wpa_supplicant/ibss_rsn.c

   1 /*
   2  * wpa_supplicant - IBSS RSN
   3  * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "l2_packet/l2_packet.h"
  19 #include "rsn_supp/wpa.h"
  20 #include "rsn_supp/wpa_ie.h"
  21 #include "ap/wpa_auth.h"
  22 #include "wpa_supplicant_i.h"
  23 #include "driver_i.h"
  24 #include "ibss_rsn.h"
  25
  26
  27 static struct ibss_rsn_peer * ibss_rsn_get_peer(struct ibss_rsn *ibss_rsn,
  28                                                 const u8 *addr)
  29 {
  30         struct ibss_rsn_peer *peer;
  31
  32         for (peer = ibss_rsn->peers; peer; peer = peer->next)
  33                 if (os_memcmp(addr, peer->addr, ETH_ALEN) == 0)
  34                         break;
  35         return peer;
  36 }
  37
  38
  39 static void ibss_rsn_free(struct ibss_rsn_peer *peer)
  40 {
  41         wpa_auth_sta_deinit(peer->auth);
  42         wpa_sm_deinit(peer->supp);
  43         os_free(peer);
  44 }
  45
  46
  47 static void supp_set_state(void *ctx, enum wpa_states state)
  48 {
  49         struct ibss_rsn_peer *peer = ctx;
  50         peer->supp_state = state;
  51 }
  52
  53
  54 static enum wpa_states supp_get_state(void *ctx)
  55 {
  56         struct ibss_rsn_peer *peer = ctx;
  57         return peer->supp_state;
  58 }
  59
  60
  61 static int supp_ether_send(void *ctx, const u8 *dest, u16 proto, const u8 *buf,
  62                            size_t len)
  63 {
  64         struct ibss_rsn_peer *peer = ctx;
  65         struct wpa_supplicant *wpa_s = peer->ibss_rsn->wpa_s;
  66
  67         wpa_printf(MSG_DEBUG, "SUPP: %s(dest=" MACSTR " proto=0x%04x "
  68                    "len=%lu)",
  69                    __func__, MAC2STR(dest), proto, (unsigned long) len);
  70
  71         if (wpa_s->l2)
  72                 return l2_packet_send(wpa_s->l2, dest, proto, buf, len);
  73
  74         return wpa_drv_send_eapol(wpa_s, dest, proto, buf, len);
  75 }
  76
  77
  78 static u8 * supp_alloc_eapol(void *ctx, u8 type, const void *data,
  79                              u16 data_len, size_t *msg_len, void **data_pos)
  80 {
  81         struct ieee802_1x_hdr *hdr;
  82
  83         wpa_printf(MSG_DEBUG, "SUPP: %s(type=%d data_len=%d)",
  84                    __func__, type, data_len);
  85
  86         *msg_len = sizeof(*hdr) + data_len;
  87         hdr = os_malloc(*msg_len);
  88         if (hdr == NULL)
  89                 return NULL;
  90
  91         hdr->version = 2;
  92         hdr->type = type;
  93         hdr->length = host_to_be16(data_len);
  94
  95         if (data)
  96                 os_memcpy(hdr + 1, data, data_len);
  97         else
  98                 os_memset(hdr + 1, 0, data_len);
  99
 100         if (data_pos)
 101                 *data_pos = hdr + 1;
 102
 103         return (u8 *) hdr;
 104 }
 105
 106
 107 static int supp_get_beacon_ie(void *ctx)
 108 {
 109         struct ibss_rsn_peer *peer = ctx;
 110
 111         wpa_printf(MSG_DEBUG, "SUPP: %s", __func__);
 112         /* TODO: get correct RSN IE */
 113         return wpa_sm_set_ap_rsn_ie(peer->supp,
 114                                     (u8 *) "\x30\x14\x01\x00"
 115                                     "\x00\x0f\xac\x04"
 116                                     "\x01\x00\x00\x0f\xac\x04"
 117                                     "\x01\x00\x00\x0f\xac\x02"
 118                                     "\x00\x00", 22);
 119 }
 120
 121
 122 static int supp_set_key(void *ctx, enum wpa_alg alg,
 123                         const u8 *addr, int key_idx, int set_tx,
 124                         const u8 *seq, size_t seq_len,
 125                         const u8 *key, size_t key_len)
 126 {
 127         struct ibss_rsn_peer *peer = ctx;
 128
 129         wpa_printf(MSG_DEBUG, "SUPP: %s(alg=%d addr=" MACSTR " key_idx=%d "
 130                    "set_tx=%d)",
 131                    __func__, alg, MAC2STR(addr), key_idx, set_tx);
 132         wpa_hexdump(MSG_DEBUG, "SUPP: set_key - seq", seq, seq_len);
 133         wpa_hexdump_key(MSG_DEBUG, "SUPP: set_key - key", key, key_len);
 134
 135         if (key_idx == 0) {
 136                 /*
 137                  * In IBSS RSN, the pairwise key from the 4-way handshake
 138                  * initiated by the peer with highest MAC address is used.
 139                  */
 140                 if (os_memcmp(peer->ibss_rsn->wpa_s->own_addr, peer->addr,
 141                               ETH_ALEN) > 0) {
 142                         wpa_printf(MSG_DEBUG, "SUPP: Do not use this PTK");
 143                         return 0;
 144                 }
 145         }
 146
 147         if (is_broadcast_ether_addr(addr))
 148                 addr = peer->addr;
 149         return wpa_drv_set_key(peer->ibss_rsn->wpa_s, alg, addr, key_idx,
 150                                set_tx, seq, seq_len, key, key_len);
 151 }
 152
 153
 154 static void * supp_get_network_ctx(void *ctx)
 155 {
 156         struct ibss_rsn_peer *peer = ctx;
 157         return wpa_supplicant_get_ssid(peer->ibss_rsn->wpa_s);
 158 }
 159
 160
 161 static int supp_mlme_setprotection(void *ctx, const u8 *addr,
 162                                    int protection_type, int key_type)
 163 {
 164         wpa_printf(MSG_DEBUG, "SUPP: %s(addr=" MACSTR " protection_type=%d "
 165                    "key_type=%d)",
 166                    __func__, MAC2STR(addr), protection_type, key_type);
 167         return 0;
 168 }
 169
 170
 171 static void supp_cancel_auth_timeout(void *ctx)
 172 {
 173         wpa_printf(MSG_DEBUG, "SUPP: %s", __func__);
 174 }
 175
 176
 177 static void supp_deauthenticate(void * ctx, int reason_code)
 178 {
 179         wpa_printf(MSG_DEBUG, "SUPP: %s (TODO)", __func__);
 180 }
 181
 182
 183 static int ibss_rsn_supp_init(struct ibss_rsn_peer *peer, const u8 *own_addr,
 184                               const u8 *psk)
 185 {
 186         struct wpa_sm_ctx *ctx = os_zalloc(sizeof(*ctx));
 187         if (ctx == NULL)
 188                 return -1;
 189
 190         ctx->ctx = peer;
 191         ctx->msg_ctx = peer->ibss_rsn->wpa_s;
 192         ctx->set_state = supp_set_state;
 193         ctx->get_state = supp_get_state;
 194         ctx->ether_send = supp_ether_send;
 195         ctx->get_beacon_ie = supp_get_beacon_ie;
 196         ctx->alloc_eapol = supp_alloc_eapol;
 197         ctx->set_key = supp_set_key;
 198         ctx->get_network_ctx = supp_get_network_ctx;
 199         ctx->mlme_setprotection = supp_mlme_setprotection;
 200         ctx->cancel_auth_timeout = supp_cancel_auth_timeout;
 201         ctx->deauthenticate = supp_deauthenticate;
 202         peer->supp = wpa_sm_init(ctx);
 203         if (peer->supp == NULL) {
 204                 wpa_printf(MSG_DEBUG, "SUPP: wpa_sm_init() failed");
 205                 return -1;
 206         }
 207
 208         wpa_sm_set_own_addr(peer->supp, own_addr);
 209         wpa_sm_set_param(peer->supp, WPA_PARAM_RSN_ENABLED, 1);
 210         wpa_sm_set_param(peer->supp, WPA_PARAM_PROTO, WPA_PROTO_RSN);
 211         wpa_sm_set_param(peer->supp, WPA_PARAM_PAIRWISE, WPA_CIPHER_CCMP);
 212         wpa_sm_set_param(peer->supp, WPA_PARAM_GROUP, WPA_CIPHER_CCMP);
 213         wpa_sm_set_param(peer->supp, WPA_PARAM_KEY_MGMT, WPA_KEY_MGMT_PSK);
 214         wpa_sm_set_pmk(peer->supp, psk, PMK_LEN);
 215
 216         peer->supp_ie_len = sizeof(peer->supp_ie);
 217         if (wpa_sm_set_assoc_wpa_ie_default(peer->supp, peer->supp_ie,
 218                                             &peer->supp_ie_len) < 0) {
 219                 wpa_printf(MSG_DEBUG, "SUPP: wpa_sm_set_assoc_wpa_ie_default()"
 220                            " failed");
 221                 return -1;
 222         }
 223
 224         wpa_sm_notify_assoc(peer->supp, peer->addr);
 225
 226         return 0;
 227 }
 228
 229
 230 static void auth_logger(void *ctx, const u8 *addr, logger_level level,
 231                         const char *txt)
 232 {
 233         if (addr)
 234                 wpa_printf(MSG_DEBUG, "AUTH: " MACSTR " - %s",
 235                            MAC2STR(addr), txt);
 236         else
 237                 wpa_printf(MSG_DEBUG, "AUTH: %s", txt);
 238 }
 239
 240
 241 static const u8 * auth_get_psk(void *ctx, const u8 *addr, const u8 *prev_psk)
 242 {
 243         struct ibss_rsn *ibss_rsn = ctx;
 244         wpa_printf(MSG_DEBUG, "AUTH: %s (addr=" MACSTR " prev_psk=%p)",
 245                    __func__, MAC2STR(addr), prev_psk);
 246         if (prev_psk)
 247                 return NULL;
 248         return ibss_rsn->psk;
 249 }
 250
 251
 252 static int auth_send_eapol(void *ctx, const u8 *addr, const u8 *data,
 253                            size_t data_len, int encrypt)
 254 {
 255         struct ibss_rsn *ibss_rsn = ctx;
 256         struct wpa_supplicant *wpa_s = ibss_rsn->wpa_s;
 257
 258         wpa_printf(MSG_DEBUG, "AUTH: %s(addr=" MACSTR " data_len=%lu "
 259                    "encrypt=%d)",
 260                    __func__, MAC2STR(addr), (unsigned long) data_len, encrypt);
 261
 262         if (wpa_s->l2)
 263                 return l2_packet_send(wpa_s->l2, addr, ETH_P_EAPOL, data,
 264                                       data_len);
 265
 266         return wpa_drv_send_eapol(wpa_s, addr, ETH_P_EAPOL, data, data_len);
 267 }
 268
 269
 270 static int auth_set_key(void *ctx, int vlan_id, enum wpa_alg alg,
 271                         const u8 *addr, int idx, u8 *key, size_t key_len)
 272 {
 273         struct ibss_rsn *ibss_rsn = ctx;
 274         u8 seq[6];
 275
 276         os_memset(seq, 0, sizeof(seq));
 277
 278         if (addr) {
 279                 wpa_printf(MSG_DEBUG, "AUTH: %s(alg=%d addr=" MACSTR
 280                            " key_idx=%d)",
 281                            __func__, alg, MAC2STR(addr), idx);
 282         } else {
 283                 wpa_printf(MSG_DEBUG, "AUTH: %s(alg=%d key_idx=%d)",
 284                            __func__, alg, idx);
 285         }
 286         wpa_hexdump_key(MSG_DEBUG, "AUTH: set_key - key", key, key_len);
 287
 288         if (idx == 0) {
 289                 /*
 290                  * In IBSS RSN, the pairwise key from the 4-way handshake
 291                  * initiated by the peer with highest MAC address is used.
 292                  */
 293                 if (addr == NULL ||
 294                     os_memcmp(ibss_rsn->wpa_s->own_addr, addr, ETH_ALEN) < 0) {
 295                         wpa_printf(MSG_DEBUG, "AUTH: Do not use this PTK");
 296                         return 0;
 297                 }
 298         }
 299
 300         return wpa_drv_set_key(ibss_rsn->wpa_s, alg, addr, idx,
 301                                1, seq, 6, key, key_len);
 302 }
 303
 304
 305 static int auth_for_each_sta(void *ctx, int (*cb)(struct wpa_state_machine *sm,
 306                                                   void *ctx),
 307                              void *cb_ctx)
 308 {
 309         struct ibss_rsn *ibss_rsn = ctx;
 310         struct ibss_rsn_peer *peer;
 311
 312         wpa_printf(MSG_DEBUG, "AUTH: for_each_sta");
 313
 314         for (peer = ibss_rsn->peers; peer; peer = peer->next) {
 315                 if (peer->auth && cb(peer->auth, cb_ctx))
 316                         return 1;
 317         }
 318
 319         return 0;
 320 }
 321
 322
 323 static int ibss_rsn_auth_init_group(struct ibss_rsn *ibss_rsn,
 324                                     const u8 *own_addr)
 325 {
 326         struct wpa_auth_config conf;
 327         struct wpa_auth_callbacks cb;
 328
 329         wpa_printf(MSG_DEBUG, "AUTH: Initializing group state machine");
 330
 331         os_memset(&conf, 0, sizeof(conf));
 332         conf.wpa = 2;
 333         conf.wpa_key_mgmt = WPA_KEY_MGMT_PSK;
 334         conf.wpa_pairwise = WPA_CIPHER_CCMP;
 335         conf.rsn_pairwise = WPA_CIPHER_CCMP;
 336         conf.wpa_group = WPA_CIPHER_CCMP;
 337         conf.eapol_version = 2;
 338         conf.wpa_group_rekey = 600;
 339
 340         os_memset(&cb, 0, sizeof(cb));
 341         cb.ctx = ibss_rsn;
 342         cb.logger = auth_logger;
 343         cb.send_eapol = auth_send_eapol;
 344         cb.get_psk = auth_get_psk;
 345         cb.set_key = auth_set_key;
 346         cb.for_each_sta = auth_for_each_sta;
 347
 348         ibss_rsn->auth_group = wpa_init(own_addr, &conf, &cb);
 349         if (ibss_rsn->auth_group == NULL) {
 350                 wpa_printf(MSG_DEBUG, "AUTH: wpa_init() failed");
 351                 return -1;
 352         }
 353
 354         wpa_init_keys(ibss_rsn->auth_group);
 355
 356         return 0;
 357 }
 358
 359
 360 static int ibss_rsn_auth_init(struct ibss_rsn *ibss_rsn,
 361                               struct ibss_rsn_peer *peer)
 362 {
 363         peer->auth = wpa_auth_sta_init(ibss_rsn->auth_group, peer->addr);
 364         if (peer->auth == NULL) {
 365                 wpa_printf(MSG_DEBUG, "AUTH: wpa_auth_sta_init() failed");
 366                 return -1;
 367         }
 368
 369         /* TODO: get peer RSN IE with Probe Request */
 370         if (wpa_validate_wpa_ie(ibss_rsn->auth_group, peer->auth,
 371                                 (u8 *) "\x30\x14\x01\x00"
 372                                 "\x00\x0f\xac\x04"
 373                                 "\x01\x00\x00\x0f\xac\x04"
 374                                 "\x01\x00\x00\x0f\xac\x02"
 375                                 "\x00\x00", 22, NULL, 0) !=
 376             WPA_IE_OK) {
 377                 wpa_printf(MSG_DEBUG, "AUTH: wpa_validate_wpa_ie() failed");
 378                 return -1;
 379         }
 380
 381         if (wpa_auth_sm_event(peer->auth, WPA_ASSOC))
 382                 return -1;
 383
 384         if (wpa_auth_sta_associated(ibss_rsn->auth_group, peer->auth))
 385                 return -1;
 386
 387         return 0;
 388 }
 389
 390
 391 int ibss_rsn_start(struct ibss_rsn *ibss_rsn, const u8 *addr)
 392 {
 393         struct ibss_rsn_peer *peer;
 394
 395         if (ibss_rsn == NULL)
 396                 return -1;
 397
 398         if (ibss_rsn_get_peer(ibss_rsn, addr)) {
 399                 wpa_printf(MSG_DEBUG, "RSN: IBSS Authenticator and Supplicant "
 400                            "for peer " MACSTR " already running",
 401                            MAC2STR(addr));
 402                 return 0;
 403         }
 404
 405         wpa_printf(MSG_DEBUG, "RSN: Starting IBSS Authenticator and "
 406                    "Supplicant for peer " MACSTR, MAC2STR(addr));
 407
 408         peer = os_zalloc(sizeof(*peer));
 409         if (peer == NULL)
 410                 return -1;
 411
 412         peer->ibss_rsn = ibss_rsn;
 413         os_memcpy(peer->addr, addr, ETH_ALEN);
 414
 415         if (ibss_rsn_supp_init(peer, ibss_rsn->wpa_s->own_addr, ibss_rsn->psk)
 416             < 0) {
 417                 ibss_rsn_free(peer);
 418                 return -1;
 419         }
 420
 421         if (ibss_rsn_auth_init(ibss_rsn, peer) < 0) {
 422                 ibss_rsn_free(peer);
 423                 return -1;
 424         }
 425
 426         peer->next = ibss_rsn->peers;
 427         ibss_rsn->peers = peer;
 428
 429         return 0;
 430 }
 431
 432
 433 void ibss_rsn_stop(struct ibss_rsn *ibss_rsn, const u8 *peermac)
 434 {
 435         struct ibss_rsn_peer *peer, *prev;
 436
 437         if (ibss_rsn == NULL)
 438                 return;
 439
 440         if (peermac == NULL) {
 441                 /* remove all peers */
 442                 wpa_printf(MSG_DEBUG, "%s: Remove all peers", __func__);
 443                 peer = ibss_rsn->peers;
 444                 while (peer) {
 445                         prev = peer;
 446                         peer = peer->next;
 447                         ibss_rsn_free(prev);
 448                         ibss_rsn->peers = peer;
 449                 }
 450         } else {
 451                 /* remove specific peer */
 452                 wpa_printf(MSG_DEBUG, "%s: Remove specific peer " MACSTR,
 453                            __func__, MAC2STR(peermac));
 454
 455                 for (prev = NULL, peer = ibss_rsn->peers; peer != NULL;
 456                      prev = peer, peer = peer->next) {
 457                         if (os_memcmp(peermac, peer->addr, ETH_ALEN) == 0) {
 458                                 if (prev == NULL)
 459                                         ibss_rsn->peers = peer->next;
 460                                 else
 461                                         prev->next = peer->next;
 462                                 ibss_rsn_free(peer);
 463                                 wpa_printf(MSG_DEBUG, "%s: Successfully "
 464                                            "removed a specific peer",
 465                                            __func__);
 466                                 break;
 467                         }
 468                 }
 469         }
 470 }
 471
 472
 473 struct ibss_rsn * ibss_rsn_init(struct wpa_supplicant *wpa_s)
 474 {
 475         struct ibss_rsn *ibss_rsn;
 476
 477         ibss_rsn = os_zalloc(sizeof(*ibss_rsn));
 478         if (ibss_rsn == NULL)
 479                 return NULL;
 480         ibss_rsn->wpa_s = wpa_s;
 481
 482         if (ibss_rsn_auth_init_group(ibss_rsn, wpa_s->own_addr) < 0) {
 483                 ibss_rsn_deinit(ibss_rsn);
 484                 return NULL;
 485         }
 486
 487         return ibss_rsn;
 488 }
 489
 490
 491 void ibss_rsn_deinit(struct ibss_rsn *ibss_rsn)
 492 {
 493         struct ibss_rsn_peer *peer, *prev;
 494
 495         if (ibss_rsn == NULL)
 496                 return;
 497
 498         peer = ibss_rsn->peers;
 499         while (peer) {
 500                 prev = peer;
 501                 peer = peer->next;
 502                 ibss_rsn_free(prev);
 503         }
 504
 505         wpa_deinit(ibss_rsn->auth_group);
 506         os_free(ibss_rsn);
 507
 508 }
 509
 510
 511 static int ibss_rsn_eapol_dst_supp(const u8 *buf, size_t len)
 512 {
 513         const struct ieee802_1x_hdr *hdr;
 514         const struct wpa_eapol_key *key;
 515         u16 key_info;
 516         size_t plen;
 517
 518         /* TODO: Support other EAPOL packets than just EAPOL-Key */
 519
 520         if (len < sizeof(*hdr) + sizeof(*key))
 521                 return -1;
 522
 523         hdr = (const struct ieee802_1x_hdr *) buf;
 524         key = (const struct wpa_eapol_key *) (hdr + 1);
 525         plen = be_to_host16(hdr->length);
 526
 527         if (hdr->version < EAPOL_VERSION) {
 528                 /* TODO: backwards compatibility */
 529         }
 530         if (hdr->type != IEEE802_1X_TYPE_EAPOL_KEY) {
 531                 wpa_printf(MSG_DEBUG, "RSN: EAPOL frame (type %u) discarded, "
 532                         "not a Key frame", hdr->type);
 533                 return -1;
 534         }
 535         if (plen > len - sizeof(*hdr) || plen < sizeof(*key)) {
 536                 wpa_printf(MSG_DEBUG, "RSN: EAPOL frame payload size %lu "
 537                            "invalid (frame size %lu)",
 538                            (unsigned long) plen, (unsigned long) len);
 539                 return -1;
 540         }
 541
 542         if (key->type != EAPOL_KEY_TYPE_RSN) {
 543                 wpa_printf(MSG_DEBUG, "RSN: EAPOL-Key type (%d) unknown, "
 544                            "discarded", key->type);
 545                 return -1;
 546         }
 547
 548         key_info = WPA_GET_BE16(key->key_info);
 549
 550         return !!(key_info & WPA_KEY_INFO_ACK);
 551 }
 552
 553
 554 static int ibss_rsn_process_rx_eapol(struct ibss_rsn *ibss_rsn,
 555                                      struct ibss_rsn_peer *peer,
 556                                      const u8 *buf, size_t len)
 557 {
 558         int supp;
 559         u8 *tmp;
 560
 561         supp = ibss_rsn_eapol_dst_supp(buf, len);
 562         if (supp < 0)
 563                 return -1;
 564
 565         tmp = os_malloc(len);
 566         if (tmp == NULL)
 567                 return -1;
 568         os_memcpy(tmp, buf, len);
 569         if (supp) {
 570                 wpa_printf(MSG_DEBUG, "RSN: IBSS RX EAPOL for Supplicant");
 571                 wpa_sm_rx_eapol(peer->supp, peer->addr, tmp, len);
 572         } else {
 573                 wpa_printf(MSG_DEBUG, "RSN: IBSS RX EAPOL for Authenticator");
 574                 wpa_receive(ibss_rsn->auth_group, peer->auth, tmp, len);
 575         }
 576         os_free(tmp);
 577
 578         return 1;
 579 }
 580
 581
 582 int ibss_rsn_rx_eapol(struct ibss_rsn *ibss_rsn, const u8 *src_addr,
 583                       const u8 *buf, size_t len)
 584 {
 585         struct ibss_rsn_peer *peer;
 586
 587         if (ibss_rsn == NULL)
 588                 return -1;
 589
 590         peer = ibss_rsn_get_peer(ibss_rsn, src_addr);
 591         if (peer)
 592                 return ibss_rsn_process_rx_eapol(ibss_rsn, peer, buf, len);
 593
 594         if (ibss_rsn_eapol_dst_supp(buf, len) > 0) {
 595                 /*
 596                  * Create new IBSS peer based on an EAPOL message from the peer
 597                  * Authenticator.
 598                  */
 599                 if (ibss_rsn_start(ibss_rsn, src_addr) < 0)
 600                         return -1;
 601                 return ibss_rsn_process_rx_eapol(ibss_rsn, ibss_rsn->peers,
 602                                                  buf, len);
 603         }
 604
 605         return 0;
 606 }
 607
 608
 609 void ibss_rsn_set_psk(struct ibss_rsn *ibss_rsn, const u8 *psk)
 610 {
 611         if (ibss_rsn == NULL)
 612                 return;
 613         os_memcpy(ibss_rsn->psk, psk, PMK_LEN);
 614 }