src/ap/pmksa_cache_auth.c

   1 /*
   2  * hostapd - PMKSA cache for IEEE 802.11i RSN
   3  * Copyright (c) 2004-2008, 2012-2015, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #include "utils/common.h"
  12 #include "utils/eloop.h"
  13 #include "eapol_auth/eapol_auth_sm.h"
  14 #include "eapol_auth/eapol_auth_sm_i.h"
  15 #include "radius/radius_das.h"
  16 #include "sta_info.h"
  17 #include "ap_config.h"
  18 #include "pmksa_cache_auth.h"
  19
  20
  21 static const int pmksa_cache_max_entries = 1024;
  22 static const int dot11RSNAConfigPMKLifetime = 43200;
  23
  24 struct rsn_pmksa_cache {
  25 #define PMKID_HASH_SIZE 128
  26 #define PMKID_HASH(pmkid) (unsigned int) ((pmkid)[0] & 0x7f)
  27         struct rsn_pmksa_cache_entry *pmkid[PMKID_HASH_SIZE];
  28         struct rsn_pmksa_cache_entry *pmksa;
  29         int pmksa_count;
  30
  31         void (*free_cb)(struct rsn_pmksa_cache_entry *entry, void *ctx);
  32         void *ctx;
  33 };
  34
  35
  36 static void pmksa_cache_set_expiration(struct rsn_pmksa_cache *pmksa);
  37
  38
  39 static void _pmksa_cache_free_entry(struct rsn_pmksa_cache_entry *entry)
  40 {
  41         os_free(entry->vlan_desc);
  42         os_free(entry->identity);
  43         wpabuf_free(entry->cui);
  44 #ifndef CONFIG_NO_RADIUS
  45         radius_free_class(&entry->radius_class);
  46 #endif /* CONFIG_NO_RADIUS */
  47         bin_clear_free(entry, sizeof(*entry));
  48 }
  49
  50
  51 void pmksa_cache_free_entry(struct rsn_pmksa_cache *pmksa,
  52                             struct rsn_pmksa_cache_entry *entry)
  53 {
  54         struct rsn_pmksa_cache_entry *pos, *prev;
  55         unsigned int hash;
  56
  57         pmksa->pmksa_count--;
  58         pmksa->free_cb(entry, pmksa->ctx);
  59
  60         /* unlink from hash list */
  61         hash = PMKID_HASH(entry->pmkid);
  62         pos = pmksa->pmkid[hash];
  63         prev = NULL;
  64         while (pos) {
  65                 if (pos == entry) {
  66                         if (prev != NULL)
  67                                 prev->hnext = entry->hnext;
  68                         else
  69                                 pmksa->pmkid[hash] = entry->hnext;
  70                         break;
  71                 }
  72                 prev = pos;
  73                 pos = pos->hnext;
  74         }
  75
  76         /* unlink from entry list */
  77         pos = pmksa->pmksa;
  78         prev = NULL;
  79         while (pos) {
  80                 if (pos == entry) {
  81                         if (prev != NULL)
  82                                 prev->next = entry->next;
  83                         else
  84                                 pmksa->pmksa = entry->next;
  85                         break;
  86                 }
  87                 prev = pos;
  88                 pos = pos->next;
  89         }
  90
  91         _pmksa_cache_free_entry(entry);
  92 }
  93
  94
  95 static void pmksa_cache_expire(void *eloop_ctx, void *timeout_ctx)
  96 {
  97         struct rsn_pmksa_cache *pmksa = eloop_ctx;
  98         struct os_reltime now;
  99
 100         os_get_reltime(&now);
 101         while (pmksa->pmksa && pmksa->pmksa->expiration <= now.sec) {
 102                 wpa_printf(MSG_DEBUG, "RSN: expired PMKSA cache entry for "
 103                            MACSTR, MAC2STR(pmksa->pmksa->spa));
 104                 pmksa_cache_free_entry(pmksa, pmksa->pmksa);
 105         }
 106
 107         pmksa_cache_set_expiration(pmksa);
 108 }
 109
 110
 111 static void pmksa_cache_set_expiration(struct rsn_pmksa_cache *pmksa)
 112 {
 113         int sec;
 114         struct os_reltime now;
 115
 116         eloop_cancel_timeout(pmksa_cache_expire, pmksa, NULL);
 117         if (pmksa->pmksa == NULL)
 118                 return;
 119         os_get_reltime(&now);
 120         sec = pmksa->pmksa->expiration - now.sec;
 121         if (sec < 0)
 122                 sec = 0;
 123         eloop_register_timeout(sec + 1, 0, pmksa_cache_expire, pmksa, NULL);
 124 }
 125
 126
 127 static void pmksa_cache_from_eapol_data(struct rsn_pmksa_cache_entry *entry,
 128                                         struct eapol_state_machine *eapol)
 129 {
 130         struct vlan_description *vlan_desc;
 131
 132         if (eapol == NULL)
 133                 return;
 134
 135         if (eapol->identity) {
 136                 entry->identity = os_malloc(eapol->identity_len);
 137                 if (entry->identity) {
 138                         entry->identity_len = eapol->identity_len;
 139                         os_memcpy(entry->identity, eapol->identity,
 140                                   eapol->identity_len);
 141                 }
 142         }
 143
 144         if (eapol->radius_cui)
 145                 entry->cui = wpabuf_dup(eapol->radius_cui);
 146
 147 #ifndef CONFIG_NO_RADIUS
 148         radius_copy_class(&entry->radius_class, &eapol->radius_class);
 149 #endif /* CONFIG_NO_RADIUS */
 150
 151         entry->eap_type_authsrv = eapol->eap_type_authsrv;
 152
 153         vlan_desc = ((struct sta_info *) eapol->sta)->vlan_desc;
 154         if (vlan_desc && vlan_desc->notempty) {
 155                 entry->vlan_desc = os_zalloc(sizeof(struct vlan_description));
 156                 if (entry->vlan_desc)
 157                         *entry->vlan_desc = *vlan_desc;
 158         } else {
 159                 entry->vlan_desc = NULL;
 160         }
 161
 162         entry->acct_multi_session_id = eapol->acct_multi_session_id;
 163 }
 164
 165
 166 void pmksa_cache_to_eapol_data(struct hostapd_data *hapd,
 167                                struct rsn_pmksa_cache_entry *entry,
 168                                struct eapol_state_machine *eapol)
 169 {
 170         struct sta_info *sta;
 171
 172         if (entry == NULL || eapol == NULL)
 173                 return;
 174
 175         if (entry->identity) {
 176                 os_free(eapol->identity);
 177                 eapol->identity = os_malloc(entry->identity_len);
 178                 if (eapol->identity) {
 179                         eapol->identity_len = entry->identity_len;
 180                         os_memcpy(eapol->identity, entry->identity,
 181                                   entry->identity_len);
 182                 }
 183                 wpa_hexdump_ascii(MSG_DEBUG, "STA identity from PMKSA",
 184                                   eapol->identity, eapol->identity_len);
 185         }
 186
 187         if (entry->cui) {
 188                 wpabuf_free(eapol->radius_cui);
 189                 eapol->radius_cui = wpabuf_dup(entry->cui);
 190         }
 191
 192 #ifndef CONFIG_NO_RADIUS
 193         radius_free_class(&eapol->radius_class);
 194         radius_copy_class(&eapol->radius_class, &entry->radius_class);
 195 #endif /* CONFIG_NO_RADIUS */
 196         if (eapol->radius_class.attr) {
 197                 wpa_printf(MSG_DEBUG, "Copied %lu Class attribute(s) from "
 198                            "PMKSA", (unsigned long) eapol->radius_class.count);
 199         }
 200
 201         eapol->eap_type_authsrv = entry->eap_type_authsrv;
 202         sta = (struct sta_info *) eapol->sta;
 203         ap_sta_set_vlan(hapd, sta, entry->vlan_desc);
 204
 205         eapol->acct_multi_session_id = entry->acct_multi_session_id;
 206 }
 207
 208
 209 static void pmksa_cache_link_entry(struct rsn_pmksa_cache *pmksa,
 210                                    struct rsn_pmksa_cache_entry *entry)
 211 {
 212         struct rsn_pmksa_cache_entry *pos, *prev;
 213         int hash;
 214
 215         /* Add the new entry; order by expiration time */
 216         pos = pmksa->pmksa;
 217         prev = NULL;
 218         while (pos) {
 219                 if (pos->expiration > entry->expiration)
 220                         break;
 221                 prev = pos;
 222                 pos = pos->next;
 223         }
 224         if (prev == NULL) {
 225                 entry->next = pmksa->pmksa;
 226                 pmksa->pmksa = entry;
 227         } else {
 228                 entry->next = prev->next;
 229                 prev->next = entry;
 230         }
 231
 232         hash = PMKID_HASH(entry->pmkid);
 233         entry->hnext = pmksa->pmkid[hash];
 234         pmksa->pmkid[hash] = entry;
 235
 236         pmksa->pmksa_count++;
 237         if (prev == NULL)
 238                 pmksa_cache_set_expiration(pmksa);
 239         wpa_printf(MSG_DEBUG, "RSN: added PMKSA cache entry for " MACSTR,
 240                    MAC2STR(entry->spa));
 241         wpa_hexdump(MSG_DEBUG, "RSN: added PMKID", entry->pmkid, PMKID_LEN);
 242 }
 243
 244
 245 /**
 246  * pmksa_cache_auth_add - Add a PMKSA cache entry
 247  * @pmksa: Pointer to PMKSA cache data from pmksa_cache_auth_init()
 248  * @pmk: The new pairwise master key
 249  * @pmk_len: PMK length in bytes, usually PMK_LEN (32)
 250  * @pmkid: Calculated PMKID
 251  * @kck: Key confirmation key or %NULL if not yet derived
 252  * @kck_len: KCK length in bytes
 253  * @aa: Authenticator address
 254  * @spa: Supplicant address
 255  * @session_timeout: Session timeout
 256  * @eapol: Pointer to EAPOL state machine data
 257  * @akmp: WPA_KEY_MGMT_* used in key derivation
 258  * Returns: Pointer to the added PMKSA cache entry or %NULL on error
 259  *
 260  * This function create a PMKSA entry for a new PMK and adds it to the PMKSA
 261  * cache. If an old entry is already in the cache for the same Supplicant,
 262  * this entry will be replaced with the new entry. PMKID will be calculated
 263  * based on the PMK.
 264  */
 265 struct rsn_pmksa_cache_entry *
 266 pmksa_cache_auth_add(struct rsn_pmksa_cache *pmksa,
 267                      const u8 *pmk, size_t pmk_len, const u8 *pmkid,
 268                      const u8 *kck, size_t kck_len,
 269                      const u8 *aa, const u8 *spa, int session_timeout,
 270                      struct eapol_state_machine *eapol, int akmp)
 271 {
 272         struct rsn_pmksa_cache_entry *entry, *pos;
 273         struct os_reltime now;
 274
 275         if (pmk_len > PMK_LEN_MAX)
 276                 return NULL;
 277
 278         if (wpa_key_mgmt_suite_b(akmp) && !kck)
 279                 return NULL;
 280
 281         entry = os_zalloc(sizeof(*entry));
 282         if (entry == NULL)
 283                 return NULL;
 284         os_memcpy(entry->pmk, pmk, pmk_len);
 285         entry->pmk_len = pmk_len;
 286         if (pmkid)
 287                 os_memcpy(entry->pmkid, pmkid, PMKID_LEN);
 288         else if (akmp == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
 289                 rsn_pmkid_suite_b_192(kck, kck_len, aa, spa, entry->pmkid);
 290         else if (wpa_key_mgmt_suite_b(akmp))
 291                 rsn_pmkid_suite_b(kck, kck_len, aa, spa, entry->pmkid);
 292         else
 293                 rsn_pmkid(pmk, pmk_len, aa, spa, entry->pmkid,
 294                           wpa_key_mgmt_sha256(akmp));
 295         os_get_reltime(&now);
 296         entry->expiration = now.sec;
 297         if (session_timeout > 0)
 298                 entry->expiration += session_timeout;
 299         else
 300                 entry->expiration += dot11RSNAConfigPMKLifetime;
 301         entry->akmp = akmp;
 302         os_memcpy(entry->spa, spa, ETH_ALEN);
 303         pmksa_cache_from_eapol_data(entry, eapol);
 304
 305         /* Replace an old entry for the same STA (if found) with the new entry
 306          */
 307         pos = pmksa_cache_auth_get(pmksa, spa, NULL);
 308         if (pos)
 309                 pmksa_cache_free_entry(pmksa, pos);
 310
 311         if (pmksa->pmksa_count >= pmksa_cache_max_entries && pmksa->pmksa) {
 312                 /* Remove the oldest entry to make room for the new entry */
 313                 wpa_printf(MSG_DEBUG, "RSN: removed the oldest PMKSA cache "
 314                            "entry (for " MACSTR ") to make room for new one",
 315                            MAC2STR(pmksa->pmksa->spa));
 316                 pmksa_cache_free_entry(pmksa, pmksa->pmksa);
 317         }
 318
 319         pmksa_cache_link_entry(pmksa, entry);
 320
 321         return entry;
 322 }
 323
 324
 325 struct rsn_pmksa_cache_entry *
 326 pmksa_cache_add_okc(struct rsn_pmksa_cache *pmksa,
 327                     const struct rsn_pmksa_cache_entry *old_entry,
 328                     const u8 *aa, const u8 *pmkid)
 329 {
 330         struct rsn_pmksa_cache_entry *entry;
 331
 332         entry = os_zalloc(sizeof(*entry));
 333         if (entry == NULL)
 334                 return NULL;
 335         os_memcpy(entry->pmkid, pmkid, PMKID_LEN);
 336         os_memcpy(entry->pmk, old_entry->pmk, old_entry->pmk_len);
 337         entry->pmk_len = old_entry->pmk_len;
 338         entry->expiration = old_entry->expiration;
 339         entry->akmp = old_entry->akmp;
 340         os_memcpy(entry->spa, old_entry->spa, ETH_ALEN);
 341         entry->opportunistic = 1;
 342         if (old_entry->identity) {
 343                 entry->identity = os_malloc(old_entry->identity_len);
 344                 if (entry->identity) {
 345                         entry->identity_len = old_entry->identity_len;
 346                         os_memcpy(entry->identity, old_entry->identity,
 347                                   old_entry->identity_len);
 348                 }
 349         }
 350         if (old_entry->cui)
 351                 entry->cui = wpabuf_dup(old_entry->cui);
 352 #ifndef CONFIG_NO_RADIUS
 353         radius_copy_class(&entry->radius_class, &old_entry->radius_class);
 354 #endif /* CONFIG_NO_RADIUS */
 355         entry->eap_type_authsrv = old_entry->eap_type_authsrv;
 356         if (old_entry->vlan_desc) {
 357                 entry->vlan_desc = os_zalloc(sizeof(struct vlan_description));
 358                 if (entry->vlan_desc)
 359                         *entry->vlan_desc = *old_entry->vlan_desc;
 360         } else {
 361                 entry->vlan_desc = NULL;
 362         }
 363         entry->opportunistic = 1;
 364
 365         pmksa_cache_link_entry(pmksa, entry);
 366
 367         return entry;
 368 }
 369
 370
 371 /**
 372  * pmksa_cache_auth_deinit - Free all entries in PMKSA cache
 373  * @pmksa: Pointer to PMKSA cache data from pmksa_cache_auth_init()
 374  */
 375 void pmksa_cache_auth_deinit(struct rsn_pmksa_cache *pmksa)
 376 {
 377         struct rsn_pmksa_cache_entry *entry, *prev;
 378         int i;
 379
 380         if (pmksa == NULL)
 381                 return;
 382
 383         entry = pmksa->pmksa;
 384         while (entry) {
 385                 prev = entry;
 386                 entry = entry->next;
 387                 _pmksa_cache_free_entry(prev);
 388         }
 389         eloop_cancel_timeout(pmksa_cache_expire, pmksa, NULL);
 390         pmksa->pmksa_count = 0;
 391         pmksa->pmksa = NULL;
 392         for (i = 0; i < PMKID_HASH_SIZE; i++)
 393                 pmksa->pmkid[i] = NULL;
 394         os_free(pmksa);
 395 }
 396
 397
 398 /**
 399  * pmksa_cache_auth_get - Fetch a PMKSA cache entry
 400  * @pmksa: Pointer to PMKSA cache data from pmksa_cache_auth_init()
 401  * @spa: Supplicant address or %NULL to match any
 402  * @pmkid: PMKID or %NULL to match any
 403  * Returns: Pointer to PMKSA cache entry or %NULL if no match was found
 404  */
 405 struct rsn_pmksa_cache_entry *
 406 pmksa_cache_auth_get(struct rsn_pmksa_cache *pmksa,
 407                      const u8 *spa, const u8 *pmkid)
 408 {
 409         struct rsn_pmksa_cache_entry *entry;
 410
 411         if (pmkid) {
 412                 for (entry = pmksa->pmkid[PMKID_HASH(pmkid)]; entry;
 413                      entry = entry->hnext) {
 414                         if ((spa == NULL ||
 415                              os_memcmp(entry->spa, spa, ETH_ALEN) == 0) &&
 416                             os_memcmp(entry->pmkid, pmkid, PMKID_LEN) == 0)
 417                                 return entry;
 418                 }
 419         } else {
 420                 for (entry = pmksa->pmksa; entry; entry = entry->next) {
 421                         if (spa == NULL ||
 422                             os_memcmp(entry->spa, spa, ETH_ALEN) == 0)
 423                                 return entry;
 424                 }
 425         }
 426
 427         return NULL;
 428 }
 429
 430
 431 /**
 432  * pmksa_cache_get_okc - Fetch a PMKSA cache entry using OKC
 433  * @pmksa: Pointer to PMKSA cache data from pmksa_cache_auth_init()
 434  * @aa: Authenticator address
 435  * @spa: Supplicant address
 436  * @pmkid: PMKID
 437  * Returns: Pointer to PMKSA cache entry or %NULL if no match was found
 438  *
 439  * Use opportunistic key caching (OKC) to find a PMK for a supplicant.
 440  */
 441 struct rsn_pmksa_cache_entry * pmksa_cache_get_okc(
 442         struct rsn_pmksa_cache *pmksa, const u8 *aa, const u8 *spa,
 443         const u8 *pmkid)
 444 {
 445         struct rsn_pmksa_cache_entry *entry;
 446         u8 new_pmkid[PMKID_LEN];
 447
 448         for (entry = pmksa->pmksa; entry; entry = entry->next) {
 449                 if (os_memcmp(entry->spa, spa, ETH_ALEN) != 0)
 450                         continue;
 451                 rsn_pmkid(entry->pmk, entry->pmk_len, aa, spa, new_pmkid,
 452                           wpa_key_mgmt_sha256(entry->akmp));
 453                 if (os_memcmp(new_pmkid, pmkid, PMKID_LEN) == 0)
 454                         return entry;
 455         }
 456         return NULL;
 457 }
 458
 459
 460 /**
 461  * pmksa_cache_auth_init - Initialize PMKSA cache
 462  * @free_cb: Callback function to be called when a PMKSA cache entry is freed
 463  * @ctx: Context pointer for free_cb function
 464  * Returns: Pointer to PMKSA cache data or %NULL on failure
 465  */
 466 struct rsn_pmksa_cache *
 467 pmksa_cache_auth_init(void (*free_cb)(struct rsn_pmksa_cache_entry *entry,
 468                                       void *ctx), void *ctx)
 469 {
 470         struct rsn_pmksa_cache *pmksa;
 471
 472         pmksa = os_zalloc(sizeof(*pmksa));
 473         if (pmksa) {
 474                 pmksa->free_cb = free_cb;
 475                 pmksa->ctx = ctx;
 476         }
 477
 478         return pmksa;
 479 }
 480
 481
 482 static int das_attr_match(struct rsn_pmksa_cache_entry *entry,
 483                           struct radius_das_attrs *attr)
 484 {
 485         int match = 0;
 486
 487         if (attr->sta_addr) {
 488                 if (os_memcmp(attr->sta_addr, entry->spa, ETH_ALEN) != 0)
 489                         return 0;
 490                 match++;
 491         }
 492
 493         if (attr->acct_multi_session_id) {
 494                 char buf[20];
 495
 496                 if (attr->acct_multi_session_id_len != 16)
 497                         return 0;
 498                 os_snprintf(buf, sizeof(buf), "%016llX",
 499                             (unsigned long long) entry->acct_multi_session_id);
 500                 if (os_memcmp(attr->acct_multi_session_id, buf, 16) != 0)
 501                         return 0;
 502                 match++;
 503         }
 504
 505         if (attr->cui) {
 506                 if (!entry->cui ||
 507                     attr->cui_len != wpabuf_len(entry->cui) ||
 508                     os_memcmp(attr->cui, wpabuf_head(entry->cui),
 509                               attr->cui_len) != 0)
 510                         return 0;
 511                 match++;
 512         }
 513
 514         if (attr->user_name) {
 515                 if (!entry->identity ||
 516                     attr->user_name_len != entry->identity_len ||
 517                     os_memcmp(attr->user_name, entry->identity,
 518                               attr->user_name_len) != 0)
 519                         return 0;
 520                 match++;
 521         }
 522
 523         return match;
 524 }
 525
 526
 527 int pmksa_cache_auth_radius_das_disconnect(struct rsn_pmksa_cache *pmksa,
 528                                            struct radius_das_attrs *attr)
 529 {
 530         int found = 0;
 531         struct rsn_pmksa_cache_entry *entry, *prev;
 532
 533         if (attr->acct_session_id)
 534                 return -1;
 535
 536         entry = pmksa->pmksa;
 537         while (entry) {
 538                 if (das_attr_match(entry, attr)) {
 539                         found++;
 540                         prev = entry;
 541                         entry = entry->next;
 542                         pmksa_cache_free_entry(pmksa, prev);
 543                         continue;
 544                 }
 545                 entry = entry->next;
 546         }
 547
 548         return found ? 0 : -1;
 549 }
 550
 551
 552 /**
 553  * pmksa_cache_auth_list - Dump text list of entries in PMKSA cache
 554  * @pmksa: Pointer to PMKSA cache data from pmksa_cache_auth_init()
 555  * @buf: Buffer for the list
 556  * @len: Length of the buffer
 557  * Returns: Number of bytes written to buffer
 558  *
 559  * This function is used to generate a text format representation of the
 560  * current PMKSA cache contents for the ctrl_iface PMKSA command.
 561  */
 562 int pmksa_cache_auth_list(struct rsn_pmksa_cache *pmksa, char *buf, size_t len)
 563 {
 564         int i, ret;
 565         char *pos = buf;
 566         struct rsn_pmksa_cache_entry *entry;
 567         struct os_reltime now;
 568
 569         os_get_reltime(&now);
 570         ret = os_snprintf(pos, buf + len - pos,
 571                           "Index / SPA / PMKID / expiration (in seconds) / opportunistic\n");
 572         if (os_snprintf_error(buf + len - pos, ret))
 573                 return pos - buf;
 574         pos += ret;
 575         i = 0;
 576         entry = pmksa->pmksa;
 577         while (entry) {
 578                 ret = os_snprintf(pos, buf + len - pos, "%d " MACSTR " ",
 579                                   i, MAC2STR(entry->spa));
 580                 if (os_snprintf_error(buf + len - pos, ret))
 581                         return pos - buf;
 582                 pos += ret;
 583                 pos += wpa_snprintf_hex(pos, buf + len - pos, entry->pmkid,
 584                                         PMKID_LEN);
 585                 ret = os_snprintf(pos, buf + len - pos, " %d %d\n",
 586                                   (int) (entry->expiration - now.sec),
 587                                   entry->opportunistic);
 588                 if (os_snprintf_error(buf + len - pos, ret))
 589                         return pos - buf;
 590                 pos += ret;
 591                 entry = entry->next;
 592         }
 593         return pos - buf;
 594 }