]> git.ipfire.org Git - thirdparty/hostap.git/blob - src/ap/ieee802_1x.c
projects / thirdparty / hostap.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
RADIUS: Use more likely unique accounting Acct-{,Multi-}Session-Id
[thirdparty/hostap.git] / src / ap / ieee802_1x.c
1 /*
2 * hostapd / IEEE 802.1X-2004 Authenticator
3 * Copyright (c) 2002-2012, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "utils/includes.h"
10
11 #include "utils/common.h"
12 #include "utils/eloop.h"
13 #include "crypto/md5.h"
14 #include "crypto/crypto.h"
15 #include "crypto/random.h"
16 #include "common/ieee802_11_defs.h"
17 #include "radius/radius.h"
18 #include "radius/radius_client.h"
19 #include "eap_server/eap.h"
20 #include "eap_common/eap_wsc_common.h"
21 #include "eapol_auth/eapol_auth_sm.h"
22 #include "eapol_auth/eapol_auth_sm_i.h"
23 #include "p2p/p2p.h"
24 #include "hostapd.h"
25 #include "accounting.h"
26 #include "sta_info.h"
27 #include "wpa_auth.h"
28 #include "preauth_auth.h"
29 #include "pmksa_cache_auth.h"
30 #include "ap_config.h"
31 #include "ap_drv_ops.h"
32 #include "wps_hostapd.h"
33 #include "hs20.h"
34 #include "ieee802_1x.h"
35
36
37 #ifdef CONFIG_HS20
38 static void ieee802_1x_wnm_notif_send(void *eloop_ctx, void *timeout_ctx);
39 #endif /* CONFIG_HS20 */
40 static void ieee802_1x_finished(struct hostapd_data *hapd,
41 struct sta_info *sta, int success,
42 int remediation);
43
44
45 static void ieee802_1x_send(struct hostapd_data *hapd, struct sta_info *sta,
46 u8 type, const u8 *data, size_t datalen)
47 {
48 u8 *buf;
49 struct ieee802_1x_hdr *xhdr;
50 size_t len;
51 int encrypt = 0;
52
53 len = sizeof(*xhdr) + datalen;
54 buf = os_zalloc(len);
55 if (buf == NULL) {
56 wpa_printf(MSG_ERROR, "malloc() failed for "
57 "ieee802_1x_send(len=%lu)",
58 (unsigned long) len);
59 return;
60 }
61
62 xhdr = (struct ieee802_1x_hdr *) buf;
63 xhdr->version = hapd->conf->eapol_version;
64 xhdr->type = type;
65 xhdr->length = host_to_be16(datalen);
66
67 if (datalen > 0 && data != NULL)
68 os_memcpy(xhdr + 1, data, datalen);
69
70 if (wpa_auth_pairwise_set(sta->wpa_sm))
71 encrypt = 1;
72 #ifdef CONFIG_TESTING_OPTIONS
73 if (hapd->ext_eapol_frame_io) {
74 size_t hex_len = 2 * len + 1;
75 char *hex = os_malloc(hex_len);
76
77 if (hex) {
78 wpa_snprintf_hex(hex, hex_len, buf, len);
79 wpa_msg(hapd->msg_ctx, MSG_INFO,
80 "EAPOL-TX " MACSTR " %s",
81 MAC2STR(sta->addr), hex);
82 os_free(hex);
83 }
84 } else
85 #endif /* CONFIG_TESTING_OPTIONS */
86 if (sta->flags & WLAN_STA_PREAUTH) {
87 rsn_preauth_send(hapd, sta, buf, len);
88 } else {
89 hostapd_drv_hapd_send_eapol(
90 hapd, sta->addr, buf, len,
91 encrypt, hostapd_sta_flags_to_drv(sta->flags));
92 }
93
94 os_free(buf);
95 }
96
97
98 void ieee802_1x_set_sta_authorized(struct hostapd_data *hapd,
99 struct sta_info *sta, int authorized)
100 {
101 int res;
102
103 if (sta->flags & WLAN_STA_PREAUTH)
104 return;
105
106 if (authorized) {
107 ap_sta_set_authorized(hapd, sta, 1);
108 res = hostapd_set_authorized(hapd, sta, 1);
109 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
110 HOSTAPD_LEVEL_DEBUG, "authorizing port");
111 } else {
112 ap_sta_set_authorized(hapd, sta, 0);
113 res = hostapd_set_authorized(hapd, sta, 0);
114 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
115 HOSTAPD_LEVEL_DEBUG, "unauthorizing port");
116 }
117
118 if (res && errno != ENOENT) {
119 wpa_printf(MSG_DEBUG, "Could not set station " MACSTR
120 " flags for kernel driver (errno=%d).",
121 MAC2STR(sta->addr), errno);
122 }
123
124 if (authorized) {
125 os_get_reltime(&sta->connected_time);
126 accounting_sta_start(hapd, sta);
127 }
128 }
129
130
131 #ifndef CONFIG_FIPS
132 #ifndef CONFIG_NO_RC4
133
134 static void ieee802_1x_tx_key_one(struct hostapd_data *hapd,
135 struct sta_info *sta,
136 int idx, int broadcast,
137 u8 *key_data, size_t key_len)
138 {
139 u8 *buf, *ekey;
140 struct ieee802_1x_hdr *hdr;
141 struct ieee802_1x_eapol_key *key;
142 size_t len, ekey_len;
143 struct eapol_state_machine *sm = sta->eapol_sm;
144
145 if (sm == NULL)
146 return;
147
148 len = sizeof(*key) + key_len;
149 buf = os_zalloc(sizeof(*hdr) + len);
150 if (buf == NULL)
151 return;
152
153 hdr = (struct ieee802_1x_hdr *) buf;
154 key = (struct ieee802_1x_eapol_key *) (hdr + 1);
155 key->type = EAPOL_KEY_TYPE_RC4;
156 WPA_PUT_BE16(key->key_length, key_len);
157 wpa_get_ntp_timestamp(key->replay_counter);
158
159 if (random_get_bytes(key->key_iv, sizeof(key->key_iv))) {
160 wpa_printf(MSG_ERROR, "Could not get random numbers");
161 os_free(buf);
162 return;
163 }
164
165 key->key_index = idx | (broadcast ? 0 : BIT(7));
166 if (hapd->conf->eapol_key_index_workaround) {
167 /* According to some information, WinXP Supplicant seems to
168 * interpret bit7 as an indication whether the key is to be
169 * activated, so make it possible to enable workaround that
170 * sets this bit for all keys. */
171 key->key_index |= BIT(7);
172 }
173
174 /* Key is encrypted using "Key-IV + MSK[0..31]" as the RC4-key and
175 * MSK[32..63] is used to sign the message. */
176 if (sm->eap_if->eapKeyData == NULL || sm->eap_if->eapKeyDataLen < 64) {
177 wpa_printf(MSG_ERROR, "No eapKeyData available for encrypting "
178 "and signing EAPOL-Key");
179 os_free(buf);
180 return;
181 }
182 os_memcpy((u8 *) (key + 1), key_data, key_len);
183 ekey_len = sizeof(key->key_iv) + 32;
184 ekey = os_malloc(ekey_len);
185 if (ekey == NULL) {
186 wpa_printf(MSG_ERROR, "Could not encrypt key");
187 os_free(buf);
188 return;
189 }
190 os_memcpy(ekey, key->key_iv, sizeof(key->key_iv));
191 os_memcpy(ekey + sizeof(key->key_iv), sm->eap_if->eapKeyData, 32);
192 rc4_skip(ekey, ekey_len, 0, (u8 *) (key + 1), key_len);
193 os_free(ekey);
194
195 /* This header is needed here for HMAC-MD5, but it will be regenerated
196 * in ieee802_1x_send() */
197 hdr->version = hapd->conf->eapol_version;
198 hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
199 hdr->length = host_to_be16(len);
200 hmac_md5(sm->eap_if->eapKeyData + 32, 32, buf, sizeof(*hdr) + len,
201 key->key_signature);
202
203 wpa_printf(MSG_DEBUG, "IEEE 802.1X: Sending EAPOL-Key to " MACSTR
204 " (%s index=%d)", MAC2STR(sm->addr),
205 broadcast ? "broadcast" : "unicast", idx);
206 ieee802_1x_send(hapd, sta, IEEE802_1X_TYPE_EAPOL_KEY, (u8 *) key, len);
207 if (sta->eapol_sm)
208 sta->eapol_sm->dot1xAuthEapolFramesTx++;
209 os_free(buf);
210 }
211
212
213 static void ieee802_1x_tx_key(struct hostapd_data *hapd, struct sta_info *sta)
214 {
215 struct eapol_authenticator *eapol = hapd->eapol_auth;
216 struct eapol_state_machine *sm = sta->eapol_sm;
217
218 if (sm == NULL || !sm->eap_if->eapKeyData)
219 return;
220
221 wpa_printf(MSG_DEBUG, "IEEE 802.1X: Sending EAPOL-Key(s) to " MACSTR,
222 MAC2STR(sta->addr));
223
224 #ifndef CONFIG_NO_VLAN
225 if (sta->vlan_id > 0 && sta->vlan_id <= MAX_VLAN_ID) {
226 wpa_printf(MSG_ERROR, "Using WEP with vlans is not supported.");
227 return;
228 }
229 #endif /* CONFIG_NO_VLAN */
230
231 if (eapol->default_wep_key) {
232 ieee802_1x_tx_key_one(hapd, sta, eapol->default_wep_key_idx, 1,
233 eapol->default_wep_key,
234 hapd->conf->default_wep_key_len);
235 }
236
237 if (hapd->conf->individual_wep_key_len > 0) {
238 u8 *ikey;
239 ikey = os_malloc(hapd->conf->individual_wep_key_len);
240 if (ikey == NULL ||
241 random_get_bytes(ikey, hapd->conf->individual_wep_key_len))
242 {
243 wpa_printf(MSG_ERROR, "Could not generate random "
244 "individual WEP key.");
245 os_free(ikey);
246 return;
247 }
248
249 wpa_hexdump_key(MSG_DEBUG, "Individual WEP key",
250 ikey, hapd->conf->individual_wep_key_len);
251
252 ieee802_1x_tx_key_one(hapd, sta, 0, 0, ikey,
253 hapd->conf->individual_wep_key_len);
254
255 /* TODO: set encryption in TX callback, i.e., only after STA
256 * has ACKed EAPOL-Key frame */
257 if (hostapd_drv_set_key(hapd->conf->iface, hapd, WPA_ALG_WEP,
258 sta->addr, 0, 1, NULL, 0, ikey,
259 hapd->conf->individual_wep_key_len)) {
260 wpa_printf(MSG_ERROR, "Could not set individual WEP "
261 "encryption.");
262 }
263
264 os_free(ikey);
265 }
266 }
267
268 #endif /* CONFIG_NO_RC4 */
269 #endif /* CONFIG_FIPS */
270
271
272 const char *radius_mode_txt(struct hostapd_data *hapd)
273 {
274 switch (hapd->iface->conf->hw_mode) {
275 case HOSTAPD_MODE_IEEE80211AD:
276 return "802.11ad";
277 case HOSTAPD_MODE_IEEE80211A:
278 return "802.11a";
279 case HOSTAPD_MODE_IEEE80211G:
280 return "802.11g";
281 case HOSTAPD_MODE_IEEE80211B:
282 default:
283 return "802.11b";
284 }
285 }
286
287
288 int radius_sta_rate(struct hostapd_data *hapd, struct sta_info *sta)
289 {
290 int i;
291 u8 rate = 0;
292
293 for (i = 0; i < sta->supported_rates_len; i++)
294 if ((sta->supported_rates[i] & 0x7f) > rate)
295 rate = sta->supported_rates[i] & 0x7f;
296
297 return rate;
298 }
299
300
301 #ifndef CONFIG_NO_RADIUS
302 static void ieee802_1x_learn_identity(struct hostapd_data *hapd,
303 struct eapol_state_machine *sm,
304 const u8 *eap, size_t len)
305 {
306 const u8 *identity;
307 size_t identity_len;
308 const struct eap_hdr *hdr = (const struct eap_hdr *) eap;
309
310 if (len <= sizeof(struct eap_hdr) ||
311 (hdr->code == EAP_CODE_RESPONSE &&
312 eap[sizeof(struct eap_hdr)] != EAP_TYPE_IDENTITY) ||
313 (hdr->code == EAP_CODE_INITIATE &&
314 eap[sizeof(struct eap_hdr)] != EAP_ERP_TYPE_REAUTH) ||
315 (hdr->code != EAP_CODE_RESPONSE &&
316 hdr->code != EAP_CODE_INITIATE))
317 return;
318
319 identity = eap_get_identity(sm->eap, &identity_len);
320 if (identity == NULL)
321 return;
322
323 /* Save station identity for future RADIUS packets */
324 os_free(sm->identity);
325 sm->identity = (u8 *) dup_binstr(identity, identity_len);
326 if (sm->identity == NULL) {
327 sm->identity_len = 0;
328 return;
329 }
330
331 sm->identity_len = identity_len;
332 hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
333 HOSTAPD_LEVEL_DEBUG, "STA identity '%s'", sm->identity);
334 sm->dot1xAuthEapolRespIdFramesRx++;
335 }
336
337
338 static int add_common_radius_sta_attr_rsn(struct hostapd_data *hapd,
339 struct hostapd_radius_attr *req_attr,
340 struct sta_info *sta,
341 struct radius_msg *msg)
342 {
343 u32 suite;
344 int ver, val;
345
346 ver = wpa_auth_sta_wpa_version(sta->wpa_sm);
347 val = wpa_auth_get_pairwise(sta->wpa_sm);
348 suite = wpa_cipher_to_suite(ver, val);
349 if (val != -1 &&
350 !hostapd_config_get_radius_attr(req_attr,
351 RADIUS_ATTR_WLAN_PAIRWISE_CIPHER) &&
352 !radius_msg_add_attr_int32(msg, RADIUS_ATTR_WLAN_PAIRWISE_CIPHER,
353 suite)) {
354 wpa_printf(MSG_ERROR, "Could not add WLAN-Pairwise-Cipher");
355 return -1;
356 }
357
358 suite = wpa_cipher_to_suite(((hapd->conf->wpa & 0x2) ||
359 hapd->conf->osen) ?
360 WPA_PROTO_RSN : WPA_PROTO_WPA,
361 hapd->conf->wpa_group);
362 if (!hostapd_config_get_radius_attr(req_attr,
363 RADIUS_ATTR_WLAN_GROUP_CIPHER) &&
364 !radius_msg_add_attr_int32(msg, RADIUS_ATTR_WLAN_GROUP_CIPHER,
365 suite)) {
366 wpa_printf(MSG_ERROR, "Could not add WLAN-Group-Cipher");
367 return -1;
368 }
369
370 val = wpa_auth_sta_key_mgmt(sta->wpa_sm);
371 suite = wpa_akm_to_suite(val);
372 if (val != -1 &&
373 !hostapd_config_get_radius_attr(req_attr,
374 RADIUS_ATTR_WLAN_AKM_SUITE) &&
375 !radius_msg_add_attr_int32(msg, RADIUS_ATTR_WLAN_AKM_SUITE,
376 suite)) {
377 wpa_printf(MSG_ERROR, "Could not add WLAN-AKM-Suite");
378 return -1;
379 }
380
381 #ifdef CONFIG_IEEE80211W
382 if (hapd->conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) {
383 suite = wpa_cipher_to_suite(WPA_PROTO_RSN,
384 hapd->conf->group_mgmt_cipher);
385 if (!hostapd_config_get_radius_attr(
386 req_attr, RADIUS_ATTR_WLAN_GROUP_MGMT_CIPHER) &&
387 !radius_msg_add_attr_int32(
388 msg, RADIUS_ATTR_WLAN_GROUP_MGMT_CIPHER, suite)) {
389 wpa_printf(MSG_ERROR,
390 "Could not add WLAN-Group-Mgmt-Cipher");
391 return -1;
392 }
393 }
394 #endif /* CONFIG_IEEE80211W */
395
396 return 0;
397 }
398
399
400 static int add_common_radius_sta_attr(struct hostapd_data *hapd,
401 struct hostapd_radius_attr *req_attr,
402 struct sta_info *sta,
403 struct radius_msg *msg)
404 {
405 char buf[128];
406
407 if (!hostapd_config_get_radius_attr(req_attr,
408 RADIUS_ATTR_NAS_PORT) &&
409 !radius_msg_add_attr_int32(msg, RADIUS_ATTR_NAS_PORT, sta->aid)) {
410 wpa_printf(MSG_ERROR, "Could not add NAS-Port");
411 return -1;
412 }
413
414 os_snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT,
415 MAC2STR(sta->addr));
416 buf[sizeof(buf) - 1] = '\0';
417 if (!radius_msg_add_attr(msg, RADIUS_ATTR_CALLING_STATION_ID,
418 (u8 *) buf, os_strlen(buf))) {
419 wpa_printf(MSG_ERROR, "Could not add Calling-Station-Id");
420 return -1;
421 }
422
423 if (sta->flags & WLAN_STA_PREAUTH) {
424 os_strlcpy(buf, "IEEE 802.11i Pre-Authentication",
425 sizeof(buf));
426 } else {
427 os_snprintf(buf, sizeof(buf), "CONNECT %d%sMbps %s",
428 radius_sta_rate(hapd, sta) / 2,
429 (radius_sta_rate(hapd, sta) & 1) ? ".5" : "",
430 radius_mode_txt(hapd));
431 buf[sizeof(buf) - 1] = '\0';
432 }
433 if (!hostapd_config_get_radius_attr(req_attr,
434 RADIUS_ATTR_CONNECT_INFO) &&
435 !radius_msg_add_attr(msg, RADIUS_ATTR_CONNECT_INFO,
436 (u8 *) buf, os_strlen(buf))) {
437 wpa_printf(MSG_ERROR, "Could not add Connect-Info");
438 return -1;
439 }
440
441 if (sta->acct_session_id) {
442 os_snprintf(buf, sizeof(buf), "%016lX",
443 (long unsigned int) sta->acct_session_id);
444 if (!radius_msg_add_attr(msg, RADIUS_ATTR_ACCT_SESSION_ID,
445 (u8 *) buf, os_strlen(buf))) {
446 wpa_printf(MSG_ERROR, "Could not add Acct-Session-Id");
447 return -1;
448 }
449 }
450
451 #ifdef CONFIG_IEEE80211R
452 if (hapd->conf->wpa && wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt) &&
453 sta->wpa_sm &&
454 (wpa_key_mgmt_ft(wpa_auth_sta_key_mgmt(sta->wpa_sm)) ||
455 sta->auth_alg == WLAN_AUTH_FT) &&
456 !hostapd_config_get_radius_attr(req_attr,
457 RADIUS_ATTR_MOBILITY_DOMAIN_ID) &&
458 !radius_msg_add_attr_int32(msg, RADIUS_ATTR_MOBILITY_DOMAIN_ID,
459 WPA_GET_BE16(
460 hapd->conf->mobility_domain))) {
461 wpa_printf(MSG_ERROR, "Could not add Mobility-Domain-Id");
462 return -1;
463 }
464 #endif /* CONFIG_IEEE80211R */
465
466 if ((hapd->conf->wpa || hapd->conf->osen) && sta->wpa_sm &&
467 add_common_radius_sta_attr_rsn(hapd, req_attr, sta, msg) < 0)
468 return -1;
469
470 return 0;
471 }
472
473
474 int add_common_radius_attr(struct hostapd_data *hapd,
475 struct hostapd_radius_attr *req_attr,
476 struct sta_info *sta,
477 struct radius_msg *msg)
478 {
479 char buf[128];
480 struct hostapd_radius_attr *attr;
481 int len;
482
483 if (!hostapd_config_get_radius_attr(req_attr,
484 RADIUS_ATTR_NAS_IP_ADDRESS) &&
485 hapd->conf->own_ip_addr.af == AF_INET &&
486 !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IP_ADDRESS,
487 (u8 *) &hapd->conf->own_ip_addr.u.v4, 4)) {
488 wpa_printf(MSG_ERROR, "Could not add NAS-IP-Address");
489 return -1;
490 }
491
492 #ifdef CONFIG_IPV6
493 if (!hostapd_config_get_radius_attr(req_attr,
494 RADIUS_ATTR_NAS_IPV6_ADDRESS) &&
495 hapd->conf->own_ip_addr.af == AF_INET6 &&
496 !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IPV6_ADDRESS,
497 (u8 *) &hapd->conf->own_ip_addr.u.v6, 16)) {
498 wpa_printf(MSG_ERROR, "Could not add NAS-IPv6-Address");
499 return -1;
500 }
501 #endif /* CONFIG_IPV6 */
502
503 if (!hostapd_config_get_radius_attr(req_attr,
504 RADIUS_ATTR_NAS_IDENTIFIER) &&
505 hapd->conf->nas_identifier &&
506 !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IDENTIFIER,
507 (u8 *) hapd->conf->nas_identifier,
508 os_strlen(hapd->conf->nas_identifier))) {
509 wpa_printf(MSG_ERROR, "Could not add NAS-Identifier");
510 return -1;
511 }
512
513 len = os_snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT ":",
514 MAC2STR(hapd->own_addr));
515 os_memcpy(&buf[len], hapd->conf->ssid.ssid,
516 hapd->conf->ssid.ssid_len);
517 len += hapd->conf->ssid.ssid_len;
518 if (!hostapd_config_get_radius_attr(req_attr,
519 RADIUS_ATTR_CALLED_STATION_ID) &&
520 !radius_msg_add_attr(msg, RADIUS_ATTR_CALLED_STATION_ID,
521 (u8 *) buf, len)) {
522 wpa_printf(MSG_ERROR, "Could not add Called-Station-Id");
523 return -1;
524 }
525
526 if (!hostapd_config_get_radius_attr(req_attr,
527 RADIUS_ATTR_NAS_PORT_TYPE) &&
528 !radius_msg_add_attr_int32(msg, RADIUS_ATTR_NAS_PORT_TYPE,
529 RADIUS_NAS_PORT_TYPE_IEEE_802_11)) {
530 wpa_printf(MSG_ERROR, "Could not add NAS-Port-Type");
531 return -1;
532 }
533
534 #ifdef CONFIG_INTERWORKING
535 if (hapd->conf->interworking &&
536 !is_zero_ether_addr(hapd->conf->hessid)) {
537 os_snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT,
538 MAC2STR(hapd->conf->hessid));
539 buf[sizeof(buf) - 1] = '\0';
540 if (!hostapd_config_get_radius_attr(req_attr,
541 RADIUS_ATTR_WLAN_HESSID) &&
542 !radius_msg_add_attr(msg, RADIUS_ATTR_WLAN_HESSID,
543 (u8 *) buf, os_strlen(buf))) {
544 wpa_printf(MSG_ERROR, "Could not add WLAN-HESSID");
545 return -1;
546 }
547 }
548 #endif /* CONFIG_INTERWORKING */
549
550 if (sta && add_common_radius_sta_attr(hapd, req_attr, sta, msg) < 0)
551 return -1;
552
553 for (attr = req_attr; attr; attr = attr->next) {
554 if (!radius_msg_add_attr(msg, attr->type,
555 wpabuf_head(attr->val),
556 wpabuf_len(attr->val))) {
557 wpa_printf(MSG_ERROR, "Could not add RADIUS "
558 "attribute");
559 return -1;
560 }
561 }
562
563 return 0;
564 }
565
566
567 static void ieee802_1x_encapsulate_radius(struct hostapd_data *hapd,
568 struct sta_info *sta,
569 const u8 *eap, size_t len)
570 {
571 struct radius_msg *msg;
572 struct eapol_state_machine *sm = sta->eapol_sm;
573
574 if (sm == NULL)
575 return;
576
577 ieee802_1x_learn_identity(hapd, sm, eap, len);
578
579 wpa_printf(MSG_DEBUG, "Encapsulating EAP message into a RADIUS "
580 "packet");
581
582 sm->radius_identifier = radius_client_get_id(hapd->radius);
583 msg = radius_msg_new(RADIUS_CODE_ACCESS_REQUEST,
584 sm->radius_identifier);
585 if (msg == NULL) {
586 wpa_printf(MSG_INFO, "Could not create new RADIUS packet");
587 return;
588 }
589
590 radius_msg_make_authenticator(msg, (u8 *) sta, sizeof(*sta));
591
592 if (sm->identity &&
593 !radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME,
594 sm->identity, sm->identity_len)) {
595 wpa_printf(MSG_INFO, "Could not add User-Name");
596 goto fail;
597 }
598
599 if (add_common_radius_attr(hapd, hapd->conf->radius_auth_req_attr, sta,
600 msg) < 0)
601 goto fail;
602
603 /* TODO: should probably check MTU from driver config; 2304 is max for
604 * IEEE 802.11, but use 1400 to avoid problems with too large packets
605 */
606 if (!hostapd_config_get_radius_attr(hapd->conf->radius_auth_req_attr,
607 RADIUS_ATTR_FRAMED_MTU) &&
608 !radius_msg_add_attr_int32(msg, RADIUS_ATTR_FRAMED_MTU, 1400)) {
609 wpa_printf(MSG_INFO, "Could not add Framed-MTU");
610 goto fail;
611 }
612
613 if (!radius_msg_add_eap(msg, eap, len)) {
614 wpa_printf(MSG_INFO, "Could not add EAP-Message");
615 goto fail;
616 }
617
618 /* State attribute must be copied if and only if this packet is
619 * Access-Request reply to the previous Access-Challenge */
620 if (sm->last_recv_radius &&
621 radius_msg_get_hdr(sm->last_recv_radius)->code ==
622 RADIUS_CODE_ACCESS_CHALLENGE) {
623 int res = radius_msg_copy_attr(msg, sm->last_recv_radius,
624 RADIUS_ATTR_STATE);
625 if (res < 0) {
626 wpa_printf(MSG_INFO, "Could not copy State attribute from previous Access-Challenge");
627 goto fail;
628 }
629 if (res > 0) {
630 wpa_printf(MSG_DEBUG, "Copied RADIUS State Attribute");
631 }
632 }
633
634 if (hapd->conf->radius_request_cui) {
635 const u8 *cui;
636 size_t cui_len;
637 /* Add previously learned CUI or nul CUI to request CUI */
638 if (sm->radius_cui) {
639 cui = wpabuf_head(sm->radius_cui);
640 cui_len = wpabuf_len(sm->radius_cui);
641 } else {
642 cui = (const u8 *) "\0";
643 cui_len = 1;
644 }
645 if (!radius_msg_add_attr(msg,
646 RADIUS_ATTR_CHARGEABLE_USER_IDENTITY,
647 cui, cui_len)) {
648 wpa_printf(MSG_ERROR, "Could not add CUI");
649 goto fail;
650 }
651 }
652
653 #ifdef CONFIG_HS20
654 if (hapd->conf->hs20) {
655 u8 ver = 1; /* Release 2 */
656 if (!radius_msg_add_wfa(
657 msg, RADIUS_VENDOR_ATTR_WFA_HS20_AP_VERSION,
658 &ver, 1)) {
659 wpa_printf(MSG_ERROR, "Could not add HS 2.0 AP "
660 "version");
661 goto fail;
662 }
663
664 if (sta->hs20_ie && wpabuf_len(sta->hs20_ie) > 0) {
665 const u8 *pos;
666 u8 buf[3];
667 u16 id;
668 pos = wpabuf_head_u8(sta->hs20_ie);
669 buf[0] = (*pos) >> 4;
670 if (((*pos) & HS20_PPS_MO_ID_PRESENT) &&
671 wpabuf_len(sta->hs20_ie) >= 3)
672 id = WPA_GET_LE16(pos + 1);
673 else
674 id = 0;
675 WPA_PUT_BE16(buf + 1, id);
676 if (!radius_msg_add_wfa(
677 msg,
678 RADIUS_VENDOR_ATTR_WFA_HS20_STA_VERSION,
679 buf, sizeof(buf))) {
680 wpa_printf(MSG_ERROR, "Could not add HS 2.0 "
681 "STA version");
682 goto fail;
683 }
684 }
685 }
686 #endif /* CONFIG_HS20 */
687
688 if (radius_client_send(hapd->radius, msg, RADIUS_AUTH, sta->addr) < 0)
689 goto fail;
690
691 return;
692
693 fail:
694 radius_msg_free(msg);
695 }
696 #endif /* CONFIG_NO_RADIUS */
697
698
699 static void handle_eap_response(struct hostapd_data *hapd,
700 struct sta_info *sta, struct eap_hdr *eap,
701 size_t len)
702 {
703 u8 type, *data;
704 struct eapol_state_machine *sm = sta->eapol_sm;
705 if (sm == NULL)
706 return;
707
708 data = (u8 *) (eap + 1);
709
710 if (len < sizeof(*eap) + 1) {
711 wpa_printf(MSG_INFO, "handle_eap_response: too short response data");
712 return;
713 }
714
715 sm->eap_type_supp = type = data[0];
716
717 hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
718 HOSTAPD_LEVEL_DEBUG, "received EAP packet (code=%d "
719 "id=%d len=%d) from STA: EAP Response-%s (%d)",
720 eap->code, eap->identifier, be_to_host16(eap->length),
721 eap_server_get_name(0, type), type);
722
723 sm->dot1xAuthEapolRespFramesRx++;
724
725 wpabuf_free(sm->eap_if->eapRespData);
726 sm->eap_if->eapRespData = wpabuf_alloc_copy(eap, len);
727 sm->eapolEap = TRUE;
728 }
729
730
731 static void handle_eap_initiate(struct hostapd_data *hapd,
732 struct sta_info *sta, struct eap_hdr *eap,
733 size_t len)
734 {
735 #ifdef CONFIG_ERP
736 u8 type, *data;
737 struct eapol_state_machine *sm = sta->eapol_sm;
738
739 if (sm == NULL)
740 return;
741
742 if (len < sizeof(*eap) + 1) {
743 wpa_printf(MSG_INFO,
744 "handle_eap_initiate: too short response data");
745 return;
746 }
747
748 data = (u8 *) (eap + 1);
749 type = data[0];
750
751 hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
752 HOSTAPD_LEVEL_DEBUG, "received EAP packet (code=%d "
753 "id=%d len=%d) from STA: EAP Initiate type %u",
754 eap->code, eap->identifier, be_to_host16(eap->length),
755 type);
756
757 wpabuf_free(sm->eap_if->eapRespData);
758 sm->eap_if->eapRespData = wpabuf_alloc_copy(eap, len);
759 sm->eapolEap = TRUE;
760 #endif /* CONFIG_ERP */
761 }
762
763
764 /* Process incoming EAP packet from Supplicant */
765 static void handle_eap(struct hostapd_data *hapd, struct sta_info *sta,
766 u8 *buf, size_t len)
767 {
768 struct eap_hdr *eap;
769 u16 eap_len;
770
771 if (len < sizeof(*eap)) {
772 wpa_printf(MSG_INFO, " too short EAP packet");
773 return;
774 }
775
776 eap = (struct eap_hdr *) buf;
777
778 eap_len = be_to_host16(eap->length);
779 wpa_printf(MSG_DEBUG, "EAP: code=%d identifier=%d length=%d",
780 eap->code, eap->identifier, eap_len);
781 if (eap_len < sizeof(*eap)) {
782 wpa_printf(MSG_DEBUG, " Invalid EAP length");
783 return;
784 } else if (eap_len > len) {
785 wpa_printf(MSG_DEBUG, " Too short frame to contain this EAP "
786 "packet");
787 return;
788 } else if (eap_len < len) {
789 wpa_printf(MSG_DEBUG, " Ignoring %lu extra bytes after EAP "
790 "packet", (unsigned long) len - eap_len);
791 }
792
793 switch (eap->code) {
794 case EAP_CODE_REQUEST:
795 wpa_printf(MSG_DEBUG, " (request)");
796 return;
797 case EAP_CODE_RESPONSE:
798 wpa_printf(MSG_DEBUG, " (response)");
799 handle_eap_response(hapd, sta, eap, eap_len);
800 break;
801 case EAP_CODE_SUCCESS:
802 wpa_printf(MSG_DEBUG, " (success)");
803 return;
804 case EAP_CODE_FAILURE:
805 wpa_printf(MSG_DEBUG, " (failure)");
806 return;
807 case EAP_CODE_INITIATE:
808 wpa_printf(MSG_DEBUG, " (initiate)");
809 handle_eap_initiate(hapd, sta, eap, eap_len);
810 break;
811 case EAP_CODE_FINISH:
812 wpa_printf(MSG_DEBUG, " (finish)");
813 break;
814 default:
815 wpa_printf(MSG_DEBUG, " (unknown code)");
816 return;
817 }
818 }
819
820
821 static struct eapol_state_machine *
822 ieee802_1x_alloc_eapol_sm(struct hostapd_data *hapd, struct sta_info *sta)
823 {
824 int flags = 0;
825 if (sta->flags & WLAN_STA_PREAUTH)
826 flags |= EAPOL_SM_PREAUTH;
827 if (sta->wpa_sm) {
828 flags |= EAPOL_SM_USES_WPA;
829 if (wpa_auth_sta_get_pmksa(sta->wpa_sm))
830 flags |= EAPOL_SM_FROM_PMKSA_CACHE;
831 }
832 return eapol_auth_alloc(hapd->eapol_auth, sta->addr, flags,
833 sta->wps_ie, sta->p2p_ie, sta,
834 sta->identity, sta->radius_cui);
835 }
836
837
838 /**
839 * ieee802_1x_receive - Process the EAPOL frames from the Supplicant
840 * @hapd: hostapd BSS data
841 * @sa: Source address (sender of the EAPOL frame)
842 * @buf: EAPOL frame
843 * @len: Length of buf in octets
844 *
845 * This function is called for each incoming EAPOL frame from the interface
846 */
847 void ieee802_1x_receive(struct hostapd_data *hapd, const u8 *sa, const u8 *buf,
848 size_t len)
849 {
850 struct sta_info *sta;
851 struct ieee802_1x_hdr *hdr;
852 struct ieee802_1x_eapol_key *key;
853 u16 datalen;
854 struct rsn_pmksa_cache_entry *pmksa;
855 int key_mgmt;
856
857 if (!hapd->conf->ieee802_1x && !hapd->conf->wpa && !hapd->conf->osen &&
858 !hapd->conf->wps_state)
859 return;
860
861 wpa_printf(MSG_DEBUG, "IEEE 802.1X: %lu bytes from " MACSTR,
862 (unsigned long) len, MAC2STR(sa));
863 sta = ap_get_sta(hapd, sa);
864 if (!sta || (!(sta->flags & (WLAN_STA_ASSOC | WLAN_STA_PREAUTH)) &&
865 !(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_WIRED))) {
866 wpa_printf(MSG_DEBUG, "IEEE 802.1X data frame from not "
867 "associated/Pre-authenticating STA");
868 return;
869 }
870
871 if (len < sizeof(*hdr)) {
872 wpa_printf(MSG_INFO, " too short IEEE 802.1X packet");
873 return;
874 }
875
876 hdr = (struct ieee802_1x_hdr *) buf;
877 datalen = be_to_host16(hdr->length);
878 wpa_printf(MSG_DEBUG, " IEEE 802.1X: version=%d type=%d length=%d",
879 hdr->version, hdr->type, datalen);
880
881 if (len - sizeof(*hdr) < datalen) {
882 wpa_printf(MSG_INFO, " frame too short for this IEEE 802.1X packet");
883 if (sta->eapol_sm)
884 sta->eapol_sm->dot1xAuthEapLengthErrorFramesRx++;
885 return;
886 }
887 if (len - sizeof(*hdr) > datalen) {
888 wpa_printf(MSG_DEBUG, " ignoring %lu extra octets after "
889 "IEEE 802.1X packet",
890 (unsigned long) len - sizeof(*hdr) - datalen);
891 }
892
893 if (sta->eapol_sm) {
894 sta->eapol_sm->dot1xAuthLastEapolFrameVersion = hdr->version;
895 sta->eapol_sm->dot1xAuthEapolFramesRx++;
896 }
897
898 key = (struct ieee802_1x_eapol_key *) (hdr + 1);
899 if (datalen >= sizeof(struct ieee802_1x_eapol_key) &&
900 hdr->type == IEEE802_1X_TYPE_EAPOL_KEY &&
901 (key->type == EAPOL_KEY_TYPE_WPA ||
902 key->type == EAPOL_KEY_TYPE_RSN)) {
903 wpa_receive(hapd->wpa_auth, sta->wpa_sm, (u8 *) hdr,
904 sizeof(*hdr) + datalen);
905 return;
906 }
907
908 if (!hapd->conf->ieee802_1x && !hapd->conf->osen &&
909 !(sta->flags & (WLAN_STA_WPS | WLAN_STA_MAYBE_WPS))) {
910 wpa_printf(MSG_DEBUG, "IEEE 802.1X: Ignore EAPOL message - "
911 "802.1X not enabled and WPS not used");
912 return;
913 }
914
915 key_mgmt = wpa_auth_sta_key_mgmt(sta->wpa_sm);
916 if (key_mgmt != -1 && wpa_key_mgmt_wpa_psk(key_mgmt)) {
917 wpa_printf(MSG_DEBUG, "IEEE 802.1X: Ignore EAPOL message - "
918 "STA is using PSK");
919 return;
920 }
921
922 if (!sta->eapol_sm) {
923 sta->eapol_sm = ieee802_1x_alloc_eapol_sm(hapd, sta);
924 if (!sta->eapol_sm)
925 return;
926
927 #ifdef CONFIG_WPS
928 if (!hapd->conf->ieee802_1x && hapd->conf->wps_state) {
929 u32 wflags = sta->flags & (WLAN_STA_WPS |
930 WLAN_STA_WPS2 |
931 WLAN_STA_MAYBE_WPS);
932 if (wflags == WLAN_STA_MAYBE_WPS ||
933 wflags == (WLAN_STA_WPS | WLAN_STA_MAYBE_WPS)) {
934 /*
935 * Delay EAPOL frame transmission until a
936 * possible WPS STA initiates the handshake
937 * with EAPOL-Start. Only allow the wait to be
938 * skipped if the STA is known to support WPS
939 * 2.0.
940 */
941 wpa_printf(MSG_DEBUG, "WPS: Do not start "
942 "EAPOL until EAPOL-Start is "
943 "received");
944 sta->eapol_sm->flags |= EAPOL_SM_WAIT_START;
945 }
946 }
947 #endif /* CONFIG_WPS */
948
949 sta->eapol_sm->eap_if->portEnabled = TRUE;
950 }
951
952 /* since we support version 1, we can ignore version field and proceed
953 * as specified in version 1 standard [IEEE Std 802.1X-2001, 7.5.5] */
954 /* TODO: actually, we are not version 1 anymore.. However, Version 2
955 * does not change frame contents, so should be ok to process frames
956 * more or less identically. Some changes might be needed for
957 * verification of fields. */
958
959 switch (hdr->type) {
960 case IEEE802_1X_TYPE_EAP_PACKET:
961 handle_eap(hapd, sta, (u8 *) (hdr + 1), datalen);
962 break;
963
964 case IEEE802_1X_TYPE_EAPOL_START:
965 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
966 HOSTAPD_LEVEL_DEBUG, "received EAPOL-Start "
967 "from STA");
968 sta->eapol_sm->flags &= ~EAPOL_SM_WAIT_START;
969 pmksa = wpa_auth_sta_get_pmksa(sta->wpa_sm);
970 if (pmksa) {
971 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA,
972 HOSTAPD_LEVEL_DEBUG, "cached PMKSA "
973 "available - ignore it since "
974 "STA sent EAPOL-Start");
975 wpa_auth_sta_clear_pmksa(sta->wpa_sm, pmksa);
976 }
977 sta->eapol_sm->eapolStart = TRUE;
978 sta->eapol_sm->dot1xAuthEapolStartFramesRx++;
979 eap_server_clear_identity(sta->eapol_sm->eap);
980 wpa_auth_sm_event(sta->wpa_sm, WPA_REAUTH_EAPOL);
981 break;
982
983 case IEEE802_1X_TYPE_EAPOL_LOGOFF:
984 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
985 HOSTAPD_LEVEL_DEBUG, "received EAPOL-Logoff "
986 "from STA");
987 sta->acct_terminate_cause =
988 RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
989 accounting_sta_stop(hapd, sta);
990 sta->eapol_sm->eapolLogoff = TRUE;
991 sta->eapol_sm->dot1xAuthEapolLogoffFramesRx++;
992 eap_server_clear_identity(sta->eapol_sm->eap);
993 break;
994
995 case IEEE802_1X_TYPE_EAPOL_KEY:
996 wpa_printf(MSG_DEBUG, " EAPOL-Key");
997 if (!ap_sta_is_authorized(sta)) {
998 wpa_printf(MSG_DEBUG, " Dropped key data from "
999 "unauthorized Supplicant");
1000 break;
1001 }
1002 break;
1003
1004 case IEEE802_1X_TYPE_EAPOL_ENCAPSULATED_ASF_ALERT:
1005 wpa_printf(MSG_DEBUG, " EAPOL-Encapsulated-ASF-Alert");
1006 /* TODO: implement support for this; show data */
1007 break;
1008
1009 default:
1010 wpa_printf(MSG_DEBUG, " unknown IEEE 802.1X packet type");
1011 sta->eapol_sm->dot1xAuthInvalidEapolFramesRx++;
1012 break;
1013 }
1014
1015 eapol_auth_step(sta->eapol_sm);
1016 }
1017
1018
1019 /**
1020 * ieee802_1x_new_station - Start IEEE 802.1X authentication
1021 * @hapd: hostapd BSS data
1022 * @sta: The station
1023 *
1024 * This function is called to start IEEE 802.1X authentication when a new
1025 * station completes IEEE 802.11 association.
1026 */
1027 void ieee802_1x_new_station(struct hostapd_data *hapd, struct sta_info *sta)
1028 {
1029 struct rsn_pmksa_cache_entry *pmksa;
1030 int reassoc = 1;
1031 int force_1x = 0;
1032 int key_mgmt;
1033
1034 #ifdef CONFIG_WPS
1035 if (hapd->conf->wps_state &&
1036 ((hapd->conf->wpa && (sta->flags & WLAN_STA_MAYBE_WPS)) ||
1037 (sta->flags & WLAN_STA_WPS))) {
1038 /*
1039 * Need to enable IEEE 802.1X/EAPOL state machines for possible
1040 * WPS handshake even if IEEE 802.1X/EAPOL is not used for
1041 * authentication in this BSS.
1042 */
1043 force_1x = 1;
1044 }
1045 #endif /* CONFIG_WPS */
1046
1047 if (!force_1x && !hapd->conf->ieee802_1x && !hapd->conf->osen) {
1048 wpa_printf(MSG_DEBUG, "IEEE 802.1X: Ignore STA - "
1049 "802.1X not enabled or forced for WPS");
1050 /*
1051 * Clear any possible EAPOL authenticator state to support
1052 * reassociation change from WPS to PSK.
1053 */
1054 ieee802_1x_free_station(hapd, sta);
1055 return;
1056 }
1057
1058 key_mgmt = wpa_auth_sta_key_mgmt(sta->wpa_sm);
1059 if (key_mgmt != -1 && wpa_key_mgmt_wpa_psk(key_mgmt)) {
1060 wpa_printf(MSG_DEBUG, "IEEE 802.1X: Ignore STA - using PSK");
1061 /*
1062 * Clear any possible EAPOL authenticator state to support
1063 * reassociation change from WPA-EAP to PSK.
1064 */
1065 ieee802_1x_free_station(hapd, sta);
1066 return;
1067 }
1068
1069 if (sta->eapol_sm == NULL) {
1070 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1071 HOSTAPD_LEVEL_DEBUG, "start authentication");
1072 sta->eapol_sm = ieee802_1x_alloc_eapol_sm(hapd, sta);
1073 if (sta->eapol_sm == NULL) {
1074 hostapd_logger(hapd, sta->addr,
1075 HOSTAPD_MODULE_IEEE8021X,
1076 HOSTAPD_LEVEL_INFO,
1077 "failed to allocate state machine");
1078 return;
1079 }
1080 reassoc = 0;
1081 }
1082
1083 #ifdef CONFIG_WPS
1084 sta->eapol_sm->flags &= ~EAPOL_SM_WAIT_START;
1085 if (!hapd->conf->ieee802_1x && hapd->conf->wps_state &&
1086 !(sta->flags & WLAN_STA_WPS2)) {
1087 /*
1088 * Delay EAPOL frame transmission until a possible WPS STA
1089 * initiates the handshake with EAPOL-Start. Only allow the
1090 * wait to be skipped if the STA is known to support WPS 2.0.
1091 */
1092 wpa_printf(MSG_DEBUG, "WPS: Do not start EAPOL until "
1093 "EAPOL-Start is received");
1094 sta->eapol_sm->flags |= EAPOL_SM_WAIT_START;
1095 }
1096 #endif /* CONFIG_WPS */
1097
1098 sta->eapol_sm->eap_if->portEnabled = TRUE;
1099
1100 #ifdef CONFIG_IEEE80211R
1101 if (sta->auth_alg == WLAN_AUTH_FT) {
1102 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1103 HOSTAPD_LEVEL_DEBUG,
1104 "PMK from FT - skip IEEE 802.1X/EAP");
1105 /* Setup EAPOL state machines to already authenticated state
1106 * because of existing FT information from R0KH. */
1107 sta->eapol_sm->keyRun = TRUE;
1108 sta->eapol_sm->eap_if->eapKeyAvailable = TRUE;
1109 sta->eapol_sm->auth_pae_state = AUTH_PAE_AUTHENTICATING;
1110 sta->eapol_sm->be_auth_state = BE_AUTH_SUCCESS;
1111 sta->eapol_sm->authSuccess = TRUE;
1112 sta->eapol_sm->authFail = FALSE;
1113 sta->eapol_sm->portValid = TRUE;
1114 if (sta->eapol_sm->eap)
1115 eap_sm_notify_cached(sta->eapol_sm->eap);
1116 /* TODO: get vlan_id from R0KH using RRB message */
1117 return;
1118 }
1119 #endif /* CONFIG_IEEE80211R */
1120
1121 pmksa = wpa_auth_sta_get_pmksa(sta->wpa_sm);
1122 if (pmksa) {
1123 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1124 HOSTAPD_LEVEL_DEBUG,
1125 "PMK from PMKSA cache - skip IEEE 802.1X/EAP");
1126 /* Setup EAPOL state machines to already authenticated state
1127 * because of existing PMKSA information in the cache. */
1128 sta->eapol_sm->keyRun = TRUE;
1129 sta->eapol_sm->eap_if->eapKeyAvailable = TRUE;
1130 sta->eapol_sm->auth_pae_state = AUTH_PAE_AUTHENTICATING;
1131 sta->eapol_sm->be_auth_state = BE_AUTH_SUCCESS;
1132 sta->eapol_sm->authSuccess = TRUE;
1133 sta->eapol_sm->authFail = FALSE;
1134 if (sta->eapol_sm->eap)
1135 eap_sm_notify_cached(sta->eapol_sm->eap);
1136 pmksa_cache_to_eapol_data(pmksa, sta->eapol_sm);
1137 ap_sta_bind_vlan(hapd, sta);
1138 } else {
1139 if (reassoc) {
1140 /*
1141 * Force EAPOL state machines to start
1142 * re-authentication without having to wait for the
1143 * Supplicant to send EAPOL-Start.
1144 */
1145 sta->eapol_sm->reAuthenticate = TRUE;
1146 }
1147 eapol_auth_step(sta->eapol_sm);
1148 }
1149 }
1150
1151
1152 void ieee802_1x_free_station(struct hostapd_data *hapd, struct sta_info *sta)
1153 {
1154 struct eapol_state_machine *sm = sta->eapol_sm;
1155
1156 #ifdef CONFIG_HS20
1157 eloop_cancel_timeout(ieee802_1x_wnm_notif_send, hapd, sta);
1158 #endif /* CONFIG_HS20 */
1159
1160 if (sm == NULL)
1161 return;
1162
1163 sta->eapol_sm = NULL;
1164
1165 #ifndef CONFIG_NO_RADIUS
1166 radius_msg_free(sm->last_recv_radius);
1167 radius_free_class(&sm->radius_class);
1168 #endif /* CONFIG_NO_RADIUS */
1169
1170 eapol_auth_free(sm);
1171 }
1172
1173
1174 #ifndef CONFIG_NO_RADIUS
1175 static void ieee802_1x_decapsulate_radius(struct hostapd_data *hapd,
1176 struct sta_info *sta)
1177 {
1178 struct wpabuf *eap;
1179 const struct eap_hdr *hdr;
1180 int eap_type = -1;
1181 char buf[64];
1182 struct radius_msg *msg;
1183 struct eapol_state_machine *sm = sta->eapol_sm;
1184
1185 if (sm == NULL || sm->last_recv_radius == NULL) {
1186 if (sm)
1187 sm->eap_if->aaaEapNoReq = TRUE;
1188 return;
1189 }
1190
1191 msg = sm->last_recv_radius;
1192
1193 eap = radius_msg_get_eap(msg);
1194 if (eap == NULL) {
1195 /* RFC 3579, Chap. 2.6.3:
1196 * RADIUS server SHOULD NOT send Access-Reject/no EAP-Message
1197 * attribute */
1198 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1199 HOSTAPD_LEVEL_WARNING, "could not extract "
1200 "EAP-Message from RADIUS message");
1201 sm->eap_if->aaaEapNoReq = TRUE;
1202 return;
1203 }
1204
1205 if (wpabuf_len(eap) < sizeof(*hdr)) {
1206 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1207 HOSTAPD_LEVEL_WARNING, "too short EAP packet "
1208 "received from authentication server");
1209 wpabuf_free(eap);
1210 sm->eap_if->aaaEapNoReq = TRUE;
1211 return;
1212 }
1213
1214 if (wpabuf_len(eap) > sizeof(*hdr))
1215 eap_type = (wpabuf_head_u8(eap))[sizeof(*hdr)];
1216
1217 hdr = wpabuf_head(eap);
1218 switch (hdr->code) {
1219 case EAP_CODE_REQUEST:
1220 if (eap_type >= 0)
1221 sm->eap_type_authsrv = eap_type;
1222 os_snprintf(buf, sizeof(buf), "EAP-Request-%s (%d)",
1223 eap_server_get_name(0, eap_type), eap_type);
1224 break;
1225 case EAP_CODE_RESPONSE:
1226 os_snprintf(buf, sizeof(buf), "EAP Response-%s (%d)",
1227 eap_server_get_name(0, eap_type), eap_type);
1228 break;
1229 case EAP_CODE_SUCCESS:
1230 os_strlcpy(buf, "EAP Success", sizeof(buf));
1231 break;
1232 case EAP_CODE_FAILURE:
1233 os_strlcpy(buf, "EAP Failure", sizeof(buf));
1234 break;
1235 default:
1236 os_strlcpy(buf, "unknown EAP code", sizeof(buf));
1237 break;
1238 }
1239 buf[sizeof(buf) - 1] = '\0';
1240 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1241 HOSTAPD_LEVEL_DEBUG, "decapsulated EAP packet (code=%d "
1242 "id=%d len=%d) from RADIUS server: %s",
1243 hdr->code, hdr->identifier, be_to_host16(hdr->length),
1244 buf);
1245 sm->eap_if->aaaEapReq = TRUE;
1246
1247 wpabuf_free(sm->eap_if->aaaEapReqData);
1248 sm->eap_if->aaaEapReqData = eap;
1249 }
1250
1251
1252 static void ieee802_1x_get_keys(struct hostapd_data *hapd,
1253 struct sta_info *sta, struct radius_msg *msg,
1254 struct radius_msg *req,
1255 const u8 *shared_secret,
1256 size_t shared_secret_len)
1257 {
1258 struct radius_ms_mppe_keys *keys;
1259 struct eapol_state_machine *sm = sta->eapol_sm;
1260 if (sm == NULL)
1261 return;
1262
1263 keys = radius_msg_get_ms_keys(msg, req, shared_secret,
1264 shared_secret_len);
1265
1266 if (keys && keys->send && keys->recv) {
1267 size_t len = keys->send_len + keys->recv_len;
1268 wpa_hexdump_key(MSG_DEBUG, "MS-MPPE-Send-Key",
1269 keys->send, keys->send_len);
1270 wpa_hexdump_key(MSG_DEBUG, "MS-MPPE-Recv-Key",
1271 keys->recv, keys->recv_len);
1272
1273 os_free(sm->eap_if->aaaEapKeyData);
1274 sm->eap_if->aaaEapKeyData = os_malloc(len);
1275 if (sm->eap_if->aaaEapKeyData) {
1276 os_memcpy(sm->eap_if->aaaEapKeyData, keys->recv,
1277 keys->recv_len);
1278 os_memcpy(sm->eap_if->aaaEapKeyData + keys->recv_len,
1279 keys->send, keys->send_len);
1280 sm->eap_if->aaaEapKeyDataLen = len;
1281 sm->eap_if->aaaEapKeyAvailable = TRUE;
1282 }
1283 } else {
1284 wpa_printf(MSG_DEBUG,
1285 "MS-MPPE: 1x_get_keys, could not get keys: %p send: %p recv: %p",
1286 keys, keys ? keys->send : NULL,
1287 keys ? keys->recv : NULL);
1288 }
1289
1290 if (keys) {
1291 os_free(keys->send);
1292 os_free(keys->recv);
1293 os_free(keys);
1294 }
1295 }
1296
1297
1298 static void ieee802_1x_store_radius_class(struct hostapd_data *hapd,
1299 struct sta_info *sta,
1300 struct radius_msg *msg)
1301 {
1302 u8 *attr_class;
1303 size_t class_len;
1304 struct eapol_state_machine *sm = sta->eapol_sm;
1305 int count, i;
1306 struct radius_attr_data *nclass;
1307 size_t nclass_count;
1308
1309 if (!hapd->conf->radius->acct_server || hapd->radius == NULL ||
1310 sm == NULL)
1311 return;
1312
1313 radius_free_class(&sm->radius_class);
1314 count = radius_msg_count_attr(msg, RADIUS_ATTR_CLASS, 1);
1315 if (count <= 0)
1316 return;
1317
1318 nclass = os_calloc(count, sizeof(struct radius_attr_data));
1319 if (nclass == NULL)
1320 return;
1321
1322 nclass_count = 0;
1323
1324 attr_class = NULL;
1325 for (i = 0; i < count; i++) {
1326 do {
1327 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_CLASS,
1328 &attr_class, &class_len,
1329 attr_class) < 0) {
1330 i = count;
1331 break;
1332 }
1333 } while (class_len < 1);
1334
1335 nclass[nclass_count].data = os_malloc(class_len);
1336 if (nclass[nclass_count].data == NULL)
1337 break;
1338
1339 os_memcpy(nclass[nclass_count].data, attr_class, class_len);
1340 nclass[nclass_count].len = class_len;
1341 nclass_count++;
1342 }
1343
1344 sm->radius_class.attr = nclass;
1345 sm->radius_class.count = nclass_count;
1346 wpa_printf(MSG_DEBUG, "IEEE 802.1X: Stored %lu RADIUS Class "
1347 "attributes for " MACSTR,
1348 (unsigned long) sm->radius_class.count,
1349 MAC2STR(sta->addr));
1350 }
1351
1352
1353 /* Update sta->identity based on User-Name attribute in Access-Accept */
1354 static void ieee802_1x_update_sta_identity(struct hostapd_data *hapd,
1355 struct sta_info *sta,
1356 struct radius_msg *msg)
1357 {
1358 u8 *buf, *identity;
1359 size_t len;
1360 struct eapol_state_machine *sm = sta->eapol_sm;
1361
1362 if (sm == NULL)
1363 return;
1364
1365 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_USER_NAME, &buf, &len,
1366 NULL) < 0)
1367 return;
1368
1369 identity = (u8 *) dup_binstr(buf, len);
1370 if (identity == NULL)
1371 return;
1372
1373 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1374 HOSTAPD_LEVEL_DEBUG, "old identity '%s' updated with "
1375 "User-Name from Access-Accept '%s'",
1376 sm->identity ? (char *) sm->identity : "N/A",
1377 (char *) identity);
1378
1379 os_free(sm->identity);
1380 sm->identity = identity;
1381 sm->identity_len = len;
1382 }
1383
1384
1385 /* Update CUI based on Chargeable-User-Identity attribute in Access-Accept */
1386 static void ieee802_1x_update_sta_cui(struct hostapd_data *hapd,
1387 struct sta_info *sta,
1388 struct radius_msg *msg)
1389 {
1390 struct eapol_state_machine *sm = sta->eapol_sm;
1391 struct wpabuf *cui;
1392 u8 *buf;
1393 size_t len;
1394
1395 if (sm == NULL)
1396 return;
1397
1398 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_CHARGEABLE_USER_IDENTITY,
1399 &buf, &len, NULL) < 0)
1400 return;
1401
1402 cui = wpabuf_alloc_copy(buf, len);
1403 if (cui == NULL)
1404 return;
1405
1406 wpabuf_free(sm->radius_cui);
1407 sm->radius_cui = cui;
1408 }
1409
1410
1411 #ifdef CONFIG_HS20
1412
1413 static void ieee802_1x_hs20_sub_rem(struct sta_info *sta, u8 *pos, size_t len)
1414 {
1415 sta->remediation = 1;
1416 os_free(sta->remediation_url);
1417 if (len > 2) {
1418 sta->remediation_url = os_malloc(len);
1419 if (!sta->remediation_url)
1420 return;
1421 sta->remediation_method = pos[0];
1422 os_memcpy(sta->remediation_url, pos + 1, len - 1);
1423 sta->remediation_url[len - 1] = '\0';
1424 wpa_printf(MSG_DEBUG, "HS 2.0: Subscription remediation needed "
1425 "for " MACSTR " - server method %u URL %s",
1426 MAC2STR(sta->addr), sta->remediation_method,
1427 sta->remediation_url);
1428 } else {
1429 sta->remediation_url = NULL;
1430 wpa_printf(MSG_DEBUG, "HS 2.0: Subscription remediation needed "
1431 "for " MACSTR, MAC2STR(sta->addr));
1432 }
1433 /* TODO: assign the STA into remediation VLAN or add filtering */
1434 }
1435
1436
1437 static void ieee802_1x_hs20_deauth_req(struct hostapd_data *hapd,
1438 struct sta_info *sta, u8 *pos,
1439 size_t len)
1440 {
1441 if (len < 3)
1442 return; /* Malformed information */
1443 sta->hs20_deauth_requested = 1;
1444 wpa_printf(MSG_DEBUG, "HS 2.0: Deauthentication request - Code %u "
1445 "Re-auth Delay %u",
1446 *pos, WPA_GET_LE16(pos + 1));
1447 wpabuf_free(sta->hs20_deauth_req);
1448 sta->hs20_deauth_req = wpabuf_alloc(len + 1);
1449 if (sta->hs20_deauth_req) {
1450 wpabuf_put_data(sta->hs20_deauth_req, pos, 3);
1451 wpabuf_put_u8(sta->hs20_deauth_req, len - 3);
1452 wpabuf_put_data(sta->hs20_deauth_req, pos + 3, len - 3);
1453 }
1454 ap_sta_session_timeout(hapd, sta, hapd->conf->hs20_deauth_req_timeout);
1455 }
1456
1457
1458 static void ieee802_1x_hs20_session_info(struct hostapd_data *hapd,
1459 struct sta_info *sta, u8 *pos,
1460 size_t len, int session_timeout)
1461 {
1462 unsigned int swt;
1463 int warning_time, beacon_int;
1464
1465 if (len < 1)
1466 return; /* Malformed information */
1467 os_free(sta->hs20_session_info_url);
1468 sta->hs20_session_info_url = os_malloc(len);
1469 if (sta->hs20_session_info_url == NULL)
1470 return;
1471 swt = pos[0];
1472 os_memcpy(sta->hs20_session_info_url, pos + 1, len - 1);
1473 sta->hs20_session_info_url[len - 1] = '\0';
1474 wpa_printf(MSG_DEBUG, "HS 2.0: Session Information URL='%s' SWT=%u "
1475 "(session_timeout=%d)",
1476 sta->hs20_session_info_url, swt, session_timeout);
1477 if (session_timeout < 0) {
1478 wpa_printf(MSG_DEBUG, "HS 2.0: No Session-Timeout set - ignore session info URL");
1479 return;
1480 }
1481 if (swt == 255)
1482 swt = 1; /* Use one minute as the AP selected value */
1483
1484 if ((unsigned int) session_timeout < swt * 60)
1485 warning_time = 0;
1486 else
1487 warning_time = session_timeout - swt * 60;
1488
1489 beacon_int = hapd->iconf->beacon_int;
1490 if (beacon_int < 1)
1491 beacon_int = 100; /* best guess */
1492 sta->hs20_disassoc_timer = swt * 60 * 1000 / beacon_int * 125 / 128;
1493 if (sta->hs20_disassoc_timer > 65535)
1494 sta->hs20_disassoc_timer = 65535;
1495
1496 ap_sta_session_warning_timeout(hapd, sta, warning_time);
1497 }
1498
1499 #endif /* CONFIG_HS20 */
1500
1501
1502 static void ieee802_1x_check_hs20(struct hostapd_data *hapd,
1503 struct sta_info *sta,
1504 struct radius_msg *msg,
1505 int session_timeout)
1506 {
1507 #ifdef CONFIG_HS20
1508 u8 *buf, *pos, *end, type, sublen;
1509 size_t len;
1510
1511 buf = NULL;
1512 sta->remediation = 0;
1513 sta->hs20_deauth_requested = 0;
1514
1515 for (;;) {
1516 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_VENDOR_SPECIFIC,
1517 &buf, &len, buf) < 0)
1518 break;
1519 if (len < 6)
1520 continue;
1521 pos = buf;
1522 end = buf + len;
1523 if (WPA_GET_BE32(pos) != RADIUS_VENDOR_ID_WFA)
1524 continue;
1525 pos += 4;
1526
1527 type = *pos++;
1528 sublen = *pos++;
1529 if (sublen < 2)
1530 continue; /* invalid length */
1531 sublen -= 2; /* skip header */
1532 if (pos + sublen > end)
1533 continue; /* invalid WFA VSA */
1534
1535 switch (type) {
1536 case RADIUS_VENDOR_ATTR_WFA_HS20_SUBSCR_REMEDIATION:
1537 ieee802_1x_hs20_sub_rem(sta, pos, sublen);
1538 break;
1539 case RADIUS_VENDOR_ATTR_WFA_HS20_DEAUTH_REQ:
1540 ieee802_1x_hs20_deauth_req(hapd, sta, pos, sublen);
1541 break;
1542 case RADIUS_VENDOR_ATTR_WFA_HS20_SESSION_INFO_URL:
1543 ieee802_1x_hs20_session_info(hapd, sta, pos, sublen,
1544 session_timeout);
1545 break;
1546 }
1547 }
1548 #endif /* CONFIG_HS20 */
1549 }
1550
1551
1552 struct sta_id_search {
1553 u8 identifier;
1554 struct eapol_state_machine *sm;
1555 };
1556
1557
1558 static int ieee802_1x_select_radius_identifier(struct hostapd_data *hapd,
1559 struct sta_info *sta,
1560 void *ctx)
1561 {
1562 struct sta_id_search *id_search = ctx;
1563 struct eapol_state_machine *sm = sta->eapol_sm;
1564
1565 if (sm && sm->radius_identifier >= 0 &&
1566 sm->radius_identifier == id_search->identifier) {
1567 id_search->sm = sm;
1568 return 1;
1569 }
1570 return 0;
1571 }
1572
1573
1574 static struct eapol_state_machine *
1575 ieee802_1x_search_radius_identifier(struct hostapd_data *hapd, u8 identifier)
1576 {
1577 struct sta_id_search id_search;
1578 id_search.identifier = identifier;
1579 id_search.sm = NULL;
1580 ap_for_each_sta(hapd, ieee802_1x_select_radius_identifier, &id_search);
1581 return id_search.sm;
1582 }
1583
1584
1585 /**
1586 * ieee802_1x_receive_auth - Process RADIUS frames from Authentication Server
1587 * @msg: RADIUS response message
1588 * @req: RADIUS request message
1589 * @shared_secret: RADIUS shared secret
1590 * @shared_secret_len: Length of shared_secret in octets
1591 * @data: Context data (struct hostapd_data *)
1592 * Returns: Processing status
1593 */
1594 static RadiusRxResult
1595 ieee802_1x_receive_auth(struct radius_msg *msg, struct radius_msg *req,
1596 const u8 *shared_secret, size_t shared_secret_len,
1597 void *data)
1598 {
1599 struct hostapd_data *hapd = data;
1600 struct sta_info *sta;
1601 u32 session_timeout = 0, termination_action, acct_interim_interval;
1602 int session_timeout_set, vlan_id = 0;
1603 struct eapol_state_machine *sm;
1604 int override_eapReq = 0;
1605 struct radius_hdr *hdr = radius_msg_get_hdr(msg);
1606
1607 sm = ieee802_1x_search_radius_identifier(hapd, hdr->identifier);
1608 if (sm == NULL) {
1609 wpa_printf(MSG_DEBUG, "IEEE 802.1X: Could not find matching "
1610 "station for this RADIUS message");
1611 return RADIUS_RX_UNKNOWN;
1612 }
1613 sta = sm->sta;
1614
1615 /* RFC 2869, Ch. 5.13: valid Message-Authenticator attribute MUST be
1616 * present when packet contains an EAP-Message attribute */
1617 if (hdr->code == RADIUS_CODE_ACCESS_REJECT &&
1618 radius_msg_get_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR, NULL,
1619 0) < 0 &&
1620 radius_msg_get_attr(msg, RADIUS_ATTR_EAP_MESSAGE, NULL, 0) < 0) {
1621 wpa_printf(MSG_DEBUG, "Allowing RADIUS Access-Reject without "
1622 "Message-Authenticator since it does not include "
1623 "EAP-Message");
1624 } else if (radius_msg_verify(msg, shared_secret, shared_secret_len,
1625 req, 1)) {
1626 wpa_printf(MSG_INFO, "Incoming RADIUS packet did not have correct Message-Authenticator - dropped");
1627 return RADIUS_RX_INVALID_AUTHENTICATOR;
1628 }
1629
1630 if (hdr->code != RADIUS_CODE_ACCESS_ACCEPT &&
1631 hdr->code != RADIUS_CODE_ACCESS_REJECT &&
1632 hdr->code != RADIUS_CODE_ACCESS_CHALLENGE) {
1633 wpa_printf(MSG_INFO, "Unknown RADIUS message code");
1634 return RADIUS_RX_UNKNOWN;
1635 }
1636
1637 sm->radius_identifier = -1;
1638 wpa_printf(MSG_DEBUG, "RADIUS packet matching with station " MACSTR,
1639 MAC2STR(sta->addr));
1640
1641 radius_msg_free(sm->last_recv_radius);
1642 sm->last_recv_radius = msg;
1643
1644 session_timeout_set =
1645 !radius_msg_get_attr_int32(msg, RADIUS_ATTR_SESSION_TIMEOUT,
1646 &session_timeout);
1647 if (radius_msg_get_attr_int32(msg, RADIUS_ATTR_TERMINATION_ACTION,
1648 &termination_action))
1649 termination_action = RADIUS_TERMINATION_ACTION_DEFAULT;
1650
1651 if (hapd->conf->acct_interim_interval == 0 &&
1652 hdr->code == RADIUS_CODE_ACCESS_ACCEPT &&
1653 radius_msg_get_attr_int32(msg, RADIUS_ATTR_ACCT_INTERIM_INTERVAL,
1654 &acct_interim_interval) == 0) {
1655 if (acct_interim_interval < 60) {
1656 hostapd_logger(hapd, sta->addr,
1657 HOSTAPD_MODULE_IEEE8021X,
1658 HOSTAPD_LEVEL_INFO,
1659 "ignored too small "
1660 "Acct-Interim-Interval %d",
1661 acct_interim_interval);
1662 } else
1663 sta->acct_interim_interval = acct_interim_interval;
1664 }
1665
1666
1667 switch (hdr->code) {
1668 case RADIUS_CODE_ACCESS_ACCEPT:
1669 if (hapd->conf->ssid.dynamic_vlan == DYNAMIC_VLAN_DISABLED)
1670 vlan_id = 0;
1671 #ifndef CONFIG_NO_VLAN
1672 else
1673 vlan_id = radius_msg_get_vlanid(msg);
1674 if (vlan_id > 0 &&
1675 hostapd_vlan_id_valid(hapd->conf->vlan, vlan_id)) {
1676 hostapd_logger(hapd, sta->addr,
1677 HOSTAPD_MODULE_RADIUS,
1678 HOSTAPD_LEVEL_INFO,
1679 "VLAN ID %d", vlan_id);
1680 } else if (vlan_id > 0) {
1681 sta->eapol_sm->authFail = TRUE;
1682 hostapd_logger(hapd, sta->addr,
1683 HOSTAPD_MODULE_RADIUS,
1684 HOSTAPD_LEVEL_INFO,
1685 "Invalid VLAN ID %d received from RADIUS server",
1686 vlan_id);
1687 break;
1688 } else if (hapd->conf->ssid.dynamic_vlan ==
1689 DYNAMIC_VLAN_REQUIRED) {
1690 sta->eapol_sm->authFail = TRUE;
1691 hostapd_logger(hapd, sta->addr,
1692 HOSTAPD_MODULE_IEEE8021X,
1693 HOSTAPD_LEVEL_INFO, "authentication "
1694 "server did not include required VLAN "
1695 "ID in Access-Accept");
1696 break;
1697 }
1698 #endif /* CONFIG_NO_VLAN */
1699
1700 sta->vlan_id = vlan_id;
1701 if ((sta->flags & WLAN_STA_ASSOC) &&
1702 ap_sta_bind_vlan(hapd, sta) < 0)
1703 break;
1704
1705 sta->session_timeout_set = !!session_timeout_set;
1706 sta->session_timeout = session_timeout;
1707
1708 /* RFC 3580, Ch. 3.17 */
1709 if (session_timeout_set && termination_action ==
1710 RADIUS_TERMINATION_ACTION_RADIUS_REQUEST) {
1711 sm->reAuthPeriod = session_timeout;
1712 } else if (session_timeout_set)
1713 ap_sta_session_timeout(hapd, sta, session_timeout);
1714
1715 sm->eap_if->aaaSuccess = TRUE;
1716 override_eapReq = 1;
1717 ieee802_1x_get_keys(hapd, sta, msg, req, shared_secret,
1718 shared_secret_len);
1719 ieee802_1x_store_radius_class(hapd, sta, msg);
1720 ieee802_1x_update_sta_identity(hapd, sta, msg);
1721 ieee802_1x_update_sta_cui(hapd, sta, msg);
1722 ieee802_1x_check_hs20(hapd, sta, msg,
1723 session_timeout_set ?
1724 (int) session_timeout : -1);
1725 break;
1726 case RADIUS_CODE_ACCESS_REJECT:
1727 sm->eap_if->aaaFail = TRUE;
1728 override_eapReq = 1;
1729 break;
1730 case RADIUS_CODE_ACCESS_CHALLENGE:
1731 sm->eap_if->aaaEapReq = TRUE;
1732 if (session_timeout_set) {
1733 /* RFC 2869, Ch. 2.3.2; RFC 3580, Ch. 3.17 */
1734 sm->eap_if->aaaMethodTimeout = session_timeout;
1735 hostapd_logger(hapd, sm->addr,
1736 HOSTAPD_MODULE_IEEE8021X,
1737 HOSTAPD_LEVEL_DEBUG,
1738 "using EAP timeout of %d seconds (from "
1739 "RADIUS)",
1740 sm->eap_if->aaaMethodTimeout);
1741 } else {
1742 /*
1743 * Use dynamic retransmission behavior per EAP
1744 * specification.
1745 */
1746 sm->eap_if->aaaMethodTimeout = 0;
1747 }
1748 break;
1749 }
1750
1751 ieee802_1x_decapsulate_radius(hapd, sta);
1752 if (override_eapReq)
1753 sm->eap_if->aaaEapReq = FALSE;
1754
1755 eapol_auth_step(sm);
1756
1757 return RADIUS_RX_QUEUED;
1758 }
1759 #endif /* CONFIG_NO_RADIUS */
1760
1761
1762 void ieee802_1x_abort_auth(struct hostapd_data *hapd, struct sta_info *sta)
1763 {
1764 struct eapol_state_machine *sm = sta->eapol_sm;
1765 if (sm == NULL)
1766 return;
1767
1768 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1769 HOSTAPD_LEVEL_DEBUG, "aborting authentication");
1770
1771 #ifndef CONFIG_NO_RADIUS
1772 radius_msg_free(sm->last_recv_radius);
1773 sm->last_recv_radius = NULL;
1774 #endif /* CONFIG_NO_RADIUS */
1775
1776 if (sm->eap_if->eapTimeout) {
1777 /*
1778 * Disconnect the STA since it did not reply to the last EAP
1779 * request and we cannot continue EAP processing (EAP-Failure
1780 * could only be sent if the EAP peer actually replied).
1781 */
1782 wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "EAP Timeout, STA " MACSTR,
1783 MAC2STR(sta->addr));
1784
1785 sm->eap_if->portEnabled = FALSE;
1786 ap_sta_disconnect(hapd, sta, sta->addr,
1787 WLAN_REASON_PREV_AUTH_NOT_VALID);
1788 }
1789 }
1790
1791
1792 static int ieee802_1x_rekey_broadcast(struct hostapd_data *hapd)
1793 {
1794 struct eapol_authenticator *eapol = hapd->eapol_auth;
1795
1796 if (hapd->conf->default_wep_key_len < 1)
1797 return 0;
1798
1799 os_free(eapol->default_wep_key);
1800 eapol->default_wep_key = os_malloc(hapd->conf->default_wep_key_len);
1801 if (eapol->default_wep_key == NULL ||
1802 random_get_bytes(eapol->default_wep_key,
1803 hapd->conf->default_wep_key_len)) {
1804 wpa_printf(MSG_INFO, "Could not generate random WEP key");
1805 os_free(eapol->default_wep_key);
1806 eapol->default_wep_key = NULL;
1807 return -1;
1808 }
1809
1810 wpa_hexdump_key(MSG_DEBUG, "IEEE 802.1X: New default WEP key",
1811 eapol->default_wep_key,
1812 hapd->conf->default_wep_key_len);
1813
1814 return 0;
1815 }
1816
1817
1818 static int ieee802_1x_sta_key_available(struct hostapd_data *hapd,
1819 struct sta_info *sta, void *ctx)
1820 {
1821 if (sta->eapol_sm) {
1822 sta->eapol_sm->eap_if->eapKeyAvailable = TRUE;
1823 eapol_auth_step(sta->eapol_sm);
1824 }
1825 return 0;
1826 }
1827
1828
1829 static void ieee802_1x_rekey(void *eloop_ctx, void *timeout_ctx)
1830 {
1831 struct hostapd_data *hapd = eloop_ctx;
1832 struct eapol_authenticator *eapol = hapd->eapol_auth;
1833
1834 if (eapol->default_wep_key_idx >= 3)
1835 eapol->default_wep_key_idx =
1836 hapd->conf->individual_wep_key_len > 0 ? 1 : 0;
1837 else
1838 eapol->default_wep_key_idx++;
1839
1840 wpa_printf(MSG_DEBUG, "IEEE 802.1X: New default WEP key index %d",
1841 eapol->default_wep_key_idx);
1842
1843 if (ieee802_1x_rekey_broadcast(hapd)) {
1844 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE8021X,
1845 HOSTAPD_LEVEL_WARNING, "failed to generate a "
1846 "new broadcast key");
1847 os_free(eapol->default_wep_key);
1848 eapol->default_wep_key = NULL;
1849 return;
1850 }
1851
1852 /* TODO: Could setup key for RX here, but change default TX keyid only
1853 * after new broadcast key has been sent to all stations. */
1854 if (hostapd_drv_set_key(hapd->conf->iface, hapd, WPA_ALG_WEP,
1855 broadcast_ether_addr,
1856 eapol->default_wep_key_idx, 1, NULL, 0,
1857 eapol->default_wep_key,
1858 hapd->conf->default_wep_key_len)) {
1859 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE8021X,
1860 HOSTAPD_LEVEL_WARNING, "failed to configure a "
1861 "new broadcast key");
1862 os_free(eapol->default_wep_key);
1863 eapol->default_wep_key = NULL;
1864 return;
1865 }
1866
1867 ap_for_each_sta(hapd, ieee802_1x_sta_key_available, NULL);
1868
1869 if (hapd->conf->wep_rekeying_period > 0) {
1870 eloop_register_timeout(hapd->conf->wep_rekeying_period, 0,
1871 ieee802_1x_rekey, hapd, NULL);
1872 }
1873 }
1874
1875
1876 static void ieee802_1x_eapol_send(void *ctx, void *sta_ctx, u8 type,
1877 const u8 *data, size_t datalen)
1878 {
1879 #ifdef CONFIG_WPS
1880 struct sta_info *sta = sta_ctx;
1881
1882 if ((sta->flags & (WLAN_STA_WPS | WLAN_STA_MAYBE_WPS)) ==
1883 WLAN_STA_MAYBE_WPS) {
1884 const u8 *identity;
1885 size_t identity_len;
1886 struct eapol_state_machine *sm = sta->eapol_sm;
1887
1888 identity = eap_get_identity(sm->eap, &identity_len);
1889 if (identity &&
1890 ((identity_len == WSC_ID_ENROLLEE_LEN &&
1891 os_memcmp(identity, WSC_ID_ENROLLEE,
1892 WSC_ID_ENROLLEE_LEN) == 0) ||
1893 (identity_len == WSC_ID_REGISTRAR_LEN &&
1894 os_memcmp(identity, WSC_ID_REGISTRAR,
1895 WSC_ID_REGISTRAR_LEN) == 0))) {
1896 wpa_printf(MSG_DEBUG, "WPS: WLAN_STA_MAYBE_WPS -> "
1897 "WLAN_STA_WPS");
1898 sta->flags |= WLAN_STA_WPS;
1899 }
1900 }
1901 #endif /* CONFIG_WPS */
1902
1903 ieee802_1x_send(ctx, sta_ctx, type, data, datalen);
1904 }
1905
1906
1907 static void ieee802_1x_aaa_send(void *ctx, void *sta_ctx,
1908 const u8 *data, size_t datalen)
1909 {
1910 #ifndef CONFIG_NO_RADIUS
1911 struct hostapd_data *hapd = ctx;
1912 struct sta_info *sta = sta_ctx;
1913
1914 ieee802_1x_encapsulate_radius(hapd, sta, data, datalen);
1915 #endif /* CONFIG_NO_RADIUS */
1916 }
1917
1918
1919 static void _ieee802_1x_finished(void *ctx, void *sta_ctx, int success,
1920 int preauth, int remediation)
1921 {
1922 struct hostapd_data *hapd = ctx;
1923 struct sta_info *sta = sta_ctx;
1924 if (preauth)
1925 rsn_preauth_finished(hapd, sta, success);
1926 else
1927 ieee802_1x_finished(hapd, sta, success, remediation);
1928 }
1929
1930
1931 static int ieee802_1x_get_eap_user(void *ctx, const u8 *identity,
1932 size_t identity_len, int phase2,
1933 struct eap_user *user)
1934 {
1935 struct hostapd_data *hapd = ctx;
1936 const struct hostapd_eap_user *eap_user;
1937 int i;
1938 int rv = -1;
1939
1940 eap_user = hostapd_get_eap_user(hapd, identity, identity_len, phase2);
1941 if (eap_user == NULL)
1942 goto out;
1943
1944 os_memset(user, 0, sizeof(*user));
1945 user->phase2 = phase2;
1946 for (i = 0; i < EAP_MAX_METHODS; i++) {
1947 user->methods[i].vendor = eap_user->methods[i].vendor;
1948 user->methods[i].method = eap_user->methods[i].method;
1949 }
1950
1951 if (eap_user->password) {
1952 user->password = os_malloc(eap_user->password_len);
1953 if (user->password == NULL)
1954 goto out;
1955 os_memcpy(user->password, eap_user->password,
1956 eap_user->password_len);
1957 user->password_len = eap_user->password_len;
1958 user->password_hash = eap_user->password_hash;
1959 }
1960 user->force_version = eap_user->force_version;
1961 user->macacl = eap_user->macacl;
1962 user->ttls_auth = eap_user->ttls_auth;
1963 user->remediation = eap_user->remediation;
1964 rv = 0;
1965
1966 out:
1967 if (rv)
1968 wpa_printf(MSG_DEBUG, "%s: Failed to find user", __func__);
1969
1970 return rv;
1971 }
1972
1973
1974 static int ieee802_1x_sta_entry_alive(void *ctx, const u8 *addr)
1975 {
1976 struct hostapd_data *hapd = ctx;
1977 struct sta_info *sta;
1978 sta = ap_get_sta(hapd, addr);
1979 if (sta == NULL || sta->eapol_sm == NULL)
1980 return 0;
1981 return 1;
1982 }
1983
1984
1985 static void ieee802_1x_logger(void *ctx, const u8 *addr,
1986 eapol_logger_level level, const char *txt)
1987 {
1988 #ifndef CONFIG_NO_HOSTAPD_LOGGER
1989 struct hostapd_data *hapd = ctx;
1990 int hlevel;
1991
1992 switch (level) {
1993 case EAPOL_LOGGER_WARNING:
1994 hlevel = HOSTAPD_LEVEL_WARNING;
1995 break;
1996 case EAPOL_LOGGER_INFO:
1997 hlevel = HOSTAPD_LEVEL_INFO;
1998 break;
1999 case EAPOL_LOGGER_DEBUG:
2000 default:
2001 hlevel = HOSTAPD_LEVEL_DEBUG;
2002 break;
2003 }
2004
2005 hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE8021X, hlevel, "%s",
2006 txt);
2007 #endif /* CONFIG_NO_HOSTAPD_LOGGER */
2008 }
2009
2010
2011 static void ieee802_1x_set_port_authorized(void *ctx, void *sta_ctx,
2012 int authorized)
2013 {
2014 struct hostapd_data *hapd = ctx;
2015 struct sta_info *sta = sta_ctx;
2016 ieee802_1x_set_sta_authorized(hapd, sta, authorized);
2017 }
2018
2019
2020 static void _ieee802_1x_abort_auth(void *ctx, void *sta_ctx)
2021 {
2022 struct hostapd_data *hapd = ctx;
2023 struct sta_info *sta = sta_ctx;
2024 ieee802_1x_abort_auth(hapd, sta);
2025 }
2026
2027
2028 static void _ieee802_1x_tx_key(void *ctx, void *sta_ctx)
2029 {
2030 #ifndef CONFIG_FIPS
2031 #ifndef CONFIG_NO_RC4
2032 struct hostapd_data *hapd = ctx;
2033 struct sta_info *sta = sta_ctx;
2034 ieee802_1x_tx_key(hapd, sta);
2035 #endif /* CONFIG_NO_RC4 */
2036 #endif /* CONFIG_FIPS */
2037 }
2038
2039
2040 static void ieee802_1x_eapol_event(void *ctx, void *sta_ctx,
2041 enum eapol_event type)
2042 {
2043 /* struct hostapd_data *hapd = ctx; */
2044 struct sta_info *sta = sta_ctx;
2045 switch (type) {
2046 case EAPOL_AUTH_SM_CHANGE:
2047 wpa_auth_sm_notify(sta->wpa_sm);
2048 break;
2049 case EAPOL_AUTH_REAUTHENTICATE:
2050 wpa_auth_sm_event(sta->wpa_sm, WPA_REAUTH_EAPOL);
2051 break;
2052 }
2053 }
2054
2055
2056 #ifdef CONFIG_ERP
2057
2058 static struct eap_server_erp_key *
2059 ieee802_1x_erp_get_key(void *ctx, const char *keyname)
2060 {
2061 struct hostapd_data *hapd = ctx;
2062 struct eap_server_erp_key *erp;
2063
2064 dl_list_for_each(erp, &hapd->erp_keys, struct eap_server_erp_key,
2065 list) {
2066 if (os_strcmp(erp->keyname_nai, keyname) == 0)
2067 return erp;
2068 }
2069
2070 return NULL;
2071 }
2072
2073
2074 static int ieee802_1x_erp_add_key(void *ctx, struct eap_server_erp_key *erp)
2075 {
2076 struct hostapd_data *hapd = ctx;
2077
2078 dl_list_add(&hapd->erp_keys, &erp->list);
2079 return 0;
2080 }
2081
2082 #endif /* CONFIG_ERP */
2083
2084
2085 int ieee802_1x_init(struct hostapd_data *hapd)
2086 {
2087 int i;
2088 struct eapol_auth_config conf;
2089 struct eapol_auth_cb cb;
2090
2091 dl_list_init(&hapd->erp_keys);
2092
2093 os_memset(&conf, 0, sizeof(conf));
2094 conf.ctx = hapd;
2095 conf.eap_reauth_period = hapd->conf->eap_reauth_period;
2096 conf.wpa = hapd->conf->wpa;
2097 conf.individual_wep_key_len = hapd->conf->individual_wep_key_len;
2098 conf.eap_server = hapd->conf->eap_server;
2099 conf.ssl_ctx = hapd->ssl_ctx;
2100 conf.msg_ctx = hapd->msg_ctx;
2101 conf.eap_sim_db_priv = hapd->eap_sim_db_priv;
2102 conf.eap_req_id_text = hapd->conf->eap_req_id_text;
2103 conf.eap_req_id_text_len = hapd->conf->eap_req_id_text_len;
2104 conf.erp_send_reauth_start = hapd->conf->erp_send_reauth_start;
2105 conf.erp_domain = hapd->conf->erp_domain;
2106 conf.erp = hapd->conf->eap_server_erp;
2107 conf.tls_session_lifetime = hapd->conf->tls_session_lifetime;
2108 conf.pac_opaque_encr_key = hapd->conf->pac_opaque_encr_key;
2109 conf.eap_fast_a_id = hapd->conf->eap_fast_a_id;
2110 conf.eap_fast_a_id_len = hapd->conf->eap_fast_a_id_len;
2111 conf.eap_fast_a_id_info = hapd->conf->eap_fast_a_id_info;
2112 conf.eap_fast_prov = hapd->conf->eap_fast_prov;
2113 conf.pac_key_lifetime = hapd->conf->pac_key_lifetime;
2114 conf.pac_key_refresh_time = hapd->conf->pac_key_refresh_time;
2115 conf.eap_sim_aka_result_ind = hapd->conf->eap_sim_aka_result_ind;
2116 conf.tnc = hapd->conf->tnc;
2117 conf.wps = hapd->wps;
2118 conf.fragment_size = hapd->conf->fragment_size;
2119 conf.pwd_group = hapd->conf->pwd_group;
2120 conf.pbc_in_m1 = hapd->conf->pbc_in_m1;
2121 if (hapd->conf->server_id) {
2122 conf.server_id = (const u8 *) hapd->conf->server_id;
2123 conf.server_id_len = os_strlen(hapd->conf->server_id);
2124 } else {
2125 conf.server_id = (const u8 *) "hostapd";
2126 conf.server_id_len = 7;
2127 }
2128
2129 os_memset(&cb, 0, sizeof(cb));
2130 cb.eapol_send = ieee802_1x_eapol_send;
2131 cb.aaa_send = ieee802_1x_aaa_send;
2132 cb.finished = _ieee802_1x_finished;
2133 cb.get_eap_user = ieee802_1x_get_eap_user;
2134 cb.sta_entry_alive = ieee802_1x_sta_entry_alive;
2135 cb.logger = ieee802_1x_logger;
2136 cb.set_port_authorized = ieee802_1x_set_port_authorized;
2137 cb.abort_auth = _ieee802_1x_abort_auth;
2138 cb.tx_key = _ieee802_1x_tx_key;
2139 cb.eapol_event = ieee802_1x_eapol_event;
2140 #ifdef CONFIG_ERP
2141 cb.erp_get_key = ieee802_1x_erp_get_key;
2142 cb.erp_add_key = ieee802_1x_erp_add_key;
2143 #endif /* CONFIG_ERP */
2144
2145 hapd->eapol_auth = eapol_auth_init(&conf, &cb);
2146 if (hapd->eapol_auth == NULL)
2147 return -1;
2148
2149 if ((hapd->conf->ieee802_1x || hapd->conf->wpa) &&
2150 hostapd_set_drv_ieee8021x(hapd, hapd->conf->iface, 1))
2151 return -1;
2152
2153 #ifndef CONFIG_NO_RADIUS
2154 if (radius_client_register(hapd->radius, RADIUS_AUTH,
2155 ieee802_1x_receive_auth, hapd))
2156 return -1;
2157 #endif /* CONFIG_NO_RADIUS */
2158
2159 if (hapd->conf->default_wep_key_len) {
2160 for (i = 0; i < 4; i++)
2161 hostapd_drv_set_key(hapd->conf->iface, hapd,
2162 WPA_ALG_NONE, NULL, i, 0, NULL, 0,
2163 NULL, 0);
2164
2165 ieee802_1x_rekey(hapd, NULL);
2166
2167 if (hapd->eapol_auth->default_wep_key == NULL)
2168 return -1;
2169 }
2170
2171 return 0;
2172 }
2173
2174
2175 void ieee802_1x_erp_flush(struct hostapd_data *hapd)
2176 {
2177 struct eap_server_erp_key *erp;
2178
2179 while ((erp = dl_list_first(&hapd->erp_keys, struct eap_server_erp_key,
2180 list)) != NULL) {
2181 dl_list_del(&erp->list);
2182 bin_clear_free(erp, sizeof(*erp));
2183 }
2184 }
2185
2186
2187 void ieee802_1x_deinit(struct hostapd_data *hapd)
2188 {
2189 eloop_cancel_timeout(ieee802_1x_rekey, hapd, NULL);
2190
2191 if (hapd->driver && hapd->drv_priv &&
2192 (hapd->conf->ieee802_1x || hapd->conf->wpa))
2193 hostapd_set_drv_ieee8021x(hapd, hapd->conf->iface, 0);
2194
2195 eapol_auth_deinit(hapd->eapol_auth);
2196 hapd->eapol_auth = NULL;
2197
2198 ieee802_1x_erp_flush(hapd);
2199 }
2200
2201
2202 int ieee802_1x_tx_status(struct hostapd_data *hapd, struct sta_info *sta,
2203 const u8 *buf, size_t len, int ack)
2204 {
2205 struct ieee80211_hdr *hdr;
2206 u8 *pos;
2207 const unsigned char rfc1042_hdr[ETH_ALEN] =
2208 { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
2209
2210 if (sta == NULL)
2211 return -1;
2212 if (len < sizeof(*hdr) + sizeof(rfc1042_hdr) + 2)
2213 return 0;
2214
2215 hdr = (struct ieee80211_hdr *) buf;
2216 pos = (u8 *) (hdr + 1);
2217 if (os_memcmp(pos, rfc1042_hdr, sizeof(rfc1042_hdr)) != 0)
2218 return 0;
2219 pos += sizeof(rfc1042_hdr);
2220 if (WPA_GET_BE16(pos) != ETH_P_PAE)
2221 return 0;
2222 pos += 2;
2223
2224 return ieee802_1x_eapol_tx_status(hapd, sta, pos, buf + len - pos,
2225 ack);
2226 }
2227
2228
2229 int ieee802_1x_eapol_tx_status(struct hostapd_data *hapd, struct sta_info *sta,
2230 const u8 *buf, int len, int ack)
2231 {
2232 const struct ieee802_1x_hdr *xhdr =
2233 (const struct ieee802_1x_hdr *) buf;
2234 const u8 *pos = buf + sizeof(*xhdr);
2235 struct ieee802_1x_eapol_key *key;
2236
2237 if (len < (int) sizeof(*xhdr))
2238 return 0;
2239 wpa_printf(MSG_DEBUG, "IEEE 802.1X: " MACSTR " TX status - version=%d "
2240 "type=%d length=%d - ack=%d",
2241 MAC2STR(sta->addr), xhdr->version, xhdr->type,
2242 be_to_host16(xhdr->length), ack);
2243
2244 if (xhdr->type != IEEE802_1X_TYPE_EAPOL_KEY)
2245 return 0;
2246
2247 if (pos + sizeof(struct wpa_eapol_key) <= buf + len) {
2248 const struct wpa_eapol_key *wpa;
2249 wpa = (const struct wpa_eapol_key *) pos;
2250 if (wpa->type == EAPOL_KEY_TYPE_RSN ||
2251 wpa->type == EAPOL_KEY_TYPE_WPA)
2252 wpa_auth_eapol_key_tx_status(hapd->wpa_auth,
2253 sta->wpa_sm, ack);
2254 }
2255
2256 /* EAPOL EAP-Packet packets are eventually re-sent by either Supplicant
2257 * or Authenticator state machines, but EAPOL-Key packets are not
2258 * retransmitted in case of failure. Try to re-send failed EAPOL-Key
2259 * packets couple of times because otherwise STA keys become
2260 * unsynchronized with AP. */
2261 if (!ack && pos + sizeof(*key) <= buf + len) {
2262 key = (struct ieee802_1x_eapol_key *) pos;
2263 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
2264 HOSTAPD_LEVEL_DEBUG, "did not Ack EAPOL-Key "
2265 "frame (%scast index=%d)",
2266 key->key_index & BIT(7) ? "uni" : "broad",
2267 key->key_index & ~BIT(7));
2268 /* TODO: re-send EAPOL-Key couple of times (with short delay
2269 * between them?). If all attempt fail, report error and
2270 * deauthenticate STA so that it will get new keys when
2271 * authenticating again (e.g., after returning in range).
2272 * Separate limit/transmit state needed both for unicast and
2273 * broadcast keys(?) */
2274 }
2275 /* TODO: could move unicast key configuration from ieee802_1x_tx_key()
2276 * to here and change the key only if the EAPOL-Key packet was Acked.
2277 */
2278
2279 return 1;
2280 }
2281
2282
2283 u8 * ieee802_1x_get_identity(struct eapol_state_machine *sm, size_t *len)
2284 {
2285 if (sm == NULL || sm->identity == NULL)
2286 return NULL;
2287
2288 *len = sm->identity_len;
2289 return sm->identity;
2290 }
2291
2292
2293 u8 * ieee802_1x_get_radius_class(struct eapol_state_machine *sm, size_t *len,
2294 int idx)
2295 {
2296 if (sm == NULL || sm->radius_class.attr == NULL ||
2297 idx >= (int) sm->radius_class.count)
2298 return NULL;
2299
2300 *len = sm->radius_class.attr[idx].len;
2301 return sm->radius_class.attr[idx].data;
2302 }
2303
2304
2305 struct wpabuf * ieee802_1x_get_radius_cui(struct eapol_state_machine *sm)
2306 {
2307 if (sm == NULL)
2308 return NULL;
2309 return sm->radius_cui;
2310 }
2311
2312
2313 const u8 * ieee802_1x_get_key(struct eapol_state_machine *sm, size_t *len)
2314 {
2315 *len = 0;
2316 if (sm == NULL)
2317 return NULL;
2318
2319 *len = sm->eap_if->eapKeyDataLen;
2320 return sm->eap_if->eapKeyData;
2321 }
2322
2323
2324 void ieee802_1x_notify_port_enabled(struct eapol_state_machine *sm,
2325 int enabled)
2326 {
2327 if (sm == NULL)
2328 return;
2329 sm->eap_if->portEnabled = enabled ? TRUE : FALSE;
2330 eapol_auth_step(sm);
2331 }
2332
2333
2334 void ieee802_1x_notify_port_valid(struct eapol_state_machine *sm,
2335 int valid)
2336 {
2337 if (sm == NULL)
2338 return;
2339 sm->portValid = valid ? TRUE : FALSE;
2340 eapol_auth_step(sm);
2341 }
2342
2343
2344 void ieee802_1x_notify_pre_auth(struct eapol_state_machine *sm, int pre_auth)
2345 {
2346 if (sm == NULL)
2347 return;
2348 if (pre_auth)
2349 sm->flags |= EAPOL_SM_PREAUTH;
2350 else
2351 sm->flags &= ~EAPOL_SM_PREAUTH;
2352 }
2353
2354
2355 static const char * bool_txt(Boolean val)
2356 {
2357 return val ? "TRUE" : "FALSE";
2358 }
2359
2360
2361 int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
2362 {
2363 /* TODO */
2364 return 0;
2365 }
2366
2367
2368 int ieee802_1x_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta,
2369 char *buf, size_t buflen)
2370 {
2371 int len = 0, ret;
2372 struct eapol_state_machine *sm = sta->eapol_sm;
2373 struct os_reltime diff;
2374 const char *name1;
2375 const char *name2;
2376
2377 if (sm == NULL)
2378 return 0;
2379
2380 ret = os_snprintf(buf + len, buflen - len,
2381 "dot1xPaePortNumber=%d\n"
2382 "dot1xPaePortProtocolVersion=%d\n"
2383 "dot1xPaePortCapabilities=1\n"
2384 "dot1xPaePortInitialize=%d\n"
2385 "dot1xPaePortReauthenticate=FALSE\n",
2386 sta->aid,
2387 EAPOL_VERSION,
2388 sm->initialize);
2389 if (os_snprintf_error(buflen - len, ret))
2390 return len;
2391 len += ret;
2392
2393 /* dot1xAuthConfigTable */
2394 ret = os_snprintf(buf + len, buflen - len,
2395 "dot1xAuthPaeState=%d\n"
2396 "dot1xAuthBackendAuthState=%d\n"
2397 "dot1xAuthAdminControlledDirections=%d\n"
2398 "dot1xAuthOperControlledDirections=%d\n"
2399 "dot1xAuthAuthControlledPortStatus=%d\n"
2400 "dot1xAuthAuthControlledPortControl=%d\n"
2401 "dot1xAuthQuietPeriod=%u\n"
2402 "dot1xAuthServerTimeout=%u\n"
2403 "dot1xAuthReAuthPeriod=%u\n"
2404 "dot1xAuthReAuthEnabled=%s\n"
2405 "dot1xAuthKeyTxEnabled=%s\n",
2406 sm->auth_pae_state + 1,
2407 sm->be_auth_state + 1,
2408 sm->adminControlledDirections,
2409 sm->operControlledDirections,
2410 sm->authPortStatus,
2411 sm->portControl,
2412 sm->quietPeriod,
2413 sm->serverTimeout,
2414 sm->reAuthPeriod,
2415 bool_txt(sm->reAuthEnabled),
2416 bool_txt(sm->keyTxEnabled));
2417 if (os_snprintf_error(buflen - len, ret))
2418 return len;
2419 len += ret;
2420
2421 /* dot1xAuthStatsTable */
2422 ret = os_snprintf(buf + len, buflen - len,
2423 "dot1xAuthEapolFramesRx=%u\n"
2424 "dot1xAuthEapolFramesTx=%u\n"
2425 "dot1xAuthEapolStartFramesRx=%u\n"
2426 "dot1xAuthEapolLogoffFramesRx=%u\n"
2427 "dot1xAuthEapolRespIdFramesRx=%u\n"
2428 "dot1xAuthEapolRespFramesRx=%u\n"
2429 "dot1xAuthEapolReqIdFramesTx=%u\n"
2430 "dot1xAuthEapolReqFramesTx=%u\n"
2431 "dot1xAuthInvalidEapolFramesRx=%u\n"
2432 "dot1xAuthEapLengthErrorFramesRx=%u\n"
2433 "dot1xAuthLastEapolFrameVersion=%u\n"
2434 "dot1xAuthLastEapolFrameSource=" MACSTR "\n",
2435 sm->dot1xAuthEapolFramesRx,
2436 sm->dot1xAuthEapolFramesTx,
2437 sm->dot1xAuthEapolStartFramesRx,
2438 sm->dot1xAuthEapolLogoffFramesRx,
2439 sm->dot1xAuthEapolRespIdFramesRx,
2440 sm->dot1xAuthEapolRespFramesRx,
2441 sm->dot1xAuthEapolReqIdFramesTx,
2442 sm->dot1xAuthEapolReqFramesTx,
2443 sm->dot1xAuthInvalidEapolFramesRx,
2444 sm->dot1xAuthEapLengthErrorFramesRx,
2445 sm->dot1xAuthLastEapolFrameVersion,
2446 MAC2STR(sm->addr));
2447 if (os_snprintf_error(buflen - len, ret))
2448 return len;
2449 len += ret;
2450
2451 /* dot1xAuthDiagTable */
2452 ret = os_snprintf(buf + len, buflen - len,
2453 "dot1xAuthEntersConnecting=%u\n"
2454 "dot1xAuthEapLogoffsWhileConnecting=%u\n"
2455 "dot1xAuthEntersAuthenticating=%u\n"
2456 "dot1xAuthAuthSuccessesWhileAuthenticating=%u\n"
2457 "dot1xAuthAuthTimeoutsWhileAuthenticating=%u\n"
2458 "dot1xAuthAuthFailWhileAuthenticating=%u\n"
2459 "dot1xAuthAuthEapStartsWhileAuthenticating=%u\n"
2460 "dot1xAuthAuthEapLogoffWhileAuthenticating=%u\n"
2461 "dot1xAuthAuthReauthsWhileAuthenticated=%u\n"
2462 "dot1xAuthAuthEapStartsWhileAuthenticated=%u\n"
2463 "dot1xAuthAuthEapLogoffWhileAuthenticated=%u\n"
2464 "dot1xAuthBackendResponses=%u\n"
2465 "dot1xAuthBackendAccessChallenges=%u\n"
2466 "dot1xAuthBackendOtherRequestsToSupplicant=%u\n"
2467 "dot1xAuthBackendAuthSuccesses=%u\n"
2468 "dot1xAuthBackendAuthFails=%u\n",
2469 sm->authEntersConnecting,
2470 sm->authEapLogoffsWhileConnecting,
2471 sm->authEntersAuthenticating,
2472 sm->authAuthSuccessesWhileAuthenticating,
2473 sm->authAuthTimeoutsWhileAuthenticating,
2474 sm->authAuthFailWhileAuthenticating,
2475 sm->authAuthEapStartsWhileAuthenticating,
2476 sm->authAuthEapLogoffWhileAuthenticating,
2477 sm->authAuthReauthsWhileAuthenticated,
2478 sm->authAuthEapStartsWhileAuthenticated,
2479 sm->authAuthEapLogoffWhileAuthenticated,
2480 sm->backendResponses,
2481 sm->backendAccessChallenges,
2482 sm->backendOtherRequestsToSupplicant,
2483 sm->backendAuthSuccesses,
2484 sm->backendAuthFails);
2485 if (os_snprintf_error(buflen - len, ret))
2486 return len;
2487 len += ret;
2488
2489 /* dot1xAuthSessionStatsTable */
2490 os_reltime_age(&sta->acct_session_start, &diff);
2491 ret = os_snprintf(buf + len, buflen - len,
2492 /* TODO: dot1xAuthSessionOctetsRx */
2493 /* TODO: dot1xAuthSessionOctetsTx */
2494 /* TODO: dot1xAuthSessionFramesRx */
2495 /* TODO: dot1xAuthSessionFramesTx */
2496 "dot1xAuthSessionId=%016lX\n"
2497 "dot1xAuthSessionAuthenticMethod=%d\n"
2498 "dot1xAuthSessionTime=%u\n"
2499 "dot1xAuthSessionTerminateCause=999\n"
2500 "dot1xAuthSessionUserName=%s\n",
2501 (long unsigned int) sta->acct_session_id,
2502 (wpa_key_mgmt_wpa_ieee8021x(
2503 wpa_auth_sta_key_mgmt(sta->wpa_sm))) ?
2504 1 : 2,
2505 (unsigned int) diff.sec,
2506 sm->identity);
2507 if (os_snprintf_error(buflen - len, ret))
2508 return len;
2509 len += ret;
2510
2511 if (sm->acct_multi_session_id) {
2512 ret = os_snprintf(buf + len, buflen - len,
2513 "authMultiSessionId=%016lX\n",
2514 (long unsigned int)
2515 sm->acct_multi_session_id);
2516 if (os_snprintf_error(buflen - len, ret))
2517 return len;
2518 len += ret;
2519 }
2520
2521 name1 = eap_server_get_name(0, sm->eap_type_authsrv);
2522 name2 = eap_server_get_name(0, sm->eap_type_supp);
2523 ret = os_snprintf(buf + len, buflen - len,
2524 "last_eap_type_as=%d (%s)\n"
2525 "last_eap_type_sta=%d (%s)\n",
2526 sm->eap_type_authsrv, name1,
2527 sm->eap_type_supp, name2);
2528 if (os_snprintf_error(buflen - len, ret))
2529 return len;
2530 len += ret;
2531
2532 return len;
2533 }
2534
2535
2536 #ifdef CONFIG_HS20
2537 static void ieee802_1x_wnm_notif_send(void *eloop_ctx, void *timeout_ctx)
2538 {
2539 struct hostapd_data *hapd = eloop_ctx;
2540 struct sta_info *sta = timeout_ctx;
2541
2542 if (sta->remediation) {
2543 wpa_printf(MSG_DEBUG, "HS 2.0: Send WNM-Notification to "
2544 MACSTR " to indicate Subscription Remediation",
2545 MAC2STR(sta->addr));
2546 hs20_send_wnm_notification(hapd, sta->addr,
2547 sta->remediation_method,
2548 sta->remediation_url);
2549 os_free(sta->remediation_url);
2550 sta->remediation_url = NULL;
2551 }
2552
2553 if (sta->hs20_deauth_req) {
2554 wpa_printf(MSG_DEBUG, "HS 2.0: Send WNM-Notification to "
2555 MACSTR " to indicate imminent deauthentication",
2556 MAC2STR(sta->addr));
2557 hs20_send_wnm_notification_deauth_req(hapd, sta->addr,
2558 sta->hs20_deauth_req);
2559 }
2560 }
2561 #endif /* CONFIG_HS20 */
2562
2563
2564 static void ieee802_1x_finished(struct hostapd_data *hapd,
2565 struct sta_info *sta, int success,
2566 int remediation)
2567 {
2568 const u8 *key;
2569 size_t len;
2570 /* TODO: get PMKLifetime from WPA parameters */
2571 static const int dot11RSNAConfigPMKLifetime = 43200;
2572 unsigned int session_timeout;
2573
2574 #ifdef CONFIG_HS20
2575 if (remediation && !sta->remediation) {
2576 sta->remediation = 1;
2577 os_free(sta->remediation_url);
2578 sta->remediation_url =
2579 os_strdup(hapd->conf->subscr_remediation_url);
2580 sta->remediation_method = 1; /* SOAP-XML SPP */
2581 }
2582
2583 if (success && (sta->remediation || sta->hs20_deauth_req)) {
2584 wpa_printf(MSG_DEBUG, "HS 2.0: Schedule WNM-Notification to "
2585 MACSTR " in 100 ms", MAC2STR(sta->addr));
2586 eloop_cancel_timeout(ieee802_1x_wnm_notif_send, hapd, sta);
2587 eloop_register_timeout(0, 100000, ieee802_1x_wnm_notif_send,
2588 hapd, sta);
2589 }
2590 #endif /* CONFIG_HS20 */
2591
2592 key = ieee802_1x_get_key(sta->eapol_sm, &len);
2593 if (sta->session_timeout_set)
2594 session_timeout = sta->session_timeout;
2595 else
2596 session_timeout = dot11RSNAConfigPMKLifetime;
2597 if (success && key && len >= PMK_LEN && !sta->remediation &&
2598 !sta->hs20_deauth_requested &&
2599 wpa_auth_pmksa_add(sta->wpa_sm, key, len, session_timeout,
2600 sta->eapol_sm) == 0) {
2601 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA,
2602 HOSTAPD_LEVEL_DEBUG,
2603 "Added PMKSA cache entry (IEEE 802.1X)");
2604 }
2605
2606 if (!success) {
2607 /*
2608 * Many devices require deauthentication after WPS provisioning
2609 * and some may not be be able to do that themselves, so
2610 * disconnect the client here. In addition, this may also
2611 * benefit IEEE 802.1X/EAPOL authentication cases, too since
2612 * the EAPOL PAE state machine would remain in HELD state for
2613 * considerable amount of time and some EAP methods, like
2614 * EAP-FAST with anonymous provisioning, may require another
2615 * EAPOL authentication to be started to complete connection.
2616 */
2617 wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "IEEE 802.1X: Force "
2618 "disconnection after EAP-Failure");
2619 /* Add a small sleep to increase likelihood of previously
2620 * requested EAP-Failure TX getting out before this should the
2621 * driver reorder operations.
2622 */
2623 os_sleep(0, 10000);
2624 ap_sta_disconnect(hapd, sta, sta->addr,
2625 WLAN_REASON_IEEE_802_1X_AUTH_FAILED);
2626 hostapd_wps_eap_completed(hapd);
2627 }
2628 }
Unnamed repository; edit this file 'description' to name the repository.