SAE: Add testing code for reflection attack

Allow hostapd to be configured to perform SAE reflection attack for SAE
testing purposes with sae_reflection_attack=1 configuration parameter.
This is included only in CONFIG_TESTING_OPTIONS=y builds.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

diff --git a/hostapd/config_file.c b/hostapd/config_file.c
index cc799d4820f0dd91fb12ab3c9790870c85a2adba..7f1965b0643c4b8d2faf46c110a1e8e0afe9c7d8 100644 (file)
--- a/hostapd/config_file.c
+++ b/hostapd/config_file.c
@@ -3561,6 +3561,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
 
                wpabuf_free(bss->own_ie_override);
                bss->own_ie_override = tmp;
+       } else if (os_strcmp(buf, "sae_reflection_attack") == 0) {
+               bss->sae_reflection_attack = atoi(pos);
 #endif /* CONFIG_TESTING_OPTIONS */
        } else if (os_strcmp(buf, "vendor_elements") == 0) {
                if (parse_wpabuf_hex(line, buf, &bss->vendor_elements, pos))

diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
index 8e5ff524d6faa95268847f6a4c9e0f206be4094f..79048de0b06afad8efa29ad52bdd990934464094 100644 (file)
--- a/src/ap/ap_config.h
+++ b/src/ap/ap_config.h
@@ -588,6 +588,7 @@ struct hostapd_bss_config {
        u8 bss_load_test[5];
        u8 bss_load_test_set;
        struct wpabuf *own_ie_override;
+       int sae_reflection_attack;
 #endif /* CONFIG_TESTING_OPTIONS */
 
 #define MESH_ENABLED BIT(0)

diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
index 7999611463f6497b9a29715c75ef7e5dd14d60cb..e35ed3a0844af55af26060e1f9a7fade59ca3fd7 100644 (file)
--- a/src/ap/ieee802_11.c
+++ b/src/ap/ieee802_11.c
@@ -786,6 +786,18 @@ static void handle_auth_sae(struct hostapd_data *hapd, struct sta_info *sta,
        int resp = WLAN_STATUS_SUCCESS;
        struct wpabuf *data = NULL;
 
+#ifdef CONFIG_TESTING_OPTIONS
+       if (hapd->conf->sae_reflection_attack && auth_transaction == 1) {
+               const u8 *pos, *end;
+
+               wpa_printf(MSG_DEBUG, "SAE: TESTING - reflection attack");
+               pos = mgmt->u.auth.variable;
+               end = ((const u8 *) mgmt) + len;
+               send_auth_reply(hapd, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE,
+                               auth_transaction, resp, pos, end - pos);
+               goto remove_sta;
+       }
+#endif /* CONFIG_TESTING_OPTIONS */
        if (!sta->sae) {
                if (auth_transaction != 1 ||
                    status_code != WLAN_STATUS_SUCCESS) {