jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

SAE: Add testing code for reflection attack

Browse source 
Allow hostapd to be configured to perform SAE reflection attack for SAE
testing purposes with sae_reflection_attack=1 configuration parameter.
This is included only in CONFIG_TESTING_OPTIONS=y builds.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This commit is contained in:
Jouni Malinen 2017-09-02 01:31:47 +03:00 committed by Jouni Malinen
parent e61fea6b46
commit e75335384a
3 changed files with 15 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
hostapd/config_file.c
View file

@ -3561,6 +3561,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
wpabuf_free(bss->own_ie_override); wpabuf_free(bss->own_ie_override);
bss->own_ie_override = tmp; bss->own_ie_override = tmp;
} else if (os_strcmp(buf, "sae_reflection_attack") == 0) {
bss->sae_reflection_attack = atoi(pos);
#endif /* CONFIG_TESTING_OPTIONS */ #endif /* CONFIG_TESTING_OPTIONS */
} else if (os_strcmp(buf, "vendor_elements") == 0) { } else if (os_strcmp(buf, "vendor_elements") == 0) {
if (parse_wpabuf_hex(line, buf, &bss->vendor_elements, pos)) if (parse_wpabuf_hex(line, buf, &bss->vendor_elements, pos))

1
src/ap/ap_config.h
View file

@ -588,6 +588,7 @@ struct hostapd_bss_config {
u8 bss_load_test[5]; u8 bss_load_test[5];
u8 bss_load_test_set; u8 bss_load_test_set;
struct wpabuf *own_ie_override; struct wpabuf *own_ie_override;
int sae_reflection_attack;
#endif /* CONFIG_TESTING_OPTIONS */ #endif /* CONFIG_TESTING_OPTIONS */
#define MESH_ENABLED BIT(0) #define MESH_ENABLED BIT(0)

12
src/ap/ieee802_11.c
View file

@ -786,6 +786,18 @@ static void handle_auth_sae(struct hostapd_data *hapd, struct sta_info *sta,
int resp = WLAN_STATUS_SUCCESS; int resp = WLAN_STATUS_SUCCESS;
struct wpabuf *data = NULL; struct wpabuf *data = NULL;
#ifdef CONFIG_TESTING_OPTIONS
if (hapd->conf->sae_reflection_attack && auth_transaction == 1) {
const u8 *pos, *end;
wpa_printf(MSG_DEBUG, "SAE: TESTING - reflection attack");
pos = mgmt->u.auth.variable;
end = ((const u8 *) mgmt) + len;
send_auth_reply(hapd, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE,
auth_transaction, resp, pos, end - pos);
goto remove_sta;
}
#endif /* CONFIG_TESTING_OPTIONS */
if (!sta->sae) { if (!sta->sae) {
if (auth_transaction != 1 || if (auth_transaction != 1 ||
status_code != WLAN_STATUS_SUCCESS) { status_code != WLAN_STATUS_SUCCESS) {