4d77d80edd
These commnds are mesh version of PMKSA_GET/ADD commands. So the usage
and security risk is similar to them. Refer to
commit 3459381dd2 ('External persistent
storage for PMKSA cache entries') also.
The MESH_PMKSA_GET command requires peer MAC address or "any" as an
argument and outputs appropriate stored PMKSA cache. And the
MESH_PMKSA_ADD command receives an output of MESH_PMKSA_GET and re-store
the PMKSA cache into wpa_supplicant. By using re-stored PMKSA cache,
wpa_supplicant can skip commit message creation which can use
significant CPU resources.
The output of the MESH_PMKSA_GET command uses the following format:
<BSSID> <PMKID> <PMK> <expiration in seconds>
The example of MESH_PMKSA_ADD command is this.
MESH_PMKSA_ADD 02:00:00:00:03:00 231dc1c9fa2eed0354ea49e8ff2cc2dc cb0f6c9cab358a8146488566ca155421ab4f3ea4a6de2120050c149b797018fe 42930
MESH_PMKSA_ADD 02:00:00:00:04:00 d7e595916611640d3e4e8eac02909c3c eb414a33c74831275f25c2357b3c12e3d8bd2f2aab6cf781d6ade706be71321a 43180
This functionality is disabled by default and can be enabled with
CONFIG_PMKSA_CACHE_EXTERNAL=y build configuration option.
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
79 lines
2.7 KiB
C
79 lines
2.7 KiB
C
/*
|
|
* hostapd - PMKSA cache for IEEE 802.11i RSN
|
|
* Copyright (c) 2004-2008, 2012, Jouni Malinen <j@w1.fi>
|
|
*
|
|
* This software may be distributed under the terms of the BSD license.
|
|
* See README for more details.
|
|
*/
|
|
|
|
#ifndef PMKSA_CACHE_H
|
|
#define PMKSA_CACHE_H
|
|
|
|
#include "radius/radius.h"
|
|
|
|
/**
|
|
* struct rsn_pmksa_cache_entry - PMKSA cache entry
|
|
*/
|
|
struct rsn_pmksa_cache_entry {
|
|
struct rsn_pmksa_cache_entry *next, *hnext;
|
|
u8 pmkid[PMKID_LEN];
|
|
u8 pmk[PMK_LEN_MAX];
|
|
size_t pmk_len;
|
|
os_time_t expiration;
|
|
int akmp; /* WPA_KEY_MGMT_* */
|
|
u8 spa[ETH_ALEN];
|
|
|
|
u8 *identity;
|
|
size_t identity_len;
|
|
struct wpabuf *cui;
|
|
struct radius_class_data radius_class;
|
|
u8 eap_type_authsrv;
|
|
struct vlan_description *vlan_desc;
|
|
int opportunistic;
|
|
|
|
u64 acct_multi_session_id;
|
|
};
|
|
|
|
struct rsn_pmksa_cache;
|
|
|
|
struct rsn_pmksa_cache *
|
|
pmksa_cache_auth_init(void (*free_cb)(struct rsn_pmksa_cache_entry *entry,
|
|
void *ctx), void *ctx);
|
|
void pmksa_cache_auth_deinit(struct rsn_pmksa_cache *pmksa);
|
|
struct rsn_pmksa_cache_entry *
|
|
pmksa_cache_auth_get(struct rsn_pmksa_cache *pmksa,
|
|
const u8 *spa, const u8 *pmkid);
|
|
struct rsn_pmksa_cache_entry * pmksa_cache_get_okc(
|
|
struct rsn_pmksa_cache *pmksa, const u8 *spa, const u8 *aa,
|
|
const u8 *pmkid);
|
|
struct rsn_pmksa_cache_entry *
|
|
pmksa_cache_auth_add(struct rsn_pmksa_cache *pmksa,
|
|
const u8 *pmk, size_t pmk_len, const u8 *pmkid,
|
|
const u8 *kck, size_t kck_len,
|
|
const u8 *aa, const u8 *spa, int session_timeout,
|
|
struct eapol_state_machine *eapol, int akmp);
|
|
struct rsn_pmksa_cache_entry *
|
|
pmksa_cache_auth_create_entry(const u8 *pmk, size_t pmk_len, const u8 *pmkid,
|
|
const u8 *kck, size_t kck_len, const u8 *aa,
|
|
const u8 *spa, int session_timeout,
|
|
struct eapol_state_machine *eapol, int akmp);
|
|
int pmksa_cache_auth_add_entry(struct rsn_pmksa_cache *pmksa,
|
|
struct rsn_pmksa_cache_entry *entry);
|
|
struct rsn_pmksa_cache_entry *
|
|
pmksa_cache_add_okc(struct rsn_pmksa_cache *pmksa,
|
|
const struct rsn_pmksa_cache_entry *old_entry,
|
|
const u8 *aa, const u8 *pmkid);
|
|
void pmksa_cache_to_eapol_data(struct hostapd_data *hapd,
|
|
struct rsn_pmksa_cache_entry *entry,
|
|
struct eapol_state_machine *eapol);
|
|
void pmksa_cache_free_entry(struct rsn_pmksa_cache *pmksa,
|
|
struct rsn_pmksa_cache_entry *entry);
|
|
int pmksa_cache_auth_radius_das_disconnect(struct rsn_pmksa_cache *pmksa,
|
|
struct radius_das_attrs *attr);
|
|
int pmksa_cache_auth_list(struct rsn_pmksa_cache *pmksa, char *buf, size_t len);
|
|
void pmksa_cache_auth_flush(struct rsn_pmksa_cache *pmksa);
|
|
int pmksa_cache_auth_list_mesh(struct rsn_pmksa_cache *pmksa, const u8 *addr,
|
|
char *buf, size_t len);
|
|
|
|
#endif /* PMKSA_CACHE_H */
|