From a3556d5813106308a7954402026d0948b00575da Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Mon, 25 May 2020 19:08:16 +0300 Subject: [PATCH] OCV: Report validation errors for EAPOL-Key messages in AP mode Add the OCV-FAILURE control interface event to notify upper layers of OCV validation issues in EAPOL-Key msg 2/4 and group 2/2. Signed-off-by: Jouni Malinen --- src/ap/wpa_auth.c | 13 ++++++++++++- src/ap/wpa_auth.h | 1 + src/ap/wpa_auth_glue.c | 1 + 3 files changed, 14 insertions(+), 1 deletion(-) diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c index d5aaf9cb8..203aecea7 100644 --- a/src/ap/wpa_auth.c +++ b/src/ap/wpa_auth.c @@ -15,6 +15,7 @@ #include "common/ieee802_11_defs.h" #include "common/ocv.h" #include "common/dpp.h" +#include "common/wpa_ctrl.h" #include "crypto/aes.h" #include "crypto/aes_wrap.h" #include "crypto/aes_siv.h" @@ -3044,6 +3045,11 @@ SM_STATE(WPA_PTK, PTKCALCNEGOTIATING) tx_chanwidth, tx_seg1_idx) != 0) { wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO, "OCV failed: %s", ocv_errorstr); + if (wpa_auth->conf.msg_ctx) + wpa_msg(wpa_auth->conf.msg_ctx, MSG_INFO, + OCV_FAILURE "addr=" MACSTR + " frame=eapol-key-m2 error=%s", + MAC2STR(sm->addr), ocv_errorstr); return; } } @@ -3868,7 +3874,7 @@ SM_STATE(WPA_PTK_GROUP, REKEYESTABLISHED) if (wpa_channel_info(wpa_auth, &ci) != 0) { wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, - "Failed to get channel info to validate received OCI in EAPOL-Key group 1/2"); + "Failed to get channel info to validate received OCI in EAPOL-Key group 2/2"); return; } @@ -3882,6 +3888,11 @@ SM_STATE(WPA_PTK_GROUP, REKEYESTABLISHED) tx_chanwidth, tx_seg1_idx) != 0) { wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO, "OCV failed: %s", ocv_errorstr); + if (wpa_auth->conf.msg_ctx) + wpa_msg(wpa_auth->conf.msg_ctx, MSG_INFO, + OCV_FAILURE "addr=" MACSTR + " frame=eapol-key-g2 error=%s", + MAC2STR(sm->addr), ocv_errorstr); return; } } diff --git a/src/ap/wpa_auth.h b/src/ap/wpa_auth.h index 1ea067bcf..90b188599 100644 --- a/src/ap/wpa_auth.h +++ b/src/ap/wpa_auth.h @@ -168,6 +168,7 @@ struct ft_remote_r1kh { struct wpa_auth_config { + void *msg_ctx; int wpa; int extended_key_id; int wpa_key_mgmt; diff --git a/src/ap/wpa_auth_glue.c b/src/ap/wpa_auth_glue.c index 05d87ac50..e1da56da9 100644 --- a/src/ap/wpa_auth_glue.c +++ b/src/ap/wpa_auth_glue.c @@ -1451,6 +1451,7 @@ int hostapd_setup_wpa(struct hostapd_data *hapd) size_t wpa_ie_len; hostapd_wpa_auth_conf(hapd->conf, hapd->iconf, &_conf); + _conf.msg_ctx = hapd->msg_ctx; if (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_EAPOL_TX_STATUS) _conf.tx_status = 1; if (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_AP_MLME)