PMKSA: Flush AP/mesh PMKSA cache by PMKSA_FLUSH command

This extends the wpa_supplicant PMKSA_FLUSH control interface command to
allow the PMKSA list from the authenticator side to be flushed for AP
and mesh mode. In addition, this adds a hostapd PMKSA_FLUSH control
interface command to flush the PMKSA entries.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
This commit is contained in:
Masashi Honma 2016-03-09 18:16:13 +09:00 committed by Jouni Malinen
parent b8daac18a4
commit 4c522c7798
11 changed files with 65 additions and 1 deletions

View file

@ -2310,6 +2310,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
} else if (os_strcmp(buf, "PMKSA") == 0) { } else if (os_strcmp(buf, "PMKSA") == 0) {
reply_len = hostapd_ctrl_iface_pmksa_list(hapd, reply, reply_len = hostapd_ctrl_iface_pmksa_list(hapd, reply,
reply_size); reply_size);
} else if (os_strcmp(buf, "PMKSA_FLUSH") == 0) {
hostapd_ctrl_iface_pmksa_flush(hapd);
} else { } else {
os_memcpy(reply, "UNKNOWN COMMAND\n", 16); os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
reply_len = 16; reply_len = 16;

View file

@ -1136,6 +1136,13 @@ static int hostapd_cli_cmd_pmksa(struct wpa_ctrl *ctrl, int argc, char *argv[])
} }
static int hostapd_cli_cmd_pmksa_flush(struct wpa_ctrl *ctrl, int argc,
char *argv[])
{
return wpa_ctrl_command(ctrl, "PMKSA_FLUSH");
}
struct hostapd_cli_cmd { struct hostapd_cli_cmd {
const char *cmd; const char *cmd;
int (*handler)(struct wpa_ctrl *ctrl, int argc, char *argv[]); int (*handler)(struct wpa_ctrl *ctrl, int argc, char *argv[]);
@ -1196,6 +1203,7 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
{ "erp_flush", hostapd_cli_cmd_erp_flush }, { "erp_flush", hostapd_cli_cmd_erp_flush },
{ "log_level", hostapd_cli_cmd_log_level }, { "log_level", hostapd_cli_cmd_log_level },
{ "pmksa", hostapd_cli_cmd_pmksa }, { "pmksa", hostapd_cli_cmd_pmksa },
{ "pmksa_flush", hostapd_cli_cmd_pmksa_flush },
{ NULL, NULL } { NULL, NULL }
}; };

View file

@ -575,3 +575,9 @@ int hostapd_ctrl_iface_pmksa_list(struct hostapd_data *hapd, char *buf,
{ {
return wpa_auth_pmksa_list(hapd->wpa_auth, buf, len); return wpa_auth_pmksa_list(hapd->wpa_auth, buf, len);
} }
void hostapd_ctrl_iface_pmksa_flush(struct hostapd_data *hapd)
{
wpa_auth_pmksa_flush(hapd->wpa_auth);
}

View file

@ -26,5 +26,6 @@ int hostapd_parse_csa_settings(const char *pos,
int hostapd_ctrl_iface_stop_ap(struct hostapd_data *hapd); int hostapd_ctrl_iface_stop_ap(struct hostapd_data *hapd);
int hostapd_ctrl_iface_pmksa_list(struct hostapd_data *hapd, char *buf, int hostapd_ctrl_iface_pmksa_list(struct hostapd_data *hapd, char *buf,
size_t len); size_t len);
void hostapd_ctrl_iface_pmksa_flush(struct hostapd_data *hapd);
#endif /* CTRL_IFACE_AP_H */ #endif /* CTRL_IFACE_AP_H */

View file

@ -92,6 +92,20 @@ void pmksa_cache_free_entry(struct rsn_pmksa_cache *pmksa,
} }
/**
* pmksa_cache_auth_flush - Flush all PMKSA cache entries
* @pmksa: Pointer to PMKSA cache data from pmksa_cache_auth_init()
*/
void pmksa_cache_auth_flush(struct rsn_pmksa_cache *pmksa)
{
while (pmksa->pmksa) {
wpa_printf(MSG_DEBUG, "RSN: Flush PMKSA cache entry for "
MACSTR, MAC2STR(pmksa->pmksa->spa));
pmksa_cache_free_entry(pmksa, pmksa->pmksa);
}
}
static void pmksa_cache_expire(void *eloop_ctx, void *timeout_ctx) static void pmksa_cache_expire(void *eloop_ctx, void *timeout_ctx)
{ {
struct rsn_pmksa_cache *pmksa = eloop_ctx; struct rsn_pmksa_cache *pmksa = eloop_ctx;

View file

@ -64,5 +64,6 @@ void pmksa_cache_free_entry(struct rsn_pmksa_cache *pmksa,
int pmksa_cache_auth_radius_das_disconnect(struct rsn_pmksa_cache *pmksa, int pmksa_cache_auth_radius_das_disconnect(struct rsn_pmksa_cache *pmksa,
struct radius_das_attrs *attr); struct radius_das_attrs *attr);
int pmksa_cache_auth_list(struct rsn_pmksa_cache *pmksa, char *buf, size_t len); int pmksa_cache_auth_list(struct rsn_pmksa_cache *pmksa, char *buf, size_t len);
void pmksa_cache_auth_flush(struct rsn_pmksa_cache *pmksa);
#endif /* PMKSA_CACHE_H */ #endif /* PMKSA_CACHE_H */

View file

@ -3368,6 +3368,13 @@ int wpa_auth_pmksa_list(struct wpa_authenticator *wpa_auth, char *buf,
} }
void wpa_auth_pmksa_flush(struct wpa_authenticator *wpa_auth)
{
if (wpa_auth && wpa_auth->pmksa)
pmksa_cache_auth_flush(wpa_auth->pmksa);
}
/* /*
* Remove and free the group from wpa_authenticator. This is triggered by a * Remove and free the group from wpa_authenticator. This is triggered by a
* callback to make sure nobody is currently iterating the group list while it * callback to make sure nobody is currently iterating the group list while it

View file

@ -300,6 +300,7 @@ void wpa_auth_pmksa_remove(struct wpa_authenticator *wpa_auth,
const u8 *sta_addr); const u8 *sta_addr);
int wpa_auth_pmksa_list(struct wpa_authenticator *wpa_auth, char *buf, int wpa_auth_pmksa_list(struct wpa_authenticator *wpa_auth, char *buf,
size_t len); size_t len);
void wpa_auth_pmksa_flush(struct wpa_authenticator *wpa_auth);
int wpa_auth_sta_set_vlan(struct wpa_state_machine *sm, int vlan_id); int wpa_auth_sta_set_vlan(struct wpa_state_machine *sm, int vlan_id);
void wpa_auth_eapol_key_tx_status(struct wpa_authenticator *wpa_auth, void wpa_auth_eapol_key_tx_status(struct wpa_authenticator *wpa_auth,
struct wpa_state_machine *sm, int ack); struct wpa_state_machine *sm, int ack);

View file

@ -1404,6 +1404,20 @@ int wpas_ap_pmksa_cache_list(struct wpa_supplicant *wpa_s, char *buf,
} }
void wpas_ap_pmksa_cache_flush(struct wpa_supplicant *wpa_s)
{
size_t i;
if (wpa_s->ap_iface) {
for (i = 0; i < wpa_s->ap_iface->num_bss; i++)
hostapd_ctrl_iface_pmksa_flush(wpa_s->ap_iface->bss[i]);
}
if (wpa_s->ifmsh)
hostapd_ctrl_iface_pmksa_flush(wpa_s->ifmsh->bss[0]);
}
#ifdef NEED_AP_MLME #ifdef NEED_AP_MLME
void wpas_event_dfs_radar_detected(struct wpa_supplicant *wpa_s, void wpas_event_dfs_radar_detected(struct wpa_supplicant *wpa_s,
struct dfs_event *radar) struct dfs_event *radar)

View file

@ -84,6 +84,7 @@ int wpas_ap_stop_ap(struct wpa_supplicant *wpa_s);
int wpas_ap_pmksa_cache_list(struct wpa_supplicant *wpa_s, char *buf, int wpas_ap_pmksa_cache_list(struct wpa_supplicant *wpa_s, char *buf,
size_t len); size_t len);
void wpas_ap_pmksa_cache_flush(struct wpa_supplicant *wpa_s);
void wpas_event_dfs_radar_detected(struct wpa_supplicant *wpa_s, void wpas_event_dfs_radar_detected(struct wpa_supplicant *wpa_s,
struct dfs_event *radar); struct dfs_event *radar);

View file

@ -8368,6 +8368,15 @@ static int wpas_ctrl_iface_pmksa(struct wpa_supplicant *wpa_s,
} }
static void wpas_ctrl_iface_pmksa_flush(struct wpa_supplicant *wpa_s)
{
wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
#ifdef CONFIG_AP
wpas_ap_pmksa_cache_flush(wpa_s);
#endif /* CONFIG_AP */
}
static int wpas_ctrl_cmd_debug_level(const char *cmd) static int wpas_ctrl_cmd_debug_level(const char *cmd)
{ {
if (os_strcmp(cmd, "PING") == 0 || if (os_strcmp(cmd, "PING") == 0 ||
@ -8441,7 +8450,7 @@ char * wpa_supplicant_ctrl_iface_process(struct wpa_supplicant *wpa_s,
} else if (os_strcmp(buf, "PMKSA") == 0) { } else if (os_strcmp(buf, "PMKSA") == 0) {
reply_len = wpas_ctrl_iface_pmksa(wpa_s, reply, reply_size); reply_len = wpas_ctrl_iface_pmksa(wpa_s, reply, reply_size);
} else if (os_strcmp(buf, "PMKSA_FLUSH") == 0) { } else if (os_strcmp(buf, "PMKSA_FLUSH") == 0) {
wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL); wpas_ctrl_iface_pmksa_flush(wpa_s);
} else if (os_strncmp(buf, "SET ", 4) == 0) { } else if (os_strncmp(buf, "SET ", 4) == 0) {
if (wpa_supplicant_ctrl_iface_set(wpa_s, buf + 4)) if (wpa_supplicant_ctrl_iface_set(wpa_s, buf + 4))
reply_len = -1; reply_len = -1;