1 /* 2 * wpa_supplicant - IBSS RSN 3 * Copyright (c) 2009-2013, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 11 #include "common.h" 12 #include "common/wpa_ctrl.h" 13 #include "utils/eloop.h" 14 #include "l2_packet/l2_packet.h" 15 #include "rsn_supp/wpa.h" 16 #include "rsn_supp/wpa_ie.h" 17 #include "ap/wpa_auth.h" 18 #include "wpa_supplicant_i.h" 19 #include "driver_i.h" 20 #include "common/ieee802_11_defs.h" 21 #include "ibss_rsn.h" 22 23 24 static void ibss_rsn_auth_timeout(void *eloop_ctx, void *timeout_ctx); 25 26 27 static struct ibss_rsn_peer * ibss_rsn_get_peer(struct ibss_rsn *ibss_rsn, 28 const u8 *addr) 29 { 30 struct ibss_rsn_peer *peer; 31 32 for (peer = ibss_rsn->peers; peer; peer = peer->next) 33 if (ether_addr_equal(addr, peer->addr)) 34 break; 35 return peer; 36 } 37 38 39 static void ibss_rsn_free(struct ibss_rsn_peer *peer) 40 { 41 eloop_cancel_timeout(ibss_rsn_auth_timeout, peer, NULL); 42 wpa_auth_sta_deinit(peer->auth); 43 wpa_sm_deinit(peer->supp); 44 os_free(peer); 45 } 46 47 48 static void supp_set_state(void *ctx, enum wpa_states state) 49 { 50 struct ibss_rsn_peer *peer = ctx; 51 peer->supp_state = state; 52 } 53 54 55 static enum wpa_states supp_get_state(void *ctx) 56 { 57 struct ibss_rsn_peer *peer = ctx; 58 return peer->supp_state; 59 } 60 61 62 static int supp_ether_send(void *ctx, const u8 *dest, u16 proto, const u8 *buf, 63 size_t len) 64 { 65 struct ibss_rsn_peer *peer = ctx; 66 struct wpa_supplicant *wpa_s = peer->ibss_rsn->wpa_s; 67 int encrypt = peer->authentication_status & IBSS_RSN_REPORTED_PTK; 68 69 wpa_printf(MSG_DEBUG, "SUPP: %s(dest=" MACSTR 70 " proto=0x%04x len=%lu no_encrypt=%d)", 71 __func__, MAC2STR(dest), proto, (unsigned long) len, 72 !encrypt); 73 74 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_CONTROL_PORT) 75 return wpa_drv_tx_control_port(wpa_s, dest, proto, buf, len, 76 !encrypt); 77 78 if (wpa_s->l2) 79 return l2_packet_send(wpa_s->l2, dest, proto, buf, len); 80 81 return -1; 82 } 83 84 85 static u8 * supp_alloc_eapol(void *ctx, u8 type, const void *data, 86 u16 data_len, size_t *msg_len, void **data_pos) 87 { 88 struct ieee802_1x_hdr *hdr; 89 90 wpa_printf(MSG_DEBUG, "SUPP: %s(type=%d data_len=%d)", 91 __func__, type, data_len); 92 93 *msg_len = sizeof(*hdr) + data_len; 94 hdr = os_malloc(*msg_len); 95 if (hdr == NULL) 96 return NULL; 97 98 hdr->version = 2; 99 hdr->type = type; 100 hdr->length = host_to_be16(data_len); 101 102 if (data) 103 os_memcpy(hdr + 1, data, data_len); 104 else 105 os_memset(hdr + 1, 0, data_len); 106 107 if (data_pos) 108 *data_pos = hdr + 1; 109 110 return (u8 *) hdr; 111 } 112 113 114 static int supp_get_beacon_ie(void *ctx) 115 { 116 struct ibss_rsn_peer *peer = ctx; 117 118 wpa_printf(MSG_DEBUG, "SUPP: %s", __func__); 119 /* TODO: get correct RSN IE */ 120 wpa_sm_set_ap_rsnxe(peer->supp, NULL, 0); 121 return wpa_sm_set_ap_rsn_ie(peer->supp, 122 (u8 *) "\x30\x14\x01\x00" 123 "\x00\x0f\xac\x04" 124 "\x01\x00\x00\x0f\xac\x04" 125 "\x01\x00\x00\x0f\xac\x02" 126 "\x00\x00", 22); 127 } 128 129 130 static void ibss_check_rsn_completed(struct ibss_rsn_peer *peer) 131 { 132 struct wpa_supplicant *wpa_s = peer->ibss_rsn->wpa_s; 133 134 if ((peer->authentication_status & 135 (IBSS_RSN_SET_PTK_SUPP | IBSS_RSN_SET_PTK_AUTH)) != 136 (IBSS_RSN_SET_PTK_SUPP | IBSS_RSN_SET_PTK_AUTH)) 137 return; 138 if (peer->authentication_status & IBSS_RSN_REPORTED_PTK) 139 return; 140 peer->authentication_status |= IBSS_RSN_REPORTED_PTK; 141 wpa_msg(wpa_s, MSG_INFO, IBSS_RSN_COMPLETED MACSTR, 142 MAC2STR(peer->addr)); 143 } 144 145 146 static int supp_set_key(void *ctx, int link_id, enum wpa_alg alg, 147 const u8 *addr, int key_idx, int set_tx, 148 const u8 *seq, size_t seq_len, 149 const u8 *key, size_t key_len, enum key_flag key_flag) 150 { 151 struct ibss_rsn_peer *peer = ctx; 152 153 wpa_printf(MSG_DEBUG, "SUPP: %s(alg=%d addr=" MACSTR " key_idx=%d " 154 "set_tx=%d)", 155 __func__, alg, MAC2STR(addr), key_idx, set_tx); 156 wpa_hexdump(MSG_DEBUG, "SUPP: set_key - seq", seq, seq_len); 157 wpa_hexdump_key(MSG_DEBUG, "SUPP: set_key - key", key, key_len); 158 159 if (key_idx == 0) { 160 peer->authentication_status |= IBSS_RSN_SET_PTK_SUPP; 161 ibss_check_rsn_completed(peer); 162 /* 163 * In IBSS RSN, the pairwise key from the 4-way handshake 164 * initiated by the peer with highest MAC address is used. 165 */ 166 if (os_memcmp(peer->ibss_rsn->wpa_s->own_addr, peer->addr, 167 ETH_ALEN) > 0) { 168 wpa_printf(MSG_DEBUG, "SUPP: Do not use this PTK"); 169 return 0; 170 } 171 } 172 173 if (is_broadcast_ether_addr(addr)) 174 addr = peer->addr; 175 return wpa_drv_set_key(peer->ibss_rsn->wpa_s, link_id, alg, addr, 176 key_idx, set_tx, seq, seq_len, key, key_len, 177 key_flag); 178 } 179 180 181 static void * supp_get_network_ctx(void *ctx) 182 { 183 struct ibss_rsn_peer *peer = ctx; 184 return wpa_supplicant_get_ssid(peer->ibss_rsn->wpa_s); 185 } 186 187 188 static int supp_mlme_setprotection(void *ctx, const u8 *addr, 189 int protection_type, int key_type) 190 { 191 wpa_printf(MSG_DEBUG, "SUPP: %s(addr=" MACSTR " protection_type=%d " 192 "key_type=%d)", 193 __func__, MAC2STR(addr), protection_type, key_type); 194 return 0; 195 } 196 197 198 static void supp_cancel_auth_timeout(void *ctx) 199 { 200 wpa_printf(MSG_DEBUG, "SUPP: %s", __func__); 201 } 202 203 204 static void supp_deauthenticate(void *ctx, u16 reason_code) 205 { 206 wpa_printf(MSG_DEBUG, "SUPP: %s (TODO)", __func__); 207 } 208 209 210 static void supp_reconnect(void *ctx) 211 { 212 wpa_printf(MSG_DEBUG, "SUPP: %s (TODO)", __func__); 213 } 214 215 216 static int ibss_rsn_supp_init(struct ibss_rsn_peer *peer, const u8 *own_addr, 217 const u8 *psk) 218 { 219 struct wpa_sm_ctx *ctx = os_zalloc(sizeof(*ctx)); 220 if (ctx == NULL) 221 return -1; 222 223 ctx->ctx = peer; 224 ctx->msg_ctx = peer->ibss_rsn->wpa_s; 225 ctx->set_state = supp_set_state; 226 ctx->get_state = supp_get_state; 227 ctx->ether_send = supp_ether_send; 228 ctx->get_beacon_ie = supp_get_beacon_ie; 229 ctx->alloc_eapol = supp_alloc_eapol; 230 ctx->set_key = supp_set_key; 231 ctx->get_network_ctx = supp_get_network_ctx; 232 ctx->mlme_setprotection = supp_mlme_setprotection; 233 ctx->cancel_auth_timeout = supp_cancel_auth_timeout; 234 ctx->deauthenticate = supp_deauthenticate; 235 ctx->reconnect = supp_reconnect; 236 peer->supp = wpa_sm_init(ctx); 237 if (peer->supp == NULL) { 238 wpa_printf(MSG_DEBUG, "SUPP: wpa_sm_init() failed"); 239 os_free(ctx); 240 return -1; 241 } 242 243 wpa_sm_set_own_addr(peer->supp, own_addr); 244 wpa_sm_set_param(peer->supp, WPA_PARAM_RSN_ENABLED, 1); 245 wpa_sm_set_param(peer->supp, WPA_PARAM_PROTO, WPA_PROTO_RSN); 246 wpa_sm_set_param(peer->supp, WPA_PARAM_PAIRWISE, WPA_CIPHER_CCMP); 247 wpa_sm_set_param(peer->supp, WPA_PARAM_GROUP, WPA_CIPHER_CCMP); 248 wpa_sm_set_param(peer->supp, WPA_PARAM_KEY_MGMT, WPA_KEY_MGMT_PSK); 249 wpa_sm_set_pmk(peer->supp, psk, PMK_LEN, NULL, NULL); 250 251 peer->supp_ie_len = sizeof(peer->supp_ie); 252 if (wpa_sm_set_assoc_wpa_ie_default(peer->supp, peer->supp_ie, 253 &peer->supp_ie_len) < 0) { 254 wpa_printf(MSG_DEBUG, "SUPP: wpa_sm_set_assoc_wpa_ie_default()" 255 " failed"); 256 return -1; 257 } 258 259 wpa_sm_notify_assoc(peer->supp, peer->addr); 260 261 return 0; 262 } 263 264 265 static void auth_logger(void *ctx, const u8 *addr, logger_level level, 266 const char *txt) 267 { 268 if (addr) 269 wpa_printf(MSG_DEBUG, "AUTH: " MACSTR " - %s", 270 MAC2STR(addr), txt); 271 else 272 wpa_printf(MSG_DEBUG, "AUTH: %s", txt); 273 } 274 275 276 static const u8 * auth_get_psk(void *ctx, const u8 *addr, 277 const u8 *p2p_dev_addr, const u8 *prev_psk, 278 size_t *psk_len, int *vlan_id) 279 { 280 struct ibss_rsn *ibss_rsn = ctx; 281 282 if (psk_len) 283 *psk_len = PMK_LEN; 284 if (vlan_id) 285 *vlan_id = 0; 286 wpa_printf(MSG_DEBUG, "AUTH: %s (addr=" MACSTR " prev_psk=%p)", 287 __func__, MAC2STR(addr), prev_psk); 288 if (prev_psk) 289 return NULL; 290 return ibss_rsn->psk; 291 } 292 293 294 static int auth_send_eapol(void *ctx, const u8 *addr, const u8 *data, 295 size_t data_len, int encrypt) 296 { 297 struct ibss_rsn *ibss_rsn = ctx; 298 struct wpa_supplicant *wpa_s = ibss_rsn->wpa_s; 299 300 wpa_printf(MSG_DEBUG, "AUTH: %s(addr=" MACSTR " data_len=%lu " 301 "encrypt=%d)", 302 __func__, MAC2STR(addr), (unsigned long) data_len, encrypt); 303 304 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_CONTROL_PORT) 305 return wpa_drv_tx_control_port(wpa_s, addr, ETH_P_EAPOL, 306 data, data_len, !encrypt); 307 308 if (wpa_s->l2) 309 return l2_packet_send(wpa_s->l2, addr, ETH_P_EAPOL, data, 310 data_len); 311 312 return -1; 313 } 314 315 316 static int auth_set_key(void *ctx, int vlan_id, enum wpa_alg alg, 317 const u8 *addr, int idx, u8 *key, size_t key_len, 318 enum key_flag key_flag) 319 { 320 struct ibss_rsn *ibss_rsn = ctx; 321 u8 seq[6]; 322 323 os_memset(seq, 0, sizeof(seq)); 324 325 if (addr) { 326 wpa_printf(MSG_DEBUG, "AUTH: %s(alg=%d addr=" MACSTR 327 " key_idx=%d)", 328 __func__, alg, MAC2STR(addr), idx); 329 } else { 330 wpa_printf(MSG_DEBUG, "AUTH: %s(alg=%d key_idx=%d)", 331 __func__, alg, idx); 332 } 333 wpa_hexdump_key(MSG_DEBUG, "AUTH: set_key - key", key, key_len); 334 335 if (idx == 0) { 336 if (addr) { 337 struct ibss_rsn_peer *peer; 338 peer = ibss_rsn_get_peer(ibss_rsn, addr); 339 if (peer) { 340 peer->authentication_status |= 341 IBSS_RSN_SET_PTK_AUTH; 342 ibss_check_rsn_completed(peer); 343 } 344 } 345 /* 346 * In IBSS RSN, the pairwise key from the 4-way handshake 347 * initiated by the peer with highest MAC address is used. 348 */ 349 if (addr == NULL || 350 os_memcmp(ibss_rsn->wpa_s->own_addr, addr, ETH_ALEN) < 0) { 351 wpa_printf(MSG_DEBUG, "AUTH: Do not use this PTK"); 352 return 0; 353 } 354 } 355 356 return wpa_drv_set_key(ibss_rsn->wpa_s, -1, alg, addr, idx, 357 1, seq, 6, key, key_len, key_flag); 358 } 359 360 361 static void ibss_rsn_disconnect(void *ctx, const u8 *addr, u16 reason) 362 { 363 struct ibss_rsn *ibss_rsn = ctx; 364 wpa_drv_sta_deauth(ibss_rsn->wpa_s, addr, reason); 365 } 366 367 368 static int auth_for_each_sta(void *ctx, int (*cb)(struct wpa_state_machine *sm, 369 void *ctx), 370 void *cb_ctx) 371 { 372 struct ibss_rsn *ibss_rsn = ctx; 373 struct ibss_rsn_peer *peer; 374 375 wpa_printf(MSG_DEBUG, "AUTH: for_each_sta"); 376 377 for (peer = ibss_rsn->peers; peer; peer = peer->next) { 378 if (peer->auth && cb(peer->auth, cb_ctx)) 379 return 1; 380 } 381 382 return 0; 383 } 384 385 386 static void ibss_set_sta_authorized(struct ibss_rsn *ibss_rsn, 387 struct ibss_rsn_peer *peer, int authorized) 388 { 389 int res; 390 391 if (authorized) { 392 res = wpa_drv_sta_set_flags(ibss_rsn->wpa_s, peer->addr, 393 WPA_STA_AUTHORIZED, 394 WPA_STA_AUTHORIZED, ~0); 395 wpa_printf(MSG_DEBUG, "AUTH: " MACSTR " authorizing port", 396 MAC2STR(peer->addr)); 397 } else { 398 res = wpa_drv_sta_set_flags(ibss_rsn->wpa_s, peer->addr, 399 0, 0, ~WPA_STA_AUTHORIZED); 400 wpa_printf(MSG_DEBUG, "AUTH: " MACSTR " unauthorizing port", 401 MAC2STR(peer->addr)); 402 } 403 404 if (res && errno != ENOENT) { 405 wpa_printf(MSG_DEBUG, "Could not set station " MACSTR " flags " 406 "for kernel driver (errno=%d)", 407 MAC2STR(peer->addr), errno); 408 } 409 } 410 411 412 static void auth_set_eapol(void *ctx, const u8 *addr, 413 wpa_eapol_variable var, int value) 414 { 415 struct ibss_rsn *ibss_rsn = ctx; 416 struct ibss_rsn_peer *peer = ibss_rsn_get_peer(ibss_rsn, addr); 417 418 if (peer == NULL) 419 return; 420 421 switch (var) { 422 case WPA_EAPOL_authorized: 423 ibss_set_sta_authorized(ibss_rsn, peer, value); 424 break; 425 default: 426 /* do not handle any other event */ 427 wpa_printf(MSG_DEBUG, "AUTH: eapol event not handled %d", var); 428 break; 429 } 430 } 431 432 433 static int ibss_rsn_auth_init_group(struct ibss_rsn *ibss_rsn, 434 const u8 *own_addr, struct wpa_ssid *ssid) 435 { 436 struct wpa_auth_config conf; 437 static const struct wpa_auth_callbacks cb = { 438 .logger = auth_logger, 439 .set_eapol = auth_set_eapol, 440 .send_eapol = auth_send_eapol, 441 .get_psk = auth_get_psk, 442 .set_key = auth_set_key, 443 .for_each_sta = auth_for_each_sta, 444 .disconnect = ibss_rsn_disconnect, 445 }; 446 447 wpa_printf(MSG_DEBUG, "AUTH: Initializing group state machine"); 448 449 os_memset(&conf, 0, sizeof(conf)); 450 conf.wpa = 2; 451 conf.wpa_key_mgmt = WPA_KEY_MGMT_PSK; 452 conf.wpa_pairwise = WPA_CIPHER_CCMP; 453 conf.rsn_pairwise = WPA_CIPHER_CCMP; 454 conf.wpa_group = WPA_CIPHER_CCMP; 455 conf.eapol_version = 2; 456 conf.wpa_group_rekey = ssid->group_rekey ? ssid->group_rekey : 600; 457 conf.wpa_group_update_count = 4; 458 conf.wpa_pairwise_update_count = 4; 459 460 ibss_rsn->auth_group = wpa_init(own_addr, &conf, &cb, ibss_rsn); 461 if (ibss_rsn->auth_group == NULL) { 462 wpa_printf(MSG_DEBUG, "AUTH: wpa_init() failed"); 463 return -1; 464 } 465 466 wpa_init_keys(ibss_rsn->auth_group); 467 468 return 0; 469 } 470 471 472 static int ibss_rsn_auth_init(struct ibss_rsn *ibss_rsn, 473 struct ibss_rsn_peer *peer) 474 { 475 peer->auth = wpa_auth_sta_init(ibss_rsn->auth_group, peer->addr, NULL); 476 if (peer->auth == NULL) { 477 wpa_printf(MSG_DEBUG, "AUTH: wpa_auth_sta_init() failed"); 478 return -1; 479 } 480 481 /* TODO: get peer RSN IE with Probe Request */ 482 if (wpa_validate_wpa_ie(ibss_rsn->auth_group, peer->auth, 0, 483 (u8 *) "\x30\x14\x01\x00" 484 "\x00\x0f\xac\x04" 485 "\x01\x00\x00\x0f\xac\x04" 486 "\x01\x00\x00\x0f\xac\x02" 487 "\x00\x00", 22, NULL, 0, NULL, 0, NULL, 0, 488 NULL) != WPA_IE_OK) { 489 wpa_printf(MSG_DEBUG, "AUTH: wpa_validate_wpa_ie() failed"); 490 return -1; 491 } 492 493 if (wpa_auth_sm_event(peer->auth, WPA_ASSOC)) 494 return -1; 495 496 if (wpa_auth_sta_associated(ibss_rsn->auth_group, peer->auth)) 497 return -1; 498 499 return 0; 500 } 501 502 503 static int ibss_rsn_send_auth(struct ibss_rsn *ibss_rsn, const u8 *da, int seq) 504 { 505 struct ieee80211_mgmt auth; 506 const size_t auth_length = IEEE80211_HDRLEN + sizeof(auth.u.auth); 507 struct wpa_supplicant *wpa_s = ibss_rsn->wpa_s; 508 509 os_memset(&auth, 0, sizeof(auth)); 510 511 auth.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, 512 WLAN_FC_STYPE_AUTH); 513 os_memcpy(auth.da, da, ETH_ALEN); 514 os_memcpy(auth.sa, wpa_s->own_addr, ETH_ALEN); 515 os_memcpy(auth.bssid, wpa_s->bssid, ETH_ALEN); 516 517 auth.u.auth.auth_alg = host_to_le16(WLAN_AUTH_OPEN); 518 auth.u.auth.auth_transaction = host_to_le16(seq); 519 auth.u.auth.status_code = host_to_le16(WLAN_STATUS_SUCCESS); 520 521 wpa_printf(MSG_DEBUG, "RSN: IBSS TX Auth frame (SEQ %d) to " MACSTR, 522 seq, MAC2STR(da)); 523 524 return wpa_drv_send_mlme(wpa_s, (u8 *) &auth, auth_length, 0, 0, 0); 525 } 526 527 528 static int ibss_rsn_is_auth_started(struct ibss_rsn_peer * peer) 529 { 530 return peer->authentication_status & 531 (IBSS_RSN_AUTH_BY_US | IBSS_RSN_AUTH_EAPOL_BY_US); 532 } 533 534 535 static struct ibss_rsn_peer * 536 ibss_rsn_peer_init(struct ibss_rsn *ibss_rsn, const u8 *addr) 537 { 538 struct ibss_rsn_peer *peer; 539 if (ibss_rsn == NULL) 540 return NULL; 541 542 peer = ibss_rsn_get_peer(ibss_rsn, addr); 543 if (peer) { 544 wpa_printf(MSG_DEBUG, "RSN: IBSS Supplicant for peer "MACSTR 545 " already running", MAC2STR(addr)); 546 return peer; 547 } 548 549 wpa_printf(MSG_DEBUG, "RSN: Starting IBSS Supplicant for peer "MACSTR, 550 MAC2STR(addr)); 551 552 peer = os_zalloc(sizeof(*peer)); 553 if (peer == NULL) { 554 wpa_printf(MSG_DEBUG, "RSN: Could not allocate memory."); 555 return NULL; 556 } 557 558 peer->ibss_rsn = ibss_rsn; 559 os_memcpy(peer->addr, addr, ETH_ALEN); 560 peer->authentication_status = IBSS_RSN_AUTH_NOT_AUTHENTICATED; 561 562 if (ibss_rsn_supp_init(peer, ibss_rsn->wpa_s->own_addr, 563 ibss_rsn->psk) < 0) { 564 ibss_rsn_free(peer); 565 return NULL; 566 } 567 568 peer->next = ibss_rsn->peers; 569 ibss_rsn->peers = peer; 570 571 return peer; 572 } 573 574 575 static void ibss_rsn_auth_timeout(void *eloop_ctx, void *timeout_ctx) 576 { 577 struct ibss_rsn_peer *peer = eloop_ctx; 578 579 /* 580 * Assume peer does not support Authentication exchange or the frame was 581 * lost somewhere - start EAPOL Authenticator. 582 */ 583 wpa_printf(MSG_DEBUG, 584 "RSN: Timeout on waiting Authentication frame response from " 585 MACSTR " - start authenticator", MAC2STR(peer->addr)); 586 587 peer->authentication_status |= IBSS_RSN_AUTH_BY_US; 588 ibss_rsn_auth_init(peer->ibss_rsn, peer); 589 } 590 591 592 int ibss_rsn_start(struct ibss_rsn *ibss_rsn, const u8 *addr) 593 { 594 struct ibss_rsn_peer *peer; 595 int res; 596 597 if (!ibss_rsn) 598 return -1; 599 600 /* if the peer already exists, exit immediately */ 601 peer = ibss_rsn_get_peer(ibss_rsn, addr); 602 if (peer) 603 return 0; 604 605 peer = ibss_rsn_peer_init(ibss_rsn, addr); 606 if (peer == NULL) 607 return -1; 608 609 /* Open Authentication: send first Authentication frame */ 610 res = ibss_rsn_send_auth(ibss_rsn, addr, 1); 611 if (res) { 612 /* 613 * The driver may not support Authentication frame exchange in 614 * IBSS. Ignore authentication and go through EAPOL exchange. 615 */ 616 peer->authentication_status |= IBSS_RSN_AUTH_BY_US; 617 return ibss_rsn_auth_init(ibss_rsn, peer); 618 } else { 619 os_get_reltime(&peer->own_auth_tx); 620 eloop_register_timeout(1, 0, ibss_rsn_auth_timeout, peer, NULL); 621 } 622 623 return 0; 624 } 625 626 627 static int ibss_rsn_peer_authenticated(struct ibss_rsn *ibss_rsn, 628 struct ibss_rsn_peer *peer, int reason) 629 { 630 int already_started; 631 632 if (ibss_rsn == NULL || peer == NULL) 633 return -1; 634 635 already_started = ibss_rsn_is_auth_started(peer); 636 peer->authentication_status |= reason; 637 638 if (already_started) { 639 wpa_printf(MSG_DEBUG, "RSN: IBSS Authenticator already " 640 "started for peer " MACSTR, MAC2STR(peer->addr)); 641 return 0; 642 } 643 644 wpa_printf(MSG_DEBUG, "RSN: Starting IBSS Authenticator " 645 "for now-authenticated peer " MACSTR, MAC2STR(peer->addr)); 646 647 return ibss_rsn_auth_init(ibss_rsn, peer); 648 } 649 650 651 void ibss_rsn_stop(struct ibss_rsn *ibss_rsn, const u8 *peermac) 652 { 653 struct ibss_rsn_peer *peer, *prev; 654 655 if (ibss_rsn == NULL) 656 return; 657 658 if (peermac == NULL) { 659 /* remove all peers */ 660 wpa_printf(MSG_DEBUG, "%s: Remove all peers", __func__); 661 peer = ibss_rsn->peers; 662 while (peer) { 663 prev = peer; 664 peer = peer->next; 665 ibss_rsn_free(prev); 666 ibss_rsn->peers = peer; 667 } 668 } else { 669 /* remove specific peer */ 670 wpa_printf(MSG_DEBUG, "%s: Remove specific peer " MACSTR, 671 __func__, MAC2STR(peermac)); 672 673 for (prev = NULL, peer = ibss_rsn->peers; peer != NULL; 674 prev = peer, peer = peer->next) { 675 if (ether_addr_equal(peermac, peer->addr)) { 676 if (prev == NULL) 677 ibss_rsn->peers = peer->next; 678 else 679 prev->next = peer->next; 680 ibss_rsn_free(peer); 681 wpa_printf(MSG_DEBUG, "%s: Successfully " 682 "removed a specific peer", 683 __func__); 684 break; 685 } 686 } 687 } 688 } 689 690 691 struct ibss_rsn * ibss_rsn_init(struct wpa_supplicant *wpa_s, 692 struct wpa_ssid *ssid) 693 { 694 struct ibss_rsn *ibss_rsn; 695 696 ibss_rsn = os_zalloc(sizeof(*ibss_rsn)); 697 if (ibss_rsn == NULL) 698 return NULL; 699 ibss_rsn->wpa_s = wpa_s; 700 701 if (ibss_rsn_auth_init_group(ibss_rsn, wpa_s->own_addr, ssid) < 0) { 702 ibss_rsn_deinit(ibss_rsn); 703 return NULL; 704 } 705 706 return ibss_rsn; 707 } 708 709 710 void ibss_rsn_deinit(struct ibss_rsn *ibss_rsn) 711 { 712 struct ibss_rsn_peer *peer, *prev; 713 714 if (ibss_rsn == NULL) 715 return; 716 717 peer = ibss_rsn->peers; 718 while (peer) { 719 prev = peer; 720 peer = peer->next; 721 ibss_rsn_free(prev); 722 } 723 724 if (ibss_rsn->auth_group) 725 wpa_deinit(ibss_rsn->auth_group); 726 os_free(ibss_rsn); 727 728 } 729 730 731 static int ibss_rsn_eapol_dst_supp(const u8 *buf, size_t len) 732 { 733 const struct ieee802_1x_hdr *hdr; 734 const struct wpa_eapol_key *key; 735 u16 key_info; 736 size_t plen; 737 738 /* TODO: Support other EAPOL packets than just EAPOL-Key */ 739 740 if (len < sizeof(*hdr) + sizeof(*key)) 741 return -1; 742 743 hdr = (const struct ieee802_1x_hdr *) buf; 744 key = (const struct wpa_eapol_key *) (hdr + 1); 745 plen = be_to_host16(hdr->length); 746 747 if (hdr->version < EAPOL_VERSION) { 748 /* TODO: backwards compatibility */ 749 } 750 if (hdr->type != IEEE802_1X_TYPE_EAPOL_KEY) { 751 wpa_printf(MSG_DEBUG, "RSN: EAPOL frame (type %u) discarded, " 752 "not a Key frame", hdr->type); 753 return -1; 754 } 755 if (plen > len - sizeof(*hdr) || plen < sizeof(*key)) { 756 wpa_printf(MSG_DEBUG, "RSN: EAPOL frame payload size %lu " 757 "invalid (frame size %lu)", 758 (unsigned long) plen, (unsigned long) len); 759 return -1; 760 } 761 762 if (key->type != EAPOL_KEY_TYPE_RSN) { 763 wpa_printf(MSG_DEBUG, "RSN: EAPOL-Key type (%d) unknown, " 764 "discarded", key->type); 765 return -1; 766 } 767 768 key_info = WPA_GET_BE16(key->key_info); 769 770 return !!(key_info & WPA_KEY_INFO_ACK); 771 } 772 773 774 static int ibss_rsn_process_rx_eapol(struct ibss_rsn *ibss_rsn, 775 struct ibss_rsn_peer *peer, 776 const u8 *buf, size_t len, 777 enum frame_encryption encrypted) 778 { 779 int supp; 780 u8 *tmp; 781 782 supp = ibss_rsn_eapol_dst_supp(buf, len); 783 if (supp < 0) 784 return -1; 785 786 tmp = os_memdup(buf, len); 787 if (tmp == NULL) 788 return -1; 789 if (supp) { 790 peer->authentication_status |= IBSS_RSN_AUTH_EAPOL_BY_PEER; 791 wpa_printf(MSG_DEBUG, "RSN: IBSS RX EAPOL for Supplicant from " 792 MACSTR, MAC2STR(peer->addr)); 793 wpa_sm_rx_eapol(peer->supp, peer->addr, tmp, len, encrypted); 794 } else { 795 if (ibss_rsn_is_auth_started(peer) == 0) { 796 wpa_printf(MSG_DEBUG, "RSN: IBSS EAPOL for " 797 "Authenticator dropped as " MACSTR " is not " 798 "authenticated", MAC2STR(peer->addr)); 799 os_free(tmp); 800 return -1; 801 } 802 803 wpa_printf(MSG_DEBUG, "RSN: IBSS RX EAPOL for Authenticator " 804 "from "MACSTR, MAC2STR(peer->addr)); 805 wpa_receive(ibss_rsn->auth_group, peer->auth, tmp, len); 806 } 807 os_free(tmp); 808 809 return 1; 810 } 811 812 813 int ibss_rsn_rx_eapol(struct ibss_rsn *ibss_rsn, const u8 *src_addr, 814 const u8 *buf, size_t len, 815 enum frame_encryption encrypted) 816 { 817 struct ibss_rsn_peer *peer; 818 819 if (ibss_rsn == NULL) 820 return -1; 821 822 peer = ibss_rsn_get_peer(ibss_rsn, src_addr); 823 if (peer) 824 return ibss_rsn_process_rx_eapol(ibss_rsn, peer, buf, len, 825 encrypted); 826 827 if (ibss_rsn_eapol_dst_supp(buf, len) > 0) { 828 /* 829 * Create new IBSS peer based on an EAPOL message from the peer 830 * Authenticator. 831 */ 832 peer = ibss_rsn_peer_init(ibss_rsn, src_addr); 833 if (peer == NULL) 834 return -1; 835 836 /* assume the peer is authenticated already */ 837 wpa_printf(MSG_DEBUG, "RSN: IBSS Not using IBSS Auth for peer " 838 MACSTR, MAC2STR(src_addr)); 839 ibss_rsn_peer_authenticated(ibss_rsn, peer, 840 IBSS_RSN_AUTH_EAPOL_BY_US); 841 842 return ibss_rsn_process_rx_eapol(ibss_rsn, ibss_rsn->peers, 843 buf, len, encrypted); 844 } 845 846 return 0; 847 } 848 849 void ibss_rsn_set_psk(struct ibss_rsn *ibss_rsn, const u8 *psk) 850 { 851 if (ibss_rsn == NULL) 852 return; 853 os_memcpy(ibss_rsn->psk, psk, PMK_LEN); 854 } 855 856 857 static void ibss_rsn_handle_auth_1_of_2(struct ibss_rsn *ibss_rsn, 858 struct ibss_rsn_peer *peer, 859 const u8* addr) 860 { 861 wpa_printf(MSG_DEBUG, "RSN: IBSS RX Auth frame (SEQ 1) from " MACSTR, 862 MAC2STR(addr)); 863 864 if (peer && 865 peer->authentication_status & (IBSS_RSN_SET_PTK_SUPP | 866 IBSS_RSN_SET_PTK_AUTH)) { 867 /* Clear the TK for this pair to allow recovery from the case 868 * where the peer STA has restarted and lost its key while we 869 * still have a pairwise key configured. */ 870 wpa_printf(MSG_DEBUG, "RSN: Clear pairwise key for peer " 871 MACSTR, MAC2STR(addr)); 872 wpa_drv_set_key(ibss_rsn->wpa_s, -1, WPA_ALG_NONE, addr, 0, 0, 873 NULL, 0, NULL, 0, KEY_FLAG_PAIRWISE); 874 } 875 876 if (peer && 877 peer->authentication_status & IBSS_RSN_AUTH_EAPOL_BY_PEER) { 878 if (peer->own_auth_tx.sec) { 879 struct os_reltime now, diff; 880 os_get_reltime(&now); 881 os_reltime_sub(&now, &peer->own_auth_tx, &diff); 882 if (diff.sec == 0 && diff.usec < 500000) { 883 wpa_printf(MSG_DEBUG, "RSN: Skip IBSS reinit since only %u usec from own Auth frame TX", 884 (int) diff.usec); 885 goto skip_reinit; 886 } 887 } 888 /* 889 * A peer sent us an Authentication frame even though it already 890 * started an EAPOL session. We should reinit state machines 891 * here, but it's much more complicated than just deleting and 892 * recreating the state machine 893 */ 894 wpa_printf(MSG_DEBUG, "RSN: IBSS Reinitializing station " 895 MACSTR, MAC2STR(addr)); 896 897 ibss_rsn_stop(ibss_rsn, addr); 898 peer = NULL; 899 } 900 901 if (!peer) { 902 peer = ibss_rsn_peer_init(ibss_rsn, addr); 903 if (!peer) 904 return; 905 906 wpa_printf(MSG_DEBUG, "RSN: IBSS Auth started by peer " MACSTR, 907 MAC2STR(addr)); 908 } 909 910 skip_reinit: 911 /* reply with an Authentication frame now, before sending an EAPOL */ 912 ibss_rsn_send_auth(ibss_rsn, addr, 2); 913 /* no need to start another AUTH challenge in the other way.. */ 914 ibss_rsn_peer_authenticated(ibss_rsn, peer, IBSS_RSN_AUTH_EAPOL_BY_US); 915 } 916 917 918 void ibss_rsn_handle_auth(struct ibss_rsn *ibss_rsn, const u8 *auth_frame, 919 size_t len) 920 { 921 const struct ieee80211_mgmt *header; 922 struct ibss_rsn_peer *peer; 923 size_t auth_length; 924 925 header = (const struct ieee80211_mgmt *) auth_frame; 926 auth_length = IEEE80211_HDRLEN + sizeof(header->u.auth); 927 928 if (ibss_rsn == NULL || len < auth_length) 929 return; 930 931 if (le_to_host16(header->u.auth.auth_alg) != WLAN_AUTH_OPEN || 932 le_to_host16(header->u.auth.status_code) != WLAN_STATUS_SUCCESS) 933 return; 934 935 peer = ibss_rsn_get_peer(ibss_rsn, header->sa); 936 937 switch (le_to_host16(header->u.auth.auth_transaction)) { 938 case 1: 939 ibss_rsn_handle_auth_1_of_2(ibss_rsn, peer, header->sa); 940 break; 941 case 2: 942 wpa_printf(MSG_DEBUG, "RSN: IBSS RX Auth frame (SEQ 2) from " 943 MACSTR, MAC2STR(header->sa)); 944 if (!peer) { 945 wpa_printf(MSG_DEBUG, "RSN: Received Auth seq 2 from " 946 "unknown STA " MACSTR, MAC2STR(header->sa)); 947 break; 948 } 949 950 /* authentication has been completed */ 951 eloop_cancel_timeout(ibss_rsn_auth_timeout, peer, NULL); 952 wpa_printf(MSG_DEBUG, "RSN: IBSS Auth completed with " MACSTR, 953 MAC2STR(header->sa)); 954 ibss_rsn_peer_authenticated(ibss_rsn, peer, 955 IBSS_RSN_AUTH_BY_US); 956 break; 957 } 958 } 959