xref: /freebsd/contrib/wpa/src/common/ptksa_cache.c (revision 71e72c9e91c4b8007a4292e09669e8b549c29e97)

/*
 * RSN PTKSA cache implementation
 *
 * Copyright (C) 2019 Intel Corporation
 *
 * This software may be distributed under the terms of the BSD license.
 * See README for more details.
 */

#include "includes.h"
#include "utils/common.h"
#include "eloop.h"
#include "common/ptksa_cache.h"

#define PTKSA_CACHE_MAX_ENTRIES 16

struct ptksa_cache {
	struct dl_list ptksa;
	unsigned int n_ptksa;
};

#ifdef CONFIG_PTKSA_CACHE

static void ptksa_cache_set_expiration(struct ptksa_cache *ptksa);


static void ptksa_cache_free_entry(struct ptksa_cache *ptksa,
				   struct ptksa_cache_entry *entry)
{
	ptksa->n_ptksa--;

	dl_list_del(&entry->list);
	bin_clear_free(entry, sizeof(*entry));
}


static void ptksa_cache_expire(void *eloop_ctx, void *timeout_ctx)
{
	struct ptksa_cache *ptksa = eloop_ctx;
	struct ptksa_cache_entry *e, *next;
	struct os_reltime now;
	struct dl_list expired;

	if (!ptksa)
		return;

	os_get_reltime(&now);
	dl_list_init(&expired);

	/*
	 * Move expired entries from the main ptksa list to a temporary
	 * 'expired' list. This prevents issues if the callback (e->cb)
	 * triggers operations like ptksa_cache_flush(), which would iterate
	 * over ptksa->ptksa. By removing entries first, flush operations
	 * will not double-process or double-free these entries.
	 */
	dl_list_for_each_safe(e, next, &ptksa->ptksa,
			      struct ptksa_cache_entry, list) {
		if (e->expiration > now.sec)
			continue;

		wpa_printf(MSG_DEBUG, "Expired PTKSA cache entry for " MACSTR,
			   MAC2STR(e->addr));

		dl_list_del(&e->list);
		ptksa->n_ptksa--;
		dl_list_add_tail(&expired, &e->list);
	}

	dl_list_for_each_safe(e, next, &expired,
			      struct ptksa_cache_entry, list) {
		dl_list_del(&e->list);
		if (e->cb && e->ctx)
			e->cb(e);
		bin_clear_free(e, sizeof(*e));
	}

	ptksa_cache_set_expiration(ptksa);
}


static void ptksa_cache_set_expiration(struct ptksa_cache *ptksa)
{
	struct ptksa_cache_entry *e;
	int sec;
	struct os_reltime now;

	eloop_cancel_timeout(ptksa_cache_expire, ptksa, NULL);

	if (!ptksa || !ptksa->n_ptksa)
		return;

	e = dl_list_first(&ptksa->ptksa, struct ptksa_cache_entry, list);
	if (!e)
		return;

	os_get_reltime(&now);
	sec = e->expiration - now.sec;
	if (sec < 0)
		sec = 0;

	eloop_register_timeout(sec + 1, 0, ptksa_cache_expire, ptksa, NULL);
}


/*
 * ptksa_cache_init - Initialize PTKSA cache
 *
 * Returns: Pointer to PTKSA cache data or %NULL on failure
 */
struct ptksa_cache * ptksa_cache_init(void)
{
	struct ptksa_cache *ptksa = os_zalloc(sizeof(struct ptksa_cache));

	wpa_printf(MSG_DEBUG, "PTKSA: Initializing");

	if (ptksa)
		dl_list_init(&ptksa->ptksa);

	return ptksa;
}


/*
 * ptksa_cache_deinit - Free all entries in PTKSA cache
 * @ptksa: Pointer to PTKSA cache data from ptksa_cache_init()
 */
void ptksa_cache_deinit(struct ptksa_cache *ptksa)
{
	struct ptksa_cache_entry *e, *next;

	if (!ptksa)
		return;

	wpa_printf(MSG_DEBUG, "PTKSA: Deinit. n_ptksa=%u", ptksa->n_ptksa);

	dl_list_for_each_safe(e, next, &ptksa->ptksa,
			      struct ptksa_cache_entry, list)
		ptksa_cache_free_entry(ptksa, e);

	eloop_cancel_timeout(ptksa_cache_expire, ptksa, NULL);
	os_free(ptksa);
}


/*
 * ptksa_cache_get - Fetch a PTKSA cache entry
 * @ptksa: Pointer to PTKSA cache data from ptksa_cache_init()
 * @addr: Peer address or %NULL to match any
 * @cipher: Specific cipher suite to search for or WPA_CIPHER_NONE for any
 * Returns: Pointer to PTKSA cache entry or %NULL if no match was found
 */
struct ptksa_cache_entry * ptksa_cache_get(struct ptksa_cache *ptksa,
					   const u8 *addr, u32 cipher)
{
	struct ptksa_cache_entry *e;

	if (!ptksa)
		return NULL;

	dl_list_for_each(e, &ptksa->ptksa, struct ptksa_cache_entry, list) {
		if ((!addr || ether_addr_equal(e->addr, addr)) &&
		    (cipher == WPA_CIPHER_NONE || cipher == e->cipher))
			return e;
	}

	return NULL;
}


/*
 * ptksa_cache_list - Dump text list of entries in PTKSA cache
 * @ptksa: Pointer to PTKSA cache data from ptksa_cache_init()
 * @buf: Buffer for the list
 * @len: Length of the buffer
 * Returns: Number of bytes written to buffer
 *
 * This function is used to generate a text format representation of the
 * current PTKSA cache contents for the ctrl_iface PTKSA command.
 */
int ptksa_cache_list(struct ptksa_cache *ptksa, char *buf, size_t len)
{
	struct ptksa_cache_entry *e;
	int i = 0, ret;
	char *pos = buf;
	struct os_reltime now;

	if (!ptksa)
		return 0;

	os_get_reltime(&now);

	ret = os_snprintf(pos, buf + len - pos,
			  "Index / ADDR / Cipher / expiration (secs) / TK / KDK\n");
	if (os_snprintf_error(buf + len - pos, ret))
		return pos - buf;
	pos += ret;

	dl_list_for_each(e, &ptksa->ptksa, struct ptksa_cache_entry, list) {
		ret = os_snprintf(pos, buf + len - pos, "%u " MACSTR,
				  i, MAC2STR(e->addr));
		if (os_snprintf_error(buf + len - pos, ret))
			return pos - buf;
		pos += ret;

		ret = os_snprintf(pos, buf + len - pos, " %s %lu ",
				  wpa_cipher_txt(e->cipher),
				  e->expiration - now.sec);
		if (os_snprintf_error(buf + len - pos, ret))
			return pos - buf;
		pos += ret;

		ret = wpa_snprintf_hex(pos, buf + len - pos, e->ptk.tk,
				       e->ptk.tk_len);
		if (os_snprintf_error(buf + len - pos, ret))
			return pos - buf;
		pos += ret;

		ret = os_snprintf(pos, buf + len - pos, " ");
		if (os_snprintf_error(buf + len - pos, ret))
			return pos - buf;
		pos += ret;

		ret = wpa_snprintf_hex(pos, buf + len - pos, e->ptk.kdk,
				       e->ptk.kdk_len);
		if (os_snprintf_error(buf + len - pos, ret))
			return pos - buf;
		pos += ret;

		ret = os_snprintf(pos, buf + len - pos, "\n");
		if (os_snprintf_error(buf + len - pos, ret))
			return pos - buf;
		pos += ret;

		i++;
	}

	return pos - buf;
}


/*
 * ptksa_cache_flush - Flush PTKSA cache entries
 *
 * @ptksa: Pointer to PTKSA cache data from ptksa_cache_init()
 * @addr: Peer address or %NULL to match any
 * @cipher: Specific cipher suite to search for or WPA_CIPHER_NONE for any
 */
void ptksa_cache_flush(struct ptksa_cache *ptksa, const u8 *addr, u32 cipher)
{
	struct ptksa_cache_entry *e, *next;
	bool removed = false;

	if (!ptksa)
		return;

	dl_list_for_each_safe(e, next, &ptksa->ptksa, struct ptksa_cache_entry,
			      list) {
		if ((!addr || ether_addr_equal(e->addr, addr)) &&
		    (cipher == WPA_CIPHER_NONE || cipher == e->cipher)) {
			wpa_printf(MSG_DEBUG,
				   "Flush PTKSA cache entry for " MACSTR,
				   MAC2STR(e->addr));

			ptksa_cache_free_entry(ptksa, e);
			removed = true;
		}
	}

	if (removed)
		ptksa_cache_set_expiration(ptksa);
}


/*
 * ptksa_cache_add - Add a PTKSA cache entry
 * @ptksa: Pointer to PTKSA cache data from ptksa_cache_init()
 * @own_addr: Own MAC address
 * @addr: Peer address
 * @cipher: The cipher used
 * @life_time: The PTK life time in seconds
 * @ptk: The PTK
 * @life_time_expiry_cb: Callback for alternative expiration handling
 * @ctx: Context pointer to save into e->ctx for the callback
 * @akmp: The key management mechanism that was used to derive the PTK
 * @auth_alg: The authentication algorithm that was used to derive the PTK
 * Returns: Pointer to the added PTKSA cache entry or %NULL on error
 *
 * This function creates a PTKSA entry and adds it to the PTKSA cache.
 * If an old entry is already in the cache for the same peer and cipher
 * this entry will be replaced with the new entry.
 */
struct ptksa_cache_entry * ptksa_cache_add(struct ptksa_cache *ptksa,
					   const u8 *own_addr,
					   const u8 *addr, u32 cipher,
					   u32 life_time,
					   const struct wpa_ptk *ptk,
					   void (*life_time_expiry_cb)
					   (struct ptksa_cache_entry *e),
					   void *ctx, u32 akmp, u16 auth_alg)
{
	struct ptksa_cache_entry *entry, *tmp, *tmp2 = NULL;
	struct os_reltime now;
	bool set_expiry = false;

	if (!ptksa || !ptk || !addr || !life_time || cipher == WPA_CIPHER_NONE)
		return NULL;

	/* remove a previous entry if present */
	ptksa_cache_flush(ptksa, addr, cipher);

	/* no place to add another entry */
	if (ptksa->n_ptksa >= PTKSA_CACHE_MAX_ENTRIES)
		return NULL;

	entry = os_zalloc(sizeof(*entry));
	if (!entry)
		return NULL;

	dl_list_init(&entry->list);
	os_memcpy(entry->addr, addr, ETH_ALEN);
	entry->cipher = cipher;
	entry->cb = life_time_expiry_cb;
	entry->ctx = ctx;
	entry->akmp = akmp;
	entry->auth_alg = auth_alg;

	if (own_addr)
		os_memcpy(entry->own_addr, own_addr, ETH_ALEN);

	os_memcpy(&entry->ptk, ptk, sizeof(entry->ptk));

	os_get_reltime(&now);
	entry->expiration = now.sec + life_time;

	dl_list_for_each(tmp, &ptksa->ptksa, struct ptksa_cache_entry, list) {
		if (tmp->expiration > entry->expiration) {
			tmp2 = tmp;
			break;
		}
	}

	if (dl_list_empty(&entry->list))
		set_expiry = true;
	/*
	 * If the expiration is later then all other or the list is empty
	 * entries, add it to the end of the list;
	 * otherwise add it before the relevant entry.
	 */
	if (tmp2)
		dl_list_add(&tmp2->list, &entry->list);
	else
		dl_list_add_tail(&ptksa->ptksa, &entry->list);

	ptksa->n_ptksa++;
	wpa_printf(MSG_DEBUG,
		   "Added PTKSA cache entry addr=" MACSTR " cipher=%u",
		   MAC2STR(addr), cipher);

	if (set_expiry)
		ptksa_cache_set_expiration(ptksa);

	return entry;
}

#else /* CONFIG_PTKSA_CACHE */

struct ptksa_cache * ptksa_cache_init(void)
{
	return (struct ptksa_cache *) 1;
}


void ptksa_cache_deinit(struct ptksa_cache *ptksa)
{
}


struct ptksa_cache_entry *
ptksa_cache_get(struct ptksa_cache *ptksa, const u8 *addr, u32 cipher)
{
	return NULL;
}


int ptksa_cache_list(struct ptksa_cache *ptksa, char *buf, size_t len)
{
	return -1;
}


struct ptksa_cache_entry *
ptksa_cache_add(struct ptksa_cache *ptksa, const u8 *own_addr, const u8 *addr,
		u32 cipher, u32 life_time, const struct wpa_ptk *ptk,
		void (*cb)(struct ptksa_cache_entry *e), void *ctx, u32 akmp,
		u16 auth_alg)
{
	return NULL;
}


void ptksa_cache_flush(struct ptksa_cache *ptksa, const u8 *addr, u32 cipher)
{
}

#endif /* CONFIG_PTKSA_CACHE */