ibss_rsn.c revision 1.1.1.2
1 /* 2 * wpa_supplicant - IBSS RSN 3 * Copyright (c) 2009, Jouni Malinen <j (at) w1.fi> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 * Alternatively, this software may be distributed under the terms of BSD 10 * license. 11 * 12 * See README and COPYING for more details. 13 */ 14 15 #include "includes.h" 16 17 #include "common.h" 18 #include "l2_packet/l2_packet.h" 19 #include "rsn_supp/wpa.h" 20 #include "rsn_supp/wpa_ie.h" 21 #include "ap/wpa_auth.h" 22 #include "wpa_supplicant_i.h" 23 #include "driver_i.h" 24 #include "ibss_rsn.h" 25 26 27 static void ibss_rsn_free(struct ibss_rsn_peer *peer) 28 { 29 wpa_auth_sta_deinit(peer->auth); 30 wpa_sm_deinit(peer->supp); 31 os_free(peer); 32 } 33 34 35 static void supp_set_state(void *ctx, enum wpa_states state) 36 { 37 struct ibss_rsn_peer *peer = ctx; 38 peer->supp_state = state; 39 } 40 41 42 static enum wpa_states supp_get_state(void *ctx) 43 { 44 struct ibss_rsn_peer *peer = ctx; 45 return peer->supp_state; 46 } 47 48 49 static int supp_ether_send(void *ctx, const u8 *dest, u16 proto, const u8 *buf, 50 size_t len) 51 { 52 struct ibss_rsn_peer *peer = ctx; 53 struct wpa_supplicant *wpa_s = peer->ibss_rsn->wpa_s; 54 55 wpa_printf(MSG_DEBUG, "SUPP: %s(dest=" MACSTR " proto=0x%04x " 56 "len=%lu)", 57 __func__, MAC2STR(dest), proto, (unsigned long) len); 58 59 if (wpa_s->l2) 60 return l2_packet_send(wpa_s->l2, dest, proto, buf, len); 61 62 return wpa_drv_send_eapol(wpa_s, dest, proto, buf, len); 63 } 64 65 66 static u8 * supp_alloc_eapol(void *ctx, u8 type, const void *data, 67 u16 data_len, size_t *msg_len, void **data_pos) 68 { 69 struct ieee802_1x_hdr *hdr; 70 71 wpa_printf(MSG_DEBUG, "SUPP: %s(type=%d data_len=%d)", 72 __func__, type, data_len); 73 74 *msg_len = sizeof(*hdr) + data_len; 75 hdr = os_malloc(*msg_len); 76 if (hdr == NULL) 77 return NULL; 78 79 hdr->version = 2; 80 hdr->type = type; 81 hdr->length = host_to_be16(data_len); 82 83 if (data) 84 os_memcpy(hdr + 1, data, data_len); 85 else 86 os_memset(hdr + 1, 0, data_len); 87 88 if (data_pos) 89 *data_pos = hdr + 1; 90 91 return (u8 *) hdr; 92 } 93 94 95 static int supp_get_beacon_ie(void *ctx) 96 { 97 struct ibss_rsn_peer *peer = ctx; 98 99 wpa_printf(MSG_DEBUG, "SUPP: %s", __func__); 100 /* TODO: get correct RSN IE */ 101 return wpa_sm_set_ap_rsn_ie(peer->supp, 102 (u8 *) "\x30\x14\x01\x00" 103 "\x00\x0f\xac\x04" 104 "\x01\x00\x00\x0f\xac\x04" 105 "\x01\x00\x00\x0f\xac\x02" 106 "\x00\x00", 22); 107 } 108 109 110 static int supp_set_key(void *ctx, enum wpa_alg alg, 111 const u8 *addr, int key_idx, int set_tx, 112 const u8 *seq, size_t seq_len, 113 const u8 *key, size_t key_len) 114 { 115 struct ibss_rsn_peer *peer = ctx; 116 117 wpa_printf(MSG_DEBUG, "SUPP: %s(alg=%d addr=" MACSTR " key_idx=%d " 118 "set_tx=%d)", 119 __func__, alg, MAC2STR(addr), key_idx, set_tx); 120 wpa_hexdump(MSG_DEBUG, "SUPP: set_key - seq", seq, seq_len); 121 wpa_hexdump_key(MSG_DEBUG, "SUPP: set_key - key", key, key_len); 122 123 if (key_idx == 0) { 124 /* 125 * In IBSS RSN, the pairwise key from the 4-way handshake 126 * initiated by the peer with highest MAC address is used. 127 */ 128 if (os_memcmp(peer->ibss_rsn->wpa_s->own_addr, peer->addr, 129 ETH_ALEN) > 0) { 130 wpa_printf(MSG_DEBUG, "SUPP: Do not use this PTK"); 131 return 0; 132 } 133 } 134 135 if (is_broadcast_ether_addr(addr)) 136 addr = peer->addr; 137 return wpa_drv_set_key(peer->ibss_rsn->wpa_s, alg, addr, key_idx, 138 set_tx, seq, seq_len, key, key_len); 139 } 140 141 142 static void * supp_get_network_ctx(void *ctx) 143 { 144 struct ibss_rsn_peer *peer = ctx; 145 return wpa_supplicant_get_ssid(peer->ibss_rsn->wpa_s); 146 } 147 148 149 static int supp_mlme_setprotection(void *ctx, const u8 *addr, 150 int protection_type, int key_type) 151 { 152 wpa_printf(MSG_DEBUG, "SUPP: %s(addr=" MACSTR " protection_type=%d " 153 "key_type=%d)", 154 __func__, MAC2STR(addr), protection_type, key_type); 155 return 0; 156 } 157 158 159 static void supp_cancel_auth_timeout(void *ctx) 160 { 161 wpa_printf(MSG_DEBUG, "SUPP: %s", __func__); 162 } 163 164 165 static void supp_deauthenticate(void * ctx, int reason_code) 166 { 167 wpa_printf(MSG_DEBUG, "SUPP: %s (TODO)", __func__); 168 } 169 170 171 int ibss_rsn_supp_init(struct ibss_rsn_peer *peer, const u8 *own_addr, 172 const u8 *psk) 173 { 174 struct wpa_sm_ctx *ctx = os_zalloc(sizeof(*ctx)); 175 if (ctx == NULL) 176 return -1; 177 178 ctx->ctx = peer; 179 ctx->msg_ctx = peer->ibss_rsn->wpa_s; 180 ctx->set_state = supp_set_state; 181 ctx->get_state = supp_get_state; 182 ctx->ether_send = supp_ether_send; 183 ctx->get_beacon_ie = supp_get_beacon_ie; 184 ctx->alloc_eapol = supp_alloc_eapol; 185 ctx->set_key = supp_set_key; 186 ctx->get_network_ctx = supp_get_network_ctx; 187 ctx->mlme_setprotection = supp_mlme_setprotection; 188 ctx->cancel_auth_timeout = supp_cancel_auth_timeout; 189 ctx->deauthenticate = supp_deauthenticate; 190 peer->supp = wpa_sm_init(ctx); 191 if (peer->supp == NULL) { 192 wpa_printf(MSG_DEBUG, "SUPP: wpa_sm_init() failed"); 193 return -1; 194 } 195 196 wpa_sm_set_own_addr(peer->supp, own_addr); 197 wpa_sm_set_param(peer->supp, WPA_PARAM_RSN_ENABLED, 1); 198 wpa_sm_set_param(peer->supp, WPA_PARAM_PROTO, WPA_PROTO_RSN); 199 wpa_sm_set_param(peer->supp, WPA_PARAM_PAIRWISE, WPA_CIPHER_CCMP); 200 wpa_sm_set_param(peer->supp, WPA_PARAM_GROUP, WPA_CIPHER_CCMP); 201 wpa_sm_set_param(peer->supp, WPA_PARAM_KEY_MGMT, WPA_KEY_MGMT_PSK); 202 wpa_sm_set_pmk(peer->supp, psk, PMK_LEN); 203 204 peer->supp_ie_len = sizeof(peer->supp_ie); 205 if (wpa_sm_set_assoc_wpa_ie_default(peer->supp, peer->supp_ie, 206 &peer->supp_ie_len) < 0) { 207 wpa_printf(MSG_DEBUG, "SUPP: wpa_sm_set_assoc_wpa_ie_default()" 208 " failed"); 209 return -1; 210 } 211 212 wpa_sm_notify_assoc(peer->supp, peer->addr); 213 214 return 0; 215 } 216 217 218 static void auth_logger(void *ctx, const u8 *addr, logger_level level, 219 const char *txt) 220 { 221 if (addr) 222 wpa_printf(MSG_DEBUG, "AUTH: " MACSTR " - %s", 223 MAC2STR(addr), txt); 224 else 225 wpa_printf(MSG_DEBUG, "AUTH: %s", txt); 226 } 227 228 229 static const u8 * auth_get_psk(void *ctx, const u8 *addr, const u8 *prev_psk) 230 { 231 struct ibss_rsn *ibss_rsn = ctx; 232 wpa_printf(MSG_DEBUG, "AUTH: %s (addr=" MACSTR " prev_psk=%p)", 233 __func__, MAC2STR(addr), prev_psk); 234 if (prev_psk) 235 return NULL; 236 return ibss_rsn->psk; 237 } 238 239 240 static int auth_send_eapol(void *ctx, const u8 *addr, const u8 *data, 241 size_t data_len, int encrypt) 242 { 243 struct ibss_rsn *ibss_rsn = ctx; 244 struct wpa_supplicant *wpa_s = ibss_rsn->wpa_s; 245 246 wpa_printf(MSG_DEBUG, "AUTH: %s(addr=" MACSTR " data_len=%lu " 247 "encrypt=%d)", 248 __func__, MAC2STR(addr), (unsigned long) data_len, encrypt); 249 250 if (wpa_s->l2) 251 return l2_packet_send(wpa_s->l2, addr, ETH_P_EAPOL, data, 252 data_len); 253 254 return wpa_drv_send_eapol(wpa_s, addr, ETH_P_EAPOL, data, data_len); 255 } 256 257 258 static int auth_set_key(void *ctx, int vlan_id, enum wpa_alg alg, 259 const u8 *addr, int idx, u8 *key, size_t key_len) 260 { 261 struct ibss_rsn *ibss_rsn = ctx; 262 u8 seq[6]; 263 264 os_memset(seq, 0, sizeof(seq)); 265 266 if (addr) { 267 wpa_printf(MSG_DEBUG, "AUTH: %s(alg=%d addr=" MACSTR 268 " key_idx=%d)", 269 __func__, alg, MAC2STR(addr), idx); 270 } else { 271 wpa_printf(MSG_DEBUG, "AUTH: %s(alg=%d key_idx=%d)", 272 __func__, alg, idx); 273 } 274 wpa_hexdump_key(MSG_DEBUG, "AUTH: set_key - key", key, key_len); 275 276 if (idx == 0) { 277 /* 278 * In IBSS RSN, the pairwise key from the 4-way handshake 279 * initiated by the peer with highest MAC address is used. 280 */ 281 if (addr == NULL || 282 os_memcmp(ibss_rsn->wpa_s->own_addr, addr, ETH_ALEN) < 0) { 283 wpa_printf(MSG_DEBUG, "AUTH: Do not use this PTK"); 284 return 0; 285 } 286 } 287 288 return wpa_drv_set_key(ibss_rsn->wpa_s, alg, addr, idx, 289 1, seq, 6, key, key_len); 290 } 291 292 293 static int auth_for_each_sta(void *ctx, int (*cb)(struct wpa_state_machine *sm, 294 void *ctx), 295 void *cb_ctx) 296 { 297 struct ibss_rsn *ibss_rsn = ctx; 298 struct ibss_rsn_peer *peer; 299 300 wpa_printf(MSG_DEBUG, "AUTH: for_each_sta"); 301 302 for (peer = ibss_rsn->peers; peer; peer = peer->next) { 303 if (peer->auth && cb(peer->auth, cb_ctx)) 304 return 1; 305 } 306 307 return 0; 308 } 309 310 311 static int ibss_rsn_auth_init_group(struct ibss_rsn *ibss_rsn, 312 const u8 *own_addr) 313 { 314 struct wpa_auth_config conf; 315 struct wpa_auth_callbacks cb; 316 317 wpa_printf(MSG_DEBUG, "AUTH: Initializing group state machine"); 318 319 os_memset(&conf, 0, sizeof(conf)); 320 conf.wpa = 2; 321 conf.wpa_key_mgmt = WPA_KEY_MGMT_PSK; 322 conf.wpa_pairwise = WPA_CIPHER_CCMP; 323 conf.rsn_pairwise = WPA_CIPHER_CCMP; 324 conf.wpa_group = WPA_CIPHER_CCMP; 325 conf.eapol_version = 2; 326 conf.wpa_group_rekey = 600; 327 328 os_memset(&cb, 0, sizeof(cb)); 329 cb.ctx = ibss_rsn; 330 cb.logger = auth_logger; 331 cb.send_eapol = auth_send_eapol; 332 cb.get_psk = auth_get_psk; 333 cb.set_key = auth_set_key; 334 cb.for_each_sta = auth_for_each_sta; 335 336 ibss_rsn->auth_group = wpa_init(own_addr, &conf, &cb); 337 if (ibss_rsn->auth_group == NULL) { 338 wpa_printf(MSG_DEBUG, "AUTH: wpa_init() failed"); 339 return -1; 340 } 341 342 wpa_init_keys(ibss_rsn->auth_group); 343 344 return 0; 345 } 346 347 348 static int ibss_rsn_auth_init(struct ibss_rsn *ibss_rsn, 349 struct ibss_rsn_peer *peer) 350 { 351 peer->auth = wpa_auth_sta_init(ibss_rsn->auth_group, peer->addr); 352 if (peer->auth == NULL) { 353 wpa_printf(MSG_DEBUG, "AUTH: wpa_auth_sta_init() failed"); 354 return -1; 355 } 356 357 /* TODO: get peer RSN IE with Probe Request */ 358 if (wpa_validate_wpa_ie(ibss_rsn->auth_group, peer->auth, 359 (u8 *) "\x30\x14\x01\x00" 360 "\x00\x0f\xac\x04" 361 "\x01\x00\x00\x0f\xac\x04" 362 "\x01\x00\x00\x0f\xac\x02" 363 "\x00\x00", 22, NULL, 0) != 364 WPA_IE_OK) { 365 wpa_printf(MSG_DEBUG, "AUTH: wpa_validate_wpa_ie() failed"); 366 return -1; 367 } 368 369 if (wpa_auth_sm_event(peer->auth, WPA_ASSOC)) 370 return -1; 371 372 if (wpa_auth_sta_associated(ibss_rsn->auth_group, peer->auth)) 373 return -1; 374 375 return 0; 376 } 377 378 379 int ibss_rsn_start(struct ibss_rsn *ibss_rsn, const u8 *addr) 380 { 381 struct ibss_rsn_peer *peer; 382 383 if (ibss_rsn == NULL) 384 return -1; 385 386 for (peer = ibss_rsn->peers; peer; peer = peer->next) { 387 if (os_memcmp(addr, peer->addr, ETH_ALEN) == 0) { 388 wpa_printf(MSG_DEBUG, "RSN: IBSS Authenticator and " 389 "Supplicant for peer " MACSTR " already " 390 "running", MAC2STR(addr)); 391 return 0; 392 } 393 } 394 395 wpa_printf(MSG_DEBUG, "RSN: Starting IBSS Authenticator and " 396 "Supplicant for peer " MACSTR, MAC2STR(addr)); 397 398 peer = os_zalloc(sizeof(*peer)); 399 if (peer == NULL) 400 return -1; 401 402 peer->ibss_rsn = ibss_rsn; 403 os_memcpy(peer->addr, addr, ETH_ALEN); 404 405 if (ibss_rsn_supp_init(peer, ibss_rsn->wpa_s->own_addr, ibss_rsn->psk) 406 < 0) { 407 ibss_rsn_free(peer); 408 return -1; 409 } 410 411 if (ibss_rsn_auth_init(ibss_rsn, peer) < 0) { 412 ibss_rsn_free(peer); 413 return -1; 414 } 415 416 peer->next = ibss_rsn->peers; 417 ibss_rsn->peers = peer; 418 419 return 0; 420 } 421 422 423 void ibss_rsn_stop(struct ibss_rsn *ibss_rsn, const u8 *peermac) 424 { 425 struct ibss_rsn_peer *peer, *prev; 426 427 if (ibss_rsn == NULL) 428 return; 429 430 if (peermac == NULL) { 431 /* remove all peers */ 432 wpa_printf(MSG_DEBUG, "%s: Remove all peers", __func__); 433 peer = ibss_rsn->peers; 434 while (peer) { 435 prev = peer; 436 peer = peer->next; 437 ibss_rsn_free(prev); 438 ibss_rsn->peers = peer; 439 } 440 } else { 441 /* remove specific peer */ 442 wpa_printf(MSG_DEBUG, "%s: Remove specific peer " MACSTR, 443 __func__, MAC2STR(peermac)); 444 445 for (prev = NULL, peer = ibss_rsn->peers; peer != NULL; 446 prev = peer, peer = peer->next) { 447 if (os_memcmp(peermac, peer->addr, ETH_ALEN) == 0) { 448 if (prev == NULL) 449 ibss_rsn->peers = peer->next; 450 else 451 prev->next = peer->next; 452 ibss_rsn_free(peer); 453 wpa_printf(MSG_DEBUG, "%s: Successfully " 454 "removed a specific peer", 455 __func__); 456 break; 457 } 458 } 459 } 460 } 461 462 463 struct ibss_rsn * ibss_rsn_init(struct wpa_supplicant *wpa_s) 464 { 465 struct ibss_rsn *ibss_rsn; 466 467 ibss_rsn = os_zalloc(sizeof(*ibss_rsn)); 468 if (ibss_rsn == NULL) 469 return NULL; 470 ibss_rsn->wpa_s = wpa_s; 471 472 if (ibss_rsn_auth_init_group(ibss_rsn, wpa_s->own_addr) < 0) { 473 ibss_rsn_deinit(ibss_rsn); 474 return NULL; 475 } 476 477 return ibss_rsn; 478 } 479 480 481 void ibss_rsn_deinit(struct ibss_rsn *ibss_rsn) 482 { 483 struct ibss_rsn_peer *peer, *prev; 484 485 if (ibss_rsn == NULL) 486 return; 487 488 peer = ibss_rsn->peers; 489 while (peer) { 490 prev = peer; 491 peer = peer->next; 492 ibss_rsn_free(prev); 493 } 494 495 wpa_deinit(ibss_rsn->auth_group); 496 os_free(ibss_rsn); 497 498 } 499 500 501 static int ibss_rsn_eapol_dst_supp(const u8 *buf, size_t len) 502 { 503 const struct ieee802_1x_hdr *hdr; 504 const struct wpa_eapol_key *key; 505 u16 key_info; 506 size_t plen; 507 508 /* TODO: Support other EAPOL packets than just EAPOL-Key */ 509 510 if (len < sizeof(*hdr) + sizeof(*key)) 511 return -1; 512 513 hdr = (const struct ieee802_1x_hdr *) buf; 514 key = (const struct wpa_eapol_key *) (hdr + 1); 515 plen = be_to_host16(hdr->length); 516 517 if (hdr->version < EAPOL_VERSION) { 518 /* TODO: backwards compatibility */ 519 } 520 if (hdr->type != IEEE802_1X_TYPE_EAPOL_KEY) { 521 wpa_printf(MSG_DEBUG, "RSN: EAPOL frame (type %u) discarded, " 522 "not a Key frame", hdr->type); 523 return -1; 524 } 525 if (plen > len - sizeof(*hdr) || plen < sizeof(*key)) { 526 wpa_printf(MSG_DEBUG, "RSN: EAPOL frame payload size %lu " 527 "invalid (frame size %lu)", 528 (unsigned long) plen, (unsigned long) len); 529 return -1; 530 } 531 532 if (key->type != EAPOL_KEY_TYPE_RSN) { 533 wpa_printf(MSG_DEBUG, "RSN: EAPOL-Key type (%d) unknown, " 534 "discarded", key->type); 535 return -1; 536 } 537 538 key_info = WPA_GET_BE16(key->key_info); 539 540 return !!(key_info & WPA_KEY_INFO_ACK); 541 } 542 543 544 static int ibss_rsn_process_rx_eapol(struct ibss_rsn *ibss_rsn, 545 struct ibss_rsn_peer *peer, 546 const u8 *buf, size_t len) 547 { 548 int supp; 549 u8 *tmp; 550 551 supp = ibss_rsn_eapol_dst_supp(buf, len); 552 if (supp < 0) 553 return -1; 554 555 tmp = os_malloc(len); 556 if (tmp == NULL) 557 return -1; 558 os_memcpy(tmp, buf, len); 559 if (supp) { 560 wpa_printf(MSG_DEBUG, "RSN: IBSS RX EAPOL for Supplicant"); 561 wpa_sm_rx_eapol(peer->supp, peer->addr, tmp, len); 562 } else { 563 wpa_printf(MSG_DEBUG, "RSN: IBSS RX EAPOL for Authenticator"); 564 wpa_receive(ibss_rsn->auth_group, peer->auth, tmp, len); 565 } 566 os_free(tmp); 567 568 return 1; 569 } 570 571 572 int ibss_rsn_rx_eapol(struct ibss_rsn *ibss_rsn, const u8 *src_addr, 573 const u8 *buf, size_t len) 574 { 575 struct ibss_rsn_peer *peer; 576 577 if (ibss_rsn == NULL) 578 return -1; 579 580 for (peer = ibss_rsn->peers; peer; peer = peer->next) { 581 if (os_memcmp(src_addr, peer->addr, ETH_ALEN) == 0) 582 return ibss_rsn_process_rx_eapol(ibss_rsn, peer, 583 buf, len); 584 } 585 586 if (ibss_rsn_eapol_dst_supp(buf, len) > 0) { 587 /* 588 * Create new IBSS peer based on an EAPOL message from the peer 589 * Authenticator. 590 */ 591 if (ibss_rsn_start(ibss_rsn, src_addr) < 0) 592 return -1; 593 return ibss_rsn_process_rx_eapol(ibss_rsn, ibss_rsn->peers, 594 buf, len); 595 } 596 597 return 0; 598 } 599 600 601 void ibss_rsn_set_psk(struct ibss_rsn *ibss_rsn, const u8 *psk) 602 { 603 if (ibss_rsn == NULL) 604 return; 605 os_memcpy(ibss_rsn->psk, psk, PMK_LEN); 606 } 607
Indexes created Sun Apr 26 00:22:38 UTC 2026