Store a copy of Association Request RSNXE in AP mode for later use

This is needed to be able to compare the received RSNXE to a protected
version in EAPOL-Key msg 2/4.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>

diff --git a/src/ap/drv_callbacks.c b/src/ap/drv_callbacks.c
index 57c14347d8af9b4399e77ee73788e1ed6726007c..f863c98694bc79f0ff1e78baf84b910928e85abd 100644 (file)
--- a/src/ap/drv_callbacks.c
+++ b/src/ap/drv_callbacks.c
@@ -319,6 +319,8 @@ int hostapd_notif_assoc(struct hostapd_data *hapd, const u8 *addr,
                res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
                                          hapd->iface->freq,
                                          ie, ielen,
+                                         elems.rsnxe ? elems.rsnxe - 2 : NULL,
+                                         elems.rsnxe ? elems.rsnxe_len + 2 : 0,
                                          elems.mdie, elems.mdie_len,
                                          elems.owe_dh, elems.owe_dh_len);
                if (res != WPA_IE_OK) {

diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
index 401f907f47348278c087238cc11ad923306fe1af..7cd00624f5e39471c9b290dbec2bc4c9a9a138a5 100644 (file)
--- a/src/ap/ieee802_11.c
+++ b/src/ap/ieee802_11.c
@@ -1654,6 +1654,8 @@ void handle_auth_fils(struct hostapd_data *hapd, struct sta_info *sta,
        res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
                                  hapd->iface->freq,
                                  elems.rsn_ie - 2, elems.rsn_ie_len + 2,
+                                 elems.rsnxe ? elems.rsnxe - 2 : NULL,
+                                 elems.rsnxe ? elems.rsnxe_len + 2 : 0,
                                  elems.mdie, elems.mdie_len, NULL, 0);
        resp = wpa_res_to_status_code(res);
        if (resp != WLAN_STATUS_SUCCESS)
@@ -2965,7 +2967,7 @@ u16 owe_process_rsn_ie(struct hostapd_data *hapd,
        rsn_ie_len += 2;
        res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
                                  hapd->iface->freq, rsn_ie, rsn_ie_len,
-                                 NULL, 0, owe_dh, owe_dh_len);
+                                 NULL, 0, NULL, 0, owe_dh, owe_dh_len);
        status = wpa_res_to_status_code(res);
        if (status != WLAN_STATUS_SUCCESS)
                goto end;
@@ -3173,6 +3175,8 @@ static u16 check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
                res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
                                          hapd->iface->freq,
                                          wpa_ie, wpa_ie_len,
+                                         elems.rsnxe ? elems.rsnxe - 2 : NULL,
+                                         elems.rsnxe ? elems.rsnxe_len + 2 : 0,
                                          elems.mdie, elems.mdie_len,
                                          elems.owe_dh, elems.owe_dh_len);
                resp = wpa_res_to_status_code(res);

diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c
index 1c82ccf6208a8aa16beec9980edaf01f70b58b7c..aaea5841f12e225bf497b2ddca7a9f97f58f1249 100644 (file)
--- a/src/ap/wpa_auth.c
+++ b/src/ap/wpa_auth.c
@@ -708,6 +708,7 @@ static void wpa_free_sta_sm(struct wpa_state_machine *sm)
 #endif /* CONFIG_IEEE80211R_AP */
        os_free(sm->last_rx_eapol_key);
        os_free(sm->wpa_ie);
+       os_free(sm->rsnxe);
        wpa_group_put(sm->wpa_auth, sm->group);
 #ifdef CONFIG_DPP2
        wpabuf_clear_free(sm->dpp_z);

diff --git a/src/ap/wpa_auth.h b/src/ap/wpa_auth.h
index f0f03aa5247bcc9af848e93dc14d680d2647d498..f6278381253765e16b41259f3457e0cdb5fb0ca1 100644 (file)
--- a/src/ap/wpa_auth.h
+++ b/src/ap/wpa_auth.h
@@ -319,6 +319,7 @@ enum {
 int wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth,
                        struct wpa_state_machine *sm, int freq,
                        const u8 *wpa_ie, size_t wpa_ie_len,
+                       const u8 *rsnxe, size_t rsnxe_len,
                        const u8 *mdie, size_t mdie_len,
                        const u8 *owe_dh, size_t owe_dh_len);
 int wpa_validate_osen(struct wpa_authenticator *wpa_auth,

diff --git a/src/ap/wpa_auth_i.h b/src/ap/wpa_auth_i.h
index f568a90c89617fd3894acaabcd26f03bd4d25cdb..a993f50089168b4d1a0aa4ab0a7dda059263cb12 100644 (file)
--- a/src/ap/wpa_auth_i.h
+++ b/src/ap/wpa_auth_i.h
@@ -102,6 +102,8 @@ struct wpa_state_machine {
 
        u8 *wpa_ie;
        size_t wpa_ie_len;
+       u8 *rsnxe;
+       size_t rsnxe_len;
 
        enum {
                WPA_VERSION_NO_WPA = 0 /* WPA not used */,

diff --git a/src/ap/wpa_auth_ie.c b/src/ap/wpa_auth_ie.c
index 4b0e279dcf29d2b9d9641b8ee4b13bdcde776a87..c0f57aa7fed11c08e2a2f8ac83c14d7ce86078fe 100644 (file)
--- a/src/ap/wpa_auth_ie.c
+++ b/src/ap/wpa_auth_ie.c
@@ -549,6 +549,7 @@ static int wpa_auth_okc_iter(struct wpa_authenticator *a, void *ctx)
 int wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth,
                        struct wpa_state_machine *sm, int freq,
                        const u8 *wpa_ie, size_t wpa_ie_len,
+                       const u8 *rsnxe, size_t rsnxe_len,
                        const u8 *mdie, size_t mdie_len,
                        const u8 *owe_dh, size_t owe_dh_len)
 {
@@ -952,6 +953,21 @@ int wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth,
        os_memcpy(sm->wpa_ie, wpa_ie, wpa_ie_len);
        sm->wpa_ie_len = wpa_ie_len;
 
+       if (rsnxe && rsnxe_len) {
+               if (!sm->rsnxe || sm->rsnxe_len < rsnxe_len) {
+                       os_free(sm->rsnxe);
+                       sm->rsnxe = os_malloc(rsnxe_len);
+                       if (!sm->rsnxe)
+                               return WPA_ALLOC_FAIL;
+               }
+               os_memcpy(sm->rsnxe, rsnxe, rsnxe_len);
+               sm->rsnxe_len = rsnxe_len;
+       } else {
+               os_free(sm->rsnxe);
+               sm->rsnxe = NULL;
+               sm->rsnxe_len = 0;
+       }
+
        return WPA_IE_OK;
 }
 

diff --git a/tests/fuzzing/eapol-key-auth/eapol-key-auth.c b/tests/fuzzing/eapol-key-auth/eapol-key-auth.c
index 0fffa783f010ea14dd84567c1a2bd4336e4808bf..a909114a4b09cdcba60280a2d33ebc2cdf468227 100644 (file)
--- a/tests/fuzzing/eapol-key-auth/eapol-key-auth.c
+++ b/tests/fuzzing/eapol-key-auth/eapol-key-auth.c
@@ -261,7 +261,8 @@ static int auth_init(struct wpa *wpa)
        }
 
        if (wpa_validate_wpa_ie(wpa->auth_group, wpa->auth, 2412, supp_ie,
-                               supp_ie_len, NULL, 0, NULL, 0) != WPA_IE_OK) {
+                               supp_ie_len, NULL, 0, NULL, 0, NULL, 0) !=
+           WPA_IE_OK) {
                wpa_printf(MSG_DEBUG, "AUTH: wpa_validate_wpa_ie() failed");
                return -1;
        }

diff --git a/tests/test-eapol.c b/tests/test-eapol.c
index 0dd65e489ee47e07fe67c05e96ec7a21f99e8306..944e4cfb9b7d772bc7304ed15079e098751e133c 100644 (file)
--- a/tests/test-eapol.c
+++ b/tests/test-eapol.c
@@ -504,7 +504,7 @@ static int auth_init(struct wpa *wpa)
        }
 
        if (wpa_validate_wpa_ie(wpa->auth_group, wpa->auth, 2412, wpa->supp_ie,
-                               wpa->supp_ie_len, NULL, 0, NULL, 0) !=
+                               wpa->supp_ie_len, NULL, 0, NULL, 0, NULL, 0) !=
            WPA_IE_OK) {
                wpa_printf(MSG_DEBUG, "AUTH: wpa_validate_wpa_ie() failed");
                return -1;

diff --git a/wpa_supplicant/ibss_rsn.c b/wpa_supplicant/ibss_rsn.c
index 2bf51c626d42056282e05cd992a488f61888532d..36c0aff17374b196c888cec9f9577034bc01d68a 100644 (file)
--- a/wpa_supplicant/ibss_rsn.c
+++ b/wpa_supplicant/ibss_rsn.c
@@ -465,7 +465,7 @@ static int ibss_rsn_auth_init(struct ibss_rsn *ibss_rsn,
                                "\x00\x0f\xac\x04"
                                "\x01\x00\x00\x0f\xac\x04"
                                "\x01\x00\x00\x0f\xac\x02"
-                               "\x00\x00", 22, NULL, 0, NULL, 0) !=
+                               "\x00\x00", 22, NULL, 0, NULL, 0, NULL, 0) !=
            WPA_IE_OK) {
                wpa_printf(MSG_DEBUG, "AUTH: wpa_validate_wpa_ie() failed");
                return -1;