src/ap/ieee802_1x.c

   1 /*
   2  * hostapd / IEEE 802.1X-2004 Authenticator
   3  * Copyright (c) 2002-2012, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #include "utils/common.h"
  12 #include "utils/eloop.h"
  13 #include "crypto/md5.h"
  14 #include "crypto/crypto.h"
  15 #include "crypto/random.h"
  16 #include "common/ieee802_11_defs.h"
  17 #include "radius/radius.h"
  18 #include "radius/radius_client.h"
  19 #include "eap_server/eap.h"
  20 #include "eap_common/eap_wsc_common.h"
  21 #include "eapol_auth/eapol_auth_sm.h"
  22 #include "eapol_auth/eapol_auth_sm_i.h"
  23 #include "p2p/p2p.h"
  24 #include "hostapd.h"
  25 #include "accounting.h"
  26 #include "sta_info.h"
  27 #include "wpa_auth.h"
  28 #include "preauth_auth.h"
  29 #include "pmksa_cache_auth.h"
  30 #include "ap_config.h"
  31 #include "ap_drv_ops.h"
  32 #include "wps_hostapd.h"
  33 #include "hs20.h"
  34 #include "ieee802_1x.h"
  35
  36
  37 #ifdef CONFIG_HS20
  38 static void ieee802_1x_wnm_notif_send(void *eloop_ctx, void *timeout_ctx);
  39 #endif /* CONFIG_HS20 */
  40 static void ieee802_1x_finished(struct hostapd_data *hapd,
  41                                 struct sta_info *sta, int success,
  42                                 int remediation);
  43
  44
  45 static void ieee802_1x_send(struct hostapd_data *hapd, struct sta_info *sta,
  46                             u8 type, const u8 *data, size_t datalen)
  47 {
  48         u8 *buf;
  49         struct ieee802_1x_hdr *xhdr;
  50         size_t len;
  51         int encrypt = 0;
  52
  53         len = sizeof(*xhdr) + datalen;
  54         buf = os_zalloc(len);
  55         if (buf == NULL) {
  56                 wpa_printf(MSG_ERROR, "malloc() failed for "
  57                            "ieee802_1x_send(len=%lu)",
  58                            (unsigned long) len);
  59                 return;
  60         }
  61
  62         xhdr = (struct ieee802_1x_hdr *) buf;
  63         xhdr->version = hapd->conf->eapol_version;
  64         xhdr->type = type;
  65         xhdr->length = host_to_be16(datalen);
  66
  67         if (datalen > 0 && data != NULL)
  68                 os_memcpy(xhdr + 1, data, datalen);
  69
  70         if (wpa_auth_pairwise_set(sta->wpa_sm))
  71                 encrypt = 1;
  72 #ifdef CONFIG_TESTING_OPTIONS
  73         if (hapd->ext_eapol_frame_io) {
  74                 size_t hex_len = 2 * len + 1;
  75                 char *hex = os_malloc(hex_len);
  76
  77                 if (hex) {
  78                         wpa_snprintf_hex(hex, hex_len, buf, len);
  79                         wpa_msg(hapd->msg_ctx, MSG_INFO,
  80                                 "EAPOL-TX " MACSTR " %s",
  81                                 MAC2STR(sta->addr), hex);
  82                         os_free(hex);
  83                 }
  84         } else
  85 #endif /* CONFIG_TESTING_OPTIONS */
  86         if (sta->flags & WLAN_STA_PREAUTH) {
  87                 rsn_preauth_send(hapd, sta, buf, len);
  88         } else {
  89                 hostapd_drv_hapd_send_eapol(
  90                         hapd, sta->addr, buf, len,
  91                         encrypt, hostapd_sta_flags_to_drv(sta->flags));
  92         }
  93
  94         os_free(buf);
  95 }
  96
  97
  98 void ieee802_1x_set_sta_authorized(struct hostapd_data *hapd,
  99                                    struct sta_info *sta, int authorized)
 100 {
 101         int res;
 102
 103         if (sta->flags & WLAN_STA_PREAUTH)
 104                 return;
 105
 106         if (authorized) {
 107                 ap_sta_set_authorized(hapd, sta, 1);
 108                 res = hostapd_set_authorized(hapd, sta, 1);
 109                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
 110                                HOSTAPD_LEVEL_DEBUG, "authorizing port");
 111         } else {
 112                 ap_sta_set_authorized(hapd, sta, 0);
 113                 res = hostapd_set_authorized(hapd, sta, 0);
 114                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
 115                                HOSTAPD_LEVEL_DEBUG, "unauthorizing port");
 116         }
 117
 118         if (res && errno != ENOENT) {
 119                 wpa_printf(MSG_DEBUG, "Could not set station " MACSTR
 120                            " flags for kernel driver (errno=%d).",
 121                            MAC2STR(sta->addr), errno);
 122         }
 123
 124         if (authorized) {
 125                 os_get_reltime(&sta->connected_time);
 126                 accounting_sta_start(hapd, sta);
 127         }
 128 }
 129
 130
 131 #ifndef CONFIG_FIPS
 132 #ifndef CONFIG_NO_RC4
 133
 134 static void ieee802_1x_tx_key_one(struct hostapd_data *hapd,
 135                                   struct sta_info *sta,
 136                                   int idx, int broadcast,
 137                                   u8 *key_data, size_t key_len)
 138 {
 139         u8 *buf, *ekey;
 140         struct ieee802_1x_hdr *hdr;
 141         struct ieee802_1x_eapol_key *key;
 142         size_t len, ekey_len;
 143         struct eapol_state_machine *sm = sta->eapol_sm;
 144
 145         if (sm == NULL)
 146                 return;
 147
 148         len = sizeof(*key) + key_len;
 149         buf = os_zalloc(sizeof(*hdr) + len);
 150         if (buf == NULL)
 151                 return;
 152
 153         hdr = (struct ieee802_1x_hdr *) buf;
 154         key = (struct ieee802_1x_eapol_key *) (hdr + 1);
 155         key->type = EAPOL_KEY_TYPE_RC4;
 156         WPA_PUT_BE16(key->key_length, key_len);
 157         wpa_get_ntp_timestamp(key->replay_counter);
 158
 159         if (random_get_bytes(key->key_iv, sizeof(key->key_iv))) {
 160                 wpa_printf(MSG_ERROR, "Could not get random numbers");
 161                 os_free(buf);
 162                 return;
 163         }
 164
 165         key->key_index = idx | (broadcast ? 0 : BIT(7));
 166         if (hapd->conf->eapol_key_index_workaround) {
 167                 /* According to some information, WinXP Supplicant seems to
 168                  * interpret bit7 as an indication whether the key is to be
 169                  * activated, so make it possible to enable workaround that
 170                  * sets this bit for all keys. */
 171                 key->key_index |= BIT(7);
 172         }
 173
 174         /* Key is encrypted using "Key-IV + MSK[0..31]" as the RC4-key and
 175          * MSK[32..63] is used to sign the message. */
 176         if (sm->eap_if->eapKeyData == NULL || sm->eap_if->eapKeyDataLen < 64) {
 177                 wpa_printf(MSG_ERROR, "No eapKeyData available for encrypting "
 178                            "and signing EAPOL-Key");
 179                 os_free(buf);
 180                 return;
 181         }
 182         os_memcpy((u8 *) (key + 1), key_data, key_len);
 183         ekey_len = sizeof(key->key_iv) + 32;
 184         ekey = os_malloc(ekey_len);
 185         if (ekey == NULL) {
 186                 wpa_printf(MSG_ERROR, "Could not encrypt key");
 187                 os_free(buf);
 188                 return;
 189         }
 190         os_memcpy(ekey, key->key_iv, sizeof(key->key_iv));
 191         os_memcpy(ekey + sizeof(key->key_iv), sm->eap_if->eapKeyData, 32);
 192         rc4_skip(ekey, ekey_len, 0, (u8 *) (key + 1), key_len);
 193         os_free(ekey);
 194
 195         /* This header is needed here for HMAC-MD5, but it will be regenerated
 196          * in ieee802_1x_send() */
 197         hdr->version = hapd->conf->eapol_version;
 198         hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
 199         hdr->length = host_to_be16(len);
 200         hmac_md5(sm->eap_if->eapKeyData + 32, 32, buf, sizeof(*hdr) + len,
 201                  key->key_signature);
 202
 203         wpa_printf(MSG_DEBUG, "IEEE 802.1X: Sending EAPOL-Key to " MACSTR
 204                    " (%s index=%d)", MAC2STR(sm->addr),
 205                    broadcast ? "broadcast" : "unicast", idx);
 206         ieee802_1x_send(hapd, sta, IEEE802_1X_TYPE_EAPOL_KEY, (u8 *) key, len);
 207         if (sta->eapol_sm)
 208                 sta->eapol_sm->dot1xAuthEapolFramesTx++;
 209         os_free(buf);
 210 }
 211
 212
 213 static void ieee802_1x_tx_key(struct hostapd_data *hapd, struct sta_info *sta)
 214 {
 215         struct eapol_authenticator *eapol = hapd->eapol_auth;
 216         struct eapol_state_machine *sm = sta->eapol_sm;
 217
 218         if (sm == NULL || !sm->eap_if->eapKeyData)
 219                 return;
 220
 221         wpa_printf(MSG_DEBUG, "IEEE 802.1X: Sending EAPOL-Key(s) to " MACSTR,
 222                    MAC2STR(sta->addr));
 223
 224 #ifndef CONFIG_NO_VLAN
 225         if (sta->vlan_id > 0 && sta->vlan_id <= MAX_VLAN_ID) {
 226                 wpa_printf(MSG_ERROR, "Using WEP with vlans is not supported.");
 227                 return;
 228         }
 229 #endif /* CONFIG_NO_VLAN */
 230
 231         if (eapol->default_wep_key) {
 232                 ieee802_1x_tx_key_one(hapd, sta, eapol->default_wep_key_idx, 1,
 233                                       eapol->default_wep_key,
 234                                       hapd->conf->default_wep_key_len);
 235         }
 236
 237         if (hapd->conf->individual_wep_key_len > 0) {
 238                 u8 *ikey;
 239                 ikey = os_malloc(hapd->conf->individual_wep_key_len);
 240                 if (ikey == NULL ||
 241                     random_get_bytes(ikey, hapd->conf->individual_wep_key_len))
 242                 {
 243                         wpa_printf(MSG_ERROR, "Could not generate random "
 244                                    "individual WEP key.");
 245                         os_free(ikey);
 246                         return;
 247                 }
 248
 249                 wpa_hexdump_key(MSG_DEBUG, "Individual WEP key",
 250                                 ikey, hapd->conf->individual_wep_key_len);
 251
 252                 ieee802_1x_tx_key_one(hapd, sta, 0, 0, ikey,
 253                                       hapd->conf->individual_wep_key_len);
 254
 255                 /* TODO: set encryption in TX callback, i.e., only after STA
 256                  * has ACKed EAPOL-Key frame */
 257                 if (hostapd_drv_set_key(hapd->conf->iface, hapd, WPA_ALG_WEP,
 258                                         sta->addr, 0, 1, NULL, 0, ikey,
 259                                         hapd->conf->individual_wep_key_len)) {
 260                         wpa_printf(MSG_ERROR, "Could not set individual WEP "
 261                                    "encryption.");
 262                 }
 263
 264                 os_free(ikey);
 265         }
 266 }
 267
 268 #endif /* CONFIG_NO_RC4 */
 269 #endif /* CONFIG_FIPS */
 270
 271
 272 const char *radius_mode_txt(struct hostapd_data *hapd)
 273 {
 274         switch (hapd->iface->conf->hw_mode) {
 275         case HOSTAPD_MODE_IEEE80211AD:
 276                 return "802.11ad";
 277         case HOSTAPD_MODE_IEEE80211A:
 278                 return "802.11a";
 279         case HOSTAPD_MODE_IEEE80211G:
 280                 return "802.11g";
 281         case HOSTAPD_MODE_IEEE80211B:
 282         default:
 283                 return "802.11b";
 284         }
 285 }
 286
 287
 288 int radius_sta_rate(struct hostapd_data *hapd, struct sta_info *sta)
 289 {
 290         int i;
 291         u8 rate = 0;
 292
 293         for (i = 0; i < sta->supported_rates_len; i++)
 294                 if ((sta->supported_rates[i] & 0x7f) > rate)
 295                         rate = sta->supported_rates[i] & 0x7f;
 296
 297         return rate;
 298 }
 299
 300
 301 #ifndef CONFIG_NO_RADIUS
 302 static void ieee802_1x_learn_identity(struct hostapd_data *hapd,
 303                                       struct eapol_state_machine *sm,
 304                                       const u8 *eap, size_t len)
 305 {
 306         const u8 *identity;
 307         size_t identity_len;
 308         const struct eap_hdr *hdr = (const struct eap_hdr *) eap;
 309
 310         if (len <= sizeof(struct eap_hdr) ||
 311             (hdr->code == EAP_CODE_RESPONSE &&
 312              eap[sizeof(struct eap_hdr)] != EAP_TYPE_IDENTITY) ||
 313             (hdr->code == EAP_CODE_INITIATE &&
 314              eap[sizeof(struct eap_hdr)] != EAP_ERP_TYPE_REAUTH) ||
 315             (hdr->code != EAP_CODE_RESPONSE &&
 316              hdr->code != EAP_CODE_INITIATE))
 317                 return;
 318
 319         identity = eap_get_identity(sm->eap, &identity_len);
 320         if (identity == NULL)
 321                 return;
 322
 323         /* Save station identity for future RADIUS packets */
 324         os_free(sm->identity);
 325         sm->identity = (u8 *) dup_binstr(identity, identity_len);
 326         if (sm->identity == NULL) {
 327                 sm->identity_len = 0;
 328                 return;
 329         }
 330
 331         sm->identity_len = identity_len;
 332         hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
 333                        HOSTAPD_LEVEL_DEBUG, "STA identity '%s'", sm->identity);
 334         sm->dot1xAuthEapolRespIdFramesRx++;
 335 }
 336
 337
 338 static int add_common_radius_sta_attr_rsn(struct hostapd_data *hapd,
 339                                           struct hostapd_radius_attr *req_attr,
 340                                           struct sta_info *sta,
 341                                           struct radius_msg *msg)
 342 {
 343         u32 suite;
 344         int ver, val;
 345
 346         ver = wpa_auth_sta_wpa_version(sta->wpa_sm);
 347         val = wpa_auth_get_pairwise(sta->wpa_sm);
 348         suite = wpa_cipher_to_suite(ver, val);
 349         if (val != -1 &&
 350             !hostapd_config_get_radius_attr(req_attr,
 351                                             RADIUS_ATTR_WLAN_PAIRWISE_CIPHER) &&
 352             !radius_msg_add_attr_int32(msg, RADIUS_ATTR_WLAN_PAIRWISE_CIPHER,
 353                                        suite)) {
 354                 wpa_printf(MSG_ERROR, "Could not add WLAN-Pairwise-Cipher");
 355                 return -1;
 356         }
 357
 358         suite = wpa_cipher_to_suite(((hapd->conf->wpa & 0x2) ||
 359                                      hapd->conf->osen) ?
 360                                     WPA_PROTO_RSN : WPA_PROTO_WPA,
 361                                     hapd->conf->wpa_group);
 362         if (!hostapd_config_get_radius_attr(req_attr,
 363                                             RADIUS_ATTR_WLAN_GROUP_CIPHER) &&
 364             !radius_msg_add_attr_int32(msg, RADIUS_ATTR_WLAN_GROUP_CIPHER,
 365                                        suite)) {
 366                 wpa_printf(MSG_ERROR, "Could not add WLAN-Group-Cipher");
 367                 return -1;
 368         }
 369
 370         val = wpa_auth_sta_key_mgmt(sta->wpa_sm);
 371         suite = wpa_akm_to_suite(val);
 372         if (val != -1 &&
 373             !hostapd_config_get_radius_attr(req_attr,
 374                                             RADIUS_ATTR_WLAN_AKM_SUITE) &&
 375             !radius_msg_add_attr_int32(msg, RADIUS_ATTR_WLAN_AKM_SUITE,
 376                                        suite)) {
 377                 wpa_printf(MSG_ERROR, "Could not add WLAN-AKM-Suite");
 378                 return -1;
 379         }
 380
 381 #ifdef CONFIG_IEEE80211W
 382         if (hapd->conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) {
 383                 suite = wpa_cipher_to_suite(WPA_PROTO_RSN,
 384                                             hapd->conf->group_mgmt_cipher);
 385                 if (!hostapd_config_get_radius_attr(
 386                             req_attr, RADIUS_ATTR_WLAN_GROUP_MGMT_CIPHER) &&
 387                     !radius_msg_add_attr_int32(
 388                             msg, RADIUS_ATTR_WLAN_GROUP_MGMT_CIPHER, suite)) {
 389                         wpa_printf(MSG_ERROR,
 390                                    "Could not add WLAN-Group-Mgmt-Cipher");
 391                         return -1;
 392                 }
 393         }
 394 #endif /* CONFIG_IEEE80211W */
 395
 396         return 0;
 397 }
 398
 399
 400 static int add_common_radius_sta_attr(struct hostapd_data *hapd,
 401                                       struct hostapd_radius_attr *req_attr,
 402                                       struct sta_info *sta,
 403                                       struct radius_msg *msg)
 404 {
 405         char buf[128];
 406
 407         if (!hostapd_config_get_radius_attr(req_attr,
 408                                             RADIUS_ATTR_NAS_PORT) &&
 409             !radius_msg_add_attr_int32(msg, RADIUS_ATTR_NAS_PORT, sta->aid)) {
 410                 wpa_printf(MSG_ERROR, "Could not add NAS-Port");
 411                 return -1;
 412         }
 413
 414         os_snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT,
 415                     MAC2STR(sta->addr));
 416         buf[sizeof(buf) - 1] = '\0';
 417         if (!radius_msg_add_attr(msg, RADIUS_ATTR_CALLING_STATION_ID,
 418                                  (u8 *) buf, os_strlen(buf))) {
 419                 wpa_printf(MSG_ERROR, "Could not add Calling-Station-Id");
 420                 return -1;
 421         }
 422
 423         if (sta->flags & WLAN_STA_PREAUTH) {
 424                 os_strlcpy(buf, "IEEE 802.11i Pre-Authentication",
 425                            sizeof(buf));
 426         } else {
 427                 os_snprintf(buf, sizeof(buf), "CONNECT %d%sMbps %s",
 428                             radius_sta_rate(hapd, sta) / 2,
 429                             (radius_sta_rate(hapd, sta) & 1) ? ".5" : "",
 430                             radius_mode_txt(hapd));
 431                 buf[sizeof(buf) - 1] = '\0';
 432         }
 433         if (!hostapd_config_get_radius_attr(req_attr,
 434                                             RADIUS_ATTR_CONNECT_INFO) &&
 435             !radius_msg_add_attr(msg, RADIUS_ATTR_CONNECT_INFO,
 436                                  (u8 *) buf, os_strlen(buf))) {
 437                 wpa_printf(MSG_ERROR, "Could not add Connect-Info");
 438                 return -1;
 439         }
 440
 441         if (sta->acct_session_id) {
 442                 os_snprintf(buf, sizeof(buf), "%016lX",
 443                             (long unsigned int) sta->acct_session_id);
 444                 if (!radius_msg_add_attr(msg, RADIUS_ATTR_ACCT_SESSION_ID,
 445                                          (u8 *) buf, os_strlen(buf))) {
 446                         wpa_printf(MSG_ERROR, "Could not add Acct-Session-Id");
 447                         return -1;
 448                 }
 449         }
 450
 451         if ((hapd->conf->wpa & 2) &&
 452             !hapd->conf->disable_pmksa_caching &&
 453             sta->eapol_sm && sta->eapol_sm->acct_multi_session_id) {
 454                 os_snprintf(buf, sizeof(buf), "%016lX",
 455                             (long unsigned int)
 456                             sta->eapol_sm->acct_multi_session_id);
 457                 if (!radius_msg_add_attr(
 458                             msg, RADIUS_ATTR_ACCT_MULTI_SESSION_ID,
 459                             (u8 *) buf, os_strlen(buf))) {
 460                         wpa_printf(MSG_INFO,
 461                                    "Could not add Acct-Multi-Session-Id");
 462                         return -1;
 463                 }
 464         }
 465
 466 #ifdef CONFIG_IEEE80211R
 467         if (hapd->conf->wpa && wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt) &&
 468             sta->wpa_sm &&
 469             (wpa_key_mgmt_ft(wpa_auth_sta_key_mgmt(sta->wpa_sm)) ||
 470              sta->auth_alg == WLAN_AUTH_FT) &&
 471             !hostapd_config_get_radius_attr(req_attr,
 472                                             RADIUS_ATTR_MOBILITY_DOMAIN_ID) &&
 473             !radius_msg_add_attr_int32(msg, RADIUS_ATTR_MOBILITY_DOMAIN_ID,
 474                                        WPA_GET_BE16(
 475                                                hapd->conf->mobility_domain))) {
 476                 wpa_printf(MSG_ERROR, "Could not add Mobility-Domain-Id");
 477                 return -1;
 478         }
 479 #endif /* CONFIG_IEEE80211R */
 480
 481         if ((hapd->conf->wpa || hapd->conf->osen) && sta->wpa_sm &&
 482             add_common_radius_sta_attr_rsn(hapd, req_attr, sta, msg) < 0)
 483                 return -1;
 484
 485         return 0;
 486 }
 487
 488
 489 int add_common_radius_attr(struct hostapd_data *hapd,
 490                            struct hostapd_radius_attr *req_attr,
 491                            struct sta_info *sta,
 492                            struct radius_msg *msg)
 493 {
 494         char buf[128];
 495         struct hostapd_radius_attr *attr;
 496         int len;
 497
 498         if (!hostapd_config_get_radius_attr(req_attr,
 499                                             RADIUS_ATTR_NAS_IP_ADDRESS) &&
 500             hapd->conf->own_ip_addr.af == AF_INET &&
 501             !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IP_ADDRESS,
 502                                  (u8 *) &hapd->conf->own_ip_addr.u.v4, 4)) {
 503                 wpa_printf(MSG_ERROR, "Could not add NAS-IP-Address");
 504                 return -1;
 505         }
 506
 507 #ifdef CONFIG_IPV6
 508         if (!hostapd_config_get_radius_attr(req_attr,
 509                                             RADIUS_ATTR_NAS_IPV6_ADDRESS) &&
 510             hapd->conf->own_ip_addr.af == AF_INET6 &&
 511             !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IPV6_ADDRESS,
 512                                  (u8 *) &hapd->conf->own_ip_addr.u.v6, 16)) {
 513                 wpa_printf(MSG_ERROR, "Could not add NAS-IPv6-Address");
 514                 return -1;
 515         }
 516 #endif /* CONFIG_IPV6 */
 517
 518         if (!hostapd_config_get_radius_attr(req_attr,
 519                                             RADIUS_ATTR_NAS_IDENTIFIER) &&
 520             hapd->conf->nas_identifier &&
 521             !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IDENTIFIER,
 522                                  (u8 *) hapd->conf->nas_identifier,
 523                                  os_strlen(hapd->conf->nas_identifier))) {
 524                 wpa_printf(MSG_ERROR, "Could not add NAS-Identifier");
 525                 return -1;
 526         }
 527
 528         len = os_snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT ":",
 529                           MAC2STR(hapd->own_addr));
 530         os_memcpy(&buf[len], hapd->conf->ssid.ssid,
 531                   hapd->conf->ssid.ssid_len);
 532         len += hapd->conf->ssid.ssid_len;
 533         if (!hostapd_config_get_radius_attr(req_attr,
 534                                             RADIUS_ATTR_CALLED_STATION_ID) &&
 535             !radius_msg_add_attr(msg, RADIUS_ATTR_CALLED_STATION_ID,
 536                                  (u8 *) buf, len)) {
 537                 wpa_printf(MSG_ERROR, "Could not add Called-Station-Id");
 538                 return -1;
 539         }
 540
 541         if (!hostapd_config_get_radius_attr(req_attr,
 542                                             RADIUS_ATTR_NAS_PORT_TYPE) &&
 543             !radius_msg_add_attr_int32(msg, RADIUS_ATTR_NAS_PORT_TYPE,
 544                                        RADIUS_NAS_PORT_TYPE_IEEE_802_11)) {
 545                 wpa_printf(MSG_ERROR, "Could not add NAS-Port-Type");
 546                 return -1;
 547         }
 548
 549 #ifdef CONFIG_INTERWORKING
 550         if (hapd->conf->interworking &&
 551             !is_zero_ether_addr(hapd->conf->hessid)) {
 552                 os_snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT,
 553                             MAC2STR(hapd->conf->hessid));
 554                 buf[sizeof(buf) - 1] = '\0';
 555                 if (!hostapd_config_get_radius_attr(req_attr,
 556                                                     RADIUS_ATTR_WLAN_HESSID) &&
 557                     !radius_msg_add_attr(msg, RADIUS_ATTR_WLAN_HESSID,
 558                                          (u8 *) buf, os_strlen(buf))) {
 559                         wpa_printf(MSG_ERROR, "Could not add WLAN-HESSID");
 560                         return -1;
 561                 }
 562         }
 563 #endif /* CONFIG_INTERWORKING */
 564
 565         if (sta && add_common_radius_sta_attr(hapd, req_attr, sta, msg) < 0)
 566                 return -1;
 567
 568         for (attr = req_attr; attr; attr = attr->next) {
 569                 if (!radius_msg_add_attr(msg, attr->type,
 570                                          wpabuf_head(attr->val),
 571                                          wpabuf_len(attr->val))) {
 572                         wpa_printf(MSG_ERROR, "Could not add RADIUS "
 573                                    "attribute");
 574                         return -1;
 575                 }
 576         }
 577
 578         return 0;
 579 }
 580
 581
 582 static void ieee802_1x_encapsulate_radius(struct hostapd_data *hapd,
 583                                           struct sta_info *sta,
 584                                           const u8 *eap, size_t len)
 585 {
 586         struct radius_msg *msg;
 587         struct eapol_state_machine *sm = sta->eapol_sm;
 588
 589         if (sm == NULL)
 590                 return;
 591
 592         ieee802_1x_learn_identity(hapd, sm, eap, len);
 593
 594         wpa_printf(MSG_DEBUG, "Encapsulating EAP message into a RADIUS "
 595                    "packet");
 596
 597         sm->radius_identifier = radius_client_get_id(hapd->radius);
 598         msg = radius_msg_new(RADIUS_CODE_ACCESS_REQUEST,
 599                              sm->radius_identifier);
 600         if (msg == NULL) {
 601                 wpa_printf(MSG_INFO, "Could not create new RADIUS packet");
 602                 return;
 603         }
 604
 605         radius_msg_make_authenticator(msg, (u8 *) sta, sizeof(*sta));
 606
 607         if (sm->identity &&
 608             !radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME,
 609                                  sm->identity, sm->identity_len)) {
 610                 wpa_printf(MSG_INFO, "Could not add User-Name");
 611                 goto fail;
 612         }
 613
 614         if (add_common_radius_attr(hapd, hapd->conf->radius_auth_req_attr, sta,
 615                                    msg) < 0)
 616                 goto fail;
 617
 618         /* TODO: should probably check MTU from driver config; 2304 is max for
 619          * IEEE 802.11, but use 1400 to avoid problems with too large packets
 620          */
 621         if (!hostapd_config_get_radius_attr(hapd->conf->radius_auth_req_attr,
 622                                             RADIUS_ATTR_FRAMED_MTU) &&
 623             !radius_msg_add_attr_int32(msg, RADIUS_ATTR_FRAMED_MTU, 1400)) {
 624                 wpa_printf(MSG_INFO, "Could not add Framed-MTU");
 625                 goto fail;
 626         }
 627
 628         if (!radius_msg_add_eap(msg, eap, len)) {
 629                 wpa_printf(MSG_INFO, "Could not add EAP-Message");
 630                 goto fail;
 631         }
 632
 633         /* State attribute must be copied if and only if this packet is
 634          * Access-Request reply to the previous Access-Challenge */
 635         if (sm->last_recv_radius &&
 636             radius_msg_get_hdr(sm->last_recv_radius)->code ==
 637             RADIUS_CODE_ACCESS_CHALLENGE) {
 638                 int res = radius_msg_copy_attr(msg, sm->last_recv_radius,
 639                                                RADIUS_ATTR_STATE);
 640                 if (res < 0) {
 641                         wpa_printf(MSG_INFO, "Could not copy State attribute from previous Access-Challenge");
 642                         goto fail;
 643                 }
 644                 if (res > 0) {
 645                         wpa_printf(MSG_DEBUG, "Copied RADIUS State Attribute");
 646                 }
 647         }
 648
 649         if (hapd->conf->radius_request_cui) {
 650                 const u8 *cui;
 651                 size_t cui_len;
 652                 /* Add previously learned CUI or nul CUI to request CUI */
 653                 if (sm->radius_cui) {
 654                         cui = wpabuf_head(sm->radius_cui);
 655                         cui_len = wpabuf_len(sm->radius_cui);
 656                 } else {
 657                         cui = (const u8 *) "\0";
 658                         cui_len = 1;
 659                 }
 660                 if (!radius_msg_add_attr(msg,
 661                                          RADIUS_ATTR_CHARGEABLE_USER_IDENTITY,
 662                                          cui, cui_len)) {
 663                         wpa_printf(MSG_ERROR, "Could not add CUI");
 664                         goto fail;
 665                 }
 666         }
 667
 668 #ifdef CONFIG_HS20
 669         if (hapd->conf->hs20) {
 670                 u8 ver = 1; /* Release 2 */
 671                 if (!radius_msg_add_wfa(
 672                             msg, RADIUS_VENDOR_ATTR_WFA_HS20_AP_VERSION,
 673                             &ver, 1)) {
 674                         wpa_printf(MSG_ERROR, "Could not add HS 2.0 AP "
 675                                    "version");
 676                         goto fail;
 677                 }
 678
 679                 if (sta->hs20_ie && wpabuf_len(sta->hs20_ie) > 0) {
 680                         const u8 *pos;
 681                         u8 buf[3];
 682                         u16 id;
 683                         pos = wpabuf_head_u8(sta->hs20_ie);
 684                         buf[0] = (*pos) >> 4;
 685                         if (((*pos) & HS20_PPS_MO_ID_PRESENT) &&
 686                             wpabuf_len(sta->hs20_ie) >= 3)
 687                                 id = WPA_GET_LE16(pos + 1);
 688                         else
 689                                 id = 0;
 690                         WPA_PUT_BE16(buf + 1, id);
 691                         if (!radius_msg_add_wfa(
 692                                     msg,
 693                                     RADIUS_VENDOR_ATTR_WFA_HS20_STA_VERSION,
 694                                     buf, sizeof(buf))) {
 695                                 wpa_printf(MSG_ERROR, "Could not add HS 2.0 "
 696                                            "STA version");
 697                                 goto fail;
 698                         }
 699                 }
 700         }
 701 #endif /* CONFIG_HS20 */
 702
 703         if (radius_client_send(hapd->radius, msg, RADIUS_AUTH, sta->addr) < 0)
 704                 goto fail;
 705
 706         return;
 707
 708  fail:
 709         radius_msg_free(msg);
 710 }
 711 #endif /* CONFIG_NO_RADIUS */
 712
 713
 714 static void handle_eap_response(struct hostapd_data *hapd,
 715                                 struct sta_info *sta, struct eap_hdr *eap,
 716                                 size_t len)
 717 {
 718         u8 type, *data;
 719         struct eapol_state_machine *sm = sta->eapol_sm;
 720         if (sm == NULL)
 721                 return;
 722
 723         data = (u8 *) (eap + 1);
 724
 725         if (len < sizeof(*eap) + 1) {
 726                 wpa_printf(MSG_INFO, "handle_eap_response: too short response data");
 727                 return;
 728         }
 729
 730         sm->eap_type_supp = type = data[0];
 731
 732         hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
 733                        HOSTAPD_LEVEL_DEBUG, "received EAP packet (code=%d "
 734                        "id=%d len=%d) from STA: EAP Response-%s (%d)",
 735                        eap->code, eap->identifier, be_to_host16(eap->length),
 736                        eap_server_get_name(0, type), type);
 737
 738         sm->dot1xAuthEapolRespFramesRx++;
 739
 740         wpabuf_free(sm->eap_if->eapRespData);
 741         sm->eap_if->eapRespData = wpabuf_alloc_copy(eap, len);
 742         sm->eapolEap = TRUE;
 743 }
 744
 745
 746 static void handle_eap_initiate(struct hostapd_data *hapd,
 747                                 struct sta_info *sta, struct eap_hdr *eap,
 748                                 size_t len)
 749 {
 750 #ifdef CONFIG_ERP
 751         u8 type, *data;
 752         struct eapol_state_machine *sm = sta->eapol_sm;
 753
 754         if (sm == NULL)
 755                 return;
 756
 757         if (len < sizeof(*eap) + 1) {
 758                 wpa_printf(MSG_INFO,
 759                            "handle_eap_initiate: too short response data");
 760                 return;
 761         }
 762
 763         data = (u8 *) (eap + 1);
 764         type = data[0];
 765
 766         hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
 767                        HOSTAPD_LEVEL_DEBUG, "received EAP packet (code=%d "
 768                        "id=%d len=%d) from STA: EAP Initiate type %u",
 769                        eap->code, eap->identifier, be_to_host16(eap->length),
 770                        type);
 771
 772         wpabuf_free(sm->eap_if->eapRespData);
 773         sm->eap_if->eapRespData = wpabuf_alloc_copy(eap, len);
 774         sm->eapolEap = TRUE;
 775 #endif /* CONFIG_ERP */
 776 }
 777
 778
 779 /* Process incoming EAP packet from Supplicant */
 780 static void handle_eap(struct hostapd_data *hapd, struct sta_info *sta,
 781                        u8 *buf, size_t len)
 782 {
 783         struct eap_hdr *eap;
 784         u16 eap_len;
 785
 786         if (len < sizeof(*eap)) {
 787                 wpa_printf(MSG_INFO, "   too short EAP packet");
 788                 return;
 789         }
 790
 791         eap = (struct eap_hdr *) buf;
 792
 793         eap_len = be_to_host16(eap->length);
 794         wpa_printf(MSG_DEBUG, "EAP: code=%d identifier=%d length=%d",
 795                    eap->code, eap->identifier, eap_len);
 796         if (eap_len < sizeof(*eap)) {
 797                 wpa_printf(MSG_DEBUG, "   Invalid EAP length");
 798                 return;
 799         } else if (eap_len > len) {
 800                 wpa_printf(MSG_DEBUG, "   Too short frame to contain this EAP "
 801                            "packet");
 802                 return;
 803         } else if (eap_len < len) {
 804                 wpa_printf(MSG_DEBUG, "   Ignoring %lu extra bytes after EAP "
 805                            "packet", (unsigned long) len - eap_len);
 806         }
 807
 808         switch (eap->code) {
 809         case EAP_CODE_REQUEST:
 810                 wpa_printf(MSG_DEBUG, " (request)");
 811                 return;
 812         case EAP_CODE_RESPONSE:
 813                 wpa_printf(MSG_DEBUG, " (response)");
 814                 handle_eap_response(hapd, sta, eap, eap_len);
 815                 break;
 816         case EAP_CODE_SUCCESS:
 817                 wpa_printf(MSG_DEBUG, " (success)");
 818                 return;
 819         case EAP_CODE_FAILURE:
 820                 wpa_printf(MSG_DEBUG, " (failure)");
 821                 return;
 822         case EAP_CODE_INITIATE:
 823                 wpa_printf(MSG_DEBUG, " (initiate)");
 824                 handle_eap_initiate(hapd, sta, eap, eap_len);
 825                 break;
 826         case EAP_CODE_FINISH:
 827                 wpa_printf(MSG_DEBUG, " (finish)");
 828                 break;
 829         default:
 830                 wpa_printf(MSG_DEBUG, " (unknown code)");
 831                 return;
 832         }
 833 }
 834
 835
 836 static struct eapol_state_machine *
 837 ieee802_1x_alloc_eapol_sm(struct hostapd_data *hapd, struct sta_info *sta)
 838 {
 839         int flags = 0;
 840         if (sta->flags & WLAN_STA_PREAUTH)
 841                 flags |= EAPOL_SM_PREAUTH;
 842         if (sta->wpa_sm) {
 843                 flags |= EAPOL_SM_USES_WPA;
 844                 if (wpa_auth_sta_get_pmksa(sta->wpa_sm))
 845                         flags |= EAPOL_SM_FROM_PMKSA_CACHE;
 846         }
 847         return eapol_auth_alloc(hapd->eapol_auth, sta->addr, flags,
 848                                 sta->wps_ie, sta->p2p_ie, sta,
 849                                 sta->identity, sta->radius_cui);
 850 }
 851
 852
 853 /**
 854  * ieee802_1x_receive - Process the EAPOL frames from the Supplicant
 855  * @hapd: hostapd BSS data
 856  * @sa: Source address (sender of the EAPOL frame)
 857  * @buf: EAPOL frame
 858  * @len: Length of buf in octets
 859  *
 860  * This function is called for each incoming EAPOL frame from the interface
 861  */
 862 void ieee802_1x_receive(struct hostapd_data *hapd, const u8 *sa, const u8 *buf,
 863                         size_t len)
 864 {
 865         struct sta_info *sta;
 866         struct ieee802_1x_hdr *hdr;
 867         struct ieee802_1x_eapol_key *key;
 868         u16 datalen;
 869         struct rsn_pmksa_cache_entry *pmksa;
 870         int key_mgmt;
 871
 872         if (!hapd->conf->ieee802_1x && !hapd->conf->wpa && !hapd->conf->osen &&
 873             !hapd->conf->wps_state)
 874                 return;
 875
 876         wpa_printf(MSG_DEBUG, "IEEE 802.1X: %lu bytes from " MACSTR,
 877                    (unsigned long) len, MAC2STR(sa));
 878         sta = ap_get_sta(hapd, sa);
 879         if (!sta || (!(sta->flags & (WLAN_STA_ASSOC | WLAN_STA_PREAUTH)) &&
 880                      !(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_WIRED))) {
 881                 wpa_printf(MSG_DEBUG, "IEEE 802.1X data frame from not "
 882                            "associated/Pre-authenticating STA");
 883                 return;
 884         }
 885
 886         if (len < sizeof(*hdr)) {
 887                 wpa_printf(MSG_INFO, "   too short IEEE 802.1X packet");
 888                 return;
 889         }
 890
 891         hdr = (struct ieee802_1x_hdr *) buf;
 892         datalen = be_to_host16(hdr->length);
 893         wpa_printf(MSG_DEBUG, "   IEEE 802.1X: version=%d type=%d length=%d",
 894                    hdr->version, hdr->type, datalen);
 895
 896         if (len - sizeof(*hdr) < datalen) {
 897                 wpa_printf(MSG_INFO, "   frame too short for this IEEE 802.1X packet");
 898                 if (sta->eapol_sm)
 899                         sta->eapol_sm->dot1xAuthEapLengthErrorFramesRx++;
 900                 return;
 901         }
 902         if (len - sizeof(*hdr) > datalen) {
 903                 wpa_printf(MSG_DEBUG, "   ignoring %lu extra octets after "
 904                            "IEEE 802.1X packet",
 905                            (unsigned long) len - sizeof(*hdr) - datalen);
 906         }
 907
 908         if (sta->eapol_sm) {
 909                 sta->eapol_sm->dot1xAuthLastEapolFrameVersion = hdr->version;
 910                 sta->eapol_sm->dot1xAuthEapolFramesRx++;
 911         }
 912
 913         key = (struct ieee802_1x_eapol_key *) (hdr + 1);
 914         if (datalen >= sizeof(struct ieee802_1x_eapol_key) &&
 915             hdr->type == IEEE802_1X_TYPE_EAPOL_KEY &&
 916             (key->type == EAPOL_KEY_TYPE_WPA ||
 917              key->type == EAPOL_KEY_TYPE_RSN)) {
 918                 wpa_receive(hapd->wpa_auth, sta->wpa_sm, (u8 *) hdr,
 919                             sizeof(*hdr) + datalen);
 920                 return;
 921         }
 922
 923         if (!hapd->conf->ieee802_1x && !hapd->conf->osen &&
 924             !(sta->flags & (WLAN_STA_WPS | WLAN_STA_MAYBE_WPS))) {
 925                 wpa_printf(MSG_DEBUG, "IEEE 802.1X: Ignore EAPOL message - "
 926                            "802.1X not enabled and WPS not used");
 927                 return;
 928         }
 929
 930         key_mgmt = wpa_auth_sta_key_mgmt(sta->wpa_sm);
 931         if (key_mgmt != -1 && wpa_key_mgmt_wpa_psk(key_mgmt)) {
 932                 wpa_printf(MSG_DEBUG, "IEEE 802.1X: Ignore EAPOL message - "
 933                            "STA is using PSK");
 934                 return;
 935         }
 936
 937         if (!sta->eapol_sm) {
 938                 sta->eapol_sm = ieee802_1x_alloc_eapol_sm(hapd, sta);
 939                 if (!sta->eapol_sm)
 940                         return;
 941
 942 #ifdef CONFIG_WPS
 943                 if (!hapd->conf->ieee802_1x && hapd->conf->wps_state) {
 944                         u32 wflags = sta->flags & (WLAN_STA_WPS |
 945                                                    WLAN_STA_WPS2 |
 946                                                    WLAN_STA_MAYBE_WPS);
 947                         if (wflags == WLAN_STA_MAYBE_WPS ||
 948                             wflags == (WLAN_STA_WPS | WLAN_STA_MAYBE_WPS)) {
 949                                 /*
 950                                  * Delay EAPOL frame transmission until a
 951                                  * possible WPS STA initiates the handshake
 952                                  * with EAPOL-Start. Only allow the wait to be
 953                                  * skipped if the STA is known to support WPS
 954                                  * 2.0.
 955                                  */
 956                                 wpa_printf(MSG_DEBUG, "WPS: Do not start "
 957                                            "EAPOL until EAPOL-Start is "
 958                                            "received");
 959                                 sta->eapol_sm->flags |= EAPOL_SM_WAIT_START;
 960                         }
 961                 }
 962 #endif /* CONFIG_WPS */
 963
 964                 sta->eapol_sm->eap_if->portEnabled = TRUE;
 965         }
 966
 967         /* since we support version 1, we can ignore version field and proceed
 968          * as specified in version 1 standard [IEEE Std 802.1X-2001, 7.5.5] */
 969         /* TODO: actually, we are not version 1 anymore.. However, Version 2
 970          * does not change frame contents, so should be ok to process frames
 971          * more or less identically. Some changes might be needed for
 972          * verification of fields. */
 973
 974         switch (hdr->type) {
 975         case IEEE802_1X_TYPE_EAP_PACKET:
 976                 handle_eap(hapd, sta, (u8 *) (hdr + 1), datalen);
 977                 break;
 978
 979         case IEEE802_1X_TYPE_EAPOL_START:
 980                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
 981                                HOSTAPD_LEVEL_DEBUG, "received EAPOL-Start "
 982                                "from STA");
 983                 sta->eapol_sm->flags &= ~EAPOL_SM_WAIT_START;
 984                 pmksa = wpa_auth_sta_get_pmksa(sta->wpa_sm);
 985                 if (pmksa) {
 986                         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA,
 987                                        HOSTAPD_LEVEL_DEBUG, "cached PMKSA "
 988                                        "available - ignore it since "
 989                                        "STA sent EAPOL-Start");
 990                         wpa_auth_sta_clear_pmksa(sta->wpa_sm, pmksa);
 991                 }
 992                 sta->eapol_sm->eapolStart = TRUE;
 993                 sta->eapol_sm->dot1xAuthEapolStartFramesRx++;
 994                 eap_server_clear_identity(sta->eapol_sm->eap);
 995                 wpa_auth_sm_event(sta->wpa_sm, WPA_REAUTH_EAPOL);
 996                 break;
 997
 998         case IEEE802_1X_TYPE_EAPOL_LOGOFF:
 999                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1000                                HOSTAPD_LEVEL_DEBUG, "received EAPOL-Logoff "
1001                                "from STA");
1002                 sta->acct_terminate_cause =
1003                         RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
1004                 accounting_sta_stop(hapd, sta);
1005                 sta->eapol_sm->eapolLogoff = TRUE;
1006                 sta->eapol_sm->dot1xAuthEapolLogoffFramesRx++;
1007                 eap_server_clear_identity(sta->eapol_sm->eap);
1008                 break;
1009
1010         case IEEE802_1X_TYPE_EAPOL_KEY:
1011                 wpa_printf(MSG_DEBUG, "   EAPOL-Key");
1012                 if (!ap_sta_is_authorized(sta)) {
1013                         wpa_printf(MSG_DEBUG, "   Dropped key data from "
1014                                    "unauthorized Supplicant");
1015                         break;
1016                 }
1017                 break;
1018
1019         case IEEE802_1X_TYPE_EAPOL_ENCAPSULATED_ASF_ALERT:
1020                 wpa_printf(MSG_DEBUG, "   EAPOL-Encapsulated-ASF-Alert");
1021                 /* TODO: implement support for this; show data */
1022                 break;
1023
1024         default:
1025                 wpa_printf(MSG_DEBUG, "   unknown IEEE 802.1X packet type");
1026                 sta->eapol_sm->dot1xAuthInvalidEapolFramesRx++;
1027                 break;
1028         }
1029
1030         eapol_auth_step(sta->eapol_sm);
1031 }
1032
1033
1034 /**
1035  * ieee802_1x_new_station - Start IEEE 802.1X authentication
1036  * @hapd: hostapd BSS data
1037  * @sta: The station
1038  *
1039  * This function is called to start IEEE 802.1X authentication when a new
1040  * station completes IEEE 802.11 association.
1041  */
1042 void ieee802_1x_new_station(struct hostapd_data *hapd, struct sta_info *sta)
1043 {
1044         struct rsn_pmksa_cache_entry *pmksa;
1045         int reassoc = 1;
1046         int force_1x = 0;
1047         int key_mgmt;
1048
1049 #ifdef CONFIG_WPS
1050         if (hapd->conf->wps_state &&
1051             ((hapd->conf->wpa && (sta->flags & WLAN_STA_MAYBE_WPS)) ||
1052              (sta->flags & WLAN_STA_WPS))) {
1053                 /*
1054                  * Need to enable IEEE 802.1X/EAPOL state machines for possible
1055                  * WPS handshake even if IEEE 802.1X/EAPOL is not used for
1056                  * authentication in this BSS.
1057                  */
1058                 force_1x = 1;
1059         }
1060 #endif /* CONFIG_WPS */
1061
1062         if (!force_1x && !hapd->conf->ieee802_1x && !hapd->conf->osen) {
1063                 wpa_printf(MSG_DEBUG, "IEEE 802.1X: Ignore STA - "
1064                            "802.1X not enabled or forced for WPS");
1065                 /*
1066                  * Clear any possible EAPOL authenticator state to support
1067                  * reassociation change from WPS to PSK.
1068                  */
1069                 ieee802_1x_free_station(hapd, sta);
1070                 return;
1071         }
1072
1073         key_mgmt = wpa_auth_sta_key_mgmt(sta->wpa_sm);
1074         if (key_mgmt != -1 && wpa_key_mgmt_wpa_psk(key_mgmt)) {
1075                 wpa_printf(MSG_DEBUG, "IEEE 802.1X: Ignore STA - using PSK");
1076                 /*
1077                  * Clear any possible EAPOL authenticator state to support
1078                  * reassociation change from WPA-EAP to PSK.
1079                  */
1080                 ieee802_1x_free_station(hapd, sta);
1081                 return;
1082         }
1083
1084         if (sta->eapol_sm == NULL) {
1085                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1086                                HOSTAPD_LEVEL_DEBUG, "start authentication");
1087                 sta->eapol_sm = ieee802_1x_alloc_eapol_sm(hapd, sta);
1088                 if (sta->eapol_sm == NULL) {
1089                         hostapd_logger(hapd, sta->addr,
1090                                        HOSTAPD_MODULE_IEEE8021X,
1091                                        HOSTAPD_LEVEL_INFO,
1092                                        "failed to allocate state machine");
1093                         return;
1094                 }
1095                 reassoc = 0;
1096         }
1097
1098 #ifdef CONFIG_WPS
1099         sta->eapol_sm->flags &= ~EAPOL_SM_WAIT_START;
1100         if (!hapd->conf->ieee802_1x && hapd->conf->wps_state &&
1101             !(sta->flags & WLAN_STA_WPS2)) {
1102                 /*
1103                  * Delay EAPOL frame transmission until a possible WPS STA
1104                  * initiates the handshake with EAPOL-Start. Only allow the
1105                  * wait to be skipped if the STA is known to support WPS 2.0.
1106                  */
1107                 wpa_printf(MSG_DEBUG, "WPS: Do not start EAPOL until "
1108                            "EAPOL-Start is received");
1109                 sta->eapol_sm->flags |= EAPOL_SM_WAIT_START;
1110         }
1111 #endif /* CONFIG_WPS */
1112
1113         sta->eapol_sm->eap_if->portEnabled = TRUE;
1114
1115 #ifdef CONFIG_IEEE80211R
1116         if (sta->auth_alg == WLAN_AUTH_FT) {
1117                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1118                                HOSTAPD_LEVEL_DEBUG,
1119                                "PMK from FT - skip IEEE 802.1X/EAP");
1120                 /* Setup EAPOL state machines to already authenticated state
1121                  * because of existing FT information from R0KH. */
1122                 sta->eapol_sm->keyRun = TRUE;
1123                 sta->eapol_sm->eap_if->eapKeyAvailable = TRUE;
1124                 sta->eapol_sm->auth_pae_state = AUTH_PAE_AUTHENTICATING;
1125                 sta->eapol_sm->be_auth_state = BE_AUTH_SUCCESS;
1126                 sta->eapol_sm->authSuccess = TRUE;
1127                 sta->eapol_sm->authFail = FALSE;
1128                 sta->eapol_sm->portValid = TRUE;
1129                 if (sta->eapol_sm->eap)
1130                         eap_sm_notify_cached(sta->eapol_sm->eap);
1131                 /* TODO: get vlan_id from R0KH using RRB message */
1132                 return;
1133         }
1134 #endif /* CONFIG_IEEE80211R */
1135
1136         pmksa = wpa_auth_sta_get_pmksa(sta->wpa_sm);
1137         if (pmksa) {
1138                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1139                                HOSTAPD_LEVEL_DEBUG,
1140                                "PMK from PMKSA cache - skip IEEE 802.1X/EAP");
1141                 /* Setup EAPOL state machines to already authenticated state
1142                  * because of existing PMKSA information in the cache. */
1143                 sta->eapol_sm->keyRun = TRUE;
1144                 sta->eapol_sm->eap_if->eapKeyAvailable = TRUE;
1145                 sta->eapol_sm->auth_pae_state = AUTH_PAE_AUTHENTICATING;
1146                 sta->eapol_sm->be_auth_state = BE_AUTH_SUCCESS;
1147                 sta->eapol_sm->authSuccess = TRUE;
1148                 sta->eapol_sm->authFail = FALSE;
1149                 if (sta->eapol_sm->eap)
1150                         eap_sm_notify_cached(sta->eapol_sm->eap);
1151                 pmksa_cache_to_eapol_data(pmksa, sta->eapol_sm);
1152                 ap_sta_bind_vlan(hapd, sta);
1153         } else {
1154                 if (reassoc) {
1155                         /*
1156                          * Force EAPOL state machines to start
1157                          * re-authentication without having to wait for the
1158                          * Supplicant to send EAPOL-Start.
1159                          */
1160                         sta->eapol_sm->reAuthenticate = TRUE;
1161                 }
1162                 eapol_auth_step(sta->eapol_sm);
1163         }
1164 }
1165
1166
1167 void ieee802_1x_free_station(struct hostapd_data *hapd, struct sta_info *sta)
1168 {
1169         struct eapol_state_machine *sm = sta->eapol_sm;
1170
1171 #ifdef CONFIG_HS20
1172         eloop_cancel_timeout(ieee802_1x_wnm_notif_send, hapd, sta);
1173 #endif /* CONFIG_HS20 */
1174
1175         if (sm == NULL)
1176                 return;
1177
1178         sta->eapol_sm = NULL;
1179
1180 #ifndef CONFIG_NO_RADIUS
1181         radius_msg_free(sm->last_recv_radius);
1182         radius_free_class(&sm->radius_class);
1183 #endif /* CONFIG_NO_RADIUS */
1184
1185         eapol_auth_free(sm);
1186 }
1187
1188
1189 #ifndef CONFIG_NO_RADIUS
1190 static void ieee802_1x_decapsulate_radius(struct hostapd_data *hapd,
1191                                           struct sta_info *sta)
1192 {
1193         struct wpabuf *eap;
1194         const struct eap_hdr *hdr;
1195         int eap_type = -1;
1196         char buf[64];
1197         struct radius_msg *msg;
1198         struct eapol_state_machine *sm = sta->eapol_sm;
1199
1200         if (sm == NULL || sm->last_recv_radius == NULL) {
1201                 if (sm)
1202                         sm->eap_if->aaaEapNoReq = TRUE;
1203                 return;
1204         }
1205
1206         msg = sm->last_recv_radius;
1207
1208         eap = radius_msg_get_eap(msg);
1209         if (eap == NULL) {
1210                 /* RFC 3579, Chap. 2.6.3:
1211                  * RADIUS server SHOULD NOT send Access-Reject/no EAP-Message
1212                  * attribute */
1213                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1214                                HOSTAPD_LEVEL_WARNING, "could not extract "
1215                                "EAP-Message from RADIUS message");
1216                 sm->eap_if->aaaEapNoReq = TRUE;
1217                 return;
1218         }
1219
1220         if (wpabuf_len(eap) < sizeof(*hdr)) {
1221                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1222                                HOSTAPD_LEVEL_WARNING, "too short EAP packet "
1223                                "received from authentication server");
1224                 wpabuf_free(eap);
1225                 sm->eap_if->aaaEapNoReq = TRUE;
1226                 return;
1227         }
1228
1229         if (wpabuf_len(eap) > sizeof(*hdr))
1230                 eap_type = (wpabuf_head_u8(eap))[sizeof(*hdr)];
1231
1232         hdr = wpabuf_head(eap);
1233         switch (hdr->code) {
1234         case EAP_CODE_REQUEST:
1235                 if (eap_type >= 0)
1236                         sm->eap_type_authsrv = eap_type;
1237                 os_snprintf(buf, sizeof(buf), "EAP-Request-%s (%d)",
1238                             eap_server_get_name(0, eap_type), eap_type);
1239                 break;
1240         case EAP_CODE_RESPONSE:
1241                 os_snprintf(buf, sizeof(buf), "EAP Response-%s (%d)",
1242                             eap_server_get_name(0, eap_type), eap_type);
1243                 break;
1244         case EAP_CODE_SUCCESS:
1245                 os_strlcpy(buf, "EAP Success", sizeof(buf));
1246                 break;
1247         case EAP_CODE_FAILURE:
1248                 os_strlcpy(buf, "EAP Failure", sizeof(buf));
1249                 break;
1250         default:
1251                 os_strlcpy(buf, "unknown EAP code", sizeof(buf));
1252                 break;
1253         }
1254         buf[sizeof(buf) - 1] = '\0';
1255         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1256                        HOSTAPD_LEVEL_DEBUG, "decapsulated EAP packet (code=%d "
1257                        "id=%d len=%d) from RADIUS server: %s",
1258                        hdr->code, hdr->identifier, be_to_host16(hdr->length),
1259                        buf);
1260         sm->eap_if->aaaEapReq = TRUE;
1261
1262         wpabuf_free(sm->eap_if->aaaEapReqData);
1263         sm->eap_if->aaaEapReqData = eap;
1264 }
1265
1266
1267 static void ieee802_1x_get_keys(struct hostapd_data *hapd,
1268                                 struct sta_info *sta, struct radius_msg *msg,
1269                                 struct radius_msg *req,
1270                                 const u8 *shared_secret,
1271                                 size_t shared_secret_len)
1272 {
1273         struct radius_ms_mppe_keys *keys;
1274         struct eapol_state_machine *sm = sta->eapol_sm;
1275         if (sm == NULL)
1276                 return;
1277
1278         keys = radius_msg_get_ms_keys(msg, req, shared_secret,
1279                                       shared_secret_len);
1280
1281         if (keys && keys->send && keys->recv) {
1282                 size_t len = keys->send_len + keys->recv_len;
1283                 wpa_hexdump_key(MSG_DEBUG, "MS-MPPE-Send-Key",
1284                                 keys->send, keys->send_len);
1285                 wpa_hexdump_key(MSG_DEBUG, "MS-MPPE-Recv-Key",
1286                                 keys->recv, keys->recv_len);
1287
1288                 os_free(sm->eap_if->aaaEapKeyData);
1289                 sm->eap_if->aaaEapKeyData = os_malloc(len);
1290                 if (sm->eap_if->aaaEapKeyData) {
1291                         os_memcpy(sm->eap_if->aaaEapKeyData, keys->recv,
1292                                   keys->recv_len);
1293                         os_memcpy(sm->eap_if->aaaEapKeyData + keys->recv_len,
1294                                   keys->send, keys->send_len);
1295                         sm->eap_if->aaaEapKeyDataLen = len;
1296                         sm->eap_if->aaaEapKeyAvailable = TRUE;
1297                 }
1298         } else {
1299                 wpa_printf(MSG_DEBUG,
1300                            "MS-MPPE: 1x_get_keys, could not get keys: %p  send: %p  recv: %p",
1301                            keys, keys ? keys->send : NULL,
1302                            keys ? keys->recv : NULL);
1303         }
1304
1305         if (keys) {
1306                 os_free(keys->send);
1307                 os_free(keys->recv);
1308                 os_free(keys);
1309         }
1310 }
1311
1312
1313 static void ieee802_1x_store_radius_class(struct hostapd_data *hapd,
1314                                           struct sta_info *sta,
1315                                           struct radius_msg *msg)
1316 {
1317         u8 *attr_class;
1318         size_t class_len;
1319         struct eapol_state_machine *sm = sta->eapol_sm;
1320         int count, i;
1321         struct radius_attr_data *nclass;
1322         size_t nclass_count;
1323
1324         if (!hapd->conf->radius->acct_server || hapd->radius == NULL ||
1325             sm == NULL)
1326                 return;
1327
1328         radius_free_class(&sm->radius_class);
1329         count = radius_msg_count_attr(msg, RADIUS_ATTR_CLASS, 1);
1330         if (count <= 0)
1331                 return;
1332
1333         nclass = os_calloc(count, sizeof(struct radius_attr_data));
1334         if (nclass == NULL)
1335                 return;
1336
1337         nclass_count = 0;
1338
1339         attr_class = NULL;
1340         for (i = 0; i < count; i++) {
1341                 do {
1342                         if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_CLASS,
1343                                                     &attr_class, &class_len,
1344                                                     attr_class) < 0) {
1345                                 i = count;
1346                                 break;
1347                         }
1348                 } while (class_len < 1);
1349
1350                 nclass[nclass_count].data = os_malloc(class_len);
1351                 if (nclass[nclass_count].data == NULL)
1352                         break;
1353
1354                 os_memcpy(nclass[nclass_count].data, attr_class, class_len);
1355                 nclass[nclass_count].len = class_len;
1356                 nclass_count++;
1357         }
1358
1359         sm->radius_class.attr = nclass;
1360         sm->radius_class.count = nclass_count;
1361         wpa_printf(MSG_DEBUG, "IEEE 802.1X: Stored %lu RADIUS Class "
1362                    "attributes for " MACSTR,
1363                    (unsigned long) sm->radius_class.count,
1364                    MAC2STR(sta->addr));
1365 }
1366
1367
1368 /* Update sta->identity based on User-Name attribute in Access-Accept */
1369 static void ieee802_1x_update_sta_identity(struct hostapd_data *hapd,
1370                                            struct sta_info *sta,
1371                                            struct radius_msg *msg)
1372 {
1373         u8 *buf, *identity;
1374         size_t len;
1375         struct eapol_state_machine *sm = sta->eapol_sm;
1376
1377         if (sm == NULL)
1378                 return;
1379
1380         if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_USER_NAME, &buf, &len,
1381                                     NULL) < 0)
1382                 return;
1383
1384         identity = (u8 *) dup_binstr(buf, len);
1385         if (identity == NULL)
1386                 return;
1387
1388         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1389                        HOSTAPD_LEVEL_DEBUG, "old identity '%s' updated with "
1390                        "User-Name from Access-Accept '%s'",
1391                        sm->identity ? (char *) sm->identity : "N/A",
1392                        (char *) identity);
1393
1394         os_free(sm->identity);
1395         sm->identity = identity;
1396         sm->identity_len = len;
1397 }
1398
1399
1400 /* Update CUI based on Chargeable-User-Identity attribute in Access-Accept */
1401 static void ieee802_1x_update_sta_cui(struct hostapd_data *hapd,
1402                                       struct sta_info *sta,
1403                                       struct radius_msg *msg)
1404 {
1405         struct eapol_state_machine *sm = sta->eapol_sm;
1406         struct wpabuf *cui;
1407         u8 *buf;
1408         size_t len;
1409
1410         if (sm == NULL)
1411                 return;
1412
1413         if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_CHARGEABLE_USER_IDENTITY,
1414                                     &buf, &len, NULL) < 0)
1415                 return;
1416
1417         cui = wpabuf_alloc_copy(buf, len);
1418         if (cui == NULL)
1419                 return;
1420
1421         wpabuf_free(sm->radius_cui);
1422         sm->radius_cui = cui;
1423 }
1424
1425
1426 #ifdef CONFIG_HS20
1427
1428 static void ieee802_1x_hs20_sub_rem(struct sta_info *sta, u8 *pos, size_t len)
1429 {
1430         sta->remediation = 1;
1431         os_free(sta->remediation_url);
1432         if (len > 2) {
1433                 sta->remediation_url = os_malloc(len);
1434                 if (!sta->remediation_url)
1435                         return;
1436                 sta->remediation_method = pos[0];
1437                 os_memcpy(sta->remediation_url, pos + 1, len - 1);
1438                 sta->remediation_url[len - 1] = '\0';
1439                 wpa_printf(MSG_DEBUG, "HS 2.0: Subscription remediation needed "
1440                            "for " MACSTR " - server method %u URL %s",
1441                            MAC2STR(sta->addr), sta->remediation_method,
1442                            sta->remediation_url);
1443         } else {
1444                 sta->remediation_url = NULL;
1445                 wpa_printf(MSG_DEBUG, "HS 2.0: Subscription remediation needed "
1446                            "for " MACSTR, MAC2STR(sta->addr));
1447         }
1448         /* TODO: assign the STA into remediation VLAN or add filtering */
1449 }
1450
1451
1452 static void ieee802_1x_hs20_deauth_req(struct hostapd_data *hapd,
1453                                        struct sta_info *sta, u8 *pos,
1454                                        size_t len)
1455 {
1456         if (len < 3)
1457                 return; /* Malformed information */
1458         sta->hs20_deauth_requested = 1;
1459         wpa_printf(MSG_DEBUG, "HS 2.0: Deauthentication request - Code %u  "
1460                    "Re-auth Delay %u",
1461                    *pos, WPA_GET_LE16(pos + 1));
1462         wpabuf_free(sta->hs20_deauth_req);
1463         sta->hs20_deauth_req = wpabuf_alloc(len + 1);
1464         if (sta->hs20_deauth_req) {
1465                 wpabuf_put_data(sta->hs20_deauth_req, pos, 3);
1466                 wpabuf_put_u8(sta->hs20_deauth_req, len - 3);
1467                 wpabuf_put_data(sta->hs20_deauth_req, pos + 3, len - 3);
1468         }
1469         ap_sta_session_timeout(hapd, sta, hapd->conf->hs20_deauth_req_timeout);
1470 }
1471
1472
1473 static void ieee802_1x_hs20_session_info(struct hostapd_data *hapd,
1474                                          struct sta_info *sta, u8 *pos,
1475                                          size_t len, int session_timeout)
1476 {
1477         unsigned int swt;
1478         int warning_time, beacon_int;
1479
1480         if (len < 1)
1481                 return; /* Malformed information */
1482         os_free(sta->hs20_session_info_url);
1483         sta->hs20_session_info_url = os_malloc(len);
1484         if (sta->hs20_session_info_url == NULL)
1485                 return;
1486         swt = pos[0];
1487         os_memcpy(sta->hs20_session_info_url, pos + 1, len - 1);
1488         sta->hs20_session_info_url[len - 1] = '\0';
1489         wpa_printf(MSG_DEBUG, "HS 2.0: Session Information URL='%s' SWT=%u "
1490                    "(session_timeout=%d)",
1491                    sta->hs20_session_info_url, swt, session_timeout);
1492         if (session_timeout < 0) {
1493                 wpa_printf(MSG_DEBUG, "HS 2.0: No Session-Timeout set - ignore session info URL");
1494                 return;
1495         }
1496         if (swt == 255)
1497                 swt = 1; /* Use one minute as the AP selected value */
1498
1499         if ((unsigned int) session_timeout < swt * 60)
1500                 warning_time = 0;
1501         else
1502                 warning_time = session_timeout - swt * 60;
1503
1504         beacon_int = hapd->iconf->beacon_int;
1505         if (beacon_int < 1)
1506                 beacon_int = 100; /* best guess */
1507         sta->hs20_disassoc_timer = swt * 60 * 1000 / beacon_int * 125 / 128;
1508         if (sta->hs20_disassoc_timer > 65535)
1509                 sta->hs20_disassoc_timer = 65535;
1510
1511         ap_sta_session_warning_timeout(hapd, sta, warning_time);
1512 }
1513
1514 #endif /* CONFIG_HS20 */
1515
1516
1517 static void ieee802_1x_check_hs20(struct hostapd_data *hapd,
1518                                   struct sta_info *sta,
1519                                   struct radius_msg *msg,
1520                                   int session_timeout)
1521 {
1522 #ifdef CONFIG_HS20
1523         u8 *buf, *pos, *end, type, sublen;
1524         size_t len;
1525
1526         buf = NULL;
1527         sta->remediation = 0;
1528         sta->hs20_deauth_requested = 0;
1529
1530         for (;;) {
1531                 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_VENDOR_SPECIFIC,
1532                                             &buf, &len, buf) < 0)
1533                         break;
1534                 if (len < 6)
1535                         continue;
1536                 pos = buf;
1537                 end = buf + len;
1538                 if (WPA_GET_BE32(pos) != RADIUS_VENDOR_ID_WFA)
1539                         continue;
1540                 pos += 4;
1541
1542                 type = *pos++;
1543                 sublen = *pos++;
1544                 if (sublen < 2)
1545                         continue; /* invalid length */
1546                 sublen -= 2; /* skip header */
1547                 if (pos + sublen > end)
1548                         continue; /* invalid WFA VSA */
1549
1550                 switch (type) {
1551                 case RADIUS_VENDOR_ATTR_WFA_HS20_SUBSCR_REMEDIATION:
1552                         ieee802_1x_hs20_sub_rem(sta, pos, sublen);
1553                         break;
1554                 case RADIUS_VENDOR_ATTR_WFA_HS20_DEAUTH_REQ:
1555                         ieee802_1x_hs20_deauth_req(hapd, sta, pos, sublen);
1556                         break;
1557                 case RADIUS_VENDOR_ATTR_WFA_HS20_SESSION_INFO_URL:
1558                         ieee802_1x_hs20_session_info(hapd, sta, pos, sublen,
1559                                                      session_timeout);
1560                         break;
1561                 }
1562         }
1563 #endif /* CONFIG_HS20 */
1564 }
1565
1566
1567 struct sta_id_search {
1568         u8 identifier;
1569         struct eapol_state_machine *sm;
1570 };
1571
1572
1573 static int ieee802_1x_select_radius_identifier(struct hostapd_data *hapd,
1574                                                struct sta_info *sta,
1575                                                void *ctx)
1576 {
1577         struct sta_id_search *id_search = ctx;
1578         struct eapol_state_machine *sm = sta->eapol_sm;
1579
1580         if (sm && sm->radius_identifier >= 0 &&
1581             sm->radius_identifier == id_search->identifier) {
1582                 id_search->sm = sm;
1583                 return 1;
1584         }
1585         return 0;
1586 }
1587
1588
1589 static struct eapol_state_machine *
1590 ieee802_1x_search_radius_identifier(struct hostapd_data *hapd, u8 identifier)
1591 {
1592         struct sta_id_search id_search;
1593         id_search.identifier = identifier;
1594         id_search.sm = NULL;
1595         ap_for_each_sta(hapd, ieee802_1x_select_radius_identifier, &id_search);
1596         return id_search.sm;
1597 }
1598
1599
1600 /**
1601  * ieee802_1x_receive_auth - Process RADIUS frames from Authentication Server
1602  * @msg: RADIUS response message
1603  * @req: RADIUS request message
1604  * @shared_secret: RADIUS shared secret
1605  * @shared_secret_len: Length of shared_secret in octets
1606  * @data: Context data (struct hostapd_data *)
1607  * Returns: Processing status
1608  */
1609 static RadiusRxResult
1610 ieee802_1x_receive_auth(struct radius_msg *msg, struct radius_msg *req,
1611                         const u8 *shared_secret, size_t shared_secret_len,
1612                         void *data)
1613 {
1614         struct hostapd_data *hapd = data;
1615         struct sta_info *sta;
1616         u32 session_timeout = 0, termination_action, acct_interim_interval;
1617         int session_timeout_set, vlan_id = 0;
1618         struct eapol_state_machine *sm;
1619         int override_eapReq = 0;
1620         struct radius_hdr *hdr = radius_msg_get_hdr(msg);
1621
1622         sm = ieee802_1x_search_radius_identifier(hapd, hdr->identifier);
1623         if (sm == NULL) {
1624                 wpa_printf(MSG_DEBUG, "IEEE 802.1X: Could not find matching "
1625                            "station for this RADIUS message");
1626                 return RADIUS_RX_UNKNOWN;
1627         }
1628         sta = sm->sta;
1629
1630         /* RFC 2869, Ch. 5.13: valid Message-Authenticator attribute MUST be
1631          * present when packet contains an EAP-Message attribute */
1632         if (hdr->code == RADIUS_CODE_ACCESS_REJECT &&
1633             radius_msg_get_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR, NULL,
1634                                 0) < 0 &&
1635             radius_msg_get_attr(msg, RADIUS_ATTR_EAP_MESSAGE, NULL, 0) < 0) {
1636                 wpa_printf(MSG_DEBUG, "Allowing RADIUS Access-Reject without "
1637                            "Message-Authenticator since it does not include "
1638                            "EAP-Message");
1639         } else if (radius_msg_verify(msg, shared_secret, shared_secret_len,
1640                                      req, 1)) {
1641                 wpa_printf(MSG_INFO, "Incoming RADIUS packet did not have correct Message-Authenticator - dropped");
1642                 return RADIUS_RX_INVALID_AUTHENTICATOR;
1643         }
1644
1645         if (hdr->code != RADIUS_CODE_ACCESS_ACCEPT &&
1646             hdr->code != RADIUS_CODE_ACCESS_REJECT &&
1647             hdr->code != RADIUS_CODE_ACCESS_CHALLENGE) {
1648                 wpa_printf(MSG_INFO, "Unknown RADIUS message code");
1649                 return RADIUS_RX_UNKNOWN;
1650         }
1651
1652         sm->radius_identifier = -1;
1653         wpa_printf(MSG_DEBUG, "RADIUS packet matching with station " MACSTR,
1654                    MAC2STR(sta->addr));
1655
1656         radius_msg_free(sm->last_recv_radius);
1657         sm->last_recv_radius = msg;
1658
1659         session_timeout_set =
1660                 !radius_msg_get_attr_int32(msg, RADIUS_ATTR_SESSION_TIMEOUT,
1661                                            &session_timeout);
1662         if (radius_msg_get_attr_int32(msg, RADIUS_ATTR_TERMINATION_ACTION,
1663                                       &termination_action))
1664                 termination_action = RADIUS_TERMINATION_ACTION_DEFAULT;
1665
1666         if (hapd->conf->acct_interim_interval == 0 &&
1667             hdr->code == RADIUS_CODE_ACCESS_ACCEPT &&
1668             radius_msg_get_attr_int32(msg, RADIUS_ATTR_ACCT_INTERIM_INTERVAL,
1669                                       &acct_interim_interval) == 0) {
1670                 if (acct_interim_interval < 60) {
1671                         hostapd_logger(hapd, sta->addr,
1672                                        HOSTAPD_MODULE_IEEE8021X,
1673                                        HOSTAPD_LEVEL_INFO,
1674                                        "ignored too small "
1675                                        "Acct-Interim-Interval %d",
1676                                        acct_interim_interval);
1677                 } else
1678                         sta->acct_interim_interval = acct_interim_interval;
1679         }
1680
1681
1682         switch (hdr->code) {
1683         case RADIUS_CODE_ACCESS_ACCEPT:
1684                 if (hapd->conf->ssid.dynamic_vlan == DYNAMIC_VLAN_DISABLED)
1685                         vlan_id = 0;
1686 #ifndef CONFIG_NO_VLAN
1687                 else
1688                         vlan_id = radius_msg_get_vlanid(msg);
1689                 if (vlan_id > 0 &&
1690                     hostapd_vlan_id_valid(hapd->conf->vlan, vlan_id)) {
1691                         hostapd_logger(hapd, sta->addr,
1692                                        HOSTAPD_MODULE_RADIUS,
1693                                        HOSTAPD_LEVEL_INFO,
1694                                        "VLAN ID %d", vlan_id);
1695                 } else if (vlan_id > 0) {
1696                         sta->eapol_sm->authFail = TRUE;
1697                         hostapd_logger(hapd, sta->addr,
1698                                        HOSTAPD_MODULE_RADIUS,
1699                                        HOSTAPD_LEVEL_INFO,
1700                                        "Invalid VLAN ID %d received from RADIUS server",
1701                                        vlan_id);
1702                         break;
1703                 } else if (hapd->conf->ssid.dynamic_vlan ==
1704                            DYNAMIC_VLAN_REQUIRED) {
1705                         sta->eapol_sm->authFail = TRUE;
1706                         hostapd_logger(hapd, sta->addr,
1707                                        HOSTAPD_MODULE_IEEE8021X,
1708                                        HOSTAPD_LEVEL_INFO, "authentication "
1709                                        "server did not include required VLAN "
1710                                        "ID in Access-Accept");
1711                         break;
1712                 }
1713 #endif /* CONFIG_NO_VLAN */
1714
1715                 sta->vlan_id = vlan_id;
1716                 if ((sta->flags & WLAN_STA_ASSOC) &&
1717                     ap_sta_bind_vlan(hapd, sta) < 0)
1718                         break;
1719
1720                 sta->session_timeout_set = !!session_timeout_set;
1721                 sta->session_timeout = session_timeout;
1722
1723                 /* RFC 3580, Ch. 3.17 */
1724                 if (session_timeout_set && termination_action ==
1725                     RADIUS_TERMINATION_ACTION_RADIUS_REQUEST) {
1726                         sm->reAuthPeriod = session_timeout;
1727                 } else if (session_timeout_set)
1728                         ap_sta_session_timeout(hapd, sta, session_timeout);
1729
1730                 sm->eap_if->aaaSuccess = TRUE;
1731                 override_eapReq = 1;
1732                 ieee802_1x_get_keys(hapd, sta, msg, req, shared_secret,
1733                                     shared_secret_len);
1734                 ieee802_1x_store_radius_class(hapd, sta, msg);
1735                 ieee802_1x_update_sta_identity(hapd, sta, msg);
1736                 ieee802_1x_update_sta_cui(hapd, sta, msg);
1737                 ieee802_1x_check_hs20(hapd, sta, msg,
1738                                       session_timeout_set ?
1739                                       (int) session_timeout : -1);
1740                 break;
1741         case RADIUS_CODE_ACCESS_REJECT:
1742                 sm->eap_if->aaaFail = TRUE;
1743                 override_eapReq = 1;
1744                 break;
1745         case RADIUS_CODE_ACCESS_CHALLENGE:
1746                 sm->eap_if->aaaEapReq = TRUE;
1747                 if (session_timeout_set) {
1748                         /* RFC 2869, Ch. 2.3.2; RFC 3580, Ch. 3.17 */
1749                         sm->eap_if->aaaMethodTimeout = session_timeout;
1750                         hostapd_logger(hapd, sm->addr,
1751                                        HOSTAPD_MODULE_IEEE8021X,
1752                                        HOSTAPD_LEVEL_DEBUG,
1753                                        "using EAP timeout of %d seconds (from "
1754                                        "RADIUS)",
1755                                        sm->eap_if->aaaMethodTimeout);
1756                 } else {
1757                         /*
1758                          * Use dynamic retransmission behavior per EAP
1759                          * specification.
1760                          */
1761                         sm->eap_if->aaaMethodTimeout = 0;
1762                 }
1763                 break;
1764         }
1765
1766         ieee802_1x_decapsulate_radius(hapd, sta);
1767         if (override_eapReq)
1768                 sm->eap_if->aaaEapReq = FALSE;
1769
1770         eapol_auth_step(sm);
1771
1772         return RADIUS_RX_QUEUED;
1773 }
1774 #endif /* CONFIG_NO_RADIUS */
1775
1776
1777 void ieee802_1x_abort_auth(struct hostapd_data *hapd, struct sta_info *sta)
1778 {
1779         struct eapol_state_machine *sm = sta->eapol_sm;
1780         if (sm == NULL)
1781                 return;
1782
1783         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1784                        HOSTAPD_LEVEL_DEBUG, "aborting authentication");
1785
1786 #ifndef CONFIG_NO_RADIUS
1787         radius_msg_free(sm->last_recv_radius);
1788         sm->last_recv_radius = NULL;
1789 #endif /* CONFIG_NO_RADIUS */
1790
1791         if (sm->eap_if->eapTimeout) {
1792                 /*
1793                  * Disconnect the STA since it did not reply to the last EAP
1794                  * request and we cannot continue EAP processing (EAP-Failure
1795                  * could only be sent if the EAP peer actually replied).
1796                  */
1797                 wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "EAP Timeout, STA " MACSTR,
1798                         MAC2STR(sta->addr));
1799
1800                 sm->eap_if->portEnabled = FALSE;
1801                 ap_sta_disconnect(hapd, sta, sta->addr,
1802                                   WLAN_REASON_PREV_AUTH_NOT_VALID);
1803         }
1804 }
1805
1806
1807 static int ieee802_1x_rekey_broadcast(struct hostapd_data *hapd)
1808 {
1809         struct eapol_authenticator *eapol = hapd->eapol_auth;
1810
1811         if (hapd->conf->default_wep_key_len < 1)
1812                 return 0;
1813
1814         os_free(eapol->default_wep_key);
1815         eapol->default_wep_key = os_malloc(hapd->conf->default_wep_key_len);
1816         if (eapol->default_wep_key == NULL ||
1817             random_get_bytes(eapol->default_wep_key,
1818                              hapd->conf->default_wep_key_len)) {
1819                 wpa_printf(MSG_INFO, "Could not generate random WEP key");
1820                 os_free(eapol->default_wep_key);
1821                 eapol->default_wep_key = NULL;
1822                 return -1;
1823         }
1824
1825         wpa_hexdump_key(MSG_DEBUG, "IEEE 802.1X: New default WEP key",
1826                         eapol->default_wep_key,
1827                         hapd->conf->default_wep_key_len);
1828
1829         return 0;
1830 }
1831
1832
1833 static int ieee802_1x_sta_key_available(struct hostapd_data *hapd,
1834                                         struct sta_info *sta, void *ctx)
1835 {
1836         if (sta->eapol_sm) {
1837                 sta->eapol_sm->eap_if->eapKeyAvailable = TRUE;
1838                 eapol_auth_step(sta->eapol_sm);
1839         }
1840         return 0;
1841 }
1842
1843
1844 static void ieee802_1x_rekey(void *eloop_ctx, void *timeout_ctx)
1845 {
1846         struct hostapd_data *hapd = eloop_ctx;
1847         struct eapol_authenticator *eapol = hapd->eapol_auth;
1848
1849         if (eapol->default_wep_key_idx >= 3)
1850                 eapol->default_wep_key_idx =
1851                         hapd->conf->individual_wep_key_len > 0 ? 1 : 0;
1852         else
1853                 eapol->default_wep_key_idx++;
1854
1855         wpa_printf(MSG_DEBUG, "IEEE 802.1X: New default WEP key index %d",
1856                    eapol->default_wep_key_idx);
1857
1858         if (ieee802_1x_rekey_broadcast(hapd)) {
1859                 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE8021X,
1860                                HOSTAPD_LEVEL_WARNING, "failed to generate a "
1861                                "new broadcast key");
1862                 os_free(eapol->default_wep_key);
1863                 eapol->default_wep_key = NULL;
1864                 return;
1865         }
1866
1867         /* TODO: Could setup key for RX here, but change default TX keyid only
1868          * after new broadcast key has been sent to all stations. */
1869         if (hostapd_drv_set_key(hapd->conf->iface, hapd, WPA_ALG_WEP,
1870                                 broadcast_ether_addr,
1871                                 eapol->default_wep_key_idx, 1, NULL, 0,
1872                                 eapol->default_wep_key,
1873                                 hapd->conf->default_wep_key_len)) {
1874                 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE8021X,
1875                                HOSTAPD_LEVEL_WARNING, "failed to configure a "
1876                                "new broadcast key");
1877                 os_free(eapol->default_wep_key);
1878                 eapol->default_wep_key = NULL;
1879                 return;
1880         }
1881
1882         ap_for_each_sta(hapd, ieee802_1x_sta_key_available, NULL);
1883
1884         if (hapd->conf->wep_rekeying_period > 0) {
1885                 eloop_register_timeout(hapd->conf->wep_rekeying_period, 0,
1886                                        ieee802_1x_rekey, hapd, NULL);
1887         }
1888 }
1889
1890
1891 static void ieee802_1x_eapol_send(void *ctx, void *sta_ctx, u8 type,
1892                                   const u8 *data, size_t datalen)
1893 {
1894 #ifdef CONFIG_WPS
1895         struct sta_info *sta = sta_ctx;
1896
1897         if ((sta->flags & (WLAN_STA_WPS | WLAN_STA_MAYBE_WPS)) ==
1898             WLAN_STA_MAYBE_WPS) {
1899                 const u8 *identity;
1900                 size_t identity_len;
1901                 struct eapol_state_machine *sm = sta->eapol_sm;
1902
1903                 identity = eap_get_identity(sm->eap, &identity_len);
1904                 if (identity &&
1905                     ((identity_len == WSC_ID_ENROLLEE_LEN &&
1906                       os_memcmp(identity, WSC_ID_ENROLLEE,
1907                                 WSC_ID_ENROLLEE_LEN) == 0) ||
1908                      (identity_len == WSC_ID_REGISTRAR_LEN &&
1909                       os_memcmp(identity, WSC_ID_REGISTRAR,
1910                                 WSC_ID_REGISTRAR_LEN) == 0))) {
1911                         wpa_printf(MSG_DEBUG, "WPS: WLAN_STA_MAYBE_WPS -> "
1912                                    "WLAN_STA_WPS");
1913                         sta->flags |= WLAN_STA_WPS;
1914                 }
1915         }
1916 #endif /* CONFIG_WPS */
1917
1918         ieee802_1x_send(ctx, sta_ctx, type, data, datalen);
1919 }
1920
1921
1922 static void ieee802_1x_aaa_send(void *ctx, void *sta_ctx,
1923                                 const u8 *data, size_t datalen)
1924 {
1925 #ifndef CONFIG_NO_RADIUS
1926         struct hostapd_data *hapd = ctx;
1927         struct sta_info *sta = sta_ctx;
1928
1929         ieee802_1x_encapsulate_radius(hapd, sta, data, datalen);
1930 #endif /* CONFIG_NO_RADIUS */
1931 }
1932
1933
1934 static void _ieee802_1x_finished(void *ctx, void *sta_ctx, int success,
1935                                  int preauth, int remediation)
1936 {
1937         struct hostapd_data *hapd = ctx;
1938         struct sta_info *sta = sta_ctx;
1939         if (preauth)
1940                 rsn_preauth_finished(hapd, sta, success);
1941         else
1942                 ieee802_1x_finished(hapd, sta, success, remediation);
1943 }
1944
1945
1946 static int ieee802_1x_get_eap_user(void *ctx, const u8 *identity,
1947                                    size_t identity_len, int phase2,
1948                                    struct eap_user *user)
1949 {
1950         struct hostapd_data *hapd = ctx;
1951         const struct hostapd_eap_user *eap_user;
1952         int i;
1953         int rv = -1;
1954
1955         eap_user = hostapd_get_eap_user(hapd, identity, identity_len, phase2);
1956         if (eap_user == NULL)
1957                 goto out;
1958
1959         os_memset(user, 0, sizeof(*user));
1960         user->phase2 = phase2;
1961         for (i = 0; i < EAP_MAX_METHODS; i++) {
1962                 user->methods[i].vendor = eap_user->methods[i].vendor;
1963                 user->methods[i].method = eap_user->methods[i].method;
1964         }
1965
1966         if (eap_user->password) {
1967                 user->password = os_malloc(eap_user->password_len);
1968                 if (user->password == NULL)
1969                         goto out;
1970                 os_memcpy(user->password, eap_user->password,
1971                           eap_user->password_len);
1972                 user->password_len = eap_user->password_len;
1973                 user->password_hash = eap_user->password_hash;
1974         }
1975         user->force_version = eap_user->force_version;
1976         user->macacl = eap_user->macacl;
1977         user->ttls_auth = eap_user->ttls_auth;
1978         user->remediation = eap_user->remediation;
1979         rv = 0;
1980
1981 out:
1982         if (rv)
1983                 wpa_printf(MSG_DEBUG, "%s: Failed to find user", __func__);
1984
1985         return rv;
1986 }
1987
1988
1989 static int ieee802_1x_sta_entry_alive(void *ctx, const u8 *addr)
1990 {
1991         struct hostapd_data *hapd = ctx;
1992         struct sta_info *sta;
1993         sta = ap_get_sta(hapd, addr);
1994         if (sta == NULL || sta->eapol_sm == NULL)
1995                 return 0;
1996         return 1;
1997 }
1998
1999
2000 static void ieee802_1x_logger(void *ctx, const u8 *addr,
2001                               eapol_logger_level level, const char *txt)
2002 {
2003 #ifndef CONFIG_NO_HOSTAPD_LOGGER
2004         struct hostapd_data *hapd = ctx;
2005         int hlevel;
2006
2007         switch (level) {
2008         case EAPOL_LOGGER_WARNING:
2009                 hlevel = HOSTAPD_LEVEL_WARNING;
2010                 break;
2011         case EAPOL_LOGGER_INFO:
2012                 hlevel = HOSTAPD_LEVEL_INFO;
2013                 break;
2014         case EAPOL_LOGGER_DEBUG:
2015         default:
2016                 hlevel = HOSTAPD_LEVEL_DEBUG;
2017                 break;
2018         }
2019
2020         hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE8021X, hlevel, "%s",
2021                        txt);
2022 #endif /* CONFIG_NO_HOSTAPD_LOGGER */
2023 }
2024
2025
2026 static void ieee802_1x_set_port_authorized(void *ctx, void *sta_ctx,
2027                                            int authorized)
2028 {
2029         struct hostapd_data *hapd = ctx;
2030         struct sta_info *sta = sta_ctx;
2031         ieee802_1x_set_sta_authorized(hapd, sta, authorized);
2032 }
2033
2034
2035 static void _ieee802_1x_abort_auth(void *ctx, void *sta_ctx)
2036 {
2037         struct hostapd_data *hapd = ctx;
2038         struct sta_info *sta = sta_ctx;
2039         ieee802_1x_abort_auth(hapd, sta);
2040 }
2041
2042
2043 static void _ieee802_1x_tx_key(void *ctx, void *sta_ctx)
2044 {
2045 #ifndef CONFIG_FIPS
2046 #ifndef CONFIG_NO_RC4
2047         struct hostapd_data *hapd = ctx;
2048         struct sta_info *sta = sta_ctx;
2049         ieee802_1x_tx_key(hapd, sta);
2050 #endif /* CONFIG_NO_RC4 */
2051 #endif /* CONFIG_FIPS */
2052 }
2053
2054
2055 static void ieee802_1x_eapol_event(void *ctx, void *sta_ctx,
2056                                    enum eapol_event type)
2057 {
2058         /* struct hostapd_data *hapd = ctx; */
2059         struct sta_info *sta = sta_ctx;
2060         switch (type) {
2061         case EAPOL_AUTH_SM_CHANGE:
2062                 wpa_auth_sm_notify(sta->wpa_sm);
2063                 break;
2064         case EAPOL_AUTH_REAUTHENTICATE:
2065                 wpa_auth_sm_event(sta->wpa_sm, WPA_REAUTH_EAPOL);
2066                 break;
2067         }
2068 }
2069
2070
2071 #ifdef CONFIG_ERP
2072
2073 static struct eap_server_erp_key *
2074 ieee802_1x_erp_get_key(void *ctx, const char *keyname)
2075 {
2076         struct hostapd_data *hapd = ctx;
2077         struct eap_server_erp_key *erp;
2078
2079         dl_list_for_each(erp, &hapd->erp_keys, struct eap_server_erp_key,
2080                          list) {
2081                 if (os_strcmp(erp->keyname_nai, keyname) == 0)
2082                         return erp;
2083         }
2084
2085         return NULL;
2086 }
2087
2088
2089 static int ieee802_1x_erp_add_key(void *ctx, struct eap_server_erp_key *erp)
2090 {
2091         struct hostapd_data *hapd = ctx;
2092
2093         dl_list_add(&hapd->erp_keys, &erp->list);
2094         return 0;
2095 }
2096
2097 #endif /* CONFIG_ERP */
2098
2099
2100 int ieee802_1x_init(struct hostapd_data *hapd)
2101 {
2102         int i;
2103         struct eapol_auth_config conf;
2104         struct eapol_auth_cb cb;
2105
2106         dl_list_init(&hapd->erp_keys);
2107
2108         os_memset(&conf, 0, sizeof(conf));
2109         conf.ctx = hapd;
2110         conf.eap_reauth_period = hapd->conf->eap_reauth_period;
2111         conf.wpa = hapd->conf->wpa;
2112         conf.individual_wep_key_len = hapd->conf->individual_wep_key_len;
2113         conf.eap_server = hapd->conf->eap_server;
2114         conf.ssl_ctx = hapd->ssl_ctx;
2115         conf.msg_ctx = hapd->msg_ctx;
2116         conf.eap_sim_db_priv = hapd->eap_sim_db_priv;
2117         conf.eap_req_id_text = hapd->conf->eap_req_id_text;
2118         conf.eap_req_id_text_len = hapd->conf->eap_req_id_text_len;
2119         conf.erp_send_reauth_start = hapd->conf->erp_send_reauth_start;
2120         conf.erp_domain = hapd->conf->erp_domain;
2121         conf.erp = hapd->conf->eap_server_erp;
2122         conf.tls_session_lifetime = hapd->conf->tls_session_lifetime;
2123         conf.pac_opaque_encr_key = hapd->conf->pac_opaque_encr_key;
2124         conf.eap_fast_a_id = hapd->conf->eap_fast_a_id;
2125         conf.eap_fast_a_id_len = hapd->conf->eap_fast_a_id_len;
2126         conf.eap_fast_a_id_info = hapd->conf->eap_fast_a_id_info;
2127         conf.eap_fast_prov = hapd->conf->eap_fast_prov;
2128         conf.pac_key_lifetime = hapd->conf->pac_key_lifetime;
2129         conf.pac_key_refresh_time = hapd->conf->pac_key_refresh_time;
2130         conf.eap_sim_aka_result_ind = hapd->conf->eap_sim_aka_result_ind;
2131         conf.tnc = hapd->conf->tnc;
2132         conf.wps = hapd->wps;
2133         conf.fragment_size = hapd->conf->fragment_size;
2134         conf.pwd_group = hapd->conf->pwd_group;
2135         conf.pbc_in_m1 = hapd->conf->pbc_in_m1;
2136         if (hapd->conf->server_id) {
2137                 conf.server_id = (const u8 *) hapd->conf->server_id;
2138                 conf.server_id_len = os_strlen(hapd->conf->server_id);
2139         } else {
2140                 conf.server_id = (const u8 *) "hostapd";
2141                 conf.server_id_len = 7;
2142         }
2143
2144         os_memset(&cb, 0, sizeof(cb));
2145         cb.eapol_send = ieee802_1x_eapol_send;
2146         cb.aaa_send = ieee802_1x_aaa_send;
2147         cb.finished = _ieee802_1x_finished;
2148         cb.get_eap_user = ieee802_1x_get_eap_user;
2149         cb.sta_entry_alive = ieee802_1x_sta_entry_alive;
2150         cb.logger = ieee802_1x_logger;
2151         cb.set_port_authorized = ieee802_1x_set_port_authorized;
2152         cb.abort_auth = _ieee802_1x_abort_auth;
2153         cb.tx_key = _ieee802_1x_tx_key;
2154         cb.eapol_event = ieee802_1x_eapol_event;
2155 #ifdef CONFIG_ERP
2156         cb.erp_get_key = ieee802_1x_erp_get_key;
2157         cb.erp_add_key = ieee802_1x_erp_add_key;
2158 #endif /* CONFIG_ERP */
2159
2160         hapd->eapol_auth = eapol_auth_init(&conf, &cb);
2161         if (hapd->eapol_auth == NULL)
2162                 return -1;
2163
2164         if ((hapd->conf->ieee802_1x || hapd->conf->wpa) &&
2165             hostapd_set_drv_ieee8021x(hapd, hapd->conf->iface, 1))
2166                 return -1;
2167
2168 #ifndef CONFIG_NO_RADIUS
2169         if (radius_client_register(hapd->radius, RADIUS_AUTH,
2170                                    ieee802_1x_receive_auth, hapd))
2171                 return -1;
2172 #endif /* CONFIG_NO_RADIUS */
2173
2174         if (hapd->conf->default_wep_key_len) {
2175                 for (i = 0; i < 4; i++)
2176                         hostapd_drv_set_key(hapd->conf->iface, hapd,
2177                                             WPA_ALG_NONE, NULL, i, 0, NULL, 0,
2178                                             NULL, 0);
2179
2180                 ieee802_1x_rekey(hapd, NULL);
2181
2182                 if (hapd->eapol_auth->default_wep_key == NULL)
2183                         return -1;
2184         }
2185
2186         return 0;
2187 }
2188
2189
2190 void ieee802_1x_erp_flush(struct hostapd_data *hapd)
2191 {
2192         struct eap_server_erp_key *erp;
2193
2194         while ((erp = dl_list_first(&hapd->erp_keys, struct eap_server_erp_key,
2195                                     list)) != NULL) {
2196                 dl_list_del(&erp->list);
2197                 bin_clear_free(erp, sizeof(*erp));
2198         }
2199 }
2200
2201
2202 void ieee802_1x_deinit(struct hostapd_data *hapd)
2203 {
2204         eloop_cancel_timeout(ieee802_1x_rekey, hapd, NULL);
2205
2206         if (hapd->driver && hapd->drv_priv &&
2207             (hapd->conf->ieee802_1x || hapd->conf->wpa))
2208                 hostapd_set_drv_ieee8021x(hapd, hapd->conf->iface, 0);
2209
2210         eapol_auth_deinit(hapd->eapol_auth);
2211         hapd->eapol_auth = NULL;
2212
2213         ieee802_1x_erp_flush(hapd);
2214 }
2215
2216
2217 int ieee802_1x_tx_status(struct hostapd_data *hapd, struct sta_info *sta,
2218                          const u8 *buf, size_t len, int ack)
2219 {
2220         struct ieee80211_hdr *hdr;
2221         u8 *pos;
2222         const unsigned char rfc1042_hdr[ETH_ALEN] =
2223                 { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
2224
2225         if (sta == NULL)
2226                 return -1;
2227         if (len < sizeof(*hdr) + sizeof(rfc1042_hdr) + 2)
2228                 return 0;
2229
2230         hdr = (struct ieee80211_hdr *) buf;
2231         pos = (u8 *) (hdr + 1);
2232         if (os_memcmp(pos, rfc1042_hdr, sizeof(rfc1042_hdr)) != 0)
2233                 return 0;
2234         pos += sizeof(rfc1042_hdr);
2235         if (WPA_GET_BE16(pos) != ETH_P_PAE)
2236                 return 0;
2237         pos += 2;
2238
2239         return ieee802_1x_eapol_tx_status(hapd, sta, pos, buf + len - pos,
2240                                           ack);
2241 }
2242
2243
2244 int ieee802_1x_eapol_tx_status(struct hostapd_data *hapd, struct sta_info *sta,
2245                                const u8 *buf, int len, int ack)
2246 {
2247         const struct ieee802_1x_hdr *xhdr =
2248                 (const struct ieee802_1x_hdr *) buf;
2249         const u8 *pos = buf + sizeof(*xhdr);
2250         struct ieee802_1x_eapol_key *key;
2251
2252         if (len < (int) sizeof(*xhdr))
2253                 return 0;
2254         wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR " TX status - version=%d "
2255                    "type=%d length=%d - ack=%d",
2256                    MAC2STR(sta->addr), xhdr->version, xhdr->type,
2257                    be_to_host16(xhdr->length), ack);
2258
2259         if (xhdr->type != IEEE802_1X_TYPE_EAPOL_KEY)
2260                 return 0;
2261
2262         if (pos + sizeof(struct wpa_eapol_key) <= buf + len) {
2263                 const struct wpa_eapol_key *wpa;
2264                 wpa = (const struct wpa_eapol_key *) pos;
2265                 if (wpa->type == EAPOL_KEY_TYPE_RSN ||
2266                     wpa->type == EAPOL_KEY_TYPE_WPA)
2267                         wpa_auth_eapol_key_tx_status(hapd->wpa_auth,
2268                                                      sta->wpa_sm, ack);
2269         }
2270
2271         /* EAPOL EAP-Packet packets are eventually re-sent by either Supplicant
2272          * or Authenticator state machines, but EAPOL-Key packets are not
2273          * retransmitted in case of failure. Try to re-send failed EAPOL-Key
2274          * packets couple of times because otherwise STA keys become
2275          * unsynchronized with AP. */
2276         if (!ack && pos + sizeof(*key) <= buf + len) {
2277                 key = (struct ieee802_1x_eapol_key *) pos;
2278                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
2279                                HOSTAPD_LEVEL_DEBUG, "did not Ack EAPOL-Key "
2280                                "frame (%scast index=%d)",
2281                                key->key_index & BIT(7) ? "uni" : "broad",
2282                                key->key_index & ~BIT(7));
2283                 /* TODO: re-send EAPOL-Key couple of times (with short delay
2284                  * between them?). If all attempt fail, report error and
2285                  * deauthenticate STA so that it will get new keys when
2286                  * authenticating again (e.g., after returning in range).
2287                  * Separate limit/transmit state needed both for unicast and
2288                  * broadcast keys(?) */
2289         }
2290         /* TODO: could move unicast key configuration from ieee802_1x_tx_key()
2291          * to here and change the key only if the EAPOL-Key packet was Acked.
2292          */
2293
2294         return 1;
2295 }
2296
2297
2298 u8 * ieee802_1x_get_identity(struct eapol_state_machine *sm, size_t *len)
2299 {
2300         if (sm == NULL || sm->identity == NULL)
2301                 return NULL;
2302
2303         *len = sm->identity_len;
2304         return sm->identity;
2305 }
2306
2307
2308 u8 * ieee802_1x_get_radius_class(struct eapol_state_machine *sm, size_t *len,
2309                                  int idx)
2310 {
2311         if (sm == NULL || sm->radius_class.attr == NULL ||
2312             idx >= (int) sm->radius_class.count)
2313                 return NULL;
2314
2315         *len = sm->radius_class.attr[idx].len;
2316         return sm->radius_class.attr[idx].data;
2317 }
2318
2319
2320 struct wpabuf * ieee802_1x_get_radius_cui(struct eapol_state_machine *sm)
2321 {
2322         if (sm == NULL)
2323                 return NULL;
2324         return sm->radius_cui;
2325 }
2326
2327
2328 const u8 * ieee802_1x_get_key(struct eapol_state_machine *sm, size_t *len)
2329 {
2330         *len = 0;
2331         if (sm == NULL)
2332                 return NULL;
2333
2334         *len = sm->eap_if->eapKeyDataLen;
2335         return sm->eap_if->eapKeyData;
2336 }
2337
2338
2339 void ieee802_1x_notify_port_enabled(struct eapol_state_machine *sm,
2340                                     int enabled)
2341 {
2342         if (sm == NULL)
2343                 return;
2344         sm->eap_if->portEnabled = enabled ? TRUE : FALSE;
2345         eapol_auth_step(sm);
2346 }
2347
2348
2349 void ieee802_1x_notify_port_valid(struct eapol_state_machine *sm,
2350                                   int valid)
2351 {
2352         if (sm == NULL)
2353                 return;
2354         sm->portValid = valid ? TRUE : FALSE;
2355         eapol_auth_step(sm);
2356 }
2357
2358
2359 void ieee802_1x_notify_pre_auth(struct eapol_state_machine *sm, int pre_auth)
2360 {
2361         if (sm == NULL)
2362                 return;
2363         if (pre_auth)
2364                 sm->flags |= EAPOL_SM_PREAUTH;
2365         else
2366                 sm->flags &= ~EAPOL_SM_PREAUTH;
2367 }
2368
2369
2370 static const char * bool_txt(Boolean val)
2371 {
2372         return val ? "TRUE" : "FALSE";
2373 }
2374
2375
2376 int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
2377 {
2378         /* TODO */
2379         return 0;
2380 }
2381
2382
2383 int ieee802_1x_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta,
2384                            char *buf, size_t buflen)
2385 {
2386         int len = 0, ret;
2387         struct eapol_state_machine *sm = sta->eapol_sm;
2388         struct os_reltime diff;
2389         const char *name1;
2390         const char *name2;
2391
2392         if (sm == NULL)
2393                 return 0;
2394
2395         ret = os_snprintf(buf + len, buflen - len,
2396                           "dot1xPaePortNumber=%d\n"
2397                           "dot1xPaePortProtocolVersion=%d\n"
2398                           "dot1xPaePortCapabilities=1\n"
2399                           "dot1xPaePortInitialize=%d\n"
2400                           "dot1xPaePortReauthenticate=FALSE\n",
2401                           sta->aid,
2402                           EAPOL_VERSION,
2403                           sm->initialize);
2404         if (os_snprintf_error(buflen - len, ret))
2405                 return len;
2406         len += ret;
2407
2408         /* dot1xAuthConfigTable */
2409         ret = os_snprintf(buf + len, buflen - len,
2410                           "dot1xAuthPaeState=%d\n"
2411                           "dot1xAuthBackendAuthState=%d\n"
2412                           "dot1xAuthAdminControlledDirections=%d\n"
2413                           "dot1xAuthOperControlledDirections=%d\n"
2414                           "dot1xAuthAuthControlledPortStatus=%d\n"
2415                           "dot1xAuthAuthControlledPortControl=%d\n"
2416                           "dot1xAuthQuietPeriod=%u\n"
2417                           "dot1xAuthServerTimeout=%u\n"
2418                           "dot1xAuthReAuthPeriod=%u\n"
2419                           "dot1xAuthReAuthEnabled=%s\n"
2420                           "dot1xAuthKeyTxEnabled=%s\n",
2421                           sm->auth_pae_state + 1,
2422                           sm->be_auth_state + 1,
2423                           sm->adminControlledDirections,
2424                           sm->operControlledDirections,
2425                           sm->authPortStatus,
2426                           sm->portControl,
2427                           sm->quietPeriod,
2428                           sm->serverTimeout,
2429                           sm->reAuthPeriod,
2430                           bool_txt(sm->reAuthEnabled),
2431                           bool_txt(sm->keyTxEnabled));
2432         if (os_snprintf_error(buflen - len, ret))
2433                 return len;
2434         len += ret;
2435
2436         /* dot1xAuthStatsTable */
2437         ret = os_snprintf(buf + len, buflen - len,
2438                           "dot1xAuthEapolFramesRx=%u\n"
2439                           "dot1xAuthEapolFramesTx=%u\n"
2440                           "dot1xAuthEapolStartFramesRx=%u\n"
2441                           "dot1xAuthEapolLogoffFramesRx=%u\n"
2442                           "dot1xAuthEapolRespIdFramesRx=%u\n"
2443                           "dot1xAuthEapolRespFramesRx=%u\n"
2444                           "dot1xAuthEapolReqIdFramesTx=%u\n"
2445                           "dot1xAuthEapolReqFramesTx=%u\n"
2446                           "dot1xAuthInvalidEapolFramesRx=%u\n"
2447                           "dot1xAuthEapLengthErrorFramesRx=%u\n"
2448                           "dot1xAuthLastEapolFrameVersion=%u\n"
2449                           "dot1xAuthLastEapolFrameSource=" MACSTR "\n",
2450                           sm->dot1xAuthEapolFramesRx,
2451                           sm->dot1xAuthEapolFramesTx,
2452                           sm->dot1xAuthEapolStartFramesRx,
2453                           sm->dot1xAuthEapolLogoffFramesRx,
2454                           sm->dot1xAuthEapolRespIdFramesRx,
2455                           sm->dot1xAuthEapolRespFramesRx,
2456                           sm->dot1xAuthEapolReqIdFramesTx,
2457                           sm->dot1xAuthEapolReqFramesTx,
2458                           sm->dot1xAuthInvalidEapolFramesRx,
2459                           sm->dot1xAuthEapLengthErrorFramesRx,
2460                           sm->dot1xAuthLastEapolFrameVersion,
2461                           MAC2STR(sm->addr));
2462         if (os_snprintf_error(buflen - len, ret))
2463                 return len;
2464         len += ret;
2465
2466         /* dot1xAuthDiagTable */
2467         ret = os_snprintf(buf + len, buflen - len,
2468                           "dot1xAuthEntersConnecting=%u\n"
2469                           "dot1xAuthEapLogoffsWhileConnecting=%u\n"
2470                           "dot1xAuthEntersAuthenticating=%u\n"
2471                           "dot1xAuthAuthSuccessesWhileAuthenticating=%u\n"
2472                           "dot1xAuthAuthTimeoutsWhileAuthenticating=%u\n"
2473                           "dot1xAuthAuthFailWhileAuthenticating=%u\n"
2474                           "dot1xAuthAuthEapStartsWhileAuthenticating=%u\n"
2475                           "dot1xAuthAuthEapLogoffWhileAuthenticating=%u\n"
2476                           "dot1xAuthAuthReauthsWhileAuthenticated=%u\n"
2477                           "dot1xAuthAuthEapStartsWhileAuthenticated=%u\n"
2478                           "dot1xAuthAuthEapLogoffWhileAuthenticated=%u\n"
2479                           "dot1xAuthBackendResponses=%u\n"
2480                           "dot1xAuthBackendAccessChallenges=%u\n"
2481                           "dot1xAuthBackendOtherRequestsToSupplicant=%u\n"
2482                           "dot1xAuthBackendAuthSuccesses=%u\n"
2483                           "dot1xAuthBackendAuthFails=%u\n",
2484                           sm->authEntersConnecting,
2485                           sm->authEapLogoffsWhileConnecting,
2486                           sm->authEntersAuthenticating,
2487                           sm->authAuthSuccessesWhileAuthenticating,
2488                           sm->authAuthTimeoutsWhileAuthenticating,
2489                           sm->authAuthFailWhileAuthenticating,
2490                           sm->authAuthEapStartsWhileAuthenticating,
2491                           sm->authAuthEapLogoffWhileAuthenticating,
2492                           sm->authAuthReauthsWhileAuthenticated,
2493                           sm->authAuthEapStartsWhileAuthenticated,
2494                           sm->authAuthEapLogoffWhileAuthenticated,
2495                           sm->backendResponses,
2496                           sm->backendAccessChallenges,
2497                           sm->backendOtherRequestsToSupplicant,
2498                           sm->backendAuthSuccesses,
2499                           sm->backendAuthFails);
2500         if (os_snprintf_error(buflen - len, ret))
2501                 return len;
2502         len += ret;
2503
2504         /* dot1xAuthSessionStatsTable */
2505         os_reltime_age(&sta->acct_session_start, &diff);
2506         ret = os_snprintf(buf + len, buflen - len,
2507                           /* TODO: dot1xAuthSessionOctetsRx */
2508                           /* TODO: dot1xAuthSessionOctetsTx */
2509                           /* TODO: dot1xAuthSessionFramesRx */
2510                           /* TODO: dot1xAuthSessionFramesTx */
2511                           "dot1xAuthSessionId=%016lX\n"
2512                           "dot1xAuthSessionAuthenticMethod=%d\n"
2513                           "dot1xAuthSessionTime=%u\n"
2514                           "dot1xAuthSessionTerminateCause=999\n"
2515                           "dot1xAuthSessionUserName=%s\n",
2516                           (long unsigned int) sta->acct_session_id,
2517                           (wpa_key_mgmt_wpa_ieee8021x(
2518                                    wpa_auth_sta_key_mgmt(sta->wpa_sm))) ?
2519                           1 : 2,
2520                           (unsigned int) diff.sec,
2521                           sm->identity);
2522         if (os_snprintf_error(buflen - len, ret))
2523                 return len;
2524         len += ret;
2525
2526         if (sm->acct_multi_session_id) {
2527                 ret = os_snprintf(buf + len, buflen - len,
2528                                   "authMultiSessionId=%016lX\n",
2529                                   (long unsigned int)
2530                                   sm->acct_multi_session_id);
2531                 if (os_snprintf_error(buflen - len, ret))
2532                         return len;
2533                 len += ret;
2534         }
2535
2536         name1 = eap_server_get_name(0, sm->eap_type_authsrv);
2537         name2 = eap_server_get_name(0, sm->eap_type_supp);
2538         ret = os_snprintf(buf + len, buflen - len,
2539                           "last_eap_type_as=%d (%s)\n"
2540                           "last_eap_type_sta=%d (%s)\n",
2541                           sm->eap_type_authsrv, name1,
2542                           sm->eap_type_supp, name2);
2543         if (os_snprintf_error(buflen - len, ret))
2544                 return len;
2545         len += ret;
2546
2547         return len;
2548 }
2549
2550
2551 #ifdef CONFIG_HS20
2552 static void ieee802_1x_wnm_notif_send(void *eloop_ctx, void *timeout_ctx)
2553 {
2554         struct hostapd_data *hapd = eloop_ctx;
2555         struct sta_info *sta = timeout_ctx;
2556
2557         if (sta->remediation) {
2558                 wpa_printf(MSG_DEBUG, "HS 2.0: Send WNM-Notification to "
2559                            MACSTR " to indicate Subscription Remediation",
2560                            MAC2STR(sta->addr));
2561                 hs20_send_wnm_notification(hapd, sta->addr,
2562                                            sta->remediation_method,
2563                                            sta->remediation_url);
2564                 os_free(sta->remediation_url);
2565                 sta->remediation_url = NULL;
2566         }
2567
2568         if (sta->hs20_deauth_req) {
2569                 wpa_printf(MSG_DEBUG, "HS 2.0: Send WNM-Notification to "
2570                            MACSTR " to indicate imminent deauthentication",
2571                            MAC2STR(sta->addr));
2572                 hs20_send_wnm_notification_deauth_req(hapd, sta->addr,
2573                                                       sta->hs20_deauth_req);
2574         }
2575 }
2576 #endif /* CONFIG_HS20 */
2577
2578
2579 static void ieee802_1x_finished(struct hostapd_data *hapd,
2580                                 struct sta_info *sta, int success,
2581                                 int remediation)
2582 {
2583         const u8 *key;
2584         size_t len;
2585         /* TODO: get PMKLifetime from WPA parameters */
2586         static const int dot11RSNAConfigPMKLifetime = 43200;
2587         unsigned int session_timeout;
2588
2589 #ifdef CONFIG_HS20
2590         if (remediation && !sta->remediation) {
2591                 sta->remediation = 1;
2592                 os_free(sta->remediation_url);
2593                 sta->remediation_url =
2594                         os_strdup(hapd->conf->subscr_remediation_url);
2595                 sta->remediation_method = 1; /* SOAP-XML SPP */
2596         }
2597
2598         if (success && (sta->remediation || sta->hs20_deauth_req)) {
2599                 wpa_printf(MSG_DEBUG, "HS 2.0: Schedule WNM-Notification to "
2600                            MACSTR " in 100 ms", MAC2STR(sta->addr));
2601                 eloop_cancel_timeout(ieee802_1x_wnm_notif_send, hapd, sta);
2602                 eloop_register_timeout(0, 100000, ieee802_1x_wnm_notif_send,
2603                                        hapd, sta);
2604         }
2605 #endif /* CONFIG_HS20 */
2606
2607         key = ieee802_1x_get_key(sta->eapol_sm, &len);
2608         if (sta->session_timeout_set)
2609                 session_timeout = sta->session_timeout;
2610         else
2611                 session_timeout = dot11RSNAConfigPMKLifetime;
2612         if (success && key && len >= PMK_LEN && !sta->remediation &&
2613             !sta->hs20_deauth_requested &&
2614             wpa_auth_pmksa_add(sta->wpa_sm, key, len, session_timeout,
2615                                sta->eapol_sm) == 0) {
2616                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA,
2617                                HOSTAPD_LEVEL_DEBUG,
2618                                "Added PMKSA cache entry (IEEE 802.1X)");
2619         }
2620
2621         if (!success) {
2622                 /*
2623                  * Many devices require deauthentication after WPS provisioning
2624                  * and some may not be be able to do that themselves, so
2625                  * disconnect the client here. In addition, this may also
2626                  * benefit IEEE 802.1X/EAPOL authentication cases, too since
2627                  * the EAPOL PAE state machine would remain in HELD state for
2628                  * considerable amount of time and some EAP methods, like
2629                  * EAP-FAST with anonymous provisioning, may require another
2630                  * EAPOL authentication to be started to complete connection.
2631                  */
2632                 wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "IEEE 802.1X: Force "
2633                         "disconnection after EAP-Failure");
2634                 /* Add a small sleep to increase likelihood of previously
2635                  * requested EAP-Failure TX getting out before this should the
2636                  * driver reorder operations.
2637                  */
2638                 os_sleep(0, 10000);
2639                 ap_sta_disconnect(hapd, sta, sta->addr,
2640                                   WLAN_REASON_IEEE_802_1X_AUTH_FAILED);
2641                 hostapd_wps_eap_completed(hapd);
2642         }
2643 }