition, fix the mesh anti-clogging token request parsing on big endian CPUs. Transaction number 2 (confirm) can also have non-zero Status Code to report an error. Those should be processed, but not replied to with yet another error message. This could happen in mesh case. Avoid a loop of error messages by dropping the non-success case without additional response. In addition, don't reply to unknown transaction numbers if the status code is non-zero. This avoids a loop of error messages if an invalid frame where to be injected (or unlikely corruption were to occur). Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-14 22:52:02 +01:00
SAE: Allow authentication restart on AP In the infrastructure BSS case, the AP needs to clear pending SAE state if a new Commit message is received when already in Committed state. This allows the non-AP STA to negotiate a new group if it ends up trying to go through SAE authentication again before the AP side has removed the previous STA entry. This fixes an issue where a kernel update changed something in SAE timing or authentication sequence and started failing the sae_bignum_failure hwsim test case. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-06-20 12:04:31 +02:00
if (!(hapd->conf->mesh & MESH_ENABLED) &&
sta->sae->state == SAE_COMMITTED) {
/* This is needed in the infrastructure BSS case to
* address a sequence where a STA entry may remain in
* hostapd across two attempts to do SAE authentication
* by the same STA. The second attempt may end up trying
* to use a different group and that would not be
* allowed if we remain in Committed state with the
* previously set parameters. */
SAE: Reuse previously generated PWE on a retry with the same STA Do not start SAE authentication from scratch if a STA starts a new attempt for the same group while we still have previously generated PWE available. Instead, use the previously generated PWE as-is and skip anti-clogging token exchange since the heavy processing is already completed. This saves unnecessary processing on the AP side in case the STA failed to complete authentication on the first attempt (e.g., due to heavy SAE load on the AP causing a timeout) and makes it more likely for a valid STA to be able to complete SAE authentication during a DoS attack. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-03 15:56:14 +01:00
pos = mgmt->u.auth.variable;
end = ((const u8 *) mgmt) + len;
if (end - pos >= (int) sizeof(le16) &&
sae_group_allowed(sta->sae, groups,
WPA_GET_LE16(pos)) ==
WLAN_STATUS_SUCCESS) {
/* Do not waste resources deriving the same PWE
* again since the same group is reused. */
sae_set_state(sta, SAE_NOTHING,
"Allow previous PWE to be reused");
allow_reuse = 1;
} else {
sae_set_state(sta, SAE_NOTHING,
"Clear existing state to allow restart");
sae_clear_data(sta->sae);
}
SAE: Allow authentication restart on AP In the infrastructure BSS case, the AP needs to clear pending SAE state if a new Commit message is received when already in Committed state. This allows the non-AP STA to negotiate a new group if it ends up trying to go through SAE authentication again before the AP side has removed the previous STA entry. This fixes an issue where a kernel update changed something in SAE timing or authentication sequence and started failing the sae_bignum_failure hwsim test case. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-06-20 12:04:31 +02:00
}
SAE: Add processing of the commit message This adds validation of the received commit messages and key derivation for SAE. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:16:18 +01:00
resp = sae_parse_commit(sta->sae, mgmt->u.auth.variable,
((const u8 *) mgmt) + len -
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
mgmt->u.auth.variable, &token,
SAE: Tell sae_parse_commit() whether H2E is used This will be needed to help parsing the received SAE commit. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-07 17:33:02 +02:00
&token_len, groups, status_code ==
SAE-PK: AP functionality This adds AP side functionality for SAE-PK. The new sae_password configuration parameters can now be used to enable SAE-PK mode whenever SAE is enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
status_code == WLAN_STATUS_SAE_PK);
SAE: Verify that own/peer commit-scalar and COMMIT-ELEMENT are different This check explicitly for reflection attack and stops authentication immediately if that is detected instead of continuing to the following 4-way handshake that would fail due to the attacker not knowing the key from the SAE exchange. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-23 21:30:15 +02:00
if (resp == SAE_SILENTLY_DISCARD) {
wpa_printf(MSG_DEBUG,
"SAE: Drop commit message from " MACSTR " due to reflection attack",
MAC2STR(sta->addr));
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
goto remove_sta;
SAE: Verify that own/peer commit-scalar and COMMIT-ELEMENT are different This check explicitly for reflection attack and stops authentication immediately if that is detected instead of continuing to the following 4-way handshake that would fail due to the attacker not knowing the key from the SAE exchange. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-23 21:30:15 +02:00
}
SAE: Add support for using the optional Password Identifier This extends the SAE implementation in both infrastructure and mesh BSS cases to allow an optional Password Identifier to be used. This uses the mechanism added in P802.11REVmd/D1.0. The Password Identifier is configured in a wpa_supplicant network profile as a new string parameter sae_password_id. In hostapd configuration, the existing sae_password parameter has been extended to allow the password identifier (and also a peer MAC address) to be set. In addition, multiple sae_password entries can now be provided to hostapd to allow multiple per-peer and per-identifier passwords to be set. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-19 16:28:01 +02:00
if (resp == WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER) {
wpa_msg(hapd->msg_ctx, MSG_INFO,
WPA_EVENT_SAE_UNKNOWN_PASSWORD_IDENTIFIER
MACSTR, MAC2STR(sta->addr));
sae_clear_retransmit_timer(hapd, sta);
sae_set_state(sta, SAE_NOTHING,
"Unknown Password Identifier");
goto remove_sta;
}
AP: Rename SAE anti clogging variables and functions PASN authentication mandates support for comeback flow, which among others can be used for anti-clogging purposes. As the SAE support for anti clogging can also be used for PASN, start modifying the source code so the anti clogging support can be used for both SAE and PASN. As a start, rename some variables/functions etc. so that they would not be SAE specific. The configuration variable is also renamed, but the old version remains available for backwards compatibility. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:05 +01:00
if (token &&
check_comeback_token(hapd, sta->addr, token, token_len)
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
< 0) {
wpa_printf(MSG_DEBUG, "SAE: Drop commit message with "
"incorrect token from " MACSTR,
MAC2STR(sta->addr));
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto remove_sta;
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
}
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
if (resp != WLAN_STATUS_SUCCESS)
goto reply;
SAE-PK: Remove requirement of SAE group matching SAE-PK (K_AP) group This was clarified in the draft specification to not be a mandatory requirement for the AP and STA to enforce, i.e., matching security level is a recommendation for AP configuration rather than a protocol requirement. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-09 21:32:38 +02:00
if (check_sae_rejected_groups(hapd, sta->sae)) {
SAE: Check that peer's rejected groups are not enabled in AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
SAE: Reject invalid rejected group report in SAE commit explicitly (AP) Previously, this case was ignored silently in AP mode. While that could be a reasonable approach for an unexpected condition, it would be fine to reject this case explicitly as well. This makes it somewhat easier to test unexpected SAE H2E vs. looping behavior. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-06 23:39:46 +01:00
goto reply;
SAE: Check that peer's rejected groups are not enabled in AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
}
AP: Rename SAE anti clogging variables and functions PASN authentication mandates support for comeback flow, which among others can be used for anti-clogging purposes. As the SAE support for anti clogging can also be used for PASN, start modifying the source code so the anti clogging support can be used for both SAE and PASN. As a start, rename some variables/functions etc. so that they would not be SAE specific. The configuration variable is also renamed, but the old version remains available for backwards compatibility. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:05 +01:00
if (!token && use_anti_clogging(hapd) && !allow_reuse) {
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
int h2e = 0;
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
wpa_printf(MSG_DEBUG,
"SAE: Request anti-clogging token from "
MACSTR, MAC2STR(sta->addr));
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
if (sta->sae->tmp)
SAE: Move H2E and PK flags to main sae_data This maintains knowledge of whether H2E or PK was used as part of the SAE authentication beyond the removal of temporary state needed during that authentication. This makes it easier to use information about which kind of SAE authentication was used at higher layer functionality. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 11:08:37 +02:00
h2e = sta->sae->h2e;
SAE-PK: AP functionality This adds AP side functionality for SAE-PK. The new sae_password configuration parameters can now be used to enable SAE-PK mode whenever SAE is enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
if (status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
status_code == WLAN_STATUS_SAE_PK)
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
h2e = 1;
SAE: Fix Anti-Clogging Token request frame format This commit inserts Finite Cyclic Group to Anti-Clogging Token request frame because IEEE Std 802.11-2012, Table 8-29 says "Finite Cyclic Group is present if Status is zero or 76". Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:41 +01:00
data = auth_build_token_req(hapd, sta->sae->group,
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
sta->addr, h2e);
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
resp = WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ;
mesh: Fix SAE anti-clogging functionality for mesh The mesh anti-clogging functionality is implemented partially. This patch fixes to parse anti-clogging request frame and use anti-clogging token. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:40 +01:00
if (hapd->conf->mesh & MESH_ENABLED)
SAE: Print state changes in debug log This makes it easier to follow state changes in SAE protocol instances. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-26 23:07:42 +01:00
sae_set_state(sta, SAE_NOTHING,
"Request anti-clogging token case in mesh");
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
goto reply;
SAE: Move related operations next to each other There is no need to keep the two SAE steps separated from each other. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 20:54:16 +01:00
}
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
SAE: Reuse previously generated PWE on a retry with the same STA Do not start SAE authentication from scratch if a STA starts a new attempt for the same group while we still have previously generated PWE available. Instead, use the previously generated PWE as-is and skip anti-clogging token exchange since the heavy processing is already completed. This saves unnecessary processing on the AP side in case the STA failed to complete authentication on the first attempt (e.g., due to heavy SAE load on the AP causing a timeout) and makes it more likely for a valid STA to be able to complete SAE authentication during a DoS attack. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-03 15:56:14 +01:00
resp = sae_sm_step(hapd, sta, mgmt->bssid, auth_transaction,
SAE: H2E version of SAE commit message handling for AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
status_code, allow_reuse, &sta_removed);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
} else if (auth_transaction == 2) {
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
Add 802.11 status code strings Logs involving IEEE 802.11 Status Codes output the Status Code value, but do not provide any explanation of what the value means. This change provides a terse explanation of each status code using the latter part of the Status Code #define names. Signed-off-by: Alex Khouderchah <akhouderchah@chromium.org>
2019-04-18 20:03:21 +02:00
"SAE authentication (RX confirm, status=%u (%s))",
status_code, status2str(status_code));
SAE: Check Status Code in Authentication frames While other authentication algorithms mark Status Code as being Reserved in the case of the transaction number 1, SAE does not. Check that the Status Code indicates success before creating SAE state. In addition, fix the mesh anti-clogging token request parsing on big endian CPUs. Transaction number 2 (confirm) can also have non-zero Status Code to report an error. Those should be processed, but not replied to with yet another error message. This could happen in mesh case. Avoid a loop of error messages by dropping the non-success case without additional response. In addition, don't reply to unknown transaction numbers if the status code is non-zero. This avoids a loop of error messages if an invalid frame where to be injected (or unlikely corruption were to occur). Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-14 22:52:02 +01:00
if (status_code != WLAN_STATUS_SUCCESS)
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
goto remove_sta;
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
if (sta->sae->state >= SAE_CONFIRMED ||
!(hapd->conf->mesh & MESH_ENABLED)) {
SAE: Add Rc variable and peer send-confirm validation This implements the behavior described in IEEE Std 802.11-2016, 12.4.8.6.6 (Protocol instance behavior - Accepted state) to silently discard received Confirm message in the Accepted state if the new message does not use an incremented send-confirm value or if the special 2^16-1 value is used. This avoids unnecessary processing of retransmitted Confirm messages. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-27 11:14:41 +01:00
const u8 *var;
size_t var_len;
u16 peer_send_confirm;
var = mgmt->u.auth.variable;
var_len = ((u8 *) mgmt) + len - mgmt->u.auth.variable;
if (var_len < 2) {
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto reply;
}
peer_send_confirm = WPA_GET_LE16(var);
if (sta->sae->state == SAE_ACCEPTED &&
(peer_send_confirm <= sta->sae->rc ||
peer_send_confirm == 0xffff)) {
wpa_printf(MSG_DEBUG,
"SAE: Silently ignore unexpected Confirm from peer "
MACSTR
" (peer-send-confirm=%u Rc=%u)",
MAC2STR(sta->addr),
peer_send_confirm, sta->sae->rc);
return;
}
if (sae_check_confirm(sta->sae, var, var_len) < 0) {
SAE: Move related operations next to each other There is no need to keep the two SAE steps separated from each other. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 20:54:16 +01:00
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
goto reply;
SAE: Free temporary buffers when moving to Accepted state Most of the variables are not needed anymore once the SAE instance has entered Accepted state. Free these to save memory. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-06 18:06:59 +01:00
}
SAE: Add Rc variable and peer send-confirm validation This implements the behavior described in IEEE Std 802.11-2016, 12.4.8.6.6 (Protocol instance behavior - Accepted state) to silently discard received Confirm message in the Accepted state if the new message does not use an incremented send-confirm value or if the special 2^16-1 value is used. This avoids unnecessary processing of retransmitted Confirm messages. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-27 11:14:41 +01:00
sta->sae->rc = peer_send_confirm;
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
}
SAE: H2E version of SAE commit message handling for AP Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:51:37 +02:00
resp = sae_sm_step(hapd, sta, mgmt->bssid, auth_transaction,
status_code, 0, &sta_removed);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
} else {
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
Add 802.11 status code strings Logs involving IEEE 802.11 Status Codes output the Status Code value, but do not provide any explanation of what the value means. This change provides a terse explanation of each status code using the latter part of the Status Code #define names. Signed-off-by: Alex Khouderchah <akhouderchah@chromium.org>
2019-04-18 20:03:21 +02:00
"unexpected SAE authentication transaction %u (status=%u (%s))",
auth_transaction, status_code,
status2str(status_code));
SAE: Check Status Code in Authentication frames While other authentication algorithms mark Status Code as being Reserved in the case of the transaction number 1, SAE does not. Check that the Status Code indicates success before creating SAE state. In addition, fix the mesh anti-clogging token request parsing on big endian CPUs. Transaction number 2 (confirm) can also have non-zero Status Code to report an error. Those should be processed, but not replied to with yet another error message. This could happen in mesh case. Avoid a loop of error messages by dropping the non-success case without additional response. In addition, don't reply to unknown transaction numbers if the status code is non-zero. This avoids a loop of error messages if an invalid frame where to be injected (or unlikely corruption were to occur). Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-14 22:52:02 +01:00
if (status_code != WLAN_STATUS_SUCCESS)
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
goto remove_sta;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
}
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
reply:
mesh: Fix operations after SAE state machine removing the STA It is possible for the SAE state machine to remove the STA and free the sta pointer in the mesh use cases. handle_auth_sae() could have dereferenced that pointer and used freed memory in some cases. Fix that by explicitly checking whether the STA was removed. Fixes: bb598c3bdd06 ("AP: Add support for full station state") Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-04-15 21:09:12 +02:00
if (!sta_removed && resp != WLAN_STATUS_SUCCESS) {
SAE: Add Finite Cyclic Group field in status code 77 response Copy the Finite Cyclic Group field value from the request to the response Authentication frame if we end up rejecting the request due to unsupported group. IEEE Std 802.11-2016 has conflicting statements about this behavior. Table 9-36 (Presence of fields and elements in Authentication frames) indicates that the Finite Cyclic Group field is only included with status code values 0 (success) and 76 (anti-clogging token request) while SAE protocol description implying that the Finite Cyclic Group field is set to the rejected group (12.4.8.6.3 and 12.4.8.6.4). The standard language needs to cleaned up to describe this unambiguously, but since it looks safe to add the field into the rejection case and since there is desire to have the field present to be able to implement what exactly is stated in 12.4.8.6.4, it looks reasonable to move ahead with the AP mode implementation change. There is no change in wpa_supplicant for now to modify its behavior based on whether this field is present, i.e., wpa_supplicant will continue to work with both the old and new hostapd behavior for SAE group negotiation. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-08 15:21:03 +01:00
pos = mgmt->u.auth.variable;
end = ((const u8 *) mgmt) + len;
/* Copy the Finite Cyclic Group field from the request if we
* rejected it as unsupported group. */
if (resp == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED &&
!data && end - pos >= 2)
data = wpabuf_alloc_copy(pos, 2);
hostapd: Support external authentication offload in AP mode Extend commit 5ff39c1380d9 ("SAE: Support external authentication offload for driver-SME cases") to support external authentication with drivers that implement AP SME by notifying the status of SAE authentication to the driver after SAE handshake as the driver acts as a pass through for the SAE Authentication frames. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
2019-03-18 10:34:04 +01:00
sae_sme_send_external_auth_status(hapd, sta, resp);
SAE: A bit optimized sae_confirm_immediate=2 for testing purposes sae_confirm_immediate=2 can now be used in CONFIG_TESTING_OPTIONS=y builds to minimize the latency between SAE Commit and SAE Confirm by postponing transmission of SAE Commit until the SAE Confirm frame is generated. This does not have significant impact, but can get the frames tiny bit closer to each other over the air to increase testing coverage. The only difference between sae_confirm_immediate 1 and 2 is in the former deriving KCK, PMK, PMKID, and CN between transmission of the frames (i.e., a small number of hash operations). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-08 19:52:26 +01:00
send_auth_reply(hapd, sta, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE,
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
auth_transaction, resp,
data ? wpabuf_head(data) : (u8 *) "",
hostapd: Add send_auth_reply() caller info in debug logging This can help one understand better what happens during the authentication exchange. Signed-off-by: Ben Greear <greearb@candelatech.com>
2017-12-07 18:14:49 +01:00
data ? wpabuf_len(data) : 0, "auth-sae");
SAE: Enhance AP implementation to handle auth for mesh interfaces Add state transition logic to the SAE frame handling in order to more fully implement the state machine from the IEEE 802.11 standard. Special cases are needed for infrastructure BSS case to avoid unexpected Authentication frame sequence by postponing transmission of the second Authentication frame untile the STA sends its Confirm. [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
}
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
remove_sta:
SAE: Avoid driver STA entry removal unnecessarily when using H2E/PK The new status code values for SAE H2E and PK resulted in the sta->added_unassoc cases incorrectly removing the STA entry after successful SAE commit messages. Fix this by using sae_status_success() instead of direct check for WLAN_STATUS_SUCCESS when processing SAE commit messages before removing station entry. Signed-off-by: Aloka Dixit <alokad@codeaurora.org> Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
2021-02-08 03:49:17 +01:00
if (auth_transaction == 1)
success_status = sae_status_success(hapd, status_code);
else
success_status = status_code == WLAN_STATUS_SUCCESS;
mesh: Fix operations after SAE state machine removing the STA It is possible for the SAE state machine to remove the STA and free the sta pointer in the mesh use cases. handle_auth_sae() could have dereferenced that pointer and used freed memory in some cases. Fix that by explicitly checking whether the STA was removed. Fixes: bb598c3bdd06 ("AP: Add support for full station state") Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-04-15 21:09:12 +02:00
if (!sta_removed && sta->added_unassoc &&
SAE: Avoid driver STA entry removal unnecessarily when using H2E/PK The new status code values for SAE H2E and PK resulted in the sta->added_unassoc cases incorrectly removing the STA entry after successful SAE commit messages. Fix this by using sae_status_success() instead of direct check for WLAN_STATUS_SUCCESS when processing SAE commit messages before removing station entry. Signed-off-by: Aloka Dixit <alokad@codeaurora.org> Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
2021-02-08 03:49:17 +01:00
(resp != WLAN_STATUS_SUCCESS || !success_status)) {
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
hostapd_drv_sta_remove(hapd, sta->addr);
sta->added_unassoc = 0;
}
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
wpabuf_free(data);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
}
SAE: Centralize function for sending initial COMMIT When performing SAE authentication in mesh, one station may initiate authentication by sending a COMMIT as soon as a peer candidate is discovered. Previously we did this in mesh_rsn.c, but this left some of the state initialization in a different part of the code from the rest of the state machine, and we may need to add other initializations here in the future, so move that to a more central function. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:56 +01:00
/**
* auth_sae_init_committed - Send COMMIT and start SAE in committed state
* @hapd: BSS data for the device initiating the authentication
* @sta: the peer to which commit authentication frame is sent
*
* This function implements Init event handling (IEEE Std 802.11-2012,
* 11.3.8.6.3) in which initial COMMIT message is sent. Prior to calling, the
* sta->sae structure should be initialized appropriately via a call to
* sae_prepare_commit().
*/
int auth_sae_init_committed(struct hostapd_data *hapd, struct sta_info *sta)
{
int ret;
if (!sta->sae || !sta->sae->tmp)
return -1;
if (sta->sae->state != SAE_NOTHING)
return -1;
SAE: Determine H2E vs. looping when restarting SAE auth in AP mode If hostapd had existing STA SAE state, e.g., from a previously completed SAE authentication, a new start of a separate SAE authentication (i.e., receiving of a new SAE commit) ended up using some of the previous state. This is problematic for determining whether to H2E vs. looping since the STA is allowed (even if not really expected to) to change between these two alternatives. This could result in trying to use H2E when STA was using looping to derive PWE and that would result in SAE confirm failing. Fix this by determining whether to use H2E or looping for the restarted authentication based on the Status Code in the new SAE commit message instead of previously cached state information. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-25 14:54:11 +02:00
ret = auth_sae_send_commit(hapd, sta, hapd->own_addr, 0, -1);
SAE: Centralize function for sending initial COMMIT When performing SAE authentication in mesh, one station may initiate authentication by sending a COMMIT as soon as a peer candidate is discovered. Previously we did this in mesh_rsn.c, but this left some of the state initialization in a different part of the code from the rest of the state machine, and we may need to add other initializations here in the future, so move that to a more central function. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:56 +01:00
if (ret)
return -1;
SAE: Print state changes in debug log This makes it easier to follow state changes in SAE protocol instances. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-26 23:07:42 +01:00
sae_set_state(sta, SAE_COMMITTED, "Init and sent commit");
SAE: Implement retransmission timer Add the t0 retransmission timer as specified by IEEE Std 802.11-2012, 11.3.8.4. This makes SAE much more likely to succeed in the case of lost frames. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:57 +01:00
sta->sae->sync = 0;
sae_set_retransmit_timer(hapd, sta);
SAE: Centralize function for sending initial COMMIT When performing SAE authentication in mesh, one station may initiate authentication by sending a COMMIT as soon as a peer candidate is discovered. Previously we did this in mesh_rsn.c, but this left some of the state initialization in a different part of the code from the rest of the state machine, and we may need to add other initializations here in the future, so move that to a more central function. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-07 07:10:56 +01:00
return 0;
}
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
void auth_sae_process_commit(void *eloop_ctx, void *user_ctx)
{
struct hostapd_data *hapd = eloop_ctx;
struct hostapd_sae_commit_queue *q;
unsigned int queue_len;
q = dl_list_first(&hapd->sae_commit_queue,
struct hostapd_sae_commit_queue, list);
if (!q)
return;
wpa_printf(MSG_DEBUG,
SAE: Improved queuing policy for pending authentication frames The previous design of simply queuing all SAE commit messages was not exactly good at allowing recovery from a flooding state if the valid peer used frequent retransmissions of the SAE message. This could happen, e.g., with mesh BSSs using SAE. The frequent retransmissions and restarts of SAE authentication combined with SAE confirm messages bypassing the queue ended up in not being able to finish SAE exchange successfully. Fix this by modifying the queuing policy to queue SAE confirm messages if there is a queued SAE commit message from the same peer so that the messages within the same exchange do not get reordered. In addition, replace queued SAE commit/confirm message if a new matching message is received from the same peer STA. This is useful for the case where the peer restarts SAE more quickly than the local end has time to process the queued messages. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-14 23:03:29 +01:00
"SAE: Process next available message from queue");
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
dl_list_del(&q->list);
handle_auth(hapd, (const struct ieee80211_mgmt *) q->msg, q->len,
q->rssi, 1);
os_free(q);
if (eloop_is_timeout_registered(auth_sae_process_commit, hapd, NULL))
return;
queue_len = dl_list_len(&hapd->sae_commit_queue);
SAE: Reduce queue wait time for pending Authentication frames The queue_len * 50 ms wait time was too large with the retransmission timeouts used in the mesh case for SAE. The maximum wait of 750 ms was enough to prevent successful completion of authentication after having hit the maximum queue length. While the previous commit is enough to allow this to complete successfully in couple of retries, it looks like a smaller wait time should be used here even if it means potentially using more CPU. Drop the processing wait time to queue_len * 10 ms so that the maximum wait time is 150 ms if the queue is full. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-14 23:08:37 +01:00
eloop_register_timeout(0, queue_len * 10000, auth_sae_process_commit,
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
hapd, NULL);
}
SAE: Improved queuing policy for pending authentication frames The previous design of simply queuing all SAE commit messages was not exactly good at allowing recovery from a flooding state if the valid peer used frequent retransmissions of the SAE message. This could happen, e.g., with mesh BSSs using SAE. The frequent retransmissions and restarts of SAE authentication combined with SAE confirm messages bypassing the queue ended up in not being able to finish SAE exchange successfully. Fix this by modifying the queuing policy to queue SAE confirm messages if there is a queued SAE commit message from the same peer so that the messages within the same exchange do not get reordered. In addition, replace queued SAE commit/confirm message if a new matching message is received from the same peer STA. This is useful for the case where the peer restarts SAE more quickly than the local end has time to process the queued messages. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-14 23:03:29 +01:00
static void auth_sae_queue(struct hostapd_data *hapd,
const struct ieee80211_mgmt *mgmt, size_t len,
int rssi)
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
{
SAE: Improved queuing policy for pending authentication frames The previous design of simply queuing all SAE commit messages was not exactly good at allowing recovery from a flooding state if the valid peer used frequent retransmissions of the SAE message. This could happen, e.g., with mesh BSSs using SAE. The frequent retransmissions and restarts of SAE authentication combined with SAE confirm messages bypassing the queue ended up in not being able to finish SAE exchange successfully. Fix this by modifying the queuing policy to queue SAE confirm messages if there is a queued SAE commit message from the same peer so that the messages within the same exchange do not get reordered. In addition, replace queued SAE commit/confirm message if a new matching message is received from the same peer STA. This is useful for the case where the peer restarts SAE more quickly than the local end has time to process the queued messages. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-14 23:03:29 +01:00
struct hostapd_sae_commit_queue *q, *q2;
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
unsigned int queue_len;
SAE: Improved queuing policy for pending authentication frames The previous design of simply queuing all SAE commit messages was not exactly good at allowing recovery from a flooding state if the valid peer used frequent retransmissions of the SAE message. This could happen, e.g., with mesh BSSs using SAE. The frequent retransmissions and restarts of SAE authentication combined with SAE confirm messages bypassing the queue ended up in not being able to finish SAE exchange successfully. Fix this by modifying the queuing policy to queue SAE confirm messages if there is a queued SAE commit message from the same peer so that the messages within the same exchange do not get reordered. In addition, replace queued SAE commit/confirm message if a new matching message is received from the same peer STA. This is useful for the case where the peer restarts SAE more quickly than the local end has time to process the queued messages. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-14 23:03:29 +01:00
const struct ieee80211_mgmt *mgmt2;
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
queue_len = dl_list_len(&hapd->sae_commit_queue);
if (queue_len >= 15) {
wpa_printf(MSG_DEBUG,
SAE: Improved queuing policy for pending authentication frames The previous design of simply queuing all SAE commit messages was not exactly good at allowing recovery from a flooding state if the valid peer used frequent retransmissions of the SAE message. This could happen, e.g., with mesh BSSs using SAE. The frequent retransmissions and restarts of SAE authentication combined with SAE confirm messages bypassing the queue ended up in not being able to finish SAE exchange successfully. Fix this by modifying the queuing policy to queue SAE confirm messages if there is a queued SAE commit message from the same peer so that the messages within the same exchange do not get reordered. In addition, replace queued SAE commit/confirm message if a new matching message is received from the same peer STA. This is useful for the case where the peer restarts SAE more quickly than the local end has time to process the queued messages. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-14 23:03:29 +01:00
"SAE: No more room in message queue - drop the new frame from "
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
MACSTR, MAC2STR(mgmt->sa));
return;
}
SAE: Improved queuing policy for pending authentication frames The previous design of simply queuing all SAE commit messages was not exactly good at allowing recovery from a flooding state if the valid peer used frequent retransmissions of the SAE message. This could happen, e.g., with mesh BSSs using SAE. The frequent retransmissions and restarts of SAE authentication combined with SAE confirm messages bypassing the queue ended up in not being able to finish SAE exchange successfully. Fix this by modifying the queuing policy to queue SAE confirm messages if there is a queued SAE commit message from the same peer so that the messages within the same exchange do not get reordered. In addition, replace queued SAE commit/confirm message if a new matching message is received from the same peer STA. This is useful for the case where the peer restarts SAE more quickly than the local end has time to process the queued messages. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-14 23:03:29 +01:00
wpa_printf(MSG_DEBUG, "SAE: Queue Authentication message from "
MACSTR " for processing (queue_len %u)", MAC2STR(mgmt->sa),
queue_len);
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
q = os_zalloc(sizeof(*q) + len);
if (!q)
return;
q->rssi = rssi;
q->len = len;
os_memcpy(q->msg, mgmt, len);
SAE: Improved queuing policy for pending authentication frames The previous design of simply queuing all SAE commit messages was not exactly good at allowing recovery from a flooding state if the valid peer used frequent retransmissions of the SAE message. This could happen, e.g., with mesh BSSs using SAE. The frequent retransmissions and restarts of SAE authentication combined with SAE confirm messages bypassing the queue ended up in not being able to finish SAE exchange successfully. Fix this by modifying the queuing policy to queue SAE confirm messages if there is a queued SAE commit message from the same peer so that the messages within the same exchange do not get reordered. In addition, replace queued SAE commit/confirm message if a new matching message is received from the same peer STA. This is useful for the case where the peer restarts SAE more quickly than the local end has time to process the queued messages. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-14 23:03:29 +01:00
/* Check whether there is already a queued Authentication frame from the
* same station with the same transaction number and if so, replace that
* queue entry with the new one. This avoids issues with a peer that
* sends multiple times (e.g., due to frequent SAE retries). There is no
* point in us trying to process the old attempts after a new one has
* obsoleted them. */
dl_list_for_each(q2, &hapd->sae_commit_queue,
struct hostapd_sae_commit_queue, list) {
mgmt2 = (const struct ieee80211_mgmt *) q2->msg;
if (os_memcmp(mgmt->sa, mgmt2->sa, ETH_ALEN) == 0 &&
mgmt->u.auth.auth_transaction ==
mgmt2->u.auth.auth_transaction) {
wpa_printf(MSG_DEBUG,
"SAE: Replace queued message from same STA with same transaction number");
dl_list_add(&q2->list, &q->list);
dl_list_del(&q2->list);
os_free(q2);
goto queued;
}
}
/* No pending identical entry, so add to the end of the queue */
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
dl_list_add_tail(&hapd->sae_commit_queue, &q->list);
SAE: Improved queuing policy for pending authentication frames The previous design of simply queuing all SAE commit messages was not exactly good at allowing recovery from a flooding state if the valid peer used frequent retransmissions of the SAE message. This could happen, e.g., with mesh BSSs using SAE. The frequent retransmissions and restarts of SAE authentication combined with SAE confirm messages bypassing the queue ended up in not being able to finish SAE exchange successfully. Fix this by modifying the queuing policy to queue SAE confirm messages if there is a queued SAE commit message from the same peer so that the messages within the same exchange do not get reordered. In addition, replace queued SAE commit/confirm message if a new matching message is received from the same peer STA. This is useful for the case where the peer restarts SAE more quickly than the local end has time to process the queued messages. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-14 23:03:29 +01:00
queued:
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
if (eloop_is_timeout_registered(auth_sae_process_commit, hapd, NULL))
return;
SAE: Reduce queue wait time for pending Authentication frames The queue_len * 50 ms wait time was too large with the retransmission timeouts used in the mesh case for SAE. The maximum wait of 750 ms was enough to prevent successful completion of authentication after having hit the maximum queue length. While the previous commit is enough to allow this to complete successfully in couple of retries, it looks like a smaller wait time should be used here even if it means potentially using more CPU. Drop the processing wait time to queue_len * 10 ms so that the maximum wait time is 150 ms if the queue is full. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-14 23:08:37 +01:00
eloop_register_timeout(0, queue_len * 10000, auth_sae_process_commit,
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
hapd, NULL);
}
SAE: Improved queuing policy for pending authentication frames The previous design of simply queuing all SAE commit messages was not exactly good at allowing recovery from a flooding state if the valid peer used frequent retransmissions of the SAE message. This could happen, e.g., with mesh BSSs using SAE. The frequent retransmissions and restarts of SAE authentication combined with SAE confirm messages bypassing the queue ended up in not being able to finish SAE exchange successfully. Fix this by modifying the queuing policy to queue SAE confirm messages if there is a queued SAE commit message from the same peer so that the messages within the same exchange do not get reordered. In addition, replace queued SAE commit/confirm message if a new matching message is received from the same peer STA. This is useful for the case where the peer restarts SAE more quickly than the local end has time to process the queued messages. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-14 23:03:29 +01:00
static int auth_sae_queued_addr(struct hostapd_data *hapd, const u8 *addr)
{
struct hostapd_sae_commit_queue *q;
const struct ieee80211_mgmt *mgmt;
dl_list_for_each(q, &hapd->sae_commit_queue,
struct hostapd_sae_commit_queue, list) {
mgmt = (const struct ieee80211_mgmt *) q->msg;
if (os_memcmp(addr, mgmt->sa, ETH_ALEN) == 0)
return 1;
}
return 0;
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#endif /* CONFIG_SAE */
Return an enum from wpa_validate_wpa_ie() This is more specific then returning a generic int and also allows the compiler to do more checks. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 11:22:28 +01:00
static u16 wpa_res_to_status_code(enum wpa_validate_result res)
FILS: Add a helper function for status code conversion This will allow the existing code to be reused for FILS needs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
{
Return an enum from wpa_validate_wpa_ie() This is more specific then returning a generic int and also allows the compiler to do more checks. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 11:22:28 +01:00
switch (res) {
case WPA_IE_OK:
return WLAN_STATUS_SUCCESS;
case WPA_INVALID_IE:
return WLAN_STATUS_INVALID_IE;
case WPA_INVALID_GROUP:
FILS: Add a helper function for status code conversion This will allow the existing code to be reused for FILS needs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
return WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
Return an enum from wpa_validate_wpa_ie() This is more specific then returning a generic int and also allows the compiler to do more checks. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 11:22:28 +01:00
case WPA_INVALID_PAIRWISE:
FILS: Add a helper function for status code conversion This will allow the existing code to be reused for FILS needs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
return WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
Return an enum from wpa_validate_wpa_ie() This is more specific then returning a generic int and also allows the compiler to do more checks. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 11:22:28 +01:00
case WPA_INVALID_AKMP:
FILS: Add a helper function for status code conversion This will allow the existing code to be reused for FILS needs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
return WLAN_STATUS_AKMP_NOT_VALID;
Return an enum from wpa_validate_wpa_ie() This is more specific then returning a generic int and also allows the compiler to do more checks. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 11:22:28 +01:00
case WPA_NOT_ENABLED:
return WLAN_STATUS_INVALID_IE;
case WPA_ALLOC_FAIL:
FILS: Add a helper function for status code conversion This will allow the existing code to be reused for FILS needs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
return WLAN_STATUS_UNSPECIFIED_FAILURE;
Return an enum from wpa_validate_wpa_ie() This is more specific then returning a generic int and also allows the compiler to do more checks. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 11:22:28 +01:00
case WPA_MGMT_FRAME_PROTECTION_VIOLATION:
FILS: Add a helper function for status code conversion This will allow the existing code to be reused for FILS needs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
return WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
Return an enum from wpa_validate_wpa_ie() This is more specific then returning a generic int and also allows the compiler to do more checks. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 11:22:28 +01:00
case WPA_INVALID_MGMT_GROUP_CIPHER:
Replace RSNE group key management mismatch status/reason codes Use "cipher out of policy" value instead of invalid group cipher (which is for the group data frame cipher) and management frame policy violation (which is used for MFPC/MFPR mismatch). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-01-12 00:12:00 +01:00
return WLAN_STATUS_CIPHER_REJECTED_PER_POLICY;
Return an enum from wpa_validate_wpa_ie() This is more specific then returning a generic int and also allows the compiler to do more checks. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 11:22:28 +01:00
case WPA_INVALID_MDIE:
FILS: Add a helper function for status code conversion This will allow the existing code to be reused for FILS needs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
return WLAN_STATUS_INVALID_MDIE;
Return an enum from wpa_validate_wpa_ie() This is more specific then returning a generic int and also allows the compiler to do more checks. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 11:22:28 +01:00
case WPA_INVALID_PROTO:
FILS: Add a helper function for status code conversion This will allow the existing code to be reused for FILS needs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
return WLAN_STATUS_INVALID_IE;
Return an enum from wpa_validate_wpa_ie() This is more specific then returning a generic int and also allows the compiler to do more checks. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 11:22:28 +01:00
case WPA_INVALID_PMKID:
return WLAN_STATUS_INVALID_PMKID;
DPP2: Allow AP to require or reject PFS The new hostapd configuration parameter dpp_pfs can be used to specify how PFS is applied to associations. The default behavior (dpp_pfs=0) remains same as it was previously, i.e., allow the station to decide whether to use PFS. PFS use can now be required (dpp_pfs=1) or rejected (dpp_pfs=2). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 11:33:48 +01:00
case WPA_DENIED_OTHER_REASON:
return WLAN_STATUS_ASSOC_DENIED_UNSPEC;
Return an enum from wpa_validate_wpa_ie() This is more specific then returning a generic int and also allows the compiler to do more checks. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 11:22:28 +01:00
}
return WLAN_STATUS_INVALID_IE;
FILS: Add a helper function for status code conversion This will allow the existing code to be reused for FILS needs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
}
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
#ifdef CONFIG_FILS
static void handle_auth_fils_finish(struct hostapd_data *hapd,
struct sta_info *sta, u16 resp,
FILS: Make handle_auth_fils() re-usable for driver-based AP SME Allow this function to be called from outside ieee802_11.c and with the final steps replaced through a callback function. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
struct wpabuf *data, int pub);
void handle_auth_fils(struct hostapd_data *hapd, struct sta_info *sta,
const u8 *pos, size_t len, u16 auth_alg,
u16 auth_transaction, u16 status_code,
void (*cb)(struct hostapd_data *hapd,
struct sta_info *sta, u16 resp,
struct wpabuf *data, int pub))
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
{
u16 resp = WLAN_STATUS_SUCCESS;
FILS: Pass only IE area to handle_auth_fils() This function does not need the frame header, so pass in only the IE area to make it easier to share this for driver-based AP SME handling. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-23 17:24:38 +02:00
const u8 *end;
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
struct ieee802_11_elems elems;
Return an enum from wpa_validate_wpa_ie() This is more specific then returning a generic int and also allows the compiler to do more checks. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 11:22:28 +01:00
enum wpa_validate_result res;
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
struct wpa_ie_data rsn;
struct rsn_pmksa_cache_entry *pmksa = NULL;
if (auth_transaction != 1 || status_code != WLAN_STATUS_SUCCESS)
return;
FILS: Pass only IE area to handle_auth_fils() This function does not need the frame header, so pass in only the IE area to make it easier to share this for driver-based AP SME handling. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-23 17:24:38 +02:00
end = pos + len;
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
wpa_hexdump(MSG_DEBUG, "FILS: Authentication frame fields",
pos, end - pos);
FILS: Add FILS SK auth PFS support in AP mode This adds an option to configure hostapd to enable use of perfect forward secrecy option in FILS shared key authentication. A new build option CONFIG_FILS_SK_PFS=y can be used to include this functionality. A new runtime configuration parameter fils_dh_group is used to enable this by specifying which DH group to use. For example, fils_dh_group=19 would allow FILS SK PFS to be used with a 256-bit random ECP group. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:40:56 +01:00
/* TODO: FILS PK */
#ifdef CONFIG_FILS_SK_PFS
if (auth_alg == WLAN_AUTH_FILS_SK_PFS) {
u16 group;
struct wpabuf *pub;
size_t elem_len;
/* Using FILS PFS */
/* Finite Cyclic Group */
if (end - pos < 2) {
wpa_printf(MSG_DEBUG,
"FILS: No room for Finite Cyclic Group");
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
}
group = WPA_GET_LE16(pos);
pos += 2;
if (group != hapd->conf->fils_dh_group) {
wpa_printf(MSG_DEBUG,
"FILS: Unsupported Finite Cyclic Group: %u (expected %u)",
group, hapd->conf->fils_dh_group);
resp = WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
goto fail;
}
crypto_ecdh_deinit(sta->fils_ecdh);
sta->fils_ecdh = crypto_ecdh_init(group);
if (!sta->fils_ecdh) {
wpa_printf(MSG_INFO,
"FILS: Could not initialize ECDH with group %d",
group);
resp = WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
goto fail;
}
pub = crypto_ecdh_get_pubkey(sta->fils_ecdh, 1);
if (!pub) {
wpa_printf(MSG_DEBUG,
"FILS: Failed to derive ECDH public key");
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
}
elem_len = wpabuf_len(pub);
wpabuf_free(pub);
/* Element */
if ((size_t) (end - pos) < elem_len) {
wpa_printf(MSG_DEBUG, "FILS: No room for Element");
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
}
FILS: Fix Key-Auth derivation for SK+PFS for authenticator side The conditional gSTA and gAP (DH public keys) were not previously included in Key-Auth derivation, but they are needed for the PFS case. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-05-07 16:04:08 +02:00
wpabuf_free(sta->fils_g_sta);
sta->fils_g_sta = wpabuf_alloc_copy(pos, elem_len);
FILS: Add FILS SK auth PFS support in AP mode This adds an option to configure hostapd to enable use of perfect forward secrecy option in FILS shared key authentication. A new build option CONFIG_FILS_SK_PFS=y can be used to include this functionality. A new runtime configuration parameter fils_dh_group is used to enable this by specifying which DH group to use. For example, fils_dh_group=19 would allow FILS SK PFS to be used with a 256-bit random ECP group. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:40:56 +01:00
wpabuf_clear_free(sta->fils_dh_ss);
sta->fils_dh_ss = crypto_ecdh_set_peerkey(sta->fils_ecdh, 1,
pos, elem_len);
if (!sta->fils_dh_ss) {
wpa_printf(MSG_DEBUG, "FILS: ECDH operation failed");
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
}
wpa_hexdump_buf_key(MSG_DEBUG, "FILS: DH_SS", sta->fils_dh_ss);
pos += elem_len;
} else {
crypto_ecdh_deinit(sta->fils_ecdh);
sta->fils_ecdh = NULL;
wpabuf_clear_free(sta->fils_dh_ss);
sta->fils_dh_ss = NULL;
}
#endif /* CONFIG_FILS_SK_PFS */
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
wpa_hexdump(MSG_DEBUG, "FILS: Remaining IEs", pos, end - pos);
if (ieee802_11_parse_elems(pos, end - pos, &elems, 1) == ParseFailed) {
wpa_printf(MSG_DEBUG, "FILS: Could not parse elements");
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
}
/* RSNE */
wpa_hexdump(MSG_DEBUG, "FILS: RSN element",
elems.rsn_ie, elems.rsn_ie_len);
if (!elems.rsn_ie ||
wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, elems.rsn_ie_len + 2,
&rsn) < 0) {
wpa_printf(MSG_DEBUG, "FILS: No valid RSN element");
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
}
if (!sta->wpa_sm)
sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, sta->addr,
NULL);
if (!sta->wpa_sm) {
wpa_printf(MSG_DEBUG,
"FILS: Failed to initialize RSN state machine");
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
}
res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
Fix cipher suite selector default value in RSNE for DMG According to IEEE Std 802.11-2016, 9.4.2.25 when fields of an RSNE are not included, the default values are used. The cipher suite defaults were hardcoded to CCMP in the previous implementation, but the default is actually different for DMG: GCMP (per 9.4.2.25.2). It is not possible to find out from the RSNE if the network is non-DMG or DMG, so callers of wpa_parse_wpa_ie_rsn() need to handle this case based on context, which can be different for each caller. In order to fix this issue, add flags to the wpa_ie_data indicating whether pairwise/group ciphers were included in the RSNE. Callers can check these flags and fill in the appropriate ciphers. The wpa_parse_wpa_ie_rsn() function still initializes the ciphers to CCMP by default so existing callers will not break. This change also fixes some callers which need to handle the DMG network case. Signed-off-by: Lior David <liord@codeaurora.org>
2019-02-06 11:33:35 +01:00
hapd->iface->freq,
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
elems.rsn_ie - 2, elems.rsn_ie_len + 2,
Store a copy of Association Request RSNXE in AP mode for later use This is needed to be able to compare the received RSNXE to a protected version in EAPOL-Key msg 2/4. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-17 23:11:24 +02:00
elems.rsnxe ? elems.rsnxe - 2 : NULL,
elems.rsnxe ? elems.rsnxe_len + 2 : 0,
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
elems.mdie, elems.mdie_len, NULL, 0);
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
resp = wpa_res_to_status_code(res);
if (resp != WLAN_STATUS_SUCCESS)
goto fail;
if (!elems.fils_nonce) {
wpa_printf(MSG_DEBUG, "FILS: No FILS Nonce field");
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
}
wpa_hexdump(MSG_DEBUG, "FILS: SNonce", elems.fils_nonce,
FILS_NONCE_LEN);
os_memcpy(sta->fils_snonce, elems.fils_nonce, FILS_NONCE_LEN);
/* PMKID List */
if (rsn.pmkid && rsn.num_pmkid > 0) {
u8 num;
const u8 *pmkid;
wpa_hexdump(MSG_DEBUG, "FILS: PMKID List",
rsn.pmkid, rsn.num_pmkid * PMKID_LEN);
pmkid = rsn.pmkid;
num = rsn.num_pmkid;
while (num) {
wpa_hexdump(MSG_DEBUG, "FILS: PMKID", pmkid, PMKID_LEN);
pmksa = wpa_auth_pmksa_get(hapd->wpa_auth, sta->addr,
pmkid);
if (pmksa)
break;
FILS: Find PMKSA cache entries on AP based on FILS Cache Identifier This allows PMKSA cache entries to be shared between all the BSSs operated by the same hostapd process when those BSSs use the same FILS Cache Identifier value. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-02-21 11:18:58 +01:00
pmksa = wpa_auth_pmksa_get_fils_cache_id(hapd->wpa_auth,
sta->addr,
pmkid);
if (pmksa)
break;
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
pmkid += PMKID_LEN;
num--;
}
}
if (pmksa && wpa_auth_sta_key_mgmt(sta->wpa_sm) != pmksa->akmp) {
wpa_printf(MSG_DEBUG,
"FILS: Matching PMKSA cache entry has different AKMP (0x%x != 0x%x) - ignore",
wpa_auth_sta_key_mgmt(sta->wpa_sm), pmksa->akmp);
pmksa = NULL;
}
if (pmksa)
wpa_printf(MSG_DEBUG, "FILS: Found matching PMKSA cache entry");
/* FILS Session */
if (!elems.fils_session) {
wpa_printf(MSG_DEBUG, "FILS: No FILS Session element");
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
}
wpa_hexdump(MSG_DEBUG, "FILS: FILS Session", elems.fils_session,
FILS_SESSION_LEN);
os_memcpy(sta->fils_session, elems.fils_session, FILS_SESSION_LEN);
WPA: Rename FILS wrapped data IEEE P802.11az/D2.0 renamed the FILS Wrapped Data element, removing the FILS prefix. Change the code accordingly. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-02-24 10:14:32 +01:00
/* Wrapped Data */
if (elems.wrapped_data) {
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
wpa_hexdump(MSG_DEBUG, "FILS: Wrapped Data",
WPA: Rename FILS wrapped data IEEE P802.11az/D2.0 renamed the FILS Wrapped Data element, removing the FILS prefix. Change the code accordingly. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-02-24 10:14:32 +01:00
elems.wrapped_data,
elems.wrapped_data_len);
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
if (!pmksa) {
#ifndef CONFIG_NO_RADIUS
if (!sta->eapol_sm) {
sta->eapol_sm =
ieee802_1x_alloc_eapol_sm(hapd, sta);
}
wpa_printf(MSG_DEBUG,
FILS: Fix a frame name in a debug print The EAP message included in FILS Wrapped Data from the non-AP STA to the AP is EAP-Initiate/Re-auth. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-05 16:29:44 +02:00
"FILS: Forward EAP-Initiate/Re-auth to authentication server");
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
ieee802_1x_encapsulate_radius(
WPA: Rename FILS wrapped data IEEE P802.11az/D2.0 renamed the FILS Wrapped Data element, removing the FILS prefix. Change the code accordingly. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-02-24 10:14:32 +01:00
hapd, sta, elems.wrapped_data,
elems.wrapped_data_len);
FILS: Make handle_auth_fils() re-usable for driver-based AP SME Allow this function to be called from outside ieee802_11.c and with the final steps replaced through a callback function. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
sta->fils_pending_cb = cb;
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
wpa_printf(MSG_DEBUG,
"FILS: Will send Authentication frame once the response from authentication server is available");
sta->flags |= WLAN_STA_PENDING_FILS_ERP;
FILS: ERP-based PMKSA cache addition on AP hostapd did not add a new PMKSA cache entry when FILS shared key authentication was used, i.e., only the initial full authentication resulted in a PMKSA cache entry being created. Derive the PMKID for the ERP case as well and add a PMKSA cache entry if the ERP exchange succeeds. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-05 16:52:23 +02:00
/* Calculate pending PMKID here so that we do not need
* to maintain a copy of the EAP-Initiate/Reauth
* message. */
if (fils_pmkid_erp(wpa_auth_sta_key_mgmt(sta->wpa_sm),
WPA: Rename FILS wrapped data IEEE P802.11az/D2.0 renamed the FILS Wrapped Data element, removing the FILS prefix. Change the code accordingly. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-02-24 10:14:32 +01:00
elems.wrapped_data,
elems.wrapped_data_len,
FILS: ERP-based PMKSA cache addition on AP hostapd did not add a new PMKSA cache entry when FILS shared key authentication was used, i.e., only the initial full authentication resulted in a PMKSA cache entry being created. Derive the PMKID for the ERP case as well and add a PMKSA cache entry if the ERP exchange succeeds. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-05 16:52:23 +02:00
sta->fils_erp_pmkid) == 0)
sta->fils_erp_pmkid_set = 1;
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
return;
#else /* CONFIG_NO_RADIUS */
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
#endif /* CONFIG_NO_RADIUS */
}
}
fail:
FILS: Make handle_auth_fils() re-usable for driver-based AP SME Allow this function to be called from outside ieee802_11.c and with the final steps replaced through a callback function. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
if (cb) {
struct wpabuf *data;
int pub = 0;
data = prepare_auth_resp_fils(hapd, sta, &resp, pmksa, NULL,
NULL, 0, &pub);
if (!data) {
wpa_printf(MSG_DEBUG,
"%s: prepare_auth_resp_fils() returned failure",
__func__);
}
cb(hapd, sta, resp, data, pub);
}
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
}
FILS: Move authentication response handling into a helper function This can be reused when splitting handle_auth_fils() to support the driver-based AP SME case. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
static struct wpabuf *
prepare_auth_resp_fils(struct hostapd_data *hapd,
struct sta_info *sta, u16 *resp,
struct rsn_pmksa_cache_entry *pmksa,
struct wpabuf *erp_resp,
const u8 *msk, size_t msk_len,
int *is_pub)
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
{
u8 fils_nonce[FILS_NONCE_LEN];
size_t ielen;
struct wpabuf *data = NULL;
const u8 *ie;
u8 *ie_buf = NULL;
const u8 *pmk = NULL;
size_t pmk_len = 0;
FILS: Fix PMK and PMKID derivation from ERP This adds helper functions for deriving PMK and PMKID from ERP exchange in FILS shared key authentication as defined in IEEE Std 802.11ai-2016, 12.12.2.5.2 (PMKSA key derivation with FILS authentication). These functions is used to fix PMK and PMKID derivation which were previously using the rMSK directly as PMK instead of following the FILS protocol to derive PMK with HMAC from nonces and rMSK. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-13 20:06:21 +01:00
u8 pmk_buf[PMK_LEN_MAX];
FILS: Add FILS SK auth PFS support in AP mode This adds an option to configure hostapd to enable use of perfect forward secrecy option in FILS shared key authentication. A new build option CONFIG_FILS_SK_PFS=y can be used to include this functionality. A new runtime configuration parameter fils_dh_group is used to enable this by specifying which DH group to use. For example, fils_dh_group=19 would allow FILS SK PFS to be used with a 256-bit random ECP group. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:40:56 +01:00
struct wpabuf *pub = NULL;
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
FILS: Move authentication response handling into a helper function This can be reused when splitting handle_auth_fils() to support the driver-based AP SME case. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
if (*resp != WLAN_STATUS_SUCCESS)
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
goto fail;
ie = wpa_auth_get_wpa_ie(hapd->wpa_auth, &ielen);
if (!ie) {
FILS: Move authentication response handling into a helper function This can be reused when splitting handle_auth_fils() to support the driver-based AP SME case. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
*resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
goto fail;
}
FILS: Move authentication response handling into a helper function This can be reused when splitting handle_auth_fils() to support the driver-based AP SME case. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
if (pmksa) {
/* Add PMKID of the selected PMKSA into RSNE */
ie_buf = os_malloc(ielen + 2 + 2 + PMKID_LEN);
if (!ie_buf) {
FILS: Move authentication response handling into a helper function This can be reused when splitting handle_auth_fils() to support the driver-based AP SME case. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
*resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
goto fail;
}
FILS: Move authentication response handling into a helper function This can be reused when splitting handle_auth_fils() to support the driver-based AP SME case. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
os_memcpy(ie_buf, ie, ielen);
if (wpa_insert_pmkid(ie_buf, &ielen, pmksa->pmkid) < 0) {
FILS: Move authentication response handling into a helper function This can be reused when splitting handle_auth_fils() to support the driver-based AP SME case. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
*resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
goto fail;
}
ie = ie_buf;
}
if (random_get_bytes(fils_nonce, FILS_NONCE_LEN) < 0) {
FILS: Move authentication response handling into a helper function This can be reused when splitting handle_auth_fils() to support the driver-based AP SME case. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
*resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
goto fail;
}
wpa_hexdump(MSG_DEBUG, "RSN: Generated FILS Nonce",
fils_nonce, FILS_NONCE_LEN);
FILS: Add FILS SK auth PFS support in AP mode This adds an option to configure hostapd to enable use of perfect forward secrecy option in FILS shared key authentication. A new build option CONFIG_FILS_SK_PFS=y can be used to include this functionality. A new runtime configuration parameter fils_dh_group is used to enable this by specifying which DH group to use. For example, fils_dh_group=19 would allow FILS SK PFS to be used with a 256-bit random ECP group. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:40:56 +01:00
#ifdef CONFIG_FILS_SK_PFS
if (sta->fils_dh_ss && sta->fils_ecdh) {
pub = crypto_ecdh_get_pubkey(sta->fils_ecdh, 1);
if (!pub) {
FILS: Move authentication response handling into a helper function This can be reused when splitting handle_auth_fils() to support the driver-based AP SME case. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
*resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
FILS: Add FILS SK auth PFS support in AP mode This adds an option to configure hostapd to enable use of perfect forward secrecy option in FILS shared key authentication. A new build option CONFIG_FILS_SK_PFS=y can be used to include this functionality. A new runtime configuration parameter fils_dh_group is used to enable this by specifying which DH group to use. For example, fils_dh_group=19 would allow FILS SK PFS to be used with a 256-bit random ECP group. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:40:56 +01:00
goto fail;
}
}
#endif /* CONFIG_FILS_SK_PFS */
data = wpabuf_alloc(1000 + ielen + (pub ? wpabuf_len(pub) : 0));
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
if (!data) {
FILS: Move authentication response handling into a helper function This can be reused when splitting handle_auth_fils() to support the driver-based AP SME case. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
*resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
goto fail;
}
FILS: Add FILS SK auth PFS support in AP mode This adds an option to configure hostapd to enable use of perfect forward secrecy option in FILS shared key authentication. A new build option CONFIG_FILS_SK_PFS=y can be used to include this functionality. A new runtime configuration parameter fils_dh_group is used to enable this by specifying which DH group to use. For example, fils_dh_group=19 would allow FILS SK PFS to be used with a 256-bit random ECP group. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:40:56 +01:00
/* TODO: FILS PK */
#ifdef CONFIG_FILS_SK_PFS
if (pub) {
/* Finite Cyclic Group */
wpabuf_put_le16(data, hapd->conf->fils_dh_group);
/* Element */
wpabuf_put_buf(data, pub);
}
#endif /* CONFIG_FILS_SK_PFS */
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
/* RSNE */
wpabuf_put_data(data, ie, ielen);
FILS: Add FTE into FILS Authentication frame from AP when using FILS+FT MDE was already added with RSNE, but FTE needed to be added to the FILS Authentication frame for the FT initial mobility domain association using FILS authentication case. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-04-02 21:38:48 +02:00
/* MDE when using FILS+FT (already included in ie,ielen with RSNE) */
#ifdef CONFIG_IEEE80211R_AP
if (wpa_key_mgmt_ft(wpa_auth_sta_key_mgmt(sta->wpa_sm))) {
/* FTE[R1KH-ID,R0KH-ID] when using FILS+FT */
int res;
FT: FTE generation for SHA384-based AKM on AP The MIC field is now a variable length field, so make FTE generation in hostapd aware of the two different field lengths. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-06-05 00:31:43 +02:00
int use_sha384 = wpa_key_mgmt_sha384(
wpa_auth_sta_key_mgmt(sta->wpa_sm));
FILS: Add FTE into FILS Authentication frame from AP when using FILS+FT MDE was already added with RSNE, but FTE needed to be added to the FILS Authentication frame for the FT initial mobility domain association using FILS authentication case. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-04-02 21:38:48 +02:00
FT: FTE generation for SHA384-based AKM on AP The MIC field is now a variable length field, so make FTE generation in hostapd aware of the two different field lengths. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-06-05 00:31:43 +02:00
res = wpa_auth_write_fte(hapd->wpa_auth, use_sha384,
wpabuf_put(data, 0),
FILS: Add FTE into FILS Authentication frame from AP when using FILS+FT MDE was already added with RSNE, but FTE needed to be added to the FILS Authentication frame for the FT initial mobility domain association using FILS authentication case. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-04-02 21:38:48 +02:00
wpabuf_tailroom(data));
if (res < 0) {
FILS: Move authentication response handling into a helper function This can be reused when splitting handle_auth_fils() to support the driver-based AP SME case. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
*resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
FILS: Add FTE into FILS Authentication frame from AP when using FILS+FT MDE was already added with RSNE, but FTE needed to be added to the FILS Authentication frame for the FT initial mobility domain association using FILS authentication case. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-04-02 21:38:48 +02:00
goto fail;
}
wpabuf_put(data, res);
}
#endif /* CONFIG_IEEE80211R_AP */
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
/* FILS Nonce */
wpabuf_put_u8(data, WLAN_EID_EXTENSION); /* Element ID */
wpabuf_put_u8(data, 1 + FILS_NONCE_LEN); /* Length */
/* Element ID Extension */
wpabuf_put_u8(data, WLAN_EID_EXT_FILS_NONCE);
wpabuf_put_data(data, fils_nonce, FILS_NONCE_LEN);
/* FILS Session */
wpabuf_put_u8(data, WLAN_EID_EXTENSION); /* Element ID */
wpabuf_put_u8(data, 1 + FILS_SESSION_LEN); /* Length */
/* Element ID Extension */
wpabuf_put_u8(data, WLAN_EID_EXT_FILS_SESSION);
wpabuf_put_data(data, sta->fils_session, FILS_SESSION_LEN);
WPA: Rename FILS wrapped data IEEE P802.11az/D2.0 renamed the FILS Wrapped Data element, removing the FILS prefix. Change the code accordingly. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-02-24 10:14:32 +01:00
/* Wrapped Data */
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
if (!pmksa && erp_resp) {
wpabuf_put_u8(data, WLAN_EID_EXTENSION); /* Element ID */
wpabuf_put_u8(data, 1 + wpabuf_len(erp_resp)); /* Length */
/* Element ID Extension */
WPA: Rename FILS wrapped data IEEE P802.11az/D2.0 renamed the FILS Wrapped Data element, removing the FILS prefix. Change the code accordingly. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-02-24 10:14:32 +01:00
wpabuf_put_u8(data, WLAN_EID_EXT_WRAPPED_DATA);
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
wpabuf_put_buf(data, erp_resp);
FILS: Fix PMK and PMKID derivation from ERP This adds helper functions for deriving PMK and PMKID from ERP exchange in FILS shared key authentication as defined in IEEE Std 802.11ai-2016, 12.12.2.5.2 (PMKSA key derivation with FILS authentication). These functions is used to fix PMK and PMKID derivation which were previously using the rMSK directly as PMK instead of following the FILS protocol to derive PMK with HMAC from nonces and rMSK. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-13 20:06:21 +01:00
if (fils_rmsk_to_pmk(wpa_auth_sta_key_mgmt(sta->wpa_sm),
msk, msk_len, sta->fils_snonce, fils_nonce,
FILS: Add FILS SK auth PFS support in AP mode This adds an option to configure hostapd to enable use of perfect forward secrecy option in FILS shared key authentication. A new build option CONFIG_FILS_SK_PFS=y can be used to include this functionality. A new runtime configuration parameter fils_dh_group is used to enable this by specifying which DH group to use. For example, fils_dh_group=19 would allow FILS SK PFS to be used with a 256-bit random ECP group. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:40:56 +01:00
sta->fils_dh_ss ?
wpabuf_head(sta->fils_dh_ss) : NULL,
sta->fils_dh_ss ?
wpabuf_len(sta->fils_dh_ss) : 0,
pmk_buf, &pmk_len)) {
FILS: Fix PMK and PMKID derivation from ERP This adds helper functions for deriving PMK and PMKID from ERP exchange in FILS shared key authentication as defined in IEEE Std 802.11ai-2016, 12.12.2.5.2 (PMKSA key derivation with FILS authentication). These functions is used to fix PMK and PMKID derivation which were previously using the rMSK directly as PMK instead of following the FILS protocol to derive PMK with HMAC from nonces and rMSK. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-13 20:06:21 +01:00
wpa_printf(MSG_DEBUG, "FILS: Failed to derive PMK");
FILS: Move authentication response handling into a helper function This can be reused when splitting handle_auth_fils() to support the driver-based AP SME case. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
*resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
FILS: Fix PMK and PMKID derivation from ERP This adds helper functions for deriving PMK and PMKID from ERP exchange in FILS shared key authentication as defined in IEEE Std 802.11ai-2016, 12.12.2.5.2 (PMKSA key derivation with FILS authentication). These functions is used to fix PMK and PMKID derivation which were previously using the rMSK directly as PMK instead of following the FILS protocol to derive PMK with HMAC from nonces and rMSK. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-13 20:06:21 +01:00
wpabuf_free(data);
data = NULL;
goto fail;
}
pmk = pmk_buf;
FILS: ERP-based PMKSA cache addition on AP hostapd did not add a new PMKSA cache entry when FILS shared key authentication was used, i.e., only the initial full authentication resulted in a PMKSA cache entry being created. Derive the PMKID for the ERP case as well and add a PMKSA cache entry if the ERP exchange succeeds. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-05 16:52:23 +02:00
FILS: Add DHss into FILS-Key-Data derivation when using FILS SK+PFS This part is missing from IEEE Std 802.11ai-2016, but the lack of DHss here means there would not be proper PFS for the case where PMKSA caching is used with FILS SK+PFS authentication. This was not really the intent of the FILS design and that issue was fixed during REVmd work with the changes proposed in https://mentor.ieee.org/802.11/dcn/17/11-17-0906-04-000m-fils-fixes.docx that add DHss into FILS-Key-Data (and PTK, in practice) derivation for the PMKSA caching case so that a unique ICK, KEK, and TK are derived even when using the same PMK. Note: This is not backwards compatible, i.e., this breaks PMKSA caching with FILS SK+PFS if only STA or AP side implementation is updated. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-09-13 20:36:05 +02:00
/* Don't use DHss in PTK derivation if PMKSA caching is not
* used. */
wpabuf_clear_free(sta->fils_dh_ss);
sta->fils_dh_ss = NULL;
FILS: ERP-based PMKSA cache addition on AP hostapd did not add a new PMKSA cache entry when FILS shared key authentication was used, i.e., only the initial full authentication resulted in a PMKSA cache entry being created. Derive the PMKID for the ERP case as well and add a PMKSA cache entry if the ERP exchange succeeds. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-05 16:52:23 +02:00
if (sta->fils_erp_pmkid_set) {
/* TODO: get PMKLifetime from WPA parameters */
unsigned int dot11RSNAConfigPMKLifetime = 43200;
Convert STA session_timeout to os_reltime This is needed to allow the remaining session time to be computed for FT (when sending PMK-R1 to another AP). Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2017-05-18 15:21:56 +02:00
int session_timeout;
session_timeout = dot11RSNAConfigPMKLifetime;
if (sta->session_timeout_set) {
struct os_reltime now, diff;
os_get_reltime(&now);
os_reltime_sub(&sta->session_timeout, &now,
&diff);
session_timeout = diff.sec;
}
FILS: ERP-based PMKSA cache addition on AP hostapd did not add a new PMKSA cache entry when FILS shared key authentication was used, i.e., only the initial full authentication resulted in a PMKSA cache entry being created. Derive the PMKID for the ERP case as well and add a PMKSA cache entry if the ERP exchange succeeds. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-05 16:52:23 +02:00
sta->fils_erp_pmkid_set = 0;
FILS: Fix PTK rekeying The PMK and PMKID information from FILS ERP and FILS PMKSA caching needs to be stored within struct wpa_state_machine for PTK to work. Without this, PTK derivation would fail and attempt to go through rekeying would result in disconnection. Furthermore, wpa_rekey_ptk() timer needs to be started at the completion of FILS association since the place where it was done for non-FILS cases at the end of 4-way handshake is not reached when FILS authentication is used. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-04-17 21:52:23 +02:00
wpa_auth_add_fils_pmk_pmkid(sta->wpa_sm, pmk, pmk_len,
sta->fils_erp_pmkid);
FILS: Do not try to add PMKSA cache entry if caching is disabled This gets rid of a confusing error message "FILS: Failed to add PMKSA cache entry based on ERP" for cases where PMKSA caching is disabled in hostapd (disable_pmksa_caching=1). Functionality remains unchanged, i.e., no cache entry was added before this change either. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-13 15:34:48 +01:00
if (!hapd->conf->disable_pmksa_caching &&
wpa_auth_pmksa_add2(
FILS: ERP-based PMKSA cache addition on AP hostapd did not add a new PMKSA cache entry when FILS shared key authentication was used, i.e., only the initial full authentication resulted in a PMKSA cache entry being created. Derive the PMKID for the ERP case as well and add a PMKSA cache entry if the ERP exchange succeeds. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-05 16:52:23 +02:00
hapd->wpa_auth, sta->addr,
pmk, pmk_len,
sta->fils_erp_pmkid,
Convert STA session_timeout to os_reltime This is needed to allow the remaining session time to be computed for FT (when sending PMK-R1 to another AP). Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2017-05-18 15:21:56 +02:00
session_timeout,
FILS: ERP-based PMKSA cache addition on AP hostapd did not add a new PMKSA cache entry when FILS shared key authentication was used, i.e., only the initial full authentication resulted in a PMKSA cache entry being created. Derive the PMKID for the ERP case as well and add a PMKSA cache entry if the ERP exchange succeeds. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-05 16:52:23 +02:00
wpa_auth_sta_key_mgmt(sta->wpa_sm)) < 0) {
wpa_printf(MSG_ERROR,
"FILS: Failed to add PMKSA cache entry based on ERP");
}
}
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
} else if (pmksa) {
pmk = pmksa->pmk;
pmk_len = pmksa->pmk_len;
}
if (!pmk) {
wpa_printf(MSG_DEBUG, "FILS: No PMK available");
FILS: Move authentication response handling into a helper function This can be reused when splitting handle_auth_fils() to support the driver-based AP SME case. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
*resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
wpabuf_free(data);
data = NULL;
goto fail;
}
if (fils_auth_pmk_to_ptk(sta->wpa_sm, pmk, pmk_len,
FILS: Fix Key-Auth derivation for SK+PFS for authenticator side The conditional gSTA and gAP (DH public keys) were not previously included in Key-Auth derivation, but they are needed for the PFS case. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-05-07 16:04:08 +02:00
sta->fils_snonce, fils_nonce,
FILS: Add DHss into FILS-Key-Data derivation when using FILS SK+PFS This part is missing from IEEE Std 802.11ai-2016, but the lack of DHss here means there would not be proper PFS for the case where PMKSA caching is used with FILS SK+PFS authentication. This was not really the intent of the FILS design and that issue was fixed during REVmd work with the changes proposed in https://mentor.ieee.org/802.11/dcn/17/11-17-0906-04-000m-fils-fixes.docx that add DHss into FILS-Key-Data (and PTK, in practice) derivation for the PMKSA caching case so that a unique ICK, KEK, and TK are derived even when using the same PMK. Note: This is not backwards compatible, i.e., this breaks PMKSA caching with FILS SK+PFS if only STA or AP side implementation is updated. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-09-13 20:36:05 +02:00
sta->fils_dh_ss ?
wpabuf_head(sta->fils_dh_ss) : NULL,
sta->fils_dh_ss ?
wpabuf_len(sta->fils_dh_ss) : 0,
FILS: Fix Key-Auth derivation for SK+PFS for authenticator side The conditional gSTA and gAP (DH public keys) were not previously included in Key-Auth derivation, but they are needed for the PFS case. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-05-07 16:04:08 +02:00
sta->fils_g_sta, pub) < 0) {
FILS: Move authentication response handling into a helper function This can be reused when splitting handle_auth_fils() to support the driver-based AP SME case. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
*resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
wpabuf_free(data);
data = NULL;
goto fail;
}
fail:
FILS: Move authentication response handling into a helper function This can be reused when splitting handle_auth_fils() to support the driver-based AP SME case. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
if (is_pub)
*is_pub = pub != NULL;
os_free(ie_buf);
wpabuf_free(pub);
wpabuf_clear_free(sta->fils_dh_ss);
sta->fils_dh_ss = NULL;
#ifdef CONFIG_FILS_SK_PFS
crypto_ecdh_deinit(sta->fils_ecdh);
sta->fils_ecdh = NULL;
#endif /* CONFIG_FILS_SK_PFS */
return data;
}
static void handle_auth_fils_finish(struct hostapd_data *hapd,
struct sta_info *sta, u16 resp,
FILS: Make handle_auth_fils() re-usable for driver-based AP SME Allow this function to be called from outside ieee802_11.c and with the final steps replaced through a callback function. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
struct wpabuf *data, int pub)
FILS: Move authentication response handling into a helper function This can be reused when splitting handle_auth_fils() to support the driver-based AP SME case. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
{
u16 auth_alg;
FILS: Add FILS SK auth PFS support in AP mode This adds an option to configure hostapd to enable use of perfect forward secrecy option in FILS shared key authentication. A new build option CONFIG_FILS_SK_PFS=y can be used to include this functionality. A new runtime configuration parameter fils_dh_group is used to enable this by specifying which DH group to use. For example, fils_dh_group=19 would allow FILS SK PFS to be used with a 256-bit random ECP group. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:40:56 +01:00
auth_alg = (pub ||
resp == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED) ?
WLAN_AUTH_FILS_SK_PFS : WLAN_AUTH_FILS_SK;
SAE: A bit optimized sae_confirm_immediate=2 for testing purposes sae_confirm_immediate=2 can now be used in CONFIG_TESTING_OPTIONS=y builds to minimize the latency between SAE Commit and SAE Confirm by postponing transmission of SAE Commit until the SAE Confirm frame is generated. This does not have significant impact, but can get the frames tiny bit closer to each other over the air to increase testing coverage. The only difference between sae_confirm_immediate 1 and 2 is in the former deriving KCK, PMK, PMKID, and CN between transmission of the frames (i.e., a small number of hash operations). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-08 19:52:26 +01:00
send_auth_reply(hapd, sta, sta->addr, hapd->own_addr, auth_alg, 2, resp,
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
data ? wpabuf_head(data) : (u8 *) "",
hostapd: Add send_auth_reply() caller info in debug logging This can help one understand better what happens during the authentication exchange. Signed-off-by: Ben Greear <greearb@candelatech.com>
2017-12-07 18:14:49 +01:00
data ? wpabuf_len(data) : 0, "auth-fils-finish");
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
wpabuf_free(data);
if (resp == WLAN_STATUS_SUCCESS) {
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
"authentication OK (FILS)");
sta->flags |= WLAN_STA_AUTH;
wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
FILS: Add FILS SK auth PFS support in AP mode This adds an option to configure hostapd to enable use of perfect forward secrecy option in FILS shared key authentication. A new build option CONFIG_FILS_SK_PFS=y can be used to include this functionality. A new runtime configuration parameter fils_dh_group is used to enable this by specifying which DH group to use. For example, fils_dh_group=19 would allow FILS SK PFS to be used with a 256-bit random ECP group. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:40:56 +01:00
sta->auth_alg = pub ? WLAN_AUTH_FILS_SK_PFS : WLAN_AUTH_FILS_SK;
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
mlme_authenticate_indication(hapd, sta);
}
}
void ieee802_11_finish_fils_auth(struct hostapd_data *hapd,
struct sta_info *sta, int success,
struct wpabuf *erp_resp,
const u8 *msk, size_t msk_len)
{
FILS: Make handle_auth_fils() re-usable for driver-based AP SME Allow this function to be called from outside ieee802_11.c and with the final steps replaced through a callback function. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
u16 resp;
AP: Support PASN with FILS key derivation As the PASN FILS authentication is only defined for FILS SK without PFS, and to support PASN authentication with FILS, implement the PASN with FILS processing as part of the PASN handling and not as part of the WPA Authenticator state machine. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:56 +01:00
u32 flags = sta->flags;
FILS: Make handle_auth_fils() re-usable for driver-based AP SME Allow this function to be called from outside ieee802_11.c and with the final steps replaced through a callback function. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
AP: Support PASN with FILS key derivation As the PASN FILS authentication is only defined for FILS SK without PFS, and to support PASN authentication with FILS, implement the PASN with FILS processing as part of the PASN handling and not as part of the WPA Authenticator state machine. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:56 +01:00
sta->flags &= ~(WLAN_STA_PENDING_FILS_ERP |
WLAN_STA_PENDING_PASN_FILS_ERP);
FILS: Make handle_auth_fils() re-usable for driver-based AP SME Allow this function to be called from outside ieee802_11.c and with the final steps replaced through a callback function. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
resp = success ? WLAN_STATUS_SUCCESS : WLAN_STATUS_UNSPECIFIED_FAILURE;
AP: Support PASN with FILS key derivation As the PASN FILS authentication is only defined for FILS SK without PFS, and to support PASN authentication with FILS, implement the PASN with FILS processing as part of the PASN handling and not as part of the WPA Authenticator state machine. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:56 +01:00
if (flags & WLAN_STA_PENDING_FILS_ERP) {
struct wpabuf *data;
int pub = 0;
if (!sta->fils_pending_cb)
return;
data = prepare_auth_resp_fils(hapd, sta, &resp, NULL, erp_resp,
msk, msk_len, &pub);
if (!data) {
wpa_printf(MSG_DEBUG,
"%s: prepare_auth_resp_fils() failure",
__func__);
}
sta->fils_pending_cb(hapd, sta, resp, data, pub);
#ifdef CONFIG_PASN
} else if (flags & WLAN_STA_PENDING_PASN_FILS_ERP) {
pasn_fils_auth_resp(hapd, sta, resp, erp_resp,
msk, msk_len);
#endif /* CONFIG_PASN */
FILS: Make handle_auth_fils() re-usable for driver-based AP SME Allow this function to be called from outside ieee802_11.c and with the final steps replaced through a callback function. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
}
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
}
#endif /* CONFIG_FILS */
Call hostapd_allowed_address() directly from handle_probe_req() ieee802_11_allowed_address() did not really do anything useful for the call from handle_probe_req(), so replace that with a direct call to hostapd_allowed_address() and make ieee802_11_allowed_address() a static function. Signed-off-by: Jouni Malinen <j@w1.fi>
2019-12-29 22:24:10 +01:00
static int ieee802_11_allowed_address(struct hostapd_data *hapd, const u8 *addr,
const u8 *msg, size_t len,
struct radius_sta *info)
AP: Check ACL upon association request for 802.11ad With device_ap_sme disabled, ACL was checked upon authentication request. In 802.11ad there is no authentication phase so need to check ACL upon association. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2017-01-17 13:51:02 +01:00
{
int res;
Call hostapd_allowed_address() directly from handle_probe_req() ieee802_11_allowed_address() did not really do anything useful for the call from handle_probe_req(), so replace that with a direct call to hostapd_allowed_address() and make ieee802_11_allowed_address() a static function. Signed-off-by: Jouni Malinen <j@w1.fi>
2019-12-29 22:24:10 +01:00
res = hostapd_allowed_address(hapd, addr, msg, len, info, 0);
AP: Check ACL upon association request for 802.11ad With device_ap_sme disabled, ACL was checked upon authentication request. In 802.11ad there is no authentication phase so need to check ACL upon association. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2017-01-17 13:51:02 +01:00
if (res == HOSTAPD_ACL_REJECT) {
Call hostapd_allowed_address() directly from handle_probe_req() ieee802_11_allowed_address() did not really do anything useful for the call from handle_probe_req(), so replace that with a direct call to hostapd_allowed_address() and make ieee802_11_allowed_address() a static function. Signed-off-by: Jouni Malinen <j@w1.fi>
2019-12-29 22:24:10 +01:00
wpa_printf(MSG_DEBUG, "Station " MACSTR
" not allowed to authenticate",
MAC2STR(addr));
AP: Check ACL upon association request for 802.11ad With device_ap_sme disabled, ACL was checked upon authentication request. In 802.11ad there is no authentication phase so need to check ACL upon association. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2017-01-17 13:51:02 +01:00
return HOSTAPD_ACL_REJECT;
}
if (res == HOSTAPD_ACL_PENDING) {
wpa_printf(MSG_DEBUG, "Authentication frame from " MACSTR
" waiting for an external authentication",
MAC2STR(addr));
/* Authentication code will re-send the authentication frame
* after it has received (and cached) information from the
* external source. */
return HOSTAPD_ACL_PENDING;
}
return res;
}
static int
ieee802_11_set_radius_info(struct hostapd_data *hapd, struct sta_info *sta,
Move the RADIUS cached attributes into a struct This makes it easier to pass these around and to add new attributes. Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2019-04-28 13:14:57 +02:00
int res, struct radius_sta *info)
AP: Check ACL upon association request for 802.11ad With device_ap_sme disabled, ACL was checked upon authentication request. In 802.11ad there is no authentication phase so need to check ACL upon association. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2017-01-17 13:51:02 +01:00
{
Move the RADIUS cached attributes into a struct This makes it easier to pass these around and to add new attributes. Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2019-04-28 13:14:57 +02:00
u32 session_timeout = info->session_timeout;
u32 acct_interim_interval = info->acct_interim_interval;
struct vlan_description *vlan_id = &info->vlan_id;
Fix possible memory leak of RADIUS data in handle_auth() When returning from handle_auth() after ieee802_11_allowed_address() returned HOSTAPD_ACL_ACCEPT, but before ieee802_11_set_radius_info() has been called, identity, radius_cui, and psk might not have been consumed. Fix this by avoiding the need to free these variables at all. Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2019-04-28 13:14:57 +02:00
struct hostapd_sta_wpa_psk_short *psk = info->psk;
char *identity = info->identity;
char *radius_cui = info->radius_cui;
Move the RADIUS cached attributes into a struct This makes it easier to pass these around and to add new attributes. Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2019-04-28 13:14:57 +02:00
AP: Check ACL upon association request for 802.11ad With device_ap_sme disabled, ACL was checked upon authentication request. In 802.11ad there is no authentication phase so need to check ACL upon association. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2017-01-17 13:51:02 +01:00
if (vlan_id->notempty &&
!hostapd_vlan_valid(hapd->conf->vlan, vlan_id)) {
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
HOSTAPD_LEVEL_INFO,
"Invalid VLAN %d%s received from RADIUS server",
vlan_id->untagged,
vlan_id->tagged[0] ? "+" : "");
return -1;
}
if (ap_sta_set_vlan(hapd, sta, vlan_id) < 0)
return -1;
if (sta->vlan_id)
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
HOSTAPD_LEVEL_INFO, "VLAN ID %d", sta->vlan_id);
hostapd_free_psk_list(sta->psk);
Fix possible memory leak of RADIUS data in handle_auth() When returning from handle_auth() after ieee802_11_allowed_address() returned HOSTAPD_ACL_ACCEPT, but before ieee802_11_set_radius_info() has been called, identity, radius_cui, and psk might not have been consumed. Fix this by avoiding the need to free these variables at all. Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2019-04-28 13:14:57 +02:00
if (hapd->conf->wpa_psk_radius != PSK_RADIUS_IGNORED)
hostapd_copy_psk_list(&sta->psk, psk);
else
AP: Check ACL upon association request for 802.11ad With device_ap_sme disabled, ACL was checked upon authentication request. In 802.11ad there is no authentication phase so need to check ACL upon association. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2017-01-17 13:51:02 +01:00
sta->psk = NULL;
Fix potential memory leak with identity/radius_cui ieee802_11_set_radius_info() might be called with a STA entry that has already stored identity and/or radius_cui information, so make sure the old values get freed before being replaced by the new ones. Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2017-05-18 15:21:54 +02:00
os_free(sta->identity);
Fix possible memory leak of RADIUS data in handle_auth() When returning from handle_auth() after ieee802_11_allowed_address() returned HOSTAPD_ACL_ACCEPT, but before ieee802_11_set_radius_info() has been called, identity, radius_cui, and psk might not have been consumed. Fix this by avoiding the need to free these variables at all. Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2019-04-28 13:14:57 +02:00
if (identity)
sta->identity = os_strdup(identity);
else
sta->identity = NULL;
Fix potential memory leak with identity/radius_cui ieee802_11_set_radius_info() might be called with a STA entry that has already stored identity and/or radius_cui information, so make sure the old values get freed before being replaced by the new ones. Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2017-05-18 15:21:54 +02:00
os_free(sta->radius_cui);
Fix possible memory leak of RADIUS data in handle_auth() When returning from handle_auth() after ieee802_11_allowed_address() returned HOSTAPD_ACL_ACCEPT, but before ieee802_11_set_radius_info() has been called, identity, radius_cui, and psk might not have been consumed. Fix this by avoiding the need to free these variables at all. Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2019-04-28 13:14:57 +02:00
if (radius_cui)
sta->radius_cui = os_strdup(radius_cui);
else
sta->radius_cui = NULL;
AP: Check ACL upon association request for 802.11ad With device_ap_sme disabled, ACL was checked upon authentication request. In 802.11ad there is no authentication phase so need to check ACL upon association. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2017-01-17 13:51:02 +01:00
if (hapd->conf->acct_interim_interval == 0 && acct_interim_interval)
sta->acct_interim_interval = acct_interim_interval;
Convert STA session_timeout to os_reltime This is needed to allow the remaining session time to be computed for FT (when sending PMK-R1 to another AP). Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2017-05-18 15:21:56 +02:00
if (res == HOSTAPD_ACL_ACCEPT_TIMEOUT) {
sta->session_timeout_set = 1;
os_get_reltime(&sta->session_timeout);
sta->session_timeout.sec += session_timeout;
AP: Check ACL upon association request for 802.11ad With device_ap_sme disabled, ACL was checked upon authentication request. In 802.11ad there is no authentication phase so need to check ACL upon association. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2017-01-17 13:51:02 +01:00
ap_sta_session_timeout(hapd, sta, session_timeout);
Convert STA session_timeout to os_reltime This is needed to allow the remaining session time to be computed for FT (when sending PMK-R1 to another AP). Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2017-05-18 15:21:56 +02:00
} else {
sta->session_timeout_set = 0;
AP: Check ACL upon association request for 802.11ad With device_ap_sme disabled, ACL was checked upon authentication request. In 802.11ad there is no authentication phase so need to check ACL upon association. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2017-01-17 13:51:02 +01:00
ap_sta_no_session_timeout(hapd, sta);
Convert STA session_timeout to os_reltime This is needed to allow the remaining session time to be computed for FT (when sending PMK-R1 to another AP). Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2017-05-18 15:21:56 +02:00
}
AP: Check ACL upon association request for 802.11ad With device_ap_sme disabled, ACL was checked upon authentication request. In 802.11ad there is no authentication phase so need to check ACL upon association. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2017-01-17 13:51:02 +01:00
return 0;
}
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
#ifdef CONFIG_PASN
AP: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:53 +01:00
#ifdef CONFIG_SAE
static int pasn_wd_handle_sae_commit(struct hostapd_data *hapd,
struct sta_info *sta,
struct wpabuf *wd)
{
struct pasn_data *pasn = sta->pasn;
PASN: Change PASN flows to use SAE H2E only Do so for both wpa_supplicant and hostapd. While this was not explicitly required in IEEE P802.11az/D3.0, likely direction for the draft is to start requiring use of H2E for all cases where SAE is used with PASN. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-04-08 11:06:24 +02:00
const char *password;
AP: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:53 +01:00
const u8 *data;
size_t buf_len;
u16 res, alg, seq, status;
int groups[] = { pasn->group, 0 };
PASN: Change PASN flows to use SAE H2E only Do so for both wpa_supplicant and hostapd. While this was not explicitly required in IEEE P802.11az/D3.0, likely direction for the draft is to start requiring use of H2E for all cases where SAE is used with PASN. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-04-08 11:06:24 +02:00
struct sae_pt *pt = NULL;
AP: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:53 +01:00
int ret;
if (!wd)
return -1;
data = wpabuf_head_u8(wd);
buf_len = wpabuf_len(wd);
if (buf_len < 6) {
wpa_printf(MSG_DEBUG, "PASN: SAE buffer too short. len=%lu",
buf_len);
return -1;
}
alg = WPA_GET_LE16(data);
seq = WPA_GET_LE16(data + 2);
status = WPA_GET_LE16(data + 4);
wpa_printf(MSG_DEBUG, "PASN: SAE commit: alg=%u, seq=%u, status=%u",
alg, seq, status);
PASN: Change PASN flows to use SAE H2E only Do so for both wpa_supplicant and hostapd. While this was not explicitly required in IEEE P802.11az/D3.0, likely direction for the draft is to start requiring use of H2E for all cases where SAE is used with PASN. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-04-08 11:06:24 +02:00
if (alg != WLAN_AUTH_SAE || seq != 1 ||
status != WLAN_STATUS_SAE_HASH_TO_ELEMENT) {
AP: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:53 +01:00
wpa_printf(MSG_DEBUG, "PASN: Dropping peer SAE commit");
return -1;
}
sae_clear_data(&pasn->sae);
pasn->sae.state = SAE_NOTHING;
ret = sae_set_group(&pasn->sae, pasn->group);
if (ret) {
wpa_printf(MSG_DEBUG, "PASN: Failed to set SAE group");
return -1;
}
PASN: Change PASN flows to use SAE H2E only Do so for both wpa_supplicant and hostapd. While this was not explicitly required in IEEE P802.11az/D3.0, likely direction for the draft is to start requiring use of H2E for all cases where SAE is used with PASN. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-04-08 11:06:24 +02:00
password = sae_get_password(hapd, sta, NULL, NULL, &pt, NULL);
if (!password || !pt) {
wpa_printf(MSG_DEBUG, "PASN: No SAE PT found");
AP: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:53 +01:00
return -1;
}
PASN: Change PASN flows to use SAE H2E only Do so for both wpa_supplicant and hostapd. While this was not explicitly required in IEEE P802.11az/D3.0, likely direction for the draft is to start requiring use of H2E for all cases where SAE is used with PASN. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-04-08 11:06:24 +02:00
ret = sae_prepare_commit_pt(&pasn->sae, pt, hapd->own_addr, sta->addr,
NULL, NULL);
AP: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:53 +01:00
if (ret) {
wpa_printf(MSG_DEBUG, "PASN: Failed to prepare SAE commit");
return -1;
}
res = sae_parse_commit(&pasn->sae, data + 6, buf_len - 6, NULL, 0,
groups, 0);
if (res != WLAN_STATUS_SUCCESS) {
wpa_printf(MSG_DEBUG, "PASN: Failed parsing SAE commit");
return -1;
}
/* Process the commit message and derive the PMK */
ret = sae_process_commit(&pasn->sae);
if (ret) {
wpa_printf(MSG_DEBUG, "SAE: Failed to process peer commit");
return -1;
}
pasn->sae.state = SAE_COMMITTED;
return 0;
}
static int pasn_wd_handle_sae_confirm(struct hostapd_data *hapd,
struct sta_info *sta,
struct wpabuf *wd)
{
struct pasn_data *pasn = sta->pasn;
const u8 *data;
size_t buf_len;
u16 res, alg, seq, status;
if (!wd)
return -1;
data = wpabuf_head_u8(wd);
buf_len = wpabuf_len(wd);
if (buf_len < 6) {
wpa_printf(MSG_DEBUG, "PASN: SAE buffer too short. len=%lu",
buf_len);
return -1;
}
alg = WPA_GET_LE16(data);
seq = WPA_GET_LE16(data + 2);
status = WPA_GET_LE16(data + 4);
wpa_printf(MSG_DEBUG, "PASN: SAE confirm: alg=%u, seq=%u, status=%u",
alg, seq, status);
if (alg != WLAN_AUTH_SAE || seq != 2 || status != WLAN_STATUS_SUCCESS) {
wpa_printf(MSG_DEBUG, "PASN: Dropping peer SAE confirm");
return -1;
}
res = sae_check_confirm(&pasn->sae, data + 6, buf_len - 6);
if (res != WLAN_STATUS_SUCCESS) {
wpa_printf(MSG_DEBUG, "PASN: SAE failed checking confirm");
return -1;
}
pasn->sae.state = SAE_ACCEPTED;
/*
* TODO: Based on on IEEE P802.11az/D2.6, the PMKSA derived with
* PASN/SAE should only be allowed with future PASN only. For now do not
* restrict this only for PASN.
*/
wpa_auth_pmksa_add_sae(hapd->wpa_auth, sta->addr,
pasn->sae.pmk, pasn->sae.pmkid);
return 0;
}
static struct wpabuf * pasn_get_sae_wd(struct hostapd_data *hapd,
struct sta_info *sta)
{
struct pasn_data *pasn = sta->pasn;
struct wpabuf *buf = NULL;
u8 *len_ptr;
size_t len;
/* Need to add the entire Authentication frame body */
buf = wpabuf_alloc(8 + SAE_COMMIT_MAX_LEN + 8 + SAE_CONFIRM_MAX_LEN);
if (!buf) {
wpa_printf(MSG_DEBUG, "PASN: Failed to allocate SAE buffer");
return NULL;
}
/* Need to add the entire authentication frame body for the commit */
len_ptr = wpabuf_put(buf, 2);
wpabuf_put_le16(buf, WLAN_AUTH_SAE);
wpabuf_put_le16(buf, 1);
PASN: Change PASN flows to use SAE H2E only Do so for both wpa_supplicant and hostapd. While this was not explicitly required in IEEE P802.11az/D3.0, likely direction for the draft is to start requiring use of H2E for all cases where SAE is used with PASN. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-04-08 11:06:24 +02:00
wpabuf_put_le16(buf, WLAN_STATUS_SAE_HASH_TO_ELEMENT);
AP: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:53 +01:00
/* Write the actual commit and update the length accordingly */
sae_write_commit(&pasn->sae, buf, NULL, 0);
len = wpabuf_len(buf);
WPA_PUT_LE16(len_ptr, len - 2);
/* Need to add the entire Authentication frame body for the confirm */
len_ptr = wpabuf_put(buf, 2);
wpabuf_put_le16(buf, WLAN_AUTH_SAE);
wpabuf_put_le16(buf, 2);
wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
sae_write_confirm(&pasn->sae, buf);
WPA_PUT_LE16(len_ptr, wpabuf_len(buf) - len - 2);
pasn->sae.state = SAE_CONFIRMED;
return buf;
}
#endif /* CONFIG_SAE */
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
AP: Support PASN with FILS key derivation As the PASN FILS authentication is only defined for FILS SK without PFS, and to support PASN authentication with FILS, implement the PASN with FILS processing as part of the PASN handling and not as part of the WPA Authenticator state machine. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:56 +01:00
#ifdef CONFIG_FILS
static struct wpabuf * pasn_get_fils_wd(struct hostapd_data *hapd,
struct sta_info *sta)
{
struct pasn_data *pasn = sta->pasn;
struct pasn_fils_data *fils = &pasn->fils;
struct wpabuf *buf = NULL;
if (!fils->erp_resp) {
wpa_printf(MSG_DEBUG, "PASN: FILS: Missing erp_resp");
return NULL;
}
buf = wpabuf_alloc(1500);
if (!buf)
return NULL;
/* Add the authentication algorithm */
wpabuf_put_le16(buf, WLAN_AUTH_FILS_SK);
/* Authentication Transaction seq# */
wpabuf_put_le16(buf, 2);
/* Status Code */
wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
/* Own RSNE */
wpa_pasn_add_rsne(buf, NULL, pasn->akmp, pasn->cipher);
/* FILS Nonce */
wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
wpabuf_put_u8(buf, 1 + FILS_NONCE_LEN);
wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_NONCE);
wpabuf_put_data(buf, fils->anonce, FILS_NONCE_LEN);
/* FILS Session */
wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
wpabuf_put_u8(buf, 1 + FILS_SESSION_LEN);
wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_SESSION);
wpabuf_put_data(buf, fils->session, FILS_SESSION_LEN);
/* Wrapped Data */
wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
wpabuf_put_u8(buf, 1 + wpabuf_len(fils->erp_resp));
wpabuf_put_u8(buf, WLAN_EID_EXT_WRAPPED_DATA);
wpabuf_put_buf(buf, fils->erp_resp);
return buf;
}
static void pasn_fils_auth_resp(struct hostapd_data *hapd,
struct sta_info *sta, u16 status,
struct wpabuf *erp_resp,
const u8 *msk, size_t msk_len)
{
struct pasn_data *pasn = sta->pasn;
struct pasn_fils_data *fils = &pasn->fils;
u8 pmk[PMK_LEN_MAX];
size_t pmk_len;
int ret;
wpa_printf(MSG_DEBUG, "PASN: FILS: Handle AS response - status=%u",
status);
if (status != WLAN_STATUS_SUCCESS)
goto fail;
if (!pasn->secret) {
wpa_printf(MSG_DEBUG, "PASN: FILS: Missing secret");
goto fail;
}
if (random_get_bytes(fils->anonce, FILS_NONCE_LEN) < 0) {
wpa_printf(MSG_DEBUG, "PASN: FILS: Failed to get ANonce");
goto fail;
}
wpa_hexdump(MSG_DEBUG, "RSN: Generated FILS ANonce",
fils->anonce, FILS_NONCE_LEN);
ret = fils_rmsk_to_pmk(pasn->akmp, msk, msk_len, fils->nonce,
fils->anonce, NULL, 0, pmk, &pmk_len);
if (ret) {
wpa_printf(MSG_DEBUG, "FILS: Failed to derive PMK");
goto fail;
}
ret = pasn_pmk_to_ptk(pmk, pmk_len, sta->addr, hapd->own_addr,
wpabuf_head(pasn->secret),
wpabuf_len(pasn->secret),
&sta->pasn->ptk, sta->pasn->akmp,
PASN: Derive KDK only when required When a PTK derivation is done as part of PASN authentication flow, a KDK derivation should be done if and only if the higher layer protocol is supported by both parties. Fix the code accordingly, so KDK would be derived if and only if both sides support Secure LTF. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-04-08 11:06:20 +02:00
sta->pasn->cipher, sta->pasn->kdk_len);
AP: Support PASN with FILS key derivation As the PASN FILS authentication is only defined for FILS SK without PFS, and to support PASN authentication with FILS, implement the PASN with FILS processing as part of the PASN handling and not as part of the WPA Authenticator state machine. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:56 +01:00
if (ret) {
wpa_printf(MSG_DEBUG, "PASN: FILS: Failed to derive PTK");
goto fail;
}
wpa_printf(MSG_DEBUG, "PASN: PTK successfully derived");
wpabuf_free(pasn->secret);
pasn->secret = NULL;
fils->erp_resp = erp_resp;
ret = handle_auth_pasn_resp(hapd, sta, NULL, WLAN_STATUS_SUCCESS);
fils->erp_resp = NULL;
if (ret) {
wpa_printf(MSG_DEBUG, "PASN: FILS: Failed to send response");
goto fail;
}
fils->state = PASN_FILS_STATE_COMPLETE;
return;
fail:
ap_free_sta(hapd, sta);
}
static int pasn_wd_handle_fils(struct hostapd_data *hapd, struct sta_info *sta,
struct wpabuf *wd)
{
PASN: Avoid unreachable code with CONFIG_NO_RADIUS There is no point in trying to build in rest of this function if in the middle of it the CONFIG_NO_RADIUS case would unconditionally fail. Simply make all of this be conditional on that build parameter not being set to make things easier for static analyzers. Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 10:37:09 +01:00
#ifdef CONFIG_NO_RADIUS
wpa_printf(MSG_DEBUG, "PASN: FILS: RADIUS is not configured. Fail");
return -1;
#else /* CONFIG_NO_RADIUS */
AP: Support PASN with FILS key derivation As the PASN FILS authentication is only defined for FILS SK without PFS, and to support PASN authentication with FILS, implement the PASN with FILS processing as part of the PASN handling and not as part of the WPA Authenticator state machine. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:56 +01:00
struct pasn_data *pasn = sta->pasn;
struct pasn_fils_data *fils = &pasn->fils;
struct ieee802_11_elems elems;
struct wpa_ie_data rsne_data;
struct wpabuf *fils_wd;
const u8 *data;
size_t buf_len;
u16 alg, seq, status;
int ret;
if (fils->state != PASN_FILS_STATE_NONE) {
wpa_printf(MSG_DEBUG, "PASN: FILS: Not expecting wrapped data");
return -1;
}
if (!wd) {
wpa_printf(MSG_DEBUG, "PASN: FILS: No wrapped data");
return -1;
}
data = wpabuf_head_u8(wd);
buf_len = wpabuf_len(wd);
if (buf_len < 6) {
wpa_printf(MSG_DEBUG, "PASN: FILS: Buffer too short. len=%lu",
buf_len);
return -1;
}
alg = WPA_GET_LE16(data);
seq = WPA_GET_LE16(data + 2);
status = WPA_GET_LE16(data + 4);
wpa_printf(MSG_DEBUG, "PASN: FILS: alg=%u, seq=%u, status=%u",
alg, seq, status);
if (alg != WLAN_AUTH_FILS_SK || seq != 1 ||
status != WLAN_STATUS_SUCCESS) {
wpa_printf(MSG_DEBUG,
"PASN: FILS: Dropping peer authentication");
return -1;
}
data += 6;
buf_len -= 6;
if (ieee802_11_parse_elems(data, buf_len, &elems, 1) == ParseFailed) {
wpa_printf(MSG_DEBUG, "PASN: FILS: Could not parse elements");
return -1;
}
if (!elems.rsn_ie || !elems.fils_nonce || !elems.fils_nonce ||
!elems.wrapped_data) {
wpa_printf(MSG_DEBUG, "PASN: FILS: Missing IEs");
return -1;
}
ret = wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, elems.rsn_ie_len + 2,
&rsne_data);
if (ret) {
wpa_printf(MSG_DEBUG, "PASN: FILS: Failed parsing RNSE");
return -1;
}
ret = wpa_pasn_validate_rsne(&rsne_data);
if (ret) {
wpa_printf(MSG_DEBUG, "PASN: FILS: Failed validating RSNE");
return -1;
}
if (rsne_data.num_pmkid) {
wpa_printf(MSG_DEBUG,
"PASN: FILS: Not expecting PMKID in RSNE");
return -1;
}
wpa_hexdump(MSG_DEBUG, "PASN: FILS: Nonce", elems.fils_nonce,
FILS_NONCE_LEN);
os_memcpy(fils->nonce, elems.fils_nonce, FILS_NONCE_LEN);
wpa_hexdump(MSG_DEBUG, "PASN: FILS: Session", elems.fils_session,
FILS_SESSION_LEN);
os_memcpy(fils->session, elems.fils_session, FILS_SESSION_LEN);
fils_wd = ieee802_11_defrag(&elems, WLAN_EID_EXTENSION,
WLAN_EID_EXT_WRAPPED_DATA);
if (!fils_wd) {
wpa_printf(MSG_DEBUG, "PASN: FILS: Missing wrapped data");
return -1;
}
if (!sta->eapol_sm)
sta->eapol_sm = ieee802_1x_alloc_eapol_sm(hapd, sta);
wpa_printf(MSG_DEBUG,
"PASN: FILS: Forward EAP-Initiate/Re-auth to AS");
ieee802_1x_encapsulate_radius(hapd, sta, wpabuf_head(fils_wd),
wpabuf_len(fils_wd));
sta->flags |= WLAN_STA_PENDING_PASN_FILS_ERP;
fils->state = PASN_FILS_STATE_PENDING_AS;
/*
* Calculate pending PMKID here so that we do not need to maintain a
* copy of the EAP-Initiate/Reautt message.
*/
fils_pmkid_erp(pasn->akmp, wpabuf_head(fils_wd), wpabuf_len(fils_wd),
fils->erp_pmkid);
wpabuf_free(fils_wd);
return 0;
PASN: Avoid unreachable code with CONFIG_NO_RADIUS There is no point in trying to build in rest of this function if in the middle of it the CONFIG_NO_RADIUS case would unconditionally fail. Simply make all of this be conditional on that build parameter not being set to make things easier for static analyzers. Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 10:37:09 +01:00
#endif /* CONFIG_NO_RADIUS */
AP: Support PASN with FILS key derivation As the PASN FILS authentication is only defined for FILS SK without PFS, and to support PASN authentication with FILS, implement the PASN with FILS processing as part of the PASN handling and not as part of the WPA Authenticator state machine. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:56 +01:00
}
#endif /* CONFIG_FILS */
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
static struct wpabuf * pasn_get_wrapped_data(struct hostapd_data *hapd,
struct sta_info *sta)
{
switch (sta->pasn->akmp) {
case WPA_KEY_MGMT_PASN:
/* no wrapped data */
return NULL;
case WPA_KEY_MGMT_SAE:
AP: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:53 +01:00
#ifdef CONFIG_SAE
return pasn_get_sae_wd(hapd, sta);
AP: Support PASN with FILS key derivation As the PASN FILS authentication is only defined for FILS SK without PFS, and to support PASN authentication with FILS, implement the PASN with FILS processing as part of the PASN handling and not as part of the WPA Authenticator state machine. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:56 +01:00
#else /* CONFIG_SAE */
wpa_printf(MSG_ERROR,
"PASN: SAE: Cannot derive wrapped data");
return NULL;
AP: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:53 +01:00
#endif /* CONFIG_SAE */
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
case WPA_KEY_MGMT_FILS_SHA256:
case WPA_KEY_MGMT_FILS_SHA384:
AP: Support PASN with FILS key derivation As the PASN FILS authentication is only defined for FILS SK without PFS, and to support PASN authentication with FILS, implement the PASN with FILS processing as part of the PASN handling and not as part of the WPA Authenticator state machine. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:56 +01:00
#ifdef CONFIG_FILS
return pasn_get_fils_wd(hapd, sta);
#endif /* CONFIG_FILS */
/* fall through */
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
case WPA_KEY_MGMT_FT_PSK:
case WPA_KEY_MGMT_FT_IEEE8021X:
case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
default:
wpa_printf(MSG_ERROR,
"PASN: TODO: Wrapped data for akmp=0x%x",
sta->pasn->akmp);
return NULL;
}
}
static int
pasn_derive_keys(struct hostapd_data *hapd, struct sta_info *sta,
AP: Support PASN with FT key derivation Note that the implementation is not complete as it is missing support for the FT wrapped data which is optional for the station, but must be supported by the AP in case the station included it. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:01:04 +01:00
const u8 *cached_pmk, size_t cached_pmk_len,
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
struct wpa_pasn_params_data *pasn_data,
struct wpabuf *wrapped_data,
struct wpabuf *secret)
{
static const u8 pasn_default_pmk[] = {'P', 'M', 'K', 'z'};
u8 pmk[PMK_LEN_MAX];
u8 pmk_len;
int ret;
os_memset(pmk, 0, sizeof(pmk));
pmk_len = 0;
AP: Support PASN with FT key derivation Note that the implementation is not complete as it is missing support for the FT wrapped data which is optional for the station, but must be supported by the AP in case the station included it. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:01:04 +01:00
if (!cached_pmk || !cached_pmk_len)
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
wpa_printf(MSG_DEBUG, "PASN: No valid PMKSA entry");
if (sta->pasn->akmp == WPA_KEY_MGMT_PASN) {
wpa_printf(MSG_DEBUG, "PASN: Using default PMK");
pmk_len = WPA_PASN_PMK_LEN;
os_memcpy(pmk, pasn_default_pmk, sizeof(pasn_default_pmk));
AP: Support PASN with FT key derivation Note that the implementation is not complete as it is missing support for the FT wrapped data which is optional for the station, but must be supported by the AP in case the station included it. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:01:04 +01:00
} else if (cached_pmk && cached_pmk_len) {
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
wpa_printf(MSG_DEBUG, "PASN: Using PMKSA entry");
AP: Support PASN with FT key derivation Note that the implementation is not complete as it is missing support for the FT wrapped data which is optional for the station, but must be supported by the AP in case the station included it. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:01:04 +01:00
pmk_len = cached_pmk_len;
os_memcpy(pmk, cached_pmk, cached_pmk_len);
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
} else {
AP: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:53 +01:00
switch (sta->pasn->akmp) {
#ifdef CONFIG_SAE
case WPA_KEY_MGMT_SAE:
if (sta->pasn->sae.state == SAE_COMMITTED) {
pmk_len = PMK_LEN;
os_memcpy(pmk, sta->pasn->sae.pmk, PMK_LEN);
break;
}
#endif /* CONFIG_SAE */
/* fall through */
default:
/* TODO: Derive PMK based on wrapped data */
wpa_printf(MSG_DEBUG,
"PASN: Missing PMK derivation");
return -1;
}
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
}
ret = pasn_pmk_to_ptk(pmk, pmk_len, sta->addr, hapd->own_addr,
wpabuf_head(secret), wpabuf_len(secret),
&sta->pasn->ptk, sta->pasn->akmp,
PASN: Derive KDK only when required When a PTK derivation is done as part of PASN authentication flow, a KDK derivation should be done if and only if the higher layer protocol is supported by both parties. Fix the code accordingly, so KDK would be derived if and only if both sides support Secure LTF. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-04-08 11:06:20 +02:00
sta->pasn->cipher, sta->pasn->kdk_len);
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
if (ret) {
wpa_printf(MSG_DEBUG, "PASN: Failed to derive PTK");
return -1;
}
wpa_printf(MSG_DEBUG, "PASN: PTK successfully derived");
return 0;
}
PASN: Add support for comeback flow in AP mode Reuse the SAE anti-clogging token implementation to support similar design with the PASN comeback cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:08 +01:00
static void handle_auth_pasn_comeback(struct hostapd_data *hapd,
struct sta_info *sta, u16 group)
{
struct wpabuf *buf, *comeback;
int ret;
wpa_printf(MSG_DEBUG,
"PASN: Building comeback frame 2. Comeback after=%u",
hapd->conf->pasn_comeback_after);
buf = wpabuf_alloc(1500);
if (!buf)
return;
wpa_pasn_build_auth_header(buf, hapd->own_addr, hapd->own_addr,
sta->addr, 2,
WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY);
/*
* Do not include the group as a part of the token since it is not going
* to be used.
*/
comeback = auth_build_token_req(hapd, 0, sta->addr, 0);
if (!comeback) {
wpa_printf(MSG_DEBUG,
"PASN: Failed sending auth with comeback");
wpabuf_free(buf);
return;
}
wpa_pasn_add_parameter_ie(buf, group,
WPA_PASN_WRAPPED_DATA_NO,
NULL, 0, comeback,
hapd->conf->pasn_comeback_after);
wpabuf_free(comeback);
wpa_printf(MSG_DEBUG,
"PASN: comeback: STA=" MACSTR, MAC2STR(sta->addr));
ret = hostapd_drv_send_mlme(hapd, wpabuf_head(buf), wpabuf_len(buf), 0,
NULL, 0, 0);
if (ret)
wpa_printf(MSG_INFO, "PASN: Failed to send comeback frame 2");
wpabuf_free(buf);
}
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
static int handle_auth_pasn_resp(struct hostapd_data *hapd,
struct sta_info *sta,
struct rsn_pmksa_cache_entry *pmksa,
u16 status)
{
struct wpabuf *buf, *pubkey = NULL, *wrapped_data_buf = NULL;
u8 mic[WPA_PASN_MAX_MIC_LEN];
PASN: Fix setting frame and data lengths in AP mode PASN response Frame length and data length can exceed 256 so need to use size_t instead of u8. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:56:59 +01:00
u8 mic_len;
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
u8 *ptr;
PASN: Include RSNXE in the PASN negotiation IEEE P802.11az/D2.6 added definitions to include RSNXE in the PASN negotiation. Implement the new functionality in both wpa_supplicant and hostapd. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:01:38 +01:00
const u8 *frame, *data, *rsn_ie, *rsnxe_ie;
u8 *data_buf = NULL;
PASN: Fix setting frame and data lengths in AP mode PASN response Frame length and data length can exceed 256 so need to use size_t instead of u8. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:56:59 +01:00
size_t rsn_ie_len, frame_len, data_len;
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
int ret;
PASN: Include PMKID in RSNE in PASN response from AP As defined in IEEE P802.11az/D3.0, 12.12.3.2 for the second PASN frame. This was previously covered only for the case when the explicit PMKSA was provided to the helper function. Extend that to cover the PMKID from SAE/FILS authentication cases. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:00 +01:00
const u8 *pmkid = NULL;
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
wpa_printf(MSG_DEBUG, "PASN: Building frame 2: status=%u", status);
buf = wpabuf_alloc(1500);
if (!buf)
goto fail;
wpa_pasn_build_auth_header(buf, hapd->own_addr, hapd->own_addr,
sta->addr, 2, status);
if (status != WLAN_STATUS_SUCCESS)
goto done;
PASN: Include PMKID in RSNE in PASN response from AP As defined in IEEE P802.11az/D3.0, 12.12.3.2 for the second PASN frame. This was previously covered only for the case when the explicit PMKSA was provided to the helper function. Extend that to cover the PMKID from SAE/FILS authentication cases. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:00 +01:00
if (pmksa) {
pmkid = pmksa->pmkid;
#ifdef CONFIG_SAE
} else if (sta->pasn->akmp == WPA_KEY_MGMT_SAE) {
wpa_printf(MSG_DEBUG, "PASN: Use SAE PMKID");
pmkid = sta->pasn->sae.pmkid;
#endif /* CONFIG_SAE */
#ifdef CONFIG_FILS
} else if (sta->pasn->akmp == WPA_KEY_MGMT_FILS_SHA256 ||
sta->pasn->akmp == WPA_KEY_MGMT_FILS_SHA384) {
wpa_printf(MSG_DEBUG, "PASN: Use FILS ERP PMKID");
pmkid = sta->pasn->fils.erp_pmkid;
#endif /* CONFIG_FILS */
}
if (wpa_pasn_add_rsne(buf, pmkid,
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
sta->pasn->akmp, sta->pasn->cipher) < 0)
goto fail;
/* No need to derive PMK if PMKSA is given */
if (!pmksa)
wrapped_data_buf = pasn_get_wrapped_data(hapd, sta);
else
sta->pasn->wrapped_data_format = WPA_PASN_WRAPPED_DATA_NO;
/* Get public key */
pubkey = crypto_ecdh_get_pubkey(sta->pasn->ecdh, 0);
pubkey = wpabuf_zeropad(pubkey,
crypto_ecdh_prime_len(sta->pasn->ecdh));
if (!pubkey) {
wpa_printf(MSG_DEBUG, "PASN: Failed to get pubkey");
goto fail;
}
wpa_pasn_add_parameter_ie(buf, sta->pasn->group,
sta->pasn->wrapped_data_format,
PASN: Encode the public key properly When a public key is included in the PASN Parameters element, it should be encoded using the RFC 5480 conventions, and thus the first octet of the Ephemeral Public Key field should indicate whether the public key is compressed and the actual key part starts from the second octet. Fix the implementation to properly adhere to the convention requirements for both wpa_supplicant and hostapd. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:01 +01:00
pubkey, true, NULL, 0);
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
if (wpa_pasn_add_wrapped_data(buf, wrapped_data_buf) < 0)
goto fail;
wpabuf_free(wrapped_data_buf);
wrapped_data_buf = NULL;
wpabuf_free(pubkey);
pubkey = NULL;
PASN: Include RSNXE in the PASN negotiation IEEE P802.11az/D2.6 added definitions to include RSNXE in the PASN negotiation. Implement the new functionality in both wpa_supplicant and hostapd. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:01:38 +01:00
/* Add RSNXE if needed */
rsnxe_ie = hostapd_wpa_ie(hapd, WLAN_EID_RSNX);
if (rsnxe_ie)
wpabuf_put_data(buf, rsnxe_ie, 2 + rsnxe_ie[1]);
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
/* Add the mic */
mic_len = pasn_mic_len(sta->pasn->akmp, sta->pasn->cipher);
wpabuf_put_u8(buf, WLAN_EID_MIC);
wpabuf_put_u8(buf, mic_len);
ptr = wpabuf_put(buf, mic_len);
os_memset(ptr, 0, mic_len);
PASN: Include RSNXE in the PASN negotiation IEEE P802.11az/D2.6 added definitions to include RSNXE in the PASN negotiation. Implement the new functionality in both wpa_supplicant and hostapd. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:01:38 +01:00
frame = wpabuf_head_u8(buf) + IEEE80211_HDRLEN;
frame_len = wpabuf_len(buf) - IEEE80211_HDRLEN;
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
rsn_ie = wpa_auth_get_wpa_ie(hapd->wpa_auth, &rsn_ie_len);
if (!rsn_ie || !rsn_ie_len)
goto fail;
/*
* Note: wpa_auth_get_wpa_ie() might return not only the RSNE but also
* MDE, etc. Thus, do not use the returned length but instead use the
* length specified in the IE header.
*/
PASN: Include RSNXE in the PASN negotiation IEEE P802.11az/D2.6 added definitions to include RSNXE in the PASN negotiation. Implement the new functionality in both wpa_supplicant and hostapd. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:01:38 +01:00
data_len = rsn_ie[1] + 2;
if (rsnxe_ie) {
data_buf = os_zalloc(rsn_ie[1] + 2 + rsnxe_ie[1] + 2);
if (!data_buf)
goto fail;
os_memcpy(data_buf, rsn_ie, rsn_ie[1] + 2);
os_memcpy(data_buf + rsn_ie[1] + 2, rsnxe_ie, rsnxe_ie[1] + 2);
data_len += rsnxe_ie[1] + 2;
data = data_buf;
} else {
data = rsn_ie;
}
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
ret = pasn_mic(sta->pasn->ptk.kck, sta->pasn->akmp, sta->pasn->cipher,
PASN: Include RSNXE in the PASN negotiation IEEE P802.11az/D2.6 added definitions to include RSNXE in the PASN negotiation. Implement the new functionality in both wpa_supplicant and hostapd. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:01:38 +01:00
hapd->own_addr, sta->addr, data, data_len,
frame, frame_len, mic);
os_free(data_buf);
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
if (ret) {
wpa_printf(MSG_DEBUG, "PASN: Frame 3: Failed MIC calculation");
goto fail;
}
PASN: For testing purposes allow to corrupt MIC For testing purposes, add support for corrupting the MIC in PASN Authentication frames for both wpa_supplicant and hostapd. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:03 +01:00
#ifdef CONFIG_TESTING_OPTIONS
if (hapd->conf->pasn_corrupt_mic) {
wpa_printf(MSG_DEBUG, "PASN: frame 2: Corrupt MIC");
mic[0] = ~mic[0];
}
#endif /* CONFIG_TESTING_OPTIONS */
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
os_memcpy(ptr, mic, mic_len);
done:
wpa_printf(MSG_DEBUG,
"PASN: Building frame 2: success; resp STA=" MACSTR,
MAC2STR(sta->addr));
ret = hostapd_drv_send_mlme(hapd, wpabuf_head(buf), wpabuf_len(buf), 0,
NULL, 0, 0);
if (ret)
wpa_printf(MSG_INFO, "send_auth_reply: Send failed");
wpabuf_free(buf);
return ret;
fail:
wpabuf_free(wrapped_data_buf);
wpabuf_free(pubkey);
wpabuf_free(buf);
return -1;
}
static void handle_auth_pasn_1(struct hostapd_data *hapd, struct sta_info *sta,
const struct ieee80211_mgmt *mgmt, size_t len)
{
struct ieee802_11_elems elems;
struct wpa_ie_data rsn_data;
struct wpa_pasn_params_data pasn_params;
AP: Support PASN with FILS key derivation As the PASN FILS authentication is only defined for FILS SK without PFS, and to support PASN authentication with FILS, implement the PASN with FILS processing as part of the PASN handling and not as part of the WPA Authenticator state machine. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:56 +01:00
struct rsn_pmksa_cache_entry *pmksa = NULL;
AP: Support PASN with FT key derivation Note that the implementation is not complete as it is missing support for the FT wrapped data which is optional for the station, but must be supported by the AP in case the station included it. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:01:04 +01:00
const u8 *cached_pmk = NULL;
size_t cached_pmk_len = 0;
#ifdef CONFIG_IEEE80211R_AP
u8 pmk_r1[PMK_LEN_MAX];
size_t pmk_r1_len;
#endif /* CONFIG_IEEE80211R_AP */
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
struct wpabuf *wrapped_data = NULL, *secret = NULL;
const int *groups = hapd->conf->pasn_groups;
static const int default_groups[] = { 19, 0 };
u16 status = WLAN_STATUS_SUCCESS;
PASN: Encode the public key properly When a public key is included in the PASN Parameters element, it should be encoded using the RFC 5480 conventions, and thus the first octet of the Ephemeral Public Key field should indicate whether the public key is compressed and the actual key part starts from the second octet. Fix the implementation to properly adhere to the convention requirements for both wpa_supplicant and hostapd. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:01 +01:00
int ret, inc_y;
AP: Support PASN with FILS key derivation As the PASN FILS authentication is only defined for FILS SK without PFS, and to support PASN authentication with FILS, implement the PASN with FILS processing as part of the PASN handling and not as part of the WPA Authenticator state machine. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:56 +01:00
bool derive_keys;
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
u32 i;
if (!groups)
groups = default_groups;
if (ieee802_11_parse_elems(mgmt->u.auth.variable,
len - offsetof(struct ieee80211_mgmt,
u.auth.variable),
&elems, 0) == ParseFailed) {
wpa_printf(MSG_DEBUG,
"PASN: Failed parsing Authentication frame");
status = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto send_resp;
}
ret = wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, elems.rsn_ie_len + 2,
&rsn_data);
if (ret) {
wpa_printf(MSG_DEBUG, "PASN: Failed parsing RNSE");
status = WLAN_STATUS_INVALID_RSNIE;
goto send_resp;
}
ret = wpa_pasn_validate_rsne(&rsn_data);
if (ret) {
wpa_printf(MSG_DEBUG, "PASN: Failed validating RSNE");
status = WLAN_STATUS_INVALID_RSNIE;
goto send_resp;
}
if (!(rsn_data.key_mgmt & hapd->conf->wpa_key_mgmt) ||
!(rsn_data.pairwise_cipher & hapd->conf->rsn_pairwise)) {
wpa_printf(MSG_DEBUG, "PASN: Mismatch in AKMP/cipher");
status = WLAN_STATUS_INVALID_RSNIE;
goto send_resp;
}
sta->pasn->akmp = rsn_data.key_mgmt;
sta->pasn->cipher = rsn_data.pairwise_cipher;
PASN: Derive KDK only when required When a PTK derivation is done as part of PASN authentication flow, a KDK derivation should be done if and only if the higher layer protocol is supported by both parties. Fix the code accordingly, so KDK would be derived if and only if both sides support Secure LTF. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-04-08 11:06:20 +02:00
if (hapd->conf->force_kdk_derivation ||
((hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF) &&
elems.rsnxe && elems.rsnxe_len >= 2 &&
(WPA_GET_LE16(elems.rsnxe) & BIT(WLAN_RSNX_CAPAB_SECURE_LTF))))
sta->pasn->kdk_len = WPA_KDK_MAX_LEN;
else
sta->pasn->kdk_len = 0;
wpa_printf(MSG_DEBUG, "PASN: kdk_len=%zu", sta->pasn->kdk_len);
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
if (!elems.pasn_params || !elems.pasn_params_len) {
wpa_printf(MSG_DEBUG,
"PASN: No PASN Parameters element found");
status = WLAN_STATUS_INVALID_PARAMETERS;
goto send_resp;
}
ret = wpa_pasn_parse_parameter_ie(elems.pasn_params - 3,
elems.pasn_params_len + 3,
false, &pasn_params);
if (ret) {
wpa_printf(MSG_DEBUG,
"PASN: Failed validation of PASN Parameters IE");
status = WLAN_STATUS_INVALID_PARAMETERS;
goto send_resp;
}
for (i = 0; groups[i] > 0 && groups[i] != pasn_params.group; i++)
;
if (!pasn_params.group || groups[i] != pasn_params.group) {
wpa_printf(MSG_DEBUG, "PASN: Requested group=%hu not allowed",
pasn_params.group);
status = WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
goto send_resp;
}
if (!pasn_params.pubkey || !pasn_params.pubkey_len) {
wpa_printf(MSG_DEBUG, "PASN: Invalid public key");
status = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto send_resp;
}
PASN: Add support for comeback flow in AP mode Reuse the SAE anti-clogging token implementation to support similar design with the PASN comeback cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:08 +01:00
if (pasn_params.comeback) {
wpa_printf(MSG_DEBUG, "PASN: Checking peer comeback token");
ret = check_comeback_token(hapd, sta->addr,
pasn_params.comeback,
pasn_params.comeback_len);
if (ret) {
wpa_printf(MSG_DEBUG, "PASN: Invalid comeback token");
status = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto send_resp;
}
} else if (use_anti_clogging(hapd)) {
wpa_printf(MSG_DEBUG, "PASN: Respond with comeback");
handle_auth_pasn_comeback(hapd, sta, pasn_params.group);
ap_free_sta(hapd, sta);
return;
}
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
sta->pasn->ecdh = crypto_ecdh_init(pasn_params.group);
if (!sta->pasn->ecdh) {
wpa_printf(MSG_DEBUG, "PASN: Failed to init ECDH");
status = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto send_resp;
}
sta->pasn->group = pasn_params.group;
PASN: Encode the public key properly When a public key is included in the PASN Parameters element, it should be encoded using the RFC 5480 conventions, and thus the first octet of the Ephemeral Public Key field should indicate whether the public key is compressed and the actual key part starts from the second octet. Fix the implementation to properly adhere to the convention requirements for both wpa_supplicant and hostapd. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:01 +01:00
if (pasn_params.pubkey[0] == WPA_PASN_PUBKEY_UNCOMPRESSED) {
inc_y = 1;
} else if (pasn_params.pubkey[0] == WPA_PASN_PUBKEY_COMPRESSED_0 ||
pasn_params.pubkey[0] == WPA_PASN_PUBKEY_COMPRESSED_1) {
inc_y = 0;
} else {
wpa_printf(MSG_DEBUG,
"PASN: Invalid first octet in pubkey=0x%x",
pasn_params.pubkey[0]);
status = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto send_resp;
}
secret = crypto_ecdh_set_peerkey(sta->pasn->ecdh, inc_y,
pasn_params.pubkey + 1,
pasn_params.pubkey_len - 1);
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
if (!secret) {
wpa_printf(MSG_DEBUG, "PASN: Failed to derive shared secret");
status = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto send_resp;
}
AP: Support PASN with FILS key derivation As the PASN FILS authentication is only defined for FILS SK without PFS, and to support PASN authentication with FILS, implement the PASN with FILS processing as part of the PASN handling and not as part of the WPA Authenticator state machine. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:56 +01:00
derive_keys = true;
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
if (pasn_params.wrapped_data_format != WPA_PASN_WRAPPED_DATA_NO) {
wrapped_data = ieee802_11_defrag(&elems,
WLAN_EID_EXTENSION,
WLAN_EID_EXT_WRAPPED_DATA);
if (!wrapped_data) {
wpa_printf(MSG_DEBUG, "PASN: Missing wrapped data");
status = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto send_resp;
}
AP: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:53 +01:00
#ifdef CONFIG_SAE
if (sta->pasn->akmp == WPA_KEY_MGMT_SAE) {
ret = pasn_wd_handle_sae_commit(hapd, sta,
wrapped_data);
if (ret) {
wpa_printf(MSG_DEBUG,
"PASN: Failed processing SAE commit");
status = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto send_resp;
}
}
#endif /* CONFIG_SAE */
AP: Support PASN with FILS key derivation As the PASN FILS authentication is only defined for FILS SK without PFS, and to support PASN authentication with FILS, implement the PASN with FILS processing as part of the PASN handling and not as part of the WPA Authenticator state machine. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:56 +01:00
#ifdef CONFIG_FILS
if (sta->pasn->akmp == WPA_KEY_MGMT_FILS_SHA256 ||
sta->pasn->akmp == WPA_KEY_MGMT_FILS_SHA384) {
ret = pasn_wd_handle_fils(hapd, sta, wrapped_data);
if (ret) {
wpa_printf(MSG_DEBUG,
"PASN: Failed processing FILS wrapped data");
status = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto send_resp;
}
wpa_printf(MSG_DEBUG,
"PASN: FILS: Pending AS response");
/*
* With PASN/FILS, keys can be derived only after a
* response from the AS is processed.
*/
derive_keys = false;
}
#endif /* CONFIG_FILS */
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
}
sta->pasn->wrapped_data_format = pasn_params.wrapped_data_format;
AP: Support PASN with FILS key derivation As the PASN FILS authentication is only defined for FILS SK without PFS, and to support PASN authentication with FILS, implement the PASN with FILS processing as part of the PASN handling and not as part of the WPA Authenticator state machine. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:56 +01:00
ret = pasn_auth_frame_hash(sta->pasn->akmp, sta->pasn->cipher,
((const u8 *) mgmt) + IEEE80211_HDRLEN,
len - IEEE80211_HDRLEN, sta->pasn->hash);
if (ret) {
wpa_printf(MSG_DEBUG, "PASN: Failed to compute hash");
status = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto send_resp;
}
if (!derive_keys) {
wpa_printf(MSG_DEBUG, "PASN: Storing secret");
sta->pasn->secret = secret;
wpabuf_free(wrapped_data);
return;
}
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
if (rsn_data.num_pmkid) {
AP: Support PASN with FT key derivation Note that the implementation is not complete as it is missing support for the FT wrapped data which is optional for the station, but must be supported by the AP in case the station included it. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:01:04 +01:00
if (wpa_key_mgmt_ft(sta->pasn->akmp)) {
#ifdef CONFIG_IEEE80211R_AP
wpa_printf(MSG_DEBUG, "PASN: FT: Fetch PMK-R1");
ret = wpa_ft_fetch_pmk_r1(hapd->wpa_auth, sta->addr,
rsn_data.pmkid,
pmk_r1, &pmk_r1_len, NULL,
NULL, NULL, NULL,
NULL, NULL, NULL);
if (ret) {
wpa_printf(MSG_DEBUG,
"PASN: FT: Failed getting PMK-R1");
status = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto send_resp;
}
cached_pmk = pmk_r1;
cached_pmk_len = pmk_r1_len;
#else /* CONFIG_IEEE80211R_AP */
wpa_printf(MSG_DEBUG, "PASN: FT: Not supported");
status = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto send_resp;
#endif /* CONFIG_IEEE80211R_AP */
} else {
wpa_printf(MSG_DEBUG, "PASN: Try to find PMKSA entry");
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
AP: Support PASN with FT key derivation Note that the implementation is not complete as it is missing support for the FT wrapped data which is optional for the station, but must be supported by the AP in case the station included it. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:01:04 +01:00
pmksa = wpa_auth_pmksa_get(hapd->wpa_auth, sta->addr,
rsn_data.pmkid);
if (pmksa) {
cached_pmk = pmksa->pmk;
cached_pmk_len = pmksa->pmk_len;
}
}
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
} else {
wpa_printf(MSG_DEBUG, "PASN: No PMKID specified");
}
AP: Support PASN with FT key derivation Note that the implementation is not complete as it is missing support for the FT wrapped data which is optional for the station, but must be supported by the AP in case the station included it. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:01:04 +01:00
ret = pasn_derive_keys(hapd, sta, cached_pmk, cached_pmk_len,
&pasn_params, wrapped_data, secret);
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
if (ret) {
wpa_printf(MSG_DEBUG, "PASN: Failed to derive keys");
status = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto send_resp;
}
ret = pasn_auth_frame_hash(sta->pasn->akmp, sta->pasn->cipher,
((const u8 *) mgmt) + IEEE80211_HDRLEN,
len - IEEE80211_HDRLEN, sta->pasn->hash);
if (ret) {
wpa_printf(MSG_DEBUG, "PASN: Failed to compute hash");
status = WLAN_STATUS_UNSPECIFIED_FAILURE;
}
send_resp:
ret = handle_auth_pasn_resp(hapd, sta, pmksa, status);
if (ret) {
wpa_printf(MSG_DEBUG, "PASN: Failed to send response");
status = WLAN_STATUS_UNSPECIFIED_FAILURE;
} else {
wpa_printf(MSG_DEBUG,
"PASN: Success handling transaction == 1");
}
wpabuf_free(secret);
wpabuf_free(wrapped_data);
if (status != WLAN_STATUS_SUCCESS)
ap_free_sta(hapd, sta);
}
static void handle_auth_pasn_3(struct hostapd_data *hapd, struct sta_info *sta,
const struct ieee80211_mgmt *mgmt, size_t len)
{
struct ieee802_11_elems elems;
struct wpa_pasn_params_data pasn_params;
struct wpabuf *wrapped_data = NULL;
u8 mic[WPA_PASN_MAX_MIC_LEN], out_mic[WPA_PASN_MAX_MIC_LEN];
u8 mic_len;
int ret;
if (ieee802_11_parse_elems(mgmt->u.auth.variable,
len - offsetof(struct ieee80211_mgmt,
u.auth.variable),
&elems, 0) == ParseFailed) {
wpa_printf(MSG_DEBUG,
"PASN: Failed parsing Authentication frame");
goto fail;
}
/* Check that the MIC IE exists. Save it and zero out the memory. */
mic_len = pasn_mic_len(sta->pasn->akmp, sta->pasn->cipher);
if (!elems.mic || elems.mic_len != mic_len) {
wpa_printf(MSG_DEBUG,
"PASN: Invalid MIC. Expecting len=%u", mic_len);
goto fail;
} else {
os_memcpy(mic, elems.mic, mic_len);
/* TODO: Clean this up.. Should not modify received frame
* buffer. */
os_memset((u8 *) elems.mic, 0, mic_len);
}
if (!elems.pasn_params || !elems.pasn_params_len) {
wpa_printf(MSG_DEBUG,
"PASN: No PASN Parameters element found");
goto fail;
}
ret = wpa_pasn_parse_parameter_ie(elems.pasn_params - 3,
elems.pasn_params_len + 3,
false, &pasn_params);
if (ret) {
wpa_printf(MSG_DEBUG,
"PASN: Failed validation of PASN Parameters IE");
goto fail;
}
if (pasn_params.pubkey || pasn_params.pubkey_len) {
wpa_printf(MSG_DEBUG,
"PASN: Public key should not be included");
goto fail;
}
/* Verify the MIC */
ret = pasn_mic(sta->pasn->ptk.kck, sta->pasn->akmp, sta->pasn->cipher,
sta->addr, hapd->own_addr,
sta->pasn->hash, mic_len * 2,
(u8 *) &mgmt->u.auth,
len - offsetof(struct ieee80211_mgmt, u.auth),
out_mic);
wpa_hexdump_key(MSG_DEBUG, "PASN: Frame MIC", mic, mic_len);
if (ret || os_memcmp(mic, out_mic, mic_len) != 0) {
wpa_printf(MSG_DEBUG, "PASN: Failed MIC verification");
goto fail;
}
if (pasn_params.wrapped_data_format != WPA_PASN_WRAPPED_DATA_NO) {
wrapped_data = ieee802_11_defrag(&elems,
WLAN_EID_EXTENSION,
WLAN_EID_EXT_WRAPPED_DATA);
if (!wrapped_data) {
wpa_printf(MSG_DEBUG, "PASN: Missing wrapped data");
goto fail;
}
AP: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:53 +01:00
#ifdef CONFIG_SAE
if (sta->pasn->akmp == WPA_KEY_MGMT_SAE) {
ret = pasn_wd_handle_sae_confirm(hapd, sta,
wrapped_data);
if (ret) {
wpa_printf(MSG_DEBUG,
"PASN: Failed processing SAE confirm");
wpabuf_free(wrapped_data);
goto fail;
}
}
#endif /* CONFIG_SAE */
AP: Support PASN with FILS key derivation As the PASN FILS authentication is only defined for FILS SK without PFS, and to support PASN authentication with FILS, implement the PASN with FILS processing as part of the PASN handling and not as part of the WPA Authenticator state machine. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:56 +01:00
#ifdef CONFIG_FILS
if (sta->pasn->akmp == WPA_KEY_MGMT_FILS_SHA256 ||
sta->pasn->akmp == WPA_KEY_MGMT_FILS_SHA384) {
if (wrapped_data) {
wpa_printf(MSG_DEBUG,
"PASN: FILS: Ignore wrapped data");
}
}
#endif /* CONFIG_FILS */
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
wpabuf_free(wrapped_data);
}
wpa_printf(MSG_INFO,
"PASN: Success handling transaction == 3. Store PTK");
ptksa_cache_add(hapd->ptksa, sta->addr, sta->pasn->cipher, 43200,
&sta->pasn->ptk);
fail:
ap_free_sta(hapd, sta);
}
static void handle_auth_pasn(struct hostapd_data *hapd, struct sta_info *sta,
const struct ieee80211_mgmt *mgmt, size_t len,
u16 trans_seq, u16 status)
{
if (hapd->conf->wpa != WPA_PROTO_RSN) {
wpa_printf(MSG_INFO, "PASN: RSN is not configured");
return;
}
wpa_printf(MSG_INFO, "PASN authentication: sta=" MACSTR,
MAC2STR(sta->addr));
if (trans_seq == 1) {
if (sta->pasn) {
wpa_printf(MSG_DEBUG,
"PASN: Not expecting transaction == 1");
return;
}
if (status != WLAN_STATUS_SUCCESS) {
wpa_printf(MSG_DEBUG,
"PASN: Failure status in transaction == 1");
return;
}
sta->pasn = os_zalloc(sizeof(*sta->pasn));
if (!sta->pasn) {
wpa_printf(MSG_DEBUG,
"PASN: Failed to allocate PASN context");
return;
}
handle_auth_pasn_1(hapd, sta, mgmt, len);
} else if (trans_seq == 3) {
if (!sta->pasn) {
wpa_printf(MSG_DEBUG,
"PASN: Not expecting transaction == 3");
return;
}
if (status != WLAN_STATUS_SUCCESS) {
wpa_printf(MSG_DEBUG,
"PASN: Failure status in transaction == 3");
ap_free_sta_pasn(hapd, sta);
return;
}
handle_auth_pasn_3(hapd, sta, mgmt, len);
} else {
wpa_printf(MSG_DEBUG,
"PASN: Invalid transaction %u - ignore", trans_seq);
}
}
#endif /* CONFIG_PASN */
Mark management frame processing functions to use const buffer
2009-12-13 22:25:30 +01:00
static void handle_auth(struct hostapd_data *hapd,
OCE: RSSI-based rejection to consider Authentication frames (AP) Try to make RSSI-based rejection of associating stations a bit less likely to trigger false rejections by considering RSSI from the last received Authentication frame. Association is rejected only if both the Authentication and (Re)Association Request frames are below the RSSI threshold. Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-01 17:17:02 +01:00
const struct ieee80211_mgmt *mgmt, size_t len,
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
int rssi, int from_queue)
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
{
u16 auth_alg, auth_transaction, status_code;
u16 resp = WLAN_STATUS_SUCCESS;
struct sta_info *sta = NULL;
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
int res, reply_res;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
u16 fc;
Mark management frame processing functions to use const buffer
2009-12-13 22:25:30 +01:00
const u8 *challenge = NULL;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN];
size_t resp_ies_len = 0;
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
u16 seq_ctrl;
Move the RADIUS cached attributes into a struct This makes it easier to pass these around and to add new attributes. Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2019-04-28 13:14:57 +02:00
struct radius_sta rad_info;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
Convert perror/printf calls to wpa_printf This makes debug and error logging more consistent and allows them to be directed to a file more easily. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 11:51:30 +01:00
wpa_printf(MSG_INFO, "handle_auth - too short payload (len=%lu)",
(unsigned long) len);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
return;
}
hostapd: Add some testing options In order to test clients in scenarios where APs may (randomly) drop certain management frames, introduce some testing options into the hostapd configuration that can make it ignore certain frames. For now, these are probe requests, authentication and (re)association frames. Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2013-04-23 16:51:28 +02:00
#ifdef CONFIG_TESTING_OPTIONS
Remove floating constant suffix 'd' from test coee clang scan-build does not seem to like the 'd' suffix on floating constants and ends up reporting analyzer failures. Since this suffix does not seem to be needed, get rid of it to clear such warnings. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-04-26 10:09:29 +02:00
if (hapd->iconf->ignore_auth_probability > 0.0 &&
hostapd: Add some testing options In order to test clients in scenarios where APs may (randomly) drop certain management frames, introduce some testing options into the hostapd configuration that can make it ignore certain frames. For now, these are probe requests, authentication and (re)association frames. Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2013-04-23 16:51:28 +02:00
drand48() < hapd->iconf->ignore_auth_probability) {
wpa_printf(MSG_INFO,
"TESTING: ignoring auth frame from " MACSTR,
MAC2STR(mgmt->sa));
return;
}
#endif /* CONFIG_TESTING_OPTIONS */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
status_code = le_to_host16(mgmt->u.auth.status_code);
fc = le_to_host16(mgmt->frame_control);
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
seq_ctrl = le_to_host16(mgmt->seq_ctrl);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (len >= IEEE80211_HDRLEN + sizeof(mgmt->u.auth) +
2 + WLAN_AUTH_CHALLENGE_LEN &&
mgmt->u.auth.variable[0] == WLAN_EID_CHALLENGE &&
mgmt->u.auth.variable[1] == WLAN_AUTH_CHALLENGE_LEN)
challenge = &mgmt->u.auth.variable[2];
wpa_printf(MSG_DEBUG, "authentication: STA=" MACSTR " auth_alg=%d "
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
"auth_transaction=%d status_code=%d wep=%d%s "
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
"seq_ctrl=0x%x%s%s",
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
MAC2STR(mgmt->sa), auth_alg, auth_transaction,
status_code, !!(fc & WLAN_FC_ISWEP),
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
challenge ? " challenge" : "",
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "",
from_queue ? " (from queue)" : "");
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
Add build option to remove all internal RC4 uses The new CONFIG_NO_RC4=y build option can be used to remove all internal hostapd and wpa_supplicant uses of RC4. It should be noted that external uses (e.g., within a TLS library) do not get disabled when doing this. This removes capability of supporting WPA/TKIP, dynamic WEP keys with IEEE 802.1X, WEP shared key authentication, and MSCHAPv2 password changes. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-01 22:37:07 +02:00
#ifdef CONFIG_NO_RC4
if (auth_alg == WLAN_AUTH_SHARED_KEY) {
wpa_printf(MSG_INFO,
"Unsupported authentication algorithm (%d)",
auth_alg);
resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
goto fail;
}
#endif /* CONFIG_NO_RC4 */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (hapd->tkip_countermeasures) {
hostapd: Add logging around Michael MIC related failures This can help one understand better why stations are failing to authentication/associate. Signed-off-by: Ben Greear <greearb@candelatech.com>
2017-12-07 18:14:49 +01:00
wpa_printf(MSG_DEBUG,
"Ongoing TKIP countermeasures (Michael MIC failure) - reject authentication");
Fix Status Code in TKIP countermeasures case The previously used WLAN_REASON_MICHAEL_MIC_FAILURE (14) value as a response to Authentication frame or (Re)Association Request frame is not correct since the resp value is encoded in the Status Code (not Reason Code) field. Status Code 14 is WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION which is really what this value would have meant in the response frames. There is no Michael MIC failure status code, so have to use the generic "Unspecified failure" (1) reason code for these cases. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-11-03 09:49:45 +01:00
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
goto fail;
}
if (!(((hapd->conf->auth_algs & WPA_AUTH_ALG_OPEN) &&
auth_alg == WLAN_AUTH_OPEN) ||
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#ifdef CONFIG_IEEE80211R_AP
Use wpa_key_mgmt_*() helpers This cleans up the source code and makes it less likely that new AKM addition misses some needed changes in the future. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-24 21:46:14 +01:00
(hapd->conf->wpa && wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt) &&
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
auth_alg == WLAN_AUTH_FT) ||
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#endif /* CONFIG_IEEE80211R_AP */
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
(hapd->conf->wpa && wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) &&
auth_alg == WLAN_AUTH_SAE) ||
#endif /* CONFIG_SAE */
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
#ifdef CONFIG_FILS
(hapd->conf->wpa && wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt) &&
auth_alg == WLAN_AUTH_FILS_SK) ||
FILS: Add FILS SK auth PFS support in AP mode This adds an option to configure hostapd to enable use of perfect forward secrecy option in FILS shared key authentication. A new build option CONFIG_FILS_SK_PFS=y can be used to include this functionality. A new runtime configuration parameter fils_dh_group is used to enable this by specifying which DH group to use. For example, fils_dh_group=19 would allow FILS SK PFS to be used with a 256-bit random ECP group. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:40:56 +01:00
(hapd->conf->wpa && wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt) &&
hapd->conf->fils_dh_group &&
auth_alg == WLAN_AUTH_FILS_SK_PFS) ||
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
#endif /* CONFIG_FILS */
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
#ifdef CONFIG_PASN
(hapd->conf->wpa &&
(hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_PASN) &&
auth_alg == WLAN_AUTH_PASN) ||
#endif /* CONFIG_PASN */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
((hapd->conf->auth_algs & WPA_AUTH_ALG_SHARED) &&
auth_alg == WLAN_AUTH_SHARED_KEY))) {
Convert perror/printf calls to wpa_printf This makes debug and error logging more consistent and allows them to be directed to a file more easily. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 11:51:30 +01:00
wpa_printf(MSG_INFO, "Unsupported authentication algorithm (%d)",
auth_alg);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
goto fail;
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
if (!(auth_transaction == 1 || auth_alg == WLAN_AUTH_SAE ||
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
#ifdef CONFIG_PASN
(auth_alg == WLAN_AUTH_PASN && auth_transaction == 3) ||
#endif /* CONFIG_PASN */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
(auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 3))) {
Convert perror/printf calls to wpa_printf This makes debug and error logging more consistent and allows them to be directed to a file more easily. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 11:51:30 +01:00
wpa_printf(MSG_INFO, "Unknown authentication transaction number (%d)",
auth_transaction);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
goto fail;
}
if (os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) {
Convert perror/printf calls to wpa_printf This makes debug and error logging more consistent and allows them to be directed to a file more easily. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 11:51:30 +01:00
wpa_printf(MSG_INFO, "Station " MACSTR " not allowed to authenticate",
MAC2STR(mgmt->sa));
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
}
Add option to reject authentication on 2.4 GHz from dualband STA The new no_auth_if_seen_on=<ifname> parameter can now be used to configure hostapd to reject authentication from a station that was seen on another radio. This can be used with enabled track_sta_max_num configuration on another interface controlled by the same hostapd process to reject authentication attempts from a station that has been detected to be capable of operating on another band, e.g., to try to reduce likelihood of the station selecting a 2.4 GHz BSS when the AP operates both a 2.4 GHz and 5 GHz BSS concurrently. Note: Enabling this can cause connectivity issues and increase latency for connecting with the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 18:00:03 +02:00
if (hapd->conf->no_auth_if_seen_on) {
struct hostapd_data *other;
other = sta_track_seen_on(hapd->iface, mgmt->sa,
hapd->conf->no_auth_if_seen_on);
if (other) {
u8 *pos;
u32 info;
u8 op_class, channel, phytype;
wpa_printf(MSG_DEBUG, "%s: Reject authentication from "
MACSTR " since STA has been seen on %s",
hapd->conf->iface, MAC2STR(mgmt->sa),
hapd->conf->no_auth_if_seen_on);
resp = WLAN_STATUS_REJECTED_WITH_SUGGESTED_BSS_TRANSITION;
pos = &resp_ies[0];
*pos++ = WLAN_EID_NEIGHBOR_REPORT;
*pos++ = 13;
os_memcpy(pos, other->own_addr, ETH_ALEN);
pos += ETH_ALEN;
info = 0; /* TODO: BSSID Information */
WPA_PUT_LE32(pos, info);
pos += 4;
if (other->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD)
phytype = 8; /* dmg */
else if (other->iconf->ieee80211ac)
phytype = 9; /* vht */
else if (other->iconf->ieee80211n)
phytype = 7; /* ht */
else if (other->iconf->hw_mode ==
HOSTAPD_MODE_IEEE80211A)
phytype = 4; /* ofdm */
else if (other->iconf->hw_mode ==
HOSTAPD_MODE_IEEE80211G)
phytype = 6; /* erp */
else
phytype = 5; /* hrdsss */
if (ieee80211_freq_to_channel_ext(
hostapd_hw_get_freq(other,
other->iconf->channel),
other->iconf->secondary_channel,
other->iconf->ieee80211ac,
&op_class, &channel) == NUM_HOSTAPD_MODES) {
op_class = 0;
channel = other->iconf->channel;
}
*pos++ = op_class;
*pos++ = channel;
*pos++ = phytype;
resp_ies_len = pos - &resp_ies[0];
goto fail;
}
}
Call hostapd_allowed_address() directly from handle_probe_req() ieee802_11_allowed_address() did not really do anything useful for the call from handle_probe_req(), so replace that with a direct call to hostapd_allowed_address() and make ieee802_11_allowed_address() a static function. Signed-off-by: Jouni Malinen <j@w1.fi>
2019-12-29 22:24:10 +01:00
res = ieee802_11_allowed_address(hapd, mgmt->sa, (const u8 *) mgmt, len,
&rad_info);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (res == HOSTAPD_ACL_REJECT) {
Extend ACL check for Probe Request frames Extend ACL check to deny Probe Request frames for the client which does not pass ACL check. Skip this check for the case where RADIUS ACL is used to avoid excessive load on the RADIUS authentication server due to Probe Request frames. This patch add wpa_msg event for auth and assoc rejection due to acl reject. Signed-off-by: Tamizh chelvam <tamizhr@codeaurora.org>
2018-02-14 14:43:56 +01:00
wpa_msg(hapd->msg_ctx, MSG_DEBUG,
"Ignore Authentication frame from " MACSTR
" due to ACL reject", MAC2STR(mgmt->sa));
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
}
AP: Check ACL upon association request for 802.11ad With device_ap_sme disabled, ACL was checked upon authentication request. In 802.11ad there is no authentication phase so need to check ACL upon association. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2017-01-17 13:51:02 +01:00
if (res == HOSTAPD_ACL_PENDING)
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
return;
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
#ifdef CONFIG_SAE
SAE: Improved queuing policy for pending authentication frames The previous design of simply queuing all SAE commit messages was not exactly good at allowing recovery from a flooding state if the valid peer used frequent retransmissions of the SAE message. This could happen, e.g., with mesh BSSs using SAE. The frequent retransmissions and restarts of SAE authentication combined with SAE confirm messages bypassing the queue ended up in not being able to finish SAE exchange successfully. Fix this by modifying the queuing policy to queue SAE confirm messages if there is a queued SAE commit message from the same peer so that the messages within the same exchange do not get reordered. In addition, replace queued SAE commit/confirm message if a new matching message is received from the same peer STA. This is useful for the case where the peer restarts SAE more quickly than the local end has time to process the queued messages. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-14 23:03:29 +01:00
if (auth_alg == WLAN_AUTH_SAE && !from_queue &&
(auth_transaction == 1 ||
(auth_transaction == 2 && auth_sae_queued_addr(hapd, mgmt->sa)))) {
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
/* Handle SAE Authentication commit message through a queue to
* provide more control for postponing the needed heavy
SAE: Improved queuing policy for pending authentication frames The previous design of simply queuing all SAE commit messages was not exactly good at allowing recovery from a flooding state if the valid peer used frequent retransmissions of the SAE message. This could happen, e.g., with mesh BSSs using SAE. The frequent retransmissions and restarts of SAE authentication combined with SAE confirm messages bypassing the queue ended up in not being able to finish SAE exchange successfully. Fix this by modifying the queuing policy to queue SAE confirm messages if there is a queued SAE commit message from the same peer so that the messages within the same exchange do not get reordered. In addition, replace queued SAE commit/confirm message if a new matching message is received from the same peer STA. This is useful for the case where the peer restarts SAE more quickly than the local end has time to process the queued messages. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-14 23:03:29 +01:00
* processing under a possible DoS attack scenario. In addition,
* queue SAE Authentication confirm message if there happens to
* be a queued commit message from the same peer. This is needed
* to avoid reordering Authentication frames within the same
* SAE exchange. */
auth_sae_queue(hapd, mgmt, len, rssi);
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
return;
}
#endif /* CONFIG_SAE */
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
sta = ap_get_sta(hapd, mgmt->sa);
if (sta) {
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
sta->flags &= ~WLAN_STA_PENDING_FILS_ERP;
FT: Allow STA entry to be removed/re-added with FT-over-the-DS FT-over-the-DS has a special case where the STA entry (and as such, the TK) has not yet been configured to the driver depending on which driver interface is used. For that case, allow add-STA operation to be used (instead of set-STA). This is needed to allow mac80211-based drivers to accept the STA parameter configuration. Since this is after a new FT-over-DS exchange, a new TK has been derived after the last STA entry was added to the driver, so key reinstallation is not a concern for this case. Fixes: 0e3bd7ac684a ("hostapd: Avoid key reinstallation in FT handshake") Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-04 21:58:56 +01:00
sta->ft_over_ds = 0;
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
if ((fc & WLAN_FC_RETRY) &&
sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
sta->last_seq_ctrl == seq_ctrl &&
sta->last_subtype == WLAN_FC_STYPE_AUTH) {
hostapd_logger(hapd, sta->addr,
HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
"Drop repeated authentication frame seq_ctrl=0x%x",
seq_ctrl);
return;
}
mesh: Drop Authentication frames from BLOCKED STA Previously, only mesh Action frames from BLOCKED STA were dropped. Extend that to drop Authentication frames as well. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-02-17 11:48:53 +01:00
#ifdef CONFIG_MESH
if ((hapd->conf->mesh & MESH_ENABLED) &&
sta->plink_state == PLINK_BLOCKED) {
wpa_printf(MSG_DEBUG, "Mesh peer " MACSTR
" is blocked - drop Authentication frame",
MAC2STR(mgmt->sa));
return;
}
#endif /* CONFIG_MESH */
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
#ifdef CONFIG_PASN
if (auth_alg == WLAN_AUTH_PASN &&
(sta->flags & WLAN_STA_ASSOC)) {
wpa_printf(MSG_DEBUG,
"PASN: auth: Existing station: " MACSTR,
MAC2STR(sta->addr));
return;
}
#endif /* CONFIG_PASN */
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
} else {
mesh: Start mesh peering after successful authentication [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
#ifdef CONFIG_MESH
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
if (hapd->conf->mesh & MESH_ENABLED) {
/* if the mesh peer is not available, we don't do auth.
*/
mesh: Delay Authentication frame process with no_auto_peer There is a possible race condition between receiving the NEW_PEER_CANDIDATE event and the Authentication frame from the peer. Previously, if the Authentication frame RX event was indicated first, that frame got dropped silently. Now, this frame is still dropped, but a copy of it is stored and the frame gets processed on the following NEW_PEER_CANDIDATE event if that is received for the same peer within two seconds. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-23 12:44:38 +01:00
wpa_printf(MSG_DEBUG, "Mesh peer " MACSTR
mesh: Drop Authentication frames from BLOCKED STA Previously, only mesh Action frames from BLOCKED STA were dropped. Extend that to drop Authentication frames as well. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-02-17 11:48:53 +01:00
" not yet known - drop Authentication frame",
mesh: Delay Authentication frame process with no_auto_peer There is a possible race condition between receiving the NEW_PEER_CANDIDATE event and the Authentication frame from the peer. Previously, if the Authentication frame RX event was indicated first, that frame got dropped silently. Now, this frame is still dropped, but a copy of it is stored and the frame gets processed on the following NEW_PEER_CANDIDATE event if that is received for the same peer within two seconds. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-23 12:44:38 +01:00
MAC2STR(mgmt->sa));
/*
* Save a copy of the frame so that it can be processed
* if a new peer entry is added shortly after this.
*/
wpabuf_free(hapd->mesh_pending_auth);
hapd->mesh_pending_auth = wpabuf_alloc_copy(mgmt, len);
os_get_reltime(&hapd->mesh_pending_auth_time);
mesh: Start mesh peering after successful authentication [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
return;
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
}
mesh: Start mesh peering after successful authentication [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
#endif /* CONFIG_MESH */
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
mesh: Start mesh peering after successful authentication [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
sta = ap_sta_add(hapd, mgmt->sa);
if (!sta) {
hostapd: Add more authentication error case debugging This can help one understand better why stations are failing to authenticate. Signed-off-by: Ben Greear <greearb@candelatech.com>
2017-12-07 18:14:49 +01:00
wpa_printf(MSG_DEBUG, "ap_sta_add() failed");
mesh: Start mesh peering after successful authentication [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
goto fail;
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
sta->last_seq_ctrl = seq_ctrl;
sta->last_subtype = WLAN_FC_STYPE_AUTH;
OCE: RSSI-based rejection to consider Authentication frames (AP) Try to make RSSI-based rejection of associating stations a bit less likely to trigger false rejections by considering RSSI from the last received Authentication frame. Association is rejected only if both the Authentication and (Re)Association Request frames are below the RSSI threshold. Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-01 17:17:02 +01:00
#ifdef CONFIG_MBO
sta->auth_rssi = rssi;
#endif /* CONFIG_MBO */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
Move the RADIUS cached attributes into a struct This makes it easier to pass these around and to add new attributes. Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2019-04-28 13:14:57 +02:00
res = ieee802_11_set_radius_info(hapd, sta, res, &rad_info);
AP: Check ACL upon association request for 802.11ad With device_ap_sme disabled, ACL was checked upon authentication request. In 802.11ad there is no authentication phase so need to check ACL upon association. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2017-01-17 13:51:02 +01:00
if (res) {
hostapd: Add more authentication error case debugging This can help one understand better why stations are failing to authenticate. Signed-off-by: Ben Greear <greearb@candelatech.com>
2017-12-07 18:14:49 +01:00
wpa_printf(MSG_DEBUG, "ieee802_11_set_radius_info() failed");
VLAN: Add per-STA vif option This allows the stations to be assigned to their own vif. It does not need dynamic_vlan to be set. Make hostapd call ap_sta_set_vlan even if !vlan_desc.notempty, so vlan_id can be assigned regardless. Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2016-01-21 14:52:00 +01:00
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
Copy User-Name/CUI from RADIUS ACL to STA entry Signed-hostap: Michael Braun <michael-dev@fami-braun.de>
2012-08-19 13:20:10 +02:00
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
sta->flags &= ~WLAN_STA_PREAUTH;
ieee802_1x_notify_pre_auth(sta->eapol_sm, 0);
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
/*
* If the driver supports full AP client state, add a station to the
* driver before sending authentication reply to make sure the driver
* has resources, and not to go through the entire authentication and
* association handshake, and fail it at the end.
*
* If this is not the first transaction, in a multi-step authentication
* algorithm, the station already exists in the driver
* (sta->added_unassoc = 1) so skip it.
*
* In mesh mode, the station was already added to the driver when the
* NEW_PEER_CANDIDATE event is received.
AP: Do not drop STA entry if PMF is used with full AP client state This fixes a regression from commit bb598c3bdd0616f0c15e1a42e99591d8f3ff3323 ('AP: Add support for full station state'). That commit added code to remove and re-add the kernel STA entry when processing Authentication frames with a driver that advertises support for full AP client state. That resulted in bypassing PMF protections for unprotected Authentication frames with such drivers since the TK was lost in this operation. It is simplest to skip the STA entry clearing in this type of case completely to leave the TK in place and to process the new authentication exchange otherwise normally. This matches the behavior used with the drivers that do not implement full AP client state. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-29 15:15:31 +01:00
*
* If PMF was negotiated for the existing association, skip this to
* avoid dropping the STA entry and the associated keys. This is needed
* to allow the original connection work until the attempt can complete
* (re)association, so that unprotected Authentication frame cannot be
* used to bypass PMF protection.
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
*
* PASN authentication does not require adding/removing station to the
* driver so skip this flow in case of PASN authentication.
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
*/
if (FULL_AP_CLIENT_STATE_SUPP(hapd->iface->drv_flags) &&
AP: Do not drop STA entry if PMF is used with full AP client state This fixes a regression from commit bb598c3bdd0616f0c15e1a42e99591d8f3ff3323 ('AP: Add support for full station state'). That commit added code to remove and re-add the kernel STA entry when processing Authentication frames with a driver that advertises support for full AP client state. That resulted in bypassing PMF protections for unprotected Authentication frames with such drivers since the TK was lost in this operation. It is simplest to skip the STA entry clearing in this type of case completely to leave the TK in place and to process the new authentication exchange otherwise normally. This matches the behavior used with the drivers that do not implement full AP client state. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-29 15:15:31 +01:00
(!(sta->flags & WLAN_STA_MFP) || !ap_sta_is_authorized(sta)) &&
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
!(hapd->conf->mesh & MESH_ENABLED) &&
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
!(sta->added_unassoc) && auth_alg != WLAN_AUTH_PASN) {
FT: Remove and re-add STA entry after FT protocol success with PMF Allow STA entry to be removed and re-added to the driver with PMF is used with FT. Previously, this case resulted in cfg80211 rejecting STA entry update after successful FT protocol use if the association had not been dropped and it could not be dropped for the PMF case in handle_auth(). Signed-off-by: Jouni Malinen <j@w1.fi>
2020-04-04 20:50:37 +02:00
if (ap_sta_re_add(hapd, sta) < 0) {
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
goto fail;
}
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
switch (auth_alg) {
case WLAN_AUTH_OPEN:
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
"authentication OK (open system)");
sta->flags |= WLAN_STA_AUTH;
wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
sta->auth_alg = WLAN_AUTH_OPEN;
mlme_authenticate_indication(hapd, sta);
break;
Make WEP functionality an optional build parameter WEP should not be used for anything anymore. As a step towards removing it completely, move all WEP related functionality to be within CONFIG_WEP blocks. This will be included in builds only if CONFIG_WEP=y is explicitly set in build configuration. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-02-29 15:52:39 +01:00
#ifdef CONFIG_WEP
Add build option to remove all internal RC4 uses The new CONFIG_NO_RC4=y build option can be used to remove all internal hostapd and wpa_supplicant uses of RC4. It should be noted that external uses (e.g., within a TLS library) do not get disabled when doing this. This removes capability of supporting WPA/TKIP, dynamic WEP keys with IEEE 802.1X, WEP shared key authentication, and MSCHAPv2 password changes. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-01 22:37:07 +02:00
#ifndef CONFIG_NO_RC4
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
case WLAN_AUTH_SHARED_KEY:
resp = auth_shared_key(hapd, sta, auth_transaction, challenge,
fc & WLAN_FC_ISWEP);
hostapd: Add more authentication error case debugging This can help one understand better why stations are failing to authenticate. Signed-off-by: Ben Greear <greearb@candelatech.com>
2017-12-07 18:14:49 +01:00
if (resp != 0)
wpa_printf(MSG_DEBUG,
"auth_shared_key() failed: status=%d", resp);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
sta->auth_alg = WLAN_AUTH_SHARED_KEY;
mlme_authenticate_indication(hapd, sta);
if (sta->challenge && auth_transaction == 1) {
resp_ies[0] = WLAN_EID_CHALLENGE;
resp_ies[1] = WLAN_AUTH_CHALLENGE_LEN;
os_memcpy(resp_ies + 2, sta->challenge,
WLAN_AUTH_CHALLENGE_LEN);
resp_ies_len = 2 + WLAN_AUTH_CHALLENGE_LEN;
}
break;
Add build option to remove all internal RC4 uses The new CONFIG_NO_RC4=y build option can be used to remove all internal hostapd and wpa_supplicant uses of RC4. It should be noted that external uses (e.g., within a TLS library) do not get disabled when doing this. This removes capability of supporting WPA/TKIP, dynamic WEP keys with IEEE 802.1X, WEP shared key authentication, and MSCHAPv2 password changes. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-01 22:37:07 +02:00
#endif /* CONFIG_NO_RC4 */
Make WEP functionality an optional build parameter WEP should not be used for anything anymore. As a step towards removing it completely, move all WEP related functionality to be within CONFIG_WEP blocks. This will be included in builds only if CONFIG_WEP=y is explicitly set in build configuration. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-02-29 15:52:39 +01:00
#endif /* CONFIG_WEP */
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#ifdef CONFIG_IEEE80211R_AP
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
case WLAN_AUTH_FT:
sta->auth_alg = WLAN_AUTH_FT;
if (sta->wpa_sm == NULL)
sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
P2P: Make peer's P2P Device Address available to authenticator This can be used to implement per-device PSK selection based on the peer's P2P Device Address instead of P2P Interface Address. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-09-01 10:05:19 +02:00
sta->addr, NULL);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (sta->wpa_sm == NULL) {
wpa_printf(MSG_DEBUG, "FT: Failed to initialize WPA "
"state machine");
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
}
wpa_ft_process_auth(sta->wpa_sm, mgmt->bssid,
auth_transaction, mgmt->u.auth.variable,
len - IEEE80211_HDRLEN -
sizeof(mgmt->u.auth),
handle_auth_ft_finish, hapd);
/* handle_auth_ft_finish() callback will complete auth. */
return;
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#endif /* CONFIG_IEEE80211R_AP */
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
case WLAN_AUTH_SAE:
mesh: Start mesh peering after successful authentication [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
#ifdef CONFIG_MESH
SAE: Check Status Code in Authentication frames While other authentication algorithms mark Status Code as being Reserved in the case of the transaction number 1, SAE does not. Check that the Status Code indicates success before creating SAE state. In addition, fix the mesh anti-clogging token request parsing on big endian CPUs. Transaction number 2 (confirm) can also have non-zero Status Code to report an error. Those should be processed, but not replied to with yet another error message. This could happen in mesh case. Avoid a loop of error messages by dropping the non-success case without additional response. In addition, don't reply to unknown transaction numbers if the status code is non-zero. This avoids a loop of error messages if an invalid frame where to be injected (or unlikely corruption were to occur). Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-14 22:52:02 +01:00
if (status_code == WLAN_STATUS_SUCCESS &&
hapd->conf->mesh & MESH_ENABLED) {
mesh: Start mesh peering after successful authentication [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
if (sta->wpa_sm == NULL)
sta->wpa_sm =
wpa_auth_sta_init(hapd->wpa_auth,
sta->addr, NULL);
if (sta->wpa_sm == NULL) {
wpa_printf(MSG_DEBUG,
"SAE: Failed to initialize WPA state machine");
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
}
}
#endif /* CONFIG_MESH */
SAE: Check Status Code in Authentication frames While other authentication algorithms mark Status Code as being Reserved in the case of the transaction number 1, SAE does not. Check that the Status Code indicates success before creating SAE state. In addition, fix the mesh anti-clogging token request parsing on big endian CPUs. Transaction number 2 (confirm) can also have non-zero Status Code to report an error. Those should be processed, but not replied to with yet another error message. This could happen in mesh case. Avoid a loop of error messages by dropping the non-success case without additional response. In addition, don't reply to unknown transaction numbers if the status code is non-zero. This avoids a loop of error messages if an invalid frame where to be injected (or unlikely corruption were to occur). Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-14 22:52:02 +01:00
handle_auth_sae(hapd, sta, mgmt, len, auth_transaction,
status_code);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
return;
#endif /* CONFIG_SAE */
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
#ifdef CONFIG_FILS
case WLAN_AUTH_FILS_SK:
FILS: Add FILS SK auth PFS support in AP mode This adds an option to configure hostapd to enable use of perfect forward secrecy option in FILS shared key authentication. A new build option CONFIG_FILS_SK_PFS=y can be used to include this functionality. A new runtime configuration parameter fils_dh_group is used to enable this by specifying which DH group to use. For example, fils_dh_group=19 would allow FILS SK PFS to be used with a 256-bit random ECP group. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:40:56 +01:00
case WLAN_AUTH_FILS_SK_PFS:
FILS: Pass only IE area to handle_auth_fils() This function does not need the frame header, so pass in only the IE area to make it easier to share this for driver-based AP SME handling. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-23 17:24:38 +02:00
handle_auth_fils(hapd, sta, mgmt->u.auth.variable,
len - IEEE80211_HDRLEN - sizeof(mgmt->u.auth),
FILS: Make handle_auth_fils() re-usable for driver-based AP SME Allow this function to be called from outside ieee802_11.c and with the final steps replaced through a callback function. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-04-21 17:42:00 +02:00
auth_alg, auth_transaction, status_code,
handle_auth_fils_finish);
FILS: Process FILS Authentication frame (AP) This implements processing of FILS Authentication frame for FILS shared key authentication with ERP and PMKSA caching. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
return;
#endif /* CONFIG_FILS */
AP: Add support for PASN processing to the SME Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:32 +01:00
#ifdef CONFIG_PASN
case WLAN_AUTH_PASN:
handle_auth_pasn(hapd, sta, mgmt, len, auth_transaction,
status_code);
return;
#endif /* CONFIG_PASN */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
fail:
SAE: A bit optimized sae_confirm_immediate=2 for testing purposes sae_confirm_immediate=2 can now be used in CONFIG_TESTING_OPTIONS=y builds to minimize the latency between SAE Commit and SAE Confirm by postponing transmission of SAE Commit until the SAE Confirm frame is generated. This does not have significant impact, but can get the frames tiny bit closer to each other over the air to increase testing coverage. The only difference between sae_confirm_immediate 1 and 2 is in the former deriving KCK, PMK, PMKID, and CN between transmission of the frames (i.e., a small number of hash operations). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-08 19:52:26 +01:00
reply_res = send_auth_reply(hapd, sta, mgmt->sa, mgmt->bssid, auth_alg,
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
auth_transaction + 1, resp, resp_ies,
hostapd: Add send_auth_reply() caller info in debug logging This can help one understand better what happens during the authentication exchange. Signed-off-by: Ben Greear <greearb@candelatech.com>
2017-12-07 18:14:49 +01:00
resp_ies_len, "handle-auth");
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
if (sta && sta->added_unassoc && (resp != WLAN_STATUS_SUCCESS ||
reply_res != WLAN_STATUS_SUCCESS)) {
hostapd_drv_sta_remove(hapd, sta->addr);
sta->added_unassoc = 0;
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
mesh: Generate proper AID for peer IEEE Std 802.11-2012 13.3.1 states that the AID should be generated on the local node for each peer. Previously, we were using the peer link ID (generated by the peer) which may not be unique among all peers. Correct this by reusing the AP AID generation code. Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-10-05 14:16:40 +02:00
int hostapd_get_aid(struct hostapd_data *hapd, struct sta_info *sta)
Move AID derivation into a separate function
2009-03-25 14:35:00 +01:00
{
Replace sta_aid array with bitfield The actual pointer to struct sta_info was not really used and it is enough to use a single bit to indicate whether an AID is allocated. This makes the BSS data take less memory while making the allocation routine faster and removing the arbitrary MAX_AID_TABLE_SIZE limit of 128 STAs.
2009-03-25 14:54:25 +01:00
int i, j = 32, aid;
Move AID derivation into a separate function
2009-03-25 14:35:00 +01:00
/* get a unique AID */
if (sta->aid > 0) {
wpa_printf(MSG_DEBUG, " old AID %d", sta->aid);
return 0;
}
tests: Add TEST_FAIL() to hostapd_get_aid() This allows additional testing coverage for AID unavailability cases. Signed-off-by: Jouni Malinen <j@w1.fi>
2016-06-28 19:44:26 +02:00
if (TEST_FAIL())
return -1;
Replace sta_aid array with bitfield The actual pointer to struct sta_info was not really used and it is enough to use a single bit to indicate whether an AID is allocated. This makes the BSS data take less memory while making the allocation routine faster and removing the arbitrary MAX_AID_TABLE_SIZE limit of 128 STAs.
2009-03-25 14:54:25 +01:00
for (i = 0; i < AID_WORDS; i++) {
if (hapd->sta_aid[i] == (u32) -1)
continue;
for (j = 0; j < 32; j++) {
if (!(hapd->sta_aid[i] & BIT(j)))
break;
}
if (j < 32)
Move AID derivation into a separate function
2009-03-25 14:35:00 +01:00
break;
}
Replace sta_aid array with bitfield The actual pointer to struct sta_info was not really used and it is enough to use a single bit to indicate whether an AID is allocated. This makes the BSS data take less memory while making the allocation routine faster and removing the arbitrary MAX_AID_TABLE_SIZE limit of 128 STAs.
2009-03-25 14:54:25 +01:00
if (j == 32)
return -1;
aid = i * 32 + j + 1;
if (aid > 2007)
return -1;
Move AID derivation into a separate function
2009-03-25 14:35:00 +01:00
Replace sta_aid array with bitfield The actual pointer to struct sta_info was not really used and it is enough to use a single bit to indicate whether an AID is allocated. This makes the BSS data take less memory while making the allocation routine faster and removing the arbitrary MAX_AID_TABLE_SIZE limit of 128 STAs.
2009-03-25 14:54:25 +01:00
sta->aid = aid;
hapd->sta_aid[i] |= BIT(j);
Move AID derivation into a separate function
2009-03-25 14:35:00 +01:00
wpa_printf(MSG_DEBUG, " new AID %d", sta->aid);
return 0;
}
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
static u16 check_ssid(struct hostapd_data *hapd, struct sta_info *sta,
const u8 *ssid_ie, size_t ssid_ie_len)
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
{
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
if (ssid_ie == NULL)
return WLAN_STATUS_UNSPECIFIED_FAILURE;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
if (ssid_ie_len != hapd->conf->ssid.ssid_len ||
os_memcmp(ssid_ie, hapd->conf->ssid.ssid, ssid_ie_len) != 0) {
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO,
"Station tried to associate with unknown SSID "
Replace ieee802_11_print_ssid() with wpa_ssid_txt() There is no need to maintain two different functions for printing out ASCII text version of SSID. Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-31 21:20:41 +01:00
"'%s'", wpa_ssid_txt(ssid_ie, ssid_ie_len));
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
return WLAN_STATUS_UNSPECIFIED_FAILURE;
Added max_listen_interval configuration option This allows associations to be denied if the STA tries to use too large listen interval. The default value is 65535 which matches with the field size limits.
2008-02-28 02:54:06 +01:00
}
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
return WLAN_STATUS_SUCCESS;
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
static u16 check_wmm(struct hostapd_data *hapd, struct sta_info *sta,
const u8 *wmm_ie, size_t wmm_ie_len)
{
WMM cleanup (WME -> WMM rename, comments, etc.) This updates the terminogy to match with the final WMM specification. In addition, some of the WMM TSPEC structure fields were in incorrect order and used without byte order swapping. Those are also taken care of this cleanup patch.
2009-03-04 11:33:24 +01:00
sta->flags &= ~WLAN_STA_WMM;
AP: Pass station's WMM configuration to driver wrappers This updates a previous patch did more or less the same thing by providing the qosinfo as a single variable to the driver wrappers. Signed-hostap: Jason Young <jason.young@dspg.com>
2011-12-17 11:38:06 +01:00
sta->qosinfo = 0;
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
if (wmm_ie && hapd->conf->wmm_enabled) {
AP: Add uapsd_queues and max_sp fields Add uapsd_queues and max_sp fields to sta_info struct, and pass them to the sta_add callback. These values are determined by the WMM IE in the (Re)Association Request. Signed-off-by: Eliad Peller <eliad@wizery.com>
2011-12-17 10:55:14 +01:00
struct wmm_information_element *wmm;
Make hostapd_eid_wmm_valid() return more logical return values Return 1/0 instead 0/-1 to indicate valid/invalid element so that the if statement makes more sense with !wmm_valid(). Signed-hostap: Jouni Malinen <j@w1.fi>
2011-12-17 11:41:00 +01:00
if (!hostapd_eid_wmm_valid(hapd, wmm_ie, wmm_ie_len)) {
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
hostapd_logger(hapd, sta->addr,
HOSTAPD_MODULE_WPA,
HOSTAPD_LEVEL_DEBUG,
WMM cleanup (WME -> WMM rename, comments, etc.) This updates the terminogy to match with the final WMM specification. In addition, some of the WMM TSPEC structure fields were in incorrect order and used without byte order swapping. Those are also taken care of this cleanup patch.
2009-03-04 11:33:24 +01:00
"invalid WMM element in association "
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
"request");
AP: Add uapsd_queues and max_sp fields Add uapsd_queues and max_sp fields to sta_info struct, and pass them to the sta_add callback. These values are determined by the WMM IE in the (Re)Association Request. Signed-off-by: Eliad Peller <eliad@wizery.com>
2011-12-17 10:55:14 +01:00
return WLAN_STATUS_UNSPECIFIED_FAILURE;
}
sta->flags |= WLAN_STA_WMM;
wmm = (struct wmm_information_element *) wmm_ie;
AP: Pass station's WMM configuration to driver wrappers This updates a previous patch did more or less the same thing by providing the qosinfo as a single variable to the driver wrappers. Signed-hostap: Jason Young <jason.young@dspg.com>
2011-12-17 11:38:06 +01:00
sta->qosinfo = wmm->qos_info;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
return WLAN_STATUS_SUCCESS;
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
hostapd: Add Multi-AP protocol support The purpose of Multi-AP specification is to enable inter-operability across Wi-Fi access points (APs) from different vendors. This patch introduces one new configuration parameter 'multi_ap' to enable Multi-AP functionality and to configure the BSS as a backhaul and/or fronthaul BSS. Advertise vendor specific Multi-AP capabilities in (Re)Association Response frame, if Multi-AP functionality is enabled through the configuration parameter. A backhaul AP must support receiving both 3addr and 4addr frames from a backhaul STA, so create a VLAN for it just like is done for WDS, i.e., by calling hostapd_set_wds_sta(). Since Multi-AP requires WPA2 (never WEP), we can safely call hostapd_set_wds_encryption() as well and we can reuse the entire WDS condition. To parse the Multi-AP Extension subelement, we use get_ie(): even though that function is meant for parsing IEs, it works for subelements. Signed-off-by: Venkateswara Naralasetty <vnaralas@codeaurora.org> Signed-off-by: Jouni Malinen <jouni@codeaurora.org> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2018-12-05 11:23:51 +01:00
static u16 check_multi_ap(struct hostapd_data *hapd, struct sta_info *sta,
const u8 *multi_ap_ie, size_t multi_ap_len)
{
u8 multi_ap_value = 0;
sta->flags &= ~WLAN_STA_MULTI_AP;
if (!hapd->conf->multi_ap)
return WLAN_STATUS_SUCCESS;
if (multi_ap_ie) {
const u8 *multi_ap_subelem;
multi_ap_subelem = get_ie(multi_ap_ie + 4,
multi_ap_len - 4,
MULTI_AP_SUB_ELEM_TYPE);
if (multi_ap_subelem && multi_ap_subelem[1] == 1) {
multi_ap_value = multi_ap_subelem[2];
} else {
hostapd_logger(hapd, sta->addr,
HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO,
"Multi-AP IE has missing or invalid Multi-AP subelement");
return WLAN_STATUS_INVALID_IE;
}
}
Multi-AP: Don't reject backhaul STA on fronthaul BSS The Multi-AP specification only specifies that information elements have to be added to the Association Request and Association Response frame; it doesn't specify anything about what should be done in case they are missing. Previously, we rejected non-backhaul associations on a backhaul-only BSS, and non-fronthaul associations on a fronthaul-only BSS. However, this makes WPS fail when fronthaul and backhaul are separate SSIDs. Indeed, WPS for the backhaul link is performed on the *fronthaul* SSID. Thus, the Association Request frmae used for WPS *will* contain the Multi-AP IE indicating a backhaul STA. Rejecting that association makes WPS fail. Therefore, accept a multi-AP backhaul STA Association Request frame on a fronthaul-only BSS. Still issue a warning about it, but only at level DEBUG intead of INFO. Also change the condition checking to make it clearer. While we're at it, also fix the handling of unexpected bits in the Multi-AP IE. 4 bits are reserved in the specification, so these certainly have to be ignored. The specification also doesn't say that setting one of the other bits is not allowed. Therefore, only report unexpected values in the Multi-AP IE, don't reject because of it. Note that a malformed IE (containing more than one byte) still triggers a rejection. Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2019-02-12 15:35:23 +01:00
if (multi_ap_value && multi_ap_value != MULTI_AP_BACKHAUL_STA)
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO,
"Multi-AP IE with unexpected value 0x%02x",
multi_ap_value);
hostapd: Add Multi-AP protocol support The purpose of Multi-AP specification is to enable inter-operability across Wi-Fi access points (APs) from different vendors. This patch introduces one new configuration parameter 'multi_ap' to enable Multi-AP functionality and to configure the BSS as a backhaul and/or fronthaul BSS. Advertise vendor specific Multi-AP capabilities in (Re)Association Response frame, if Multi-AP functionality is enabled through the configuration parameter. A backhaul AP must support receiving both 3addr and 4addr frames from a backhaul STA, so create a VLAN for it just like is done for WDS, i.e., by calling hostapd_set_wds_sta(). Since Multi-AP requires WPA2 (never WEP), we can safely call hostapd_set_wds_encryption() as well and we can reuse the entire WDS condition. To parse the Multi-AP Extension subelement, we use get_ie(): even though that function is meant for parsing IEs, it works for subelements. Signed-off-by: Venkateswara Naralasetty <vnaralas@codeaurora.org> Signed-off-by: Jouni Malinen <jouni@codeaurora.org> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2018-12-05 11:23:51 +01:00
Multi-AP: Don't reject backhaul STA on fronthaul BSS The Multi-AP specification only specifies that information elements have to be added to the Association Request and Association Response frame; it doesn't specify anything about what should be done in case they are missing. Previously, we rejected non-backhaul associations on a backhaul-only BSS, and non-fronthaul associations on a fronthaul-only BSS. However, this makes WPS fail when fronthaul and backhaul are separate SSIDs. Indeed, WPS for the backhaul link is performed on the *fronthaul* SSID. Thus, the Association Request frmae used for WPS *will* contain the Multi-AP IE indicating a backhaul STA. Rejecting that association makes WPS fail. Therefore, accept a multi-AP backhaul STA Association Request frame on a fronthaul-only BSS. Still issue a warning about it, but only at level DEBUG intead of INFO. Also change the condition checking to make it clearer. While we're at it, also fix the handling of unexpected bits in the Multi-AP IE. 4 bits are reserved in the specification, so these certainly have to be ignored. The specification also doesn't say that setting one of the other bits is not allowed. Therefore, only report unexpected values in the Multi-AP IE, don't reject because of it. Note that a malformed IE (containing more than one byte) still triggers a rejection. Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2019-02-12 15:35:23 +01:00
if (!(multi_ap_value & MULTI_AP_BACKHAUL_STA)) {
if (hapd->conf->multi_ap & FRONTHAUL_BSS)
return WLAN_STATUS_SUCCESS;
hostapd: Add Multi-AP protocol support The purpose of Multi-AP specification is to enable inter-operability across Wi-Fi access points (APs) from different vendors. This patch introduces one new configuration parameter 'multi_ap' to enable Multi-AP functionality and to configure the BSS as a backhaul and/or fronthaul BSS. Advertise vendor specific Multi-AP capabilities in (Re)Association Response frame, if Multi-AP functionality is enabled through the configuration parameter. A backhaul AP must support receiving both 3addr and 4addr frames from a backhaul STA, so create a VLAN for it just like is done for WDS, i.e., by calling hostapd_set_wds_sta(). Since Multi-AP requires WPA2 (never WEP), we can safely call hostapd_set_wds_encryption() as well and we can reuse the entire WDS condition. To parse the Multi-AP Extension subelement, we use get_ie(): even though that function is meant for parsing IEs, it works for subelements. Signed-off-by: Venkateswara Naralasetty <vnaralas@codeaurora.org> Signed-off-by: Jouni Malinen <jouni@codeaurora.org> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2018-12-05 11:23:51 +01:00
Multi-AP: Don't reject backhaul STA on fronthaul BSS The Multi-AP specification only specifies that information elements have to be added to the Association Request and Association Response frame; it doesn't specify anything about what should be done in case they are missing. Previously, we rejected non-backhaul associations on a backhaul-only BSS, and non-fronthaul associations on a fronthaul-only BSS. However, this makes WPS fail when fronthaul and backhaul are separate SSIDs. Indeed, WPS for the backhaul link is performed on the *fronthaul* SSID. Thus, the Association Request frmae used for WPS *will* contain the Multi-AP IE indicating a backhaul STA. Rejecting that association makes WPS fail. Therefore, accept a multi-AP backhaul STA Association Request frame on a fronthaul-only BSS. Still issue a warning about it, but only at level DEBUG intead of INFO. Also change the condition checking to make it clearer. While we're at it, also fix the handling of unexpected bits in the Multi-AP IE. 4 bits are reserved in the specification, so these certainly have to be ignored. The specification also doesn't say that setting one of the other bits is not allowed. Therefore, only report unexpected values in the Multi-AP IE, don't reject because of it. Note that a malformed IE (containing more than one byte) still triggers a rejection. Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2019-02-12 15:35:23 +01:00
hostapd_logger(hapd, sta->addr,
HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO,
"Non-Multi-AP STA tries to associate with backhaul-only BSS");
return WLAN_STATUS_ASSOC_DENIED_UNSPEC;
hostapd: Add Multi-AP protocol support The purpose of Multi-AP specification is to enable inter-operability across Wi-Fi access points (APs) from different vendors. This patch introduces one new configuration parameter 'multi_ap' to enable Multi-AP functionality and to configure the BSS as a backhaul and/or fronthaul BSS. Advertise vendor specific Multi-AP capabilities in (Re)Association Response frame, if Multi-AP functionality is enabled through the configuration parameter. A backhaul AP must support receiving both 3addr and 4addr frames from a backhaul STA, so create a VLAN for it just like is done for WDS, i.e., by calling hostapd_set_wds_sta(). Since Multi-AP requires WPA2 (never WEP), we can safely call hostapd_set_wds_encryption() as well and we can reuse the entire WDS condition. To parse the Multi-AP Extension subelement, we use get_ie(): even though that function is meant for parsing IEs, it works for subelements. Signed-off-by: Venkateswara Naralasetty <vnaralas@codeaurora.org> Signed-off-by: Jouni Malinen <jouni@codeaurora.org> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2018-12-05 11:23:51 +01:00
}
Multi-AP: Don't reject backhaul STA on fronthaul BSS The Multi-AP specification only specifies that information elements have to be added to the Association Request and Association Response frame; it doesn't specify anything about what should be done in case they are missing. Previously, we rejected non-backhaul associations on a backhaul-only BSS, and non-fronthaul associations on a fronthaul-only BSS. However, this makes WPS fail when fronthaul and backhaul are separate SSIDs. Indeed, WPS for the backhaul link is performed on the *fronthaul* SSID. Thus, the Association Request frmae used for WPS *will* contain the Multi-AP IE indicating a backhaul STA. Rejecting that association makes WPS fail. Therefore, accept a multi-AP backhaul STA Association Request frame on a fronthaul-only BSS. Still issue a warning about it, but only at level DEBUG intead of INFO. Also change the condition checking to make it clearer. While we're at it, also fix the handling of unexpected bits in the Multi-AP IE. 4 bits are reserved in the specification, so these certainly have to be ignored. The specification also doesn't say that setting one of the other bits is not allowed. Therefore, only report unexpected values in the Multi-AP IE, don't reject because of it. Note that a malformed IE (containing more than one byte) still triggers a rejection. Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2019-02-12 15:35:23 +01:00
if (!(hapd->conf->multi_ap & BACKHAUL_BSS))
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
"Backhaul STA tries to associate with fronthaul-only BSS");
sta->flags |= WLAN_STA_MULTI_AP;
return WLAN_STATUS_SUCCESS;
hostapd: Add Multi-AP protocol support The purpose of Multi-AP specification is to enable inter-operability across Wi-Fi access points (APs) from different vendors. This patch introduces one new configuration parameter 'multi_ap' to enable Multi-AP functionality and to configure the BSS as a backhaul and/or fronthaul BSS. Advertise vendor specific Multi-AP capabilities in (Re)Association Response frame, if Multi-AP functionality is enabled through the configuration parameter. A backhaul AP must support receiving both 3addr and 4addr frames from a backhaul STA, so create a VLAN for it just like is done for WDS, i.e., by calling hostapd_set_wds_sta(). Since Multi-AP requires WPA2 (never WEP), we can safely call hostapd_set_wds_encryption() as well and we can reuse the entire WDS condition. To parse the Multi-AP Extension subelement, we use get_ie(): even though that function is meant for parsing IEs, it works for subelements. Signed-off-by: Venkateswara Naralasetty <vnaralas@codeaurora.org> Signed-off-by: Jouni Malinen <jouni@codeaurora.org> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2018-12-05 11:23:51 +01:00
}
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
static u16 copy_supp_rates(struct hostapd_data *hapd, struct sta_info *sta,
struct ieee802_11_elems *elems)
{
AP: Do not look for supported rates in DMG/IEEE 802.11ad Supported Rates element is not present in DMG/IEEE 802.11ad frames. Make copy_supp_rates() immediately return with success if hardware mode is IEEE 802.11ad. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-12-20 16:04:43 +01:00
/* Supported rates not used in IEEE 802.11ad/DMG */
if (hapd->iface->current_mode &&
hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211AD)
return WLAN_STATUS_SUCCESS;
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
if (!elems->supp_rates) {
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
HOSTAPD_LEVEL_DEBUG,
"No supported rates element in AssocReq");
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
return WLAN_STATUS_UNSPECIFIED_FAILURE;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
Use a shared helper function for merging supported rate lists Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-19 16:52:41 +02:00
if (elems->supp_rates_len + elems->ext_supp_rates_len >
sizeof(sta->supported_rates)) {
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
HOSTAPD_LEVEL_DEBUG,
Use a shared helper function for merging supported rate lists Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-19 16:52:41 +02:00
"Invalid supported rates element length %d+%d",
elems->supp_rates_len,
elems->ext_supp_rates_len);
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
return WLAN_STATUS_UNSPECIFIED_FAILURE;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
Use a shared helper function for merging supported rate lists Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-19 16:52:41 +02:00
sta->supported_rates_len = merge_byte_arrays(
sta->supported_rates, sizeof(sta->supported_rates),
elems->supp_rates, elems->supp_rates_len,
elems->ext_supp_rates, elems->ext_supp_rates_len);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
return WLAN_STATUS_SUCCESS;
}
Interworking: Add support for QoS Mapping functionality for the AP This allows QoS Map Set element to be added to (Re)Association Response frames and in QoS Map Configure frame. The QoS Mapping parameters are also made available for the driver interface. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2013-07-24 11:28:20 +02:00
static u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
const u8 *ext_capab_ie, size_t ext_capab_ie_len)
{
#ifdef CONFIG_INTERWORKING
/* check for QoS Map support */
if (ext_capab_ie_len >= 5) {
if (ext_capab_ie[4] & 0x01)
sta->qos_map_enabled = 1;
}
#endif /* CONFIG_INTERWORKING */
hostapd: Add extended capabilities into STA command Signed-off-by: bhagavathi perumal s <bperumal@qti.qualcomm.com>
2017-10-06 17:03:25 +02:00
if (ext_capab_ie_len > 0) {
P2P: Implement P2P_GO_FREQ_MOVE_SCM_ECSA policy Add new GO frequency move policy. The P2P_GO_FREQ_MOVE_SCM_ECSA prefers SCM if all the clients advertise eCSA support and the candidate frequency is one of the group common frequencies. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2015-09-08 11:46:20 +02:00
sta->ecsa_supported = !!(ext_capab_ie[0] & BIT(2));
hostapd: Add extended capabilities into STA command Signed-off-by: bhagavathi perumal s <bperumal@qti.qualcomm.com>
2017-10-06 17:03:25 +02:00
os_free(sta->ext_capability);
sta->ext_capability = os_malloc(1 + ext_capab_ie_len);
if (sta->ext_capability) {
sta->ext_capability[0] = ext_capab_ie_len;
os_memcpy(sta->ext_capability + 1, ext_capab_ie,
ext_capab_ie_len);
}
}
P2P: Implement P2P_GO_FREQ_MOVE_SCM_ECSA policy Add new GO frequency move policy. The P2P_GO_FREQ_MOVE_SCM_ECSA prefers SCM if all the clients advertise eCSA support and the candidate frequency is one of the group common frequencies. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2015-09-08 11:46:20 +02:00
Interworking: Add support for QoS Mapping functionality for the AP This allows QoS Map Set element to be added to (Re)Association Response frames and in QoS Map Configure frame. The QoS Mapping parameters are also made available for the driver interface. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2013-07-24 11:28:20 +02:00
return WLAN_STATUS_SUCCESS;
}
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
#ifdef CONFIG_OWE
OWE: Allow set of enabled DH groups to be limited on AP The new hostapd configuration parameter owe_groups can be used to specify a subset of the allowed DH groups as a space separated list of group identifiers. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-10 18:00:57 +02:00
static int owe_group_supported(struct hostapd_data *hapd, u16 group)
{
int i;
int *groups = hapd->conf->owe_groups;
if (group != 19 && group != 20 && group != 21)
return 0;
if (!groups)
return 1;
for (i = 0; groups[i] > 0; i++) {
if (groups[i] == group)
return 1;
}
return 0;
}
OWE: PMKSA caching in AP mode This extends OWE support in hostapd to allow PMKSA caching to be used. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-09 11:08:12 +02:00
static u16 owe_process_assoc_req(struct hostapd_data *hapd,
struct sta_info *sta, const u8 *owe_dh,
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
u8 owe_dh_len)
{
struct wpabuf *secret, *pub, *hkey;
int res;
OWE: Support DH groups 20 (NIST P-384) and 21 (NIST P-521) in AP mode This extends OWE support in hostapd to allow DH groups 20 and 21 to be used in addition to the mandatory group 19 (NIST P-256). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 15:37:32 +02:00
u8 prk[SHA512_MAC_LEN], pmkid[SHA512_MAC_LEN];
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
const char *info = "OWE Key Generation";
const u8 *addr[2];
size_t len[2];
OWE: Support DH groups 20 (NIST P-384) and 21 (NIST P-521) in AP mode This extends OWE support in hostapd to allow DH groups 20 and 21 to be used in addition to the mandatory group 19 (NIST P-256). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 15:37:32 +02:00
u16 group;
size_t hash_len, prime_len;
OWE: PMKSA caching in AP mode This extends OWE support in hostapd to allow PMKSA caching to be used. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-09 11:08:12 +02:00
if (wpa_auth_sta_get_pmksa(sta->wpa_sm)) {
wpa_printf(MSG_DEBUG, "OWE: Using PMKSA caching");
return WLAN_STATUS_SUCCESS;
}
OWE: Support DH groups 20 (NIST P-384) and 21 (NIST P-521) in AP mode This extends OWE support in hostapd to allow DH groups 20 and 21 to be used in addition to the mandatory group 19 (NIST P-256). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 15:37:32 +02:00
group = WPA_GET_LE16(owe_dh);
OWE: Allow set of enabled DH groups to be limited on AP The new hostapd configuration parameter owe_groups can be used to specify a subset of the allowed DH groups as a space separated list of group identifiers. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-10 18:00:57 +02:00
if (!owe_group_supported(hapd, group)) {
wpa_printf(MSG_DEBUG, "OWE: Unsupported DH group %u", group);
return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
}
OWE: Support DH groups 20 (NIST P-384) and 21 (NIST P-521) in AP mode This extends OWE support in hostapd to allow DH groups 20 and 21 to be used in addition to the mandatory group 19 (NIST P-256). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 15:37:32 +02:00
if (group == 19)
prime_len = 32;
else if (group == 20)
prime_len = 48;
else if (group == 21)
prime_len = 66;
else
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
crypto_ecdh_deinit(sta->owe_ecdh);
OWE: Support DH groups 20 (NIST P-384) and 21 (NIST P-521) in AP mode This extends OWE support in hostapd to allow DH groups 20 and 21 to be used in addition to the mandatory group 19 (NIST P-256). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 15:37:32 +02:00
sta->owe_ecdh = crypto_ecdh_init(group);
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
if (!sta->owe_ecdh)
return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
OWE: Support DH groups 20 (NIST P-384) and 21 (NIST P-521) in AP mode This extends OWE support in hostapd to allow DH groups 20 and 21 to be used in addition to the mandatory group 19 (NIST P-256). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 15:37:32 +02:00
sta->owe_group = group;
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
secret = crypto_ecdh_set_peerkey(sta->owe_ecdh, 0, owe_dh + 2,
owe_dh_len - 2);
OWE: Support DH groups 20 (NIST P-384) and 21 (NIST P-521) in AP mode This extends OWE support in hostapd to allow DH groups 20 and 21 to be used in addition to the mandatory group 19 (NIST P-256). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 15:37:32 +02:00
secret = wpabuf_zeropad(secret, prime_len);
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
if (!secret) {
wpa_printf(MSG_DEBUG, "OWE: Invalid peer DH public key");
return WLAN_STATUS_UNSPECIFIED_FAILURE;
}
wpa_hexdump_buf_key(MSG_DEBUG, "OWE: DH shared secret", secret);
/* prk = HKDF-extract(C | A | group, z) */
pub = crypto_ecdh_get_pubkey(sta->owe_ecdh, 0);
if (!pub) {
wpabuf_clear_free(secret);
return WLAN_STATUS_UNSPECIFIED_FAILURE;
}
/* PMKID = Truncate-128(Hash(C | A)) */
addr[0] = owe_dh + 2;
len[0] = owe_dh_len - 2;
addr[1] = wpabuf_head(pub);
len[1] = wpabuf_len(pub);
OWE: Support DH groups 20 (NIST P-384) and 21 (NIST P-521) in AP mode This extends OWE support in hostapd to allow DH groups 20 and 21 to be used in addition to the mandatory group 19 (NIST P-256). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 15:37:32 +02:00
if (group == 19) {
res = sha256_vector(2, addr, len, pmkid);
hash_len = SHA256_MAC_LEN;
} else if (group == 20) {
res = sha384_vector(2, addr, len, pmkid);
hash_len = SHA384_MAC_LEN;
} else if (group == 21) {
res = sha512_vector(2, addr, len, pmkid);
hash_len = SHA512_MAC_LEN;
} else {
wpabuf_free(pub);
wpabuf_clear_free(secret);
return WLAN_STATUS_UNSPECIFIED_FAILURE;
}
pub = wpabuf_zeropad(pub, prime_len);
if (res < 0 || !pub) {
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
wpabuf_free(pub);
wpabuf_clear_free(secret);
return WLAN_STATUS_UNSPECIFIED_FAILURE;
}
hkey = wpabuf_alloc(owe_dh_len - 2 + wpabuf_len(pub) + 2);
if (!hkey) {
wpabuf_free(pub);
wpabuf_clear_free(secret);
return WLAN_STATUS_UNSPECIFIED_FAILURE;
}
wpabuf_put_data(hkey, owe_dh + 2, owe_dh_len - 2); /* C */
wpabuf_put_buf(hkey, pub); /* A */
wpabuf_free(pub);
OWE: Support DH groups 20 (NIST P-384) and 21 (NIST P-521) in AP mode This extends OWE support in hostapd to allow DH groups 20 and 21 to be used in addition to the mandatory group 19 (NIST P-256). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 15:37:32 +02:00
wpabuf_put_le16(hkey, group); /* group */
if (group == 19)
res = hmac_sha256(wpabuf_head(hkey), wpabuf_len(hkey),
wpabuf_head(secret), wpabuf_len(secret), prk);
else if (group == 20)
res = hmac_sha384(wpabuf_head(hkey), wpabuf_len(hkey),
wpabuf_head(secret), wpabuf_len(secret), prk);
else if (group == 21)
res = hmac_sha512(wpabuf_head(hkey), wpabuf_len(hkey),
wpabuf_head(secret), wpabuf_len(secret), prk);
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
wpabuf_clear_free(hkey);
wpabuf_clear_free(secret);
if (res < 0)
return WLAN_STATUS_UNSPECIFIED_FAILURE;
OWE: Support DH groups 20 (NIST P-384) and 21 (NIST P-521) in AP mode This extends OWE support in hostapd to allow DH groups 20 and 21 to be used in addition to the mandatory group 19 (NIST P-256). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 15:37:32 +02:00
wpa_hexdump_key(MSG_DEBUG, "OWE: prk", prk, hash_len);
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
/* PMK = HKDF-expand(prk, "OWE Key Generation", n) */
os_free(sta->owe_pmk);
OWE: Support DH groups 20 (NIST P-384) and 21 (NIST P-521) in AP mode This extends OWE support in hostapd to allow DH groups 20 and 21 to be used in addition to the mandatory group 19 (NIST P-256). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 15:37:32 +02:00
sta->owe_pmk = os_malloc(hash_len);
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
if (!sta->owe_pmk) {
OWE: Support DH groups 20 (NIST P-384) and 21 (NIST P-521) in AP mode This extends OWE support in hostapd to allow DH groups 20 and 21 to be used in addition to the mandatory group 19 (NIST P-256). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 15:37:32 +02:00
os_memset(prk, 0, SHA512_MAC_LEN);
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
return WLAN_STATUS_UNSPECIFIED_FAILURE;
}
OWE: Support DH groups 20 (NIST P-384) and 21 (NIST P-521) in AP mode This extends OWE support in hostapd to allow DH groups 20 and 21 to be used in addition to the mandatory group 19 (NIST P-256). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 15:37:32 +02:00
if (group == 19)
res = hmac_sha256_kdf(prk, hash_len, NULL, (const u8 *) info,
os_strlen(info), sta->owe_pmk, hash_len);
else if (group == 20)
res = hmac_sha384_kdf(prk, hash_len, NULL, (const u8 *) info,
os_strlen(info), sta->owe_pmk, hash_len);
else if (group == 21)
res = hmac_sha512_kdf(prk, hash_len, NULL, (const u8 *) info,
os_strlen(info), sta->owe_pmk, hash_len);
os_memset(prk, 0, SHA512_MAC_LEN);
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
if (res < 0) {
os_free(sta->owe_pmk);
sta->owe_pmk = NULL;
return WLAN_STATUS_UNSPECIFIED_FAILURE;
}
OWE: Support DH groups 20 (NIST P-384) and 21 (NIST P-521) in AP mode This extends OWE support in hostapd to allow DH groups 20 and 21 to be used in addition to the mandatory group 19 (NIST P-256). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 15:37:32 +02:00
sta->owe_pmk_len = hash_len;
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
OWE: Support DH groups 20 (NIST P-384) and 21 (NIST P-521) in AP mode This extends OWE support in hostapd to allow DH groups 20 and 21 to be used in addition to the mandatory group 19 (NIST P-256). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 15:37:32 +02:00
wpa_hexdump_key(MSG_DEBUG, "OWE: PMK", sta->owe_pmk, sta->owe_pmk_len);
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
wpa_hexdump(MSG_DEBUG, "OWE: PMKID", pmkid, PMKID_LEN);
OWE: PMKSA caching in AP mode This extends OWE support in hostapd to allow PMKSA caching to be used. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-09 11:08:12 +02:00
wpa_auth_pmksa_add2(hapd->wpa_auth, sta->addr, sta->owe_pmk,
sta->owe_pmk_len, pmkid, 0, WPA_KEY_MGMT_OWE);
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
return WLAN_STATUS_SUCCESS;
}
OWE: Allow set of enabled DH groups to be limited on AP The new hostapd configuration parameter owe_groups can be used to specify a subset of the allowed DH groups as a space separated list of group identifiers. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-10 18:00:57 +02:00
hostapd: Process OWE IE and update DH IE to the driver if needed This implements the required functionality in hostapd to facilitate OWE connection with the AP SME-in-driver cases. Stations can either send DH IE or PMKID (in RSNE) (or both) in Association Request frame during the OWE handshake. The drivers that use this offload mechanism do not interpret this information and instead, pass the same to hostapd for further processing. hostapd will either validate the PMKID obtained from the STA or generate DH IE and further indicate the same to the driver. The driver further sends this information in the Association Response frame. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org> Signed-off-by: Liangwei Dong <liangwei@codeaurora.org> Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-05-29 11:11:48 +02:00
u16 owe_validate_request(struct hostapd_data *hapd, const u8 *peer,
const u8 *rsn_ie, size_t rsn_ie_len,
const u8 *owe_dh, size_t owe_dh_len)
{
struct wpa_ie_data data;
int res;
if (!rsn_ie || rsn_ie_len < 2) {
wpa_printf(MSG_DEBUG, "OWE: Invalid RSNE from " MACSTR,
MAC2STR(peer));
return WLAN_STATUS_INVALID_IE;
}
rsn_ie -= 2;
rsn_ie_len += 2;
res = wpa_parse_wpa_ie_rsn(rsn_ie, rsn_ie_len, &data);
if (res) {
wpa_printf(MSG_DEBUG, "Failed to parse RSNE from " MACSTR
" (res=%d)", MAC2STR(peer), res);
wpa_hexdump(MSG_DEBUG, "RSNE", rsn_ie, rsn_ie_len);
return wpa_res_to_status_code(res);
}
if (!(data.key_mgmt & WPA_KEY_MGMT_OWE)) {
wpa_printf(MSG_DEBUG,
"OWE: Unexpected key mgmt 0x%x from " MACSTR,
(unsigned int) data.key_mgmt, MAC2STR(peer));
return WLAN_STATUS_AKMP_NOT_VALID;
}
if (!owe_dh) {
wpa_printf(MSG_DEBUG,
"OWE: No Diffie-Hellman Parameter element from "
MACSTR, MAC2STR(peer));
return WLAN_STATUS_AKMP_NOT_VALID;
}
return WLAN_STATUS_SUCCESS;
}
u16 owe_process_rsn_ie(struct hostapd_data *hapd,
struct sta_info *sta,
const u8 *rsn_ie, size_t rsn_ie_len,
const u8 *owe_dh, size_t owe_dh_len)
{
u16 status;
u8 *owe_buf, ie[256 * 2];
size_t ie_len = 0;
Return an enum from wpa_validate_wpa_ie() This is more specific then returning a generic int and also allows the compiler to do more checks. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 11:22:28 +01:00
enum wpa_validate_result res;
hostapd: Process OWE IE and update DH IE to the driver if needed This implements the required functionality in hostapd to facilitate OWE connection with the AP SME-in-driver cases. Stations can either send DH IE or PMKID (in RSNE) (or both) in Association Request frame during the OWE handshake. The drivers that use this offload mechanism do not interpret this information and instead, pass the same to hostapd for further processing. hostapd will either validate the PMKID obtained from the STA or generate DH IE and further indicate the same to the driver. The driver further sends this information in the Association Response frame. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org> Signed-off-by: Liangwei Dong <liangwei@codeaurora.org> Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-05-29 11:11:48 +02:00
if (!rsn_ie || rsn_ie_len < 2) {
wpa_printf(MSG_DEBUG, "OWE: No RSNE in (Re)AssocReq");
status = WLAN_STATUS_INVALID_IE;
goto end;
}
if (!sta->wpa_sm)
sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, sta->addr,
NULL);
if (!sta->wpa_sm) {
wpa_printf(MSG_WARNING,
"OWE: Failed to initialize WPA state machine");
status = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto end;
}
rsn_ie -= 2;
rsn_ie_len += 2;
res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
hapd->iface->freq, rsn_ie, rsn_ie_len,
Store a copy of Association Request RSNXE in AP mode for later use This is needed to be able to compare the received RSNXE to a protected version in EAPOL-Key msg 2/4. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-17 23:11:24 +02:00
NULL, 0, NULL, 0, owe_dh, owe_dh_len);
hostapd: Process OWE IE and update DH IE to the driver if needed This implements the required functionality in hostapd to facilitate OWE connection with the AP SME-in-driver cases. Stations can either send DH IE or PMKID (in RSNE) (or both) in Association Request frame during the OWE handshake. The drivers that use this offload mechanism do not interpret this information and instead, pass the same to hostapd for further processing. hostapd will either validate the PMKID obtained from the STA or generate DH IE and further indicate the same to the driver. The driver further sends this information in the Association Response frame. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org> Signed-off-by: Liangwei Dong <liangwei@codeaurora.org> Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-05-29 11:11:48 +02:00
status = wpa_res_to_status_code(res);
if (status != WLAN_STATUS_SUCCESS)
goto end;
status = owe_process_assoc_req(hapd, sta, owe_dh, owe_dh_len);
if (status != WLAN_STATUS_SUCCESS)
goto end;
owe_buf = wpa_auth_write_assoc_resp_owe(sta->wpa_sm, ie, sizeof(ie),
NULL, 0);
if (!owe_buf) {
status = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto end;
}
if (sta->owe_ecdh) {
struct wpabuf *pub;
pub = crypto_ecdh_get_pubkey(sta->owe_ecdh, 0);
if (!pub) {
status = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto end;
}
/* OWE Diffie-Hellman Parameter element */
*owe_buf++ = WLAN_EID_EXTENSION; /* Element ID */
*owe_buf++ = 1 + 2 + wpabuf_len(pub); /* Length */
*owe_buf++ = WLAN_EID_EXT_OWE_DH_PARAM; /* Element ID Extension
*/
WPA_PUT_LE16(owe_buf, sta->owe_group);
owe_buf += 2;
os_memcpy(owe_buf, wpabuf_head(pub), wpabuf_len(pub));
owe_buf += wpabuf_len(pub);
wpabuf_free(pub);
sta->external_dh_updated = 1;
}
ie_len = owe_buf - ie;
end:
wpa_printf(MSG_DEBUG, "OWE: Update status %d, ie len %d for peer "
MACSTR, status, (unsigned int) ie_len,
MAC2STR(sta->addr));
hostapd_drv_update_dh_ie(hapd, sta->addr, status,
status == WLAN_STATUS_SUCCESS ? ie : NULL,
ie_len);
return status;
}
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
#endif /* CONFIG_OWE */
WPS: Enable SA Query checks for WPS AP Initiate SA Query for a WPS+MFP AP. STA flag checks for MFP added for Association Request frames that use WPS IE without RSNE. This is needed to avoid giving an opportunity to skip the protection against disconnections when WPS is enabled. Signed-off-by: Disha Das <dishad@codeaurora.org>
2020-10-06 14:07:01 +02:00
static bool check_sa_query(struct hostapd_data *hapd, struct sta_info *sta,
int reassoc)
{
if ((sta->flags &
(WLAN_STA_ASSOC | WLAN_STA_MFP | WLAN_STA_AUTHORIZED)) !=
(WLAN_STA_ASSOC | WLAN_STA_MFP | WLAN_STA_AUTHORIZED))
return false;
if (!sta->sa_query_timed_out && sta->sa_query_count > 0)
ap_check_sa_query_timeout(hapd, sta);
if (!sta->sa_query_timed_out &&
(!reassoc || sta->auth_alg != WLAN_AUTH_FT)) {
/*
* STA has already been associated with MFP and SA Query timeout
* has not been reached. Reject the association attempt
* temporarily and start SA Query, if one is not pending.
*/
if (sta->sa_query_count == 0)
ap_sta_start_sa_query(hapd, sta);
return true;
}
return false;
}
FT: Discard ReassocReq with mismatching RSNXE Used value Discard the FT Reassociation Request frame instead of rejecting it (i.e., do not send Reassociation Response frame) if RSNXE Used is indicated in FTE, but no RSNXE is included even though the AP is advertising RSNXE. While there is not really much of a difference between discarding and rejecting the frame, this discarding behavior is what the standard says for this type of an error case. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-14 12:46:00 +02:00
static int check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
Mark management frame processing functions to use const buffer
2009-12-13 22:25:30 +01:00
const u8 *ies, size_t ies_len, int reassoc)
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
{
struct ieee802_11_elems elems;
FT: Discard ReassocReq with mismatching RSNXE Used value Discard the FT Reassociation Request frame instead of rejecting it (i.e., do not send Reassociation Response frame) if RSNXE Used is indicated in FTE, but no RSNXE is included even though the AP is advertising RSNXE. While there is not really much of a difference between discarding and rejecting the frame, this discarding behavior is what the standard says for this type of an error case. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-14 12:46:00 +02:00
int resp;
Mark ieee802_11_parse_elems() input and parsed elems const In addition, re-order IE pointers and u8 length so that the shorter length fields are together to allow compiler to optimize structure size.
2009-12-13 22:11:11 +01:00
const u8 *wpa_ie;
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
size_t wpa_ie_len;
P2P: Make peer's P2P Device Address available to authenticator This can be used to implement per-device PSK selection based on the peer's P2P Device Address instead of P2P Interface Address. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-09-01 10:05:19 +02:00
const u8 *p2p_dev_addr = NULL;
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
if (ieee802_11_parse_elems(ies, ies_len, &elems, 1) == ParseFailed) {
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO, "Station sent an invalid "
"association request");
return WLAN_STATUS_UNSPECIFIED_FAILURE;
}
resp = check_ssid(hapd, sta, elems.ssid, elems.ssid_len);
if (resp != WLAN_STATUS_SUCCESS)
return resp;
resp = check_wmm(hapd, sta, elems.wmm, elems.wmm_len);
Interworking: Add support for QoS Mapping functionality for the AP This allows QoS Map Set element to be added to (Re)Association Response frames and in QoS Map Configure frame. The QoS Mapping parameters are also made available for the driver interface. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2013-07-24 11:28:20 +02:00
if (resp != WLAN_STATUS_SUCCESS)
return resp;
resp = check_ext_capab(hapd, sta, elems.ext_capab, elems.ext_capab_len);
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
if (resp != WLAN_STATUS_SUCCESS)
return resp;
resp = copy_supp_rates(hapd, sta, &elems);
if (resp != WLAN_STATUS_SUCCESS)
return resp;
hostapd: Add Multi-AP protocol support The purpose of Multi-AP specification is to enable inter-operability across Wi-Fi access points (APs) from different vendors. This patch introduces one new configuration parameter 'multi_ap' to enable Multi-AP functionality and to configure the BSS as a backhaul and/or fronthaul BSS. Advertise vendor specific Multi-AP capabilities in (Re)Association Response frame, if Multi-AP functionality is enabled through the configuration parameter. A backhaul AP must support receiving both 3addr and 4addr frames from a backhaul STA, so create a VLAN for it just like is done for WDS, i.e., by calling hostapd_set_wds_sta(). Since Multi-AP requires WPA2 (never WEP), we can safely call hostapd_set_wds_encryption() as well and we can reuse the entire WDS condition. To parse the Multi-AP Extension subelement, we use get_ie(): even though that function is meant for parsing IEs, it works for subelements. Signed-off-by: Venkateswara Naralasetty <vnaralas@codeaurora.org> Signed-off-by: Jouni Malinen <jouni@codeaurora.org> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2018-12-05 11:23:51 +01:00
resp = check_multi_ap(hapd, sta, elems.multi_ap, elems.multi_ap_len);
if (resp != WLAN_STATUS_SUCCESS)
return resp;
Simplify HT Capabilities element parsing Check the element length in the parser and remove the length field from struct ieee802_11_elems since the element is of fixed length. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-04-19 15:48:21 +02:00
resp = copy_sta_ht_capab(hapd, sta, elems.ht_capabilities);
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
if (resp != WLAN_STATUS_SUCCESS)
return resp;
hostapd: Add require_ht configuration parameter This can be used to configure hostapd to reject association with any station that does not support HT PHY.
2011-02-09 14:08:47 +01:00
if (hapd->iconf->ieee80211n && hapd->iconf->require_ht &&
!(sta->flags & WLAN_STA_HT)) {
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO, "Station does not support "
"mandatory HT PHY - reject association");
return WLAN_STATUS_ASSOC_DENIED_NO_HT;
}
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
VHT: Store VHT capabilities and manage VHT flag for STAs Signed-hostap: Mahesh Palivela <maheshp@posedge.com>
2012-08-10 18:49:18 +02:00
#ifdef CONFIG_IEEE80211AC
Do not copy STA VHT capabilities if VHT is not enabled for AP Previously, station's VHT information elements were copied and passed regardless of the AP's VHT configuration. As a result, AP with VHT disabled in configuration could have ended up transmitting packets in VHT rates though AP is not advertising VHT support. Fix this by copying the station's VHT capabilities only when AP supports VHT (both hardware and configuration). Signed-off-by: Ashok Raj Nagarajan <arnagara@qti.qualcomm.com>
2015-09-22 15:56:00 +02:00
if (hapd->iconf->ieee80211ac) {
resp = copy_sta_vht_capab(hapd, sta, elems.vht_capabilities);
if (resp != WLAN_STATUS_SUCCESS)
return resp;
hostapd: Add Operating Mode Notification support Handle Operating Mode Notification received in (Re)Association Request frames. Signed-hostap: Marek Kwaczynski <marek.kwaczynski@tieto.com>
2014-02-10 13:43:05 +01:00
Do not copy STA VHT capabilities if VHT is not enabled for AP Previously, station's VHT information elements were copied and passed regardless of the AP's VHT configuration. As a result, AP with VHT disabled in configuration could have ended up transmitting packets in VHT rates though AP is not advertising VHT support. Fix this by copying the station's VHT capabilities only when AP supports VHT (both hardware and configuration). Signed-off-by: Ashok Raj Nagarajan <arnagara@qti.qualcomm.com>
2015-09-22 15:56:00 +02:00
resp = set_sta_vht_opmode(hapd, sta, elems.vht_opmode_notif);
if (resp != WLAN_STATUS_SUCCESS)
return resp;
}
hostapd: Add Operating Mode Notification support Handle Operating Mode Notification received in (Re)Association Request frames. Signed-hostap: Marek Kwaczynski <marek.kwaczynski@tieto.com>
2014-02-10 13:43:05 +01:00
VHT: Add option for requiring use of VHT Signed-hostap: Mahesh Palivela <maheshp@posedge.com>
2012-08-10 18:53:24 +02:00
if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht &&
!(sta->flags & WLAN_STA_VHT)) {
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO, "Station does not support "
"mandatory VHT PHY - reject association");
VHT: Use status code 104 to indicate VHT required IEEE Std 802.11ac-2013 defines a status code for this, so use that instead of the unspecified reason. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-24 20:19:45 +01:00
return WLAN_STATUS_ASSOC_DENIED_NO_VHT;
VHT: Add option for requiring use of VHT Signed-hostap: Mahesh Palivela <maheshp@posedge.com>
2012-08-10 18:53:24 +02:00
}
hostapd: Add vendor specific VHT extension for the 2.4 GHz band This allows vendor specific information element to be used to advertise support for VHT on 2.4 GHz band. In practice, this is used to enable use of 256 QAM rates (VHT-MCS 8 and 9) on 2.4 GHz band. This functionality is disabled by default, but can be enabled with vendor_vht=1 parameter in hostapd.conf if the driver advertises support for VHT on either 2.4 or 5 GHz bands. Signed-off-by: Yanbo Li <yanbol@qti.qualcomm.com>
2014-11-10 16:12:29 +01:00
if (hapd->conf->vendor_vht && !elems.vht_capabilities) {
resp = copy_sta_vendor_vht(hapd, sta, elems.vendor_vht,
elems.vendor_vht_len);
if (resp != WLAN_STATUS_SUCCESS)
return resp;
}
VHT: Store VHT capabilities and manage VHT flag for STAs Signed-hostap: Mahesh Palivela <maheshp@posedge.com>
2012-08-10 18:49:18 +02:00
#endif /* CONFIG_IEEE80211AC */
HE: Add AP mode MLME/SME handling for HE stations Process HE information in (Re)Association Request frames and add HE elements into (Re)Association Response frames when HE is enabled in the BSS. Signed-off-by: Shashidhar Lakkavalli <slakkavalli@datto.com> Signed-off-by: John Crispin <john@phrozen.org>
2019-05-20 09:55:05 +02:00
#ifdef CONFIG_IEEE80211AX
hostapd: Add ability to disable HT/VHT/HE per BSS Add the ability to disable HT/VHT/HE for specific BSS from hostapd.conf. - Add disable_11ax boolean to hostapd_bss_config. - Change disable_11n and disable_11ac to bool in hostapd_bss_config. - Add configuration option to set these disable_11* parameters (which were previously used only automatically based on incompatible security parameters to disable HT/VHT). Signed-off-by: Shay Bar <shay.bar@celeno.com>
2020-06-30 16:23:46 +02:00
if (hapd->iconf->ieee80211ax && !hapd->conf->disable_11ax) {
nl80211: Add driver multi iftype HE capability parsing The HE capabilities are no longer per PHY but per iftype on this specific PHY. It is therefore no longer enough to just parse the AP capabilities. The he_capabilities are now duplicated to store all information for IEEE80211_MODE_* which hostap cares about. The nl80211 driver fills in this information when the iftype supports HE. The rest of the code still only uses the IEEE80211_HE_AP portion but can be extended later to also use other HE capabilities. Signed-off-by: Sven Eckelmann <seckelmann@datto.com>
2019-06-14 16:49:20 +02:00
resp = copy_sta_he_capab(hapd, sta, IEEE80211_MODE_AP,
elems.he_capabilities,
HE: Add AP mode MLME/SME handling for HE stations Process HE information in (Re)Association Request frames and add HE elements into (Re)Association Response frames when HE is enabled in the BSS. Signed-off-by: Shashidhar Lakkavalli <slakkavalli@datto.com> Signed-off-by: John Crispin <john@phrozen.org>
2019-05-20 09:55:05 +02:00
elems.he_capabilities_len);
if (resp != WLAN_STATUS_SUCCESS)
return resp;
HE: Process HE 6 GHz band capab from associating HE STA Process HE 6 GHz band capabilities in (Re)Association Request frames and pass the information to the driver. Signed-off-by: Rajkumar Manoharan <rmanohar@codeaurora.org>
2020-04-25 00:45:41 +02:00
if (is_6ghz_op_class(hapd->iconf->op_class)) {
AP: Reject association request upon invalid HE capabilities Operation in the 6 GHz band mandates valid HE capabilities element in station negotiation. Reject association request upon receiving invalid or missing HE elements. Signed-off-by: Rajkumar Manoharan <rmanohar@codeaurora.org>
2020-06-02 08:14:28 +02:00
if (!(sta->flags & WLAN_STA_HE)) {
hostapd_logger(hapd, sta->addr,
HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO,
"Station does not support mandatory HE PHY - reject association");
return WLAN_STATUS_DENIED_HE_NOT_SUPPORTED;
}
HE: Process HE 6 GHz band capab from associating HE STA Process HE 6 GHz band capabilities in (Re)Association Request frames and pass the information to the driver. Signed-off-by: Rajkumar Manoharan <rmanohar@codeaurora.org>
2020-04-25 00:45:41 +02:00
resp = copy_sta_he_6ghz_capab(hapd, sta,
elems.he_6ghz_band_cap);
if (resp != WLAN_STATUS_SUCCESS)
return resp;
}
HE: Add AP mode MLME/SME handling for HE stations Process HE information in (Re)Association Request frames and add HE elements into (Re)Association Response frames when HE is enabled in the BSS. Signed-off-by: Shashidhar Lakkavalli <slakkavalli@datto.com> Signed-off-by: John Crispin <john@phrozen.org>
2019-05-20 09:55:05 +02:00
}
#endif /* CONFIG_IEEE80211AX */
VHT: Store VHT capabilities and manage VHT flag for STAs Signed-hostap: Mahesh Palivela <maheshp@posedge.com>
2012-08-10 18:49:18 +02:00
P2P: Make peer's P2P Device Address available to authenticator This can be used to implement per-device PSK selection based on the peer's P2P Device Address instead of P2P Interface Address. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-09-01 10:05:19 +02:00
#ifdef CONFIG_P2P
if (elems.p2p) {
wpabuf_free(sta->p2p_ie);
sta->p2p_ie = ieee802_11_vendor_ie_concat(ies, ies_len,
P2P_IE_VENDOR_TYPE);
if (sta->p2p_ie)
p2p_dev_addr = p2p_get_go_dev_addr(sta->p2p_ie);
} else {
wpabuf_free(sta->p2p_ie);
sta->p2p_ie = NULL;
}
#endif /* CONFIG_P2P */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if ((hapd->conf->wpa & WPA_PROTO_RSN) && elems.rsn_ie) {
wpa_ie = elems.rsn_ie;
wpa_ie_len = elems.rsn_ie_len;
} else if ((hapd->conf->wpa & WPA_PROTO_WPA) &&
elems.wpa_ie) {
wpa_ie = elems.wpa_ie;
wpa_ie_len = elems.wpa_ie_len;
} else {
wpa_ie = NULL;
wpa_ie_len = 0;
}
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
Added preliminary Wi-Fi Protected Setup (WPS) implementation This adds WPS support for both hostapd and wpa_supplicant. Both programs can be configured to act as WPS Enrollee and Registrar. Both PBC and PIN methods are supported. Currently, hostapd has more complete configuration option for WPS parameters and wpa_supplicant configuration style will likely change in the future. External Registrars are not yet supported in hostapd or wpa_supplicant. While wpa_supplicant has initial support for acting as an Registrar to configure an AP, this is still using number of hardcoded parameters which will need to be made configurable for proper operation.
2008-11-23 18:34:26 +01:00
#ifdef CONFIG_WPS
WPS: Wait for EAPOL-Start unless WPS 2.0 station as workaround Extend the code that waits for the station to send EAPOL-Start before initiating EAPOL authenticator operations to cover the case where the station includes WPS IE in (Re)Association Request frame if that IE does not include support for WPS 2.0. While this should not really be needed, this may help with some deployed WPS 1.0 stations that do not support EAPOL operations correctly and may get confused of the EAP-Request/Identity packets that would show up twice if EAPOL-Start is transmitted.
2011-08-28 18:16:59 +02:00
sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS | WLAN_STA_WPS2);
WPS: Fix association when both WPS and WPA/RSN IE are included The WPS IE was overriding the WPA/RSN IE in driver based MLME case (hostapd_notif_assoc), but the MLME code here was not using WPS IE correctly, i.e., it allowed the WPA/RSN IE override the operation.
2010-04-15 11:55:34 +02:00
if (hapd->conf->wps_state && elems.wps_ie) {
wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)Association "
"Request - assume WPS is used");
WPS: Enable SA Query checks for WPS AP Initiate SA Query for a WPS+MFP AP. STA flag checks for MFP added for Association Request frames that use WPS IE without RSNE. This is needed to avoid giving an opportunity to skip the protection against disconnections when WPS is enabled. Signed-off-by: Disha Das <dishad@codeaurora.org>
2020-10-06 14:07:01 +02:00
if (check_sa_query(hapd, sta, reassoc))
return WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY;
WPS: Fix association when both WPS and WPA/RSN IE are included The WPS IE was overriding the WPA/RSN IE in driver based MLME case (hostapd_notif_assoc), but the MLME code here was not using WPS IE correctly, i.e., it allowed the WPA/RSN IE override the operation.
2010-04-15 11:55:34 +02:00
sta->flags |= WLAN_STA_WPS;
wpabuf_free(sta->wps_ie);
Reassemble WPS IE(s) in (Re)Association Request if needed Use a function that will take care of possible (though, very unlikely) fragmentation of WPS TLVs in (Re)Association Request frames.
2010-05-26 17:17:13 +02:00
sta->wps_ie = ieee802_11_vendor_ie_concat(ies, ies_len,
WPS_IE_VENDOR_TYPE);
WPS: Wait for EAPOL-Start unless WPS 2.0 station as workaround Extend the code that waits for the station to send EAPOL-Start before initiating EAPOL authenticator operations to cover the case where the station includes WPS IE in (Re)Association Request frame if that IE does not include support for WPS 2.0. While this should not really be needed, this may help with some deployed WPS 1.0 stations that do not support EAPOL operations correctly and may get confused of the EAP-Request/Identity packets that would show up twice if EAPOL-Start is transmitted.
2011-08-28 18:16:59 +02:00
if (sta->wps_ie && wps_is_20(sta->wps_ie)) {
wpa_printf(MSG_DEBUG, "WPS: STA supports WPS 2.0");
sta->flags |= WLAN_STA_WPS2;
}
WPS: Fix association when both WPS and WPA/RSN IE are included The WPS IE was overriding the WPA/RSN IE in driver based MLME case (hostapd_notif_assoc), but the MLME code here was not using WPS IE correctly, i.e., it allowed the WPA/RSN IE override the operation.
2010-04-15 11:55:34 +02:00
wpa_ie = NULL;
wpa_ie_len = 0;
WPS 2.0: Validate WPS attributes in management frames and WSC messages If CONFIG_WPS_STRICT is set, validate WPS IE(s) in management frames and reject the frames if any of the mandatory attributes is missing or if an included attribute uses an invalid value. In addition, verify that all mandatory attributes are included and have valid values in the WSC messages.
2010-05-26 16:16:14 +02:00
if (sta->wps_ie && wps_validate_assoc_req(sta->wps_ie) < 0) {
wpa_printf(MSG_DEBUG, "WPS: Invalid WPS IE in "
"(Re)Association Request - reject");
return WLAN_STATUS_INVALID_IE;
}
WPS: Fix association when both WPS and WPA/RSN IE are included The WPS IE was overriding the WPA/RSN IE in driver based MLME case (hostapd_notif_assoc), but the MLME code here was not using WPS IE correctly, i.e., it allowed the WPA/RSN IE override the operation.
2010-04-15 11:55:34 +02:00
} else if (hapd->conf->wps_state && wpa_ie == NULL) {
wpa_printf(MSG_DEBUG, "STA did not include WPA/RSN IE in "
"(Re)Association Request - possible WPS use");
sta->flags |= WLAN_STA_MAYBE_WPS;
Added preliminary Wi-Fi Protected Setup (WPS) implementation This adds WPS support for both hostapd and wpa_supplicant. Both programs can be configured to act as WPS Enrollee and Registrar. Both PBC and PIN methods are supported. Currently, hostapd has more complete configuration option for WPS parameters and wpa_supplicant configuration style will likely change in the future. External Registrars are not yet supported in hostapd or wpa_supplicant. While wpa_supplicant has initial support for acting as an Registrar to configure an AP, this is still using number of hardcoded parameters which will need to be made configurable for proper operation.
2008-11-23 18:34:26 +01:00
} else
#endif /* CONFIG_WPS */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (hapd->conf->wpa && wpa_ie == NULL) {
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO,
"No WPA/RSN IE in association request");
return WLAN_STATUS_INVALID_IE;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
if (hapd->conf->wpa && wpa_ie) {
Return an enum from wpa_validate_wpa_ie() This is more specific then returning a generic int and also allows the compiler to do more checks. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 11:22:28 +01:00
enum wpa_validate_result res;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
wpa_ie -= 2;
wpa_ie_len += 2;
if (sta->wpa_sm == NULL)
sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
P2P: Make peer's P2P Device Address available to authenticator This can be used to implement per-device PSK selection based on the peer's P2P Device Address instead of P2P Interface Address. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-09-01 10:05:19 +02:00
sta->addr,
p2p_dev_addr);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (sta->wpa_sm == NULL) {
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
wpa_printf(MSG_WARNING, "Failed to initialize WPA "
"state machine");
return WLAN_STATUS_UNSPECIFIED_FAILURE;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
FILS+FT: AP mode processing of PMKR1Name in initial MD association Derive PMKR1Name during the FILS authentication step, verify that the station uses matching PMKR1Name in (Re)Association Request frame, and add RSNE[PMKR1Name] into (Re)Association Response frame when going through FT initial mobility domain association using FILS. These steps were missed from the initial implementation, but are needed to match the IEEE 802.11ai requirements for explicit confirmation of the FT key hierarchy (similarly to what is done in FT 4-way handshake when FILS is not used). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-13 16:24:29 +01:00
wpa_auth_set_auth_alg(sta->wpa_sm, sta->auth_alg);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
Fix cipher suite selector default value in RSNE for DMG According to IEEE Std 802.11-2016, 9.4.2.25 when fields of an RSNE are not included, the default values are used. The cipher suite defaults were hardcoded to CCMP in the previous implementation, but the default is actually different for DMG: GCMP (per 9.4.2.25.2). It is not possible to find out from the RSNE if the network is non-DMG or DMG, so callers of wpa_parse_wpa_ie_rsn() need to handle this case based on context, which can be different for each caller. In order to fix this issue, add flags to the wpa_ie_data indicating whether pairwise/group ciphers were included in the RSNE. Callers can check these flags and fill in the appropriate ciphers. The wpa_parse_wpa_ie_rsn() function still initializes the ciphers to CCMP by default so existing callers will not break. This change also fixes some callers which need to handle the DMG network case. Signed-off-by: Lior David <liord@codeaurora.org>
2019-02-06 11:33:35 +01:00
hapd->iface->freq,
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
wpa_ie, wpa_ie_len,
Store a copy of Association Request RSNXE in AP mode for later use This is needed to be able to compare the received RSNXE to a protected version in EAPOL-Key msg 2/4. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-17 23:11:24 +02:00
elems.rsnxe ? elems.rsnxe - 2 : NULL,
elems.rsnxe ? elems.rsnxe_len + 2 : 0,
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
elems.mdie, elems.mdie_len,
elems.owe_dh, elems.owe_dh_len);
FILS: Add a helper function for status code conversion This will allow the existing code to be reused for FILS needs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 23:04:21 +02:00
resp = wpa_res_to_status_code(res);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (resp != WLAN_STATUS_SUCCESS)
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
return resp;
IEEE 802.11w: Added association ping This updates management frame protection to use the assocition ping process from the latest draft (D6.0) to protect against unauthenticated authenticate or (re)associate frames dropping association.
2008-08-31 10:04:47 +02:00
WPS: Enable SA Query checks for WPS AP Initiate SA Query for a WPS+MFP AP. STA flag checks for MFP added for Association Request frames that use WPS IE without RSNE. This is needed to avoid giving an opportunity to skip the protection against disconnections when WPS is enabled. Signed-off-by: Disha Das <dishad@codeaurora.org>
2020-10-06 14:07:01 +02:00
if (check_sa_query(hapd, sta, reassoc))
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
return WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY;
IEEE 802.11w: Added association ping This updates management frame protection to use the assocition ping process from the latest draft (D6.0) to protect against unauthenticated authenticate or (re)associate frames dropping association.
2008-08-31 10:04:47 +02:00
Added WLAN_STA_MFP flag for driver wrappers so that they can configure the driver to enable MFP (IEEE 802.11w) processing for the STA.
2008-06-17 10:21:11 +02:00
if (wpa_auth_uses_mfp(sta->wpa_sm))
sta->flags |= WLAN_STA_MFP;
else
sta->flags &= ~WLAN_STA_MFP;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#ifdef CONFIG_IEEE80211R_AP
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (sta->auth_alg == WLAN_AUTH_FT) {
if (!reassoc) {
wpa_printf(MSG_DEBUG, "FT: " MACSTR " tried "
"to use association (not "
"re-association) with FT auth_alg",
MAC2STR(sta->addr));
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
return WLAN_STATUS_UNSPECIFIED_FAILURE;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
resp = wpa_ft_validate_reassoc(sta->wpa_sm, ies,
ies_len);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (resp != WLAN_STATUS_SUCCESS)
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
return resp;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#endif /* CONFIG_IEEE80211R_AP */
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
SAE: Fix PMKID in EAPOL-Key msg 1/4 Previously, the association that used SAE authentication ended up recalculating the PMKID for EAPOL-Key msg 1/4 using incorrect PMK-to-PMKID derivation instead of using the previously derived PMKID from SAE. The correct PMKID was used only when going through PMKSA caching exchange with a previously derived PMKSA from SAE. Fix this by storing the SAE PMKID into the state machine entry for the initial SAE authentication case when there is no explicit PMKSA entry attached to the station. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-03-23 16:45:44 +01:00
if (wpa_auth_uses_sae(sta->wpa_sm) && sta->sae &&
sta->sae->state == SAE_ACCEPTED)
wpa_auth_add_sae_pmkid(sta->wpa_sm, sta->sae->pmkid);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
if (wpa_auth_uses_sae(sta->wpa_sm) &&
SAE: Add support for PMKSA caching on the AP side This makes hostapd create PMKSA cache entries from SAE authentication and allow PMKSA caching to be used with the SAE AKM. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-10-18 12:00:29 +02:00
sta->auth_alg == WLAN_AUTH_OPEN) {
struct rsn_pmksa_cache_entry *sa;
sa = wpa_auth_sta_get_pmksa(sta->wpa_sm);
if (!sa || sa->akmp != WPA_KEY_MGMT_SAE) {
wpa_printf(MSG_DEBUG,
"SAE: No PMKSA cache entry found for "
MACSTR, MAC2STR(sta->addr));
return WLAN_STATUS_INVALID_PMKID;
}
wpa_printf(MSG_DEBUG, "SAE: " MACSTR
" using PMKSA caching", MAC2STR(sta->addr));
} else if (wpa_auth_uses_sae(sta->wpa_sm) &&
sta->auth_alg != WLAN_AUTH_SAE &&
!(sta->auth_alg == WLAN_AUTH_FT &&
wpa_auth_uses_ft_sae(sta->wpa_sm))) {
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
wpa_printf(MSG_DEBUG, "SAE: " MACSTR " tried to use "
"SAE AKM after non-SAE auth_alg %u",
MAC2STR(sta->addr), sta->auth_alg);
return WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
}
SAE: Verify that STA negotiated H2E if it claims to support it If a STA indicates support for SAE H2E in RSNXE and H2E is enabled in the AP configuration, require H2E to be used. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-18 11:38:11 +02:00
if (hapd->conf->sae_pwe == 2 &&
sta->auth_alg == WLAN_AUTH_SAE &&
SAE: Move H2E and PK flags to main sae_data This maintains knowledge of whether H2E or PK was used as part of the SAE authentication beyond the removal of temporary state needed during that authentication. This makes it easier to use information about which kind of SAE authentication was used at higher layer functionality. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 11:08:37 +02:00
sta->sae && !sta->sae->h2e &&
SAE: Verify that STA negotiated H2E if it claims to support it If a STA indicates support for SAE H2E in RSNXE and H2E is enabled in the AP configuration, require H2E to be used. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-18 11:38:11 +02:00
elems.rsnxe && elems.rsnxe_len >= 1 &&
(elems.rsnxe[0] & BIT(WLAN_RSNX_CAPAB_SAE_H2E))) {
wpa_printf(MSG_INFO, "SAE: " MACSTR
" indicates support for SAE H2E, but did not use it",
MAC2STR(sta->addr));
return WLAN_STATUS_UNSPECIFIED_FAILURE;
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#endif /* CONFIG_SAE */
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
#ifdef CONFIG_OWE
if ((hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE) &&
wpa_auth_sta_key_mgmt(sta->wpa_sm) == WPA_KEY_MGMT_OWE &&
elems.owe_dh) {
OWE: PMKSA caching in AP mode This extends OWE support in hostapd to allow PMKSA caching to be used. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-09 11:08:12 +02:00
resp = owe_process_assoc_req(hapd, sta, elems.owe_dh,
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
elems.owe_dh_len);
if (resp != WLAN_STATUS_SUCCESS)
return resp;
}
#endif /* CONFIG_OWE */
DPP2: PFS for PTK derivation Use Diffie-Hellman key exchange to derivate additional material for PMK-to-PTK derivation to get PFS. The Diffie-Hellman Parameter element (defined in OWE RFC 8110) is used in association frames to exchange the DH public keys. For backwards compatibility, ignore missing request/response DH parameter and fall back to no PFS in such cases. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-17 22:51:53 +01:00
#ifdef CONFIG_DPP2
dpp_pfs_free(sta->dpp_pfs);
sta->dpp_pfs = NULL;
DPP: Allow version number to be overridden for testing purposes "SET dpp_version_override <ver>" can now be used to request wpa_supplicant and hostapd to support a subset of DPP versions. In practice, the only valid case for now is to fall back from DPP version 2 support to version 1 in builds that include CONFIG_DPP2=y. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-01 20:07:42 +02:00
if (DPP_VERSION > 1 &&
(hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_DPP) &&
DPP2: PFS for PTK derivation Use Diffie-Hellman key exchange to derivate additional material for PMK-to-PTK derivation to get PFS. The Diffie-Hellman Parameter element (defined in OWE RFC 8110) is used in association frames to exchange the DH public keys. For backwards compatibility, ignore missing request/response DH parameter and fall back to no PFS in such cases. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-17 22:51:53 +01:00
hapd->conf->dpp_netaccesskey && sta->wpa_sm &&
wpa_auth_sta_key_mgmt(sta->wpa_sm) == WPA_KEY_MGMT_DPP &&
elems.owe_dh) {
sta->dpp_pfs = dpp_pfs_init(
wpabuf_head(hapd->conf->dpp_netaccesskey),
wpabuf_len(hapd->conf->dpp_netaccesskey));
if (!sta->dpp_pfs) {
wpa_printf(MSG_DEBUG,
"DPP: Could not initialize PFS");
/* Try to continue without PFS */
goto pfs_fail;
}
if (dpp_pfs_process(sta->dpp_pfs, elems.owe_dh,
elems.owe_dh_len) < 0) {
dpp_pfs_free(sta->dpp_pfs);
sta->dpp_pfs = NULL;
return WLAN_STATUS_UNSPECIFIED_FAILURE;
}
}
wpa_auth_set_dpp_z(sta->wpa_sm, sta->dpp_pfs ?
sta->dpp_pfs->secret : NULL);
pfs_fail:
#endif /* CONFIG_DPP2 */
AP: Fix erroneous "station tried TKIP" error The commit b5fd8b18335f2a7784a1f0a5eb5dbe45976d9e21 "VHT: Do not allow use of TKIP with VHT" introduced an off-by-one regression: a WPA/RSN 11n AP would no longer accept stations to connect, instead it would produce a bogus error message: ... Station tried to use TKIP with HT association. Signed-hostapd: Christian Lamparter <chunkeey@googlemail.com>
2012-08-11 09:53:03 +02:00
if ((sta->flags & (WLAN_STA_HT | WLAN_STA_VHT)) &&
Reject association if HT STA tries to use TKIP as pairwise cipher
2008-12-22 13:05:53 +01:00
wpa_auth_get_pairwise(sta->wpa_sm) == WPA_CIPHER_TKIP) {
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
hostapd_logger(hapd, sta->addr,
HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO,
"Station tried to use TKIP with HT "
"association");
return WLAN_STATUS_CIPHER_REJECTED_PER_POLICY;
Reject association if HT STA tries to use TKIP as pairwise cipher
2008-12-22 13:05:53 +01:00
}
HS 2.0R2 AP: Add OSEN implementation Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2013-07-23 20:25:21 +02:00
#ifdef CONFIG_HS20
} else if (hapd->conf->osen) {
if (elems.osen == NULL) {
hostapd_logger(
hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO,
"No HS 2.0 OSEN element in association request");
return WLAN_STATUS_INVALID_IE;
}
wpa_printf(MSG_DEBUG, "HS 2.0: OSEN association");
if (sta->wpa_sm == NULL)
sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
sta->addr, NULL);
if (sta->wpa_sm == NULL) {
wpa_printf(MSG_WARNING, "Failed to initialize WPA "
"state machine");
return WLAN_STATUS_UNSPECIFIED_FAILURE;
}
if (wpa_validate_osen(hapd->wpa_auth, sta->wpa_sm,
elems.osen - 2, elems.osen_len + 2) < 0)
return WLAN_STATUS_INVALID_IE;
#endif /* CONFIG_HS20 */
Clear various flags on re-association to allow key_mgmt changes If a STA reassociates and changes key_mgmt (e.g., from WPA-PSK to WPS), hostapd needs to reset some of the existing STA and WPA state machine variables to allow correct processing for the new association.
2008-11-30 16:22:51 +01:00
} else
wpa_auth_sta_no_wpa(sta->wpa_sm);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
P2P: Save a copy of P2P IE(s) data from (Re)Association Request
2010-07-18 23:30:25 +02:00
#ifdef CONFIG_P2P
P2P: Track non-P2P members in the group and set Group Limit bit The P2P group component is now tracking of associated stations in the group and the Group Limit bit in the Group Capabilities is updated based on whether there is room for new clients in the group.
2010-10-19 17:10:28 +02:00
p2p_group_notif_assoc(hapd->p2p_group, sta->addr, ies, ies_len);
P2P: Save a copy of P2P IE(s) data from (Re)Association Request
2010-07-18 23:30:25 +02:00
#endif /* CONFIG_P2P */
HS 2.0: Maintain a copy of HS 2.0 Indication from Association Request This allows the AP to figure out whether a station is a HS 2.0 STA during the association and access any information that the STA may have included in this element. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-11-21 23:19:17 +01:00
#ifdef CONFIG_HS20
wpabuf_free(sta->hs20_ie);
if (elems.hs20 && elems.hs20_len > 4) {
HS 2.0: Reject Hotspot 2.0 Rel 2 or newer association without PMF Hotspot 2.0 Rel 2 requires PMF to be enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-12-08 11:20:33 +01:00
int release;
HS 2.0: Maintain a copy of HS 2.0 Indication from Association Request This allows the AP to figure out whether a station is a HS 2.0 STA during the association and access any information that the STA may have included in this element. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-11-21 23:19:17 +01:00
sta->hs20_ie = wpabuf_alloc_copy(elems.hs20 + 4,
elems.hs20_len - 4);
HS 2.0: Reject Hotspot 2.0 Rel 2 or newer association without PMF Hotspot 2.0 Rel 2 requires PMF to be enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-12-08 11:20:33 +01:00
release = ((elems.hs20[4] >> 4) & 0x0f) + 1;
HS 2.0 AP: Do not mandate PMF for HS 2.0 Indication in open OSU network Even though the station is not supposed to include Hotspot 2.0 Indication element in the Association Request frame when connecting to the open OSU BSS, some station devices seem to do so. With the strict PMF-required-with-Hotspot-2.0-R2 interpretation, such connection attempts were rejected. Relax this to only perform the PMF check if the local AP configuration has PMF enabled, i.e., for the production BSS. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-30 14:22:42 +02:00
if (release >= 2 && !wpa_auth_uses_mfp(sta->wpa_sm) &&
hapd->conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) {
HS 2.0: Reject Hotspot 2.0 Rel 2 or newer association without PMF Hotspot 2.0 Rel 2 requires PMF to be enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-12-08 11:20:33 +01:00
wpa_printf(MSG_DEBUG,
"HS 2.0: PMF not negotiated by release %d station "
MACSTR, release, MAC2STR(sta->addr));
return WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
}
} else {
HS 2.0: Maintain a copy of HS 2.0 Indication from Association Request This allows the AP to figure out whether a station is a HS 2.0 STA during the association and access any information that the STA may have included in this element. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-11-21 23:19:17 +01:00
sta->hs20_ie = NULL;
HS 2.0: Reject Hotspot 2.0 Rel 2 or newer association without PMF Hotspot 2.0 Rel 2 requires PMF to be enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-12-08 11:20:33 +01:00
}
HS 2.0: Copy Roaming Consortium OI from (Re)AssocReq to Access-Request This extends hostapd processing of (Re)Association Request frames to store a local copy of the Consortium OI within the Roaming Consortium Selection element, if present, and then add that in HS 2.0 Roaming Consortium attribute into RADIUS Access-Request messages. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-04-17 12:08:31 +02:00
wpabuf_free(sta->roaming_consortium);
if (elems.roaming_cons_sel)
sta->roaming_consortium = wpabuf_alloc_copy(
elems.roaming_cons_sel + 4,
elems.roaming_cons_sel_len - 4);
else
sta->roaming_consortium = NULL;
HS 2.0: Maintain a copy of HS 2.0 Indication from Association Request This allows the AP to figure out whether a station is a HS 2.0 STA during the association and access any information that the STA may have included in this element. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-11-21 23:19:17 +01:00
#endif /* CONFIG_HS20 */
FST: Store MB IEs from (Re)Association Request Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-21 14:30:48 +01:00
#ifdef CONFIG_FST
wpabuf_free(sta->mb_ies);
if (hapd->iface->fst)
sta->mb_ies = mb_ies_by_info(&elems.mb_ies);
else
sta->mb_ies = NULL;
#endif /* CONFIG_FST */
MBO: Mandate use of PMF for WPA2+MBO association (AP) If WPA2 and MBO are enabled, PMF needs to be enabled in hostapd configuration. If PMF is optional in the configuration, an MBO STA is required to negotiate use of PMF. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-02-22 15:39:24 +01:00
#ifdef CONFIG_MBO
MBO: Track STA cellular data capability from association request This makes hostapd parse the MBO attribute in (Re)Association Request frame and track the cellular data capability (mbo_cell_capa=<val> in STA control interface command). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-02-22 12:03:28 +01:00
mbo_ap_check_sta_assoc(hapd, sta, &elems);
MBO: Mandate use of PMF for WPA2+MBO association (AP) If WPA2 and MBO are enabled, PMF needs to be enabled in hostapd configuration. If PMF is optional in the configuration, an MBO STA is required to negotiate use of PMF. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-02-22 15:39:24 +01:00
if (hapd->conf->mbo_enabled && (hapd->conf->wpa & 2) &&
elems.mbo && sta->cell_capa && !(sta->flags & WLAN_STA_MFP) &&
hapd->conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) {
wpa_printf(MSG_INFO,
"MBO: Reject WPA2 association without PMF");
return WLAN_STATUS_UNSPECIFIED_FAILURE;
}
#endif /* CONFIG_MBO */
OCV: Include and verify OCI in the FILS handshake Include and verify the OCI element in FILS (Re)Association Request and Response frames. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:36 +02:00
#if defined(CONFIG_FILS) && defined(CONFIG_OCV)
if (wpa_auth_uses_ocv(sta->wpa_sm) &&
(sta->auth_alg == WLAN_AUTH_FILS_SK ||
sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
sta->auth_alg == WLAN_AUTH_FILS_PK)) {
struct wpa_channel_info ci;
int tx_chanwidth;
int tx_seg1_idx;
OCV: Work around for misbehaving STAs that indicate OCVC=1 without OCI Some legacy stations copy previously reserved RSN capability bits, including OCVC, in (Re)Association Request frames from the AP's RSNE but do not indicate MFP capability and/or do not send OCI in RSN handshakes. This is causing connection failures with such erroneous STAs. To improve interoperability with such legacy STAs allow a workaround OCV mode to be enabled to ignore OCVC=1 from the STA if it does not follow OCV requirements in the first protected exchange. This covers cases where a STA claims to have OCV capability, but it does not negotiate use of management frame protection or does not include OCI in EAPOL Key msg 2/4, FT Reassociation Request frame, or FILS (Re)Association Reqest. The previous behavior with ocv=1 is maintained, i.e., misbehaving STAs are not allowed to connect. When the new workaround mode is enabled with ocv=2, the AP considers STA as OCV capable on below criteria - STA indicates both OCV and MFP capability - STA sends OCI during connection attempt in a protected frame Enabling this workaround mode reduced OCV protection to some extend since it allows misbehavior to go through. As such, this should be enabled only if interoperability with misbehaving STAs is needed. Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-10-07 09:21:58 +02:00
enum oci_verify_result res;
OCV: Include and verify OCI in the FILS handshake Include and verify the OCI element in FILS (Re)Association Request and Response frames. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:36 +02:00
if (hostapd_drv_channel_info(hapd, &ci) != 0) {
wpa_printf(MSG_WARNING,
"Failed to get channel info to validate received OCI in FILS (Re)Association Request frame");
return WLAN_STATUS_UNSPECIFIED_FAILURE;
}
if (get_sta_tx_parameters(sta->wpa_sm,
channel_width_to_int(ci.chanwidth),
ci.seg1_idx, &tx_chanwidth,
&tx_seg1_idx) < 0)
return WLAN_STATUS_UNSPECIFIED_FAILURE;
OCV: Work around for misbehaving STAs that indicate OCVC=1 without OCI Some legacy stations copy previously reserved RSN capability bits, including OCVC, in (Re)Association Request frames from the AP's RSNE but do not indicate MFP capability and/or do not send OCI in RSN handshakes. This is causing connection failures with such erroneous STAs. To improve interoperability with such legacy STAs allow a workaround OCV mode to be enabled to ignore OCVC=1 from the STA if it does not follow OCV requirements in the first protected exchange. This covers cases where a STA claims to have OCV capability, but it does not negotiate use of management frame protection or does not include OCI in EAPOL Key msg 2/4, FT Reassociation Request frame, or FILS (Re)Association Reqest. The previous behavior with ocv=1 is maintained, i.e., misbehaving STAs are not allowed to connect. When the new workaround mode is enabled with ocv=2, the AP considers STA as OCV capable on below criteria - STA indicates both OCV and MFP capability - STA sends OCI during connection attempt in a protected frame Enabling this workaround mode reduced OCV protection to some extend since it allows misbehavior to go through. As such, this should be enabled only if interoperability with misbehaving STAs is needed. Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-10-07 09:21:58 +02:00
res = ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
tx_chanwidth, tx_seg1_idx);
if (wpa_auth_uses_ocv(sta->wpa_sm) == 2 &&
res == OCI_NOT_FOUND) {
/* Work around misbehaving STAs */
wpa_printf(MSG_INFO,
"FILS: Disable OCV with a STA that does not send OCI");
wpa_auth_set_ocv(sta->wpa_sm, 0);
} else if (res != OCI_SUCCESS) {
OCV: Move "OCV failed" prefix to callers Make reporting of OCV validation failure reasons more flexible by removing the fixed prefix from ocv_verify_tx_params() output in ocv_errorstr so that the caller can use whatever prefix or encapsulation that is most appropriate for each case. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-25 17:33:00 +02:00
wpa_printf(MSG_WARNING, "FILS: OCV failed: %s",
ocv_errorstr);
OCV: Report validation errors for (Re)Association Request frames Add the OCV-FAILURE control interface event to notify upper layers of OCV validation issues in FT and FILS (Re)Association Request frames. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-25 19:46:32 +02:00
wpa_msg(hapd->msg_ctx, MSG_INFO, OCV_FAILURE "addr="
MACSTR " frame=fils-reassoc-req error=%s",
MAC2STR(sta->addr), ocv_errorstr);
OCV: Include and verify OCI in the FILS handshake Include and verify the OCI element in FILS (Re)Association Request and Response frames. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:36 +02:00
return WLAN_STATUS_UNSPECIFIED_FAILURE;
}
}
#endif /* CONFIG_FILS && CONFIG_OCV */
AP: Store STA supported operating classes information This makes hostapd track Supported Operating Classes information from the associated STAs. The stored information is available through the STA control interface command (supp_op_classes row) as a hexdump of the Supported Operating Classes element starting from the Length field. This information can be used as input to BSS transition management and channel switching decisions. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-02-24 11:20:31 +01:00
ap_copy_sta_supp_op_classes(sta, elems.supp_op_classes,
elems.supp_op_classes_len);
hostapd: Save RM enabled capability of station Save RM enabled capability element of an associating station if radio measurement is supported in its capability field. Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-04-06 18:42:10 +02:00
if ((sta->capability & WLAN_CAPABILITY_RADIO_MEASUREMENT) &&
elems.rrm_enabled &&
elems.rrm_enabled_len >= sizeof(sta->rrm_enabled_capa))
os_memcpy(sta->rrm_enabled_capa, elems.rrm_enabled,
sizeof(sta->rrm_enabled_capa));
hostapd: Add Min/Max Transmit Power Capability into STA command This provides access to the Minimum/Maximum Transmit Power Capabilitie fileds (the nominal minimum/maximum transmit power with which the STA is capable of transmitting in the current channel; signed integer in units of decibels relative to 1 mW). Signed-off-by: bhagavathi perumal s <bperumal@qti.qualcomm.com>
2017-10-06 17:03:25 +02:00
if (elems.power_capab) {
sta->min_tx_power = elems.power_capab[0];
sta->max_tx_power = elems.power_capab[1];
sta->power_capab = 1;
} else {
sta->power_capab = 0;
}
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
return WLAN_STATUS_SUCCESS;
}
static void send_deauth(struct hostapd_data *hapd, const u8 *addr,
u16 reason_code)
{
int send_len;
struct ieee80211_mgmt reply;
os_memset(&reply, 0, sizeof(reply));
reply.frame_control =
IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_DEAUTH);
os_memcpy(reply.da, addr, ETH_ALEN);
os_memcpy(reply.sa, hapd->own_addr, ETH_ALEN);
os_memcpy(reply.bssid, hapd->own_addr, ETH_ALEN);
send_len = IEEE80211_HDRLEN + sizeof(reply.u.deauth);
reply.u.deauth.reason_code = host_to_le16(reason_code);
Make hostapd_drv_send_mlme() more generic Merge hostapd_drv_send_mlme_csa() functionality into hostapd_drv_send_mlme() to get a single driver ops handler function for hostapd. In addition, add a new no_encrypt parameter in preparation for functionality that is needed to get rid of the separate send_frame() driver op. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-01-03 12:34:37 +01:00
if (hostapd_drv_send_mlme(hapd, &reply, send_len, 0, NULL, 0, 0) < 0)
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
wpa_printf(MSG_INFO, "Failed to send deauth: %s",
strerror(errno));
}
AP: Set STA assoc flag in the driver before sending Assoc Resp frame Previously, stations were added to the driver only after the (Re)Association Response frame was acked. In the time period between the station has acked the (Re)Association Response frame and the time the station was added to the kernel, the station can already start sending Data frames, which will be dropped by the hardware/driver. In addition to the data loss, the driver may ignore NDPs with PM bit set from this STA. Fix this by setting/adding the STA with associated flag set to the driver before the AP sends the (Re)Association Response frame with status success. If the (Re)Association Response frame wasn't acked, remove the station from the driver. Note that setting a station to associated state before the non-AP station acknowledges the (Re)Association Response frame is not compliant with the IEEE 802.11 standard that specifically states that a non-AP station should transition to authenticated/associated state only after it acknowledged the (Re)Association Response frame. However, this is a justifiable simplification to work around the issue described above since 1. The station will be removed in case it does not acknowledge the (Re)Association Response frame. 2. All Data frames would be dropped until the station is set to authorized state and there are no known issues with processing the other Class 3 frames during the short window before the acknowledgement is seen. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2016-02-16 10:54:33 +01:00
static int add_associated_sta(struct hostapd_data *hapd,
FT: Allow STA entry to be removed/re-added with FT-over-the-DS FT-over-the-DS has a special case where the STA entry (and as such, the TK) has not yet been configured to the driver depending on which driver interface is used. For that case, allow add-STA operation to be used (instead of set-STA). This is needed to allow mac80211-based drivers to accept the STA parameter configuration. Since this is after a new FT-over-DS exchange, a new TK has been derived after the last STA entry was added to the driver, so key reinstallation is not a concern for this case. Fixes: 0e3bd7ac684a ("hostapd: Avoid key reinstallation in FT handshake") Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-04 21:58:56 +01:00
struct sta_info *sta, int reassoc)
AP: Set STA assoc flag in the driver before sending Assoc Resp frame Previously, stations were added to the driver only after the (Re)Association Response frame was acked. In the time period between the station has acked the (Re)Association Response frame and the time the station was added to the kernel, the station can already start sending Data frames, which will be dropped by the hardware/driver. In addition to the data loss, the driver may ignore NDPs with PM bit set from this STA. Fix this by setting/adding the STA with associated flag set to the driver before the AP sends the (Re)Association Response frame with status success. If the (Re)Association Response frame wasn't acked, remove the station from the driver. Note that setting a station to associated state before the non-AP station acknowledges the (Re)Association Response frame is not compliant with the IEEE 802.11 standard that specifically states that a non-AP station should transition to authenticated/associated state only after it acknowledged the (Re)Association Response frame. However, this is a justifiable simplification to work around the issue described above since 1. The station will be removed in case it does not acknowledge the (Re)Association Response frame. 2. All Data frames would be dropped until the station is set to authorized state and there are no known issues with processing the other Class 3 frames during the short window before the acknowledgement is seen. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2016-02-16 10:54:33 +01:00
{
struct ieee80211_ht_capabilities ht_cap;
struct ieee80211_vht_capabilities vht_cap;
HE: Add AP mode MLME/SME handling for HE stations Process HE information in (Re)Association Request frames and add HE elements into (Re)Association Response frames when HE is enabled in the BSS. Signed-off-by: Shashidhar Lakkavalli <slakkavalli@datto.com> Signed-off-by: John Crispin <john@phrozen.org>
2019-05-20 09:55:05 +02:00
struct ieee80211_he_capabilities he_cap;
hostapd: Avoid key reinstallation in FT handshake Do not reinstall TK to the driver during Reassociation Response frame processing if the first attempt of setting the TK succeeded. This avoids issues related to clearing the TX/RX PN that could result in reusing same PN values for transmitted frames (e.g., due to CCM nonce reuse and also hitting replay protection on the receiver) and accepting replayed frames on RX side. This issue was introduced by the commit 0e84c25434e6a1f283c7b4e62e483729085b78d2 ('FT: Fix PTK configuration in authenticator') which allowed wpa_ft_install_ptk() to be called multiple times with the same PTK. While the second configuration attempt is needed with some drivers, it must be done only if the first attempt failed. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2017-07-14 15:15:35 +02:00
int set = 1;
AP: Set STA assoc flag in the driver before sending Assoc Resp frame Previously, stations were added to the driver only after the (Re)Association Response frame was acked. In the time period between the station has acked the (Re)Association Response frame and the time the station was added to the kernel, the station can already start sending Data frames, which will be dropped by the hardware/driver. In addition to the data loss, the driver may ignore NDPs with PM bit set from this STA. Fix this by setting/adding the STA with associated flag set to the driver before the AP sends the (Re)Association Response frame with status success. If the (Re)Association Response frame wasn't acked, remove the station from the driver. Note that setting a station to associated state before the non-AP station acknowledges the (Re)Association Response frame is not compliant with the IEEE 802.11 standard that specifically states that a non-AP station should transition to authenticated/associated state only after it acknowledged the (Re)Association Response frame. However, this is a justifiable simplification to work around the issue described above since 1. The station will be removed in case it does not acknowledge the (Re)Association Response frame. 2. All Data frames would be dropped until the station is set to authorized state and there are no known issues with processing the other Class 3 frames during the short window before the acknowledgement is seen. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2016-02-16 10:54:33 +01:00
/*
* Remove the STA entry to ensure the STA PS state gets cleared and
* configuration gets updated. This is relevant for cases, such as
* FT-over-the-DS, where a station re-associates back to the same AP but
* skips the authentication flow, or if working with a driver that
* does not support full AP client state.
hostapd: Avoid key reinstallation in FT handshake Do not reinstall TK to the driver during Reassociation Response frame processing if the first attempt of setting the TK succeeded. This avoids issues related to clearing the TX/RX PN that could result in reusing same PN values for transmitted frames (e.g., due to CCM nonce reuse and also hitting replay protection on the receiver) and accepting replayed frames on RX side. This issue was introduced by the commit 0e84c25434e6a1f283c7b4e62e483729085b78d2 ('FT: Fix PTK configuration in authenticator') which allowed wpa_ft_install_ptk() to be called multiple times with the same PTK. While the second configuration attempt is needed with some drivers, it must be done only if the first attempt failed. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2017-07-14 15:15:35 +02:00
*
* Skip this if the STA has already completed FT reassociation and the
* TK has been configured since the TX/RX PN must not be reset to 0 for
* the same key.
FT: Allow STA entry to be removed/re-added with FT-over-the-DS FT-over-the-DS has a special case where the STA entry (and as such, the TK) has not yet been configured to the driver depending on which driver interface is used. For that case, allow add-STA operation to be used (instead of set-STA). This is needed to allow mac80211-based drivers to accept the STA parameter configuration. Since this is after a new FT-over-DS exchange, a new TK has been derived after the last STA entry was added to the driver, so key reinstallation is not a concern for this case. Fixes: 0e3bd7ac684a ("hostapd: Avoid key reinstallation in FT handshake") Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-04 21:58:56 +01:00
*
* FT-over-the-DS has a special case where the STA entry (and as such,
* the TK) has not yet been configured to the driver depending on which
* driver interface is used. For that case, allow add-STA operation to
* be used (instead of set-STA). This is needed to allow mac80211-based
* drivers to accept the STA parameter configuration. Since this is
* after a new FT-over-DS exchange, a new TK has been derived, so key
* reinstallation is not a concern for this case.
AP: Set STA assoc flag in the driver before sending Assoc Resp frame Previously, stations were added to the driver only after the (Re)Association Response frame was acked. In the time period between the station has acked the (Re)Association Response frame and the time the station was added to the kernel, the station can already start sending Data frames, which will be dropped by the hardware/driver. In addition to the data loss, the driver may ignore NDPs with PM bit set from this STA. Fix this by setting/adding the STA with associated flag set to the driver before the AP sends the (Re)Association Response frame with status success. If the (Re)Association Response frame wasn't acked, remove the station from the driver. Note that setting a station to associated state before the non-AP station acknowledges the (Re)Association Response frame is not compliant with the IEEE 802.11 standard that specifically states that a non-AP station should transition to authenticated/associated state only after it acknowledged the (Re)Association Response frame. However, this is a justifiable simplification to work around the issue described above since 1. The station will be removed in case it does not acknowledge the (Re)Association Response frame. 2. All Data frames would be dropped until the station is set to authorized state and there are no known issues with processing the other Class 3 frames during the short window before the acknowledgement is seen. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2016-02-16 10:54:33 +01:00
*/
FT: Allow STA entry to be removed/re-added with FT-over-the-DS FT-over-the-DS has a special case where the STA entry (and as such, the TK) has not yet been configured to the driver depending on which driver interface is used. For that case, allow add-STA operation to be used (instead of set-STA). This is needed to allow mac80211-based drivers to accept the STA parameter configuration. Since this is after a new FT-over-DS exchange, a new TK has been derived after the last STA entry was added to the driver, so key reinstallation is not a concern for this case. Fixes: 0e3bd7ac684a ("hostapd: Avoid key reinstallation in FT handshake") Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-04 21:58:56 +01:00
wpa_printf(MSG_DEBUG, "Add associated STA " MACSTR
" (added_unassoc=%d auth_alg=%u ft_over_ds=%u reassoc=%d authorized=%d ft_tk=%d fils_tk=%d)",
MAC2STR(sta->addr), sta->added_unassoc, sta->auth_alg,
sta->ft_over_ds, reassoc,
!!(sta->flags & WLAN_STA_AUTHORIZED),
wpa_auth_sta_ft_tk_already_set(sta->wpa_sm),
wpa_auth_sta_fils_tk_already_set(sta->wpa_sm));
hostapd: Avoid key reinstallation in FT handshake Do not reinstall TK to the driver during Reassociation Response frame processing if the first attempt of setting the TK succeeded. This avoids issues related to clearing the TX/RX PN that could result in reusing same PN values for transmitted frames (e.g., due to CCM nonce reuse and also hitting replay protection on the receiver) and accepting replayed frames on RX side. This issue was introduced by the commit 0e84c25434e6a1f283c7b4e62e483729085b78d2 ('FT: Fix PTK configuration in authenticator') which allowed wpa_ft_install_ptk() to be called multiple times with the same PTK. While the second configuration attempt is needed with some drivers, it must be done only if the first attempt failed. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2017-07-14 15:15:35 +02:00
if (!sta->added_unassoc &&
(!(sta->flags & WLAN_STA_AUTHORIZED) ||
FT: Allow STA entry to be removed/re-added with FT-over-the-DS FT-over-the-DS has a special case where the STA entry (and as such, the TK) has not yet been configured to the driver depending on which driver interface is used. For that case, allow add-STA operation to be used (instead of set-STA). This is needed to allow mac80211-based drivers to accept the STA parameter configuration. Since this is after a new FT-over-DS exchange, a new TK has been derived after the last STA entry was added to the driver, so key reinstallation is not a concern for this case. Fixes: 0e3bd7ac684a ("hostapd: Avoid key reinstallation in FT handshake") Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-04 21:58:56 +01:00
(reassoc && sta->ft_over_ds && sta->auth_alg == WLAN_AUTH_FT) ||
FILS: Accept another (Re)Association Request frame during an association The previous implementation ended up starting a new EAPOL-Key 4-way handshake if the STA were to attempt to perform another association. This resulted in immediate disconnection since the PTK was not ready for configuring FILS TK at the point when EAPOL-Key msg 1/4 is sent out. This is better than alloing the association to continue with the same TK reconfigured, but not really ideal. Address this potential sequence by not starting a new 4-way handshake on the additional association attempt. Instead, allow the association to complete, but do so without reconfiguring the TK to avoid potential issues with PN reuse with the same TK. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-08-25 15:24:18 +02:00
(!wpa_auth_sta_ft_tk_already_set(sta->wpa_sm) &&
!wpa_auth_sta_fils_tk_already_set(sta->wpa_sm)))) {
AP: Set STA assoc flag in the driver before sending Assoc Resp frame Previously, stations were added to the driver only after the (Re)Association Response frame was acked. In the time period between the station has acked the (Re)Association Response frame and the time the station was added to the kernel, the station can already start sending Data frames, which will be dropped by the hardware/driver. In addition to the data loss, the driver may ignore NDPs with PM bit set from this STA. Fix this by setting/adding the STA with associated flag set to the driver before the AP sends the (Re)Association Response frame with status success. If the (Re)Association Response frame wasn't acked, remove the station from the driver. Note that setting a station to associated state before the non-AP station acknowledges the (Re)Association Response frame is not compliant with the IEEE 802.11 standard that specifically states that a non-AP station should transition to authenticated/associated state only after it acknowledged the (Re)Association Response frame. However, this is a justifiable simplification to work around the issue described above since 1. The station will be removed in case it does not acknowledge the (Re)Association Response frame. 2. All Data frames would be dropped until the station is set to authorized state and there are no known issues with processing the other Class 3 frames during the short window before the acknowledgement is seen. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2016-02-16 10:54:33 +01:00
hostapd_drv_sta_remove(hapd, sta->addr);
hostapd: Avoid key reinstallation in FT handshake Do not reinstall TK to the driver during Reassociation Response frame processing if the first attempt of setting the TK succeeded. This avoids issues related to clearing the TX/RX PN that could result in reusing same PN values for transmitted frames (e.g., due to CCM nonce reuse and also hitting replay protection on the receiver) and accepting replayed frames on RX side. This issue was introduced by the commit 0e84c25434e6a1f283c7b4e62e483729085b78d2 ('FT: Fix PTK configuration in authenticator') which allowed wpa_ft_install_ptk() to be called multiple times with the same PTK. While the second configuration attempt is needed with some drivers, it must be done only if the first attempt failed. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2017-07-14 15:15:35 +02:00
wpa_auth_sm_event(sta->wpa_sm, WPA_DRV_STA_REMOVED);
set = 0;
FT: Allow STA entry to be removed/re-added with FT-over-the-DS FT-over-the-DS has a special case where the STA entry (and as such, the TK) has not yet been configured to the driver depending on which driver interface is used. For that case, allow add-STA operation to be used (instead of set-STA). This is needed to allow mac80211-based drivers to accept the STA parameter configuration. Since this is after a new FT-over-DS exchange, a new TK has been derived after the last STA entry was added to the driver, so key reinstallation is not a concern for this case. Fixes: 0e3bd7ac684a ("hostapd: Avoid key reinstallation in FT handshake") Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-04 21:58:56 +01:00
/* Do not allow the FT-over-DS exception to be used more than
* once per authentication exchange to guarantee a new TK is
* used here */
sta->ft_over_ds = 0;
hostapd: Avoid key reinstallation in FT handshake Do not reinstall TK to the driver during Reassociation Response frame processing if the first attempt of setting the TK succeeded. This avoids issues related to clearing the TX/RX PN that could result in reusing same PN values for transmitted frames (e.g., due to CCM nonce reuse and also hitting replay protection on the receiver) and accepting replayed frames on RX side. This issue was introduced by the commit 0e84c25434e6a1f283c7b4e62e483729085b78d2 ('FT: Fix PTK configuration in authenticator') which allowed wpa_ft_install_ptk() to be called multiple times with the same PTK. While the second configuration attempt is needed with some drivers, it must be done only if the first attempt failed. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2017-07-14 15:15:35 +02:00
}
AP: Set STA assoc flag in the driver before sending Assoc Resp frame Previously, stations were added to the driver only after the (Re)Association Response frame was acked. In the time period between the station has acked the (Re)Association Response frame and the time the station was added to the kernel, the station can already start sending Data frames, which will be dropped by the hardware/driver. In addition to the data loss, the driver may ignore NDPs with PM bit set from this STA. Fix this by setting/adding the STA with associated flag set to the driver before the AP sends the (Re)Association Response frame with status success. If the (Re)Association Response frame wasn't acked, remove the station from the driver. Note that setting a station to associated state before the non-AP station acknowledges the (Re)Association Response frame is not compliant with the IEEE 802.11 standard that specifically states that a non-AP station should transition to authenticated/associated state only after it acknowledged the (Re)Association Response frame. However, this is a justifiable simplification to work around the issue described above since 1. The station will be removed in case it does not acknowledge the (Re)Association Response frame. 2. All Data frames would be dropped until the station is set to authorized state and there are no known issues with processing the other Class 3 frames during the short window before the acknowledgement is seen. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2016-02-16 10:54:33 +01:00
if (sta->flags & WLAN_STA_HT)
hostapd_get_ht_capab(hapd, sta->ht_capabilities, &ht_cap);
#ifdef CONFIG_IEEE80211AC
if (sta->flags & WLAN_STA_VHT)
hostapd_get_vht_capab(hapd, sta->vht_capabilities, &vht_cap);
#endif /* CONFIG_IEEE80211AC */
HE: Add AP mode MLME/SME handling for HE stations Process HE information in (Re)Association Request frames and add HE elements into (Re)Association Response frames when HE is enabled in the BSS. Signed-off-by: Shashidhar Lakkavalli <slakkavalli@datto.com> Signed-off-by: John Crispin <john@phrozen.org>
2019-05-20 09:55:05 +02:00
#ifdef CONFIG_IEEE80211AX
if (sta->flags & WLAN_STA_HE) {
hostapd_get_he_capab(hapd, sta->he_capab, &he_cap,
sta->he_capab_len);
}
#endif /* CONFIG_IEEE80211AX */
AP: Set STA assoc flag in the driver before sending Assoc Resp frame Previously, stations were added to the driver only after the (Re)Association Response frame was acked. In the time period between the station has acked the (Re)Association Response frame and the time the station was added to the kernel, the station can already start sending Data frames, which will be dropped by the hardware/driver. In addition to the data loss, the driver may ignore NDPs with PM bit set from this STA. Fix this by setting/adding the STA with associated flag set to the driver before the AP sends the (Re)Association Response frame with status success. If the (Re)Association Response frame wasn't acked, remove the station from the driver. Note that setting a station to associated state before the non-AP station acknowledges the (Re)Association Response frame is not compliant with the IEEE 802.11 standard that specifically states that a non-AP station should transition to authenticated/associated state only after it acknowledged the (Re)Association Response frame. However, this is a justifiable simplification to work around the issue described above since 1. The station will be removed in case it does not acknowledge the (Re)Association Response frame. 2. All Data frames would be dropped until the station is set to authorized state and there are no known issues with processing the other Class 3 frames during the short window before the acknowledgement is seen. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2016-02-16 10:54:33 +01:00
/*
* Add the station with forced WLAN_STA_ASSOC flag. The sta->flags
* will be set when the ACK frame for the (Re)Association Response frame
* is processed (TX status driver event).
*/
if (hostapd_sta_add(hapd, sta->addr, sta->aid, sta->capability,
sta->supported_rates, sta->supported_rates_len,
sta->listen_interval,
sta->flags & WLAN_STA_HT ? &ht_cap : NULL,
sta->flags & WLAN_STA_VHT ? &vht_cap : NULL,
HE: Add AP mode MLME/SME handling for HE stations Process HE information in (Re)Association Request frames and add HE elements into (Re)Association Response frames when HE is enabled in the BSS. Signed-off-by: Shashidhar Lakkavalli <slakkavalli@datto.com> Signed-off-by: John Crispin <john@phrozen.org>
2019-05-20 09:55:05 +02:00
sta->flags & WLAN_STA_HE ? &he_cap : NULL,
sta->flags & WLAN_STA_HE ? sta->he_capab_len : 0,
HE: Process HE 6 GHz band capab from associating HE STA Process HE 6 GHz band capabilities in (Re)Association Request frames and pass the information to the driver. Signed-off-by: Rajkumar Manoharan <rmanohar@codeaurora.org>
2020-04-25 00:45:41 +02:00
sta->he_6ghz_capab,
AP: Set STA assoc flag in the driver before sending Assoc Resp frame Previously, stations were added to the driver only after the (Re)Association Response frame was acked. In the time period between the station has acked the (Re)Association Response frame and the time the station was added to the kernel, the station can already start sending Data frames, which will be dropped by the hardware/driver. In addition to the data loss, the driver may ignore NDPs with PM bit set from this STA. Fix this by setting/adding the STA with associated flag set to the driver before the AP sends the (Re)Association Response frame with status success. If the (Re)Association Response frame wasn't acked, remove the station from the driver. Note that setting a station to associated state before the non-AP station acknowledges the (Re)Association Response frame is not compliant with the IEEE 802.11 standard that specifically states that a non-AP station should transition to authenticated/associated state only after it acknowledged the (Re)Association Response frame. However, this is a justifiable simplification to work around the issue described above since 1. The station will be removed in case it does not acknowledge the (Re)Association Response frame. 2. All Data frames would be dropped until the station is set to authorized state and there are no known issues with processing the other Class 3 frames during the short window before the acknowledgement is seen. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2016-02-16 10:54:33 +01:00
sta->flags | WLAN_STA_ASSOC, sta->qosinfo,
AP: Pass station P2P PS capabilities info during station add/set If a legacy client with no P2P PS support is trying to connect to a P2P GO, the driver should know that, and change its PS behavior accordingly. Add a parameter to hostapd_sta_add_params() indicating if P2P PS is supported by the station and pass this parameter to kernel with nl80211 driver when the station is added/set. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-04-07 12:31:01 +02:00
sta->vht_opmode, sta->p2p_ie ? 1 : 0,
hostapd: Avoid key reinstallation in FT handshake Do not reinstall TK to the driver during Reassociation Response frame processing if the first attempt of setting the TK succeeded. This avoids issues related to clearing the TX/RX PN that could result in reusing same PN values for transmitted frames (e.g., due to CCM nonce reuse and also hitting replay protection on the receiver) and accepting replayed frames on RX side. This issue was introduced by the commit 0e84c25434e6a1f283c7b4e62e483729085b78d2 ('FT: Fix PTK configuration in authenticator') which allowed wpa_ft_install_ptk() to be called multiple times with the same PTK. While the second configuration attempt is needed with some drivers, it must be done only if the first attempt failed. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2017-07-14 15:15:35 +02:00
set)) {
AP: Set STA assoc flag in the driver before sending Assoc Resp frame Previously, stations were added to the driver only after the (Re)Association Response frame was acked. In the time period between the station has acked the (Re)Association Response frame and the time the station was added to the kernel, the station can already start sending Data frames, which will be dropped by the hardware/driver. In addition to the data loss, the driver may ignore NDPs with PM bit set from this STA. Fix this by setting/adding the STA with associated flag set to the driver before the AP sends the (Re)Association Response frame with status success. If the (Re)Association Response frame wasn't acked, remove the station from the driver. Note that setting a station to associated state before the non-AP station acknowledges the (Re)Association Response frame is not compliant with the IEEE 802.11 standard that specifically states that a non-AP station should transition to authenticated/associated state only after it acknowledged the (Re)Association Response frame. However, this is a justifiable simplification to work around the issue described above since 1. The station will be removed in case it does not acknowledge the (Re)Association Response frame. 2. All Data frames would be dropped until the station is set to authorized state and there are no known issues with processing the other Class 3 frames during the short window before the acknowledgement is seen. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2016-02-16 10:54:33 +01:00
hostapd_logger(hapd, sta->addr,
HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_NOTICE,
"Could not %s STA to kernel driver",
hostapd: Avoid key reinstallation in FT handshake Do not reinstall TK to the driver during Reassociation Response frame processing if the first attempt of setting the TK succeeded. This avoids issues related to clearing the TX/RX PN that could result in reusing same PN values for transmitted frames (e.g., due to CCM nonce reuse and also hitting replay protection on the receiver) and accepting replayed frames on RX side. This issue was introduced by the commit 0e84c25434e6a1f283c7b4e62e483729085b78d2 ('FT: Fix PTK configuration in authenticator') which allowed wpa_ft_install_ptk() to be called multiple times with the same PTK. While the second configuration attempt is needed with some drivers, it must be done only if the first attempt failed. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2017-07-14 15:15:35 +02:00
set ? "set" : "add");
AP: Set STA assoc flag in the driver before sending Assoc Resp frame Previously, stations were added to the driver only after the (Re)Association Response frame was acked. In the time period between the station has acked the (Re)Association Response frame and the time the station was added to the kernel, the station can already start sending Data frames, which will be dropped by the hardware/driver. In addition to the data loss, the driver may ignore NDPs with PM bit set from this STA. Fix this by setting/adding the STA with associated flag set to the driver before the AP sends the (Re)Association Response frame with status success. If the (Re)Association Response frame wasn't acked, remove the station from the driver. Note that setting a station to associated state before the non-AP station acknowledges the (Re)Association Response frame is not compliant with the IEEE 802.11 standard that specifically states that a non-AP station should transition to authenticated/associated state only after it acknowledged the (Re)Association Response frame. However, this is a justifiable simplification to work around the issue described above since 1. The station will be removed in case it does not acknowledge the (Re)Association Response frame. 2. All Data frames would be dropped until the station is set to authorized state and there are no known issues with processing the other Class 3 frames during the short window before the acknowledgement is seen. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2016-02-16 10:54:33 +01:00
if (sta->added_unassoc) {
hostapd_drv_sta_remove(hapd, sta->addr);
sta->added_unassoc = 0;
}
return -1;
}
sta->added_unassoc = 0;
return 0;
}
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
static u16 send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
AP: Skip authentication/deauthentication phase for DMG/IEEE 802.11ad Authentication and Deauthentication frames are not used in DMG/IEEE 802.11ad networks. For DMG/IEEE 802.11ad the following was implemented: Upon receiving association request, allocate the sta object and initialize it as if authentication took place. Upon receiving disassociation, deallocate the sta object. ap_sta_disassociate/ap_sta_deauthenticate/ap_sta_disconnect all use disassociation instead of deauthentication. In driver_nl80211, i802_sta_deauth() is routed to i802_sta_disassoc(). Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-12-26 20:00:51 +01:00
const u8 *addr, u16 status_code, int reassoc,
FT: Omit RSNXE from FT protocol Reassociation Response when needed The previous design for adding RSNXE into FT was not backwards compatible. Move to a new design based on 20/332r3 to avoid that issue by not include RSNXE in the FT protocol Reassociation Response frame so that a STA not supporting RSNXE can still validate the FTE MIC correctly. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-20 20:56:44 +01:00
const u8 *ies, size_t ies_len, int rssi,
int omit_rsnxe)
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
{
int send_len;
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
u8 *buf;
size_t buflen;
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
struct ieee80211_mgmt *reply;
u8 *p;
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
u16 res = WLAN_STATUS_SUCCESS;
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
buflen = sizeof(struct ieee80211_mgmt) + 1024;
#ifdef CONFIG_FILS
FILS: Fix send_assoc_resp() HLP extension to cover sta == NULL Commit 91d91abf6f9bf420643a9245b63f5ac8c6bbb18a ('FILS: DHCP relay for HLP requests') added steps that are conditional on sta->fils_hlp_resp being non-NULL. One of these cases within send_assoc_resp() was properly protected from sta == NULL error case (that is now possible after a recent DMG change), but the first one was not. A DMG error case in a CONFIG_FILS=y build could have hit a NULL pointer dereference here. Fix this by verifying sta != NULL more consistently. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-02-05 15:40:15 +01:00
if (sta && sta->fils_hlp_resp)
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
buflen += wpabuf_len(sta->fils_hlp_resp);
FILS: Add RSNE into (Re)Association Response frame This AP behavior was missing from IEEE Std 802.11ai-2016, but it is needed for the RSNE validation to work correctly and for a FILS STA to be able to perform the mandatory check for RSNE matching when processing the (Re)Association Response frame (as described in 802.11ai). REVmd will be updating the standard to cover this AP case, so prepare the implementation to match that. Without this, a FILS STA might reject association whenever using FILS authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-05-22 16:26:55 +02:00
if (sta)
buflen += 150;
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
#endif /* CONFIG_FILS */
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
#ifdef CONFIG_OWE
if (sta && (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE))
OWE: Include RSNE in (Re)Association Response frame This is not normally done in RSN, but RFC 8110 seems to imply that AP has to include OWE AKM in the RSNE within these frames. So, add the RSNE to (Re)Association Response frames when OWE is being negotiated. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 12:49:45 +02:00
buflen += 150;
OWE: Process Diffie-Hellman Parameter element in AP mode This adds AP side processing for OWE Diffie-Hellman Parameter element in (Re)Association Request frame and adding it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 00:26:43 +01:00
#endif /* CONFIG_OWE */
DPP2: PFS for PTK derivation Use Diffie-Hellman key exchange to derivate additional material for PMK-to-PTK derivation to get PFS. The Diffie-Hellman Parameter element (defined in OWE RFC 8110) is used in association frames to exchange the DH public keys. For backwards compatibility, ignore missing request/response DH parameter and fall back to no PFS in such cases. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-17 22:51:53 +01:00
#ifdef CONFIG_DPP2
if (sta && sta->dpp_pfs)
buflen += 5 + sta->dpp_pfs->curve->prime_len;
#endif /* CONFIG_DPP2 */
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
buf = os_zalloc(buflen);
if (!buf) {
res = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto done;
}
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
reply = (struct ieee80211_mgmt *) buf;
reply->frame_control =
IEEE80211_FC(WLAN_FC_TYPE_MGMT,
(reassoc ? WLAN_FC_STYPE_REASSOC_RESP :
WLAN_FC_STYPE_ASSOC_RESP));
AP: Skip authentication/deauthentication phase for DMG/IEEE 802.11ad Authentication and Deauthentication frames are not used in DMG/IEEE 802.11ad networks. For DMG/IEEE 802.11ad the following was implemented: Upon receiving association request, allocate the sta object and initialize it as if authentication took place. Upon receiving disassociation, deallocate the sta object. ap_sta_disassociate/ap_sta_deauthenticate/ap_sta_disconnect all use disassociation instead of deauthentication. In driver_nl80211, i802_sta_deauth() is routed to i802_sta_disassoc(). Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-12-26 20:00:51 +01:00
os_memcpy(reply->da, addr, ETH_ALEN);
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
os_memcpy(reply->bssid, hapd->own_addr, ETH_ALEN);
send_len = IEEE80211_HDRLEN;
send_len += sizeof(reply->u.assoc_resp);
reply->u.assoc_resp.capab_info =
Remove unused leftover from multi-SSID design The multi-SSID design that used a single beaconing BSSID with multiple SSIDs was never completed in this repository, so there is no need to maintain the per-STA ssid/ssid_probe pointers that could only point to &hapd->conf->ssid. Save some memory and reduce code complexity by removing this unused partial capability. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-04-20 23:33:25 +02:00
host_to_le16(hostapd_own_capab_info(hapd));
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
reply->u.assoc_resp.status_code = host_to_le16(status_code);
AP: Skip authentication/deauthentication phase for DMG/IEEE 802.11ad Authentication and Deauthentication frames are not used in DMG/IEEE 802.11ad networks. For DMG/IEEE 802.11ad the following was implemented: Upon receiving association request, allocate the sta object and initialize it as if authentication took place. Upon receiving disassociation, deallocate the sta object. ap_sta_disassociate/ap_sta_deauthenticate/ap_sta_disconnect all use disassociation instead of deauthentication. In driver_nl80211, i802_sta_deauth() is routed to i802_sta_disassoc(). Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-12-26 20:00:51 +01:00
reply->u.assoc_resp.aid = host_to_le16((sta ? sta->aid : 0) |
BIT(14) | BIT(15));
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
/* Supported rates */
p = hostapd_eid_supp_rates(hapd, reply->u.assoc_resp.variable);
/* Extended supported rates */
p = hostapd_eid_ext_supp_rates(hapd, p);
Send RM Enabled Capabilities element in (Re)Association Response frame (Re)Association Response frames should include radio measurement capabilities in order to let stations know if they can, e.g., use neighbor requests. I tested this commit with a Samsung S8, which does not send neighbor requests without this commit and sends them afterwards. Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
2020-01-24 17:24:53 +01:00
/* Radio measurement capabilities */
p = hostapd_eid_rm_enabled_capab(hapd, p, buf + buflen - p);
OCE: Add RSSI based association rejection support (AP) An AP might reject a STA association request due to low RSSI. In such case, the AP informs the STA the desired RSSI improvement and a retry timeout. The STA might retry to associate even if the RSSI hasn't improved if the retry timeout expired. Signed-off-by: Beni Lev <beni.lev@intel.com>
2017-08-21 18:43:53 +02:00
#ifdef CONFIG_MBO
if (status_code == WLAN_STATUS_DENIED_POOR_CHANNEL_CONDITIONS &&
rssi != 0) {
int delta = hapd->iconf->rssi_reject_assoc_rssi - rssi;
p = hostapd_eid_mbo_rssi_assoc_rej(hapd, p, buf + buflen - p,
delta);
}
#endif /* CONFIG_MBO */
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#ifdef CONFIG_IEEE80211R_AP
AP: Skip authentication/deauthentication phase for DMG/IEEE 802.11ad Authentication and Deauthentication frames are not used in DMG/IEEE 802.11ad networks. For DMG/IEEE 802.11ad the following was implemented: Upon receiving association request, allocate the sta object and initialize it as if authentication took place. Upon receiving disassociation, deallocate the sta object. ap_sta_disassociate/ap_sta_deauthenticate/ap_sta_disconnect all use disassociation instead of deauthentication. In driver_nl80211, i802_sta_deauth() is routed to i802_sta_disassoc(). Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-12-26 20:00:51 +01:00
if (sta && status_code == WLAN_STATUS_SUCCESS) {
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
/* IEEE 802.11r: Mobility Domain Information, Fast BSS
* Transition Information, RSN, [RIC Response] */
p = wpa_sm_write_assoc_resp_ies(sta->wpa_sm, p,
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
buf + buflen - p,
FT: Omit RSNXE from FT protocol Reassociation Response when needed The previous design for adding RSNXE into FT was not backwards compatible. Move to a new design based on 20/332r3 to avoid that issue by not include RSNXE in the FT protocol Reassociation Response frame so that a STA not supporting RSNXE can still validate the FTE MIC correctly. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-20 20:56:44 +01:00
sta->auth_alg, ies, ies_len,
omit_rsnxe);
FT: Handle AssocResp generation failures as fatal errors Instead of sending out a partially completed frame, abort the association process if something unexpected happens and remove the STA entry. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-06-05 20:09:43 +02:00
if (!p) {
wpa_printf(MSG_DEBUG,
"FT: Failed to write AssocResp IEs");
res = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto done;
}
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
}
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#endif /* CONFIG_IEEE80211R_AP */
FILS: Add RSNE into (Re)Association Response frame This AP behavior was missing from IEEE Std 802.11ai-2016, but it is needed for the RSNE validation to work correctly and for a FILS STA to be able to perform the mandatory check for RSNE matching when processing the (Re)Association Response frame (as described in 802.11ai). REVmd will be updating the standard to cover this AP case, so prepare the implementation to match that. Without this, a FILS STA might reject association whenever using FILS authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-05-22 16:26:55 +02:00
#ifdef CONFIG_FILS
if (sta && status_code == WLAN_STATUS_SUCCESS &&
(sta->auth_alg == WLAN_AUTH_FILS_SK ||
sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
sta->auth_alg == WLAN_AUTH_FILS_PK))
p = wpa_auth_write_assoc_resp_fils(sta->wpa_sm, p,
buf + buflen - p,
ies, ies_len);
#endif /* CONFIG_FILS */
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
OWE: Include RSNE in (Re)Association Response frame This is not normally done in RSN, but RFC 8110 seems to imply that AP has to include OWE AKM in the RSNE within these frames. So, add the RSNE to (Re)Association Response frames when OWE is being negotiated. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 12:49:45 +02:00
#ifdef CONFIG_OWE
OWE: Fix association rejection behavior If association failed for any non-OWE specific reason, the previous implementation tried to add the OWE related IEs into the (Re)Association Response frame. This is not needed and could actually result in dereferencing a NULL pointer. Fix this by adding those OWE related IEs only for successful association and only if the RSN state machine has been initialized. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-02 19:21:21 +01:00
if (sta && status_code == WLAN_STATUS_SUCCESS &&
(hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE))
OWE: Include RSNE in (Re)Association Response frame This is not normally done in RSN, but RFC 8110 seems to imply that AP has to include OWE AKM in the RSNE within these frames. So, add the RSNE to (Re)Association Response frames when OWE is being negotiated. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 12:49:45 +02:00
p = wpa_auth_write_assoc_resp_owe(sta->wpa_sm, p,
buf + buflen - p,
ies, ies_len);
#endif /* CONFIG_OWE */
AP: Skip authentication/deauthentication phase for DMG/IEEE 802.11ad Authentication and Deauthentication frames are not used in DMG/IEEE 802.11ad networks. For DMG/IEEE 802.11ad the following was implemented: Upon receiving association request, allocate the sta object and initialize it as if authentication took place. Upon receiving disassociation, deallocate the sta object. ap_sta_disassociate/ap_sta_deauthenticate/ap_sta_disconnect all use disassociation instead of deauthentication. In driver_nl80211, i802_sta_deauth() is routed to i802_sta_disassoc(). Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-12-26 20:00:51 +01:00
if (sta && status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY)
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
p = hostapd_eid_assoc_comeback_time(hapd, sta, p);
hostapd: Reorder some IEs to get closer to IEEE 802.11 standard Vendor-specific IEs are supposed to be in the end of the frame, so move WMM into the end of Beacon, Probe Response, and (Re)Association Response frames. In addition, move HT IEs to be later in (Re)Association Response to match the correct order. hostapd_eid_wpa() adds multiple IEs and the end result may not always be correct. If WPA is enabled, WPA IE (vendor-specific) gets added in the middle of the frame and not in the end. This would require a larger change to spliut the IEs from WPA module into separate locations when constructing Beacon and Probe Response frames. This is not yet addressed.
2010-05-02 09:53:01 +02:00
p = hostapd_eid_ht_capabilities(hapd, p);
p = hostapd_eid_ht_operation(hapd, p);
VHT: Add VHT elements into (Re)Association Response Signed-hostap: Mahesh Palivela <maheshp@posedge.com>
2012-08-10 18:51:17 +02:00
#ifdef CONFIG_IEEE80211AC
AP: Publish only HE capabilities and operation IEs on 6 GHz band When operating on the 6 GHz band, add 6 GHz Operation Information inside the HE Operation element and don't publish HT/VHT IEs. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com> - Replace HOSTAPD_MODE_IEEE80211AX mode checks with is_6ghz_op_class() Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org>
2019-06-19 14:49:13 +02:00
if (hapd->iconf->ieee80211ac && !hapd->conf->disable_11ac &&
!is_6ghz_op_class(hapd->iconf->op_class)) {
hostapd: Use stations nsts capability in (Re)Association Response frame Some deployed stations incorrectly consider nsts capability in (Re)Association Response frame as required capability instead of maximum capability and if it is greater than station's capability then beamform will not happen in uplink traffic. This commit adds support for an optional workaround to use station's nsts capability in (Re)Association Response frame if the station's nsts is less than AP by using the use_sta_nsts=1 configuration parameter. This configuration is introduced in this commit and it is disabled by default. Signed-off-by: Tamizh chelvam <c_traja@qti.qualcomm.com>
2016-08-31 16:15:47 +02:00
u32 nsts = 0, sta_nsts;
AP: Skip authentication/deauthentication phase for DMG/IEEE 802.11ad Authentication and Deauthentication frames are not used in DMG/IEEE 802.11ad networks. For DMG/IEEE 802.11ad the following was implemented: Upon receiving association request, allocate the sta object and initialize it as if authentication took place. Upon receiving disassociation, deallocate the sta object. ap_sta_disassociate/ap_sta_deauthenticate/ap_sta_disconnect all use disassociation instead of deauthentication. In driver_nl80211, i802_sta_deauth() is routed to i802_sta_disassoc(). Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-12-26 20:00:51 +01:00
if (sta && hapd->conf->use_sta_nsts && sta->vht_capabilities) {
hostapd: Use stations nsts capability in (Re)Association Response frame Some deployed stations incorrectly consider nsts capability in (Re)Association Response frame as required capability instead of maximum capability and if it is greater than station's capability then beamform will not happen in uplink traffic. This commit adds support for an optional workaround to use station's nsts capability in (Re)Association Response frame if the station's nsts is less than AP by using the use_sta_nsts=1 configuration parameter. This configuration is introduced in this commit and it is disabled by default. Signed-off-by: Tamizh chelvam <c_traja@qti.qualcomm.com>
2016-08-31 16:15:47 +02:00
struct ieee80211_vht_capabilities *capa;
nsts = (hapd->iface->conf->vht_capab >>
VHT_CAP_BEAMFORMEE_STS_OFFSET) & 7;
capa = sta->vht_capabilities;
sta_nsts = (le_to_host32(capa->vht_capabilities_info) >>
VHT_CAP_BEAMFORMEE_STS_OFFSET) & 7;
if (nsts < sta_nsts)
nsts = 0;
else
nsts = sta_nsts;
}
p = hostapd_eid_vht_capabilities(hapd, p, nsts);
hostapd: Add vendor specific VHT extension for the 2.4 GHz band This allows vendor specific information element to be used to advertise support for VHT on 2.4 GHz band. In practice, this is used to enable use of 256 QAM rates (VHT-MCS 8 and 9) on 2.4 GHz band. This functionality is disabled by default, but can be enabled with vendor_vht=1 parameter in hostapd.conf if the driver advertises support for VHT on either 2.4 or 5 GHz bands. Signed-off-by: Yanbo Li <yanbol@qti.qualcomm.com>
2014-11-10 16:12:29 +01:00
p = hostapd_eid_vht_operation(hapd, p);
}
VHT: Add VHT elements into (Re)Association Response Signed-hostap: Mahesh Palivela <maheshp@posedge.com>
2012-08-10 18:51:17 +02:00
#endif /* CONFIG_IEEE80211AC */
HE: Add AP mode MLME/SME handling for HE stations Process HE information in (Re)Association Request frames and add HE elements into (Re)Association Response frames when HE is enabled in the BSS. Signed-off-by: Shashidhar Lakkavalli <slakkavalli@datto.com> Signed-off-by: John Crispin <john@phrozen.org>
2019-05-20 09:55:05 +02:00
#ifdef CONFIG_IEEE80211AX
hostapd: Add ability to disable HT/VHT/HE per BSS Add the ability to disable HT/VHT/HE for specific BSS from hostapd.conf. - Add disable_11ax boolean to hostapd_bss_config. - Change disable_11n and disable_11ac to bool in hostapd_bss_config. - Add configuration option to set these disable_11* parameters (which were previously used only automatically based on incompatible security parameters to disable HT/VHT). Signed-off-by: Shay Bar <shay.bar@celeno.com>
2020-06-30 16:23:46 +02:00
if (hapd->iconf->ieee80211ax && !hapd->conf->disable_11ax) {
nl80211: Add driver multi iftype HE capability parsing The HE capabilities are no longer per PHY but per iftype on this specific PHY. It is therefore no longer enough to just parse the AP capabilities. The he_capabilities are now duplicated to store all information for IEEE80211_MODE_* which hostap cares about. The nl80211 driver fills in this information when the iftype supports HE. The rest of the code still only uses the IEEE80211_HE_AP portion but can be extended later to also use other HE capabilities. Signed-off-by: Sven Eckelmann <seckelmann@datto.com>
2019-06-14 16:49:20 +02:00
p = hostapd_eid_he_capab(hapd, p, IEEE80211_MODE_AP);
HE: Add AP mode MLME/SME handling for HE stations Process HE information in (Re)Association Request frames and add HE elements into (Re)Association Response frames when HE is enabled in the BSS. Signed-off-by: Shashidhar Lakkavalli <slakkavalli@datto.com> Signed-off-by: John Crispin <john@phrozen.org>
2019-05-20 09:55:05 +02:00
p = hostapd_eid_he_operation(hapd, p);
p = hostapd_eid_spatial_reuse(hapd, p);
p = hostapd_eid_he_mu_edca_parameter_set(hapd, p);
HE: Add 6 GHz Band Capabilities element in Beacon and response frames Construct HE 6 GHz Band Capabilities element (IEEE 802.11ax/D6.0, 9.4.2.261) from HT and VHT capabilities and add it to Beacon, Probe Response, and (Re)Association Response frames when operating on the 6 GHz band. Signed-off-by: Rajkumar Manoharan <rmanohar@codeaurora.org>
2020-04-25 00:45:37 +02:00
p = hostapd_eid_he_6ghz_band_cap(hapd, p);
HE: Add AP mode MLME/SME handling for HE stations Process HE information in (Re)Association Request frames and add HE elements into (Re)Association Response frames when HE is enabled in the BSS. Signed-off-by: Shashidhar Lakkavalli <slakkavalli@datto.com> Signed-off-by: John Crispin <john@phrozen.org>
2019-05-20 09:55:05 +02:00
}
#endif /* CONFIG_IEEE80211AX */
hostapd: Allow TDLS use to be prohibited in the BSS tdls_prohibit=1 and tdls_prohibit_chan_switch=1 and now be used to disable use of TDLS or TDLS channel switching in the BSS using extended cabilities IE as defined in IEEE 802.11z.
2011-01-28 18:21:59 +01:00
p = hostapd_eid_ext_capab(hapd, p);
WNM: Add advertisement of BSS max idle period If WNM is enabled for the build (CONFIG_WNM=y), add BSS max idle period information to the (Re)Association Response frame from the AP and parse this information on the station. For SME-in-wpa_supplicant case, add a timer to handle periodic transmission of the keep-alive frame. The actual request for the driver to transmit a frame is not yet implemented. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-05-28 02:35:00 +02:00
p = hostapd_eid_bss_max_idle_period(hapd, p);
AP: Skip authentication/deauthentication phase for DMG/IEEE 802.11ad Authentication and Deauthentication frames are not used in DMG/IEEE 802.11ad networks. For DMG/IEEE 802.11ad the following was implemented: Upon receiving association request, allocate the sta object and initialize it as if authentication took place. Upon receiving disassociation, deallocate the sta object. ap_sta_disassociate/ap_sta_deauthenticate/ap_sta_disconnect all use disassociation instead of deauthentication. In driver_nl80211, i802_sta_deauth() is routed to i802_sta_disassoc(). Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-12-26 20:00:51 +01:00
if (sta && sta->qos_map_enabled)
Interworking: Add support for QoS Mapping functionality for the AP This allows QoS Map Set element to be added to (Re)Association Response frames and in QoS Map Configure frame. The QoS Mapping parameters are also made available for the driver interface. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2013-07-24 11:28:20 +02:00
p = hostapd_eid_qos_map_set(hapd, p);
hostapd: Allow TDLS use to be prohibited in the BSS tdls_prohibit=1 and tdls_prohibit_chan_switch=1 and now be used to disable use of TDLS or TDLS channel switching in the BSS using extended cabilities IE as defined in IEEE 802.11z.
2011-01-28 18:21:59 +01:00
FST: Add FST IEs into AP mode management frames This adds the FST IEs received from the FST module into Beacon, Probe Response, and (Re)Association Response frames. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-21 14:30:48 +01:00
#ifdef CONFIG_FST
if (hapd->iface->fst_ies) {
os_memcpy(p, wpabuf_head(hapd->iface->fst_ies),
wpabuf_len(hapd->iface->fst_ies));
p += wpabuf_len(hapd->iface->fst_ies);
}
#endif /* CONFIG_FST */
Allow RSNE/RSNXE to be replaced in FT protocol Reassocation Response frame This can be used to test station side behavior for FT protocol validation steps. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-14 22:30:27 +01:00
#ifdef CONFIG_TESTING_OPTIONS
if (hapd->conf->rsnxe_override_ft &&
buf + buflen - p >=
(long int) wpabuf_len(hapd->conf->rsnxe_override_ft) &&
sta && sta->auth_alg == WLAN_AUTH_FT) {
wpa_printf(MSG_DEBUG, "TESTING: RSNXE FT override");
os_memcpy(p, wpabuf_head(hapd->conf->rsnxe_override_ft),
wpabuf_len(hapd->conf->rsnxe_override_ft));
p += wpabuf_len(hapd->conf->rsnxe_override_ft);
goto rsnxe_done;
}
#endif /* CONFIG_TESTING_OPTIONS */
FT: Omit RSNXE from FT protocol Reassociation Response when needed The previous design for adding RSNXE into FT was not backwards compatible. Move to a new design based on 20/332r3 to avoid that issue by not include RSNXE in the FT protocol Reassociation Response frame so that a STA not supporting RSNXE can still validate the FTE MIC correctly. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-20 20:56:44 +01:00
if (!omit_rsnxe)
p = hostapd_eid_rsnxe(hapd, p, buf + buflen - p);
Allow RSNE/RSNXE to be replaced in FT protocol Reassocation Response frame This can be used to test station side behavior for FT protocol validation steps. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-14 22:30:27 +01:00
#ifdef CONFIG_TESTING_OPTIONS
rsnxe_done:
#endif /* CONFIG_TESTING_OPTIONS */
Add RSNXE into (Re)Association Response frames Add the new RSNXE into (Re)Association Response frames if any of the capability bits is nonzero. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-18 14:49:32 +02:00
OWE: Move Association Response frame IE addition to appropriate place This code was after the FILS handling that would have encrypted the frame. While FILS and OWE are never used together, the OWE handling should really be before the FILS handling since no IEs can be added after the FILS encryption step. In addition, the Diffie-Hellman Parameter element is not a Vendor Specific element, so it should be before some of the Vendor Specific elements even though it is not defined in IEEE 802.11. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-18 10:48:53 +01:00
#ifdef CONFIG_OWE
if ((hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE) &&
sta && sta->owe_ecdh && status_code == WLAN_STATUS_SUCCESS &&
OWE: Do not add DH Params element in AssocResp with PMKSA caching As per RFC 8110 (Opportunistic Wireless Encryption), if the AP has the PMK identified by the PMKID and wishes to perform PMK caching, it will include the PMKID in the Association Response frame RSNE but does not include the Diffie-Hellman Parameter element. This was already addressed for most cases with owe_process_assoc_req() not setting sta->owe_ecdh in case PMKSA caching is used. However, it was possible to an old STA entry to maintain the initial sta->owe_ecdh value if reassociation back to the same AP was used to initiate the PMKSA caching attempt. Cover that case by adding an explicit check for the time when the Association Response frame is being generated. Signed-off-by: Chittur Subramanian Raman <craman@maxlinear.com>
2020-08-19 11:06:39 +02:00
wpa_auth_sta_key_mgmt(sta->wpa_sm) == WPA_KEY_MGMT_OWE &&
!wpa_auth_sta_get_pmksa(sta->wpa_sm)) {
OWE: Move Association Response frame IE addition to appropriate place This code was after the FILS handling that would have encrypted the frame. While FILS and OWE are never used together, the OWE handling should really be before the FILS handling since no IEs can be added after the FILS encryption step. In addition, the Diffie-Hellman Parameter element is not a Vendor Specific element, so it should be before some of the Vendor Specific elements even though it is not defined in IEEE 802.11. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-18 10:48:53 +01:00
struct wpabuf *pub;
pub = crypto_ecdh_get_pubkey(sta->owe_ecdh, 0);
if (!pub) {
res = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto done;
}
/* OWE Diffie-Hellman Parameter element */
*p++ = WLAN_EID_EXTENSION; /* Element ID */
*p++ = 1 + 2 + wpabuf_len(pub); /* Length */
*p++ = WLAN_EID_EXT_OWE_DH_PARAM; /* Element ID Extension */
WPA_PUT_LE16(p, sta->owe_group);
p += 2;
os_memcpy(p, wpabuf_head(pub), wpabuf_len(pub));
p += wpabuf_len(pub);
wpabuf_free(pub);
}
#endif /* CONFIG_OWE */
DPP2: PFS for PTK derivation Use Diffie-Hellman key exchange to derivate additional material for PMK-to-PTK derivation to get PFS. The Diffie-Hellman Parameter element (defined in OWE RFC 8110) is used in association frames to exchange the DH public keys. For backwards compatibility, ignore missing request/response DH parameter and fall back to no PFS in such cases. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-17 22:51:53 +01:00
#ifdef CONFIG_DPP2
DPP: Allow version number to be overridden for testing purposes "SET dpp_version_override <ver>" can now be used to request wpa_supplicant and hostapd to support a subset of DPP versions. In practice, the only valid case for now is to fall back from DPP version 2 support to version 1 in builds that include CONFIG_DPP2=y. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-01 20:07:42 +02:00
if (DPP_VERSION > 1 && (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_DPP) &&
DPP2: PFS for PTK derivation Use Diffie-Hellman key exchange to derivate additional material for PMK-to-PTK derivation to get PFS. The Diffie-Hellman Parameter element (defined in OWE RFC 8110) is used in association frames to exchange the DH public keys. For backwards compatibility, ignore missing request/response DH parameter and fall back to no PFS in such cases. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-17 22:51:53 +01:00
sta && sta->dpp_pfs && status_code == WLAN_STATUS_SUCCESS &&
wpa_auth_sta_key_mgmt(sta->wpa_sm) == WPA_KEY_MGMT_DPP) {
os_memcpy(p, wpabuf_head(sta->dpp_pfs->ie),
wpabuf_len(sta->dpp_pfs->ie));
p += wpabuf_len(sta->dpp_pfs->ie);
}
#endif /* CONFIG_DPP2 */
hostapd: Add vendor specific VHT extension for the 2.4 GHz band This allows vendor specific information element to be used to advertise support for VHT on 2.4 GHz band. In practice, this is used to enable use of 256 QAM rates (VHT-MCS 8 and 9) on 2.4 GHz band. This functionality is disabled by default, but can be enabled with vendor_vht=1 parameter in hostapd.conf if the driver advertises support for VHT on either 2.4 or 5 GHz bands. Signed-off-by: Yanbo Li <yanbol@qti.qualcomm.com>
2014-11-10 16:12:29 +01:00
#ifdef CONFIG_IEEE80211AC
AP: Skip authentication/deauthentication phase for DMG/IEEE 802.11ad Authentication and Deauthentication frames are not used in DMG/IEEE 802.11ad networks. For DMG/IEEE 802.11ad the following was implemented: Upon receiving association request, allocate the sta object and initialize it as if authentication took place. Upon receiving disassociation, deallocate the sta object. ap_sta_disassociate/ap_sta_deauthenticate/ap_sta_disconnect all use disassociation instead of deauthentication. In driver_nl80211, i802_sta_deauth() is routed to i802_sta_disassoc(). Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-12-26 20:00:51 +01:00
if (sta && hapd->conf->vendor_vht && (sta->flags & WLAN_STA_VENDOR_VHT))
hostapd: Add vendor specific VHT extension for the 2.4 GHz band This allows vendor specific information element to be used to advertise support for VHT on 2.4 GHz band. In practice, this is used to enable use of 256 QAM rates (VHT-MCS 8 and 9) on 2.4 GHz band. This functionality is disabled by default, but can be enabled with vendor_vht=1 parameter in hostapd.conf if the driver advertises support for VHT on either 2.4 or 5 GHz bands. Signed-off-by: Yanbo Li <yanbol@qti.qualcomm.com>
2014-11-10 16:12:29 +01:00
p = hostapd_eid_vendor_vht(hapd, p);
#endif /* CONFIG_IEEE80211AC */
AP: Skip authentication/deauthentication phase for DMG/IEEE 802.11ad Authentication and Deauthentication frames are not used in DMG/IEEE 802.11ad networks. For DMG/IEEE 802.11ad the following was implemented: Upon receiving association request, allocate the sta object and initialize it as if authentication took place. Upon receiving disassociation, deallocate the sta object. ap_sta_disassociate/ap_sta_deauthenticate/ap_sta_disconnect all use disassociation instead of deauthentication. In driver_nl80211, i802_sta_deauth() is routed to i802_sta_disassoc(). Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-12-26 20:00:51 +01:00
if (sta && (sta->flags & WLAN_STA_WMM))
hostapd: Reorder some IEs to get closer to IEEE 802.11 standard Vendor-specific IEs are supposed to be in the end of the frame, so move WMM into the end of Beacon, Probe Response, and (Re)Association Response frames. In addition, move HT IEs to be later in (Re)Association Response to match the correct order. hostapd_eid_wpa() adds multiple IEs and the end result may not always be correct. If WPA is enabled, WPA IE (vendor-specific) gets added in the middle of the frame and not in the end. This would require a larger change to spliut the IEs from WPA module into separate locations when constructing Beacon and Probe Response frames. This is not yet addressed.
2010-05-02 09:53:01 +02:00
p = hostapd_eid_wmm(hapd, p);
Add WPS IE into (Re)Association Response frame if WPS is used If the associating station indicates that it is intents to use WPS by including WPS IE in (Re)Association Request frame, include WPS IE in (Re)Association Response frame.
2010-05-26 17:46:08 +02:00
#ifdef CONFIG_WPS
AP: Skip authentication/deauthentication phase for DMG/IEEE 802.11ad Authentication and Deauthentication frames are not used in DMG/IEEE 802.11ad networks. For DMG/IEEE 802.11ad the following was implemented: Upon receiving association request, allocate the sta object and initialize it as if authentication took place. Upon receiving disassociation, deallocate the sta object. ap_sta_disassociate/ap_sta_deauthenticate/ap_sta_disconnect all use disassociation instead of deauthentication. In driver_nl80211, i802_sta_deauth() is routed to i802_sta_disassoc(). Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-12-26 20:00:51 +01:00
if (sta &&
((sta->flags & WLAN_STA_WPS) ||
((sta->flags & WLAN_STA_MAYBE_WPS) && hapd->conf->wpa))) {
Add WPS IE into (Re)Association Response frame if WPS is used If the associating station indicates that it is intents to use WPS by including WPS IE in (Re)Association Request frame, include WPS IE in (Re)Association Response frame.
2010-05-26 17:46:08 +02:00
struct wpabuf *wps = wps_build_assoc_resp_ie();
if (wps) {
os_memcpy(p, wpabuf_head(wps), wpabuf_len(wps));
p += wpabuf_len(wps);
wpabuf_free(wps);
}
}
#endif /* CONFIG_WPS */
hostapd: Add Multi-AP protocol support The purpose of Multi-AP specification is to enable inter-operability across Wi-Fi access points (APs) from different vendors. This patch introduces one new configuration parameter 'multi_ap' to enable Multi-AP functionality and to configure the BSS as a backhaul and/or fronthaul BSS. Advertise vendor specific Multi-AP capabilities in (Re)Association Response frame, if Multi-AP functionality is enabled through the configuration parameter. A backhaul AP must support receiving both 3addr and 4addr frames from a backhaul STA, so create a VLAN for it just like is done for WDS, i.e., by calling hostapd_set_wds_sta(). Since Multi-AP requires WPA2 (never WEP), we can safely call hostapd_set_wds_encryption() as well and we can reuse the entire WDS condition. To parse the Multi-AP Extension subelement, we use get_ie(): even though that function is meant for parsing IEs, it works for subelements. Signed-off-by: Venkateswara Naralasetty <vnaralas@codeaurora.org> Signed-off-by: Jouni Malinen <jouni@codeaurora.org> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2018-12-05 11:23:51 +01:00
if (sta && (sta->flags & WLAN_STA_MULTI_AP))
p = hostapd_eid_multi_ap(hapd, p);
P2P: Add group notifications
2010-07-18 23:30:25 +02:00
#ifdef CONFIG_P2P
AP: Skip authentication/deauthentication phase for DMG/IEEE 802.11ad Authentication and Deauthentication frames are not used in DMG/IEEE 802.11ad networks. For DMG/IEEE 802.11ad the following was implemented: Upon receiving association request, allocate the sta object and initialize it as if authentication took place. Upon receiving disassociation, deallocate the sta object. ap_sta_disassociate/ap_sta_deauthenticate/ap_sta_disconnect all use disassociation instead of deauthentication. In driver_nl80211, i802_sta_deauth() is routed to i802_sta_disassoc(). Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-12-26 20:00:51 +01:00
if (sta && sta->p2p_ie && hapd->p2p_group) {
P2P: Add group notifications
2010-07-18 23:30:25 +02:00
struct wpabuf *p2p_resp_ie;
enum p2p_status_code status;
switch (status_code) {
case WLAN_STATUS_SUCCESS:
status = P2P_SC_SUCCESS;
break;
case WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA:
status = P2P_SC_FAIL_LIMIT_REACHED;
break;
default:
status = P2P_SC_FAIL_INVALID_PARAMS;
break;
}
p2p_resp_ie = p2p_group_assoc_resp_ie(hapd->p2p_group, status);
if (p2p_resp_ie) {
os_memcpy(p, wpabuf_head(p2p_resp_ie),
wpabuf_len(p2p_resp_ie));
p += wpabuf_len(p2p_resp_ie);
wpabuf_free(p2p_resp_ie);
}
}
#endif /* CONFIG_P2P */
P2P: Add preliminary P2P Manager AP support for hostapd
2010-07-18 23:30:26 +02:00
#ifdef CONFIG_P2P_MANAGER
if (hapd->conf->p2p & P2P_MANAGE)
p = hostapd_eid_p2p_manage(hapd, p);
#endif /* CONFIG_P2P_MANAGER */
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
p = hostapd_eid_mbo(hapd, p, buf + buflen - p);
hostapd: Add MBO IE to Beacon, Probe Response, Association Response Add MBO IE with AP capability attribute to Beacon, Probe Response, and (Re)Association Response frames to indicate the AP supports MBO. Add option to add Association Disallowed attribute to Beacon, Probe Response, and (Re)Association Response frames. Usage: SET mbo_assoc_disallow <reason code> Valid reason code values are between 1-5. Setting the reason code to 0 will remove the Association Disallowed attribute from the MBO IE and will allow new associations. MBO functionality is enabled by setting "mbo=1" in the config file. Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-15 15:53:52 +01:00
Add assocresp_elements parameter for hostapd This new parameter allows hostapd to add Vendor Specific elements into (Re)Association Response frames similarly to the way vendor_elements parameter can be used for Beacon and Probe Response frames. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-04-20 06:04:17 +02:00
if (hapd->conf->assocresp_elements &&
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
(size_t) (buf + buflen - p) >=
Add assocresp_elements parameter for hostapd This new parameter allows hostapd to add Vendor Specific elements into (Re)Association Response frames similarly to the way vendor_elements parameter can be used for Beacon and Probe Response frames. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-04-20 06:04:17 +02:00
wpabuf_len(hapd->conf->assocresp_elements)) {
os_memcpy(p, wpabuf_head(hapd->conf->assocresp_elements),
wpabuf_len(hapd->conf->assocresp_elements));
p += wpabuf_len(hapd->conf->assocresp_elements);
}
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
send_len += p - reply->u.assoc_resp.variable;
FILS: Add Association Response frame elements and encrypt them (AP) Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-09 14:43:53 +02:00
#ifdef CONFIG_FILS
AP: Skip authentication/deauthentication phase for DMG/IEEE 802.11ad Authentication and Deauthentication frames are not used in DMG/IEEE 802.11ad networks. For DMG/IEEE 802.11ad the following was implemented: Upon receiving association request, allocate the sta object and initialize it as if authentication took place. Upon receiving disassociation, deallocate the sta object. ap_sta_disassociate/ap_sta_deauthenticate/ap_sta_disconnect all use disassociation instead of deauthentication. In driver_nl80211, i802_sta_deauth() is routed to i802_sta_disassoc(). Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-12-26 20:00:51 +01:00
if (sta &&
(sta->auth_alg == WLAN_AUTH_FILS_SK ||
FILS: Add Association Response frame elements and encrypt them (AP) Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-09 14:43:53 +02:00
sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
sta->auth_alg == WLAN_AUTH_FILS_PK) &&
status_code == WLAN_STATUS_SUCCESS) {
struct ieee802_11_elems elems;
if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) ==
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
ParseFailed || !elems.fils_session) {
res = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto done;
}
FILS: Add Association Response frame elements and encrypt them (AP) Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-09 14:43:53 +02:00
/* FILS Session */
*p++ = WLAN_EID_EXTENSION; /* Element ID */
*p++ = 1 + FILS_SESSION_LEN; /* Length */
*p++ = WLAN_EID_EXT_FILS_SESSION; /* Element ID Extension */
os_memcpy(p, elems.fils_session, FILS_SESSION_LEN);
send_len += 2 + 1 + FILS_SESSION_LEN;
send_len = fils_encrypt_assoc(sta->wpa_sm, buf, send_len,
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
buflen, sta->fils_hlp_resp);
if (send_len < 0) {
res = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto done;
}
FILS: Add Association Response frame elements and encrypt them (AP) Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-09 14:43:53 +02:00
}
#endif /* CONFIG_FILS */
Make hostapd_drv_send_mlme() more generic Merge hostapd_drv_send_mlme_csa() functionality into hostapd_drv_send_mlme() to get a single driver ops handler function for hostapd. In addition, add a new no_encrypt parameter in preparation for functionality that is needed to get rid of the separate send_frame() driver op. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-01-03 12:34:37 +01:00
if (hostapd_drv_send_mlme(hapd, reply, send_len, 0, NULL, 0, 0) < 0) {
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
wpa_printf(MSG_INFO, "Failed to send assoc resp: %s",
strerror(errno));
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
res = WLAN_STATUS_UNSPECIFIED_FAILURE;
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
}
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
done:
os_free(buf);
return res;
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
}
OWE: Add AP mode handling of OWE with drivers that implement SME Handle OWE DH exchange and key setup when processing the association event from a driver that implements AP SME. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-30 22:24:42 +01:00
#ifdef CONFIG_OWE
OWE: Rename function to match use (driver-SME/MLME) This function is used to process a (Re)Association Request frame, so rename it appropriately to mention assoc_req instead of auth_req. Signed-off-by: Ashok Ponnaiah <aponnaia@codeaurora.org>
2018-02-06 19:27:41 +01:00
u8 * owe_assoc_req_process(struct hostapd_data *hapd, struct sta_info *sta,
const u8 *owe_dh, u8 owe_dh_len,
OWE: Rename owe_assoc_req_process() parameter reason to status In the function owe_assoc_req_process(), values assigned to the reason argument imply that it should be renamed to status. Rename 'reason' to 'status' and modify the uses of owe_assoc_req_process() accordingly. Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2020-02-13 09:51:23 +01:00
u8 *owe_buf, size_t owe_buf_len, u16 *status)
OWE: Add AP mode handling of OWE with drivers that implement SME Handle OWE DH exchange and key setup when processing the association event from a driver that implements AP SME. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-30 22:24:42 +01:00
{
OWE: Add testing RSNE for OWE assoc response with driver SME/MLME Allow RSNE to be overwritten for testing purposes also in the driver-based SME/MLME case. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-12 12:57:12 +01:00
#ifdef CONFIG_TESTING_OPTIONS
if (hapd->conf->own_ie_override) {
wpa_printf(MSG_DEBUG, "OWE: Using IE override");
OWE: Rename owe_assoc_req_process() parameter reason to status In the function owe_assoc_req_process(), values assigned to the reason argument imply that it should be renamed to status. Rename 'reason' to 'status' and modify the uses of owe_assoc_req_process() accordingly. Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2020-02-13 09:51:23 +01:00
*status = WLAN_STATUS_SUCCESS;
OWE: Add testing RSNE for OWE assoc response with driver SME/MLME Allow RSNE to be overwritten for testing purposes also in the driver-based SME/MLME case. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-12 12:57:12 +01:00
return wpa_auth_write_assoc_resp_owe(sta->wpa_sm, owe_buf,
owe_buf_len, NULL, 0);
}
#endif /* CONFIG_TESTING_OPTIONS */
OWE: Use PMKSA caching if available with driver AP MLME If a matching PMKSA cache entry is present for an OWE client, use it and do not go through DH while processing Association Rquest frame. Association Response frame will identify the PMKID in such a case and DH parameters won't be present. Signed-off-by: Ashok Ponnaiah <aponnaia@codeaurora.org>
2018-01-30 12:24:39 +01:00
if (wpa_auth_sta_get_pmksa(sta->wpa_sm)) {
wpa_printf(MSG_DEBUG, "OWE: Using PMKSA caching");
owe_buf = wpa_auth_write_assoc_resp_owe(sta->wpa_sm, owe_buf,
owe_buf_len, NULL, 0);
OWE: Rename owe_assoc_req_process() parameter reason to status In the function owe_assoc_req_process(), values assigned to the reason argument imply that it should be renamed to status. Rename 'reason' to 'status' and modify the uses of owe_assoc_req_process() accordingly. Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2020-02-13 09:51:23 +01:00
*status = WLAN_STATUS_SUCCESS;
hostapd: Process OWE IE and update DH IE to the driver if needed This implements the required functionality in hostapd to facilitate OWE connection with the AP SME-in-driver cases. Stations can either send DH IE or PMKID (in RSNE) (or both) in Association Request frame during the OWE handshake. The drivers that use this offload mechanism do not interpret this information and instead, pass the same to hostapd for further processing. hostapd will either validate the PMKID obtained from the STA or generate DH IE and further indicate the same to the driver. The driver further sends this information in the Association Response frame. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org> Signed-off-by: Liangwei Dong <liangwei@codeaurora.org> Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-05-29 11:11:48 +02:00
return owe_buf;
}
if (sta->owe_pmk && sta->external_dh_updated) {
wpa_printf(MSG_DEBUG, "OWE: Using previously derived PMK");
OWE: Rename owe_assoc_req_process() parameter reason to status In the function owe_assoc_req_process(), values assigned to the reason argument imply that it should be renamed to status. Rename 'reason' to 'status' and modify the uses of owe_assoc_req_process() accordingly. Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2020-02-13 09:51:23 +01:00
*status = WLAN_STATUS_SUCCESS;
OWE: Use PMKSA caching if available with driver AP MLME If a matching PMKSA cache entry is present for an OWE client, use it and do not go through DH while processing Association Rquest frame. Association Response frame will identify the PMKID in such a case and DH parameters won't be present. Signed-off-by: Ashok Ponnaiah <aponnaia@codeaurora.org>
2018-01-30 12:24:39 +01:00
return owe_buf;
}
OWE: Rename owe_assoc_req_process() parameter reason to status In the function owe_assoc_req_process(), values assigned to the reason argument imply that it should be renamed to status. Rename 'reason' to 'status' and modify the uses of owe_assoc_req_process() accordingly. Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2020-02-13 09:51:23 +01:00
*status = owe_process_assoc_req(hapd, sta, owe_dh, owe_dh_len);
if (*status != WLAN_STATUS_SUCCESS)
OWE: Add AP mode handling of OWE with drivers that implement SME Handle OWE DH exchange and key setup when processing the association event from a driver that implements AP SME. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-30 22:24:42 +01:00
return NULL;
OWE: Add RSNE when not using PMKSA caching (driver-SME/MLME) RSNE needs to be added both with and without use of PMKSA caching. Signed-off-by: Ashok Ponnaiah <aponnaia@codeaurora.org>
2018-02-06 19:22:53 +01:00
owe_buf = wpa_auth_write_assoc_resp_owe(sta->wpa_sm, owe_buf,
owe_buf_len, NULL, 0);
OWE: Clean up pointer check in a testing code path Check wpa_auth_write_assoc_resp_owe() return value to keep static analyzers happier. The code path where this could happen is not really reachable due to the separate hapd->conf->own_ie_override check and wpa_auth_write_assoc_resp_owe() returning NULL only in an error case in the override path. Furthermore, clean up the pointer return value to use a proper pointer (NULL vs. 0). Signed-off-by: Ashok Ponnaiah <aponnaia@codeaurora.org>
2018-03-05 06:29:18 +01:00
if (sta->owe_ecdh && owe_buf) {
OWE: Check for ECDH availability before use (driver-SME/MLME) Verify that the STA has ECDH data available before trying to use this data to add the OWE DH Params element. Signed-off-by: Ashok Ponnaiah <aponnaia@codeaurora.org>
2018-02-06 19:25:41 +01:00
struct wpabuf *pub;
pub = crypto_ecdh_get_pubkey(sta->owe_ecdh, 0);
if (!pub) {
OWE: Rename owe_assoc_req_process() parameter reason to status In the function owe_assoc_req_process(), values assigned to the reason argument imply that it should be renamed to status. Rename 'reason' to 'status' and modify the uses of owe_assoc_req_process() accordingly. Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2020-02-13 09:51:23 +01:00
*status = WLAN_STATUS_UNSPECIFIED_FAILURE;
OWE: Check for ECDH availability before use (driver-SME/MLME) Verify that the STA has ECDH data available before trying to use this data to add the OWE DH Params element. Signed-off-by: Ashok Ponnaiah <aponnaia@codeaurora.org>
2018-02-06 19:25:41 +01:00
return owe_buf;
}
/* OWE Diffie-Hellman Parameter element */
*owe_buf++ = WLAN_EID_EXTENSION; /* Element ID */
*owe_buf++ = 1 + 2 + wpabuf_len(pub); /* Length */
*owe_buf++ = WLAN_EID_EXT_OWE_DH_PARAM; /* Element ID Extension
*/
WPA_PUT_LE16(owe_buf, sta->owe_group);
owe_buf += 2;
os_memcpy(owe_buf, wpabuf_head(pub), wpabuf_len(pub));
owe_buf += wpabuf_len(pub);
wpabuf_free(pub);
}
OWE: Add AP mode handling of OWE with drivers that implement SME Handle OWE DH exchange and key setup when processing the association event from a driver that implements AP SME. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-30 22:24:42 +01:00
return owe_buf;
}
#endif /* CONFIG_OWE */
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
#ifdef CONFIG_FILS
void fils_hlp_finish_assoc(struct hostapd_data *hapd, struct sta_info *sta)
{
u16 reply_res;
wpa_printf(MSG_DEBUG, "FILS: Finish association with " MACSTR,
MAC2STR(sta->addr));
eloop_cancel_timeout(fils_hlp_timeout, hapd, sta);
if (!sta->fils_pending_assoc_req)
return;
reply_res = send_assoc_resp(hapd, sta, sta->addr, WLAN_STATUS_SUCCESS,
sta->fils_pending_assoc_is_reassoc,
sta->fils_pending_assoc_req,
FT: Omit RSNXE from FT protocol Reassociation Response when needed The previous design for adding RSNXE into FT was not backwards compatible. Move to a new design based on 20/332r3 to avoid that issue by not include RSNXE in the FT protocol Reassociation Response frame so that a STA not supporting RSNXE can still validate the FTE MIC correctly. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-20 20:56:44 +01:00
sta->fils_pending_assoc_req_len, 0, 0);
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
os_free(sta->fils_pending_assoc_req);
sta->fils_pending_assoc_req = NULL;
sta->fils_pending_assoc_req_len = 0;
wpabuf_free(sta->fils_hlp_resp);
sta->fils_hlp_resp = NULL;
wpabuf_free(sta->hlp_dhcp_discover);
sta->hlp_dhcp_discover = NULL;
/*
AP: Remove unneeded check for 'added_unassociated' In fils_hlp_finish_assoc() the station is already added to the driver so it is not needed to check the 'added_unassociated' flag. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2017-08-21 18:36:21 +02:00
* Remove the station in case transmission of a success response fails.
* At this point the station was already added associated to the driver.
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
*/
AP: Remove unneeded check for 'added_unassociated' In fils_hlp_finish_assoc() the station is already added to the driver so it is not needed to check the 'added_unassociated' flag. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2017-08-21 18:36:21 +02:00
if (reply_res != WLAN_STATUS_SUCCESS)
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
hostapd_drv_sta_remove(hapd, sta->addr);
}
void fils_hlp_timeout(void *eloop_ctx, void *eloop_data)
{
struct hostapd_data *hapd = eloop_ctx;
struct sta_info *sta = eloop_data;
wpa_printf(MSG_DEBUG,
"FILS: HLP response timeout - continue with association response for "
MACSTR, MAC2STR(sta->addr));
FILS: Add HLP support with driver-based AP SME This allows HLP processing to postpone association processing in hostapd_notify_assoc(). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-06 12:57:54 +02:00
if (sta->fils_drv_assoc_finish)
hostapd_notify_assoc_fils_finish(hapd, sta);
else
fils_hlp_finish_assoc(hapd, sta);
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
}
#endif /* CONFIG_FILS */
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
static void handle_assoc(struct hostapd_data *hapd,
Mark management frame processing functions to use const buffer
2009-12-13 22:25:30 +01:00
const struct ieee80211_mgmt *mgmt, size_t len,
OCE: Add RSSI based association rejection support (AP) An AP might reject a STA association request due to low RSSI. In such case, the AP informs the STA the desired RSSI improvement and a retry timeout. The STA might retry to associate even if the RSSI hasn't improved if the retry timeout expired. Signed-off-by: Beni Lev <beni.lev@intel.com>
2017-08-21 18:43:53 +02:00
int reassoc, int rssi)
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
{
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
u16 capab_info, listen_interval, seq_ctrl, fc;
FT: Discard ReassocReq with mismatching RSNXE Used value Discard the FT Reassociation Request frame instead of rejecting it (i.e., do not send Reassociation Response frame) if RSNXE Used is indicated in FTE, but no RSNXE is included even though the AP is advertising RSNXE. While there is not really much of a difference between discarding and rejecting the frame, this discarding behavior is what the standard says for this type of an error case. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-14 12:46:00 +02:00
int resp = WLAN_STATUS_SUCCESS;
hostapd: Resolved compiler uninitialized warning Resolved the below warning ../src/ap/ieee802_11.c:4535:25: warning: 'reply_res' may be used uninitialized in this function [-Wmaybe-uninitialized] if (sta && ((reply_res != WLAN_STATUS_SUCCESS && ^ Since reply_res is been assigned inside an if condition and so compiler treats reply_res as uninitalized variable Initialize reply_res with WLAN_STATUS_UNSPECIFIED_FAILURE. Fixes: 5344af7d22ac ("FT: Discard ReassocReq with mismatching RSNXE Used value") Signed-off-by: Karthikeyan Kathirvel <kathirve@codeaurora.org>
2020-07-20 18:52:01 +02:00
u16 reply_res = WLAN_STATUS_UNSPECIFIED_FAILURE;
Mark management frame processing functions to use const buffer
2009-12-13 22:25:30 +01:00
const u8 *pos;
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
int left, i;
struct sta_info *sta;
FILS: Decrypt Association Request elements and check Key-Auth (AP) Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-09 00:27:22 +02:00
u8 *tmp = NULL;
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
#ifdef CONFIG_FILS
int delay_assoc = 0;
#endif /* CONFIG_FILS */
FT: Omit RSNXE from FT protocol Reassociation Response when needed The previous design for adding RSNXE into FT was not backwards compatible. Move to a new design based on 20/332r3 to avoid that issue by not include RSNXE in the FT protocol Reassociation Response frame so that a STA not supporting RSNXE can still validate the FTE MIC correctly. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-20 20:56:44 +01:00
int omit_rsnxe = 0;
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_req) :
sizeof(mgmt->u.assoc_req))) {
Convert perror/printf calls to wpa_printf This makes debug and error logging more consistent and allows them to be directed to a file more easily. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 11:51:30 +01:00
wpa_printf(MSG_INFO, "handle_assoc(reassoc=%d) - too short payload (len=%lu)",
reassoc, (unsigned long) len);
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
return;
}
hostapd: Add some testing options In order to test clients in scenarios where APs may (randomly) drop certain management frames, introduce some testing options into the hostapd configuration that can make it ignore certain frames. For now, these are probe requests, authentication and (re)association frames. Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2013-04-23 16:51:28 +02:00
#ifdef CONFIG_TESTING_OPTIONS
if (reassoc) {
Remove floating constant suffix 'd' from test coee clang scan-build does not seem to like the 'd' suffix on floating constants and ends up reporting analyzer failures. Since this suffix does not seem to be needed, get rid of it to clear such warnings. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-04-26 10:09:29 +02:00
if (hapd->iconf->ignore_reassoc_probability > 0.0 &&
hostapd: Add some testing options In order to test clients in scenarios where APs may (randomly) drop certain management frames, introduce some testing options into the hostapd configuration that can make it ignore certain frames. For now, these are probe requests, authentication and (re)association frames. Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2013-04-23 16:51:28 +02:00
drand48() < hapd->iconf->ignore_reassoc_probability) {
wpa_printf(MSG_INFO,
"TESTING: ignoring reassoc request from "
MACSTR, MAC2STR(mgmt->sa));
return;
}
} else {
Remove floating constant suffix 'd' from test coee clang scan-build does not seem to like the 'd' suffix on floating constants and ends up reporting analyzer failures. Since this suffix does not seem to be needed, get rid of it to clear such warnings. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-04-26 10:09:29 +02:00
if (hapd->iconf->ignore_assoc_probability > 0.0 &&
hostapd: Add some testing options In order to test clients in scenarios where APs may (randomly) drop certain management frames, introduce some testing options into the hostapd configuration that can make it ignore certain frames. For now, these are probe requests, authentication and (re)association frames. Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2013-04-23 16:51:28 +02:00
drand48() < hapd->iconf->ignore_assoc_probability) {
wpa_printf(MSG_INFO,
"TESTING: ignoring assoc request from "
MACSTR, MAC2STR(mgmt->sa));
return;
}
}
#endif /* CONFIG_TESTING_OPTIONS */
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
fc = le_to_host16(mgmt->frame_control);
seq_ctrl = le_to_host16(mgmt->seq_ctrl);
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
if (reassoc) {
capab_info = le_to_host16(mgmt->u.reassoc_req.capab_info);
listen_interval = le_to_host16(
mgmt->u.reassoc_req.listen_interval);
wpa_printf(MSG_DEBUG, "reassociation request: STA=" MACSTR
" capab_info=0x%02x listen_interval=%d current_ap="
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
MACSTR " seq_ctrl=0x%x%s",
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
MAC2STR(mgmt->sa), capab_info, listen_interval,
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
MAC2STR(mgmt->u.reassoc_req.current_ap),
seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "");
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.reassoc_req));
pos = mgmt->u.reassoc_req.variable;
} else {
capab_info = le_to_host16(mgmt->u.assoc_req.capab_info);
listen_interval = le_to_host16(
mgmt->u.assoc_req.listen_interval);
wpa_printf(MSG_DEBUG, "association request: STA=" MACSTR
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
" capab_info=0x%02x listen_interval=%d "
"seq_ctrl=0x%x%s",
MAC2STR(mgmt->sa), capab_info, listen_interval,
seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "");
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.assoc_req));
pos = mgmt->u.assoc_req.variable;
}
sta = ap_get_sta(hapd, mgmt->sa);
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#ifdef CONFIG_IEEE80211R_AP
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
if (sta && sta->auth_alg == WLAN_AUTH_FT &&
(sta->flags & WLAN_STA_AUTH) == 0) {
wpa_printf(MSG_DEBUG, "FT: Allow STA " MACSTR " to associate "
"prior to authentication since it is using "
"over-the-DS FT", MAC2STR(mgmt->sa));
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
/*
* Mark station as authenticated, to avoid adding station
* entry in the driver as associated and not authenticated
*/
sta->flags |= WLAN_STA_AUTH;
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
} else
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#endif /* CONFIG_IEEE80211R_AP */
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
if (sta == NULL || (sta->flags & WLAN_STA_AUTH) == 0) {
AP: Skip authentication/deauthentication phase for DMG/IEEE 802.11ad Authentication and Deauthentication frames are not used in DMG/IEEE 802.11ad networks. For DMG/IEEE 802.11ad the following was implemented: Upon receiving association request, allocate the sta object and initialize it as if authentication took place. Upon receiving disassociation, deallocate the sta object. ap_sta_disassociate/ap_sta_deauthenticate/ap_sta_disconnect all use disassociation instead of deauthentication. In driver_nl80211, i802_sta_deauth() is routed to i802_sta_disassoc(). Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-12-26 20:00:51 +01:00
if (hapd->iface->current_mode &&
hapd->iface->current_mode->mode ==
HOSTAPD_MODE_IEEE80211AD) {
AP: Check ACL upon association request for 802.11ad With device_ap_sme disabled, ACL was checked upon authentication request. In 802.11ad there is no authentication phase so need to check ACL upon association. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2017-01-17 13:51:02 +01:00
int acl_res;
Fix possible memory leak of RADIUS data in handle_auth() When returning from handle_auth() after ieee802_11_allowed_address() returned HOSTAPD_ACL_ACCEPT, but before ieee802_11_set_radius_info() has been called, identity, radius_cui, and psk might not have been consumed. Fix this by avoiding the need to free these variables at all. Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2019-04-28 13:14:57 +02:00
struct radius_sta info;
AP: Check ACL upon association request for 802.11ad With device_ap_sme disabled, ACL was checked upon authentication request. In 802.11ad there is no authentication phase so need to check ACL upon association. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2017-01-17 13:51:02 +01:00
Move the RADIUS cached attributes into a struct This makes it easier to pass these around and to add new attributes. Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2019-04-28 13:14:57 +02:00
acl_res = ieee802_11_allowed_address(hapd, mgmt->sa,
(const u8 *) mgmt,
Call hostapd_allowed_address() directly from handle_probe_req() ieee802_11_allowed_address() did not really do anything useful for the call from handle_probe_req(), so replace that with a direct call to hostapd_allowed_address() and make ieee802_11_allowed_address() a static function. Signed-off-by: Jouni Malinen <j@w1.fi>
2019-12-29 22:24:10 +01:00
len, &info);
AP: Check ACL upon association request for 802.11ad With device_ap_sme disabled, ACL was checked upon authentication request. In 802.11ad there is no authentication phase so need to check ACL upon association. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2017-01-17 13:51:02 +01:00
if (acl_res == HOSTAPD_ACL_REJECT) {
Extend ACL check for Probe Request frames Extend ACL check to deny Probe Request frames for the client which does not pass ACL check. Skip this check for the case where RADIUS ACL is used to avoid excessive load on the RADIUS authentication server due to Probe Request frames. This patch add wpa_msg event for auth and assoc rejection due to acl reject. Signed-off-by: Tamizh chelvam <tamizhr@codeaurora.org>
2018-02-14 14:43:56 +01:00
wpa_msg(hapd->msg_ctx, MSG_DEBUG,
"Ignore Association Request frame from "
MACSTR " due to ACL reject",
MAC2STR(mgmt->sa));
AP: Check ACL upon association request for 802.11ad With device_ap_sme disabled, ACL was checked upon authentication request. In 802.11ad there is no authentication phase so need to check ACL upon association. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2017-01-17 13:51:02 +01:00
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
}
if (acl_res == HOSTAPD_ACL_PENDING)
return;
AP: Skip authentication/deauthentication phase for DMG/IEEE 802.11ad Authentication and Deauthentication frames are not used in DMG/IEEE 802.11ad networks. For DMG/IEEE 802.11ad the following was implemented: Upon receiving association request, allocate the sta object and initialize it as if authentication took place. Upon receiving disassociation, deallocate the sta object. ap_sta_disassociate/ap_sta_deauthenticate/ap_sta_disconnect all use disassociation instead of deauthentication. In driver_nl80211, i802_sta_deauth() is routed to i802_sta_disassoc(). Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-12-26 20:00:51 +01:00
/* DMG/IEEE 802.11ad does not use authentication.
* Allocate sta entry upon association. */
sta = ap_sta_add(hapd, mgmt->sa);
if (!sta) {
hostapd_logger(hapd, mgmt->sa,
HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO,
"Failed to add STA");
resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
goto fail;
}
AP: Check ACL upon association request for 802.11ad With device_ap_sme disabled, ACL was checked upon authentication request. In 802.11ad there is no authentication phase so need to check ACL upon association. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2017-01-17 13:51:02 +01:00
acl_res = ieee802_11_set_radius_info(
Move the RADIUS cached attributes into a struct This makes it easier to pass these around and to add new attributes. Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2019-04-28 13:14:57 +02:00
hapd, sta, acl_res, &info);
AP: Check ACL upon association request for 802.11ad With device_ap_sme disabled, ACL was checked upon authentication request. In 802.11ad there is no authentication phase so need to check ACL upon association. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2017-01-17 13:51:02 +01:00
if (acl_res) {
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
}
AP: Skip authentication/deauthentication phase for DMG/IEEE 802.11ad Authentication and Deauthentication frames are not used in DMG/IEEE 802.11ad networks. For DMG/IEEE 802.11ad the following was implemented: Upon receiving association request, allocate the sta object and initialize it as if authentication took place. Upon receiving disassociation, deallocate the sta object. ap_sta_disassociate/ap_sta_deauthenticate/ap_sta_disconnect all use disassociation instead of deauthentication. In driver_nl80211, i802_sta_deauth() is routed to i802_sta_disassoc(). Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-12-26 20:00:51 +01:00
hostapd_logger(hapd, sta->addr,
HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
"Skip authentication for DMG/IEEE 802.11ad");
sta->flags |= WLAN_STA_AUTH;
wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
sta->auth_alg = WLAN_AUTH_OPEN;
} else {
hostapd_logger(hapd, mgmt->sa,
HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO,
"Station tried to associate before authentication (aid=%d flags=0x%x)",
sta ? sta->aid : -1,
sta ? sta->flags : 0);
send_deauth(hapd, mgmt->sa,
WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA);
return;
}
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
}
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
if ((fc & WLAN_FC_RETRY) &&
sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
sta->last_seq_ctrl == seq_ctrl &&
Fix duplicate Reassociation Request frame dropping Relational operators (==) have higher precedence than the ternary conditional in C. The last_subtype check for association/reassociation was broken due to incorrect assumption about the precedence. Fix this by adding parenthesis around the ternary conditional. The previous implementation worked for Association Request frames by accident since WLAN_FC_STYPE_ASSOC_REQ happens to have value 0 and when the last receive frame was an Association Request frame, the sta->last_subtype == reassoc check was true and non-zero WLAN_FC_STYPE_REASSOC_REQ was interpreted as true. However, this was broken for Reassociation Request frame. reassoc == 1 in that case could have matched received Association Response frame (subtype == 1), but those are not received in AP mode and as such, this did not break other behavior apart from not being able to drop duplicated Reassociation Request frames. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-14 00:04:31 +01:00
sta->last_subtype == (reassoc ? WLAN_FC_STYPE_REASSOC_REQ :
WLAN_FC_STYPE_ASSOC_REQ)) {
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
"Drop repeated association frame seq_ctrl=0x%x",
seq_ctrl);
return;
}
sta->last_seq_ctrl = seq_ctrl;
sta->last_subtype = reassoc ? WLAN_FC_STYPE_REASSOC_REQ :
WLAN_FC_STYPE_ASSOC_REQ;
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
if (hapd->tkip_countermeasures) {
Fix Status Code in TKIP countermeasures case The previously used WLAN_REASON_MICHAEL_MIC_FAILURE (14) value as a response to Authentication frame or (Re)Association Request frame is not correct since the resp value is encoded in the Status Code (not Reason Code) field. Status Code 14 is WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION which is really what this value would have meant in the response frames. There is no Michael MIC failure status code, so have to use the generic "Unspecified failure" (1) reason code for these cases. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-11-03 09:49:45 +01:00
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
goto fail;
}
if (listen_interval > hapd->conf->max_listen_interval) {
hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
"Too large Listen Interval (%d)",
listen_interval);
resp = WLAN_STATUS_ASSOC_DENIED_LISTEN_INT_TOO_LARGE;
goto fail;
}
hostapd: Add MBO IE to Beacon, Probe Response, Association Response Add MBO IE with AP capability attribute to Beacon, Probe Response, and (Re)Association Response frames to indicate the AP supports MBO. Add option to add Association Disallowed attribute to Beacon, Probe Response, and (Re)Association Response frames. Usage: SET mbo_assoc_disallow <reason code> Valid reason code values are between 1-5. Setting the reason code to 0 will remove the Association Disallowed attribute from the MBO IE and will allow new associations. MBO functionality is enabled by setting "mbo=1" in the config file. Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-15 15:53:52 +01:00
#ifdef CONFIG_MBO
if (hapd->conf->mbo_enabled && hapd->mbo_assoc_disallow) {
resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
goto fail;
}
OCE: Add RSSI based association rejection support (AP) An AP might reject a STA association request due to low RSSI. In such case, the AP informs the STA the desired RSSI improvement and a retry timeout. The STA might retry to associate even if the RSSI hasn't improved if the retry timeout expired. Signed-off-by: Beni Lev <beni.lev@intel.com>
2017-08-21 18:43:53 +02:00
if (hapd->iconf->rssi_reject_assoc_rssi && rssi &&
OCE: RSSI-based rejection to consider Authentication frames (AP) Try to make RSSI-based rejection of associating stations a bit less likely to trigger false rejections by considering RSSI from the last received Authentication frame. Association is rejected only if both the Authentication and (Re)Association Request frames are below the RSSI threshold. Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-01 17:17:02 +01:00
rssi < hapd->iconf->rssi_reject_assoc_rssi &&
(sta->auth_rssi == 0 ||
sta->auth_rssi < hapd->iconf->rssi_reject_assoc_rssi)) {
OCE: Add RSSI based association rejection support (AP) An AP might reject a STA association request due to low RSSI. In such case, the AP informs the STA the desired RSSI improvement and a retry timeout. The STA might retry to associate even if the RSSI hasn't improved if the retry timeout expired. Signed-off-by: Beni Lev <beni.lev@intel.com>
2017-08-21 18:43:53 +02:00
resp = WLAN_STATUS_DENIED_POOR_CHANNEL_CONDITIONS;
goto fail;
}
hostapd: Add MBO IE to Beacon, Probe Response, Association Response Add MBO IE with AP capability attribute to Beacon, Probe Response, and (Re)Association Response frames to indicate the AP supports MBO. Add option to add Association Disallowed attribute to Beacon, Probe Response, and (Re)Association Response frames. Usage: SET mbo_assoc_disallow <reason code> Valid reason code values are between 1-5. Setting the reason code to 0 will remove the Association Disallowed attribute from the MBO IE and will allow new associations. MBO functionality is enabled by setting "mbo=1" in the config file. Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-15 15:53:52 +01:00
#endif /* CONFIG_MBO */
hostapd: Save RM enabled capability of station Save RM enabled capability element of an associating station if radio measurement is supported in its capability field. Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-04-06 18:42:10 +02:00
/*
* sta->capability is used in check_assoc_ies() for RRM enabled
* capability element.
*/
sta->capability = capab_info;
FILS: Decrypt Association Request elements and check Key-Auth (AP) Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-09 00:27:22 +02:00
#ifdef CONFIG_FILS
if (sta->auth_alg == WLAN_AUTH_FILS_SK ||
sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
sta->auth_alg == WLAN_AUTH_FILS_PK) {
FILS: Do not leave error value in left counter If fils_decrypt_assoc() were to fail on the AP side, the previous implementation could have continued through the response generation using left = -1. That could have resulted in unexpected processing if this value were to be used as the length of the remaining (unencrypted) IEs. Fix this by not updating left in the failure case. Fixes: 78815f3dde6e ("FILS: Decrypt Association Request elements and check Key-Auth (AP)") Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-11-24 11:21:18 +01:00
int res;
FILS: Decrypt Association Request elements and check Key-Auth (AP) Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-09 00:27:22 +02:00
/* The end of the payload is encrypted. Need to decrypt it
* before parsing. */
Use os_memdup() This leads to cleaner code overall, and also reduces the size of the hostapd and wpa_supplicant binaries (in hwsim test build on x86_64) by about 2.5 and 3.5KiB respectively. The mechanical conversions all over the code were done with the following spatch: @@ expression SIZE, SRC; expression a; @@ -a = os_malloc(SIZE); +a = os_memdup(SRC, SIZE); <... if (!a) {...} ...> -os_memcpy(a, SRC, SIZE); Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-03-07 10:17:23 +01:00
tmp = os_memdup(pos, left);
FILS: Decrypt Association Request elements and check Key-Auth (AP) Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-09 00:27:22 +02:00
if (!tmp) {
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
}
FILS: Do not leave error value in left counter If fils_decrypt_assoc() were to fail on the AP side, the previous implementation could have continued through the response generation using left = -1. That could have resulted in unexpected processing if this value were to be used as the length of the remaining (unencrypted) IEs. Fix this by not updating left in the failure case. Fixes: 78815f3dde6e ("FILS: Decrypt Association Request elements and check Key-Auth (AP)") Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-11-24 11:21:18 +01:00
res = fils_decrypt_assoc(sta->wpa_sm, sta->fils_session, mgmt,
len, tmp, left);
if (res < 0) {
FILS: Decrypt Association Request elements and check Key-Auth (AP) Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-09 00:27:22 +02:00
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
}
pos = tmp;
FILS: Do not leave error value in left counter If fils_decrypt_assoc() were to fail on the AP side, the previous implementation could have continued through the response generation using left = -1. That could have resulted in unexpected processing if this value were to be used as the length of the remaining (unencrypted) IEs. Fix this by not updating left in the failure case. Fixes: 78815f3dde6e ("FILS: Decrypt Association Request elements and check Key-Auth (AP)") Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-11-24 11:21:18 +01:00
left = res;
FILS: Decrypt Association Request elements and check Key-Auth (AP) Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-09 00:27:22 +02:00
}
#endif /* CONFIG_FILS */
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
/* followed by SSID and Supported rates; and HT capabilities if 802.11n
* is used */
resp = check_assoc_ies(hapd, sta, pos, left, reassoc);
if (resp != WLAN_STATUS_SUCCESS)
goto fail;
FT: Omit RSNXE from FT protocol Reassociation Response when needed The previous design for adding RSNXE into FT was not backwards compatible. Move to a new design based on 20/332r3 to avoid that issue by not include RSNXE in the FT protocol Reassociation Response frame so that a STA not supporting RSNXE can still validate the FTE MIC correctly. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-20 20:56:44 +01:00
omit_rsnxe = !get_ie(pos, left, WLAN_EID_RSNX);
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
if (hostapd_get_aid(hapd, sta) < 0) {
hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO, "No room for more AIDs");
resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
goto fail;
}
sta->listen_interval = listen_interval;
Check hostapd current_mode before dereferencing it in additional places While most places using this should be for cases where the hw_features functionality is required, there seem to be some paths that are getting exposed in new OWE related operations where that might not be the case. Add explicit NULL pointer checks to avoid dereferencing the pointer if it is not set when operating with driver wrappers that do not provide sufficient information. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-30 22:17:05 +01:00
if (hapd->iface->current_mode &&
hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G)
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
sta->flags |= WLAN_STA_NONERP;
for (i = 0; i < sta->supported_rates_len; i++) {
if ((sta->supported_rates[i] & 0x7f) > 22) {
sta->flags &= ~WLAN_STA_NONERP;
break;
}
}
if (sta->flags & WLAN_STA_NONERP && !sta->nonerp_set) {
sta->nonerp_set = 1;
hapd->iface->num_sta_non_erp++;
if (hapd->iface->num_sta_non_erp == 1)
ieee802_11_set_beacons(hapd->iface);
}
if (!(sta->capability & WLAN_CAPABILITY_SHORT_SLOT_TIME) &&
!sta->no_short_slot_time_set) {
sta->no_short_slot_time_set = 1;
hapd->iface->num_sta_no_short_slot_time++;
Check hostapd current_mode before dereferencing it in additional places While most places using this should be for cases where the hw_features functionality is required, there seem to be some paths that are getting exposed in new OWE related operations where that might not be the case. Add explicit NULL pointer checks to avoid dereferencing the pointer if it is not set when operating with driver wrappers that do not provide sufficient information. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-30 22:17:05 +01:00
if (hapd->iface->current_mode &&
hapd->iface->current_mode->mode ==
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
HOSTAPD_MODE_IEEE80211G &&
hapd->iface->num_sta_no_short_slot_time == 1)
ieee802_11_set_beacons(hapd->iface);
}
if (sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
sta->flags |= WLAN_STA_SHORT_PREAMBLE;
else
sta->flags &= ~WLAN_STA_SHORT_PREAMBLE;
if (!(sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) &&
!sta->no_short_preamble_set) {
sta->no_short_preamble_set = 1;
hapd->iface->num_sta_no_short_preamble++;
Check hostapd current_mode before dereferencing it in additional places While most places using this should be for cases where the hw_features functionality is required, there seem to be some paths that are getting exposed in new OWE related operations where that might not be the case. Add explicit NULL pointer checks to avoid dereferencing the pointer if it is not set when operating with driver wrappers that do not provide sufficient information. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-30 22:17:05 +01:00
if (hapd->iface->current_mode &&
hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
&& hapd->iface->num_sta_no_short_preamble == 1)
ieee802_11_set_beacons(hapd->iface);
}
Split handle_assoc() into number of helper functions
2009-11-29 21:14:57 +01:00
update_ht_state(hapd, sta);
Add preliminary IEEE 802.11n support into hostapd This commit brings in cleaned up version of IEEE 802.11n implementation from Intel (1). The Intel tarball includes number of other changes, too, and only the changes specific to IEEE 802.11n are brought in here. In addition, this does not include all the changes (e.g., some of the configuration parameters are still missing and driver wrapper changes for mac80211 were not included). (1) http://www.kernel.org/pub/linux/kernel/people/chuyee/wireless/iwl4965_ap/hostap_0_6_0_intel_0.0.13.1.tgz
2008-08-21 17:18:38 +02:00
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
"association OK (aid %d)", sta->aid);
/* Station will be marked associated, after it acknowledges AssocResp
*/
Add workaround for race condition with AssocResp TX status It may take some time for the TX status to be delivered for a (Re)Association Response frame and if any Data frames are received during that time, they may end up getting dropped as Class 3 frames in not-associated state. This results in a Disassociation frame being sent to the station and it assuming that the association has been lost. Work around the issue by remembering that the (Re)Association Request has already been accepted and skip the Deauth/Disassoc sending because of the possible Class 3 frames before the TX status callback is received.
2011-04-15 18:26:28 +02:00
sta->flags |= WLAN_STA_ASSOC_REQ_OK;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
Added a TODO item for sending protected Disassoc after failed SA Query
2008-12-26 14:56:30 +01:00
if ((sta->flags & WLAN_STA_MFP) && sta->sa_query_timed_out) {
wpa_printf(MSG_DEBUG, "Allowing %sassociation after timed out "
"SA Query procedure", reassoc ? "re" : "");
/* TODO: Send a protected Disassociate frame to the STA using
* the old key and Reason Code "Previous Authentication no
* longer valid". Make sure this is only sent protected since
* unprotected frame would be received by the STA that is now
* trying to associate.
*/
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
/* Make sure that the previously registered inactivity timer will not
* remove the STA immediately. */
sta->timeout_next = STA_NULLFUNC;
Passive Client Taxonomy Implement the signature mechanism described in the paper "Passive Taxonomy of Wifi Clients using MLME Frame Contents" published by Denton Gentry and Avery Pennarun. http://research.google.com/pubs/pub45429.html https://arxiv.org/abs/1608.01725 This involves: 1. Add a CONFIG_TAXONOMY compile option. Enabling taxonomy incurs a memory overhead of up to several kilobytes per associated station. 2. If enabled, store the Probe Request and (Re)Associate Request frame in struct sta_info. 3. Implement code to extract the ID of each Information Element, plus selected fields and bitmasks from certain IEs, into a descriptive text string. This is done in a new source file, src/ap/taxonomy.c. 4. Implement a "signature qq:rr:ss:tt:uu:vv" command in hostapd_cli to retrieve the signature. Signatures take the form of a text string. For example, a signature for the Nexus 5X is: wifi4|probe:0,1,127,45,191,htcap:01ef,htagg:03,htmcs:0000ffff,vhtcap:338061b2, vhtrxmcs:030cfffa,vhttxmcs:030cfffa,extcap:00000a0201000040|assoc:0,1,48,45, 221(0050f2,2),191,127,htcap:01ef,htagg:03,htmcs:0000ffff,vhtcap:339071b2, vhtrxmcs:030cfffa,vhttxmcs:030cfffa,extcap:0000000000000040 Signed-off-by: dgentry@google.com (Denton Gentry) Signed-off-by: denny@geekhold.com (Denton Gentry) Signed-off-by: rofrankel@google.com (Richard Frankel) Signed-off-by: richard@frankel.tv (Richard Frankel)
2016-08-15 06:42:48 +02:00
#ifdef CONFIG_TAXONOMY
taxonomy_sta_info_assoc_req(hapd, sta, pos, left);
#endif /* CONFIG_TAXONOMY */
Fix race condition between AssocResp callback and 4addr event It is apparently possible for the NL80211_CMD_UNEXPECTED_4ADDR_FRAME event to be delivered to hostapd before the NL80211_CMD_FRAME_TX_STATUS event for (Re)Association Response frame. This resulted in the 4-address WDS mode not getting enabled for a STA. This could occur in particular when operating under heavy load and the STA is reconnecting to the same AP in a sequence where Deauthentication frame is followed immediately by Authentication frame and the driver event processing gets delayed due to removal of the previous netdev taking time in the middle of this sequence. Fix this by recording a pending item for 4-address WDS enabling if the NL80211_CMD_UNEXPECTED_4ADDR_FRAME event would have been dropped due to incompleted association and then process this pending item if the TX status for the (Re)Association Response frame is received and it shows that the frame was acknowledged. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-12-20 00:30:09 +01:00
sta->pending_wds_enable = 0;
FILS: Parse received FILS HLP requests This adds parsing of received FILS HLP requests from (Re)Association Request frames. The reassembled requests are verified to be in valid format and are printed in debug output. However, actual processing or forwarding of the packets is not yet implemented, i.e., the vendor specific frame filtering logic is for now practically dropping all HLP requests. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-29 13:09:51 +01:00
#ifdef CONFIG_FILS
if (sta->auth_alg == WLAN_AUTH_FILS_SK ||
sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
sta->auth_alg == WLAN_AUTH_FILS_PK) {
if (fils_process_hlp(hapd, sta, pos, left) > 0)
delay_assoc = 1;
}
FILS: Parse received FILS HLP requests This adds parsing of received FILS HLP requests from (Re)Association Request frames. The reassembled requests are verified to be in valid format and are printed in debug output. However, actual processing or forwarding of the packets is not yet implemented, i.e., the vendor specific frame filtering logic is for now practically dropping all HLP requests. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-29 13:09:51 +01:00
#endif /* CONFIG_FILS */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
fail:
AP: Check ACL upon association request for 802.11ad With device_ap_sme disabled, ACL was checked upon authentication request. In 802.11ad there is no authentication phase so need to check ACL upon association. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2017-01-17 13:51:02 +01:00
AP: Set STA assoc flag in the driver before sending Assoc Resp frame Previously, stations were added to the driver only after the (Re)Association Response frame was acked. In the time period between the station has acked the (Re)Association Response frame and the time the station was added to the kernel, the station can already start sending Data frames, which will be dropped by the hardware/driver. In addition to the data loss, the driver may ignore NDPs with PM bit set from this STA. Fix this by setting/adding the STA with associated flag set to the driver before the AP sends the (Re)Association Response frame with status success. If the (Re)Association Response frame wasn't acked, remove the station from the driver. Note that setting a station to associated state before the non-AP station acknowledges the (Re)Association Response frame is not compliant with the IEEE 802.11 standard that specifically states that a non-AP station should transition to authenticated/associated state only after it acknowledged the (Re)Association Response frame. However, this is a justifiable simplification to work around the issue described above since 1. The station will be removed in case it does not acknowledge the (Re)Association Response frame. 2. All Data frames would be dropped until the station is set to authorized state and there are no known issues with processing the other Class 3 frames during the short window before the acknowledgement is seen. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2016-02-16 10:54:33 +01:00
/*
* In case of a successful response, add the station to the driver.
* Otherwise, the kernel may ignore Data frames before we process the
* ACK frame (TX status). In case of a failure, this station will be
* removed.
*
* Note that this is not compliant with the IEEE 802.11 standard that
* states that a non-AP station should transition into the
* authenticated/associated state only after the station acknowledges
* the (Re)Association Response frame. However, still do this as:
*
* 1. In case the station does not acknowledge the (Re)Association
* Response frame, it will be removed.
* 2. Data frames will be dropped in the kernel until the station is
* set into authorized state, and there are no significant known
* issues with processing other non-Data Class 3 frames during this
* window.
*/
FT: Allow STA entry to be removed/re-added with FT-over-the-DS FT-over-the-DS has a special case where the STA entry (and as such, the TK) has not yet been configured to the driver depending on which driver interface is used. For that case, allow add-STA operation to be used (instead of set-STA). This is needed to allow mac80211-based drivers to accept the STA parameter configuration. Since this is after a new FT-over-DS exchange, a new TK has been derived after the last STA entry was added to the driver, so key reinstallation is not a concern for this case. Fixes: 0e3bd7ac684a ("hostapd: Avoid key reinstallation in FT handshake") Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-04 21:58:56 +01:00
if (resp == WLAN_STATUS_SUCCESS && sta &&
add_associated_sta(hapd, sta, reassoc))
AP: Set STA assoc flag in the driver before sending Assoc Resp frame Previously, stations were added to the driver only after the (Re)Association Response frame was acked. In the time period between the station has acked the (Re)Association Response frame and the time the station was added to the kernel, the station can already start sending Data frames, which will be dropped by the hardware/driver. In addition to the data loss, the driver may ignore NDPs with PM bit set from this STA. Fix this by setting/adding the STA with associated flag set to the driver before the AP sends the (Re)Association Response frame with status success. If the (Re)Association Response frame wasn't acked, remove the station from the driver. Note that setting a station to associated state before the non-AP station acknowledges the (Re)Association Response frame is not compliant with the IEEE 802.11 standard that specifically states that a non-AP station should transition to authenticated/associated state only after it acknowledged the (Re)Association Response frame. However, this is a justifiable simplification to work around the issue described above since 1. The station will be removed in case it does not acknowledge the (Re)Association Response frame. 2. All Data frames would be dropped until the station is set to authorized state and there are no known issues with processing the other Class 3 frames during the short window before the acknowledgement is seen. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2016-02-16 10:54:33 +01:00
resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
#ifdef CONFIG_FILS
FILS: Do not process FILS HLP request again while previous one is pending It is better not to process a new (most likely repeated) FILS HLP request if a station retransmits (Re)Association Request frame before the previous HLP response has either been received or timed out. The previous implementation ended up doing this and also ended up rescheduling the fils_hlp_timeout timer in a manner that prevented the initial timeout from being reached if the STA continued retransmitting the frame. This could result in failed association due to a timeout on the station side. Make this more robust by processing (and relaying to the server) the HLP request once and then ignoring any new HLP request while the response for the relayed request is still pending. The new (Re)Association Request frames are otherwise processed, but they do not result in actual state change on the AP side before the HLP process from the first pending request is completed. This fixes hwsim test case fils_sk_hlp_oom failures with unmodified mac80211 implementation (i.e., with a relatively short retransmission timeout for (Re)Association Request frame). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-12-07 15:03:40 +01:00
if (sta && delay_assoc && resp == WLAN_STATUS_SUCCESS &&
eloop_is_timeout_registered(fils_hlp_timeout, hapd, sta) &&
sta->fils_pending_assoc_req) {
/* Do not reschedule fils_hlp_timeout in case the station
* retransmits (Re)Association Request frame while waiting for
* the previously started FILS HLP wait, so that the timeout can
* be determined from the first pending attempt. */
wpa_printf(MSG_DEBUG,
"FILS: Continue waiting for HLP processing before sending (Re)Association Response frame to "
MACSTR, MAC2STR(sta->addr));
os_free(tmp);
return;
}
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
if (sta) {
eloop_cancel_timeout(fils_hlp_timeout, hapd, sta);
os_free(sta->fils_pending_assoc_req);
sta->fils_pending_assoc_req = NULL;
sta->fils_pending_assoc_req_len = 0;
wpabuf_free(sta->fils_hlp_resp);
sta->fils_hlp_resp = NULL;
}
if (sta && delay_assoc && resp == WLAN_STATUS_SUCCESS) {
sta->fils_pending_assoc_req = tmp;
sta->fils_pending_assoc_req_len = left;
sta->fils_pending_assoc_is_reassoc = reassoc;
FILS: Add HLP support with driver-based AP SME This allows HLP processing to postpone association processing in hostapd_notify_assoc(). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-06 12:57:54 +02:00
sta->fils_drv_assoc_finish = 0;
FILS: DHCP relay for HLP requests The new dhcp_server configuration parameter can now be used to configure hostapd to act as a DHCP relay for DHCPDISCOVER messages received as FILS HLP requests. The dhcp_rapid_commit_proxy=1 parameter can be used to configure hostapd to convert 4 message DHCP exchange into a 2 message exchange in case the DHCP server does not support DHCP rapid commit option. The fils_hlp_wait_time parameter can be used to set the time hostapd waits for an HLP response. This matches the dot11HLPWaitTime in IEEE Std 802.11ai-2016. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-31 13:38:44 +01:00
wpa_printf(MSG_DEBUG,
"FILS: Waiting for HLP processing before sending (Re)Association Response frame to "
MACSTR, MAC2STR(sta->addr));
eloop_cancel_timeout(fils_hlp_timeout, hapd, sta);
eloop_register_timeout(0, hapd->conf->fils_hlp_wait_time * 1024,
fils_hlp_timeout, hapd, sta);
return;
}
#endif /* CONFIG_FILS */
FT: Discard ReassocReq with mismatching RSNXE Used value Discard the FT Reassociation Request frame instead of rejecting it (i.e., do not send Reassociation Response frame) if RSNXE Used is indicated in FTE, but no RSNXE is included even though the AP is advertising RSNXE. While there is not really much of a difference between discarding and rejecting the frame, this discarding behavior is what the standard says for this type of an error case. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-14 12:46:00 +02:00
if (resp >= 0)
reply_res = send_assoc_resp(hapd, sta, mgmt->sa, resp, reassoc,
pos, left, rssi, omit_rsnxe);
FILS: Decrypt Association Request elements and check Key-Auth (AP) Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-09 00:27:22 +02:00
os_free(tmp);
AP: Set STA assoc flag in the driver before sending Assoc Resp frame Previously, stations were added to the driver only after the (Re)Association Response frame was acked. In the time period between the station has acked the (Re)Association Response frame and the time the station was added to the kernel, the station can already start sending Data frames, which will be dropped by the hardware/driver. In addition to the data loss, the driver may ignore NDPs with PM bit set from this STA. Fix this by setting/adding the STA with associated flag set to the driver before the AP sends the (Re)Association Response frame with status success. If the (Re)Association Response frame wasn't acked, remove the station from the driver. Note that setting a station to associated state before the non-AP station acknowledges the (Re)Association Response frame is not compliant with the IEEE 802.11 standard that specifically states that a non-AP station should transition to authenticated/associated state only after it acknowledged the (Re)Association Response frame. However, this is a justifiable simplification to work around the issue described above since 1. The station will be removed in case it does not acknowledge the (Re)Association Response frame. 2. All Data frames would be dropped until the station is set to authorized state and there are no known issues with processing the other Class 3 frames during the short window before the acknowledgement is seen. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2016-02-16 10:54:33 +01:00
/*
Fix a typo in a comment Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-09-22 22:31:20 +02:00
* Remove the station in case transmission of a success response fails
AP: Set STA assoc flag in the driver before sending Assoc Resp frame Previously, stations were added to the driver only after the (Re)Association Response frame was acked. In the time period between the station has acked the (Re)Association Response frame and the time the station was added to the kernel, the station can already start sending Data frames, which will be dropped by the hardware/driver. In addition to the data loss, the driver may ignore NDPs with PM bit set from this STA. Fix this by setting/adding the STA with associated flag set to the driver before the AP sends the (Re)Association Response frame with status success. If the (Re)Association Response frame wasn't acked, remove the station from the driver. Note that setting a station to associated state before the non-AP station acknowledges the (Re)Association Response frame is not compliant with the IEEE 802.11 standard that specifically states that a non-AP station should transition to authenticated/associated state only after it acknowledged the (Re)Association Response frame. However, this is a justifiable simplification to work around the issue described above since 1. The station will be removed in case it does not acknowledge the (Re)Association Response frame. 2. All Data frames would be dropped until the station is set to authorized state and there are no known issues with processing the other Class 3 frames during the short window before the acknowledgement is seen. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2016-02-16 10:54:33 +01:00
* (the STA was added associated to the driver) or if the station was
* previously added unassociated.
*/
AP: Skip authentication/deauthentication phase for DMG/IEEE 802.11ad Authentication and Deauthentication frames are not used in DMG/IEEE 802.11ad networks. For DMG/IEEE 802.11ad the following was implemented: Upon receiving association request, allocate the sta object and initialize it as if authentication took place. Upon receiving disassociation, deallocate the sta object. ap_sta_disassociate/ap_sta_deauthenticate/ap_sta_disconnect all use disassociation instead of deauthentication. In driver_nl80211, i802_sta_deauth() is routed to i802_sta_disassoc(). Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-12-26 20:00:51 +01:00
if (sta && ((reply_res != WLAN_STATUS_SUCCESS &&
resp == WLAN_STATUS_SUCCESS) || sta->added_unassoc)) {
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
hostapd_drv_sta_remove(hapd, sta->addr);
sta->added_unassoc = 0;
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
static void handle_disassoc(struct hostapd_data *hapd,
Use generic driver events for TX status and RX reporting Replace driver wrapper calls to hostapd_tx_status(), hostapd_rx_from_unknown_sta(), hostapd_mgmt_rx(), and hostapd_mgmt_tx_cb() with new generic driver events EVENT_TX_STATUS, EVENT_RX_FROM_UNKNOWN, and EVENT_RX_MGMT. This cleans up lot of the driver wrapper code to be less dependent on whether it is being used within wpa_supplicant AP mode or hostapd.
2009-12-13 22:05:39 +01:00
const struct ieee80211_mgmt *mgmt, size_t len)
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
{
struct sta_info *sta;
if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.disassoc)) {
Convert perror/printf calls to wpa_printf This makes debug and error logging more consistent and allows them to be directed to a file more easily. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 11:51:30 +01:00
wpa_printf(MSG_INFO, "handle_disassoc - too short payload (len=%lu)",
(unsigned long) len);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
return;
}
wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d",
MAC2STR(mgmt->sa),
le_to_host16(mgmt->u.disassoc.reason_code));
sta = ap_get_sta(hapd, mgmt->sa);
if (sta == NULL) {
Convert perror/printf calls to wpa_printf This makes debug and error logging more consistent and allows them to be directed to a file more easily. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 11:51:30 +01:00
wpa_printf(MSG_INFO, "Station " MACSTR " trying to disassociate, but it is not associated",
MAC2STR(mgmt->sa));
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
return;
}
Move AP events for STA connected/disconnected into one function Instead of trying to remember to add wpa_msg() calls for every possible path where a STA becomes authorized or unauthorized, use ap_sta_set_authorized() to send these events more consistently. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-03 21:17:41 +01:00
ap_sta_set_authorized(hapd, sta, 0);
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ;
Add workaround for race condition with AssocResp TX status It may take some time for the TX status to be delivered for a (Re)Association Response frame and if any Data frames are received during that time, they may end up getting dropped as Class 3 frames in not-associated state. This results in a Disassociation frame being sent to the station and it assuming that the association has been lost. Work around the issue by remembering that the (Re)Association Request has already been accepted and skip the Deauth/Disassoc sending because of the possible Class 3 frames before the TX status callback is received.
2011-04-15 18:26:28 +02:00
sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK);
Update STA flags to the driver immediately on disconnection hostapd (and wpa_supplicant in AP mode) was internally updating the STA flags on disconnection cases to remove authorization and association. However, some cases did not result in immediate update of the driver STA entry. Update all such cases to send out the update to the driver as well to reduce risk of race conditions where new frames might be accepted for TX or RX after the port authorization or association has been lost and configured keys are removed. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-18 11:41:46 +01:00
hostapd_set_sta_flags(hapd, sta);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO, "disassociated");
sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
/* Stop Accounting and IEEE 802.1X sessions, but leave the STA
* authenticated. */
accounting_sta_stop(hapd, sta);
HS 2.0: Postpone WNM-Notification sending by 100 ms This makes it somewhat easier for the station to be able to receive and process the encrypted WNM-Notification frames that the AP previously sentt immediately after receiving EAPOL-Key msg 4/4. While the station is supposed to have the TK configured for receive before sending out EAPOL-Key msg 4/4, not many actual implementations do that. As such, there is a race condition in being able to configure the key at the station and the AP sending out the first encrypted frame after EAPOL-Key 4/4. The extra 100 ms time here makes it more likely for the station to have managed to configure the key in time. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-31 20:46:08 +01:00
ieee802_1x_free_station(hapd, sta);
AP: Add support for Proxy ARP, DHCP snooping mechanism Proxy ARP allows the AP devices to keep track of the hardware address to IP address mapping of the STA devices within the BSS. When a request for such information is made (i.e., ARP request, Neighbor Solicitation), the AP will respond on behalf of the STA device within the BSS. Such requests could originate from a device within the BSS or also from the bridge. In the process of the AP replying to the request (i.e., ARP reply, Neighbor Advertisement), the AP will drop the original request frame. The relevant STA will not even know that such information was ever requested. This feature is a requirement for Hotspot 2.0, and is defined in IEEE Std 802.11-2012, 10.23.13. While the Proxy ARP support code mainly resides in the kernel bridge code, in order to optimize the performance and simplify kernel implementation, the DHCP snooping code was added to the hostapd. Signed-off-by: Kyeyoon Park <kyeyoonp@qca.qualcomm.com>
2014-09-26 07:32:55 +02:00
if (sta->ipaddr)
AP: Extend the BSS bridge neighbor entry management to support IPv6 This allows adding/deleting an IPv6 neighbor entry to/from the bridge, to which the BSS belongs. This commit adds the needed functionality in driver_nl80211.c for the Linux bridge implementation. In theory, this could be shared with multiple Linux driver interfaces, but for now, only the main nl80211 interface is supported. Signed-off-by: Kyeyoon Park <kyeyoonp@qca.qualcomm.com>
2014-11-06 01:15:46 +01:00
hostapd_drv_br_delete_ip_neigh(hapd, 4, (u8 *) &sta->ipaddr);
AP: Add Neighbor Discovery snooping mechanism for Proxy ARP This commit establishes the infrastructure, and handles the Neighbor Solicitation and Neighbor Advertisement frames. This will be extended in the future to handle other frames. Signed-off-by: Kyeyoon Park <kyeyoonp@qca.qualcomm.com>
2014-11-01 07:33:41 +01:00
ap_sta_ip6addr_del(hapd, sta);
hostapd_driver_ops reduction set_sta_vlan, get_inact_sec, sta_deauth, sta_disassoc, and sta_remove to use inline functions instead of extra abstraction.
2010-11-24 14:36:02 +01:00
hostapd_drv_sta_remove(hapd, sta->addr);
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
sta->added_unassoc = 0;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (sta->timeout_next == STA_NULLFUNC ||
sta->timeout_next == STA_DISASSOC) {
sta->timeout_next = STA_DEAUTH;
eloop_cancel_timeout(ap_handle_timer, hapd, sta);
eloop_register_timeout(AP_DEAUTH_DELAY, 0, ap_handle_timer,
hapd, sta);
}
mlme_disassociate_indication(
hapd, sta, le_to_host16(mgmt->u.disassoc.reason_code));
AP: Skip authentication/deauthentication phase for DMG/IEEE 802.11ad Authentication and Deauthentication frames are not used in DMG/IEEE 802.11ad networks. For DMG/IEEE 802.11ad the following was implemented: Upon receiving association request, allocate the sta object and initialize it as if authentication took place. Upon receiving disassociation, deallocate the sta object. ap_sta_disassociate/ap_sta_deauthenticate/ap_sta_disconnect all use disassociation instead of deauthentication. In driver_nl80211, i802_sta_deauth() is routed to i802_sta_disassoc(). Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-12-26 20:00:51 +01:00
/* DMG/IEEE 802.11ad does not use deauthication. Deallocate sta upon
* disassociation. */
if (hapd->iface->current_mode &&
hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211AD) {
sta->flags &= ~WLAN_STA_AUTH;
wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH);
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG, "deauthenticated");
ap_free_sta(hapd, sta);
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
static void handle_deauth(struct hostapd_data *hapd,
Use generic driver events for TX status and RX reporting Replace driver wrapper calls to hostapd_tx_status(), hostapd_rx_from_unknown_sta(), hostapd_mgmt_rx(), and hostapd_mgmt_tx_cb() with new generic driver events EVENT_TX_STATUS, EVENT_RX_FROM_UNKNOWN, and EVENT_RX_MGMT. This cleans up lot of the driver wrapper code to be less dependent on whether it is being used within wpa_supplicant AP mode or hostapd.
2009-12-13 22:05:39 +01:00
const struct ieee80211_mgmt *mgmt, size_t len)
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
{
struct sta_info *sta;
if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.deauth)) {
Fix some recent wpa_msg() calls in hostapd use correct context wpa_msg() has to use hapd->msg_ctx instead of hapd as the context pointer to work properly in wpa_supplicant AP mode. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-03 21:04:17 +01:00
wpa_msg(hapd->msg_ctx, MSG_DEBUG, "handle_deauth - too short "
"payload (len=%lu)", (unsigned long) len);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
return;
}
Fix some recent wpa_msg() calls in hostapd use correct context wpa_msg() has to use hapd->msg_ctx instead of hapd as the context pointer to work properly in wpa_supplicant AP mode. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-03 21:04:17 +01:00
wpa_msg(hapd->msg_ctx, MSG_DEBUG, "deauthentication: STA=" MACSTR
AP: Update logging related to inactivity and disassociation Add MAC addresses for stations and use wpa_msg instead of printf methods to make it easier to grep logs and find messages for the station in question. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 16:44:45 +01:00
" reason_code=%d",
MAC2STR(mgmt->sa), le_to_host16(mgmt->u.deauth.reason_code));
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
AP: Handle deauthentication frame from PASN station When a Deauthentication frame is received, clear the corresponding PTKSA cache entry for the given station, to invalidate previous PTK information. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:10 +01:00
/* Clear the PTKSA cache entries for PASN */
ptksa_cache_flush(hapd->ptksa, mgmt->sa, WPA_CIPHER_NONE);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
sta = ap_get_sta(hapd, mgmt->sa);
if (sta == NULL) {
Fix some recent wpa_msg() calls in hostapd use correct context wpa_msg() has to use hapd->msg_ctx instead of hapd as the context pointer to work properly in wpa_supplicant AP mode. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-03 21:04:17 +01:00
wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying "
"to deauthenticate, but it is not authenticated",
AP: Update logging related to inactivity and disassociation Add MAC addresses for stations and use wpa_msg instead of printf methods to make it easier to grep logs and find messages for the station in question. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 16:44:45 +01:00
MAC2STR(mgmt->sa));
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
return;
}
Move AP events for STA connected/disconnected into one function Instead of trying to remember to add wpa_msg() calls for every possible path where a STA becomes authorized or unauthorized, use ap_sta_set_authorized() to send these events more consistently. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-03 21:17:41 +01:00
ap_sta_set_authorized(hapd, sta, 0);
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ;
Add workaround for race condition with AssocResp TX status It may take some time for the TX status to be delivered for a (Re)Association Response frame and if any Data frames are received during that time, they may end up getting dropped as Class 3 frames in not-associated state. This results in a Disassociation frame being sent to the station and it assuming that the association has been lost. Work around the issue by remembering that the (Re)Association Request has already been accepted and skip the Deauth/Disassoc sending because of the possible Class 3 frames before the TX status callback is received.
2011-04-15 18:26:28 +02:00
sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC |
WLAN_STA_ASSOC_REQ_OK);
Update STA flags to the driver immediately on disconnection hostapd (and wpa_supplicant in AP mode) was internally updating the STA flags on disconnection cases to remove authorization and association. However, some cases did not result in immediate update of the driver STA entry. Update all such cases to send out the update to the driver as well to reduce risk of race conditions where new frames might be accepted for TX or RX after the port authorization or association has been lost and configured keys are removed. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-18 11:41:46 +01:00
hostapd_set_sta_flags(hapd, sta);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH);
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG, "deauthenticated");
mlme_deauthenticate_indication(
hapd, sta, le_to_host16(mgmt->u.deauth.reason_code));
sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
ap_free_sta(hapd, sta);
}
static void handle_beacon(struct hostapd_data *hapd,
Mark management frame processing functions to use const buffer
2009-12-13 22:25:30 +01:00
const struct ieee80211_mgmt *mgmt, size_t len,
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
struct hostapd_frame_info *fi)
{
struct ieee802_11_elems elems;
if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.beacon)) {
Convert perror/printf calls to wpa_printf This makes debug and error logging more consistent and allows them to be directed to a file more easily. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 11:51:30 +01:00
wpa_printf(MSG_INFO, "handle_beacon - too short payload (len=%lu)",
(unsigned long) len);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
return;
}
Removed the unused hapd argument to ieee802_11_parse_elems()
2008-10-29 20:33:46 +01:00
(void) ieee802_11_parse_elems(mgmt->u.beacon.variable,
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
len - (IEEE80211_HDRLEN +
sizeof(mgmt->u.beacon)), &elems,
0);
ap_list_process_beacon(hapd->iface, mgmt, &elems, fi);
}
Drop unprotected Robust Action frames from MFP STAs These frames are delivered through mac80211 monitor interface, so we need to filter them out in hostapd.
2009-05-08 11:51:28 +02:00
static int robust_action_frame(u8 category)
{
return category != WLAN_ACTION_PUBLIC &&
category != WLAN_ACTION_HT;
}
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
static int handle_action(struct hostapd_data *hapd,
Report offchannel RX frame frequency to hostapd Not all code paths for management frame RX reporting delivered the correct frequency for offchannel RX cases. This is needed mainly for Public Action frame processing in some special cases where AP is operating, but an exchange is done on a non-operational channel. For example, DPP Initiator role may need to do this. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-01-08 02:37:48 +01:00
const struct ieee80211_mgmt *mgmt, size_t len,
unsigned int freq)
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
{
Drop unprotected Robust Action frames from MFP STAs These frames are delivered through mac80211 monitor interface, so we need to filter them out in hostapd.
2009-05-08 11:51:28 +02:00
struct sta_info *sta;
Use more consistent Action frame RX handling in both AP mode paths Both handle_action() and hostapd_action_rx() are used for processing received Action frames depending on what type of driver architecture is used (MLME in hostapd vs. driver) and which build options were used to build hostapd. These functions had a bit different sequence for checking the frame and printing debug prints. Make those more consistent by checking that the frame includes the category-specific action field and some payload. Add a debug print for both functions to make it easier to see which path various Action frames use. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-01 12:19:47 +01:00
u8 *action __maybe_unused;
Drop unprotected Robust Action frames from MFP STAs These frames are delivered through mac80211 monitor interface, so we need to filter them out in hostapd.
2009-05-08 11:51:28 +02:00
Use more consistent Action frame RX handling in both AP mode paths Both handle_action() and hostapd_action_rx() are used for processing received Action frames depending on what type of driver architecture is used (MLME in hostapd vs. driver) and which build options were used to build hostapd. These functions had a bit different sequence for checking the frame and printing debug prints. Make those more consistent by checking that the frame includes the category-specific action field and some payload. Add a debug print for both functions to make it easier to see which path various Action frames use. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-01 12:19:47 +01:00
if (len < IEEE80211_HDRLEN + 2 + 1) {
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
"handle_action - too short payload (len=%lu)",
(unsigned long) len);
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
return 0;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
Use more consistent Action frame RX handling in both AP mode paths Both handle_action() and hostapd_action_rx() are used for processing received Action frames depending on what type of driver architecture is used (MLME in hostapd vs. driver) and which build options were used to build hostapd. These functions had a bit different sequence for checking the frame and printing debug prints. Make those more consistent by checking that the frame includes the category-specific action field and some payload. Add a debug print for both functions to make it easier to see which path various Action frames use. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-01 12:19:47 +01:00
action = (u8 *) &mgmt->u.action.u;
wpa_printf(MSG_DEBUG, "RX_ACTION category %u action %u sa " MACSTR
" da " MACSTR " len %d freq %u",
mgmt->u.action.category, *action,
MAC2STR(mgmt->sa), MAC2STR(mgmt->da), (int) len, freq);
sta = ap_get_sta(hapd, mgmt->sa);
WNM: Enable WNM-Sleep Mode configuration with hostapd SME/MLME This allows hostapd to process WNM-Sleep Mode Request when using the internal SME/MLME. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-16 18:16:17 +01:00
if (mgmt->u.action.category != WLAN_ACTION_PUBLIC &&
(sta == NULL || !(sta->flags & WLAN_STA_ASSOC))) {
wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignored Action "
"frame (category=%u) from unassociated STA " MACSTR,
Fix "IEEE 802.11: Ignored Action frame" debug message The arguments to printf were in incorrect order which resulted in incorrect STA address in the debug message. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-02-11 11:08:12 +01:00
mgmt->u.action.category, MAC2STR(mgmt->sa));
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
return 0;
WNM: Enable WNM-Sleep Mode configuration with hostapd SME/MLME This allows hostapd to process WNM-Sleep Mode Request when using the internal SME/MLME. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-16 18:16:17 +01:00
}
Drop unprotected Robust Action frames from MFP STAs These frames are delivered through mac80211 monitor interface, so we need to filter them out in hostapd.
2009-05-08 11:51:28 +02:00
if (sta && (sta->flags & WLAN_STA_MFP) &&
hostapd: Fix PMF robust Action frame processing rules Due to misplaced parenthesis, unprotected not-Robust Action frames (e.g., Public Action frames) were dropped in handle_assoc() when such frames were received during an association that had negotiated use of PMF. This is not correct since only unprotected Robust Action frames were supposed to be handled in this way. This would have broken any Public Action frame use during PMF association, but such frames were not really supposed to be used currently (ANQP as the only possible use case should really use protected dual option in such case). Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2014-01-23 09:24:21 +01:00
!(mgmt->frame_control & host_to_le16(WLAN_FC_ISWEP)) &&
robust_action_frame(mgmt->u.action.category)) {
Drop unprotected Robust Action frames from MFP STAs These frames are delivered through mac80211 monitor interface, so we need to filter them out in hostapd.
2009-05-08 11:51:28 +02:00
hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
"Dropped unprotected Robust Action frame from "
"an MFP STA");
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
return 0;
Drop unprotected Robust Action frames from MFP STAs These frames are delivered through mac80211 monitor interface, so we need to filter them out in hostapd.
2009-05-08 11:51:28 +02:00
}
AP: Drop retransmitted auth/assoc/action frames It is possible that a station device might miss an ACK for an authentication, association, or action frame, and thus retransmit the same frame although the frame is already being processed in the stack. While the duplicated frame should really be dropped in the kernel or firmware code where duplicate detection is implemented for data frames, it is possible that pre-association cases are not fully addressed (which is the case at least with mac80211 today) and the frame may be delivered to upper layer stack. In such a case, the local AP will process the retransmitted frame although it has already handled the request, which might cause the station to get confused and as a result disconnect from the AP, blacklist it, etc. To avoid such a case, save the sequence control of the last processed management frame and in case of retransmissions drop them. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-11-05 09:50:34 +01:00
if (sta) {
u16 fc = le_to_host16(mgmt->frame_control);
u16 seq_ctrl = le_to_host16(mgmt->seq_ctrl);
if ((fc & WLAN_FC_RETRY) &&
sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
sta->last_seq_ctrl == seq_ctrl &&
sta->last_subtype == WLAN_FC_STYPE_ACTION) {
hostapd_logger(hapd, sta->addr,
HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
"Drop repeated action frame seq_ctrl=0x%x",
seq_ctrl);
return 1;
}
sta->last_seq_ctrl = seq_ctrl;
sta->last_subtype = WLAN_FC_STYPE_ACTION;
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
switch (mgmt->u.action.category) {
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#ifdef CONFIG_IEEE80211R_AP
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
case WLAN_ACTION_FT:
Make sta NULL-check easier for static analyzers sta == NULL check is already done above based on category != WLAN_ACTION_PUBLIC, but that seems to be too complex for some static analyzers, so avoid invalid reports by explicitly checking for this again in the WLAN_ACTION_FT case. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-04-26 10:51:19 +02:00
if (!sta ||
wpa_ft_action_rx(sta->wpa_sm, (u8 *) &mgmt->u.action,
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
len - IEEE80211_HDRLEN))
break;
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
return 1;
FT: Differentiate between FT for station and for AP in build Previously, CONFIG_IEEE80211R enabled build that supports FT for both station mode and AP mode. However, in most wpa_supplicant cases only station mode FT is required and there is no need for AP mode FT. Add support to differentiate between station mode FT and AP mode FT in wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used when AP mode FT support is required in addition to station mode FT. This allows binary size to be reduced for builds that require only the station side FT functionality. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-27 14:18:32 +02:00
#endif /* CONFIG_IEEE80211R_AP */
Moved WMM action category definition into ieee802_11_defs.h
2008-08-31 10:06:58 +02:00
case WLAN_ACTION_WMM:
WMM cleanup (WME -> WMM rename, comments, etc.) This updates the terminogy to match with the final WMM specification. In addition, some of the WMM TSPEC structure fields were in incorrect order and used without byte order swapping. Those are also taken care of this cleanup patch.
2009-03-04 11:33:24 +01:00
hostapd_wmm_action(hapd, mgmt, len);
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
return 1;
Renamed Ping procedure into SA Query procedure per 802.11w/D7.0 This commit changes just the name and Action category per D7.0. The retransmit/timeout processing in the AP is not yet updated with the changes in D7.0.
2008-12-26 10:46:21 +01:00
case WLAN_ACTION_SA_QUERY:
Move SA Query frame length check to the shared handler function Check the length in the common handler functions instead of both callers. Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-09 11:40:05 +01:00
ieee802_11_sa_query_action(hapd, mgmt, len);
return 1;
WNM: Differentiate between WNM for station and for AP in build Previously, CONFIG_WNM enabled build that supports WNM for both station mode and AP mode. However, in most wpa_supplicant cases only station mode WNM is required and there is no need for AP mode WNM. Add support to differentiate between station mode WNM and AP mode WNM in wpa_supplicant builds by adding CONFIG_WNM_AP that should be used when AP mode WNM support is required in addition to station mode WNM. This allows binary size to be reduced for builds that require only the station side WNM functionality. Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2017-06-12 08:29:27 +02:00
#ifdef CONFIG_WNM_AP
WNM: Enable WNM-Sleep Mode configuration with hostapd SME/MLME This allows hostapd to process WNM-Sleep Mode Request when using the internal SME/MLME. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-16 18:16:17 +01:00
case WLAN_ACTION_WNM:
Remove unnecessary EVENT_RX_ACTION This driver event was used separately for some Action frames, but all the driver wrappers converted to this from information that would have been enough to indicate an EVENT_RX_MGMT event. In addition, the received event was then converted back to a full IEEE 802.11 management frame for processing in most cases. This is unnecessary complexity, so get rid of the extra path and use EVENT_RX_MGMT for Action frames as well as other management frame subtypes. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 10:22:23 +01:00
ieee802_11_rx_wnm_action_ap(hapd, mgmt, len);
return 1;
WNM: Differentiate between WNM for station and for AP in build Previously, CONFIG_WNM enabled build that supports WNM for both station mode and AP mode. However, in most wpa_supplicant cases only station mode WNM is required and there is no need for AP mode WNM. Add support to differentiate between station mode WNM and AP mode WNM in wpa_supplicant builds by adding CONFIG_WNM_AP that should be used when AP mode WNM support is required in addition to station mode WNM. This allows binary size to be reduced for builds that require only the station side WNM functionality. Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2017-06-12 08:29:27 +02:00
#endif /* CONFIG_WNM_AP */
FST: Send FST Action frames to AP mode processing Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-21 14:30:48 +01:00
#ifdef CONFIG_FST
case WLAN_ACTION_FST:
if (hapd->iface->fst)
fst_rx_action(hapd->iface->fst, mgmt, len);
FST: Print reason for ignoring FST Action frame in debug log This makes it easier to understand why some frames are not processed. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-07-25 22:20:33 +02:00
else
wpa_printf(MSG_DEBUG,
"FST: Ignore FST Action frame - no FST attached");
FST: Send FST Action frames to AP mode processing Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-21 14:30:48 +01:00
return 1;
#endif /* CONFIG_FST */
Add wpa_supplicant AP mode events for Public Action frames
2010-04-11 19:33:33 +02:00
case WLAN_ACTION_PUBLIC:
GAS server: Add support for Protected Dual of Public Action frames When GAS is used with PMF negotiated, Protected Dual of Public Action frames are expected to be used instead of Public Action frames, i.e., the GAS/ANQP frames are expected to be encrypted. Add support for this different category of Action frames being used for GAS. The payload after the Category field is identical, so the only change is in using the Category field based on what was received in the request frames. For backwards compatibility, do not enforce protected dual to be used on the AP side, i.e., follow what the station does. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2014-01-23 10:15:28 +01:00
case WLAN_ACTION_PROTECTED_DUAL:
Check Public Action length explicitly before reading Action Code In theory, the previous version could have resulted in reading one byte beyond the end of the management frame RX buffer if the local driver were to deliver a truncated Public Action frame for processing. In practice, this did not seem to happen with mac80211-based drivers and even if it were, the extra octet would be an uninitialized value in a buffer rather than read beyond the end of the buffer. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-03 15:24:01 +02:00
if (len >= IEEE80211_HDRLEN + 2 &&
mgmt->u.action.u.public_action.action ==
Add AP mode support for HT 20/40 co-ex Action frame If a 2.4 GHz band AP receives a 20/40 Coexistence management frame from a connected station with 20/40 BSS Intolerant Channel Report element containing the channel list in which any legacy AP are detected or AP with 40 MHz intolerant bit set in HT Cap IE is detected in the affected range of the BSS, the BSS will be moved from 40 to 20 MHz channel width. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-04-14 20:21:40 +02:00
WLAN_PA_20_40_BSS_COEX) {
hostapd_2040_coex_action(hapd, mgmt, len);
hostapd: Fix handling a 20/40 BSS Coexistence Management frame hostapd processes a received 20/40 BSS Coexistence management frame, but if no separate callbacks are registered for handling Public Action frames it eventually sends a reply with MSB of category code set to 1 thinking that the received frame is an invalid frame. This could happen based on whether hostapd was built and enabled with functionality using the callback functions. Fix this by explicitly returning 1 from the function when the 20/40 BSS Coexistence Management frame is processed. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-05-29 13:13:37 +02:00
return 1;
Add AP mode support for HT 20/40 co-ex Action frame If a 2.4 GHz band AP receives a 20/40 Coexistence management frame from a connected station with 20/40 BSS Intolerant Channel Report element containing the channel list in which any legacy AP are detected or AP with 40 MHz intolerant bit set in HT Cap IE is detected in the affected range of the BSS, the BSS will be moved from 40 to 20 MHz channel width. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-04-14 20:21:40 +02:00
}
DPP: Integration for hostapd This adds DPP bootstrapping, authentication, and configuration into hostapd similarly to how the design was integrated in wpa_supplicant. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-06-15 21:16:45 +02:00
#ifdef CONFIG_DPP
if (len >= IEEE80211_HDRLEN + 6 &&
mgmt->u.action.u.vs_public_action.action ==
WLAN_PA_VENDOR_SPECIFIC &&
WPA_GET_BE24(mgmt->u.action.u.vs_public_action.oui) ==
OUI_WFA &&
mgmt->u.action.u.vs_public_action.variable[0] ==
DPP_OUI_TYPE) {
const u8 *pos, *end;
DPP: Update AES-SIV AD for DPP Authentication frames The protocol design was updated to protect the six octets in the header before the attributes. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-18 21:51:30 +02:00
pos = mgmt->u.action.u.vs_public_action.oui;
DPP: Integration for hostapd This adds DPP bootstrapping, authentication, and configuration into hostapd similarly to how the design was integrated in wpa_supplicant. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-06-15 21:16:45 +02:00
end = ((const u8 *) mgmt) + len;
hostapd_dpp_rx_action(hapd, mgmt->sa, pos, end - pos,
Report offchannel RX frame frequency to hostapd Not all code paths for management frame RX reporting delivered the correct frequency for offchannel RX cases. This is needed mainly for Public Action frame processing in some special cases where AP is operating, but an exchange is done on a non-operational channel. For example, DPP Initiator role may need to do this. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-01-08 02:37:48 +01:00
freq);
DPP: Integration for hostapd This adds DPP bootstrapping, authentication, and configuration into hostapd similarly to how the design was integrated in wpa_supplicant. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-06-15 21:16:45 +02:00
return 1;
}
if (len >= IEEE80211_HDRLEN + 2 &&
(mgmt->u.action.u.public_action.action ==
WLAN_PA_GAS_INITIAL_RESP ||
mgmt->u.action.u.public_action.action ==
WLAN_PA_GAS_COMEBACK_RESP)) {
const u8 *pos, *end;
pos = &mgmt->u.action.u.public_action.action;
end = ((const u8 *) mgmt) + len;
gas_query_ap_rx(hapd->gas, mgmt->sa,
mgmt->u.action.category,
pos, end - pos, hapd->iface->freq);
return 1;
}
#endif /* CONFIG_DPP */
Add wpa_supplicant AP mode events for Public Action frames
2010-04-11 19:33:33 +02:00
if (hapd->public_action_cb) {
hapd->public_action_cb(hapd->public_action_cb_ctx,
(u8 *) mgmt, len,
hapd->iface->freq);
}
P2P: Fix Action frame processing if Interworking is enabled GAS server used the same public_action_cb mechanism as P2P to process Action frames. This ended up overriding P2P processing of Action frames while running an AP/GO interface with a build that enables Interworking (e.g., for Hotspot 2.0) and a driver that uses hostapd for AP mode SME/MLME. Fix this by adding a separate callback registration for the GAS server. This should really be cleaned up by supporting arbitrary number of callback handlers, but for now, this addresses the regression with a minimal change. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2013-02-04 14:38:35 +01:00
if (hapd->public_action_cb2) {
GAS server: Fix a regression in GAS server callback Commit 2d9ffe1e855410839468a75cf6723ee339acdd7e broke GAS server callback for receiving Public Action frames. The incorrect context pointer was used in the public_action_cb2 case. Fix this to use the correct context pointer. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-02-16 18:15:05 +01:00
hapd->public_action_cb2(hapd->public_action_cb2_ctx,
P2P: Fix Action frame processing if Interworking is enabled GAS server used the same public_action_cb mechanism as P2P to process Action frames. This ended up overriding P2P processing of Action frames while running an AP/GO interface with a build that enables Interworking (e.g., for Hotspot 2.0) and a driver that uses hostapd for AP mode SME/MLME. Fix this by adding a separate callback registration for the GAS server. This should really be cleaned up by supporting arbitrary number of callback handlers, but for now, this addresses the regression with a minimal change. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2013-02-04 14:38:35 +01:00
(u8 *) mgmt, len,
hapd->iface->freq);
}
if (hapd->public_action_cb || hapd->public_action_cb2)
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
return 1;
Add wpa_supplicant AP mode events for Public Action frames
2010-04-11 19:33:33 +02:00
break;
P2P: Add P2P configuration and callbacks in hostapd code
2010-07-18 23:30:25 +02:00
case WLAN_ACTION_VENDOR_SPECIFIC:
if (hapd->vendor_action_cb) {
if (hapd->vendor_action_cb(hapd->vendor_action_cb_ctx,
(u8 *) mgmt, len,
hapd->iface->freq) == 0)
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
return 1;
P2P: Add P2P configuration and callbacks in hostapd code
2010-07-18 23:30:25 +02:00
}
break;
hostapd: Handle Neighbor Report Request frame Process Neighbor Report Request frame and send Neighbor Report Response frame based on the configured neighbor report data. Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-04-06 18:42:09 +02:00
case WLAN_ACTION_RADIO_MEASUREMENT:
hostapd_handle_radio_measurement(hapd, (const u8 *) mgmt, len);
return 1;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
"handle_action - unknown action category %d or invalid "
"frame",
mgmt->u.action.category);
ap: Use is_multicast_ether_addr() more Various checks should use is_multicast_ether_addr() instead of hardcoding the equivalent, change it. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-08-16 15:06:59 +02:00
if (!is_multicast_ether_addr(mgmt->da) &&
!(mgmt->u.action.category & 0x80) &&
!is_multicast_ether_addr(mgmt->sa)) {
Mark management frame processing functions to use const buffer
2009-12-13 22:25:30 +01:00
struct ieee80211_mgmt *resp;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
/*
* IEEE 802.11-REVma/D9.0 - 7.3.1.11
* Return the Action frame to the source without change
* except that MSB of the Category set to 1.
*/
wpa_printf(MSG_DEBUG, "IEEE 802.11: Return unknown Action "
"frame back to sender");
Use os_memdup() This leads to cleaner code overall, and also reduces the size of the hostapd and wpa_supplicant binaries (in hwsim test build on x86_64) by about 2.5 and 3.5KiB respectively. The mechanical conversions all over the code were done with the following spatch: @@ expression SIZE, SRC; expression a; @@ -a = os_malloc(SIZE); +a = os_memdup(SRC, SIZE); <... if (!a) {...} ...> -os_memcpy(a, SRC, SIZE); Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-03-07 10:17:23 +01:00
resp = os_memdup(mgmt, len);
Mark management frame processing functions to use const buffer
2009-12-13 22:25:30 +01:00
if (resp == NULL)
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
return 0;
Mark management frame processing functions to use const buffer
2009-12-13 22:25:30 +01:00
os_memcpy(resp->da, resp->sa, ETH_ALEN);
os_memcpy(resp->sa, hapd->own_addr, ETH_ALEN);
os_memcpy(resp->bssid, hapd->own_addr, ETH_ALEN);
resp->u.action.category |= 0x80;
Make hostapd_drv_send_mlme() more generic Merge hostapd_drv_send_mlme_csa() functionality into hostapd_drv_send_mlme() to get a single driver ops handler function for hostapd. In addition, add a new no_encrypt parameter in preparation for functionality that is needed to get rid of the separate send_frame() driver op. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-01-03 12:34:37 +01:00
if (hostapd_drv_send_mlme(hapd, resp, len, 0, NULL, 0, 0) < 0) {
Show an error message if sending of Action frame fails Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-19 17:34:16 +02:00
wpa_printf(MSG_ERROR, "IEEE 802.11: Failed to send "
"Action frame");
}
Mark management frame processing functions to use const buffer
2009-12-13 22:25:30 +01:00
os_free(resp);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
return 1;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
hostapd: Add an option to notify management frames on ctrl_iface In some contexts (e.g., Multi-AP) it can be useful to have access to some of the management frames in upper layers (e.g., to be able to process the content of association requests externally). Add 'notify_mgmt_frames'. When enabled, it will notify the ctrl_iface when a management frame arrives using the AP-MGMT-FRAME-RECEIVED event message. Note that to avoid completely flooding the ctrl_iface, not all management frames are included (e.g., Beacon and Probe Request frames are excluded). Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2020-11-30 12:10:46 +01:00
/**
* notify_mgmt_frame - Notify of Management frames on the control interface
* @hapd: hostapd BSS data structure (the BSS to which the Management frame was
* sent to)
* @buf: Management frame data (starting from the IEEE 802.11 header)
* @len: Length of frame data in octets
*
* Notify the control interface of any received Management frame.
*/
static void notify_mgmt_frame(struct hostapd_data *hapd, const u8 *buf,
size_t len)
{
int hex_len = len * 2 + 1;
char *hex = os_malloc(hex_len);
if (hex) {
wpa_snprintf_hex(hex, hex_len, buf, len);
wpa_msg_ctrl(hapd->msg_ctx, MSG_INFO,
AP_MGMT_FRAME_RECEIVED "buf=%s", hex);
os_free(hex);
}
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
/**
* ieee802_11_mgmt - process incoming IEEE 802.11 management frames
* @hapd: hostapd BSS data structure (the BSS to which the management frame was
* sent to)
* @buf: management frame data (starting from IEEE 802.11 header)
* @len: length of frame data in octets
Fixed number of doxygen warnings
2009-01-02 21:28:04 +01:00
* @fi: meta data about received frame (signal level, etc.)
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
*
* Process all incoming IEEE 802.11 management frames. This will be called for
* each frame received from the kernel driver through wlan#ap interface. In
* addition, it can be called to re-inserted pending frames (e.g., when using
* external RADIUS server as an MAC ACL).
*/
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
int ieee802_11_mgmt(struct hostapd_data *hapd, const u8 *buf, size_t len,
struct hostapd_frame_info *fi)
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
{
Use generic driver events for TX status and RX reporting Replace driver wrapper calls to hostapd_tx_status(), hostapd_rx_from_unknown_sta(), hostapd_mgmt_rx(), and hostapd_mgmt_tx_cb() with new generic driver events EVENT_TX_STATUS, EVENT_RX_FROM_UNKNOWN, and EVENT_RX_MGMT. This cleans up lot of the driver wrapper code to be less dependent on whether it is being used within wpa_supplicant AP mode or hostapd.
2009-12-13 22:05:39 +01:00
struct ieee80211_mgmt *mgmt;
u16 fc, stype;
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
int ret = 0;
Report offchannel RX frame frequency to hostapd Not all code paths for management frame RX reporting delivered the correct frequency for offchannel RX cases. This is needed mainly for Public Action frame processing in some special cases where AP is operating, but an exchange is done on a non-operational channel. For example, DPP Initiator role may need to do this. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-01-08 02:37:48 +01:00
unsigned int freq;
ieee802_11_mgmt: Handle frame info more consistently Check for the fi parameter to be non-NULL before trying to fetch the ssi_signal information similarly to how the fi->freq was already handled. While the meta information is supposed to be available, it looks like there is at least one corner case where fi == NULL could be used (Authentication frame reprocessing after RADIUS-based ACL). Signed-off-by: Jouni Malinen <j@w1.fi>
2018-02-07 11:34:41 +01:00
int ssi_signal = fi ? fi->ssi_signal : 0;
Use generic driver events for TX status and RX reporting Replace driver wrapper calls to hostapd_tx_status(), hostapd_rx_from_unknown_sta(), hostapd_mgmt_rx(), and hostapd_mgmt_tx_cb() with new generic driver events EVENT_TX_STATUS, EVENT_RX_FROM_UNKNOWN, and EVENT_RX_MGMT. This cleans up lot of the driver wrapper code to be less dependent on whether it is being used within wpa_supplicant AP mode or hostapd.
2009-12-13 22:05:39 +01:00
AP: Validate management frame length Make sure that received management frames are long enough before processing them. This avoids a potential segmentation fault if a driver delivers an invalid frame all the way to hostapd.
2011-01-17 11:21:29 +01:00
if (len < 24)
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
return 0;
AP: Validate management frame length Make sure that received management frames are long enough before processing them. This avoids a potential segmentation fault if a driver delivers an invalid frame all the way to hostapd.
2011-01-17 11:21:29 +01:00
Report offchannel RX frame frequency to hostapd Not all code paths for management frame RX reporting delivered the correct frequency for offchannel RX cases. This is needed mainly for Public Action frame processing in some special cases where AP is operating, but an exchange is done on a non-operational channel. For example, DPP Initiator role may need to do this. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-01-08 02:37:48 +01:00
if (fi && fi->freq)
freq = fi->freq;
else
freq = hapd->iface->freq;
Use generic driver events for TX status and RX reporting Replace driver wrapper calls to hostapd_tx_status(), hostapd_rx_from_unknown_sta(), hostapd_mgmt_rx(), and hostapd_mgmt_tx_cb() with new generic driver events EVENT_TX_STATUS, EVENT_RX_FROM_UNKNOWN, and EVENT_RX_MGMT. This cleans up lot of the driver wrapper code to be less dependent on whether it is being used within wpa_supplicant AP mode or hostapd.
2009-12-13 22:05:39 +01:00
mgmt = (struct ieee80211_mgmt *) buf;
fc = le_to_host16(mgmt->frame_control);
stype = WLAN_FC_GET_STYPE(fc);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
AP: Silently ignore management frame from unexpected source address Do not process any received Management frames with unexpected/invalid SA so that we do not add any state for unexpected STA addresses or end up sending out frames to unexpected destination. This prevents unexpected sequences where an unprotected frame might end up causing the AP to send out a response to another device and that other device processing the unexpected response. In particular, this prevents some potential denial of service cases where the unexpected response frame from the AP might result in a connected station dropping its association. Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-29 10:52:04 +02:00
if (is_multicast_ether_addr(mgmt->sa) ||
is_zero_ether_addr(mgmt->sa) ||
os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) {
/* Do not process any frames with unexpected/invalid SA so that
* we do not add any state for unexpected STA addresses or end
* up sending out frames to unexpected destination. */
wpa_printf(MSG_DEBUG, "MGMT: Invalid SA=" MACSTR
" in received frame - ignore this frame silently",
MAC2STR(mgmt->sa));
return 0;
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (stype == WLAN_FC_STYPE_BEACON) {
handle_beacon(hapd, mgmt, len, fi);
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
return 1;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
ap: Use is_broadcast_ether_addr() There's no need to have a separate variable and open-code a more complicated version of this, just use is_broadcast_ether_addr(). Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-08-05 13:31:54 +02:00
if (!is_broadcast_ether_addr(mgmt->bssid) &&
Allow Action frames with unknown BSSID in GO mode P2P invitation responses are transmitted with the BSSID set to the peer address. Pass these action frames up to allow the GO to receive the Invitation Response (and avoid sending the Invitation Request multiple times). Signed-off-by: Arik Nemtsov <arik@wizery.com>
2011-12-04 11:10:11 +01:00
#ifdef CONFIG_P2P
/* Invitation responses can be sent with the peer MAC as BSSID */
!((hapd->conf->p2p & P2P_GROUP_OWNER) &&
stype == WLAN_FC_STYPE_ACTION) &&
#endif /* CONFIG_P2P */
mesh: Accept Action frames without BSSID match [original patch by: Thomas Pedersen <thomas@noack.us>] Signed-off-by: Bob Copeland <me@bobcopeland.com>
2014-09-01 06:23:30 +02:00
#ifdef CONFIG_MESH
!(hapd->conf->mesh & MESH_ENABLED) &&
#endif /* CONFIG_MESH */
Remove experimental non-AP STA code from hostapd This was used to allow hostapd to associate as a non-AP STA to another AP one the same channel while still acting as an AP with the Host AP driver. This was very experimental and did not work with all firmware versions. Nowadays, much better way of doing this is to use mac80211 virtual non-AP STA interface. As such, this experimental code can be removed from hostapd to reduce the code size and make MLME code easier to understand since it is now only handling AP functionality.
2008-11-21 19:48:58 +01:00
os_memcmp(mgmt->bssid, hapd->own_addr, ETH_ALEN) != 0) {
Convert perror/printf calls to wpa_printf This makes debug and error logging more consistent and allows them to be directed to a file more easily. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 11:51:30 +01:00
wpa_printf(MSG_INFO, "MGMT: BSSID=" MACSTR " not our address",
MAC2STR(mgmt->bssid));
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
return 0;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
Ignore Management frames while AP interface is not fully enabled It is possible for drivers to report received Management frames while AP is going through initial setup (e.g., during ACS or DFS CAC). hostapd and the driver is not yet ready for actually sending out responses to such frames at this point and as such, it is better to explicitly ignore such received frames rather than try to process them and have the response (e.g., a Probe Response frame) getting dropped by the driver as an invalid or getting out with some incorrect information. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-05-16 11:16:34 +02:00
if (hapd->iface->state != HAPD_IFACE_ENABLED) {
wpa_printf(MSG_DEBUG, "MGMT: Ignore management frame while interface is not enabled (SA=" MACSTR " DA=" MACSTR " subtype=%u)",
MAC2STR(mgmt->sa), MAC2STR(mgmt->da), stype);
return 1;
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (stype == WLAN_FC_STYPE_PROBE_REQ) {
ieee802_11_mgmt: Handle frame info more consistently Check for the fi parameter to be non-NULL before trying to fetch the ssi_signal information similarly to how the fi->freq was already handled. While the meta information is supposed to be available, it looks like there is at least one corner case where fi == NULL could be used (Authentication frame reprocessing after RADIUS-based ACL). Signed-off-by: Jouni Malinen <j@w1.fi>
2018-02-07 11:34:41 +01:00
handle_probe_req(hapd, mgmt, len, ssi_signal);
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
return 1;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
DPP: PKEX in hostapd Allow hostapd to initiate and respond with PKEX bootstrapping similarly to how this was implemented in wpa_supplicant. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-02 11:36:48 +02:00
if ((!is_broadcast_ether_addr(mgmt->da) ||
stype != WLAN_FC_STYPE_ACTION) &&
os_memcmp(mgmt->da, hapd->own_addr, ETH_ALEN) != 0) {
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
"MGMT: DA=" MACSTR " not our address",
MAC2STR(mgmt->da));
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
return 0;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
Add station tracking based on other management frame subtypes This extends the previous tracking design to add a station entry based on other management frames than Probe Request frames. For example, this covers a case where the station is using passive scanning. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 18:38:06 +02:00
if (hapd->iconf->track_sta_max_num)
ieee802_11_mgmt: Handle frame info more consistently Check for the fi parameter to be non-NULL before trying to fetch the ssi_signal information similarly to how the fi->freq was already handled. While the meta information is supposed to be available, it looks like there is at least one corner case where fi == NULL could be used (Authentication frame reprocessing after RADIUS-based ACL). Signed-off-by: Jouni Malinen <j@w1.fi>
2018-02-07 11:34:41 +01:00
sta_track_add(hapd->iface, mgmt->sa, ssi_signal);
Add station tracking based on other management frame subtypes This extends the previous tracking design to add a station entry based on other management frames than Probe Request frames. For example, this covers a case where the station is using passive scanning. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 18:38:06 +02:00
hostapd: Add an option to notify management frames on ctrl_iface In some contexts (e.g., Multi-AP) it can be useful to have access to some of the management frames in upper layers (e.g., to be able to process the content of association requests externally). Add 'notify_mgmt_frames'. When enabled, it will notify the ctrl_iface when a management frame arrives using the AP-MGMT-FRAME-RECEIVED event message. Note that to avoid completely flooding the ctrl_iface, not all management frames are included (e.g., Beacon and Probe Request frames are excluded). Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2020-11-30 12:10:46 +01:00
if (hapd->conf->notify_mgmt_frames)
notify_mgmt_frame(hapd, buf, len);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
switch (stype) {
case WLAN_FC_STYPE_AUTH:
wpa_printf(MSG_DEBUG, "mgmt::auth");
SAE: Process received commit message through a queue This allows better control of processing new SAE sessions so that other operations can be given higher priority during bursts of SAE requests, e.g., during a potential DoS attack. The receive commit messages are queued (up to maximum of 15 entries) and processed from eloop callback. If the queue has multiple pending entries, more wait time is used to go through the each new entry to reduce heavy CPU load from SAE processing. Enable anti-clogging token use also based on the pending commit message queue and not only based on the already started sessions. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-01 18:54:51 +01:00
handle_auth(hapd, mgmt, len, ssi_signal, 0);
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
ret = 1;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
break;
case WLAN_FC_STYPE_ASSOC_REQ:
wpa_printf(MSG_DEBUG, "mgmt::assoc_req");
OCE: Add RSSI based association rejection support (AP) An AP might reject a STA association request due to low RSSI. In such case, the AP informs the STA the desired RSSI improvement and a retry timeout. The STA might retry to associate even if the RSSI hasn't improved if the retry timeout expired. Signed-off-by: Beni Lev <beni.lev@intel.com>
2017-08-21 18:43:53 +02:00
handle_assoc(hapd, mgmt, len, 0, ssi_signal);
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
ret = 1;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
break;
case WLAN_FC_STYPE_REASSOC_REQ:
wpa_printf(MSG_DEBUG, "mgmt::reassoc_req");
OCE: Add RSSI based association rejection support (AP) An AP might reject a STA association request due to low RSSI. In such case, the AP informs the STA the desired RSSI improvement and a retry timeout. The STA might retry to associate even if the RSSI hasn't improved if the retry timeout expired. Signed-off-by: Beni Lev <beni.lev@intel.com>
2017-08-21 18:43:53 +02:00
handle_assoc(hapd, mgmt, len, 1, ssi_signal);
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
ret = 1;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
break;
case WLAN_FC_STYPE_DISASSOC:
wpa_printf(MSG_DEBUG, "mgmt::disassoc");
handle_disassoc(hapd, mgmt, len);
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
ret = 1;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
break;
case WLAN_FC_STYPE_DEAUTH:
Fix some recent wpa_msg() calls in hostapd use correct context wpa_msg() has to use hapd->msg_ctx instead of hapd as the context pointer to work properly in wpa_supplicant AP mode. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-03 21:04:17 +01:00
wpa_msg(hapd->msg_ctx, MSG_DEBUG, "mgmt::deauth");
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
handle_deauth(hapd, mgmt, len);
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
ret = 1;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
break;
case WLAN_FC_STYPE_ACTION:
wpa_printf(MSG_DEBUG, "mgmt::action");
Report offchannel RX frame frequency to hostapd Not all code paths for management frame RX reporting delivered the correct frequency for offchannel RX cases. This is needed mainly for Public Action frame processing in some special cases where AP is operating, but an exchange is done on a non-operational channel. For example, DPP Initiator role may need to do this. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-01-08 02:37:48 +01:00
ret = handle_action(hapd, mgmt, len, freq);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
break;
default:
hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
"unknown mgmt frame subtype %d", stype);
break;
}
Do not process Action frames twice in hostapd SME/MLME Commit 88b32a99d30894b2d6bb391371c442fc117edbab added support for using some Action frame processing in hostapd for drivers that handle most of SME/MLME internally (it added FT, this has since be extended for SA Query and WNM). However, this was added in a way that ended up getting both the hostapd_rx_action() and hostapd_action_rx() called for Action frames. This could result in an attempt to process FT, SA Query, and WNM Action frames twice. There is need for more significant cleanup in Action frame processing in hostapd depending on the driver type, but as a simple step to avoid issues, skip the hostapd_action_rx() call if hostapd_rx_action() processed the frame. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-29 09:18:49 +01:00
return ret;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
static void handle_auth_cb(struct hostapd_data *hapd,
Use generic driver events for TX status and RX reporting Replace driver wrapper calls to hostapd_tx_status(), hostapd_rx_from_unknown_sta(), hostapd_mgmt_rx(), and hostapd_mgmt_tx_cb() with new generic driver events EVENT_TX_STATUS, EVENT_RX_FROM_UNKNOWN, and EVENT_RX_MGMT. This cleans up lot of the driver wrapper code to be less dependent on whether it is being used within wpa_supplicant AP mode or hostapd.
2009-12-13 22:05:39 +01:00
const struct ieee80211_mgmt *mgmt,
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
size_t len, int ok)
{
u16 auth_alg, auth_transaction, status_code;
struct sta_info *sta;
SAE: Avoid driver STA entry removal unnecessarily when using H2E/PK The new status code values for SAE H2E and PK resulted in the sta->added_unassoc cases incorrectly removing the STA entry after successful SAE commit messages. Fix this by using sae_status_success() instead of direct check for WLAN_STATUS_SUCCESS when processing SAE commit messages before removing station entry. Signed-off-by: Aloka Dixit <alokad@codeaurora.org> Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
2021-02-08 03:49:17 +01:00
bool success_status;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
sta = ap_get_sta(hapd, mgmt->da);
if (!sta) {
Drop logging priority for handle_auth_cb no-STA-match messages This message was printed and MSG_INFO level which would be more reasonable for error cases where hostapd has accepted authentication. However, this is not really an error case for the cases where authentication was rejected (e.g., due to MAC ACL). Drop this to use MSG_DEBUG level. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-10-14 19:03:55 +02:00
wpa_printf(MSG_DEBUG, "handle_auth_cb: STA " MACSTR
" not found",
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
MAC2STR(mgmt->da));
return;
}
Fix handle_auth_cb() message length check regression Reordering of code in handle_auth_cb() when adding support for full station state messaged up frame length checks. The length was originally tested before looking at the payload of the frame and that is obviously the correct location for that check. The location after those full state state changes was after having read six octets of the payload which did not help at all since there was no addition accesses to the payload after that check. Move the payload length check to appropriate place to get this extra level of protection behaving in the expected manner. Since this is a TX status callback handler, the frame payload is from a locally generated Authentication frame and as such, it will be long enough to include these fields in production use cases. Anyway, better keep this check in working condition. Fixes: bb598c3bdd06 ("AP: Add support for full station state") Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-02-22 23:30:09 +01:00
if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
wpa_printf(MSG_INFO, "handle_auth_cb - too short payload (len=%lu)",
(unsigned long) len);
auth_alg = 0;
auth_transaction = 0;
status_code = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
}
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
status_code = le_to_host16(mgmt->u.auth.status_code);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (!ok) {
hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_NOTICE,
"did not acknowledge authentication response");
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
goto fail;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
if (status_code == WLAN_STATUS_SUCCESS &&
((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 2) ||
(auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 4))) {
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO, "authenticated");
sta->flags |= WLAN_STA_AUTH;
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
if (sta->added_unassoc)
hostapd_set_sta_flags(hapd, sta);
return;
}
fail:
SAE: Avoid driver STA entry removal unnecessarily when using H2E/PK The new status code values for SAE H2E and PK resulted in the sta->added_unassoc cases incorrectly removing the STA entry after successful SAE commit messages. Fix this by using sae_status_success() instead of direct check for WLAN_STATUS_SUCCESS when processing SAE commit messages before removing station entry. Signed-off-by: Aloka Dixit <alokad@codeaurora.org> Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
2021-02-08 03:49:17 +01:00
success_status = status_code == WLAN_STATUS_SUCCESS;
#ifdef CONFIG_SAE
if (auth_alg == WLAN_AUTH_SAE && auth_transaction == 1)
success_status = sae_status_success(hapd, status_code);
#endif /* CONFIG_SAE */
if (!success_status && sta->added_unassoc) {
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
hostapd_drv_sta_remove(hapd, sta->addr);
sta->added_unassoc = 0;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
}
WDS: Fix WEP usage with nl80211 wds_sta=1 The static WEP keys have to be configured for the new VLAN interface that is created for a 4addr WDS peer, not doing so breaks WEP functionality in nl80211/4addr based WDS links. Signed-hostap: Sujith Manoharan <c_manoha@qca.qualcomm.com>
2013-07-20 16:41:22 +02:00
static void hostapd_set_wds_encryption(struct hostapd_data *hapd,
struct sta_info *sta,
char *ifname_wds)
{
Make WEP functionality an optional build parameter WEP should not be used for anything anymore. As a step towards removing it completely, move all WEP related functionality to be within CONFIG_WEP blocks. This will be included in builds only if CONFIG_WEP=y is explicitly set in build configuration. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-02-29 15:52:39 +01:00
#ifdef CONFIG_WEP
WDS: Fix WEP usage with nl80211 wds_sta=1 The static WEP keys have to be configured for the new VLAN interface that is created for a 4addr WDS peer, not doing so breaks WEP functionality in nl80211/4addr based WDS links. Signed-hostap: Sujith Manoharan <c_manoha@qca.qualcomm.com>
2013-07-20 16:41:22 +02:00
int i;
Remove unused leftover from multi-SSID design The multi-SSID design that used a single beaconing BSSID with multiple SSIDs was never completed in this repository, so there is no need to maintain the per-STA ssid/ssid_probe pointers that could only point to &hapd->conf->ssid. Save some memory and reduce code complexity by removing this unused partial capability. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-04-20 23:33:25 +02:00
struct hostapd_ssid *ssid = &hapd->conf->ssid;
WDS: Fix WEP usage with nl80211 wds_sta=1 The static WEP keys have to be configured for the new VLAN interface that is created for a 4addr WDS peer, not doing so breaks WEP functionality in nl80211/4addr based WDS links. Signed-hostap: Sujith Manoharan <c_manoha@qca.qualcomm.com>
2013-07-20 16:41:22 +02:00
if (hapd->conf->ieee802_1x || hapd->conf->wpa)
return;
for (i = 0; i < 4; i++) {
if (ssid->wep.key[i] &&
hostapd_drv_set_key(ifname_wds, hapd, WPA_ALG_WEP, NULL, i,
Add vlan_id to driver set_key() operation This is in preparation for adding support to use a single WLAN netdev with VLAN operations offloaded to the driver. No functional changes are included in this commit. Signed-off-by: Gurumoorthi Gnanasambandhan <gguru@codeaurora.org>
2019-12-05 11:38:47 +01:00
0, i == ssid->wep.idx, NULL, 0,
Introduce and add key_flag Add the new set_key() parameter "key_flag" to provide more specific description of what type of a key is being configured. This is needed to be able to add support for "Extended Key ID for Individually Addressed Frames" from IEEE Std 802.11-2016. In addition, this may be used to replace the set_tx boolean eventually once all the driver wrappers have moved to using the new key_flag. The following flag are defined: KEY_FLAG_MODIFY Set when an already installed key must be updated. So far the only use-case is changing RX/TX status of installed keys. Must not be set when deleting a key. KEY_FLAG_DEFAULT Set when the key is also a default key. Must not be set when deleting a key. (This is the replacement for set_tx.) KEY_FLAG_RX The key is valid for RX. Must not be set when deleting a key. KEY_FLAG_TX The key is valid for TX. Must not be set when deleting a key. KEY_FLAG_GROUP The key is a broadcast or group key. KEY_FLAG_PAIRWISE The key is a pairwise key. KEY_FLAG_PMK The key is a Pairwise Master Key (PMK). Predefined and needed flag combinations so far are: KEY_FLAG_GROUP_RX_TX WEP key not used as default key (yet). KEY_FLAG_GROUP_RX_TX_DEFAULT Default WEP or WPA-NONE key. KEY_FLAG_GROUP_RX GTK key valid for RX only. KEY_FLAG_GROUP_TX_DEFAULT GTK key valid for TX only, immediately taking over TX. KEY_FLAG_PAIRWISE_RX_TX Pairwise key immediately becoming the active pairwise key. KEY_FLAG_PAIRWISE_RX Pairwise key not yet valid for TX. (Only usable with Extended Key ID support.) KEY_FLAG_PAIRWISE_RX_TX_MODIFY Enable TX for a pairwise key installed with KEY_FLAG_PAIRWISE_RX. KEY_FLAG_RX_TX Not a valid standalone key type and can only used in combination with other flags to mark a key for RX/TX. This commit is not changing any functionality. It just adds the new key_flag to all hostapd/wpa_supplicant set_key() functions without using it, yet. Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2020-01-04 23:10:04 +01:00
ssid->wep.key[i], ssid->wep.len[i],
i == ssid->wep.idx ?
KEY_FLAG_GROUP_RX_TX_DEFAULT :
KEY_FLAG_GROUP_RX_TX)) {
WDS: Fix WEP usage with nl80211 wds_sta=1 The static WEP keys have to be configured for the new VLAN interface that is created for a 4addr WDS peer, not doing so breaks WEP functionality in nl80211/4addr based WDS links. Signed-hostap: Sujith Manoharan <c_manoha@qca.qualcomm.com>
2013-07-20 16:41:22 +02:00
wpa_printf(MSG_WARNING,
"Could not set WEP keys for WDS interface; %s",
ifname_wds);
break;
}
}
Make WEP functionality an optional build parameter WEP should not be used for anything anymore. As a step towards removing it completely, move all WEP related functionality to be within CONFIG_WEP blocks. This will be included in builds only if CONFIG_WEP=y is explicitly set in build configuration. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-02-29 15:52:39 +01:00
#endif /* CONFIG_WEP */
WDS: Fix WEP usage with nl80211 wds_sta=1 The static WEP keys have to be configured for the new VLAN interface that is created for a 4addr WDS peer, not doing so breaks WEP functionality in nl80211/4addr based WDS links. Signed-hostap: Sujith Manoharan <c_manoha@qca.qualcomm.com>
2013-07-20 16:41:22 +02:00
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
static void handle_assoc_cb(struct hostapd_data *hapd,
Use generic driver events for TX status and RX reporting Replace driver wrapper calls to hostapd_tx_status(), hostapd_rx_from_unknown_sta(), hostapd_mgmt_rx(), and hostapd_mgmt_tx_cb() with new generic driver events EVENT_TX_STATUS, EVENT_RX_FROM_UNKNOWN, and EVENT_RX_MGMT. This cleans up lot of the driver wrapper code to be less dependent on whether it is being used within wpa_supplicant AP mode or hostapd.
2009-12-13 22:05:39 +01:00
const struct ieee80211_mgmt *mgmt,
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
size_t len, int reassoc, int ok)
{
u16 status;
struct sta_info *sta;
int new_assoc = 1;
sta = ap_get_sta(hapd, mgmt->da);
if (!sta) {
Convert perror/printf calls to wpa_printf This makes debug and error logging more consistent and allows them to be directed to a file more easily. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 11:51:30 +01:00
wpa_printf(MSG_INFO, "handle_assoc_cb: STA " MACSTR " not found",
MAC2STR(mgmt->da));
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
return;
}
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_resp) :
sizeof(mgmt->u.assoc_resp))) {
wpa_printf(MSG_INFO,
"handle_assoc_cb(reassoc=%d) - too short payload (len=%lu)",
reassoc, (unsigned long) len);
AP: Set STA assoc flag in the driver before sending Assoc Resp frame Previously, stations were added to the driver only after the (Re)Association Response frame was acked. In the time period between the station has acked the (Re)Association Response frame and the time the station was added to the kernel, the station can already start sending Data frames, which will be dropped by the hardware/driver. In addition to the data loss, the driver may ignore NDPs with PM bit set from this STA. Fix this by setting/adding the STA with associated flag set to the driver before the AP sends the (Re)Association Response frame with status success. If the (Re)Association Response frame wasn't acked, remove the station from the driver. Note that setting a station to associated state before the non-AP station acknowledges the (Re)Association Response frame is not compliant with the IEEE 802.11 standard that specifically states that a non-AP station should transition to authenticated/associated state only after it acknowledged the (Re)Association Response frame. However, this is a justifiable simplification to work around the issue described above since 1. The station will be removed in case it does not acknowledge the (Re)Association Response frame. 2. All Data frames would be dropped until the station is set to authorized state and there are no known issues with processing the other Class 3 frames during the short window before the acknowledgement is seen. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2016-02-16 10:54:33 +01:00
hostapd_drv_sta_remove(hapd, sta->addr);
return;
AP: Add support for full station state Add support for drivers that support full AP client state, i.e., can handle adding stations that are not associated yet. For such drivers, add a station after processing the authentication request, instead of adding it in the association response callback. Doing so is beneficial in cases where the driver cannot handle the add station request, in which case it is useless to perform the complete connection establishment. Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2016-02-16 10:54:32 +01:00
}
AP: Set STA assoc flag in the driver before sending Assoc Resp frame Previously, stations were added to the driver only after the (Re)Association Response frame was acked. In the time period between the station has acked the (Re)Association Response frame and the time the station was added to the kernel, the station can already start sending Data frames, which will be dropped by the hardware/driver. In addition to the data loss, the driver may ignore NDPs with PM bit set from this STA. Fix this by setting/adding the STA with associated flag set to the driver before the AP sends the (Re)Association Response frame with status success. If the (Re)Association Response frame wasn't acked, remove the station from the driver. Note that setting a station to associated state before the non-AP station acknowledges the (Re)Association Response frame is not compliant with the IEEE 802.11 standard that specifically states that a non-AP station should transition to authenticated/associated state only after it acknowledged the (Re)Association Response frame. However, this is a justifiable simplification to work around the issue described above since 1. The station will be removed in case it does not acknowledge the (Re)Association Response frame. 2. All Data frames would be dropped until the station is set to authorized state and there are no known issues with processing the other Class 3 frames during the short window before the acknowledgement is seen. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2016-02-16 10:54:33 +01:00
if (reassoc)
status = le_to_host16(mgmt->u.reassoc_resp.status_code);
else
status = le_to_host16(mgmt->u.assoc_resp.status_code);
hostapd: Clear WLAN_STA_ASSOC_REQ_OK if sending the assoc response failed As long as WLAN_STA_ASSOC_REQ_OK is set in sta->flags, Class 3 frames do not trigger a disassoc/deauth. If it is still set even after the assoc response tx has already failed, it may take somewhat longer for clients to realize that the connection wasn't fully established. Signed-hostap: Felix Fietkau <nbd@openwrt.org>
2012-09-23 12:23:16 +02:00
if (!ok) {
hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
"did not acknowledge association response");
sta->flags &= ~WLAN_STA_ASSOC_REQ_OK;
AP: Set STA assoc flag in the driver before sending Assoc Resp frame Previously, stations were added to the driver only after the (Re)Association Response frame was acked. In the time period between the station has acked the (Re)Association Response frame and the time the station was added to the kernel, the station can already start sending Data frames, which will be dropped by the hardware/driver. In addition to the data loss, the driver may ignore NDPs with PM bit set from this STA. Fix this by setting/adding the STA with associated flag set to the driver before the AP sends the (Re)Association Response frame with status success. If the (Re)Association Response frame wasn't acked, remove the station from the driver. Note that setting a station to associated state before the non-AP station acknowledges the (Re)Association Response frame is not compliant with the IEEE 802.11 standard that specifically states that a non-AP station should transition to authenticated/associated state only after it acknowledged the (Re)Association Response frame. However, this is a justifiable simplification to work around the issue described above since 1. The station will be removed in case it does not acknowledge the (Re)Association Response frame. 2. All Data frames would be dropped until the station is set to authorized state and there are no known issues with processing the other Class 3 frames during the short window before the acknowledgement is seen. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2016-02-16 10:54:33 +01:00
/* The STA is added only in case of SUCCESS */
if (status == WLAN_STATUS_SUCCESS)
hostapd_drv_sta_remove(hapd, sta->addr);
hostapd: Clear WLAN_STA_ASSOC_REQ_OK if sending the assoc response failed As long as WLAN_STA_ASSOC_REQ_OK is set in sta->flags, Class 3 frames do not trigger a disassoc/deauth. If it is still set even after the assoc response tx has already failed, it may take somewhat longer for clients to realize that the connection wasn't fully established. Signed-hostap: Felix Fietkau <nbd@openwrt.org>
2012-09-23 12:23:16 +02:00
AP: Set STA assoc flag in the driver before sending Assoc Resp frame Previously, stations were added to the driver only after the (Re)Association Response frame was acked. In the time period between the station has acked the (Re)Association Response frame and the time the station was added to the kernel, the station can already start sending Data frames, which will be dropped by the hardware/driver. In addition to the data loss, the driver may ignore NDPs with PM bit set from this STA. Fix this by setting/adding the STA with associated flag set to the driver before the AP sends the (Re)Association Response frame with status success. If the (Re)Association Response frame wasn't acked, remove the station from the driver. Note that setting a station to associated state before the non-AP station acknowledges the (Re)Association Response frame is not compliant with the IEEE 802.11 standard that specifically states that a non-AP station should transition to authenticated/associated state only after it acknowledged the (Re)Association Response frame. However, this is a justifiable simplification to work around the issue described above since 1. The station will be removed in case it does not acknowledge the (Re)Association Response frame. 2. All Data frames would be dropped until the station is set to authorized state and there are no known issues with processing the other Class 3 frames during the short window before the acknowledgement is seen. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2016-02-16 10:54:33 +01:00
return;
}
hostapd: Clear WLAN_STA_ASSOC_REQ_OK if sending the assoc response failed As long as WLAN_STA_ASSOC_REQ_OK is set in sta->flags, Class 3 frames do not trigger a disassoc/deauth. If it is still set even after the assoc response tx has already failed, it may take somewhat longer for clients to realize that the connection wasn't fully established. Signed-hostap: Felix Fietkau <nbd@openwrt.org>
2012-09-23 12:23:16 +02:00
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (status != WLAN_STATUS_SUCCESS)
Remove unused STA entry information previous_ap and last_assoc_req were not really used for anything meaninful, so get rid of them to reduce the size of per-STA memory allocation. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-15 08:57:10 +01:00
return;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
/* Stop previous accounting session, if one is started, and allocate
* new session id for the new session. */
accounting_sta_stop(hapd, sta);
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO,
Simplified RADIUS accounting id usage Changed accounting_sta_start() to call accounting_sta_get_id() internally in accounting.c so that external callers do not need to do anything to allocate unique accounting id. When starting a new session, a unique identifier is needed anyway, so no need to keep these operations separate.
2008-11-23 10:12:17 +01:00
"associated (aid %d)",
sta->aid);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (sta->flags & WLAN_STA_ASSOC)
new_assoc = 0;
sta->flags |= WLAN_STA_ASSOC;
WNM: Add STA flag to indicate the current WNM-Sleep-Mode state This can be useful for displaying the current STA state and also for determining whether some operations are likely to fail or need additional delay. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-27 18:06:52 +01:00
sta->flags &= ~WLAN_STA_WNM_SLEEP_MODE;
FILS: Mark connection fully authorized after FILS Association (AP) Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-09 17:56:57 +02:00
if ((!hapd->conf->ieee802_1x && !hapd->conf->wpa &&
!hapd->conf->osen) ||
sta->auth_alg == WLAN_AUTH_FILS_SK ||
sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
sta->auth_alg == WLAN_AUTH_FILS_PK ||
FT: Fix Authorized flag setting for FT protocol 4-way handshake or EAPOL is not used in this case, so we must force Authorized flag to be set at the conclusion of successful FT protocol run.
2010-03-13 20:43:00 +01:00
sta->auth_alg == WLAN_AUTH_FT) {
/*
FILS: Mark connection fully authorized after FILS Association (AP) Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-09 17:56:57 +02:00
* Open, static WEP, FT protocol, or FILS; no separate
* authorization step.
FT: Fix Authorized flag setting for FT protocol 4-way handshake or EAPOL is not used in this case, so we must force Authorized flag to be set at the conclusion of successful FT protocol run.
2010-03-13 20:43:00 +01:00
*/
AP: Introduce sta authorized wrappers To enable making state change notifications on the WLAN_STA_AUTHORIZED flag, introduce ap_sta_set_authorized(), and to reduce use of the flag itself also add a wrapper for testing the flag: ap_sta_is_authorized(). Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2011-02-02 15:52:32 +01:00
ap_sta_set_authorized(hapd, sta, 1);
Mark STA authorized if IEEE 802.1X and WPA is not used This fixes multi-BSS configuration with driver_nl80211.c to mark STAs that use secondary BSSes with open/static WEP without having to make driver_nl80211.c track 802.1X configuration for each BSS.
2009-04-03 19:40:07 +02:00
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (reassoc)
mlme_reassociate_indication(hapd, sta);
else
mlme_associate_indication(hapd, sta);
Renamed Ping procedure into SA Query procedure per 802.11w/D7.0 This commit changes just the name and Action category per D7.0. The retransmit/timeout processing in the AP is not yet updated with the changes in D7.0.
2008-12-26 10:46:21 +01:00
sta->sa_query_timed_out = 0;
IEEE 802.11w: Added association ping This updates management frame protection to use the assocition ping process from the latest draft (D6.0) to protect against unauthenticated authenticate or (re)associate frames dropping association.
2008-08-31 10:04:47 +02:00
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (sta->eapol_sm == NULL) {
/*
* This STA does not use RADIUS server for EAP authentication,
* so bind it to the selected VLAN interface now, since the
* interface selection is not going to change anymore.
*/
Remove VLAN interface on STA free Currently, vlan_remove_dynamic() is only called when the station VLAN ID is changed (ap_sta_bind_vlan), but not when the station is freed. So dynamic VLAN interfaces are not removed actually except within 1x reauthentification VLAN ID change, although most of the code is already there. This patch fixes this by calling vlan_remove_dynamic() in ap_free_sta(). It cannot just use sta->vlan_id for this, as this might have been changed without calling ap_sta_bind_vlan() (ap/ieee802_11.c:handle_auth fetches from RADIUS cache for WPA-PSK), thus reference counting might not have been updated. Additionally, reference counting might get wrong due to old_vlanid = 0 being passed unconditionally, thus increasing the reference counter multiple times. So tracking the currently assigned (i.e., dynamic_vlan counter increased) VLAN is done in a new variable sta->vlan_id_bound. Therefore, the old_vlan_id argument of ap_sta_bind_vlan() is no longer needed and setting the VLAN for the sta in driver happens unconditionally. Additionally, vlan->dynamic_vlan is only incremented when it actually is a dynamic VLAN. Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2015-04-10 14:49:50 +02:00
if (ap_sta_bind_vlan(hapd, sta) < 0)
Remove unused STA entry information previous_ap and last_assoc_req were not really used for anything meaninful, so get rid of them to reduce the size of per-STA memory allocation. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-15 08:57:10 +01:00
return;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
} else if (sta->vlan_id) {
/* VLAN ID already set (e.g., by PMKSA caching), so bind STA */
Remove VLAN interface on STA free Currently, vlan_remove_dynamic() is only called when the station VLAN ID is changed (ap_sta_bind_vlan), but not when the station is freed. So dynamic VLAN interfaces are not removed actually except within 1x reauthentification VLAN ID change, although most of the code is already there. This patch fixes this by calling vlan_remove_dynamic() in ap_free_sta(). It cannot just use sta->vlan_id for this, as this might have been changed without calling ap_sta_bind_vlan() (ap/ieee802_11.c:handle_auth fetches from RADIUS cache for WPA-PSK), thus reference counting might not have been updated. Additionally, reference counting might get wrong due to old_vlanid = 0 being passed unconditionally, thus increasing the reference counter multiple times. So tracking the currently assigned (i.e., dynamic_vlan counter increased) VLAN is done in a new variable sta->vlan_id_bound. Therefore, the old_vlan_id argument of ap_sta_bind_vlan() is no longer needed and setting the VLAN for the sta in driver happens unconditionally. Additionally, vlan->dynamic_vlan is only incremented when it actually is a dynamic VLAN. Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2015-04-10 14:49:50 +02:00
if (ap_sta_bind_vlan(hapd, sta) < 0)
Remove unused STA entry information previous_ap and last_assoc_req were not really used for anything meaninful, so get rid of them to reduce the size of per-STA memory allocation. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-15 08:57:10 +01:00
return;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
Fix WMM and MFP STA flag setting with flags_or/flags_and These were included correctly in total_flags, but not in flags_or/flags_and.
2009-05-11 12:49:57 +02:00
Get rid of struct hostapd_driver_ops abstraction This is not needed anymore and just makes things more difficult to understand, so move the remaining function pointers to direct function calls and get rid of the struct hostapd_driver_ops.
2010-11-24 15:50:06 +01:00
hostapd_set_sta_flags(hapd, sta);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
Fix race condition between AssocResp callback and 4addr event It is apparently possible for the NL80211_CMD_UNEXPECTED_4ADDR_FRAME event to be delivered to hostapd before the NL80211_CMD_FRAME_TX_STATUS event for (Re)Association Response frame. This resulted in the 4-address WDS mode not getting enabled for a STA. This could occur in particular when operating under heavy load and the STA is reconnecting to the same AP in a sequence where Deauthentication frame is followed immediately by Authentication frame and the driver event processing gets delayed due to removal of the previous netdev taking time in the middle of this sequence. Fix this by recording a pending item for 4-address WDS enabling if the NL80211_CMD_UNEXPECTED_4ADDR_FRAME event would have been dropped due to incompleted association and then process this pending item if the TX status for the (Re)Association Response frame is received and it shows that the frame was acknowledged. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-12-20 00:30:09 +01:00
if (!(sta->flags & WLAN_STA_WDS) && sta->pending_wds_enable) {
wpa_printf(MSG_DEBUG, "Enable 4-address WDS mode for STA "
MACSTR " based on pending request",
MAC2STR(sta->addr));
sta->pending_wds_enable = 0;
sta->flags |= WLAN_STA_WDS;
}
hostapd: Add Multi-AP protocol support The purpose of Multi-AP specification is to enable inter-operability across Wi-Fi access points (APs) from different vendors. This patch introduces one new configuration parameter 'multi_ap' to enable Multi-AP functionality and to configure the BSS as a backhaul and/or fronthaul BSS. Advertise vendor specific Multi-AP capabilities in (Re)Association Response frame, if Multi-AP functionality is enabled through the configuration parameter. A backhaul AP must support receiving both 3addr and 4addr frames from a backhaul STA, so create a VLAN for it just like is done for WDS, i.e., by calling hostapd_set_wds_sta(). Since Multi-AP requires WPA2 (never WEP), we can safely call hostapd_set_wds_encryption() as well and we can reuse the entire WDS condition. To parse the Multi-AP Extension subelement, we use get_ie(): even though that function is meant for parsing IEs, it works for subelements. Signed-off-by: Venkateswara Naralasetty <vnaralas@codeaurora.org> Signed-off-by: Jouni Malinen <jouni@codeaurora.org> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2018-12-05 11:23:51 +01:00
if (sta->flags & (WLAN_STA_WDS | WLAN_STA_MULTI_AP)) {
Fix 4addr reassociation-without-deauthentication on AP Data connection was lost if a station reassociated without the STA entry being cleaned up on the AP side. Fix this by moving reconfiguration of the STA WDS parameters in association response callback to happen only after the STA flags have been updated to associated stated. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-12-02 11:51:16 +01:00
int ret;
char ifname_wds[IFNAMSIZ + 1];
wpa_printf(MSG_DEBUG, "Reenable 4-address WDS mode for STA "
MACSTR " (aid %u)",
MAC2STR(sta->addr), sta->aid);
ret = hostapd_set_wds_sta(hapd, ifname_wds, sta->addr,
sta->aid, 1);
if (!ret)
hostapd_set_wds_encryption(hapd, sta, ifname_wds);
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
if (sta->auth_alg == WLAN_AUTH_FT)
wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC_FT);
else
wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);
Avoid direct call to hostapd_new_assoc_sta from ieee802_11.c
2009-12-24 22:42:13 +01:00
hapd->new_assoc_sta_cb(hapd, sta, !new_assoc);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
AP: Save EAPOL received before Association Response ACK There is a race condition in which AP might receive the EAPOL-Start frame (from the just-associated station) before the TX completion of the Association Response frame. This in turn will cause the EAPOL-Start frame to get dropped, and potentially failing the connection. Solve this by saving EAPOL frames from authenticated-but-not-associated stations, and handling them during the Association Response frame TX completion processing. Signed-off-by: Eliad Peller <eliad@wizery.com>
2016-03-06 10:29:16 +01:00
FILS: Set TK after association (AP) Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-09 18:32:44 +02:00
#ifdef CONFIG_FILS
if ((sta->auth_alg == WLAN_AUTH_FILS_SK ||
sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
sta->auth_alg == WLAN_AUTH_FILS_PK) &&
fils_set_tk(sta->wpa_sm) < 0) {
wpa_printf(MSG_DEBUG, "FILS: TK configuration failed");
ap_sta_disconnect(hapd, sta, sta->addr,
WLAN_REASON_UNSPECIFIED);
return;
}
#endif /* CONFIG_FILS */
AP: Save EAPOL received before Association Response ACK There is a race condition in which AP might receive the EAPOL-Start frame (from the just-associated station) before the TX completion of the Association Response frame. This in turn will cause the EAPOL-Start frame to get dropped, and potentially failing the connection. Solve this by saving EAPOL frames from authenticated-but-not-associated stations, and handling them during the Association Response frame TX completion processing. Signed-off-by: Eliad Peller <eliad@wizery.com>
2016-03-06 10:29:16 +01:00
if (sta->pending_eapol_rx) {
struct os_reltime now, age;
os_get_reltime(&now);
os_reltime_sub(&now, &sta->pending_eapol_rx->rx_time, &age);
if (age.sec == 0 && age.usec < 200000) {
wpa_printf(MSG_DEBUG,
"Process pending EAPOL frame that was received from " MACSTR " just before association notification",
MAC2STR(sta->addr));
ieee802_1x_receive(
hapd, mgmt->da,
wpabuf_head(sta->pending_eapol_rx->buf),
wpabuf_len(sta->pending_eapol_rx->buf));
}
wpabuf_free(sta->pending_eapol_rx->buf);
os_free(sta->pending_eapol_rx);
sta->pending_eapol_rx = NULL;
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
}
Delay STA entry removal until Deauth/Disassoc TX status in AP mode This allows the driver to use PS buffering of Deauthentication and Disassociation frames when the STA is in power save sleep. The STA entry (and PTK) will be removed from the kernel only after the Deauth/Disassoc has been transmitted (e.g., when the STA wakes up). A hardcoded two second timeout is used to limit the length of this window should the driver fail to deliver the frame (e.g., the STA is out of range and does not wake up). The kernel STA entry is marked unauthorized during the wait to avoid accepting Data frames from the STA that we have decided to disconnect. This behavior is available only with drivers that provide TX status events for Deauth/Disassoc frames (nl80211 at this point). Other drivers continue to use the previous behavior where the STA entry is removed immediately.
2011-08-28 22:07:02 +02:00
static void handle_deauth_cb(struct hostapd_data *hapd,
const struct ieee80211_mgmt *mgmt,
size_t len, int ok)
{
struct sta_info *sta;
ap: Use is_multicast_ether_addr() more Various checks should use is_multicast_ether_addr() instead of hardcoding the equivalent, change it. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-08-16 15:06:59 +02:00
if (is_multicast_ether_addr(mgmt->da))
Delay STA entry removal until Deauth/Disassoc TX status in AP mode This allows the driver to use PS buffering of Deauthentication and Disassociation frames when the STA is in power save sleep. The STA entry (and PTK) will be removed from the kernel only after the Deauth/Disassoc has been transmitted (e.g., when the STA wakes up). A hardcoded two second timeout is used to limit the length of this window should the driver fail to deliver the frame (e.g., the STA is out of range and does not wake up). The kernel STA entry is marked unauthorized during the wait to avoid accepting Data frames from the STA that we have decided to disconnect. This behavior is available only with drivers that provide TX status events for Deauth/Disassoc frames (nl80211 at this point). Other drivers continue to use the previous behavior where the STA entry is removed immediately.
2011-08-28 22:07:02 +02:00
return;
sta = ap_get_sta(hapd, mgmt->da);
if (!sta) {
wpa_printf(MSG_DEBUG, "handle_deauth_cb: STA " MACSTR
" not found", MAC2STR(mgmt->da));
return;
}
if (ok)
wpa_printf(MSG_DEBUG, "STA " MACSTR " acknowledged deauth",
MAC2STR(sta->addr));
else
wpa_printf(MSG_DEBUG, "STA " MACSTR " did not acknowledge "
"deauth", MAC2STR(sta->addr));
ap_sta_deauth_cb(hapd, sta);
}
static void handle_disassoc_cb(struct hostapd_data *hapd,
const struct ieee80211_mgmt *mgmt,
size_t len, int ok)
{
struct sta_info *sta;
ap: Use is_multicast_ether_addr() more Various checks should use is_multicast_ether_addr() instead of hardcoding the equivalent, change it. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-08-16 15:06:59 +02:00
if (is_multicast_ether_addr(mgmt->da))
Delay STA entry removal until Deauth/Disassoc TX status in AP mode This allows the driver to use PS buffering of Deauthentication and Disassociation frames when the STA is in power save sleep. The STA entry (and PTK) will be removed from the kernel only after the Deauth/Disassoc has been transmitted (e.g., when the STA wakes up). A hardcoded two second timeout is used to limit the length of this window should the driver fail to deliver the frame (e.g., the STA is out of range and does not wake up). The kernel STA entry is marked unauthorized during the wait to avoid accepting Data frames from the STA that we have decided to disconnect. This behavior is available only with drivers that provide TX status events for Deauth/Disassoc frames (nl80211 at this point). Other drivers continue to use the previous behavior where the STA entry is removed immediately.
2011-08-28 22:07:02 +02:00
return;
sta = ap_get_sta(hapd, mgmt->da);
if (!sta) {
wpa_printf(MSG_DEBUG, "handle_disassoc_cb: STA " MACSTR
" not found", MAC2STR(mgmt->da));
return;
}
if (ok)
wpa_printf(MSG_DEBUG, "STA " MACSTR " acknowledged disassoc",
MAC2STR(sta->addr));
else
wpa_printf(MSG_DEBUG, "STA " MACSTR " did not acknowledge "
"disassoc", MAC2STR(sta->addr));
ap_sta_disassoc_cb(hapd, sta);
}
Report beacon request TX status as control interface event The new BEACON-REQ-TX-STATUS control interface event is now used to report whether a beacon request (from REQ_BEACON command) was delivered successfully. This event has the following parameters: <STA address> <dialog token> <ack=0/1>. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-01-01 23:54:44 +01:00
static void handle_action_cb(struct hostapd_data *hapd,
const struct ieee80211_mgmt *mgmt,
size_t len, int ok)
{
struct sta_info *sta;
Send BEACON-REQ-TX-STATUS event only for beacon reports Check the action TX status callback contents more thoroughly and report the BEACON-REQ-TX-STATUS event only if the Measurement Type indicates beacon report. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-01-07 21:23:13 +01:00
const struct rrm_measurement_report_element *report;
Report beacon request TX status as control interface event The new BEACON-REQ-TX-STATUS control interface event is now used to report whether a beacon request (from REQ_BEACON command) was delivered successfully. This event has the following parameters: <STA address> <dialog token> <ack=0/1>. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-01-01 23:54:44 +01:00
if (is_multicast_ether_addr(mgmt->da))
return;
DPP: Integration for hostapd This adds DPP bootstrapping, authentication, and configuration into hostapd similarly to how the design was integrated in wpa_supplicant. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-06-15 21:16:45 +02:00
#ifdef CONFIG_DPP
if (len >= IEEE80211_HDRLEN + 6 &&
mgmt->u.action.category == WLAN_ACTION_PUBLIC &&
mgmt->u.action.u.vs_public_action.action ==
WLAN_PA_VENDOR_SPECIFIC &&
WPA_GET_BE24(mgmt->u.action.u.vs_public_action.oui) ==
OUI_WFA &&
mgmt->u.action.u.vs_public_action.variable[0] ==
DPP_OUI_TYPE) {
const u8 *pos, *end;
pos = &mgmt->u.action.u.vs_public_action.variable[1];
end = ((const u8 *) mgmt) + len;
hostapd_dpp_tx_status(hapd, mgmt->da, pos, end - pos, ok);
return;
}
if (len >= IEEE80211_HDRLEN + 2 &&
mgmt->u.action.category == WLAN_ACTION_PUBLIC &&
(mgmt->u.action.u.public_action.action ==
WLAN_PA_GAS_INITIAL_REQ ||
mgmt->u.action.u.public_action.action ==
WLAN_PA_GAS_COMEBACK_REQ)) {
const u8 *pos, *end;
pos = mgmt->u.action.u.public_action.variable;
end = ((const u8 *) mgmt) + len;
gas_query_ap_tx_status(hapd->gas, mgmt->da, pos, end - pos, ok);
return;
}
#endif /* CONFIG_DPP */
Report beacon request TX status as control interface event The new BEACON-REQ-TX-STATUS control interface event is now used to report whether a beacon request (from REQ_BEACON command) was delivered successfully. This event has the following parameters: <STA address> <dialog token> <ack=0/1>. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-01-01 23:54:44 +01:00
sta = ap_get_sta(hapd, mgmt->da);
if (!sta) {
wpa_printf(MSG_DEBUG, "handle_action_cb: STA " MACSTR
" not found", MAC2STR(mgmt->da));
return;
}
Send BEACON-REQ-TX-STATUS event only for beacon reports Check the action TX status callback contents more thoroughly and report the BEACON-REQ-TX-STATUS event only if the Measurement Type indicates beacon report. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-01-07 21:23:13 +01:00
if (len < 24 + 5 + sizeof(*report))
Report beacon request TX status as control interface event The new BEACON-REQ-TX-STATUS control interface event is now used to report whether a beacon request (from REQ_BEACON command) was delivered successfully. This event has the following parameters: <STA address> <dialog token> <ack=0/1>. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-01-01 23:54:44 +01:00
return;
Send BEACON-REQ-TX-STATUS event only for beacon reports Check the action TX status callback contents more thoroughly and report the BEACON-REQ-TX-STATUS event only if the Measurement Type indicates beacon report. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-01-07 21:23:13 +01:00
report = (const struct rrm_measurement_report_element *)
&mgmt->u.action.u.rrm.variable[2];
Report beacon request TX status as control interface event The new BEACON-REQ-TX-STATUS control interface event is now used to report whether a beacon request (from REQ_BEACON command) was delivered successfully. This event has the following parameters: <STA address> <dialog token> <ack=0/1>. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-01-01 23:54:44 +01:00
if (mgmt->u.action.category == WLAN_ACTION_RADIO_MEASUREMENT &&
Send BEACON-REQ-TX-STATUS event only for beacon reports Check the action TX status callback contents more thoroughly and report the BEACON-REQ-TX-STATUS event only if the Measurement Type indicates beacon report. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-01-07 21:23:13 +01:00
mgmt->u.action.u.rrm.action == WLAN_RRM_RADIO_MEASUREMENT_REQUEST &&
report->eid == WLAN_EID_MEASURE_REQUEST &&
report->len >= 3 &&
report->type == MEASURE_TYPE_BEACON)
Report beacon request TX status as control interface event The new BEACON-REQ-TX-STATUS control interface event is now used to report whether a beacon request (from REQ_BEACON command) was delivered successfully. This event has the following parameters: <STA address> <dialog token> <ack=0/1>. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-01-01 23:54:44 +01:00
hostapd_rrm_beacon_req_tx_status(hapd, mgmt, len, ok);
}
Moved documentation from developer.txt into source code files Use Doxygen comments for functions to replace the old text file that was not up-to-date anymore.
2009-01-08 15:33:00 +01:00
/**
* ieee802_11_mgmt_cb - Process management frame TX status callback
* @hapd: hostapd BSS data structure (the BSS from which the management frame
* was sent from)
* @buf: management frame data (starting from IEEE 802.11 header)
* @len: length of frame data in octets
* @stype: management frame subtype from frame control field
* @ok: Whether the frame was ACK'ed
*/
Use generic driver events for TX status and RX reporting Replace driver wrapper calls to hostapd_tx_status(), hostapd_rx_from_unknown_sta(), hostapd_mgmt_rx(), and hostapd_mgmt_tx_cb() with new generic driver events EVENT_TX_STATUS, EVENT_RX_FROM_UNKNOWN, and EVENT_RX_MGMT. This cleans up lot of the driver wrapper code to be less dependent on whether it is being used within wpa_supplicant AP mode or hostapd.
2009-12-13 22:05:39 +01:00
void ieee802_11_mgmt_cb(struct hostapd_data *hapd, const u8 *buf, size_t len,
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
u16 stype, int ok)
{
Use generic driver events for TX status and RX reporting Replace driver wrapper calls to hostapd_tx_status(), hostapd_rx_from_unknown_sta(), hostapd_mgmt_rx(), and hostapd_mgmt_tx_cb() with new generic driver events EVENT_TX_STATUS, EVENT_RX_FROM_UNKNOWN, and EVENT_RX_MGMT. This cleans up lot of the driver wrapper code to be less dependent on whether it is being used within wpa_supplicant AP mode or hostapd.
2009-12-13 22:05:39 +01:00
const struct ieee80211_mgmt *mgmt;
mgmt = (const struct ieee80211_mgmt *) buf;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
hostapd: Allow external management frame processing or testing This enables more convenient protocol testing of station side functionality in various error cases and unexpected sequences without having to implement each test scenario within hostapd. ext_mgmt_frame_handle parameter can be set to 1 to move all management frame processing into an external program through control interface events (MGMT-RX and MGMT-TX-STATUS) and command (MGMT_TX). Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-26 07:35:22 +01:00
#ifdef CONFIG_TESTING_OPTIONS
if (hapd->ext_mgmt_frame_handling) {
Add MGMT_TX_STATUS_PROCESS command for testing purposes This allows ext_mgmt_frame_handling=1 cases with hostapd to process TX status events based on external processing. This is useful for increased test coverage of management frame processing. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-08-04 12:14:57 +02:00
size_t hex_len = 2 * len + 1;
char *hex = os_malloc(hex_len);
if (hex) {
wpa_snprintf_hex(hex, hex_len, buf, len);
wpa_msg(hapd->msg_ctx, MSG_INFO,
"MGMT-TX-STATUS stype=%u ok=%d buf=%s",
stype, ok, hex);
os_free(hex);
}
hostapd: Allow external management frame processing or testing This enables more convenient protocol testing of station side functionality in various error cases and unexpected sequences without having to implement each test scenario within hostapd. ext_mgmt_frame_handle parameter can be set to 1 to move all management frame processing into an external program through control interface events (MGMT-RX and MGMT-TX-STATUS) and command (MGMT_TX). Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-26 07:35:22 +01:00
return;
}
#endif /* CONFIG_TESTING_OPTIONS */
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
switch (stype) {
case WLAN_FC_STYPE_AUTH:
wpa_printf(MSG_DEBUG, "mgmt::auth cb");
handle_auth_cb(hapd, mgmt, len, ok);
break;
case WLAN_FC_STYPE_ASSOC_RESP:
wpa_printf(MSG_DEBUG, "mgmt::assoc_resp cb");
handle_assoc_cb(hapd, mgmt, len, 0, ok);
break;
case WLAN_FC_STYPE_REASSOC_RESP:
wpa_printf(MSG_DEBUG, "mgmt::reassoc_resp cb");
handle_assoc_cb(hapd, mgmt, len, 1, ok);
break;
case WLAN_FC_STYPE_PROBE_RESP:
AP: Debug print management frame TX result Inside management frame TX status callback, print the TX result where it was missing. This is useful for debugging management frame drops. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-02-09 08:16:56 +01:00
wpa_printf(MSG_EXCESSIVE, "mgmt::proberesp cb ok=%d", ok);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
break;
case WLAN_FC_STYPE_DEAUTH:
Delay STA entry removal until Deauth/Disassoc TX status in AP mode This allows the driver to use PS buffering of Deauthentication and Disassociation frames when the STA is in power save sleep. The STA entry (and PTK) will be removed from the kernel only after the Deauth/Disassoc has been transmitted (e.g., when the STA wakes up). A hardcoded two second timeout is used to limit the length of this window should the driver fail to deliver the frame (e.g., the STA is out of range and does not wake up). The kernel STA entry is marked unauthorized during the wait to avoid accepting Data frames from the STA that we have decided to disconnect. This behavior is available only with drivers that provide TX status events for Deauth/Disassoc frames (nl80211 at this point). Other drivers continue to use the previous behavior where the STA entry is removed immediately.
2011-08-28 22:07:02 +02:00
wpa_printf(MSG_DEBUG, "mgmt::deauth cb");
handle_deauth_cb(hapd, mgmt, len, ok);
break;
case WLAN_FC_STYPE_DISASSOC:
wpa_printf(MSG_DEBUG, "mgmt::disassoc cb");
handle_disassoc_cb(hapd, mgmt, len, ok);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
break;
IEEE 802.11w: Added association ping This updates management frame protection to use the assocition ping process from the latest draft (D6.0) to protect against unauthenticated authenticate or (re)associate frames dropping association.
2008-08-31 10:04:47 +02:00
case WLAN_FC_STYPE_ACTION:
AP: Debug print management frame TX result Inside management frame TX status callback, print the TX result where it was missing. This is useful for debugging management frame drops. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-02-09 08:16:56 +01:00
wpa_printf(MSG_DEBUG, "mgmt::action cb ok=%d", ok);
Report beacon request TX status as control interface event The new BEACON-REQ-TX-STATUS control interface event is now used to report whether a beacon request (from REQ_BEACON command) was delivered successfully. This event has the following parameters: <STA address> <dialog token> <ack=0/1>. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-01-01 23:54:44 +01:00
handle_action_cb(hapd, mgmt, len, ok);
IEEE 802.11w: Added association ping This updates management frame protection to use the assocition ping process from the latest draft (D6.0) to protect against unauthenticated authenticate or (re)associate frames dropping association.
2008-08-31 10:04:47 +02:00
break;
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
default:
Convert perror/printf calls to wpa_printf This makes debug and error logging more consistent and allows them to be directed to a file more easily. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 11:51:30 +01:00
wpa_printf(MSG_INFO, "unknown mgmt cb frame subtype %d", stype);
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
break;
}
}
int ieee802_11_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
{
/* TODO */
return 0;
}
int ieee802_11_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta,
char *buf, size_t buflen)
{
/* TODO */
return 0;
}
Use generic driver events for TX status and RX reporting Replace driver wrapper calls to hostapd_tx_status(), hostapd_rx_from_unknown_sta(), hostapd_mgmt_rx(), and hostapd_mgmt_tx_cb() with new generic driver events EVENT_TX_STATUS, EVENT_RX_FROM_UNKNOWN, and EVENT_RX_MGMT. This cleans up lot of the driver wrapper code to be less dependent on whether it is being used within wpa_supplicant AP mode or hostapd.
2009-12-13 22:05:39 +01:00
void hostapd_tx_status(struct hostapd_data *hapd, const u8 *addr,
const u8 *buf, size_t len, int ack)
{
struct sta_info *sta;
struct hostapd_iface *iface = hapd->iface;
sta = ap_get_sta(hapd, addr);
if (sta == NULL && iface->num_bss > 1) {
size_t j;
for (j = 0; j < iface->num_bss; j++) {
hapd = iface->bss[j];
sta = ap_get_sta(hapd, addr);
if (sta)
break;
}
}
Ignore TX status for Data frames from not associated STA Commit d9a38716ccf90b0ab307f570a30931684a1b8730 did this for hostapd_eapol_tx_status() but missed the older hostapd_tx_status() path. Address that case, too. The TX status event may be received after a station has been disassociated in cases where the disassociation is following a transmission of a Data frame. Ignore such events if the STA is not associated at the moment the event is being processed. This avoids confusing debug entries and rescheduling of the EAPOL TX timeouts for STAs that are still in the STA table, but are not really in active EAPOL session. Signed-hostap: Jouni Malinen <j@w1.fi> intended-for: hostap-1
2012-02-14 20:04:14 +01:00
if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))
Use generic driver events for TX status and RX reporting Replace driver wrapper calls to hostapd_tx_status(), hostapd_rx_from_unknown_sta(), hostapd_mgmt_rx(), and hostapd_mgmt_tx_cb() with new generic driver events EVENT_TX_STATUS, EVENT_RX_FROM_UNKNOWN, and EVENT_RX_MGMT. This cleans up lot of the driver wrapper code to be less dependent on whether it is being used within wpa_supplicant AP mode or hostapd.
2009-12-13 22:05:39 +01:00
return;
if (sta->flags & WLAN_STA_PENDING_POLL) {
wpa_printf(MSG_DEBUG, "STA " MACSTR " %s pending "
"activity poll", MAC2STR(sta->addr),
ack ? "ACKed" : "did not ACK");
if (ack)
sta->flags &= ~WLAN_STA_PENDING_POLL;
}
ieee802_1x_tx_status(hapd, sta, buf, len, ack);
}
AP: Add explicit EAPOL TX status event The new event can be used when EAPOL TX status can't be reported as a complete 802.11 frame but is instead reported as just the EAPOL data as originally passed to hapd_send_eapol(). Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2011-11-19 12:00:30 +01:00
void hostapd_eapol_tx_status(struct hostapd_data *hapd, const u8 *dst,
const u8 *data, size_t len, int ack)
{
struct sta_info *sta;
struct hostapd_iface *iface = hapd->iface;
sta = ap_get_sta(hapd, dst);
if (sta == NULL && iface->num_bss > 1) {
size_t j;
for (j = 0; j < iface->num_bss; j++) {
hapd = iface->bss[j];
sta = ap_get_sta(hapd, dst);
if (sta)
break;
}
}
Ignore TX status for Data frames from not associated STA The TX status event may be received after a stations has been disassociated in cases where the disassociation is following a transmission of a Data frame. Ignore such events if the STA is not associated at the moment the event is being processed. This avoids confusing debug entries and rescheduling of the EAPOL TX timeouts for STAs that are still in the STA table, but are not really in active EAPOL session. Signed-hostap: Jouni Malinen <j@w1.fi> intended-for: hostap-1
2012-02-04 11:18:56 +01:00
if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
wpa_printf(MSG_DEBUG, "Ignore TX status for Data frame to STA "
MACSTR " that is not currently associated",
MAC2STR(dst));
AP: Add explicit EAPOL TX status event The new event can be used when EAPOL TX status can't be reported as a complete 802.11 frame but is instead reported as just the EAPOL data as originally passed to hapd_send_eapol(). Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2011-11-19 12:00:30 +01:00
return;
Ignore TX status for Data frames from not associated STA The TX status event may be received after a stations has been disassociated in cases where the disassociation is following a transmission of a Data frame. Ignore such events if the STA is not associated at the moment the event is being processed. This avoids confusing debug entries and rescheduling of the EAPOL TX timeouts for STAs that are still in the STA table, but are not really in active EAPOL session. Signed-hostap: Jouni Malinen <j@w1.fi> intended-for: hostap-1
2012-02-04 11:18:56 +01:00
}
AP: Add explicit EAPOL TX status event The new event can be used when EAPOL TX status can't be reported as a complete 802.11 frame but is instead reported as just the EAPOL data as originally passed to hapd_send_eapol(). Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2011-11-19 12:00:30 +01:00
ieee802_1x_eapol_tx_status(hapd, sta, data, len, ack);
}
AP: Do station poll in driver wrapper This offloads the station polling to driver wrappers, which may offload it again to the driver. The hostap driver wrapper uses "real" data frames while nl80211 uses null data frames. Also add a specific event to indicate that a poll was successful for future use with the nl80211 driver.
2011-10-20 20:03:08 +02:00
void hostapd_client_poll_ok(struct hostapd_data *hapd, const u8 *addr)
{
struct sta_info *sta;
struct hostapd_iface *iface = hapd->iface;
sta = ap_get_sta(hapd, addr);
if (sta == NULL && iface->num_bss > 1) {
size_t j;
for (j = 0; j < iface->num_bss; j++) {
hapd = iface->bss[j];
sta = ap_get_sta(hapd, addr);
if (sta)
break;
}
}
if (sta == NULL)
return;
Add POLL_STA command to check connectivity in AP mode The hostapd "POLL_STA <addr>" control interface command can be used to check whether an associated station ACKs a QoS Data frame. The received ACK for such a frame is reported as an event message ("AP-STA-POLL-OK <addr>"). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-04-08 18:37:08 +02:00
wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_POLL_OK MACSTR,
MAC2STR(sta->addr));
AP: Do station poll in driver wrapper This offloads the station polling to driver wrappers, which may offload it again to the driver. The hostap driver wrapper uses "real" data frames while nl80211 uses null data frames. Also add a specific event to indicate that a poll was successful for future use with the nl80211 driver.
2011-10-20 20:03:08 +02:00
if (!(sta->flags & WLAN_STA_PENDING_POLL))
return;
wpa_printf(MSG_DEBUG, "STA " MACSTR " ACKed pending "
"activity poll", MAC2STR(sta->addr));
sta->flags &= ~WLAN_STA_PENDING_POLL;
}
hostapd: Add WDS (4-address frame) mode with per-station interfaces This mode allows associated stations to use 4-address frames to allow layer 2 bridging to be used. At least for the time being, this is only supported with driver=nl80211.
2009-12-24 10:46:22 +01:00
void ieee802_11_rx_from_unknown(struct hostapd_data *hapd, const u8 *src,
int wds)
Use generic driver events for TX status and RX reporting Replace driver wrapper calls to hostapd_tx_status(), hostapd_rx_from_unknown_sta(), hostapd_mgmt_rx(), and hostapd_mgmt_tx_cb() with new generic driver events EVENT_TX_STATUS, EVENT_RX_FROM_UNKNOWN, and EVENT_RX_MGMT. This cleans up lot of the driver wrapper code to be less dependent on whether it is being used within wpa_supplicant AP mode or hostapd.
2009-12-13 22:05:39 +01:00
{
struct sta_info *sta;
sta = ap_get_sta(hapd, src);
Fix race condition between AssocResp callback and 4addr event It is apparently possible for the NL80211_CMD_UNEXPECTED_4ADDR_FRAME event to be delivered to hostapd before the NL80211_CMD_FRAME_TX_STATUS event for (Re)Association Response frame. This resulted in the 4-address WDS mode not getting enabled for a STA. This could occur in particular when operating under heavy load and the STA is reconnecting to the same AP in a sequence where Deauthentication frame is followed immediately by Authentication frame and the driver event processing gets delayed due to removal of the previous netdev taking time in the middle of this sequence. Fix this by recording a pending item for 4-address WDS enabling if the NL80211_CMD_UNEXPECTED_4ADDR_FRAME event would have been dropped due to incompleted association and then process this pending item if the TX status for the (Re)Association Response frame is received and it shows that the frame was acknowledged. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-12-20 00:30:09 +01:00
if (sta &&
((sta->flags & WLAN_STA_ASSOC) ||
((sta->flags & WLAN_STA_ASSOC_REQ_OK) && wds))) {
hostapd: Add check for the wds sta flag before creating 4addr VLANs Signed-hostap: Felix Fietkau <nbd@openwrt.org>
2012-09-23 12:25:49 +02:00
if (!hapd->conf->wds_sta)
return;
Fix race condition between AssocResp callback and 4addr event It is apparently possible for the NL80211_CMD_UNEXPECTED_4ADDR_FRAME event to be delivered to hostapd before the NL80211_CMD_FRAME_TX_STATUS event for (Re)Association Response frame. This resulted in the 4-address WDS mode not getting enabled for a STA. This could occur in particular when operating under heavy load and the STA is reconnecting to the same AP in a sequence where Deauthentication frame is followed immediately by Authentication frame and the driver event processing gets delayed due to removal of the previous netdev taking time in the middle of this sequence. Fix this by recording a pending item for 4-address WDS enabling if the NL80211_CMD_UNEXPECTED_4ADDR_FRAME event would have been dropped due to incompleted association and then process this pending item if the TX status for the (Re)Association Response frame is received and it shows that the frame was acknowledged. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-12-20 00:30:09 +01:00
if ((sta->flags & (WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK)) ==
WLAN_STA_ASSOC_REQ_OK) {
wpa_printf(MSG_DEBUG,
"Postpone 4-address WDS mode enabling for STA "
MACSTR " since TX status for AssocResp is not yet known",
MAC2STR(sta->addr));
sta->pending_wds_enable = 1;
return;
}
hostapd: Add WDS (4-address frame) mode with per-station interfaces This mode allows associated stations to use 4-address frames to allow layer 2 bridging to be used. At least for the time being, this is only supported with driver=nl80211.
2009-12-24 10:46:22 +01:00
if (wds && !(sta->flags & WLAN_STA_WDS)) {
WDS: Fix WEP usage with nl80211 wds_sta=1 The static WEP keys have to be configured for the new VLAN interface that is created for a 4addr WDS peer, not doing so breaks WEP functionality in nl80211/4addr based WDS links. Signed-hostap: Sujith Manoharan <c_manoha@qca.qualcomm.com>
2013-07-20 16:41:22 +02:00
int ret;
char ifname_wds[IFNAMSIZ + 1];
hostapd: Add WDS (4-address frame) mode with per-station interfaces This mode allows associated stations to use 4-address frames to allow layer 2 bridging to be used. At least for the time being, this is only supported with driver=nl80211.
2009-12-24 10:46:22 +01:00
wpa_printf(MSG_DEBUG, "Enable 4-address WDS mode for "
"STA " MACSTR " (aid %u)",
MAC2STR(sta->addr), sta->aid);
sta->flags |= WLAN_STA_WDS;
WDS: Fix WEP usage with nl80211 wds_sta=1 The static WEP keys have to be configured for the new VLAN interface that is created for a 4addr WDS peer, not doing so breaks WEP functionality in nl80211/4addr based WDS links. Signed-hostap: Sujith Manoharan <c_manoha@qca.qualcomm.com>
2013-07-20 16:41:22 +02:00
ret = hostapd_set_wds_sta(hapd, ifname_wds,
sta->addr, sta->aid, 1);
if (!ret)
hostapd_set_wds_encryption(hapd, sta,
ifname_wds);
hostapd: Add WDS (4-address frame) mode with per-station interfaces This mode allows associated stations to use 4-address frames to allow layer 2 bridging to be used. At least for the time being, this is only supported with driver=nl80211.
2009-12-24 10:46:22 +01:00
}
Use generic driver events for TX status and RX reporting Replace driver wrapper calls to hostapd_tx_status(), hostapd_rx_from_unknown_sta(), hostapd_mgmt_rx(), and hostapd_mgmt_tx_cb() with new generic driver events EVENT_TX_STATUS, EVENT_RX_FROM_UNKNOWN, and EVENT_RX_MGMT. This cleans up lot of the driver wrapper code to be less dependent on whether it is being used within wpa_supplicant AP mode or hostapd.
2009-12-13 22:05:39 +01:00
return;
hostapd: Add WDS (4-address frame) mode with per-station interfaces This mode allows associated stations to use 4-address frames to allow layer 2 bridging to be used. At least for the time being, this is only supported with driver=nl80211.
2009-12-24 10:46:22 +01:00
}
Use generic driver events for TX status and RX reporting Replace driver wrapper calls to hostapd_tx_status(), hostapd_rx_from_unknown_sta(), hostapd_mgmt_rx(), and hostapd_mgmt_tx_cb() with new generic driver events EVENT_TX_STATUS, EVENT_RX_FROM_UNKNOWN, and EVENT_RX_MGMT. This cleans up lot of the driver wrapper code to be less dependent on whether it is being used within wpa_supplicant AP mode or hostapd.
2009-12-13 22:05:39 +01:00
wpa_printf(MSG_DEBUG, "Data/PS-poll frame from not associated STA "
MACSTR, MAC2STR(src));
More consistent SA check for unexpected Data frames Use the same rules for dropping driver notifications for Data frames from unassociated stations as were added for Management frame reception. This results in more consistent behavior in sending out Deauthentication frames with Reason Code 6/7. This case was already checking for unexpected multicast addresses, so there was no issue for the PMF protections for unexpected disconnection. Anyway, better avoid unnecessary Deauthentication frames consistently. Signed-off-by: Jouni Malinen <j@w1.fi>
2019-09-11 15:01:57 +02:00
if (is_multicast_ether_addr(src) || is_zero_ether_addr(src) ||
os_memcmp(src, hapd->own_addr, ETH_ALEN) == 0) {
/* Broadcast bit set in SA or unexpected SA?! Ignore the frame
* silently. */
Do not send Deauth/Disassoc to unknown STA if SA is invalid The frame needs to be sent from an individual (non-group) address, so drop invalid frames before sending Deauth/Disassoc frames to not associated STAs.
2010-12-05 02:40:36 +01:00
return;
}
Add workaround for race condition with AssocResp TX status It may take some time for the TX status to be delivered for a (Re)Association Response frame and if any Data frames are received during that time, they may end up getting dropped as Class 3 frames in not-associated state. This results in a Disassociation frame being sent to the station and it assuming that the association has been lost. Work around the issue by remembering that the (Re)Association Request has already been accepted and skip the Deauth/Disassoc sending because of the possible Class 3 frames before the TX status callback is received.
2011-04-15 18:26:28 +02:00
if (sta && (sta->flags & WLAN_STA_ASSOC_REQ_OK)) {
wpa_printf(MSG_DEBUG, "Association Response to the STA has "
"already been sent, but no TX status yet known - "
"ignore Class 3 frame issue with " MACSTR,
MAC2STR(src));
return;
}
Use generic driver events for TX status and RX reporting Replace driver wrapper calls to hostapd_tx_status(), hostapd_rx_from_unknown_sta(), hostapd_mgmt_rx(), and hostapd_mgmt_tx_cb() with new generic driver events EVENT_TX_STATUS, EVENT_RX_FROM_UNKNOWN, and EVENT_RX_MGMT. This cleans up lot of the driver wrapper code to be less dependent on whether it is being used within wpa_supplicant AP mode or hostapd.
2009-12-13 22:05:39 +01:00
if (sta && (sta->flags & WLAN_STA_AUTH))
hostapd_driver_ops reduction set_sta_vlan, get_inact_sec, sta_deauth, sta_disassoc, and sta_remove to use inline functions instead of extra abstraction.
2010-11-24 14:36:02 +01:00
hostapd_drv_sta_disassoc(
Use generic driver events for TX status and RX reporting Replace driver wrapper calls to hostapd_tx_status(), hostapd_rx_from_unknown_sta(), hostapd_mgmt_rx(), and hostapd_mgmt_tx_cb() with new generic driver events EVENT_TX_STATUS, EVENT_RX_FROM_UNKNOWN, and EVENT_RX_MGMT. This cleans up lot of the driver wrapper code to be less dependent on whether it is being used within wpa_supplicant AP mode or hostapd.
2009-12-13 22:05:39 +01:00
hapd, src,
WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
else
hostapd_driver_ops reduction set_sta_vlan, get_inact_sec, sta_deauth, sta_disassoc, and sta_remove to use inline functions instead of extra abstraction.
2010-11-24 14:36:02 +01:00
hostapd_drv_sta_deauth(
Use generic driver events for TX status and RX reporting Replace driver wrapper calls to hostapd_tx_status(), hostapd_rx_from_unknown_sta(), hostapd_mgmt_rx(), and hostapd_mgmt_tx_cb() with new generic driver events EVENT_TX_STATUS, EVENT_RX_FROM_UNKNOWN, and EVENT_RX_MGMT. This cleans up lot of the driver wrapper code to be less dependent on whether it is being used within wpa_supplicant AP mode or hostapd.
2009-12-13 22:05:39 +01:00
hapd, src,
WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
}
Make VHT Transmit Power Envelope element helper more generic According to latest IEEE 802.11 standard, Transmit Power Envelope element is also relevant to IEEE 802.11ax and is no longer called VHT Transmit Power Envelope. Remove the VHT naming from the element and move hostapd_eid_txpower_envelope() from ieee802_11_vht.c to ieee802_11.c in preparation of using it with HE. Signed-off-by: Shay Bar <shay.bar@celeno.com>
2021-02-10 12:07:17 +01:00
u8 * hostapd_eid_txpower_envelope(struct hostapd_data *hapd, u8 *eid)
{
struct hostapd_iface *iface = hapd->iface;
struct hostapd_config *iconf = iface->conf;
struct hostapd_hw_modes *mode = iface->current_mode;
struct hostapd_channel_data *chan;
int dfs, i;
u8 channel, tx_pwr_count, local_pwr_constraint;
int max_tx_power;
u8 tx_pwr;
if (!mode)
return eid;
if (ieee80211_freq_to_chan(iface->freq, &channel) == NUM_HOSTAPD_MODES)
return eid;
for (i = 0; i < mode->num_channels; i++) {
if (mode->channels[i].freq == iface->freq)
break;
}
if (i == mode->num_channels)
return eid;
Use hostapd_get_oper_chwidth() when build Transmit Power Envelope element hostapd_get_oper_chwidth(iconf) instead of direct access to iface->conf->vht_oper_chwidth is needed here to be able to use this with HE in cases where VHT is not enabled. Signed-off-by: Shay Bar <shay.bar@celeno.com>
2021-02-10 12:07:18 +01:00
switch (hostapd_get_oper_chwidth(iconf)) {
Make VHT Transmit Power Envelope element helper more generic According to latest IEEE 802.11 standard, Transmit Power Envelope element is also relevant to IEEE 802.11ax and is no longer called VHT Transmit Power Envelope. Remove the VHT naming from the element and move hostapd_eid_txpower_envelope() from ieee802_11_vht.c to ieee802_11.c in preparation of using it with HE. Signed-off-by: Shay Bar <shay.bar@celeno.com>
2021-02-10 12:07:17 +01:00
case CHANWIDTH_USE_HT:
if (iconf->secondary_channel == 0) {
/* Max Transmit Power count = 0 (20 MHz) */
tx_pwr_count = 0;
} else {
/* Max Transmit Power count = 1 (20, 40 MHz) */
tx_pwr_count = 1;
}
break;
case CHANWIDTH_80MHZ:
/* Max Transmit Power count = 2 (20, 40, and 80 MHz) */
tx_pwr_count = 2;
break;
case CHANWIDTH_80P80MHZ:
case CHANWIDTH_160MHZ:
/* Max Transmit Power count = 3 (20, 40, 80, 160/80+80 MHz) */
tx_pwr_count = 3;
break;
default:
return eid;
}
/*
* Below local_pwr_constraint logic is referred from
* hostapd_eid_pwr_constraint.
*
* Check if DFS is required by regulatory.
*/
dfs = hostapd_is_dfs_required(hapd->iface);
if (dfs < 0)
dfs = 0;
/*
* In order to meet regulations when TPC is not implemented using
* a transmit power that is below the legal maximum (including any
* mitigation factor) should help. In this case, indicate 3 dB below
* maximum allowed transmit power.
*/
if (hapd->iconf->local_pwr_constraint == -1)
local_pwr_constraint = (dfs == 0) ? 0 : 3;
else
local_pwr_constraint = hapd->iconf->local_pwr_constraint;
/*
* A STA that is not an AP shall use a transmit power less than or
* equal to the local maximum transmit power level for the channel.
* The local maximum transmit power can be calculated from the formula:
* local max TX pwr = max TX pwr - local pwr constraint
* Where max TX pwr is maximum transmit power level specified for
* channel in Country element and local pwr constraint is specified
* for channel in this Power Constraint element.
*/
chan = &mode->channels[i];
max_tx_power = chan->max_tx_power - local_pwr_constraint;
/*
* Local Maximum Transmit power is encoded as two's complement
* with a 0.5 dB step.
*/
max_tx_power *= 2; /* in 0.5 dB steps */
if (max_tx_power > 127) {
/* 63.5 has special meaning of 63.5 dBm or higher */
max_tx_power = 127;
}
if (max_tx_power < -128)
max_tx_power = -128;
if (max_tx_power < 0)
tx_pwr = 0x80 + max_tx_power + 128;
else
tx_pwr = max_tx_power;
*eid++ = WLAN_EID_TRANSMIT_POWER_ENVELOPE;
*eid++ = 2 + tx_pwr_count;
/*
* Max Transmit Power count and
* Max Transmit Power units = 0 (EIRP)
*/
*eid++ = tx_pwr_count;
for (i = 0; i <= tx_pwr_count; i++)
*eid++ = tx_pwr;
return eid;
}
Move hostapd_eid_wb_chsw_wrapper() to non-VHT-specific file Move hostapd_eid_wb_chsw_wrapper() from VHT specific ieee802_11_vht.c to ieee802_11.c since this can be used for both HE and VHT. This commit does not change any functionality to enable the HE use case, i.e., the function is just moved as-is. Signed-off-by: Muna Sinada <msinada@codeaurora.org>
2020-05-18 15:57:15 +02:00
u8 * hostapd_eid_wb_chsw_wrapper(struct hostapd_data *hapd, u8 *eid)
{
u8 bw, chan1, chan2 = 0;
int freq1;
if (!hapd->cs_freq_params.channel ||
Allow HE-without-VHT to add the Channel Switch Wrapper element Modify the check for VHT to include an option for HE in hostapd_eid_wb_chsw_wrapper() and its callers to allow the Channel Switch Wrapper element with the Wide Bandwidth Channel Switch subelement to be included in Beacon and Probe Response frames when AP is operating in HE mode without VHT. Signed-off-by: Muna Sinada <msinada@codeaurora.org>
2020-05-18 15:57:16 +02:00
(!hapd->cs_freq_params.vht_enabled &&
!hapd->cs_freq_params.he_enabled))
Move hostapd_eid_wb_chsw_wrapper() to non-VHT-specific file Move hostapd_eid_wb_chsw_wrapper() from VHT specific ieee802_11_vht.c to ieee802_11.c since this can be used for both HE and VHT. This commit does not change any functionality to enable the HE use case, i.e., the function is just moved as-is. Signed-off-by: Muna Sinada <msinada@codeaurora.org>
2020-05-18 15:57:15 +02:00
return eid;
/* bandwidth: 0: 40, 1: 80, 2: 160, 3: 80+80 */
switch (hapd->cs_freq_params.bandwidth) {
case 40:
bw = 0;
break;
case 80:
/* check if it's 80+80 */
if (!hapd->cs_freq_params.center_freq2)
bw = 1;
else
bw = 3;
break;
case 160:
bw = 2;
break;
default:
/* not valid VHT bandwidth or not in CSA */
return eid;
}
freq1 = hapd->cs_freq_params.center_freq1 ?
hapd->cs_freq_params.center_freq1 :
hapd->cs_freq_params.freq;
if (ieee80211_freq_to_chan(freq1, &chan1) !=
HOSTAPD_MODE_IEEE80211A)
return eid;
if (hapd->cs_freq_params.center_freq2 &&
ieee80211_freq_to_chan(hapd->cs_freq_params.center_freq2,
&chan2) != HOSTAPD_MODE_IEEE80211A)
return eid;
*eid++ = WLAN_EID_VHT_CHANNEL_SWITCH_WRAPPER;
*eid++ = 5; /* Length of Channel Switch Wrapper */
*eid++ = WLAN_EID_VHT_WIDE_BW_CHSWITCH;
*eid++ = 3; /* Length of Wide Bandwidth Channel Switch element */
*eid++ = bw; /* New Channel Width */
*eid++ = chan1; /* New Channel Center Frequency Segment 0 */
*eid++ = chan2; /* New Channel Center Frequency Segment 1 */
return eid;
}
Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 release
2008-02-28 02:34:43 +01:00
#endif /* CONFIG_NATIVE_WINDOWS */
Reference in a new issue Copy permalink