#include "utils/includes.h"
#include "utils/common.h"
+#include "utils/eloop.h"
#include "crypto/sha256.h"
#include "crypto/random.h"
#include "crypto/aes.h"
#include "ap/hostapd.h"
#include "ap/wpa_auth.h"
#include "ap/sta_info.h"
+#include "ap/ieee802_11.h"
#include "wpa_supplicant_i.h"
#include "driver_i.h"
#include "wpas_glue.h"
#include "mesh_mpm.h"
#include "mesh_rsn.h"
+#define MESH_AUTH_TIMEOUT 10
+#define MESH_AUTH_RETRY 3
+
+void mesh_auth_timer(void *eloop_ctx, void *user_data)
+{
+ struct wpa_supplicant *wpa_s = eloop_ctx;
+ struct sta_info *sta = user_data;
+ struct hostapd_data *hapd;
+
+ if (sta->sae->state != SAE_ACCEPTED) {
+ wpa_printf(MSG_DEBUG, "AUTH: Re-authenticate with " MACSTR
+ " (attempt %d) ",
+ MAC2STR(sta->addr), sta->sae_auth_retry);
+ wpa_msg(wpa_s, MSG_INFO, MESH_SAE_AUTH_FAILURE "addr=" MACSTR,
+ MAC2STR(sta->addr));
+ if (sta->sae_auth_retry < MESH_AUTH_RETRY) {
+ mesh_rsn_auth_sae_sta(wpa_s, sta);
+ } else {
+ hapd = wpa_s->ifmsh->bss[0];
+
+ if (sta->sae_auth_retry > MESH_AUTH_RETRY) {
+ ap_free_sta(hapd, sta);
+ return;
+ }
+
+ /* block the STA if exceeded the number of attempts */
+ wpa_mesh_set_plink_state(wpa_s, sta, PLINK_BLOCKED);
+ sta->sae->state = SAE_NOTHING;
+ wpa_msg(wpa_s, MSG_INFO, MESH_SAE_AUTH_BLOCKED "addr="
+ MACSTR " duration=%d",
+ MAC2STR(sta->addr),
+ hapd->conf->ap_max_inactivity);
+ }
+ sta->sae_auth_retry++;
+ }
+}
+
static void auth_logger(void *ctx, const u8 *addr, logger_level level,
const char *txt)
static int auth_start_ampe(void *ctx, const u8 *addr)
{
struct mesh_rsn *mesh_rsn = ctx;
+ struct hostapd_data *hapd;
+ struct sta_info *sta;
if (mesh_rsn->wpa_s->current_ssid->mode != WPAS_MODE_MESH)
return -1;
+ hapd = mesh_rsn->wpa_s->ifmsh->bss[0];
+ sta = ap_get_sta(hapd, addr);
+ if (sta)
+ eloop_cancel_timeout(mesh_auth_timer, mesh_rsn->wpa_s, sta);
+
mesh_mpm_auth_peer(mesh_rsn->wpa_s, addr);
return 0;
}
static void mesh_rsn_deinit(struct mesh_rsn *rsn)
{
os_memset(rsn->mgtk, 0, sizeof(rsn->mgtk));
- wpa_deinit(rsn->auth);
+ if (rsn->auth)
+ wpa_deinit(rsn->auth);
}
if (__mesh_rsn_auth_init(mesh_rsn, wpa_s->own_addr) < 0) {
mesh_rsn_deinit(mesh_rsn);
+ os_free(mesh_rsn);
return NULL;
}
bss->wpa_auth = mesh_rsn->auth;
ie = wpa_auth_get_wpa_ie(mesh_rsn->auth, &ie_len);
- conf->ies = (u8 *) ie;
- conf->ie_len = ie_len;
+ conf->rsn_ie = (u8 *) ie;
+ conf->rsn_ie_len = ie_len;
wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
}
-struct wpabuf *
-mesh_rsn_build_sae_commit(struct wpa_supplicant *wpa_s,
- struct wpa_ssid *ssid, struct sta_info *sta)
+static int mesh_rsn_build_sae_commit(struct wpa_supplicant *wpa_s,
+ struct wpa_ssid *ssid,
+ struct sta_info *sta)
{
- struct wpabuf *buf;
- int len;
-
if (ssid->passphrase == NULL) {
wpa_msg(wpa_s, MSG_DEBUG, "SAE: No password available");
- return NULL;
+ return -1;
}
if (mesh_rsn_sae_group(wpa_s, sta->sae) < 0) {
wpa_msg(wpa_s, MSG_DEBUG, "SAE: Failed to select group");
- return NULL;
- }
-
- if (sae_prepare_commit(wpa_s->own_addr, sta->addr,
- (u8 *) ssid->passphrase,
- os_strlen(ssid->passphrase), sta->sae) < 0) {
- wpa_msg(wpa_s, MSG_DEBUG, "SAE: Could not pick PWE");
- return NULL;
+ return -1;
}
- len = wpa_s->mesh_rsn->sae_token ?
- wpabuf_len(wpa_s->mesh_rsn->sae_token) : 0;
- buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + len);
- if (buf == NULL)
- return NULL;
-
- sae_write_commit(sta->sae, buf, wpa_s->mesh_rsn->sae_token);
-
- return buf;
-}
-
-
-static void mesh_rsn_send_auth(struct wpa_supplicant *wpa_s,
- const u8 *dst, const u8 *src,
- u16 auth_transaction, u16 resp,
- struct wpabuf *data)
-{
- struct ieee80211_mgmt *auth;
- u8 *buf;
- size_t len, ielen = 0;
-
- if (data)
- ielen = wpabuf_len(data);
- len = IEEE80211_HDRLEN + sizeof(auth->u.auth) + ielen;
- buf = os_zalloc(len);
- if (buf == NULL)
- return;
-
- auth = (struct ieee80211_mgmt *) buf;
- auth->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
- WLAN_FC_STYPE_AUTH);
- os_memcpy(auth->da, dst, ETH_ALEN);
- os_memcpy(auth->sa, src, ETH_ALEN);
- os_memcpy(auth->bssid, src, ETH_ALEN);
-
- auth->u.auth.auth_alg = host_to_le16(WLAN_AUTH_SAE);
- auth->u.auth.auth_transaction = host_to_le16(auth_transaction);
- auth->u.auth.status_code = host_to_le16(resp);
-
- if (data)
- os_memcpy(auth->u.auth.variable, wpabuf_head(data), ielen);
-
- wpa_msg(wpa_s, MSG_DEBUG, "authentication frame: STA=" MACSTR
- " auth_transaction=%d resp=%d (IE len=%lu)",
- MAC2STR(dst), auth_transaction, resp, (unsigned long) ielen);
- if (wpa_drv_send_mlme(wpa_s, buf, len, 0) < 0)
- perror("send_auth_reply: send");
-
- os_free(buf);
+ return sae_prepare_commit(wpa_s->own_addr, sta->addr,
+ (u8 *) ssid->passphrase,
+ os_strlen(ssid->passphrase), sta->sae);
}
int mesh_rsn_auth_sae_sta(struct wpa_supplicant *wpa_s,
struct sta_info *sta)
{
+ struct hostapd_data *hapd = wpa_s->ifmsh->bss[0];
struct wpa_ssid *ssid = wpa_s->current_ssid;
- struct wpabuf *buf;
+ struct rsn_pmksa_cache_entry *pmksa;
+ unsigned int rnd;
+ int ret;
+
+ if (!ssid) {
+ wpa_msg(wpa_s, MSG_DEBUG,
+ "AUTH: No current_ssid known to initiate new SAE");
+ return -1;
+ }
if (!sta->sae) {
sta->sae = os_zalloc(sizeof(*sta->sae));
return -1;
}
- buf = mesh_rsn_build_sae_commit(wpa_s, ssid, sta);
- if (!buf)
+ pmksa = wpa_auth_pmksa_get(hapd->wpa_auth, sta->addr);
+ if (pmksa) {
+ if (!sta->wpa_sm)
+ sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
+ sta->addr, NULL);
+ if (!sta->wpa_sm) {
+ wpa_printf(MSG_ERROR,
+ "mesh: Failed to initialize RSN state machine");
+ return -1;
+ }
+
+ wpa_printf(MSG_DEBUG,
+ "AUTH: Mesh PMKSA cache entry found for " MACSTR
+ " - try to use PMKSA caching instead of new SAE authentication",
+ MAC2STR(sta->addr));
+ wpa_auth_pmksa_set_to_sm(pmksa, sta->wpa_sm, hapd->wpa_auth,
+ sta->sae->pmkid, sta->sae->pmk);
+ sae_accept_sta(hapd, sta);
+ sta->mesh_sae_pmksa_caching = 1;
+ return 0;
+ }
+ sta->mesh_sae_pmksa_caching = 0;
+
+ if (mesh_rsn_build_sae_commit(wpa_s, ssid, sta))
return -1;
wpa_msg(wpa_s, MSG_DEBUG,
"AUTH: started authentication with SAE peer: " MACSTR,
MAC2STR(sta->addr));
- sta->sae->state = SAE_COMMITTED;
wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING);
-
- mesh_rsn_send_auth(wpa_s, sta->addr, wpa_s->own_addr,
- 1, WLAN_STATUS_SUCCESS, buf);
-
- wpabuf_free(buf);
-
+ ret = auth_sae_init_committed(hapd, sta);
+ if (ret)
+ return ret;
+
+ eloop_cancel_timeout(mesh_auth_timer, wpa_s, sta);
+ rnd = rand() % MESH_AUTH_TIMEOUT;
+ eloop_register_timeout(MESH_AUTH_TIMEOUT + rnd, 0, mesh_auth_timer,
+ wpa_s, sta);
return 0;
}
void mesh_rsn_get_pmkid(struct mesh_rsn *rsn, struct sta_info *sta, u8 *pmkid)
{
- /* don't expect wpa auth to cache the pmkid for now */
- rsn_pmkid(sta->sae->pmk, PMK_LEN, rsn->wpa_s->own_addr,
- sta->addr, pmkid,
- wpa_key_mgmt_sha256(wpa_auth_sta_key_mgmt(sta->wpa_sm)));
+ os_memcpy(pmkid, sta->sae->pmkid, SAE_PMKID_LEN);
}
int mesh_rsn_process_ampe(struct wpa_supplicant *wpa_s, struct sta_info *sta,
struct ieee802_11_elems *elems, const u8 *cat,
+ const u8 *chosen_pmk,
const u8 *start, size_t elems_len)
{
int ret = 0;
const size_t aad_len[] = { ETH_ALEN, ETH_ALEN,
(elems->mic - 2) - cat };
+ if (!sta->sae) {
+ struct hostapd_data *hapd = wpa_s->ifmsh->bss[0];
+
+ if (!wpa_auth_pmksa_get(hapd->wpa_auth, sta->addr)) {
+ wpa_printf(MSG_INFO,
+ "Mesh RSN: SAE is not prepared yet");
+ return -1;
+ }
+ mesh_rsn_auth_sae_sta(wpa_s, sta);
+ }
+
+ if (chosen_pmk && os_memcmp(chosen_pmk, sta->sae->pmkid, PMKID_LEN)) {
+ wpa_msg(wpa_s, MSG_DEBUG,
+ "Mesh RSN: Invalid PMKID (Chosen PMK did not match calculated PMKID)");
+ return -1;
+ }
+
if (!elems->mic || elems->mic_len < AES_BLOCK_SIZE) {
wpa_msg(wpa_s, MSG_DEBUG, "Mesh RSN: missing mic ie");
return -1;
projects / mech_eap.git / blobdiff