jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
hostap/src/ap
History
Jouni Malinen a9af1da0b5 SAE: Enforce single use for anti-clogging tokens 
Add a 16-bit token index into the anti-clogging token. This can be used
to enforce only a single use of each issued anti-clogging token request.
The token value is now token-index |
last-30-octets-of(HMAC-SHA256(sae_token_key, STA-MAC-address |
token-index)), i.e., the first two octets of the SHA256 hash value are
replaced with the token-index and token-index itself is protected as
part of the HMAC context data.

Track the used 16-bit token index values and accept received tokens only
if they use an index value that has been requested, but has not yet been
used. This makes it a bit more difficult for an attacker to perform DoS
attacks against the heavy CPU operations needed for processing SAE
commit since the attacker cannot simply replay the same frame multiple
times and instead, needs to request each token separately.

While this does not add significant extra processing/CPU need for the
attacker, this can be helpful in combination with the queued processing
of SAE commit messages in enforcing more delay during flooding of SAE
commit messages since the new anti-clogging token values are not
returned before the new message goes through the processing queue.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-06 13:07:03 +02:00
..
accounting.c Remove unused generation of Request Authenticator in Account-Request 2016-09-22 00:34:19 +03:00
accounting.h RADIUS: Use more likely unique accounting Acct-{,Multi-}Session-Id 2016-02-06 17:10:19 +02:00
acs.c ACS: Add supported channel bandwidth checking 2019-01-06 12:04:15 +02:00
acs.h ACS: Fix memory leak if interface is disabled during scan 2017-03-04 17:30:15 +02:00
ap_config.c hostapd: Support Multi-AP backhaul STA onboarding with WPS 2019-02-18 22:35:41 +02:00
ap_config.h hostapd: Support Multi-AP backhaul STA onboarding with WPS 2019-02-18 22:35:41 +02:00
ap_drv_ops.c OCE: Move OCE checks to IE formation from hostapd initialization 2018-10-30 15:43:01 +02:00
ap_drv_ops.h Add driver API to get current channel parameters 2018-12-16 18:35:30 +02:00
ap_list.c Move ap_list_timer() to use common AP periodic cleanup mechanism 2015-07-20 13:42:35 +03:00
ap_list.h Move ap_list_timer() to use common AP periodic cleanup mechanism 2015-07-20 13:42:35 +03:00
ap_mlme.c FILS: Do not clear PTK on FILS Auth/Assoc (AP) 2016-10-22 18:11:14 +03:00
ap_mlme.h Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
authsrv.c crl_reload_interval: Add CRL reloading support 2019-01-27 18:45:07 +02:00
authsrv.h Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
beacon.c HE: Add MU EDCA Parameter Set element (AP) 2019-01-08 17:22:43 +02:00
beacon.h hostapd: Added signal level to STA tracking 2016-10-29 00:55:49 +03:00
bss_load.c hostapd: Add average channel utilization in STATUS 2017-12-12 00:48:27 +02:00
bss_load.h AP: Add support for BSS load element (STA Count, Channel Utilization) 2014-10-21 23:25:48 +03:00
ctrl_iface_ap.c Avoid compiler warning about potentially unaligned pointer value 2019-02-25 19:48:49 +02:00
ctrl_iface_ap.h DPP: Allow PMKSA cache entries to be added through hostapd ctrl_iface 2017-06-19 21:13:17 +03:00
dfs.c DFS: Add supported channel bandwidth checking 2019-01-06 12:09:21 +02:00
dfs.h DFS: Handle pre-CAC expired event 2017-03-09 17:01:50 +02:00
dhcp_snoop.c HS 2.0: DHCP broadcast-to-unicast conversion before address learning 2018-12-30 01:05:18 +02:00
dhcp_snoop.h AP: Add support for Proxy ARP, DHCP snooping mechanism 2014-10-28 01:08:29 +02:00
dpp_hostapd.c DPP: Apply testing configuration option to signing of own config 2018-12-02 00:26:21 +02:00
dpp_hostapd.h DPP: Support retrieving of configurator's private key 2018-03-16 20:55:32 +02:00
drv_callbacks.c Fix cipher suite selector default value in RSNE for DMG 2019-02-21 12:42:24 +02:00
eap_user_db.c Check snprintf result to avoid compiler warnings 2018-12-24 11:09:22 +02:00
eth_p_oui.c FT: Replace inter-AP protocol with use of OUI Extended Ethertype 2017-05-03 18:30:31 +03:00
eth_p_oui.h FT: Replace inter-AP protocol with use of OUI Extended Ethertype 2017-05-03 18:30:31 +03:00
fils_hlp.c FILS: Do not process FILS HLP request again while previous one is pending 2018-12-07 16:03:40 +02:00
fils_hlp.h FILS: DHCP relay for HLP requests 2017-02-01 18:17:39 +02:00
gas_query_ap.c DPP: Integration for hostapd 2017-06-19 21:13:17 +03:00
gas_query_ap.h DPP: Integration for hostapd 2017-06-19 21:13:17 +03:00
gas_serv.c HS 2.0: OSU Provider NAI List advertisement 2018-10-05 20:49:42 +03:00
gas_serv.h HS 2.0: OSU Provider NAI List advertisement 2018-10-05 20:49:42 +03:00
hostapd.c SAE: Process received commit message through a queue 2019-03-06 13:06:50 +02:00
hostapd.h SAE: Enforce single use for anti-clogging tokens 2019-03-06 13:07:03 +02:00
hs20.c OCV: Advertise OCV capability in RSN capabilities (AP) 2018-12-16 20:48:48 +02:00
hs20.h HS 2.0: Move Terms and Conditions Server URL generation from AP to AS 2018-06-21 20:50:54 +03:00
hw_features.c hostapd: Add supported channel bandwidth checking infrastructure 2019-01-06 11:54:34 +02:00
hw_features.h hostapd: Fix some compilation errors 2015-03-29 20:51:14 +03:00
iapp.c IAPP: Set SO_REUSEADDR on listening socket 2016-08-18 20:01:48 +03:00
iapp.h Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
ieee802_1x.c Allow remote RADIUS authentication with local VLAN management 2019-01-02 23:27:49 +02:00
ieee802_1x.h FILS: Export IEEE 802.1X helper functions 2016-10-22 23:13:17 +03:00
ieee802_11.c SAE: Enforce single use for anti-clogging tokens 2019-03-06 13:07:03 +02:00
ieee802_11.h SAE: Process received commit message through a queue 2019-03-06 13:06:50 +02:00
ieee802_11_auth.c Allow remote RADIUS authentication with local VLAN management 2019-01-02 23:27:49 +02:00
ieee802_11_auth.h Extend ACL check for Probe Request frames 2018-03-03 00:42:16 +02:00
ieee802_11_he.c HE: Add MU EDCA Parameter Set element (AP) 2019-01-08 17:22:43 +02:00
ieee802_11_ht.c Do not disable 40 MHz based on co-ex report with matching primary channel 2018-03-21 16:58:05 +02:00
ieee802_11_shared.c SAE: Advertise Password Identifier use 2019-01-24 00:20:49 +02:00
ieee802_11_vht.c Store the VHT Operation element of an associated STA 2018-12-16 18:35:30 +02:00
Makefile Fix ap-mgmt-fuzzer build 2017-12-09 18:41:55 +02:00
mbo_ap.c MBO: Do not parse reason_detail in non_pref_chan attr (AP) 2016-09-25 17:31:26 +03:00
mbo_ap.h MBO: Parse non-preferred channel list on the AP 2016-02-22 21:17:38 +02:00
ndisc_snoop.c Fix DHCP/NDISC snoop deinit followed by failing re-init 2017-03-04 11:42:15 +02:00
ndisc_snoop.h proxyarp: Use C library header files and CONFIG_IPV6 2014-11-25 16:58:21 +02:00
neighbor_db.c RRM: Move neighbor report functions 2019-01-02 16:47:09 +02:00
neighbor_db.h RRM: Move neighbor report functions 2019-01-02 16:47:09 +02:00
p2p_hostapd.c Use P2P_IE_VENDOR_TYPE more consistently 2014-03-05 23:36:54 +02:00
p2p_hostapd.h Remove the GPL notification from files contributed by Atheros 2012-02-11 19:39:36 +02:00
pmksa_cache_auth.c FILS: Update PMKID derivation rules for ERP key hierarchy establishment 2017-09-13 22:17:58 +03:00
pmksa_cache_auth.h OWE: PMKSA caching in AP mode 2017-10-09 12:12:54 +03:00
preauth_auth.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
preauth_auth.h Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
rrm.c hostapd: Fix a typo in function name 2019-01-02 16:40:34 +02:00
rrm.h Report beacon request TX status as control interface event 2017-01-03 16:02:58 +02:00
sta_info.c Do not disassociate not-associated STA on timeout 2019-02-11 17:42:53 +02:00
sta_info.h AP: Allow identifying which passphrase station used with wpa_psk_file 2019-01-26 17:52:04 +02:00
taxonomy.c Fix or supress various sparse warnings 2017-01-29 18:33:10 +02:00
taxonomy.h taxonomy: Store Probe Request frames in hostapd_sta_info 2016-09-22 00:45:24 +03:00
tkip_countermeasures.c hostapd: Add logging around Michael MIC related failures 2018-04-02 16:51:29 +03:00
tkip_countermeasures.h hostapd: Fix a regression in TKIP countermeasures processing 2012-11-18 13:06:03 +02:00
utils.c FST: Do not prune STAs belonging to the same FST 2015-07-16 18:26:15 +03:00
vlan.c VLAN: Fix vlan_compare() for tagged VLANs 2016-02-22 19:53:05 +02:00
vlan.h radius: Add tagged VLAN parsing 2016-02-17 11:46:13 +02:00
vlan_full.c vlan: Use new bridge ioctl() 2019-01-02 00:23:43 +02:00
vlan_ifconfig.c vlan: Move if_nametoindex() use out of vlan_init.c 2016-03-25 18:00:44 +02:00
vlan_init.c Check snprintf result to avoid compiler warnings 2018-12-24 11:09:22 +02:00
vlan_init.h VLAN: Separate station grouping and uplink configuration 2016-02-17 11:46:11 +02:00
vlan_ioctl.c Use own header file for defining Linux VLAN kernel interface 2016-03-26 11:24:38 +02:00
vlan_util.c vlan: Remove unnecessary header includes from netlink implementation 2016-03-25 17:27:16 +02:00
vlan_util.h vlan: Move if_nametoindex() use out of vlan_init.c 2016-03-25 18:00:44 +02:00
wmm.c WMM: Fix estimated medium time calculation for some corner cases 2017-02-11 12:12:28 +02:00
wmm.h Remove obsolete license notifications 2013-12-24 22:59:52 +02:00
wnm_ap.c WNM: Fix WNM-Sleep Mode Request bounds checking 2019-01-28 14:58:17 +02:00
wnm_ap.h WNM: Collocated Interference Reporting 2018-10-30 14:07:51 +02:00
wpa_auth.c Fix a regression from VLAN assignment using WPA/WPA2 passphrase/PSK 2019-02-25 19:48:49 +02:00
wpa_auth.h Fix cipher suite selector default value in RSNE for DMG 2019-02-21 12:42:24 +02:00
wpa_auth_ft.c VLAN assignment based on used WPA/WPA2 passphrase/PSK 2019-02-14 13:36:54 +02:00
wpa_auth_glue.c VLAN assignment based on used WPA/WPA2 passphrase/PSK 2019-02-14 13:36:54 +02:00
wpa_auth_glue.h Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
wpa_auth_i.h OCV: Track STA OCV capability in AP mode 2018-12-16 20:49:13 +02:00
wpa_auth_ie.c Fix cipher suite selector default value in RSNE for DMG 2019-02-21 12:42:24 +02:00
wpa_auth_ie.h OCV: Parse all types of OCI information elements 2018-12-17 00:02:14 +02:00
wps_hostapd.c hostapd: Support Multi-AP backhaul STA onboarding with WPS 2019-02-18 22:35:41 +02:00
wps_hostapd.h WPS NFC: Add AP mode connection handover report 2014-01-27 21:10:55 +02:00
x_snoop.c AP: Enable multicast snooping on bridge if ProxyARP IPv6 is in use 2015-04-13 14:00:32 +03:00
x_snoop.h AP: Add multicast-to-unicast conversion send for "x_snoop" 2014-11-19 16:25:13 +02:00