jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

PASN: Change PASN flows to use SAE H2E only

Browse source 
Do so for both wpa_supplicant and hostapd. While this was not explicitly
required in IEEE P802.11az/D3.0, likely direction for the draft is to
start requiring use of H2E for all cases where SAE is used with PASN.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
This commit is contained in:
Ilan Peer 2021-04-08 12:06:24 +03:00 committed by Jouni Malinen
parent d9c566b1b8
commit 79f87f4734
2 changed files with 57 additions and 31 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
src/ap/ieee802_11.c
View file

@ -2383,11 +2383,12 @@ static int pasn_wd_handle_sae_commit(struct hostapd_data *hapd,
struct wpabuf *wd) struct wpabuf *wd)
{ {
struct pasn_data *pasn = sta->pasn; struct pasn_data *pasn = sta->pasn;
const char *password = NULL; const char *password;
const u8 *data; const u8 *data;
size_t buf_len; size_t buf_len;
u16 res, alg, seq, status; u16 res, alg, seq, status;
int groups[] = { pasn->group, 0 }; int groups[] = { pasn->group, 0 };
struct sae_pt *pt = NULL;
int ret; int ret;
if (!wd) if (!wd)
@ -2409,8 +2410,8 @@ static int pasn_wd_handle_sae_commit(struct hostapd_data *hapd,
wpa_printf(MSG_DEBUG, "PASN: SAE commit: alg=%u, seq=%u, status=%u", wpa_printf(MSG_DEBUG, "PASN: SAE commit: alg=%u, seq=%u, status=%u",
alg, seq, status); alg, seq, status);
/* TODO: SAE H2E */ if (alg != WLAN_AUTH_SAE || seq != 1 ||
if (alg != WLAN_AUTH_SAE || seq != 1 || status != WLAN_STATUS_SUCCESS) { status != WLAN_STATUS_SAE_HASH_TO_ELEMENT) {
wpa_printf(MSG_DEBUG, "PASN: Dropping peer SAE commit"); wpa_printf(MSG_DEBUG, "PASN: Dropping peer SAE commit");
return -1; return -1;
} }
@ -2424,15 +2425,14 @@ static int pasn_wd_handle_sae_commit(struct hostapd_data *hapd,
return -1; return -1;
} }
password = sae_get_password(hapd, sta, NULL, NULL, NULL, NULL); password = sae_get_password(hapd, sta, NULL, NULL, &pt, NULL);
if (!password) { if (!password || !pt) {
wpa_printf(MSG_DEBUG, "PASN: No SAE password found"); wpa_printf(MSG_DEBUG, "PASN: No SAE PT found");
return -1; return -1;
} }
ret = sae_prepare_commit(hapd->own_addr, sta->addr, ret = sae_prepare_commit_pt(&pasn->sae, pt, hapd->own_addr, sta->addr,
(const u8 *) password, os_strlen(password), 0, NULL, NULL);
&pasn->sae);
if (ret) { if (ret) {
wpa_printf(MSG_DEBUG, "PASN: Failed to prepare SAE commit"); wpa_printf(MSG_DEBUG, "PASN: Failed to prepare SAE commit");
return -1; return -1;
@ -2529,7 +2529,7 @@ static struct wpabuf * pasn_get_sae_wd(struct hostapd_data *hapd,
len_ptr = wpabuf_put(buf, 2); len_ptr = wpabuf_put(buf, 2);
wpabuf_put_le16(buf, WLAN_AUTH_SAE); wpabuf_put_le16(buf, WLAN_AUTH_SAE);
wpabuf_put_le16(buf, 1); wpabuf_put_le16(buf, 1);
wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS); wpabuf_put_le16(buf, WLAN_STATUS_SAE_HASH_TO_ELEMENT);
/* Write the actual commit and update the length accordingly */ /* Write the actual commit and update the length accordingly */
sae_write_commit(&pasn->sae, buf, NULL, 0); sae_write_commit(&pasn->sae, buf, NULL, 0);

68
wpa_supplicant/pasn_supplicant.c
View file

@ -102,30 +102,17 @@ static struct wpabuf * wpas_pasn_wd_sae_commit(struct wpa_supplicant *wpa_s)
{ {
struct wpas_pasn *pasn = &wpa_s->pasn; struct wpas_pasn *pasn = &wpa_s->pasn;
struct wpabuf *buf = NULL; struct wpabuf *buf = NULL;
const char *password = NULL;
int ret; int ret;
if (pasn->ssid) {
password = pasn->ssid->sae_password;
if (!password)
password = pasn->ssid->passphrase;
}
if (!password) {
wpa_printf(MSG_DEBUG, "PASN: SAE without a password");
return NULL;
}
ret = sae_set_group(&pasn->sae, pasn->group); ret = sae_set_group(&pasn->sae, pasn->group);
if (ret) { if (ret) {
wpa_printf(MSG_DEBUG, "PASN: Failed to set SAE group"); wpa_printf(MSG_DEBUG, "PASN: Failed to set SAE group");
return NULL; return NULL;
} }
/* TODO: SAE H2E */ ret = sae_prepare_commit_pt(&pasn->sae, pasn->ssid->pt,
ret = sae_prepare_commit(wpa_s->own_addr, pasn->bssid, wpa_s->own_addr, pasn->bssid,
(const u8 *) password, os_strlen(password), 0, NULL, NULL);
&pasn->sae);
if (ret) { if (ret) {
wpa_printf(MSG_DEBUG, "PASN: Failed to prepare SAE commit"); wpa_printf(MSG_DEBUG, "PASN: Failed to prepare SAE commit");
return NULL; return NULL;
@ -140,7 +127,7 @@ static struct wpabuf * wpas_pasn_wd_sae_commit(struct wpa_supplicant *wpa_s)
wpabuf_put_le16(buf, WLAN_AUTH_SAE); wpabuf_put_le16(buf, WLAN_AUTH_SAE);
wpabuf_put_le16(buf, 1); wpabuf_put_le16(buf, 1);
wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS); wpabuf_put_le16(buf, WLAN_STATUS_SAE_HASH_TO_ELEMENT);
sae_write_commit(&pasn->sae, buf, NULL, 0); sae_write_commit(&pasn->sae, buf, NULL, 0);
pasn->sae.state = SAE_COMMITTED; pasn->sae.state = SAE_COMMITTED;
@ -186,14 +173,14 @@ static int wpas_pasn_wd_sae_rx(struct wpa_supplicant *wpa_s, struct wpabuf *wd)
wpa_printf(MSG_DEBUG, "PASN: SAE: commit: alg=%u, seq=%u, status=%u", wpa_printf(MSG_DEBUG, "PASN: SAE: commit: alg=%u, seq=%u, status=%u",
alg, seq, status); alg, seq, status);
/* TODO: SAE H2E */ if (alg != WLAN_AUTH_SAE || seq != 1 ||
if (alg != WLAN_AUTH_SAE || seq != 1 || status != WLAN_STATUS_SUCCESS) { status != WLAN_STATUS_SAE_HASH_TO_ELEMENT) {
wpa_printf(MSG_DEBUG, "PASN: SAE: dropping peer commit"); wpa_printf(MSG_DEBUG, "PASN: SAE: dropping peer commit");
return -1; return -1;
} }
res = sae_parse_commit(&pasn->sae, data + 6, len - 6, NULL, 0, groups, res = sae_parse_commit(&pasn->sae, data + 6, len - 6, NULL, 0, groups,
0); 1);
if (res != WLAN_STATUS_SUCCESS) { if (res != WLAN_STATUS_SUCCESS) {
wpa_printf(MSG_DEBUG, "PASN: SAE failed parsing commit"); wpa_printf(MSG_DEBUG, "PASN: SAE failed parsing commit");
return -1; return -1;
@ -271,6 +258,31 @@ static struct wpabuf * wpas_pasn_wd_sae_confirm(struct wpa_supplicant *wpa_s)
return buf; return buf;
} }
static int wpas_pasn_sae_setup_pt(struct wpa_supplicant *wpa_s,
struct wpa_ssid *ssid, int group)
{
const char *password = ssid->sae_password;
int groups[2] = { group, 0 };
if (!password)
password = ssid->passphrase;
if (!password) {
wpa_printf(MSG_DEBUG, "PASN: SAE without a password");
return -1;
}
if (ssid->pt)
return 0; /* PT already derived */
ssid->pt = sae_derive_pt(groups, ssid->ssid, ssid->ssid_len,
(const u8 *) password, os_strlen(password),
ssid->sae_password_id);
return ssid->pt ? 0 : -1;
}
#endif /* CONFIG_SAE */ #endif /* CONFIG_SAE */
@ -718,8 +730,8 @@ static struct wpabuf * wpas_pasn_build_auth_1(struct wpa_supplicant *wpa_s,
goto fail; goto fail;
/* Add own RNSXE */ /* Add own RNSXE */
/* TODO: How to handle protected TWT and SAE H2E? */
capab = 0; capab = 0;
capab |= BIT(WLAN_RSNX_CAPAB_SAE_H2E);
if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF) if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF)
capab |= BIT(WLAN_RSNX_CAPAB_SECURE_LTF); capab |= BIT(WLAN_RSNX_CAPAB_SECURE_LTF);
if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_RTT) if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_RTT)
@ -1008,6 +1020,20 @@ static int wpas_pasn_start(struct wpa_supplicant *wpa_s, const u8 *bssid,
"PASN: No network profile found for SAE"); "PASN: No network profile found for SAE");
return -1; return -1;
} }
if (beacon_rsnxe_len < 3 ||
!(beacon_rsnxe[2] & BIT(WLAN_RSNX_CAPAB_SAE_H2E))) {
wpa_printf(MSG_DEBUG,
"PASN: AP does not support SAE H2E");
return -1;
}
if (wpas_pasn_sae_setup_pt(wpa_s, ssid, group) < 0) {
wpa_printf(MSG_DEBUG,
"PASN: Failed to derive PT");
return -1;
}
pasn->sae.state = SAE_NOTHING; pasn->sae.state = SAE_NOTHING;
pasn->sae.send_confirm = 0; pasn->sae.send_confirm = 0;
pasn->ssid = ssid; pasn->ssid = ssid;