src/ap/ieee802_1x.c

   1 /*
   2  * hostapd / IEEE 802.1X-2004 Authenticator
   3  * Copyright (c) 2002-2012, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #include "utils/common.h"
  12 #include "utils/eloop.h"
  13 #include "crypto/md5.h"
  14 #include "crypto/crypto.h"
  15 #include "crypto/random.h"
  16 #include "common/ieee802_11_defs.h"
  17 #include "radius/radius.h"
  18 #include "radius/radius_client.h"
  19 #include "eap_server/eap.h"
  20 #include "eap_common/eap_wsc_common.h"
  21 #include "eapol_auth/eapol_auth_sm.h"
  22 #include "eapol_auth/eapol_auth_sm_i.h"
  23 #include "p2p/p2p.h"
  24 #include "hostapd.h"
  25 #include "accounting.h"
  26 #include "sta_info.h"
  27 #include "wpa_auth.h"
  28 #include "preauth_auth.h"
  29 #include "pmksa_cache_auth.h"
  30 #include "ap_config.h"
  31 #include "ap_drv_ops.h"
  32 #include "wps_hostapd.h"
  33 #include "hs20.h"
  34 #include "ieee802_1x.h"
  35
  36
  37 #ifdef CONFIG_HS20
  38 static void ieee802_1x_wnm_notif_send(void *eloop_ctx, void *timeout_ctx);
  39 #endif /* CONFIG_HS20 */
  40 static void ieee802_1x_finished(struct hostapd_data *hapd,
  41                                 struct sta_info *sta, int success,
  42                                 int remediation);
  43
  44
  45 static void ieee802_1x_send(struct hostapd_data *hapd, struct sta_info *sta,
  46                             u8 type, const u8 *data, size_t datalen)
  47 {
  48         u8 *buf;
  49         struct ieee802_1x_hdr *xhdr;
  50         size_t len;
  51         int encrypt = 0;
  52
  53         len = sizeof(*xhdr) + datalen;
  54         buf = os_zalloc(len);
  55         if (buf == NULL) {
  56                 wpa_printf(MSG_ERROR, "malloc() failed for "
  57                            "ieee802_1x_send(len=%lu)",
  58                            (unsigned long) len);
  59                 return;
  60         }
  61
  62         xhdr = (struct ieee802_1x_hdr *) buf;
  63         xhdr->version = hapd->conf->eapol_version;
  64         xhdr->type = type;
  65         xhdr->length = host_to_be16(datalen);
  66
  67         if (datalen > 0 && data != NULL)
  68                 os_memcpy(xhdr + 1, data, datalen);
  69
  70         if (wpa_auth_pairwise_set(sta->wpa_sm))
  71                 encrypt = 1;
  72 #ifdef CONFIG_TESTING_OPTIONS
  73         if (hapd->ext_eapol_frame_io) {
  74                 size_t hex_len = 2 * len + 1;
  75                 char *hex = os_malloc(hex_len);
  76
  77                 if (hex) {
  78                         wpa_snprintf_hex(hex, hex_len, buf, len);
  79                         wpa_msg(hapd->msg_ctx, MSG_INFO,
  80                                 "EAPOL-TX " MACSTR " %s",
  81                                 MAC2STR(sta->addr), hex);
  82                         os_free(hex);
  83                 }
  84         } else
  85 #endif /* CONFIG_TESTING_OPTIONS */
  86         if (sta->flags & WLAN_STA_PREAUTH) {
  87                 rsn_preauth_send(hapd, sta, buf, len);
  88         } else {
  89                 hostapd_drv_hapd_send_eapol(
  90                         hapd, sta->addr, buf, len,
  91                         encrypt, hostapd_sta_flags_to_drv(sta->flags));
  92         }
  93
  94         os_free(buf);
  95 }
  96
  97
  98 void ieee802_1x_set_sta_authorized(struct hostapd_data *hapd,
  99                                    struct sta_info *sta, int authorized)
 100 {
 101         int res;
 102
 103         if (sta->flags & WLAN_STA_PREAUTH)
 104                 return;
 105
 106         if (authorized) {
 107                 ap_sta_set_authorized(hapd, sta, 1);
 108                 res = hostapd_set_authorized(hapd, sta, 1);
 109                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
 110                                HOSTAPD_LEVEL_DEBUG, "authorizing port");
 111         } else {
 112                 ap_sta_set_authorized(hapd, sta, 0);
 113                 res = hostapd_set_authorized(hapd, sta, 0);
 114                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
 115                                HOSTAPD_LEVEL_DEBUG, "unauthorizing port");
 116         }
 117
 118         if (res && errno != ENOENT) {
 119                 wpa_printf(MSG_DEBUG, "Could not set station " MACSTR
 120                            " flags for kernel driver (errno=%d).",
 121                            MAC2STR(sta->addr), errno);
 122         }
 123
 124         if (authorized) {
 125                 os_get_reltime(&sta->connected_time);
 126                 accounting_sta_start(hapd, sta);
 127         }
 128 }
 129
 130
 131 #ifndef CONFIG_FIPS
 132 #ifndef CONFIG_NO_RC4
 133
 134 static void ieee802_1x_tx_key_one(struct hostapd_data *hapd,
 135                                   struct sta_info *sta,
 136                                   int idx, int broadcast,
 137                                   u8 *key_data, size_t key_len)
 138 {
 139         u8 *buf, *ekey;
 140         struct ieee802_1x_hdr *hdr;
 141         struct ieee802_1x_eapol_key *key;
 142         size_t len, ekey_len;
 143         struct eapol_state_machine *sm = sta->eapol_sm;
 144
 145         if (sm == NULL)
 146                 return;
 147
 148         len = sizeof(*key) + key_len;
 149         buf = os_zalloc(sizeof(*hdr) + len);
 150         if (buf == NULL)
 151                 return;
 152
 153         hdr = (struct ieee802_1x_hdr *) buf;
 154         key = (struct ieee802_1x_eapol_key *) (hdr + 1);
 155         key->type = EAPOL_KEY_TYPE_RC4;
 156         WPA_PUT_BE16(key->key_length, key_len);
 157         wpa_get_ntp_timestamp(key->replay_counter);
 158
 159         if (random_get_bytes(key->key_iv, sizeof(key->key_iv))) {
 160                 wpa_printf(MSG_ERROR, "Could not get random numbers");
 161                 os_free(buf);
 162                 return;
 163         }
 164
 165         key->key_index = idx | (broadcast ? 0 : BIT(7));
 166         if (hapd->conf->eapol_key_index_workaround) {
 167                 /* According to some information, WinXP Supplicant seems to
 168                  * interpret bit7 as an indication whether the key is to be
 169                  * activated, so make it possible to enable workaround that
 170                  * sets this bit for all keys. */
 171                 key->key_index |= BIT(7);
 172         }
 173
 174         /* Key is encrypted using "Key-IV + MSK[0..31]" as the RC4-key and
 175          * MSK[32..63] is used to sign the message. */
 176         if (sm->eap_if->eapKeyData == NULL || sm->eap_if->eapKeyDataLen < 64) {
 177                 wpa_printf(MSG_ERROR, "No eapKeyData available for encrypting "
 178                            "and signing EAPOL-Key");
 179                 os_free(buf);
 180                 return;
 181         }
 182         os_memcpy((u8 *) (key + 1), key_data, key_len);
 183         ekey_len = sizeof(key->key_iv) + 32;
 184         ekey = os_malloc(ekey_len);
 185         if (ekey == NULL) {
 186                 wpa_printf(MSG_ERROR, "Could not encrypt key");
 187                 os_free(buf);
 188                 return;
 189         }
 190         os_memcpy(ekey, key->key_iv, sizeof(key->key_iv));
 191         os_memcpy(ekey + sizeof(key->key_iv), sm->eap_if->eapKeyData, 32);
 192         rc4_skip(ekey, ekey_len, 0, (u8 *) (key + 1), key_len);
 193         os_free(ekey);
 194
 195         /* This header is needed here for HMAC-MD5, but it will be regenerated
 196          * in ieee802_1x_send() */
 197         hdr->version = hapd->conf->eapol_version;
 198         hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
 199         hdr->length = host_to_be16(len);
 200         hmac_md5(sm->eap_if->eapKeyData + 32, 32, buf, sizeof(*hdr) + len,
 201                  key->key_signature);
 202
 203         wpa_printf(MSG_DEBUG, "IEEE 802.1X: Sending EAPOL-Key to " MACSTR
 204                    " (%s index=%d)", MAC2STR(sm->addr),
 205                    broadcast ? "broadcast" : "unicast", idx);
 206         ieee802_1x_send(hapd, sta, IEEE802_1X_TYPE_EAPOL_KEY, (u8 *) key, len);
 207         if (sta->eapol_sm)
 208                 sta->eapol_sm->dot1xAuthEapolFramesTx++;
 209         os_free(buf);
 210 }
 211
 212
 213 static void ieee802_1x_tx_key(struct hostapd_data *hapd, struct sta_info *sta)
 214 {
 215         struct eapol_authenticator *eapol = hapd->eapol_auth;
 216         struct eapol_state_machine *sm = sta->eapol_sm;
 217
 218         if (sm == NULL || !sm->eap_if->eapKeyData)
 219                 return;
 220
 221         wpa_printf(MSG_DEBUG, "IEEE 802.1X: Sending EAPOL-Key(s) to " MACSTR,
 222                    MAC2STR(sta->addr));
 223
 224 #ifndef CONFIG_NO_VLAN
 225         if (sta->vlan_id > 0) {
 226                 wpa_printf(MSG_ERROR, "Using WEP with vlans is not supported.");
 227                 return;
 228         }
 229 #endif /* CONFIG_NO_VLAN */
 230
 231         if (eapol->default_wep_key) {
 232                 ieee802_1x_tx_key_one(hapd, sta, eapol->default_wep_key_idx, 1,
 233                                       eapol->default_wep_key,
 234                                       hapd->conf->default_wep_key_len);
 235         }
 236
 237         if (hapd->conf->individual_wep_key_len > 0) {
 238                 u8 *ikey;
 239                 ikey = os_malloc(hapd->conf->individual_wep_key_len);
 240                 if (ikey == NULL ||
 241                     random_get_bytes(ikey, hapd->conf->individual_wep_key_len))
 242                 {
 243                         wpa_printf(MSG_ERROR, "Could not generate random "
 244                                    "individual WEP key.");
 245                         os_free(ikey);
 246                         return;
 247                 }
 248
 249                 wpa_hexdump_key(MSG_DEBUG, "Individual WEP key",
 250                                 ikey, hapd->conf->individual_wep_key_len);
 251
 252                 ieee802_1x_tx_key_one(hapd, sta, 0, 0, ikey,
 253                                       hapd->conf->individual_wep_key_len);
 254
 255                 /* TODO: set encryption in TX callback, i.e., only after STA
 256                  * has ACKed EAPOL-Key frame */
 257                 if (hostapd_drv_set_key(hapd->conf->iface, hapd, WPA_ALG_WEP,
 258                                         sta->addr, 0, 1, NULL, 0, ikey,
 259                                         hapd->conf->individual_wep_key_len)) {
 260                         wpa_printf(MSG_ERROR, "Could not set individual WEP "
 261                                    "encryption.");
 262                 }
 263
 264                 os_free(ikey);
 265         }
 266 }
 267
 268 #endif /* CONFIG_NO_RC4 */
 269 #endif /* CONFIG_FIPS */
 270
 271
 272 const char *radius_mode_txt(struct hostapd_data *hapd)
 273 {
 274         switch (hapd->iface->conf->hw_mode) {
 275         case HOSTAPD_MODE_IEEE80211AD:
 276                 return "802.11ad";
 277         case HOSTAPD_MODE_IEEE80211A:
 278                 return "802.11a";
 279         case HOSTAPD_MODE_IEEE80211G:
 280                 return "802.11g";
 281         case HOSTAPD_MODE_IEEE80211B:
 282         default:
 283                 return "802.11b";
 284         }
 285 }
 286
 287
 288 int radius_sta_rate(struct hostapd_data *hapd, struct sta_info *sta)
 289 {
 290         int i;
 291         u8 rate = 0;
 292
 293         for (i = 0; i < sta->supported_rates_len; i++)
 294                 if ((sta->supported_rates[i] & 0x7f) > rate)
 295                         rate = sta->supported_rates[i] & 0x7f;
 296
 297         return rate;
 298 }
 299
 300
 301 #ifndef CONFIG_NO_RADIUS
 302 static void ieee802_1x_learn_identity(struct hostapd_data *hapd,
 303                                       struct eapol_state_machine *sm,
 304                                       const u8 *eap, size_t len)
 305 {
 306         const u8 *identity;
 307         size_t identity_len;
 308         const struct eap_hdr *hdr = (const struct eap_hdr *) eap;
 309
 310         if (len <= sizeof(struct eap_hdr) ||
 311             (hdr->code == EAP_CODE_RESPONSE &&
 312              eap[sizeof(struct eap_hdr)] != EAP_TYPE_IDENTITY) ||
 313             (hdr->code == EAP_CODE_INITIATE &&
 314              eap[sizeof(struct eap_hdr)] != EAP_ERP_TYPE_REAUTH) ||
 315             (hdr->code != EAP_CODE_RESPONSE &&
 316              hdr->code != EAP_CODE_INITIATE))
 317                 return;
 318
 319         identity = eap_get_identity(sm->eap, &identity_len);
 320         if (identity == NULL)
 321                 return;
 322
 323         /* Save station identity for future RADIUS packets */
 324         os_free(sm->identity);
 325         sm->identity = (u8 *) dup_binstr(identity, identity_len);
 326         if (sm->identity == NULL) {
 327                 sm->identity_len = 0;
 328                 return;
 329         }
 330
 331         sm->identity_len = identity_len;
 332         hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
 333                        HOSTAPD_LEVEL_DEBUG, "STA identity '%s'", sm->identity);
 334         sm->dot1xAuthEapolRespIdFramesRx++;
 335 }
 336
 337
 338 static int add_common_radius_sta_attr_rsn(struct hostapd_data *hapd,
 339                                           struct hostapd_radius_attr *req_attr,
 340                                           struct sta_info *sta,
 341                                           struct radius_msg *msg)
 342 {
 343         u32 suite;
 344         int ver, val;
 345
 346         ver = wpa_auth_sta_wpa_version(sta->wpa_sm);
 347         val = wpa_auth_get_pairwise(sta->wpa_sm);
 348         suite = wpa_cipher_to_suite(ver, val);
 349         if (val != -1 &&
 350             !hostapd_config_get_radius_attr(req_attr,
 351                                             RADIUS_ATTR_WLAN_PAIRWISE_CIPHER) &&
 352             !radius_msg_add_attr_int32(msg, RADIUS_ATTR_WLAN_PAIRWISE_CIPHER,
 353                                        suite)) {
 354                 wpa_printf(MSG_ERROR, "Could not add WLAN-Pairwise-Cipher");
 355                 return -1;
 356         }
 357
 358         suite = wpa_cipher_to_suite(((hapd->conf->wpa & 0x2) ||
 359                                      hapd->conf->osen) ?
 360                                     WPA_PROTO_RSN : WPA_PROTO_WPA,
 361                                     hapd->conf->wpa_group);
 362         if (!hostapd_config_get_radius_attr(req_attr,
 363                                             RADIUS_ATTR_WLAN_GROUP_CIPHER) &&
 364             !radius_msg_add_attr_int32(msg, RADIUS_ATTR_WLAN_GROUP_CIPHER,
 365                                        suite)) {
 366                 wpa_printf(MSG_ERROR, "Could not add WLAN-Group-Cipher");
 367                 return -1;
 368         }
 369
 370         val = wpa_auth_sta_key_mgmt(sta->wpa_sm);
 371         suite = wpa_akm_to_suite(val);
 372         if (val != -1 &&
 373             !hostapd_config_get_radius_attr(req_attr,
 374                                             RADIUS_ATTR_WLAN_AKM_SUITE) &&
 375             !radius_msg_add_attr_int32(msg, RADIUS_ATTR_WLAN_AKM_SUITE,
 376                                        suite)) {
 377                 wpa_printf(MSG_ERROR, "Could not add WLAN-AKM-Suite");
 378                 return -1;
 379         }
 380
 381 #ifdef CONFIG_IEEE80211W
 382         if (hapd->conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) {
 383                 suite = wpa_cipher_to_suite(WPA_PROTO_RSN,
 384                                             hapd->conf->group_mgmt_cipher);
 385                 if (!hostapd_config_get_radius_attr(
 386                             req_attr, RADIUS_ATTR_WLAN_GROUP_MGMT_CIPHER) &&
 387                     !radius_msg_add_attr_int32(
 388                             msg, RADIUS_ATTR_WLAN_GROUP_MGMT_CIPHER, suite)) {
 389                         wpa_printf(MSG_ERROR,
 390                                    "Could not add WLAN-Group-Mgmt-Cipher");
 391                         return -1;
 392                 }
 393         }
 394 #endif /* CONFIG_IEEE80211W */
 395
 396         return 0;
 397 }
 398
 399
 400 static int add_common_radius_sta_attr(struct hostapd_data *hapd,
 401                                       struct hostapd_radius_attr *req_attr,
 402                                       struct sta_info *sta,
 403                                       struct radius_msg *msg)
 404 {
 405         char buf[128];
 406
 407         if (!hostapd_config_get_radius_attr(req_attr,
 408                                             RADIUS_ATTR_NAS_PORT) &&
 409             !radius_msg_add_attr_int32(msg, RADIUS_ATTR_NAS_PORT, sta->aid)) {
 410                 wpa_printf(MSG_ERROR, "Could not add NAS-Port");
 411                 return -1;
 412         }
 413
 414         os_snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT,
 415                     MAC2STR(sta->addr));
 416         buf[sizeof(buf) - 1] = '\0';
 417         if (!radius_msg_add_attr(msg, RADIUS_ATTR_CALLING_STATION_ID,
 418                                  (u8 *) buf, os_strlen(buf))) {
 419                 wpa_printf(MSG_ERROR, "Could not add Calling-Station-Id");
 420                 return -1;
 421         }
 422
 423         if (sta->flags & WLAN_STA_PREAUTH) {
 424                 os_strlcpy(buf, "IEEE 802.11i Pre-Authentication",
 425                            sizeof(buf));
 426         } else {
 427                 os_snprintf(buf, sizeof(buf), "CONNECT %d%sMbps %s",
 428                             radius_sta_rate(hapd, sta) / 2,
 429                             (radius_sta_rate(hapd, sta) & 1) ? ".5" : "",
 430                             radius_mode_txt(hapd));
 431                 buf[sizeof(buf) - 1] = '\0';
 432         }
 433         if (!hostapd_config_get_radius_attr(req_attr,
 434                                             RADIUS_ATTR_CONNECT_INFO) &&
 435             !radius_msg_add_attr(msg, RADIUS_ATTR_CONNECT_INFO,
 436                                  (u8 *) buf, os_strlen(buf))) {
 437                 wpa_printf(MSG_ERROR, "Could not add Connect-Info");
 438                 return -1;
 439         }
 440
 441         if (sta->acct_session_id) {
 442                 os_snprintf(buf, sizeof(buf), "%016lX",
 443                             (long unsigned int) sta->acct_session_id);
 444                 if (!radius_msg_add_attr(msg, RADIUS_ATTR_ACCT_SESSION_ID,
 445                                          (u8 *) buf, os_strlen(buf))) {
 446                         wpa_printf(MSG_ERROR, "Could not add Acct-Session-Id");
 447                         return -1;
 448                 }
 449         }
 450
 451         if ((hapd->conf->wpa & 2) &&
 452             !hapd->conf->disable_pmksa_caching &&
 453             sta->eapol_sm && sta->eapol_sm->acct_multi_session_id) {
 454                 os_snprintf(buf, sizeof(buf), "%016lX",
 455                             (long unsigned int)
 456                             sta->eapol_sm->acct_multi_session_id);
 457                 if (!radius_msg_add_attr(
 458                             msg, RADIUS_ATTR_ACCT_MULTI_SESSION_ID,
 459                             (u8 *) buf, os_strlen(buf))) {
 460                         wpa_printf(MSG_INFO,
 461                                    "Could not add Acct-Multi-Session-Id");
 462                         return -1;
 463                 }
 464         }
 465
 466 #ifdef CONFIG_IEEE80211R
 467         if (hapd->conf->wpa && wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt) &&
 468             sta->wpa_sm &&
 469             (wpa_key_mgmt_ft(wpa_auth_sta_key_mgmt(sta->wpa_sm)) ||
 470              sta->auth_alg == WLAN_AUTH_FT) &&
 471             !hostapd_config_get_radius_attr(req_attr,
 472                                             RADIUS_ATTR_MOBILITY_DOMAIN_ID) &&
 473             !radius_msg_add_attr_int32(msg, RADIUS_ATTR_MOBILITY_DOMAIN_ID,
 474                                        WPA_GET_BE16(
 475                                                hapd->conf->mobility_domain))) {
 476                 wpa_printf(MSG_ERROR, "Could not add Mobility-Domain-Id");
 477                 return -1;
 478         }
 479 #endif /* CONFIG_IEEE80211R */
 480
 481         if ((hapd->conf->wpa || hapd->conf->osen) && sta->wpa_sm &&
 482             add_common_radius_sta_attr_rsn(hapd, req_attr, sta, msg) < 0)
 483                 return -1;
 484
 485         return 0;
 486 }
 487
 488
 489 int add_common_radius_attr(struct hostapd_data *hapd,
 490                            struct hostapd_radius_attr *req_attr,
 491                            struct sta_info *sta,
 492                            struct radius_msg *msg)
 493 {
 494         char buf[128];
 495         struct hostapd_radius_attr *attr;
 496         int len;
 497
 498         if (!hostapd_config_get_radius_attr(req_attr,
 499                                             RADIUS_ATTR_NAS_IP_ADDRESS) &&
 500             hapd->conf->own_ip_addr.af == AF_INET &&
 501             !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IP_ADDRESS,
 502                                  (u8 *) &hapd->conf->own_ip_addr.u.v4, 4)) {
 503                 wpa_printf(MSG_ERROR, "Could not add NAS-IP-Address");
 504                 return -1;
 505         }
 506
 507 #ifdef CONFIG_IPV6
 508         if (!hostapd_config_get_radius_attr(req_attr,
 509                                             RADIUS_ATTR_NAS_IPV6_ADDRESS) &&
 510             hapd->conf->own_ip_addr.af == AF_INET6 &&
 511             !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IPV6_ADDRESS,
 512                                  (u8 *) &hapd->conf->own_ip_addr.u.v6, 16)) {
 513                 wpa_printf(MSG_ERROR, "Could not add NAS-IPv6-Address");
 514                 return -1;
 515         }
 516 #endif /* CONFIG_IPV6 */
 517
 518         if (!hostapd_config_get_radius_attr(req_attr,
 519                                             RADIUS_ATTR_NAS_IDENTIFIER) &&
 520             hapd->conf->nas_identifier &&
 521             !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IDENTIFIER,
 522                                  (u8 *) hapd->conf->nas_identifier,
 523                                  os_strlen(hapd->conf->nas_identifier))) {
 524                 wpa_printf(MSG_ERROR, "Could not add NAS-Identifier");
 525                 return -1;
 526         }
 527
 528         len = os_snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT ":",
 529                           MAC2STR(hapd->own_addr));
 530         os_memcpy(&buf[len], hapd->conf->ssid.ssid,
 531                   hapd->conf->ssid.ssid_len);
 532         len += hapd->conf->ssid.ssid_len;
 533         if (!hostapd_config_get_radius_attr(req_attr,
 534                                             RADIUS_ATTR_CALLED_STATION_ID) &&
 535             !radius_msg_add_attr(msg, RADIUS_ATTR_CALLED_STATION_ID,
 536                                  (u8 *) buf, len)) {
 537                 wpa_printf(MSG_ERROR, "Could not add Called-Station-Id");
 538                 return -1;
 539         }
 540
 541         if (!hostapd_config_get_radius_attr(req_attr,
 542                                             RADIUS_ATTR_NAS_PORT_TYPE) &&
 543             !radius_msg_add_attr_int32(msg, RADIUS_ATTR_NAS_PORT_TYPE,
 544                                        RADIUS_NAS_PORT_TYPE_IEEE_802_11)) {
 545                 wpa_printf(MSG_ERROR, "Could not add NAS-Port-Type");
 546                 return -1;
 547         }
 548
 549 #ifdef CONFIG_INTERWORKING
 550         if (hapd->conf->interworking &&
 551             !is_zero_ether_addr(hapd->conf->hessid)) {
 552                 os_snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT,
 553                             MAC2STR(hapd->conf->hessid));
 554                 buf[sizeof(buf) - 1] = '\0';
 555                 if (!hostapd_config_get_radius_attr(req_attr,
 556                                                     RADIUS_ATTR_WLAN_HESSID) &&
 557                     !radius_msg_add_attr(msg, RADIUS_ATTR_WLAN_HESSID,
 558                                          (u8 *) buf, os_strlen(buf))) {
 559                         wpa_printf(MSG_ERROR, "Could not add WLAN-HESSID");
 560                         return -1;
 561                 }
 562         }
 563 #endif /* CONFIG_INTERWORKING */
 564
 565         if (sta && add_common_radius_sta_attr(hapd, req_attr, sta, msg) < 0)
 566                 return -1;
 567
 568         for (attr = req_attr; attr; attr = attr->next) {
 569                 if (!radius_msg_add_attr(msg, attr->type,
 570                                          wpabuf_head(attr->val),
 571                                          wpabuf_len(attr->val))) {
 572                         wpa_printf(MSG_ERROR, "Could not add RADIUS "
 573                                    "attribute");
 574                         return -1;
 575                 }
 576         }
 577
 578         return 0;
 579 }
 580
 581
 582 static void ieee802_1x_encapsulate_radius(struct hostapd_data *hapd,
 583                                           struct sta_info *sta,
 584                                           const u8 *eap, size_t len)
 585 {
 586         struct radius_msg *msg;
 587         struct eapol_state_machine *sm = sta->eapol_sm;
 588
 589         if (sm == NULL)
 590                 return;
 591
 592         ieee802_1x_learn_identity(hapd, sm, eap, len);
 593
 594         wpa_printf(MSG_DEBUG, "Encapsulating EAP message into a RADIUS "
 595                    "packet");
 596
 597         sm->radius_identifier = radius_client_get_id(hapd->radius);
 598         msg = radius_msg_new(RADIUS_CODE_ACCESS_REQUEST,
 599                              sm->radius_identifier);
 600         if (msg == NULL) {
 601                 wpa_printf(MSG_INFO, "Could not create new RADIUS packet");
 602                 return;
 603         }
 604
 605         if (radius_msg_make_authenticator(msg) < 0) {
 606                 wpa_printf(MSG_INFO, "Could not make Request Authenticator");
 607                 goto fail;
 608         }
 609
 610         if (sm->identity &&
 611             !radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME,
 612                                  sm->identity, sm->identity_len)) {
 613                 wpa_printf(MSG_INFO, "Could not add User-Name");
 614                 goto fail;
 615         }
 616
 617         if (add_common_radius_attr(hapd, hapd->conf->radius_auth_req_attr, sta,
 618                                    msg) < 0)
 619                 goto fail;
 620
 621         /* TODO: should probably check MTU from driver config; 2304 is max for
 622          * IEEE 802.11, but use 1400 to avoid problems with too large packets
 623          */
 624         if (!hostapd_config_get_radius_attr(hapd->conf->radius_auth_req_attr,
 625                                             RADIUS_ATTR_FRAMED_MTU) &&
 626             !radius_msg_add_attr_int32(msg, RADIUS_ATTR_FRAMED_MTU, 1400)) {
 627                 wpa_printf(MSG_INFO, "Could not add Framed-MTU");
 628                 goto fail;
 629         }
 630
 631         if (!radius_msg_add_eap(msg, eap, len)) {
 632                 wpa_printf(MSG_INFO, "Could not add EAP-Message");
 633                 goto fail;
 634         }
 635
 636         /* State attribute must be copied if and only if this packet is
 637          * Access-Request reply to the previous Access-Challenge */
 638         if (sm->last_recv_radius &&
 639             radius_msg_get_hdr(sm->last_recv_radius)->code ==
 640             RADIUS_CODE_ACCESS_CHALLENGE) {
 641                 int res = radius_msg_copy_attr(msg, sm->last_recv_radius,
 642                                                RADIUS_ATTR_STATE);
 643                 if (res < 0) {
 644                         wpa_printf(MSG_INFO, "Could not copy State attribute from previous Access-Challenge");
 645                         goto fail;
 646                 }
 647                 if (res > 0) {
 648                         wpa_printf(MSG_DEBUG, "Copied RADIUS State Attribute");
 649                 }
 650         }
 651
 652         if (hapd->conf->radius_request_cui) {
 653                 const u8 *cui;
 654                 size_t cui_len;
 655                 /* Add previously learned CUI or nul CUI to request CUI */
 656                 if (sm->radius_cui) {
 657                         cui = wpabuf_head(sm->radius_cui);
 658                         cui_len = wpabuf_len(sm->radius_cui);
 659                 } else {
 660                         cui = (const u8 *) "\0";
 661                         cui_len = 1;
 662                 }
 663                 if (!radius_msg_add_attr(msg,
 664                                          RADIUS_ATTR_CHARGEABLE_USER_IDENTITY,
 665                                          cui, cui_len)) {
 666                         wpa_printf(MSG_ERROR, "Could not add CUI");
 667                         goto fail;
 668                 }
 669         }
 670
 671 #ifdef CONFIG_HS20
 672         if (hapd->conf->hs20) {
 673                 u8 ver = 1; /* Release 2 */
 674                 if (!radius_msg_add_wfa(
 675                             msg, RADIUS_VENDOR_ATTR_WFA_HS20_AP_VERSION,
 676                             &ver, 1)) {
 677                         wpa_printf(MSG_ERROR, "Could not add HS 2.0 AP "
 678                                    "version");
 679                         goto fail;
 680                 }
 681
 682                 if (sta->hs20_ie && wpabuf_len(sta->hs20_ie) > 0) {
 683                         const u8 *pos;
 684                         u8 buf[3];
 685                         u16 id;
 686                         pos = wpabuf_head_u8(sta->hs20_ie);
 687                         buf[0] = (*pos) >> 4;
 688                         if (((*pos) & HS20_PPS_MO_ID_PRESENT) &&
 689                             wpabuf_len(sta->hs20_ie) >= 3)
 690                                 id = WPA_GET_LE16(pos + 1);
 691                         else
 692                                 id = 0;
 693                         WPA_PUT_BE16(buf + 1, id);
 694                         if (!radius_msg_add_wfa(
 695                                     msg,
 696                                     RADIUS_VENDOR_ATTR_WFA_HS20_STA_VERSION,
 697                                     buf, sizeof(buf))) {
 698                                 wpa_printf(MSG_ERROR, "Could not add HS 2.0 "
 699                                            "STA version");
 700                                 goto fail;
 701                         }
 702                 }
 703         }
 704 #endif /* CONFIG_HS20 */
 705
 706         if (radius_client_send(hapd->radius, msg, RADIUS_AUTH, sta->addr) < 0)
 707                 goto fail;
 708
 709         return;
 710
 711  fail:
 712         radius_msg_free(msg);
 713 }
 714 #endif /* CONFIG_NO_RADIUS */
 715
 716
 717 static void handle_eap_response(struct hostapd_data *hapd,
 718                                 struct sta_info *sta, struct eap_hdr *eap,
 719                                 size_t len)
 720 {
 721         u8 type, *data;
 722         struct eapol_state_machine *sm = sta->eapol_sm;
 723         if (sm == NULL)
 724                 return;
 725
 726         data = (u8 *) (eap + 1);
 727
 728         if (len < sizeof(*eap) + 1) {
 729                 wpa_printf(MSG_INFO, "handle_eap_response: too short response data");
 730                 return;
 731         }
 732
 733         sm->eap_type_supp = type = data[0];
 734
 735         hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
 736                        HOSTAPD_LEVEL_DEBUG, "received EAP packet (code=%d "
 737                        "id=%d len=%d) from STA: EAP Response-%s (%d)",
 738                        eap->code, eap->identifier, be_to_host16(eap->length),
 739                        eap_server_get_name(0, type), type);
 740
 741         sm->dot1xAuthEapolRespFramesRx++;
 742
 743         wpabuf_free(sm->eap_if->eapRespData);
 744         sm->eap_if->eapRespData = wpabuf_alloc_copy(eap, len);
 745         sm->eapolEap = TRUE;
 746 }
 747
 748
 749 static void handle_eap_initiate(struct hostapd_data *hapd,
 750                                 struct sta_info *sta, struct eap_hdr *eap,
 751                                 size_t len)
 752 {
 753 #ifdef CONFIG_ERP
 754         u8 type, *data;
 755         struct eapol_state_machine *sm = sta->eapol_sm;
 756
 757         if (sm == NULL)
 758                 return;
 759
 760         if (len < sizeof(*eap) + 1) {
 761                 wpa_printf(MSG_INFO,
 762                            "handle_eap_initiate: too short response data");
 763                 return;
 764         }
 765
 766         data = (u8 *) (eap + 1);
 767         type = data[0];
 768
 769         hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
 770                        HOSTAPD_LEVEL_DEBUG, "received EAP packet (code=%d "
 771                        "id=%d len=%d) from STA: EAP Initiate type %u",
 772                        eap->code, eap->identifier, be_to_host16(eap->length),
 773                        type);
 774
 775         wpabuf_free(sm->eap_if->eapRespData);
 776         sm->eap_if->eapRespData = wpabuf_alloc_copy(eap, len);
 777         sm->eapolEap = TRUE;
 778 #endif /* CONFIG_ERP */
 779 }
 780
 781
 782 /* Process incoming EAP packet from Supplicant */
 783 static void handle_eap(struct hostapd_data *hapd, struct sta_info *sta,
 784                        u8 *buf, size_t len)
 785 {
 786         struct eap_hdr *eap;
 787         u16 eap_len;
 788
 789         if (len < sizeof(*eap)) {
 790                 wpa_printf(MSG_INFO, "   too short EAP packet");
 791                 return;
 792         }
 793
 794         eap = (struct eap_hdr *) buf;
 795
 796         eap_len = be_to_host16(eap->length);
 797         wpa_printf(MSG_DEBUG, "EAP: code=%d identifier=%d length=%d",
 798                    eap->code, eap->identifier, eap_len);
 799         if (eap_len < sizeof(*eap)) {
 800                 wpa_printf(MSG_DEBUG, "   Invalid EAP length");
 801                 return;
 802         } else if (eap_len > len) {
 803                 wpa_printf(MSG_DEBUG, "   Too short frame to contain this EAP "
 804                            "packet");
 805                 return;
 806         } else if (eap_len < len) {
 807                 wpa_printf(MSG_DEBUG, "   Ignoring %lu extra bytes after EAP "
 808                            "packet", (unsigned long) len - eap_len);
 809         }
 810
 811         switch (eap->code) {
 812         case EAP_CODE_REQUEST:
 813                 wpa_printf(MSG_DEBUG, " (request)");
 814                 return;
 815         case EAP_CODE_RESPONSE:
 816                 wpa_printf(MSG_DEBUG, " (response)");
 817                 handle_eap_response(hapd, sta, eap, eap_len);
 818                 break;
 819         case EAP_CODE_SUCCESS:
 820                 wpa_printf(MSG_DEBUG, " (success)");
 821                 return;
 822         case EAP_CODE_FAILURE:
 823                 wpa_printf(MSG_DEBUG, " (failure)");
 824                 return;
 825         case EAP_CODE_INITIATE:
 826                 wpa_printf(MSG_DEBUG, " (initiate)");
 827                 handle_eap_initiate(hapd, sta, eap, eap_len);
 828                 break;
 829         case EAP_CODE_FINISH:
 830                 wpa_printf(MSG_DEBUG, " (finish)");
 831                 break;
 832         default:
 833                 wpa_printf(MSG_DEBUG, " (unknown code)");
 834                 return;
 835         }
 836 }
 837
 838
 839 static struct eapol_state_machine *
 840 ieee802_1x_alloc_eapol_sm(struct hostapd_data *hapd, struct sta_info *sta)
 841 {
 842         int flags = 0;
 843         if (sta->flags & WLAN_STA_PREAUTH)
 844                 flags |= EAPOL_SM_PREAUTH;
 845         if (sta->wpa_sm) {
 846                 flags |= EAPOL_SM_USES_WPA;
 847                 if (wpa_auth_sta_get_pmksa(sta->wpa_sm))
 848                         flags |= EAPOL_SM_FROM_PMKSA_CACHE;
 849         }
 850         return eapol_auth_alloc(hapd->eapol_auth, sta->addr, flags,
 851                                 sta->wps_ie, sta->p2p_ie, sta,
 852                                 sta->identity, sta->radius_cui);
 853 }
 854
 855
 856 /**
 857  * ieee802_1x_receive - Process the EAPOL frames from the Supplicant
 858  * @hapd: hostapd BSS data
 859  * @sa: Source address (sender of the EAPOL frame)
 860  * @buf: EAPOL frame
 861  * @len: Length of buf in octets
 862  *
 863  * This function is called for each incoming EAPOL frame from the interface
 864  */
 865 void ieee802_1x_receive(struct hostapd_data *hapd, const u8 *sa, const u8 *buf,
 866                         size_t len)
 867 {
 868         struct sta_info *sta;
 869         struct ieee802_1x_hdr *hdr;
 870         struct ieee802_1x_eapol_key *key;
 871         u16 datalen;
 872         struct rsn_pmksa_cache_entry *pmksa;
 873         int key_mgmt;
 874
 875         if (!hapd->conf->ieee802_1x && !hapd->conf->wpa && !hapd->conf->osen &&
 876             !hapd->conf->wps_state)
 877                 return;
 878
 879         wpa_printf(MSG_DEBUG, "IEEE 802.1X: %lu bytes from " MACSTR,
 880                    (unsigned long) len, MAC2STR(sa));
 881         sta = ap_get_sta(hapd, sa);
 882         if (!sta || (!(sta->flags & (WLAN_STA_ASSOC | WLAN_STA_PREAUTH)) &&
 883                      !(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_WIRED))) {
 884                 wpa_printf(MSG_DEBUG, "IEEE 802.1X data frame from not "
 885                            "associated/Pre-authenticating STA");
 886                 return;
 887         }
 888
 889         if (len < sizeof(*hdr)) {
 890                 wpa_printf(MSG_INFO, "   too short IEEE 802.1X packet");
 891                 return;
 892         }
 893
 894         hdr = (struct ieee802_1x_hdr *) buf;
 895         datalen = be_to_host16(hdr->length);
 896         wpa_printf(MSG_DEBUG, "   IEEE 802.1X: version=%d type=%d length=%d",
 897                    hdr->version, hdr->type, datalen);
 898
 899         if (len - sizeof(*hdr) < datalen) {
 900                 wpa_printf(MSG_INFO, "   frame too short for this IEEE 802.1X packet");
 901                 if (sta->eapol_sm)
 902                         sta->eapol_sm->dot1xAuthEapLengthErrorFramesRx++;
 903                 return;
 904         }
 905         if (len - sizeof(*hdr) > datalen) {
 906                 wpa_printf(MSG_DEBUG, "   ignoring %lu extra octets after "
 907                            "IEEE 802.1X packet",
 908                            (unsigned long) len - sizeof(*hdr) - datalen);
 909         }
 910
 911         if (sta->eapol_sm) {
 912                 sta->eapol_sm->dot1xAuthLastEapolFrameVersion = hdr->version;
 913                 sta->eapol_sm->dot1xAuthEapolFramesRx++;
 914         }
 915
 916         key = (struct ieee802_1x_eapol_key *) (hdr + 1);
 917         if (datalen >= sizeof(struct ieee802_1x_eapol_key) &&
 918             hdr->type == IEEE802_1X_TYPE_EAPOL_KEY &&
 919             (key->type == EAPOL_KEY_TYPE_WPA ||
 920              key->type == EAPOL_KEY_TYPE_RSN)) {
 921                 wpa_receive(hapd->wpa_auth, sta->wpa_sm, (u8 *) hdr,
 922                             sizeof(*hdr) + datalen);
 923                 return;
 924         }
 925
 926         if (!hapd->conf->ieee802_1x && !hapd->conf->osen &&
 927             !(sta->flags & (WLAN_STA_WPS | WLAN_STA_MAYBE_WPS))) {
 928                 wpa_printf(MSG_DEBUG, "IEEE 802.1X: Ignore EAPOL message - "
 929                            "802.1X not enabled and WPS not used");
 930                 return;
 931         }
 932
 933         key_mgmt = wpa_auth_sta_key_mgmt(sta->wpa_sm);
 934         if (key_mgmt != -1 && wpa_key_mgmt_wpa_psk(key_mgmt)) {
 935                 wpa_printf(MSG_DEBUG, "IEEE 802.1X: Ignore EAPOL message - "
 936                            "STA is using PSK");
 937                 return;
 938         }
 939
 940         if (!sta->eapol_sm) {
 941                 sta->eapol_sm = ieee802_1x_alloc_eapol_sm(hapd, sta);
 942                 if (!sta->eapol_sm)
 943                         return;
 944
 945 #ifdef CONFIG_WPS
 946                 if (!hapd->conf->ieee802_1x && hapd->conf->wps_state) {
 947                         u32 wflags = sta->flags & (WLAN_STA_WPS |
 948                                                    WLAN_STA_WPS2 |
 949                                                    WLAN_STA_MAYBE_WPS);
 950                         if (wflags == WLAN_STA_MAYBE_WPS ||
 951                             wflags == (WLAN_STA_WPS | WLAN_STA_MAYBE_WPS)) {
 952                                 /*
 953                                  * Delay EAPOL frame transmission until a
 954                                  * possible WPS STA initiates the handshake
 955                                  * with EAPOL-Start. Only allow the wait to be
 956                                  * skipped if the STA is known to support WPS
 957                                  * 2.0.
 958                                  */
 959                                 wpa_printf(MSG_DEBUG, "WPS: Do not start "
 960                                            "EAPOL until EAPOL-Start is "
 961                                            "received");
 962                                 sta->eapol_sm->flags |= EAPOL_SM_WAIT_START;
 963                         }
 964                 }
 965 #endif /* CONFIG_WPS */
 966
 967                 sta->eapol_sm->eap_if->portEnabled = TRUE;
 968         }
 969
 970         /* since we support version 1, we can ignore version field and proceed
 971          * as specified in version 1 standard [IEEE Std 802.1X-2001, 7.5.5] */
 972         /* TODO: actually, we are not version 1 anymore.. However, Version 2
 973          * does not change frame contents, so should be ok to process frames
 974          * more or less identically. Some changes might be needed for
 975          * verification of fields. */
 976
 977         switch (hdr->type) {
 978         case IEEE802_1X_TYPE_EAP_PACKET:
 979                 handle_eap(hapd, sta, (u8 *) (hdr + 1), datalen);
 980                 break;
 981
 982         case IEEE802_1X_TYPE_EAPOL_START:
 983                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
 984                                HOSTAPD_LEVEL_DEBUG, "received EAPOL-Start "
 985                                "from STA");
 986                 sta->eapol_sm->flags &= ~EAPOL_SM_WAIT_START;
 987                 pmksa = wpa_auth_sta_get_pmksa(sta->wpa_sm);
 988                 if (pmksa) {
 989                         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA,
 990                                        HOSTAPD_LEVEL_DEBUG, "cached PMKSA "
 991                                        "available - ignore it since "
 992                                        "STA sent EAPOL-Start");
 993                         wpa_auth_sta_clear_pmksa(sta->wpa_sm, pmksa);
 994                 }
 995                 sta->eapol_sm->eapolStart = TRUE;
 996                 sta->eapol_sm->dot1xAuthEapolStartFramesRx++;
 997                 eap_server_clear_identity(sta->eapol_sm->eap);
 998                 wpa_auth_sm_event(sta->wpa_sm, WPA_REAUTH_EAPOL);
 999                 break;
1000
1001         case IEEE802_1X_TYPE_EAPOL_LOGOFF:
1002                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1003                                HOSTAPD_LEVEL_DEBUG, "received EAPOL-Logoff "
1004                                "from STA");
1005                 sta->acct_terminate_cause =
1006                         RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
1007                 accounting_sta_stop(hapd, sta);
1008                 sta->eapol_sm->eapolLogoff = TRUE;
1009                 sta->eapol_sm->dot1xAuthEapolLogoffFramesRx++;
1010                 eap_server_clear_identity(sta->eapol_sm->eap);
1011                 break;
1012
1013         case IEEE802_1X_TYPE_EAPOL_KEY:
1014                 wpa_printf(MSG_DEBUG, "   EAPOL-Key");
1015                 if (!ap_sta_is_authorized(sta)) {
1016                         wpa_printf(MSG_DEBUG, "   Dropped key data from "
1017                                    "unauthorized Supplicant");
1018                         break;
1019                 }
1020                 break;
1021
1022         case IEEE802_1X_TYPE_EAPOL_ENCAPSULATED_ASF_ALERT:
1023                 wpa_printf(MSG_DEBUG, "   EAPOL-Encapsulated-ASF-Alert");
1024                 /* TODO: implement support for this; show data */
1025                 break;
1026
1027         default:
1028                 wpa_printf(MSG_DEBUG, "   unknown IEEE 802.1X packet type");
1029                 sta->eapol_sm->dot1xAuthInvalidEapolFramesRx++;
1030                 break;
1031         }
1032
1033         eapol_auth_step(sta->eapol_sm);
1034 }
1035
1036
1037 /**
1038  * ieee802_1x_new_station - Start IEEE 802.1X authentication
1039  * @hapd: hostapd BSS data
1040  * @sta: The station
1041  *
1042  * This function is called to start IEEE 802.1X authentication when a new
1043  * station completes IEEE 802.11 association.
1044  */
1045 void ieee802_1x_new_station(struct hostapd_data *hapd, struct sta_info *sta)
1046 {
1047         struct rsn_pmksa_cache_entry *pmksa;
1048         int reassoc = 1;
1049         int force_1x = 0;
1050         int key_mgmt;
1051
1052 #ifdef CONFIG_WPS
1053         if (hapd->conf->wps_state &&
1054             ((hapd->conf->wpa && (sta->flags & WLAN_STA_MAYBE_WPS)) ||
1055              (sta->flags & WLAN_STA_WPS))) {
1056                 /*
1057                  * Need to enable IEEE 802.1X/EAPOL state machines for possible
1058                  * WPS handshake even if IEEE 802.1X/EAPOL is not used for
1059                  * authentication in this BSS.
1060                  */
1061                 force_1x = 1;
1062         }
1063 #endif /* CONFIG_WPS */
1064
1065         if (!force_1x && !hapd->conf->ieee802_1x && !hapd->conf->osen) {
1066                 wpa_printf(MSG_DEBUG, "IEEE 802.1X: Ignore STA - "
1067                            "802.1X not enabled or forced for WPS");
1068                 /*
1069                  * Clear any possible EAPOL authenticator state to support
1070                  * reassociation change from WPS to PSK.
1071                  */
1072                 ieee802_1x_free_station(hapd, sta);
1073                 return;
1074         }
1075
1076         key_mgmt = wpa_auth_sta_key_mgmt(sta->wpa_sm);
1077         if (key_mgmt != -1 && wpa_key_mgmt_wpa_psk(key_mgmt)) {
1078                 wpa_printf(MSG_DEBUG, "IEEE 802.1X: Ignore STA - using PSK");
1079                 /*
1080                  * Clear any possible EAPOL authenticator state to support
1081                  * reassociation change from WPA-EAP to PSK.
1082                  */
1083                 ieee802_1x_free_station(hapd, sta);
1084                 return;
1085         }
1086
1087         if (sta->eapol_sm == NULL) {
1088                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1089                                HOSTAPD_LEVEL_DEBUG, "start authentication");
1090                 sta->eapol_sm = ieee802_1x_alloc_eapol_sm(hapd, sta);
1091                 if (sta->eapol_sm == NULL) {
1092                         hostapd_logger(hapd, sta->addr,
1093                                        HOSTAPD_MODULE_IEEE8021X,
1094                                        HOSTAPD_LEVEL_INFO,
1095                                        "failed to allocate state machine");
1096                         return;
1097                 }
1098                 reassoc = 0;
1099         }
1100
1101 #ifdef CONFIG_WPS
1102         sta->eapol_sm->flags &= ~EAPOL_SM_WAIT_START;
1103         if (!hapd->conf->ieee802_1x && hapd->conf->wps_state &&
1104             !(sta->flags & WLAN_STA_WPS2)) {
1105                 /*
1106                  * Delay EAPOL frame transmission until a possible WPS STA
1107                  * initiates the handshake with EAPOL-Start. Only allow the
1108                  * wait to be skipped if the STA is known to support WPS 2.0.
1109                  */
1110                 wpa_printf(MSG_DEBUG, "WPS: Do not start EAPOL until "
1111                            "EAPOL-Start is received");
1112                 sta->eapol_sm->flags |= EAPOL_SM_WAIT_START;
1113         }
1114 #endif /* CONFIG_WPS */
1115
1116         sta->eapol_sm->eap_if->portEnabled = TRUE;
1117
1118 #ifdef CONFIG_IEEE80211R
1119         if (sta->auth_alg == WLAN_AUTH_FT) {
1120                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1121                                HOSTAPD_LEVEL_DEBUG,
1122                                "PMK from FT - skip IEEE 802.1X/EAP");
1123                 /* Setup EAPOL state machines to already authenticated state
1124                  * because of existing FT information from R0KH. */
1125                 sta->eapol_sm->keyRun = TRUE;
1126                 sta->eapol_sm->eap_if->eapKeyAvailable = TRUE;
1127                 sta->eapol_sm->auth_pae_state = AUTH_PAE_AUTHENTICATING;
1128                 sta->eapol_sm->be_auth_state = BE_AUTH_SUCCESS;
1129                 sta->eapol_sm->authSuccess = TRUE;
1130                 sta->eapol_sm->authFail = FALSE;
1131                 sta->eapol_sm->portValid = TRUE;
1132                 if (sta->eapol_sm->eap)
1133                         eap_sm_notify_cached(sta->eapol_sm->eap);
1134                 /* TODO: get vlan_id from R0KH using RRB message */
1135                 return;
1136         }
1137 #endif /* CONFIG_IEEE80211R */
1138
1139         pmksa = wpa_auth_sta_get_pmksa(sta->wpa_sm);
1140         if (pmksa) {
1141                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1142                                HOSTAPD_LEVEL_DEBUG,
1143                                "PMK from PMKSA cache - skip IEEE 802.1X/EAP");
1144                 /* Setup EAPOL state machines to already authenticated state
1145                  * because of existing PMKSA information in the cache. */
1146                 sta->eapol_sm->keyRun = TRUE;
1147                 sta->eapol_sm->eap_if->eapKeyAvailable = TRUE;
1148                 sta->eapol_sm->auth_pae_state = AUTH_PAE_AUTHENTICATING;
1149                 sta->eapol_sm->be_auth_state = BE_AUTH_SUCCESS;
1150                 sta->eapol_sm->authSuccess = TRUE;
1151                 sta->eapol_sm->authFail = FALSE;
1152                 if (sta->eapol_sm->eap)
1153                         eap_sm_notify_cached(sta->eapol_sm->eap);
1154                 pmksa_cache_to_eapol_data(hapd, pmksa, sta->eapol_sm);
1155                 ap_sta_bind_vlan(hapd, sta);
1156         } else {
1157                 if (reassoc) {
1158                         /*
1159                          * Force EAPOL state machines to start
1160                          * re-authentication without having to wait for the
1161                          * Supplicant to send EAPOL-Start.
1162                          */
1163                         sta->eapol_sm->reAuthenticate = TRUE;
1164                 }
1165                 eapol_auth_step(sta->eapol_sm);
1166         }
1167 }
1168
1169
1170 void ieee802_1x_free_station(struct hostapd_data *hapd, struct sta_info *sta)
1171 {
1172         struct eapol_state_machine *sm = sta->eapol_sm;
1173
1174 #ifdef CONFIG_HS20
1175         eloop_cancel_timeout(ieee802_1x_wnm_notif_send, hapd, sta);
1176 #endif /* CONFIG_HS20 */
1177
1178         if (sm == NULL)
1179                 return;
1180
1181         sta->eapol_sm = NULL;
1182
1183 #ifndef CONFIG_NO_RADIUS
1184         radius_msg_free(sm->last_recv_radius);
1185         radius_free_class(&sm->radius_class);
1186 #endif /* CONFIG_NO_RADIUS */
1187
1188         eapol_auth_free(sm);
1189 }
1190
1191
1192 #ifndef CONFIG_NO_RADIUS
1193 static void ieee802_1x_decapsulate_radius(struct hostapd_data *hapd,
1194                                           struct sta_info *sta)
1195 {
1196         struct wpabuf *eap;
1197         const struct eap_hdr *hdr;
1198         int eap_type = -1;
1199         char buf[64];
1200         struct radius_msg *msg;
1201         struct eapol_state_machine *sm = sta->eapol_sm;
1202
1203         if (sm == NULL || sm->last_recv_radius == NULL) {
1204                 if (sm)
1205                         sm->eap_if->aaaEapNoReq = TRUE;
1206                 return;
1207         }
1208
1209         msg = sm->last_recv_radius;
1210
1211         eap = radius_msg_get_eap(msg);
1212         if (eap == NULL) {
1213                 /* RFC 3579, Chap. 2.6.3:
1214                  * RADIUS server SHOULD NOT send Access-Reject/no EAP-Message
1215                  * attribute */
1216                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1217                                HOSTAPD_LEVEL_WARNING, "could not extract "
1218                                "EAP-Message from RADIUS message");
1219                 sm->eap_if->aaaEapNoReq = TRUE;
1220                 return;
1221         }
1222
1223         if (wpabuf_len(eap) < sizeof(*hdr)) {
1224                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1225                                HOSTAPD_LEVEL_WARNING, "too short EAP packet "
1226                                "received from authentication server");
1227                 wpabuf_free(eap);
1228                 sm->eap_if->aaaEapNoReq = TRUE;
1229                 return;
1230         }
1231
1232         if (wpabuf_len(eap) > sizeof(*hdr))
1233                 eap_type = (wpabuf_head_u8(eap))[sizeof(*hdr)];
1234
1235         hdr = wpabuf_head(eap);
1236         switch (hdr->code) {
1237         case EAP_CODE_REQUEST:
1238                 if (eap_type >= 0)
1239                         sm->eap_type_authsrv = eap_type;
1240                 os_snprintf(buf, sizeof(buf), "EAP-Request-%s (%d)",
1241                             eap_server_get_name(0, eap_type), eap_type);
1242                 break;
1243         case EAP_CODE_RESPONSE:
1244                 os_snprintf(buf, sizeof(buf), "EAP Response-%s (%d)",
1245                             eap_server_get_name(0, eap_type), eap_type);
1246                 break;
1247         case EAP_CODE_SUCCESS:
1248                 os_strlcpy(buf, "EAP Success", sizeof(buf));
1249                 break;
1250         case EAP_CODE_FAILURE:
1251                 os_strlcpy(buf, "EAP Failure", sizeof(buf));
1252                 break;
1253         default:
1254                 os_strlcpy(buf, "unknown EAP code", sizeof(buf));
1255                 break;
1256         }
1257         buf[sizeof(buf) - 1] = '\0';
1258         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1259                        HOSTAPD_LEVEL_DEBUG, "decapsulated EAP packet (code=%d "
1260                        "id=%d len=%d) from RADIUS server: %s",
1261                        hdr->code, hdr->identifier, be_to_host16(hdr->length),
1262                        buf);
1263         sm->eap_if->aaaEapReq = TRUE;
1264
1265         wpabuf_free(sm->eap_if->aaaEapReqData);
1266         sm->eap_if->aaaEapReqData = eap;
1267 }
1268
1269
1270 static void ieee802_1x_get_keys(struct hostapd_data *hapd,
1271                                 struct sta_info *sta, struct radius_msg *msg,
1272                                 struct radius_msg *req,
1273                                 const u8 *shared_secret,
1274                                 size_t shared_secret_len)
1275 {
1276         struct radius_ms_mppe_keys *keys;
1277         struct eapol_state_machine *sm = sta->eapol_sm;
1278         if (sm == NULL)
1279                 return;
1280
1281         keys = radius_msg_get_ms_keys(msg, req, shared_secret,
1282                                       shared_secret_len);
1283
1284         if (keys && keys->send && keys->recv) {
1285                 size_t len = keys->send_len + keys->recv_len;
1286                 wpa_hexdump_key(MSG_DEBUG, "MS-MPPE-Send-Key",
1287                                 keys->send, keys->send_len);
1288                 wpa_hexdump_key(MSG_DEBUG, "MS-MPPE-Recv-Key",
1289                                 keys->recv, keys->recv_len);
1290
1291                 os_free(sm->eap_if->aaaEapKeyData);
1292                 sm->eap_if->aaaEapKeyData = os_malloc(len);
1293                 if (sm->eap_if->aaaEapKeyData) {
1294                         os_memcpy(sm->eap_if->aaaEapKeyData, keys->recv,
1295                                   keys->recv_len);
1296                         os_memcpy(sm->eap_if->aaaEapKeyData + keys->recv_len,
1297                                   keys->send, keys->send_len);
1298                         sm->eap_if->aaaEapKeyDataLen = len;
1299                         sm->eap_if->aaaEapKeyAvailable = TRUE;
1300                 }
1301         } else {
1302                 wpa_printf(MSG_DEBUG,
1303                            "MS-MPPE: 1x_get_keys, could not get keys: %p  send: %p  recv: %p",
1304                            keys, keys ? keys->send : NULL,
1305                            keys ? keys->recv : NULL);
1306         }
1307
1308         if (keys) {
1309                 os_free(keys->send);
1310                 os_free(keys->recv);
1311                 os_free(keys);
1312         }
1313 }
1314
1315
1316 static void ieee802_1x_store_radius_class(struct hostapd_data *hapd,
1317                                           struct sta_info *sta,
1318                                           struct radius_msg *msg)
1319 {
1320         u8 *attr_class;
1321         size_t class_len;
1322         struct eapol_state_machine *sm = sta->eapol_sm;
1323         int count, i;
1324         struct radius_attr_data *nclass;
1325         size_t nclass_count;
1326
1327         if (!hapd->conf->radius->acct_server || hapd->radius == NULL ||
1328             sm == NULL)
1329                 return;
1330
1331         radius_free_class(&sm->radius_class);
1332         count = radius_msg_count_attr(msg, RADIUS_ATTR_CLASS, 1);
1333         if (count <= 0)
1334                 return;
1335
1336         nclass = os_calloc(count, sizeof(struct radius_attr_data));
1337         if (nclass == NULL)
1338                 return;
1339
1340         nclass_count = 0;
1341
1342         attr_class = NULL;
1343         for (i = 0; i < count; i++) {
1344                 do {
1345                         if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_CLASS,
1346                                                     &attr_class, &class_len,
1347                                                     attr_class) < 0) {
1348                                 i = count;
1349                                 break;
1350                         }
1351                 } while (class_len < 1);
1352
1353                 nclass[nclass_count].data = os_malloc(class_len);
1354                 if (nclass[nclass_count].data == NULL)
1355                         break;
1356
1357                 os_memcpy(nclass[nclass_count].data, attr_class, class_len);
1358                 nclass[nclass_count].len = class_len;
1359                 nclass_count++;
1360         }
1361
1362         sm->radius_class.attr = nclass;
1363         sm->radius_class.count = nclass_count;
1364         wpa_printf(MSG_DEBUG, "IEEE 802.1X: Stored %lu RADIUS Class "
1365                    "attributes for " MACSTR,
1366                    (unsigned long) sm->radius_class.count,
1367                    MAC2STR(sta->addr));
1368 }
1369
1370
1371 /* Update sta->identity based on User-Name attribute in Access-Accept */
1372 static void ieee802_1x_update_sta_identity(struct hostapd_data *hapd,
1373                                            struct sta_info *sta,
1374                                            struct radius_msg *msg)
1375 {
1376         u8 *buf, *identity;
1377         size_t len;
1378         struct eapol_state_machine *sm = sta->eapol_sm;
1379
1380         if (sm == NULL)
1381                 return;
1382
1383         if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_USER_NAME, &buf, &len,
1384                                     NULL) < 0)
1385                 return;
1386
1387         identity = (u8 *) dup_binstr(buf, len);
1388         if (identity == NULL)
1389                 return;
1390
1391         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1392                        HOSTAPD_LEVEL_DEBUG, "old identity '%s' updated with "
1393                        "User-Name from Access-Accept '%s'",
1394                        sm->identity ? (char *) sm->identity : "N/A",
1395                        (char *) identity);
1396
1397         os_free(sm->identity);
1398         sm->identity = identity;
1399         sm->identity_len = len;
1400 }
1401
1402
1403 /* Update CUI based on Chargeable-User-Identity attribute in Access-Accept */
1404 static void ieee802_1x_update_sta_cui(struct hostapd_data *hapd,
1405                                       struct sta_info *sta,
1406                                       struct radius_msg *msg)
1407 {
1408         struct eapol_state_machine *sm = sta->eapol_sm;
1409         struct wpabuf *cui;
1410         u8 *buf;
1411         size_t len;
1412
1413         if (sm == NULL)
1414                 return;
1415
1416         if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_CHARGEABLE_USER_IDENTITY,
1417                                     &buf, &len, NULL) < 0)
1418                 return;
1419
1420         cui = wpabuf_alloc_copy(buf, len);
1421         if (cui == NULL)
1422                 return;
1423
1424         wpabuf_free(sm->radius_cui);
1425         sm->radius_cui = cui;
1426 }
1427
1428
1429 #ifdef CONFIG_HS20
1430
1431 static void ieee802_1x_hs20_sub_rem(struct sta_info *sta, u8 *pos, size_t len)
1432 {
1433         sta->remediation = 1;
1434         os_free(sta->remediation_url);
1435         if (len > 2) {
1436                 sta->remediation_url = os_malloc(len);
1437                 if (!sta->remediation_url)
1438                         return;
1439                 sta->remediation_method = pos[0];
1440                 os_memcpy(sta->remediation_url, pos + 1, len - 1);
1441                 sta->remediation_url[len - 1] = '\0';
1442                 wpa_printf(MSG_DEBUG, "HS 2.0: Subscription remediation needed "
1443                            "for " MACSTR " - server method %u URL %s",
1444                            MAC2STR(sta->addr), sta->remediation_method,
1445                            sta->remediation_url);
1446         } else {
1447                 sta->remediation_url = NULL;
1448                 wpa_printf(MSG_DEBUG, "HS 2.0: Subscription remediation needed "
1449                            "for " MACSTR, MAC2STR(sta->addr));
1450         }
1451         /* TODO: assign the STA into remediation VLAN or add filtering */
1452 }
1453
1454
1455 static void ieee802_1x_hs20_deauth_req(struct hostapd_data *hapd,
1456                                        struct sta_info *sta, u8 *pos,
1457                                        size_t len)
1458 {
1459         if (len < 3)
1460                 return; /* Malformed information */
1461         sta->hs20_deauth_requested = 1;
1462         wpa_printf(MSG_DEBUG, "HS 2.0: Deauthentication request - Code %u  "
1463                    "Re-auth Delay %u",
1464                    *pos, WPA_GET_LE16(pos + 1));
1465         wpabuf_free(sta->hs20_deauth_req);
1466         sta->hs20_deauth_req = wpabuf_alloc(len + 1);
1467         if (sta->hs20_deauth_req) {
1468                 wpabuf_put_data(sta->hs20_deauth_req, pos, 3);
1469                 wpabuf_put_u8(sta->hs20_deauth_req, len - 3);
1470                 wpabuf_put_data(sta->hs20_deauth_req, pos + 3, len - 3);
1471         }
1472         ap_sta_session_timeout(hapd, sta, hapd->conf->hs20_deauth_req_timeout);
1473 }
1474
1475
1476 static void ieee802_1x_hs20_session_info(struct hostapd_data *hapd,
1477                                          struct sta_info *sta, u8 *pos,
1478                                          size_t len, int session_timeout)
1479 {
1480         unsigned int swt;
1481         int warning_time, beacon_int;
1482
1483         if (len < 1)
1484                 return; /* Malformed information */
1485         os_free(sta->hs20_session_info_url);
1486         sta->hs20_session_info_url = os_malloc(len);
1487         if (sta->hs20_session_info_url == NULL)
1488                 return;
1489         swt = pos[0];
1490         os_memcpy(sta->hs20_session_info_url, pos + 1, len - 1);
1491         sta->hs20_session_info_url[len - 1] = '\0';
1492         wpa_printf(MSG_DEBUG, "HS 2.0: Session Information URL='%s' SWT=%u "
1493                    "(session_timeout=%d)",
1494                    sta->hs20_session_info_url, swt, session_timeout);
1495         if (session_timeout < 0) {
1496                 wpa_printf(MSG_DEBUG, "HS 2.0: No Session-Timeout set - ignore session info URL");
1497                 return;
1498         }
1499         if (swt == 255)
1500                 swt = 1; /* Use one minute as the AP selected value */
1501
1502         if ((unsigned int) session_timeout < swt * 60)
1503                 warning_time = 0;
1504         else
1505                 warning_time = session_timeout - swt * 60;
1506
1507         beacon_int = hapd->iconf->beacon_int;
1508         if (beacon_int < 1)
1509                 beacon_int = 100; /* best guess */
1510         sta->hs20_disassoc_timer = swt * 60 * 1000 / beacon_int * 125 / 128;
1511         if (sta->hs20_disassoc_timer > 65535)
1512                 sta->hs20_disassoc_timer = 65535;
1513
1514         ap_sta_session_warning_timeout(hapd, sta, warning_time);
1515 }
1516
1517 #endif /* CONFIG_HS20 */
1518
1519
1520 static void ieee802_1x_check_hs20(struct hostapd_data *hapd,
1521                                   struct sta_info *sta,
1522                                   struct radius_msg *msg,
1523                                   int session_timeout)
1524 {
1525 #ifdef CONFIG_HS20
1526         u8 *buf, *pos, *end, type, sublen;
1527         size_t len;
1528
1529         buf = NULL;
1530         sta->remediation = 0;
1531         sta->hs20_deauth_requested = 0;
1532
1533         for (;;) {
1534                 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_VENDOR_SPECIFIC,
1535                                             &buf, &len, buf) < 0)
1536                         break;
1537                 if (len < 6)
1538                         continue;
1539                 pos = buf;
1540                 end = buf + len;
1541                 if (WPA_GET_BE32(pos) != RADIUS_VENDOR_ID_WFA)
1542                         continue;
1543                 pos += 4;
1544
1545                 type = *pos++;
1546                 sublen = *pos++;
1547                 if (sublen < 2)
1548                         continue; /* invalid length */
1549                 sublen -= 2; /* skip header */
1550                 if (pos + sublen > end)
1551                         continue; /* invalid WFA VSA */
1552
1553                 switch (type) {
1554                 case RADIUS_VENDOR_ATTR_WFA_HS20_SUBSCR_REMEDIATION:
1555                         ieee802_1x_hs20_sub_rem(sta, pos, sublen);
1556                         break;
1557                 case RADIUS_VENDOR_ATTR_WFA_HS20_DEAUTH_REQ:
1558                         ieee802_1x_hs20_deauth_req(hapd, sta, pos, sublen);
1559                         break;
1560                 case RADIUS_VENDOR_ATTR_WFA_HS20_SESSION_INFO_URL:
1561                         ieee802_1x_hs20_session_info(hapd, sta, pos, sublen,
1562                                                      session_timeout);
1563                         break;
1564                 }
1565         }
1566 #endif /* CONFIG_HS20 */
1567 }
1568
1569
1570 struct sta_id_search {
1571         u8 identifier;
1572         struct eapol_state_machine *sm;
1573 };
1574
1575
1576 static int ieee802_1x_select_radius_identifier(struct hostapd_data *hapd,
1577                                                struct sta_info *sta,
1578                                                void *ctx)
1579 {
1580         struct sta_id_search *id_search = ctx;
1581         struct eapol_state_machine *sm = sta->eapol_sm;
1582
1583         if (sm && sm->radius_identifier >= 0 &&
1584             sm->radius_identifier == id_search->identifier) {
1585                 id_search->sm = sm;
1586                 return 1;
1587         }
1588         return 0;
1589 }
1590
1591
1592 static struct eapol_state_machine *
1593 ieee802_1x_search_radius_identifier(struct hostapd_data *hapd, u8 identifier)
1594 {
1595         struct sta_id_search id_search;
1596         id_search.identifier = identifier;
1597         id_search.sm = NULL;
1598         ap_for_each_sta(hapd, ieee802_1x_select_radius_identifier, &id_search);
1599         return id_search.sm;
1600 }
1601
1602
1603 /**
1604  * ieee802_1x_receive_auth - Process RADIUS frames from Authentication Server
1605  * @msg: RADIUS response message
1606  * @req: RADIUS request message
1607  * @shared_secret: RADIUS shared secret
1608  * @shared_secret_len: Length of shared_secret in octets
1609  * @data: Context data (struct hostapd_data *)
1610  * Returns: Processing status
1611  */
1612 static RadiusRxResult
1613 ieee802_1x_receive_auth(struct radius_msg *msg, struct radius_msg *req,
1614                         const u8 *shared_secret, size_t shared_secret_len,
1615                         void *data)
1616 {
1617         struct hostapd_data *hapd = data;
1618         struct sta_info *sta;
1619         u32 session_timeout = 0, termination_action, acct_interim_interval;
1620         int session_timeout_set;
1621         struct eapol_state_machine *sm;
1622         int override_eapReq = 0;
1623         struct radius_hdr *hdr = radius_msg_get_hdr(msg);
1624         struct vlan_description vlan_desc;
1625 #ifndef CONFIG_NO_VLAN
1626         int *untagged, *tagged, *notempty;
1627 #endif /* CONFIG_NO_VLAN */
1628
1629         os_memset(&vlan_desc, 0, sizeof(vlan_desc));
1630
1631         sm = ieee802_1x_search_radius_identifier(hapd, hdr->identifier);
1632         if (sm == NULL) {
1633                 wpa_printf(MSG_DEBUG, "IEEE 802.1X: Could not find matching "
1634                            "station for this RADIUS message");
1635                 return RADIUS_RX_UNKNOWN;
1636         }
1637         sta = sm->sta;
1638
1639         /* RFC 2869, Ch. 5.13: valid Message-Authenticator attribute MUST be
1640          * present when packet contains an EAP-Message attribute */
1641         if (hdr->code == RADIUS_CODE_ACCESS_REJECT &&
1642             radius_msg_get_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR, NULL,
1643                                 0) < 0 &&
1644             radius_msg_get_attr(msg, RADIUS_ATTR_EAP_MESSAGE, NULL, 0) < 0) {
1645                 wpa_printf(MSG_DEBUG, "Allowing RADIUS Access-Reject without "
1646                            "Message-Authenticator since it does not include "
1647                            "EAP-Message");
1648         } else if (radius_msg_verify(msg, shared_secret, shared_secret_len,
1649                                      req, 1)) {
1650                 wpa_printf(MSG_INFO, "Incoming RADIUS packet did not have correct Message-Authenticator - dropped");
1651                 return RADIUS_RX_INVALID_AUTHENTICATOR;
1652         }
1653
1654         if (hdr->code != RADIUS_CODE_ACCESS_ACCEPT &&
1655             hdr->code != RADIUS_CODE_ACCESS_REJECT &&
1656             hdr->code != RADIUS_CODE_ACCESS_CHALLENGE) {
1657                 wpa_printf(MSG_INFO, "Unknown RADIUS message code");
1658                 return RADIUS_RX_UNKNOWN;
1659         }
1660
1661         sm->radius_identifier = -1;
1662         wpa_printf(MSG_DEBUG, "RADIUS packet matching with station " MACSTR,
1663                    MAC2STR(sta->addr));
1664
1665         radius_msg_free(sm->last_recv_radius);
1666         sm->last_recv_radius = msg;
1667
1668         session_timeout_set =
1669                 !radius_msg_get_attr_int32(msg, RADIUS_ATTR_SESSION_TIMEOUT,
1670                                            &session_timeout);
1671         if (radius_msg_get_attr_int32(msg, RADIUS_ATTR_TERMINATION_ACTION,
1672                                       &termination_action))
1673                 termination_action = RADIUS_TERMINATION_ACTION_DEFAULT;
1674
1675         if (hapd->conf->acct_interim_interval == 0 &&
1676             hdr->code == RADIUS_CODE_ACCESS_ACCEPT &&
1677             radius_msg_get_attr_int32(msg, RADIUS_ATTR_ACCT_INTERIM_INTERVAL,
1678                                       &acct_interim_interval) == 0) {
1679                 if (acct_interim_interval < 60) {
1680                         hostapd_logger(hapd, sta->addr,
1681                                        HOSTAPD_MODULE_IEEE8021X,
1682                                        HOSTAPD_LEVEL_INFO,
1683                                        "ignored too small "
1684                                        "Acct-Interim-Interval %d",
1685                                        acct_interim_interval);
1686                 } else
1687                         sta->acct_interim_interval = acct_interim_interval;
1688         }
1689
1690
1691         switch (hdr->code) {
1692         case RADIUS_CODE_ACCESS_ACCEPT:
1693 #ifndef CONFIG_NO_VLAN
1694                 if (hapd->conf->ssid.dynamic_vlan != DYNAMIC_VLAN_DISABLED) {
1695                         notempty = &vlan_desc.notempty;
1696                         untagged = &vlan_desc.untagged;
1697                         tagged = vlan_desc.tagged;
1698                         *notempty = !!radius_msg_get_vlanid(msg, untagged,
1699                                                             MAX_NUM_TAGGED_VLAN,
1700                                                             tagged);
1701                 }
1702
1703                 if (vlan_desc.notempty &&
1704                     !hostapd_vlan_valid(hapd->conf->vlan, &vlan_desc)) {
1705                         sta->eapol_sm->authFail = TRUE;
1706                         hostapd_logger(hapd, sta->addr,
1707                                        HOSTAPD_MODULE_RADIUS,
1708                                        HOSTAPD_LEVEL_INFO,
1709                                        "Invalid VLAN %d%s received from RADIUS server",
1710                                        vlan_desc.untagged,
1711                                        vlan_desc.tagged[0] ? "+" : "");
1712                         os_memset(&vlan_desc, 0, sizeof(vlan_desc));
1713                         ap_sta_set_vlan(hapd, sta, &vlan_desc);
1714                         break;
1715                 }
1716
1717                 if (hapd->conf->ssid.dynamic_vlan == DYNAMIC_VLAN_REQUIRED &&
1718                     !vlan_desc.notempty) {
1719                         sta->eapol_sm->authFail = TRUE;
1720                         hostapd_logger(hapd, sta->addr,
1721                                        HOSTAPD_MODULE_IEEE8021X,
1722                                        HOSTAPD_LEVEL_INFO, "authentication "
1723                                        "server did not include required VLAN "
1724                                        "ID in Access-Accept");
1725                         break;
1726                 }
1727 #endif /* CONFIG_NO_VLAN */
1728
1729                 if (ap_sta_set_vlan(hapd, sta, &vlan_desc) < 0)
1730                         break;
1731
1732 #ifndef CONFIG_NO_VLAN
1733                 if (sta->vlan_id > 0) {
1734                         hostapd_logger(hapd, sta->addr,
1735                                        HOSTAPD_MODULE_RADIUS,
1736                                        HOSTAPD_LEVEL_INFO,
1737                                        "VLAN ID %d", sta->vlan_id);
1738                 }
1739 #endif /* CONFIG_NO_VLAN */
1740
1741                 if ((sta->flags & WLAN_STA_ASSOC) &&
1742                     ap_sta_bind_vlan(hapd, sta) < 0)
1743                         break;
1744
1745                 sta->session_timeout_set = !!session_timeout_set;
1746                 sta->session_timeout = session_timeout;
1747
1748                 /* RFC 3580, Ch. 3.17 */
1749                 if (session_timeout_set && termination_action ==
1750                     RADIUS_TERMINATION_ACTION_RADIUS_REQUEST) {
1751                         sm->reAuthPeriod = session_timeout;
1752                 } else if (session_timeout_set)
1753                         ap_sta_session_timeout(hapd, sta, session_timeout);
1754
1755                 sm->eap_if->aaaSuccess = TRUE;
1756                 override_eapReq = 1;
1757                 ieee802_1x_get_keys(hapd, sta, msg, req, shared_secret,
1758                                     shared_secret_len);
1759                 ieee802_1x_store_radius_class(hapd, sta, msg);
1760                 ieee802_1x_update_sta_identity(hapd, sta, msg);
1761                 ieee802_1x_update_sta_cui(hapd, sta, msg);
1762                 ieee802_1x_check_hs20(hapd, sta, msg,
1763                                       session_timeout_set ?
1764                                       (int) session_timeout : -1);
1765                 break;
1766         case RADIUS_CODE_ACCESS_REJECT:
1767                 sm->eap_if->aaaFail = TRUE;
1768                 override_eapReq = 1;
1769                 break;
1770         case RADIUS_CODE_ACCESS_CHALLENGE:
1771                 sm->eap_if->aaaEapReq = TRUE;
1772                 if (session_timeout_set) {
1773                         /* RFC 2869, Ch. 2.3.2; RFC 3580, Ch. 3.17 */
1774                         sm->eap_if->aaaMethodTimeout = session_timeout;
1775                         hostapd_logger(hapd, sm->addr,
1776                                        HOSTAPD_MODULE_IEEE8021X,
1777                                        HOSTAPD_LEVEL_DEBUG,
1778                                        "using EAP timeout of %d seconds (from "
1779                                        "RADIUS)",
1780                                        sm->eap_if->aaaMethodTimeout);
1781                 } else {
1782                         /*
1783                          * Use dynamic retransmission behavior per EAP
1784                          * specification.
1785                          */
1786                         sm->eap_if->aaaMethodTimeout = 0;
1787                 }
1788                 break;
1789         }
1790
1791         ieee802_1x_decapsulate_radius(hapd, sta);
1792         if (override_eapReq)
1793                 sm->eap_if->aaaEapReq = FALSE;
1794
1795         eapol_auth_step(sm);
1796
1797         return RADIUS_RX_QUEUED;
1798 }
1799 #endif /* CONFIG_NO_RADIUS */
1800
1801
1802 void ieee802_1x_abort_auth(struct hostapd_data *hapd, struct sta_info *sta)
1803 {
1804         struct eapol_state_machine *sm = sta->eapol_sm;
1805         if (sm == NULL)
1806                 return;
1807
1808         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1809                        HOSTAPD_LEVEL_DEBUG, "aborting authentication");
1810
1811 #ifndef CONFIG_NO_RADIUS
1812         radius_msg_free(sm->last_recv_radius);
1813         sm->last_recv_radius = NULL;
1814 #endif /* CONFIG_NO_RADIUS */
1815
1816         if (sm->eap_if->eapTimeout) {
1817                 /*
1818                  * Disconnect the STA since it did not reply to the last EAP
1819                  * request and we cannot continue EAP processing (EAP-Failure
1820                  * could only be sent if the EAP peer actually replied).
1821                  */
1822                 wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "EAP Timeout, STA " MACSTR,
1823                         MAC2STR(sta->addr));
1824
1825                 sm->eap_if->portEnabled = FALSE;
1826                 ap_sta_disconnect(hapd, sta, sta->addr,
1827                                   WLAN_REASON_PREV_AUTH_NOT_VALID);
1828         }
1829 }
1830
1831
1832 static int ieee802_1x_rekey_broadcast(struct hostapd_data *hapd)
1833 {
1834         struct eapol_authenticator *eapol = hapd->eapol_auth;
1835
1836         if (hapd->conf->default_wep_key_len < 1)
1837                 return 0;
1838
1839         os_free(eapol->default_wep_key);
1840         eapol->default_wep_key = os_malloc(hapd->conf->default_wep_key_len);
1841         if (eapol->default_wep_key == NULL ||
1842             random_get_bytes(eapol->default_wep_key,
1843                              hapd->conf->default_wep_key_len)) {
1844                 wpa_printf(MSG_INFO, "Could not generate random WEP key");
1845                 os_free(eapol->default_wep_key);
1846                 eapol->default_wep_key = NULL;
1847                 return -1;
1848         }
1849
1850         wpa_hexdump_key(MSG_DEBUG, "IEEE 802.1X: New default WEP key",
1851                         eapol->default_wep_key,
1852                         hapd->conf->default_wep_key_len);
1853
1854         return 0;
1855 }
1856
1857
1858 static int ieee802_1x_sta_key_available(struct hostapd_data *hapd,
1859                                         struct sta_info *sta, void *ctx)
1860 {
1861         if (sta->eapol_sm) {
1862                 sta->eapol_sm->eap_if->eapKeyAvailable = TRUE;
1863                 eapol_auth_step(sta->eapol_sm);
1864         }
1865         return 0;
1866 }
1867
1868
1869 static void ieee802_1x_rekey(void *eloop_ctx, void *timeout_ctx)
1870 {
1871         struct hostapd_data *hapd = eloop_ctx;
1872         struct eapol_authenticator *eapol = hapd->eapol_auth;
1873
1874         if (eapol->default_wep_key_idx >= 3)
1875                 eapol->default_wep_key_idx =
1876                         hapd->conf->individual_wep_key_len > 0 ? 1 : 0;
1877         else
1878                 eapol->default_wep_key_idx++;
1879
1880         wpa_printf(MSG_DEBUG, "IEEE 802.1X: New default WEP key index %d",
1881                    eapol->default_wep_key_idx);
1882
1883         if (ieee802_1x_rekey_broadcast(hapd)) {
1884                 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE8021X,
1885                                HOSTAPD_LEVEL_WARNING, "failed to generate a "
1886                                "new broadcast key");
1887                 os_free(eapol->default_wep_key);
1888                 eapol->default_wep_key = NULL;
1889                 return;
1890         }
1891
1892         /* TODO: Could setup key for RX here, but change default TX keyid only
1893          * after new broadcast key has been sent to all stations. */
1894         if (hostapd_drv_set_key(hapd->conf->iface, hapd, WPA_ALG_WEP,
1895                                 broadcast_ether_addr,
1896                                 eapol->default_wep_key_idx, 1, NULL, 0,
1897                                 eapol->default_wep_key,
1898                                 hapd->conf->default_wep_key_len)) {
1899                 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE8021X,
1900                                HOSTAPD_LEVEL_WARNING, "failed to configure a "
1901                                "new broadcast key");
1902                 os_free(eapol->default_wep_key);
1903                 eapol->default_wep_key = NULL;
1904                 return;
1905         }
1906
1907         ap_for_each_sta(hapd, ieee802_1x_sta_key_available, NULL);
1908
1909         if (hapd->conf->wep_rekeying_period > 0) {
1910                 eloop_register_timeout(hapd->conf->wep_rekeying_period, 0,
1911                                        ieee802_1x_rekey, hapd, NULL);
1912         }
1913 }
1914
1915
1916 static void ieee802_1x_eapol_send(void *ctx, void *sta_ctx, u8 type,
1917                                   const u8 *data, size_t datalen)
1918 {
1919 #ifdef CONFIG_WPS
1920         struct sta_info *sta = sta_ctx;
1921
1922         if ((sta->flags & (WLAN_STA_WPS | WLAN_STA_MAYBE_WPS)) ==
1923             WLAN_STA_MAYBE_WPS) {
1924                 const u8 *identity;
1925                 size_t identity_len;
1926                 struct eapol_state_machine *sm = sta->eapol_sm;
1927
1928                 identity = eap_get_identity(sm->eap, &identity_len);
1929                 if (identity &&
1930                     ((identity_len == WSC_ID_ENROLLEE_LEN &&
1931                       os_memcmp(identity, WSC_ID_ENROLLEE,
1932                                 WSC_ID_ENROLLEE_LEN) == 0) ||
1933                      (identity_len == WSC_ID_REGISTRAR_LEN &&
1934                       os_memcmp(identity, WSC_ID_REGISTRAR,
1935                                 WSC_ID_REGISTRAR_LEN) == 0))) {
1936                         wpa_printf(MSG_DEBUG, "WPS: WLAN_STA_MAYBE_WPS -> "
1937                                    "WLAN_STA_WPS");
1938                         sta->flags |= WLAN_STA_WPS;
1939                 }
1940         }
1941 #endif /* CONFIG_WPS */
1942
1943         ieee802_1x_send(ctx, sta_ctx, type, data, datalen);
1944 }
1945
1946
1947 static void ieee802_1x_aaa_send(void *ctx, void *sta_ctx,
1948                                 const u8 *data, size_t datalen)
1949 {
1950 #ifndef CONFIG_NO_RADIUS
1951         struct hostapd_data *hapd = ctx;
1952         struct sta_info *sta = sta_ctx;
1953
1954         ieee802_1x_encapsulate_radius(hapd, sta, data, datalen);
1955 #endif /* CONFIG_NO_RADIUS */
1956 }
1957
1958
1959 static void _ieee802_1x_finished(void *ctx, void *sta_ctx, int success,
1960                                  int preauth, int remediation)
1961 {
1962         struct hostapd_data *hapd = ctx;
1963         struct sta_info *sta = sta_ctx;
1964         if (preauth)
1965                 rsn_preauth_finished(hapd, sta, success);
1966         else
1967                 ieee802_1x_finished(hapd, sta, success, remediation);
1968 }
1969
1970
1971 static int ieee802_1x_get_eap_user(void *ctx, const u8 *identity,
1972                                    size_t identity_len, int phase2,
1973                                    struct eap_user *user)
1974 {
1975         struct hostapd_data *hapd = ctx;
1976         const struct hostapd_eap_user *eap_user;
1977         int i;
1978         int rv = -1;
1979
1980         eap_user = hostapd_get_eap_user(hapd, identity, identity_len, phase2);
1981         if (eap_user == NULL)
1982                 goto out;
1983
1984         os_memset(user, 0, sizeof(*user));
1985         user->phase2 = phase2;
1986         for (i = 0; i < EAP_MAX_METHODS; i++) {
1987                 user->methods[i].vendor = eap_user->methods[i].vendor;
1988                 user->methods[i].method = eap_user->methods[i].method;
1989         }
1990
1991         if (eap_user->password) {
1992                 user->password = os_malloc(eap_user->password_len);
1993                 if (user->password == NULL)
1994                         goto out;
1995                 os_memcpy(user->password, eap_user->password,
1996                           eap_user->password_len);
1997                 user->password_len = eap_user->password_len;
1998                 user->password_hash = eap_user->password_hash;
1999         }
2000         user->force_version = eap_user->force_version;
2001         user->macacl = eap_user->macacl;
2002         user->ttls_auth = eap_user->ttls_auth;
2003         user->remediation = eap_user->remediation;
2004         rv = 0;
2005
2006 out:
2007         if (rv)
2008                 wpa_printf(MSG_DEBUG, "%s: Failed to find user", __func__);
2009
2010         return rv;
2011 }
2012
2013
2014 static int ieee802_1x_sta_entry_alive(void *ctx, const u8 *addr)
2015 {
2016         struct hostapd_data *hapd = ctx;
2017         struct sta_info *sta;
2018         sta = ap_get_sta(hapd, addr);
2019         if (sta == NULL || sta->eapol_sm == NULL)
2020                 return 0;
2021         return 1;
2022 }
2023
2024
2025 static void ieee802_1x_logger(void *ctx, const u8 *addr,
2026                               eapol_logger_level level, const char *txt)
2027 {
2028 #ifndef CONFIG_NO_HOSTAPD_LOGGER
2029         struct hostapd_data *hapd = ctx;
2030         int hlevel;
2031
2032         switch (level) {
2033         case EAPOL_LOGGER_WARNING:
2034                 hlevel = HOSTAPD_LEVEL_WARNING;
2035                 break;
2036         case EAPOL_LOGGER_INFO:
2037                 hlevel = HOSTAPD_LEVEL_INFO;
2038                 break;
2039         case EAPOL_LOGGER_DEBUG:
2040         default:
2041                 hlevel = HOSTAPD_LEVEL_DEBUG;
2042                 break;
2043         }
2044
2045         hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE8021X, hlevel, "%s",
2046                        txt);
2047 #endif /* CONFIG_NO_HOSTAPD_LOGGER */
2048 }
2049
2050
2051 static void ieee802_1x_set_port_authorized(void *ctx, void *sta_ctx,
2052                                            int authorized)
2053 {
2054         struct hostapd_data *hapd = ctx;
2055         struct sta_info *sta = sta_ctx;
2056         ieee802_1x_set_sta_authorized(hapd, sta, authorized);
2057 }
2058
2059
2060 static void _ieee802_1x_abort_auth(void *ctx, void *sta_ctx)
2061 {
2062         struct hostapd_data *hapd = ctx;
2063         struct sta_info *sta = sta_ctx;
2064         ieee802_1x_abort_auth(hapd, sta);
2065 }
2066
2067
2068 static void _ieee802_1x_tx_key(void *ctx, void *sta_ctx)
2069 {
2070 #ifndef CONFIG_FIPS
2071 #ifndef CONFIG_NO_RC4
2072         struct hostapd_data *hapd = ctx;
2073         struct sta_info *sta = sta_ctx;
2074         ieee802_1x_tx_key(hapd, sta);
2075 #endif /* CONFIG_NO_RC4 */
2076 #endif /* CONFIG_FIPS */
2077 }
2078
2079
2080 static void ieee802_1x_eapol_event(void *ctx, void *sta_ctx,
2081                                    enum eapol_event type)
2082 {
2083         /* struct hostapd_data *hapd = ctx; */
2084         struct sta_info *sta = sta_ctx;
2085         switch (type) {
2086         case EAPOL_AUTH_SM_CHANGE:
2087                 wpa_auth_sm_notify(sta->wpa_sm);
2088                 break;
2089         case EAPOL_AUTH_REAUTHENTICATE:
2090                 wpa_auth_sm_event(sta->wpa_sm, WPA_REAUTH_EAPOL);
2091                 break;
2092         }
2093 }
2094
2095
2096 #ifdef CONFIG_ERP
2097
2098 static struct eap_server_erp_key *
2099 ieee802_1x_erp_get_key(void *ctx, const char *keyname)
2100 {
2101         struct hostapd_data *hapd = ctx;
2102         struct eap_server_erp_key *erp;
2103
2104         dl_list_for_each(erp, &hapd->erp_keys, struct eap_server_erp_key,
2105                          list) {
2106                 if (os_strcmp(erp->keyname_nai, keyname) == 0)
2107                         return erp;
2108         }
2109
2110         return NULL;
2111 }
2112
2113
2114 static int ieee802_1x_erp_add_key(void *ctx, struct eap_server_erp_key *erp)
2115 {
2116         struct hostapd_data *hapd = ctx;
2117
2118         dl_list_add(&hapd->erp_keys, &erp->list);
2119         return 0;
2120 }
2121
2122 #endif /* CONFIG_ERP */
2123
2124
2125 int ieee802_1x_init(struct hostapd_data *hapd)
2126 {
2127         int i;
2128         struct eapol_auth_config conf;
2129         struct eapol_auth_cb cb;
2130
2131         dl_list_init(&hapd->erp_keys);
2132
2133         os_memset(&conf, 0, sizeof(conf));
2134         conf.ctx = hapd;
2135         conf.eap_reauth_period = hapd->conf->eap_reauth_period;
2136         conf.wpa = hapd->conf->wpa;
2137         conf.individual_wep_key_len = hapd->conf->individual_wep_key_len;
2138         conf.eap_server = hapd->conf->eap_server;
2139         conf.ssl_ctx = hapd->ssl_ctx;
2140         conf.msg_ctx = hapd->msg_ctx;
2141         conf.eap_sim_db_priv = hapd->eap_sim_db_priv;
2142         conf.eap_req_id_text = hapd->conf->eap_req_id_text;
2143         conf.eap_req_id_text_len = hapd->conf->eap_req_id_text_len;
2144         conf.erp_send_reauth_start = hapd->conf->erp_send_reauth_start;
2145         conf.erp_domain = hapd->conf->erp_domain;
2146         conf.erp = hapd->conf->eap_server_erp;
2147         conf.tls_session_lifetime = hapd->conf->tls_session_lifetime;
2148         conf.pac_opaque_encr_key = hapd->conf->pac_opaque_encr_key;
2149         conf.eap_fast_a_id = hapd->conf->eap_fast_a_id;
2150         conf.eap_fast_a_id_len = hapd->conf->eap_fast_a_id_len;
2151         conf.eap_fast_a_id_info = hapd->conf->eap_fast_a_id_info;
2152         conf.eap_fast_prov = hapd->conf->eap_fast_prov;
2153         conf.pac_key_lifetime = hapd->conf->pac_key_lifetime;
2154         conf.pac_key_refresh_time = hapd->conf->pac_key_refresh_time;
2155         conf.eap_sim_aka_result_ind = hapd->conf->eap_sim_aka_result_ind;
2156         conf.tnc = hapd->conf->tnc;
2157         conf.wps = hapd->wps;
2158         conf.fragment_size = hapd->conf->fragment_size;
2159         conf.pwd_group = hapd->conf->pwd_group;
2160         conf.pbc_in_m1 = hapd->conf->pbc_in_m1;
2161         if (hapd->conf->server_id) {
2162                 conf.server_id = (const u8 *) hapd->conf->server_id;
2163                 conf.server_id_len = os_strlen(hapd->conf->server_id);
2164         } else {
2165                 conf.server_id = (const u8 *) "hostapd";
2166                 conf.server_id_len = 7;
2167         }
2168
2169         os_memset(&cb, 0, sizeof(cb));
2170         cb.eapol_send = ieee802_1x_eapol_send;
2171         cb.aaa_send = ieee802_1x_aaa_send;
2172         cb.finished = _ieee802_1x_finished;
2173         cb.get_eap_user = ieee802_1x_get_eap_user;
2174         cb.sta_entry_alive = ieee802_1x_sta_entry_alive;
2175         cb.logger = ieee802_1x_logger;
2176         cb.set_port_authorized = ieee802_1x_set_port_authorized;
2177         cb.abort_auth = _ieee802_1x_abort_auth;
2178         cb.tx_key = _ieee802_1x_tx_key;
2179         cb.eapol_event = ieee802_1x_eapol_event;
2180 #ifdef CONFIG_ERP
2181         cb.erp_get_key = ieee802_1x_erp_get_key;
2182         cb.erp_add_key = ieee802_1x_erp_add_key;
2183 #endif /* CONFIG_ERP */
2184
2185         hapd->eapol_auth = eapol_auth_init(&conf, &cb);
2186         if (hapd->eapol_auth == NULL)
2187                 return -1;
2188
2189         if ((hapd->conf->ieee802_1x || hapd->conf->wpa) &&
2190             hostapd_set_drv_ieee8021x(hapd, hapd->conf->iface, 1))
2191                 return -1;
2192
2193 #ifndef CONFIG_NO_RADIUS
2194         if (radius_client_register(hapd->radius, RADIUS_AUTH,
2195                                    ieee802_1x_receive_auth, hapd))
2196                 return -1;
2197 #endif /* CONFIG_NO_RADIUS */
2198
2199         if (hapd->conf->default_wep_key_len) {
2200                 for (i = 0; i < 4; i++)
2201                         hostapd_drv_set_key(hapd->conf->iface, hapd,
2202                                             WPA_ALG_NONE, NULL, i, 0, NULL, 0,
2203                                             NULL, 0);
2204
2205                 ieee802_1x_rekey(hapd, NULL);
2206
2207                 if (hapd->eapol_auth->default_wep_key == NULL)
2208                         return -1;
2209         }
2210
2211         return 0;
2212 }
2213
2214
2215 void ieee802_1x_erp_flush(struct hostapd_data *hapd)
2216 {
2217         struct eap_server_erp_key *erp;
2218
2219         while ((erp = dl_list_first(&hapd->erp_keys, struct eap_server_erp_key,
2220                                     list)) != NULL) {
2221                 dl_list_del(&erp->list);
2222                 bin_clear_free(erp, sizeof(*erp));
2223         }
2224 }
2225
2226
2227 void ieee802_1x_deinit(struct hostapd_data *hapd)
2228 {
2229         eloop_cancel_timeout(ieee802_1x_rekey, hapd, NULL);
2230
2231         if (hapd->driver && hapd->drv_priv &&
2232             (hapd->conf->ieee802_1x || hapd->conf->wpa))
2233                 hostapd_set_drv_ieee8021x(hapd, hapd->conf->iface, 0);
2234
2235         eapol_auth_deinit(hapd->eapol_auth);
2236         hapd->eapol_auth = NULL;
2237
2238         ieee802_1x_erp_flush(hapd);
2239 }
2240
2241
2242 int ieee802_1x_tx_status(struct hostapd_data *hapd, struct sta_info *sta,
2243                          const u8 *buf, size_t len, int ack)
2244 {
2245         struct ieee80211_hdr *hdr;
2246         u8 *pos;
2247         const unsigned char rfc1042_hdr[ETH_ALEN] =
2248                 { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
2249
2250         if (sta == NULL)
2251                 return -1;
2252         if (len < sizeof(*hdr) + sizeof(rfc1042_hdr) + 2)
2253                 return 0;
2254
2255         hdr = (struct ieee80211_hdr *) buf;
2256         pos = (u8 *) (hdr + 1);
2257         if (os_memcmp(pos, rfc1042_hdr, sizeof(rfc1042_hdr)) != 0)
2258                 return 0;
2259         pos += sizeof(rfc1042_hdr);
2260         if (WPA_GET_BE16(pos) != ETH_P_PAE)
2261                 return 0;
2262         pos += 2;
2263
2264         return ieee802_1x_eapol_tx_status(hapd, sta, pos, buf + len - pos,
2265                                           ack);
2266 }
2267
2268
2269 int ieee802_1x_eapol_tx_status(struct hostapd_data *hapd, struct sta_info *sta,
2270                                const u8 *buf, int len, int ack)
2271 {
2272         const struct ieee802_1x_hdr *xhdr =
2273                 (const struct ieee802_1x_hdr *) buf;
2274         const u8 *pos = buf + sizeof(*xhdr);
2275         struct ieee802_1x_eapol_key *key;
2276
2277         if (len < (int) sizeof(*xhdr))
2278                 return 0;
2279         wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR " TX status - version=%d "
2280                    "type=%d length=%d - ack=%d",
2281                    MAC2STR(sta->addr), xhdr->version, xhdr->type,
2282                    be_to_host16(xhdr->length), ack);
2283
2284         if (xhdr->type != IEEE802_1X_TYPE_EAPOL_KEY)
2285                 return 0;
2286
2287         if (pos + sizeof(struct wpa_eapol_key) <= buf + len) {
2288                 const struct wpa_eapol_key *wpa;
2289                 wpa = (const struct wpa_eapol_key *) pos;
2290                 if (wpa->type == EAPOL_KEY_TYPE_RSN ||
2291                     wpa->type == EAPOL_KEY_TYPE_WPA)
2292                         wpa_auth_eapol_key_tx_status(hapd->wpa_auth,
2293                                                      sta->wpa_sm, ack);
2294         }
2295
2296         /* EAPOL EAP-Packet packets are eventually re-sent by either Supplicant
2297          * or Authenticator state machines, but EAPOL-Key packets are not
2298          * retransmitted in case of failure. Try to re-send failed EAPOL-Key
2299          * packets couple of times because otherwise STA keys become
2300          * unsynchronized with AP. */
2301         if (!ack && pos + sizeof(*key) <= buf + len) {
2302                 key = (struct ieee802_1x_eapol_key *) pos;
2303                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
2304                                HOSTAPD_LEVEL_DEBUG, "did not Ack EAPOL-Key "
2305                                "frame (%scast index=%d)",
2306                                key->key_index & BIT(7) ? "uni" : "broad",
2307                                key->key_index & ~BIT(7));
2308                 /* TODO: re-send EAPOL-Key couple of times (with short delay
2309                  * between them?). If all attempt fail, report error and
2310                  * deauthenticate STA so that it will get new keys when
2311                  * authenticating again (e.g., after returning in range).
2312                  * Separate limit/transmit state needed both for unicast and
2313                  * broadcast keys(?) */
2314         }
2315         /* TODO: could move unicast key configuration from ieee802_1x_tx_key()
2316          * to here and change the key only if the EAPOL-Key packet was Acked.
2317          */
2318
2319         return 1;
2320 }
2321
2322
2323 u8 * ieee802_1x_get_identity(struct eapol_state_machine *sm, size_t *len)
2324 {
2325         if (sm == NULL || sm->identity == NULL)
2326                 return NULL;
2327
2328         *len = sm->identity_len;
2329         return sm->identity;
2330 }
2331
2332
2333 u8 * ieee802_1x_get_radius_class(struct eapol_state_machine *sm, size_t *len,
2334                                  int idx)
2335 {
2336         if (sm == NULL || sm->radius_class.attr == NULL ||
2337             idx >= (int) sm->radius_class.count)
2338                 return NULL;
2339
2340         *len = sm->radius_class.attr[idx].len;
2341         return sm->radius_class.attr[idx].data;
2342 }
2343
2344
2345 struct wpabuf * ieee802_1x_get_radius_cui(struct eapol_state_machine *sm)
2346 {
2347         if (sm == NULL)
2348                 return NULL;
2349         return sm->radius_cui;
2350 }
2351
2352
2353 const u8 * ieee802_1x_get_key(struct eapol_state_machine *sm, size_t *len)
2354 {
2355         *len = 0;
2356         if (sm == NULL)
2357                 return NULL;
2358
2359         *len = sm->eap_if->eapKeyDataLen;
2360         return sm->eap_if->eapKeyData;
2361 }
2362
2363
2364 void ieee802_1x_notify_port_enabled(struct eapol_state_machine *sm,
2365                                     int enabled)
2366 {
2367         if (sm == NULL)
2368                 return;
2369         sm->eap_if->portEnabled = enabled ? TRUE : FALSE;
2370         eapol_auth_step(sm);
2371 }
2372
2373
2374 void ieee802_1x_notify_port_valid(struct eapol_state_machine *sm,
2375                                   int valid)
2376 {
2377         if (sm == NULL)
2378                 return;
2379         sm->portValid = valid ? TRUE : FALSE;
2380         eapol_auth_step(sm);
2381 }
2382
2383
2384 void ieee802_1x_notify_pre_auth(struct eapol_state_machine *sm, int pre_auth)
2385 {
2386         if (sm == NULL)
2387                 return;
2388         if (pre_auth)
2389                 sm->flags |= EAPOL_SM_PREAUTH;
2390         else
2391                 sm->flags &= ~EAPOL_SM_PREAUTH;
2392 }
2393
2394
2395 static const char * bool_txt(Boolean val)
2396 {
2397         return val ? "TRUE" : "FALSE";
2398 }
2399
2400
2401 int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
2402 {
2403         /* TODO */
2404         return 0;
2405 }
2406
2407
2408 int ieee802_1x_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta,
2409                            char *buf, size_t buflen)
2410 {
2411         int len = 0, ret;
2412         struct eapol_state_machine *sm = sta->eapol_sm;
2413         struct os_reltime diff;
2414         const char *name1;
2415         const char *name2;
2416
2417         if (sm == NULL)
2418                 return 0;
2419
2420         ret = os_snprintf(buf + len, buflen - len,
2421                           "dot1xPaePortNumber=%d\n"
2422                           "dot1xPaePortProtocolVersion=%d\n"
2423                           "dot1xPaePortCapabilities=1\n"
2424                           "dot1xPaePortInitialize=%d\n"
2425                           "dot1xPaePortReauthenticate=FALSE\n",
2426                           sta->aid,
2427                           EAPOL_VERSION,
2428                           sm->initialize);
2429         if (os_snprintf_error(buflen - len, ret))
2430                 return len;
2431         len += ret;
2432
2433         /* dot1xAuthConfigTable */
2434         ret = os_snprintf(buf + len, buflen - len,
2435                           "dot1xAuthPaeState=%d\n"
2436                           "dot1xAuthBackendAuthState=%d\n"
2437                           "dot1xAuthAdminControlledDirections=%d\n"
2438                           "dot1xAuthOperControlledDirections=%d\n"
2439                           "dot1xAuthAuthControlledPortStatus=%d\n"
2440                           "dot1xAuthAuthControlledPortControl=%d\n"
2441                           "dot1xAuthQuietPeriod=%u\n"
2442                           "dot1xAuthServerTimeout=%u\n"
2443                           "dot1xAuthReAuthPeriod=%u\n"
2444                           "dot1xAuthReAuthEnabled=%s\n"
2445                           "dot1xAuthKeyTxEnabled=%s\n",
2446                           sm->auth_pae_state + 1,
2447                           sm->be_auth_state + 1,
2448                           sm->adminControlledDirections,
2449                           sm->operControlledDirections,
2450                           sm->authPortStatus,
2451                           sm->portControl,
2452                           sm->quietPeriod,
2453                           sm->serverTimeout,
2454                           sm->reAuthPeriod,
2455                           bool_txt(sm->reAuthEnabled),
2456                           bool_txt(sm->keyTxEnabled));
2457         if (os_snprintf_error(buflen - len, ret))
2458                 return len;
2459         len += ret;
2460
2461         /* dot1xAuthStatsTable */
2462         ret = os_snprintf(buf + len, buflen - len,
2463                           "dot1xAuthEapolFramesRx=%u\n"
2464                           "dot1xAuthEapolFramesTx=%u\n"
2465                           "dot1xAuthEapolStartFramesRx=%u\n"
2466                           "dot1xAuthEapolLogoffFramesRx=%u\n"
2467                           "dot1xAuthEapolRespIdFramesRx=%u\n"
2468                           "dot1xAuthEapolRespFramesRx=%u\n"
2469                           "dot1xAuthEapolReqIdFramesTx=%u\n"
2470                           "dot1xAuthEapolReqFramesTx=%u\n"
2471                           "dot1xAuthInvalidEapolFramesRx=%u\n"
2472                           "dot1xAuthEapLengthErrorFramesRx=%u\n"
2473                           "dot1xAuthLastEapolFrameVersion=%u\n"
2474                           "dot1xAuthLastEapolFrameSource=" MACSTR "\n",
2475                           sm->dot1xAuthEapolFramesRx,
2476                           sm->dot1xAuthEapolFramesTx,
2477                           sm->dot1xAuthEapolStartFramesRx,
2478                           sm->dot1xAuthEapolLogoffFramesRx,
2479                           sm->dot1xAuthEapolRespIdFramesRx,
2480                           sm->dot1xAuthEapolRespFramesRx,
2481                           sm->dot1xAuthEapolReqIdFramesTx,
2482                           sm->dot1xAuthEapolReqFramesTx,
2483                           sm->dot1xAuthInvalidEapolFramesRx,
2484                           sm->dot1xAuthEapLengthErrorFramesRx,
2485                           sm->dot1xAuthLastEapolFrameVersion,
2486                           MAC2STR(sm->addr));
2487         if (os_snprintf_error(buflen - len, ret))
2488                 return len;
2489         len += ret;
2490
2491         /* dot1xAuthDiagTable */
2492         ret = os_snprintf(buf + len, buflen - len,
2493                           "dot1xAuthEntersConnecting=%u\n"
2494                           "dot1xAuthEapLogoffsWhileConnecting=%u\n"
2495                           "dot1xAuthEntersAuthenticating=%u\n"
2496                           "dot1xAuthAuthSuccessesWhileAuthenticating=%u\n"
2497                           "dot1xAuthAuthTimeoutsWhileAuthenticating=%u\n"
2498                           "dot1xAuthAuthFailWhileAuthenticating=%u\n"
2499                           "dot1xAuthAuthEapStartsWhileAuthenticating=%u\n"
2500                           "dot1xAuthAuthEapLogoffWhileAuthenticating=%u\n"
2501                           "dot1xAuthAuthReauthsWhileAuthenticated=%u\n"
2502                           "dot1xAuthAuthEapStartsWhileAuthenticated=%u\n"
2503                           "dot1xAuthAuthEapLogoffWhileAuthenticated=%u\n"
2504                           "dot1xAuthBackendResponses=%u\n"
2505                           "dot1xAuthBackendAccessChallenges=%u\n"
2506                           "dot1xAuthBackendOtherRequestsToSupplicant=%u\n"
2507                           "dot1xAuthBackendAuthSuccesses=%u\n"
2508                           "dot1xAuthBackendAuthFails=%u\n",
2509                           sm->authEntersConnecting,
2510                           sm->authEapLogoffsWhileConnecting,
2511                           sm->authEntersAuthenticating,
2512                           sm->authAuthSuccessesWhileAuthenticating,
2513                           sm->authAuthTimeoutsWhileAuthenticating,
2514                           sm->authAuthFailWhileAuthenticating,
2515                           sm->authAuthEapStartsWhileAuthenticating,
2516                           sm->authAuthEapLogoffWhileAuthenticating,
2517                           sm->authAuthReauthsWhileAuthenticated,
2518                           sm->authAuthEapStartsWhileAuthenticated,
2519                           sm->authAuthEapLogoffWhileAuthenticated,
2520                           sm->backendResponses,
2521                           sm->backendAccessChallenges,
2522                           sm->backendOtherRequestsToSupplicant,
2523                           sm->backendAuthSuccesses,
2524                           sm->backendAuthFails);
2525         if (os_snprintf_error(buflen - len, ret))
2526                 return len;
2527         len += ret;
2528
2529         /* dot1xAuthSessionStatsTable */
2530         os_reltime_age(&sta->acct_session_start, &diff);
2531         ret = os_snprintf(buf + len, buflen - len,
2532                           /* TODO: dot1xAuthSessionOctetsRx */
2533                           /* TODO: dot1xAuthSessionOctetsTx */
2534                           /* TODO: dot1xAuthSessionFramesRx */
2535                           /* TODO: dot1xAuthSessionFramesTx */
2536                           "dot1xAuthSessionId=%016lX\n"
2537                           "dot1xAuthSessionAuthenticMethod=%d\n"
2538                           "dot1xAuthSessionTime=%u\n"
2539                           "dot1xAuthSessionTerminateCause=999\n"
2540                           "dot1xAuthSessionUserName=%s\n",
2541                           (long unsigned int) sta->acct_session_id,
2542                           (wpa_key_mgmt_wpa_ieee8021x(
2543                                    wpa_auth_sta_key_mgmt(sta->wpa_sm))) ?
2544                           1 : 2,
2545                           (unsigned int) diff.sec,
2546                           sm->identity);
2547         if (os_snprintf_error(buflen - len, ret))
2548                 return len;
2549         len += ret;
2550
2551         if (sm->acct_multi_session_id) {
2552                 ret = os_snprintf(buf + len, buflen - len,
2553                                   "authMultiSessionId=%016lX\n",
2554                                   (long unsigned int)
2555                                   sm->acct_multi_session_id);
2556                 if (os_snprintf_error(buflen - len, ret))
2557                         return len;
2558                 len += ret;
2559         }
2560
2561         name1 = eap_server_get_name(0, sm->eap_type_authsrv);
2562         name2 = eap_server_get_name(0, sm->eap_type_supp);
2563         ret = os_snprintf(buf + len, buflen - len,
2564                           "last_eap_type_as=%d (%s)\n"
2565                           "last_eap_type_sta=%d (%s)\n",
2566                           sm->eap_type_authsrv, name1,
2567                           sm->eap_type_supp, name2);
2568         if (os_snprintf_error(buflen - len, ret))
2569                 return len;
2570         len += ret;
2571
2572         return len;
2573 }
2574
2575
2576 #ifdef CONFIG_HS20
2577 static void ieee802_1x_wnm_notif_send(void *eloop_ctx, void *timeout_ctx)
2578 {
2579         struct hostapd_data *hapd = eloop_ctx;
2580         struct sta_info *sta = timeout_ctx;
2581
2582         if (sta->remediation) {
2583                 wpa_printf(MSG_DEBUG, "HS 2.0: Send WNM-Notification to "
2584                            MACSTR " to indicate Subscription Remediation",
2585                            MAC2STR(sta->addr));
2586                 hs20_send_wnm_notification(hapd, sta->addr,
2587                                            sta->remediation_method,
2588                                            sta->remediation_url);
2589                 os_free(sta->remediation_url);
2590                 sta->remediation_url = NULL;
2591         }
2592
2593         if (sta->hs20_deauth_req) {
2594                 wpa_printf(MSG_DEBUG, "HS 2.0: Send WNM-Notification to "
2595                            MACSTR " to indicate imminent deauthentication",
2596                            MAC2STR(sta->addr));
2597                 hs20_send_wnm_notification_deauth_req(hapd, sta->addr,
2598                                                       sta->hs20_deauth_req);
2599         }
2600 }
2601 #endif /* CONFIG_HS20 */
2602
2603
2604 static void ieee802_1x_finished(struct hostapd_data *hapd,
2605                                 struct sta_info *sta, int success,
2606                                 int remediation)
2607 {
2608         const u8 *key;
2609         size_t len;
2610         /* TODO: get PMKLifetime from WPA parameters */
2611         static const int dot11RSNAConfigPMKLifetime = 43200;
2612         unsigned int session_timeout;
2613
2614 #ifdef CONFIG_HS20
2615         if (remediation && !sta->remediation) {
2616                 sta->remediation = 1;
2617                 os_free(sta->remediation_url);
2618                 sta->remediation_url =
2619                         os_strdup(hapd->conf->subscr_remediation_url);
2620                 sta->remediation_method = 1; /* SOAP-XML SPP */
2621         }
2622
2623         if (success && (sta->remediation || sta->hs20_deauth_req)) {
2624                 wpa_printf(MSG_DEBUG, "HS 2.0: Schedule WNM-Notification to "
2625                            MACSTR " in 100 ms", MAC2STR(sta->addr));
2626                 eloop_cancel_timeout(ieee802_1x_wnm_notif_send, hapd, sta);
2627                 eloop_register_timeout(0, 100000, ieee802_1x_wnm_notif_send,
2628                                        hapd, sta);
2629         }
2630 #endif /* CONFIG_HS20 */
2631
2632         key = ieee802_1x_get_key(sta->eapol_sm, &len);
2633         if (sta->session_timeout_set)
2634                 session_timeout = sta->session_timeout;
2635         else
2636                 session_timeout = dot11RSNAConfigPMKLifetime;
2637         if (success && key && len >= PMK_LEN && !sta->remediation &&
2638             !sta->hs20_deauth_requested &&
2639             wpa_auth_pmksa_add(sta->wpa_sm, key, len, session_timeout,
2640                                sta->eapol_sm) == 0) {
2641                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA,
2642                                HOSTAPD_LEVEL_DEBUG,
2643                                "Added PMKSA cache entry (IEEE 802.1X)");
2644         }
2645
2646         if (!success) {
2647                 /*
2648                  * Many devices require deauthentication after WPS provisioning
2649                  * and some may not be be able to do that themselves, so
2650                  * disconnect the client here. In addition, this may also
2651                  * benefit IEEE 802.1X/EAPOL authentication cases, too since
2652                  * the EAPOL PAE state machine would remain in HELD state for
2653                  * considerable amount of time and some EAP methods, like
2654                  * EAP-FAST with anonymous provisioning, may require another
2655                  * EAPOL authentication to be started to complete connection.
2656                  */
2657                 wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "IEEE 802.1X: Force "
2658                         "disconnection after EAP-Failure");
2659                 /* Add a small sleep to increase likelihood of previously
2660                  * requested EAP-Failure TX getting out before this should the
2661                  * driver reorder operations.
2662                  */
2663                 os_sleep(0, 10000);
2664                 ap_sta_disconnect(hapd, sta, sta->addr,
2665                                   WLAN_REASON_IEEE_802_1X_AUTH_FAILED);
2666                 hostapd_wps_eap_completed(hapd);
2667         }
2668 }