]> git.ipfire.org Git - thirdparty/hostap.git/blame - src/ap/wpa_auth_glue.c
projects / thirdparty / hostap.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
AP: Allow PTK rekeying without Ext KeyID to be disabled as a workaround
[thirdparty/hostap.git] / src / ap / wpa_auth_glue.c
CommitLineData
c442055e
JM		 1/*
2 * hostapd / WPA authenticator glue code
47b55a3e 3 * Copyright (c) 2002-2012, Jouni Malinen <j@w1.fi>
c442055e 4 *
0f3d578e
JM		 5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
c442055e
JM		 7 */
8
9#include "utils/includes.h"
10
11#include "utils/common.h"
c5fee160
MB		 12#include "utils/eloop.h"
13#include "utils/list.h"
c442055e 14#include "common/ieee802_11_defs.h"
47b55a3e 15#include "common/sae.h"
2c502460 16#include "common/wpa_ctrl.h"
f8e09bc5 17#include "crypto/sha1.h"
c442055e
JM		 18#include "eapol_auth/eapol_auth_sm.h"
19#include "eapol_auth/eapol_auth_sm_i.h"
20#include "eap_server/eap.h"
21#include "l2_packet/l2_packet.h"
50bd8e0a 22#include "eth_p_oui.h"
6226e38d
JM		 23#include "hostapd.h"
24#include "ieee802_1x.h"
25#include "preauth_auth.h"
26#include "sta_info.h"
27#include "tkip_countermeasures.h"
8b06c1ed
JM		 28#include "ap_drv_ops.h"
29#include "ap_config.h"
1034f67b 30#include "ieee802_11.h"
d90f10fa 31#include "pmksa_cache_auth.h"
8b06c1ed 32#include "wpa_auth.h"
373f6c72 33#include "wpa_auth_glue.h"
c442055e
JM		 34
35
36static void hostapd_wpa_auth_conf(struct hostapd_bss_config *conf,
7af092a0 37 struct hostapd_config *iconf,
c442055e
JM		 38 struct wpa_auth_config *wconf)
39{
e36a5894
JM		 40 int sae_pw_id;
41
d28b43f6 42 os_memset(wconf, 0, sizeof(*wconf));
c442055e
JM		 43 wconf->wpa = conf->wpa;
44 wconf->wpa_key_mgmt = conf->wpa_key_mgmt;
45 wconf->wpa_pairwise = conf->wpa_pairwise;
46 wconf->wpa_group = conf->wpa_group;
47 wconf->wpa_group_rekey = conf->wpa_group_rekey;
48 wconf->wpa_strict_rekey = conf->wpa_strict_rekey;
49 wconf->wpa_gmk_rekey = conf->wpa_gmk_rekey;
50 wconf->wpa_ptk_rekey = conf->wpa_ptk_rekey;
41f140d3 51 wconf->wpa_group_update_count = conf->wpa_group_update_count;
6f234c1e
JM		 52 wconf->wpa_disable_eapol_key_retries =
53 conf->wpa_disable_eapol_key_retries;
41f140d3 54 wconf->wpa_pairwise_update_count = conf->wpa_pairwise_update_count;
c442055e
JM		 55 wconf->rsn_pairwise = conf->rsn_pairwise;
56 wconf->rsn_preauth = conf->rsn_preauth;
57 wconf->eapol_version = conf->eapol_version;
524dc5bf
JM		 58#ifdef CONFIG_MACSEC
59 if (wconf->eapol_version > 2)
60 wconf->eapol_version = 2;
61#endif /* CONFIG_MACSEC */
c442055e 62 wconf->wmm_enabled = conf->wmm_enabled;
721abef9 63 wconf->wmm_uapsd = conf->wmm_uapsd;
cb465555 64 wconf->disable_pmksa_caching = conf->disable_pmksa_caching;
875ab60d
MV		 65#ifdef CONFIG_OCV
66 wconf->ocv = conf->ocv;
67#endif /* CONFIG_OCV */
c442055e 68 wconf->okc = conf->okc;
c442055e 69 wconf->ieee80211w = conf->ieee80211w;
92d407db 70 wconf->beacon_prot = conf->beacon_prot;
8dd9f9cd 71 wconf->group_mgmt_cipher = conf->group_mgmt_cipher;
ba3d435f 72 wconf->sae_require_mfp = conf->sae_require_mfp;
4ec1fd8e 73#ifdef CONFIG_IEEE80211R_AP
c442055e 74 wconf->ssid_len = conf->ssid.ssid_len;
d6c3067d
JM		 75 if (wconf->ssid_len > SSID_MAX_LEN)
76 wconf->ssid_len = SSID_MAX_LEN;
c442055e
JM		 77 os_memcpy(wconf->ssid, conf->ssid.ssid, wconf->ssid_len);
78 os_memcpy(wconf->mobility_domain, conf->mobility_domain,
79 MOBILITY_DOMAIN_ID_LEN);
80 if (conf->nas_identifier &&
81 os_strlen(conf->nas_identifier) <= FT_R0KH_ID_MAX_LEN) {
82 wconf->r0_key_holder_len = os_strlen(conf->nas_identifier);
83 os_memcpy(wconf->r0_key_holder, conf->nas_identifier,
84 wconf->r0_key_holder_len);
85 }
86 os_memcpy(wconf->r1_key_holder, conf->r1_key_holder, FT_R1KH_ID_LEN);
87 wconf->r0_key_lifetime = conf->r0_key_lifetime;
3a3e2832 88 wconf->r1_max_key_lifetime = conf->r1_max_key_lifetime;
c442055e 89 wconf->reassociation_deadline = conf->reassociation_deadline;
3a46cf93
MB		 90 wconf->rkh_pos_timeout = conf->rkh_pos_timeout;
91 wconf->rkh_neg_timeout = conf->rkh_neg_timeout;
92 wconf->rkh_pull_timeout = conf->rkh_pull_timeout;
93 wconf->rkh_pull_retries = conf->rkh_pull_retries;
94 wconf->r0kh_list = &conf->r0kh_list;
95 wconf->r1kh_list = &conf->r1kh_list;
c442055e 96 wconf->pmk_r1_push = conf->pmk_r1_push;
d7956add 97 wconf->ft_over_ds = conf->ft_over_ds;
96590564 98 wconf->ft_psk_generate_local = conf->ft_psk_generate_local;
4ec1fd8e 99#endif /* CONFIG_IEEE80211R_AP */
83421850
JM		 100#ifdef CONFIG_HS20
101 wconf->disable_gtk = conf->disable_dgaf;
a14896e8
JM		 102 if (conf->osen) {
103 wconf->disable_gtk = 1;
104 wconf->wpa = WPA_PROTO_OSEN;
105 wconf->wpa_key_mgmt = WPA_KEY_MGMT_OSEN;
106 wconf->wpa_pairwise = 0;
107 wconf->wpa_group = WPA_CIPHER_CCMP;
108 wconf->rsn_pairwise = WPA_CIPHER_CCMP;
109 wconf->rsn_preauth = 0;
110 wconf->disable_pmksa_caching = 1;
a14896e8 111 wconf->ieee80211w = 1;
a14896e8 112 }
83421850 113#endif /* CONFIG_HS20 */
7af092a0
JB		 114#ifdef CONFIG_TESTING_OPTIONS
115 wconf->corrupt_gtk_rekey_mic_probability =
116 iconf->corrupt_gtk_rekey_mic_probability;
bc02843e
JM		 117 if (conf->own_ie_override &&
118 wpabuf_len(conf->own_ie_override) <= MAX_OWN_IE_OVERRIDE) {
119 wconf->own_ie_override_len = wpabuf_len(conf->own_ie_override);
120 os_memcpy(wconf->own_ie_override,
121 wpabuf_head(conf->own_ie_override),
122 wconf->own_ie_override_len);
123 }
f2c4b44b
JM		 124 if (conf->rsnxe_override_eapol &&
125 wpabuf_len(conf->rsnxe_override_eapol) <= MAX_OWN_IE_OVERRIDE) {
126 wconf->rsnxe_override_eapol_len =
127 wpabuf_len(conf->rsnxe_override_eapol);
128 os_memcpy(wconf->rsnxe_override_eapol,
129 wpabuf_head(conf->rsnxe_override_eapol),
130 wconf->rsnxe_override_eapol_len);
131 }
8d84c75f
JM		 132 if (conf->gtk_rsc_override &&
133 wpabuf_len(conf->gtk_rsc_override) > 0 &&
134 wpabuf_len(conf->gtk_rsc_override) <= WPA_KEY_RSC_LEN) {
135 os_memcpy(wconf->gtk_rsc_override,
136 wpabuf_head(conf->gtk_rsc_override),
137 wpabuf_len(conf->gtk_rsc_override));
138 wconf->gtk_rsc_override_set = 1;
139 }
140 if (conf->igtk_rsc_override &&
141 wpabuf_len(conf->igtk_rsc_override) > 0 &&
142 wpabuf_len(conf->igtk_rsc_override) <= WPA_KEY_RSC_LEN) {
143 os_memcpy(wconf->igtk_rsc_override,
144 wpabuf_head(conf->igtk_rsc_override),
145 wpabuf_len(conf->igtk_rsc_override));
146 wconf->igtk_rsc_override_set = 1;
147 }
7af092a0 148#endif /* CONFIG_TESTING_OPTIONS */
25ef8529
JM		 149#ifdef CONFIG_P2P
150 os_memcpy(wconf->ip_addr_go, conf->ip_addr_go, 4);
151 os_memcpy(wconf->ip_addr_mask, conf->ip_addr_mask, 4);
152 os_memcpy(wconf->ip_addr_start, conf->ip_addr_start, 4);
153 os_memcpy(wconf->ip_addr_end, conf->ip_addr_end, 4);
154#endif /* CONFIG_P2P */
7eace378
JM		 155#ifdef CONFIG_FILS
156 wconf->fils_cache_id_set = conf->fils_cache_id_set;
157 os_memcpy(wconf->fils_cache_id, conf->fils_cache_id,
158 FILS_CACHE_ID_LEN);
159#endif /* CONFIG_FILS */
a36e13a7 160 wconf->sae_pwe = conf->sae_pwe;
e36a5894 161 sae_pw_id = hostapd_sae_pw_id_in_use(conf);
641d79f1 162 if (sae_pw_id == 2 && wconf->sae_pwe != 3)
e36a5894
JM		 163 wconf->sae_pwe = 1;
164 else if (sae_pw_id == 1 && wconf->sae_pwe == 0)
165 wconf->sae_pwe = 2;
65a44e84
JM		 166#ifdef CONFIG_OWE
167 wconf->owe_ptk_workaround = conf->owe_ptk_workaround;
168#endif /* CONFIG_OWE */
c442055e
JM		 169}
170
171
172static void hostapd_wpa_auth_logger(void *ctx, const u8 *addr,
173 logger_level level, const char *txt)
174{
175#ifndef CONFIG_NO_HOSTAPD_LOGGER
176 struct hostapd_data *hapd = ctx;
177 int hlevel;
178
179 switch (level) {
180 case LOGGER_WARNING:
181 hlevel = HOSTAPD_LEVEL_WARNING;
182 break;
183 case LOGGER_INFO:
184 hlevel = HOSTAPD_LEVEL_INFO;
185 break;
186 case LOGGER_DEBUG:
187 default:
188 hlevel = HOSTAPD_LEVEL_DEBUG;
189 break;
190 }
191
192 hostapd_logger(hapd, addr, HOSTAPD_MODULE_WPA, hlevel, "%s", txt);
193#endif /* CONFIG_NO_HOSTAPD_LOGGER */
194}
195
196
197static void hostapd_wpa_auth_disconnect(void *ctx, const u8 *addr,
198 u16 reason)
199{
200 struct hostapd_data *hapd = ctx;
201 wpa_printf(MSG_DEBUG, "%s: WPA authenticator requests disconnect: "
202 "STA " MACSTR " reason %d",
203 __func__, MAC2STR(addr), reason);
204 ap_sta_disconnect(hapd, NULL, addr, reason);
205}
206
207
c772d054 208static int hostapd_wpa_auth_mic_failure_report(void *ctx, const u8 *addr)
c442055e
JM		 209{
210 struct hostapd_data *hapd = ctx;
c772d054 211 return michael_mic_failure(hapd, addr, 0);
c442055e
JM		 212}
213
214
2c502460
JM		 215static void hostapd_wpa_auth_psk_failure_report(void *ctx, const u8 *addr)
216{
217 struct hostapd_data *hapd = ctx;
218 wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_POSSIBLE_PSK_MISMATCH MACSTR,
219 MAC2STR(addr));
220}
221
222
c442055e
JM		 223static void hostapd_wpa_auth_set_eapol(void *ctx, const u8 *addr,
224 wpa_eapol_variable var, int value)
225{
226 struct hostapd_data *hapd = ctx;
227 struct sta_info *sta = ap_get_sta(hapd, addr);
228 if (sta == NULL)
229 return;
230 switch (var) {
231 case WPA_EAPOL_portEnabled:
232 ieee802_1x_notify_port_enabled(sta->eapol_sm, value);
233 break;
234 case WPA_EAPOL_portValid:
235 ieee802_1x_notify_port_valid(sta->eapol_sm, value);
236 break;
237 case WPA_EAPOL_authorized:
238 ieee802_1x_set_sta_authorized(hapd, sta, value);
239 break;
240 case WPA_EAPOL_portControl_Auto:
241 if (sta->eapol_sm)
242 sta->eapol_sm->portControl = Auto;
243 break;
244 case WPA_EAPOL_keyRun:
245 if (sta->eapol_sm)
246 sta->eapol_sm->keyRun = value ? TRUE : FALSE;
247 break;
248 case WPA_EAPOL_keyAvailable:
249 if (sta->eapol_sm)
250 sta->eapol_sm->eap_if->eapKeyAvailable =
251 value ? TRUE : FALSE;
252 break;
253 case WPA_EAPOL_keyDone:
254 if (sta->eapol_sm)
255 sta->eapol_sm->keyDone = value ? TRUE : FALSE;
256 break;
257 case WPA_EAPOL_inc_EapolFramesTx:
258 if (sta->eapol_sm)
259 sta->eapol_sm->dot1xAuthEapolFramesTx++;
260 break;
261 }
262}
263
264
265static int hostapd_wpa_auth_get_eapol(void *ctx, const u8 *addr,
266 wpa_eapol_variable var)
267{
268 struct hostapd_data *hapd = ctx;
269 struct sta_info *sta = ap_get_sta(hapd, addr);
270 if (sta == NULL || sta->eapol_sm == NULL)
271 return -1;
272 switch (var) {
273 case WPA_EAPOL_keyRun:
274 return sta->eapol_sm->keyRun;
275 case WPA_EAPOL_keyAvailable:
276 return sta->eapol_sm->eap_if->eapKeyAvailable;
277 default:
278 return -1;
279 }
280}
281
282
283static const u8 * hostapd_wpa_auth_get_psk(void *ctx, const u8 *addr,
759fd76b 284 const u8 *p2p_dev_addr,
dbfa691d
JM		 285 const u8 *prev_psk, size_t *psk_len,
286 int *vlan_id)
c442055e
JM		 287{
288 struct hostapd_data *hapd = ctx;
05ab9712 289 struct sta_info *sta = ap_get_sta(hapd, addr);
47b55a3e
JM		 290 const u8 *psk;
291
dbfa691d
JM		 292 if (vlan_id)
293 *vlan_id = 0;
7a12edd1
JM		 294 if (psk_len)
295 *psk_len = PMK_LEN;
296
47b55a3e
JM		 297#ifdef CONFIG_SAE
298 if (sta && sta->auth_alg == WLAN_AUTH_SAE) {
299 if (!sta->sae || prev_psk)
300 return NULL;
301 return sta->sae->pmk;
302 }
e61fea6b
JM		 303 if (sta && wpa_auth_uses_sae(sta->wpa_sm)) {
304 wpa_printf(MSG_DEBUG,
305 "No PSK for STA trying to use SAE with PMKSA caching");
306 return NULL;
307 }
47b55a3e
JM		 308#endif /* CONFIG_SAE */
309
09368515
JM		 310#ifdef CONFIG_OWE
311 if ((hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE) &&
7a12edd1
JM		 312 sta && sta->owe_pmk) {
313 if (psk_len)
314 *psk_len = sta->owe_pmk_len;
09368515 315 return sta->owe_pmk;
7a12edd1 316 }
d90f10fa
JM		 317 if ((hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE) && sta) {
318 struct rsn_pmksa_cache_entry *sa;
319
320 sa = wpa_auth_sta_get_pmksa(sta->wpa_sm);
321 if (sa && sa->akmp == WPA_KEY_MGMT_OWE) {
322 if (psk_len)
323 *psk_len = sa->pmk_len;
324 return sa->pmk;
325 }
326 }
09368515
JM		 327#endif /* CONFIG_OWE */
328
dbfa691d
JM		 329 psk = hostapd_get_psk(hapd->conf, addr, p2p_dev_addr, prev_psk,
330 vlan_id);
59dff51d
MB		 331 /*
332 * This is about to iterate over all psks, prev_psk gives the last
333 * returned psk which should not be returned again.
5ee56c4e 334 * logic list (all hostapd_get_psk; all sta->psk)
59dff51d 335 */
5ee56c4e
MB		 336 if (sta && sta->psk && !psk) {
337 struct hostapd_sta_wpa_psk_short *pos;
dbfa691d
JM		 338
339 if (vlan_id)
340 *vlan_id = 0;
5ee56c4e
MB		 341 psk = sta->psk->psk;
342 for (pos = sta->psk; pos; pos = pos->next) {
f8e09bc5
MB		 343 if (pos->is_passphrase) {
344 pbkdf2_sha1(pos->passphrase,
345 hapd->conf->ssid.ssid,
346 hapd->conf->ssid.ssid_len, 4096,
347 pos->psk, PMK_LEN);
348 pos->is_passphrase = 0;
349 }
5ee56c4e
MB		 350 if (pos->psk == prev_psk) {
351 psk = pos->next ? pos->next->psk : NULL;
352 break;
353 }
354 }
355 }
59dff51d 356 return psk;
c442055e
JM		 357}
358
359
360static int hostapd_wpa_auth_get_msk(void *ctx, const u8 *addr, u8 *msk,
361 size_t *len)
362{
363 struct hostapd_data *hapd = ctx;
364 const u8 *key;
365 size_t keylen;
366 struct sta_info *sta;
367
368 sta = ap_get_sta(hapd, addr);
400de9b1
BG		 369 if (sta == NULL) {
370 wpa_printf(MSG_DEBUG, "AUTH_GET_MSK: Cannot find STA");
c442055e 371 return -1;
400de9b1 372 }
c442055e
JM		 373
374 key = ieee802_1x_get_key(sta->eapol_sm, &keylen);
400de9b1
BG		 375 if (key == NULL) {
376 wpa_printf(MSG_DEBUG, "AUTH_GET_MSK: Key is null, eapol_sm: %p",
377 sta->eapol_sm);
c442055e 378 return -1;
400de9b1 379 }
c442055e
JM		 380
381 if (keylen > *len)
382 keylen = *len;
383 os_memcpy(msk, key, keylen);
384 *len = keylen;
385
386 return 0;
387}
388
389
71934751 390static int hostapd_wpa_auth_set_key(void *ctx, int vlan_id, enum wpa_alg alg,
c442055e 391 const u8 *addr, int idx, u8 *key,
a919a260 392 size_t key_len, enum key_flag key_flag)
c442055e
JM		 393{
394 struct hostapd_data *hapd = ctx;
395 const char *ifname = hapd->conf->iface;
396
397 if (vlan_id > 0) {
398 ifname = hostapd_get_vlan_id_ifname(hapd->conf->vlan, vlan_id);
99d8c4dc
GG		 399 if (!ifname) {
400 if (!(hapd->iface->drv_flags &
401 WPA_DRIVER_FLAGS_VLAN_OFFLOAD))
402 return -1;
403 ifname = hapd->conf->iface;
404 }
c442055e
JM		 405 }
406
16579769
JM		 407#ifdef CONFIG_TESTING_OPTIONS
408 if (addr && !is_broadcast_ether_addr(addr)) {
409 struct sta_info *sta;
410
411 sta = ap_get_sta(hapd, addr);
412 if (sta) {
413 sta->last_tk_alg = alg;
414 sta->last_tk_key_idx = idx;
415 if (key)
416 os_memcpy(sta->last_tk, key, key_len);
417 sta->last_tk_len = key_len;
418 }
f8bfc9cb
PK		 419 } else if (alg == WPA_ALG_IGTK ||
420 alg == WPA_ALG_BIP_GMAC_128 ||
421 alg == WPA_ALG_BIP_GMAC_256 ||
422 alg == WPA_ALG_BIP_CMAC_256) {
16579769
JM		 423 hapd->last_igtk_alg = alg;
424 hapd->last_igtk_key_idx = idx;
425 if (key)
426 os_memcpy(hapd->last_igtk, key, key_len);
427 hapd->last_igtk_len = key_len;
16579769
JM		 428 } else {
429 hapd->last_gtk_alg = alg;
430 hapd->last_gtk_key_idx = idx;
431 if (key)
432 os_memcpy(hapd->last_gtk, key, key_len);
433 hapd->last_gtk_len = key_len;
434 }
435#endif /* CONFIG_TESTING_OPTIONS */
4d3ae54f 436 return hostapd_drv_set_key(ifname, hapd, alg, addr, idx, vlan_id, 1,
a919a260 437 NULL, 0, key, key_len, key_flag);
c442055e
JM		 438}
439
440
441static int hostapd_wpa_auth_get_seqnum(void *ctx, const u8 *addr, int idx,
442 u8 *seq)
443{
444 struct hostapd_data *hapd = ctx;
445 return hostapd_get_seqnum(hapd->conf->iface, hapd, addr, idx, seq);
446}
447
448
449static int hostapd_wpa_auth_send_eapol(void *ctx, const u8 *addr,
450 const u8 *data, size_t data_len,
451 int encrypt)
452{
453 struct hostapd_data *hapd = ctx;
4378fc14
FF		 454 struct sta_info *sta;
455 u32 flags = 0;
456
9d4ff04a
JM		 457#ifdef CONFIG_TESTING_OPTIONS
458 if (hapd->ext_eapol_frame_io) {
459 size_t hex_len = 2 * data_len + 1;
460 char *hex = os_malloc(hex_len);
461
462 if (hex == NULL)
463 return -1;
464 wpa_snprintf_hex(hex, hex_len, data, data_len);
465 wpa_msg(hapd->msg_ctx, MSG_INFO, "EAPOL-TX " MACSTR " %s",
466 MAC2STR(addr), hex);
467 os_free(hex);
468 return 0;
469 }
470#endif /* CONFIG_TESTING_OPTIONS */
471
4378fc14
FF		 472 sta = ap_get_sta(hapd, addr);
473 if (sta)
474 flags = hostapd_sta_flags_to_drv(sta->flags);
475
3acdf771 476 return hostapd_drv_hapd_send_eapol(hapd, addr, data, data_len,
4378fc14 477 encrypt, flags);
c442055e
JM		 478}
479
480
481static int hostapd_wpa_auth_for_each_sta(
482 void *ctx, int (*cb)(struct wpa_state_machine *sm, void *ctx),
483 void *cb_ctx)
484{
485 struct hostapd_data *hapd = ctx;
486 struct sta_info *sta;
487
488 for (sta = hapd->sta_list; sta; sta = sta->next) {
489 if (sta->wpa_sm && cb(sta->wpa_sm, cb_ctx))
490 return 1;
491 }
492 return 0;
493}
494
495
496struct wpa_auth_iface_iter_data {
497 int (*cb)(struct wpa_authenticator *sm, void *ctx);
498 void *cb_ctx;
499};
500
501static int wpa_auth_iface_iter(struct hostapd_iface *iface, void *ctx)
502{
503 struct wpa_auth_iface_iter_data *data = ctx;
504 size_t i;
505 for (i = 0; i < iface->num_bss; i++) {
03bcb0af
JM		 506 if (iface->bss[i]->wpa_auth &&
507 data->cb(iface->bss[i]->wpa_auth, data->cb_ctx))
c442055e
JM		 508 return 1;
509 }
510 return 0;
511}
512
513
514static int hostapd_wpa_auth_for_each_auth(
515 void *ctx, int (*cb)(struct wpa_authenticator *sm, void *ctx),
516 void *cb_ctx)
517{
518 struct hostapd_data *hapd = ctx;
519 struct wpa_auth_iface_iter_data data;
3776ac73
JM		 520 if (hapd->iface->interfaces == NULL ||
521 hapd->iface->interfaces->for_each_interface == NULL)
1b56c26c 522 return -1;
c442055e
JM		 523 data.cb = cb;
524 data.cb_ctx = cb_ctx;
3776ac73
JM		 525 return hapd->iface->interfaces->for_each_interface(
526 hapd->iface->interfaces, wpa_auth_iface_iter, &data);
c442055e
JM		 527}
528
529
4ec1fd8e 530#ifdef CONFIG_IEEE80211R_AP
67ccef7e 531
c5fee160
MB		 532struct wpa_ft_rrb_rx_later_data {
533 struct dl_list list;
534 u8 addr[ETH_ALEN];
535 size_t data_len;
536 /* followed by data_len octets of data */
537};
538
539static void hostapd_wpa_ft_rrb_rx_later(void *eloop_ctx, void *timeout_ctx)
540{
541 struct hostapd_data *hapd = eloop_ctx;
542 struct wpa_ft_rrb_rx_later_data *data, *n;
543
544 dl_list_for_each_safe(data, n, &hapd->l2_queue,
545 struct wpa_ft_rrb_rx_later_data, list) {
546 if (hapd->wpa_auth) {
547 wpa_ft_rrb_rx(hapd->wpa_auth, data->addr,
548 (const u8 *) (data + 1),
549 data->data_len);
550 }
551 dl_list_del(&data->list);
552 os_free(data);
553 }
554}
555
556
67ccef7e
JM		 557struct wpa_auth_ft_iface_iter_data {
558 struct hostapd_data *src_hapd;
559 const u8 *dst;
560 const u8 *data;
561 size_t data_len;
562};
563
564
565static int hostapd_wpa_auth_ft_iter(struct hostapd_iface *iface, void *ctx)
566{
567 struct wpa_auth_ft_iface_iter_data *idata = ctx;
c5fee160 568 struct wpa_ft_rrb_rx_later_data *data;
67ccef7e
JM		 569 struct hostapd_data *hapd;
570 size_t j;
571
572 for (j = 0; j < iface->num_bss; j++) {
573 hapd = iface->bss[j];
c5fee160
MB		 574 if (hapd == idata->src_hapd ||
575 !hapd->wpa_auth ||
576 os_memcmp(hapd->own_addr, idata->dst, ETH_ALEN) != 0)
71456dbd 577 continue;
c5fee160
MB		 578
579 wpa_printf(MSG_DEBUG,
580 "FT: Send RRB data directly to locally managed BSS "
581 MACSTR "@%s -> " MACSTR "@%s",
582 MAC2STR(idata->src_hapd->own_addr),
583 idata->src_hapd->conf->iface,
584 MAC2STR(hapd->own_addr), hapd->conf->iface);
585
586 /* Defer wpa_ft_rrb_rx() until next eloop step as this is
587 * when it would be triggered when reading from a socket.
588 * This avoids
589 * hapd0:send -> hapd1:recv -> hapd1:send -> hapd0:recv,
590 * that is calling hapd0:recv handler from within
591 * hapd0:send directly.
592 */
593 data = os_zalloc(sizeof(*data) + idata->data_len);
594 if (!data)
67ccef7e 595 return 1;
c5fee160
MB		 596
597 os_memcpy(data->addr, idata->src_hapd->own_addr, ETH_ALEN);
598 os_memcpy(data + 1, idata->data, idata->data_len);
599 data->data_len = idata->data_len;
600
601 dl_list_add(&hapd->l2_queue, &data->list);
602
603 if (!eloop_is_timeout_registered(hostapd_wpa_ft_rrb_rx_later,
604 hapd, NULL))
605 eloop_register_timeout(0, 0,
606 hostapd_wpa_ft_rrb_rx_later,
607 hapd, NULL);
608
609 return 1;
67ccef7e
JM		 610 }
611
612 return 0;
613}
614
4ec1fd8e 615#endif /* CONFIG_IEEE80211R_AP */
67ccef7e
JM		 616
617
c442055e
JM		 618static int hostapd_wpa_auth_send_ether(void *ctx, const u8 *dst, u16 proto,
619 const u8 *data, size_t data_len)
620{
621 struct hostapd_data *hapd = ctx;
7e031850
JM		 622 struct l2_ethhdr *buf;
623 int ret;
c442055e 624
9d4ff04a
JM		 625#ifdef CONFIG_TESTING_OPTIONS
626 if (hapd->ext_eapol_frame_io && proto == ETH_P_EAPOL) {
627 size_t hex_len = 2 * data_len + 1;
628 char *hex = os_malloc(hex_len);
629
630 if (hex == NULL)
631 return -1;
632 wpa_snprintf_hex(hex, hex_len, data, data_len);
633 wpa_msg(hapd->msg_ctx, MSG_INFO, "EAPOL-TX " MACSTR " %s",
634 MAC2STR(dst), hex);
635 os_free(hex);
636 return 0;
637 }
638#endif /* CONFIG_TESTING_OPTIONS */
639
4ec1fd8e 640#ifdef CONFIG_IEEE80211R_AP
3776ac73
JM		 641 if (proto == ETH_P_RRB && hapd->iface->interfaces &&
642 hapd->iface->interfaces->for_each_interface) {
67ccef7e
JM		 643 int res;
644 struct wpa_auth_ft_iface_iter_data idata;
645 idata.src_hapd = hapd;
646 idata.dst = dst;
647 idata.data = data;
648 idata.data_len = data_len;
3776ac73
JM		 649 res = hapd->iface->interfaces->for_each_interface(
650 hapd->iface->interfaces, hostapd_wpa_auth_ft_iter,
651 &idata);
67ccef7e
JM		 652 if (res == 1)
653 return data_len;
654 }
4ec1fd8e 655#endif /* CONFIG_IEEE80211R_AP */
67ccef7e 656
c442055e
JM		 657 if (hapd->l2 == NULL)
658 return -1;
7e031850
JM		 659
660 buf = os_malloc(sizeof(*buf) + data_len);
661 if (buf == NULL)
662 return -1;
663 os_memcpy(buf->h_dest, dst, ETH_ALEN);
664 os_memcpy(buf->h_source, hapd->own_addr, ETH_ALEN);
665 buf->h_proto = host_to_be16(proto);
666 os_memcpy(buf + 1, data, data_len);
667 ret = l2_packet_send(hapd->l2, dst, proto, (u8 *) buf,
668 sizeof(*buf) + data_len);
669 os_free(buf);
2683690d 670 return ret;
c442055e
JM		 671}
672
673
50bd8e0a
MB		 674#ifdef CONFIG_ETH_P_OUI
675static struct eth_p_oui_ctx * hostapd_wpa_get_oui(struct hostapd_data *hapd,
676 u8 oui_suffix)
677{
678 switch (oui_suffix) {
679#ifdef CONFIG_IEEE80211R_AP
680 case FT_PACKET_R0KH_R1KH_PULL:
681 return hapd->oui_pull;
682 case FT_PACKET_R0KH_R1KH_RESP:
683 return hapd->oui_resp;
684 case FT_PACKET_R0KH_R1KH_PUSH:
685 return hapd->oui_push;
eefe8630
MB		 686 case FT_PACKET_R0KH_R1KH_SEQ_REQ:
687 return hapd->oui_sreq;
688 case FT_PACKET_R0KH_R1KH_SEQ_RESP:
689 return hapd->oui_sresp;
50bd8e0a
MB		 690#endif /* CONFIG_IEEE80211R_AP */
691 default:
692 return NULL;
693 }
694}
695#endif /* CONFIG_ETH_P_OUI */
696
697
698#ifdef CONFIG_IEEE80211R_AP
699
700struct oui_deliver_later_data {
701 struct dl_list list;
702 u8 src_addr[ETH_ALEN];
703 u8 dst_addr[ETH_ALEN];
704 size_t data_len;
705 u8 oui_suffix;
706 /* followed by data_len octets of data */
707};
708
709static void hostapd_oui_deliver_later(void *eloop_ctx, void *timeout_ctx)
710{
711 struct hostapd_data *hapd = eloop_ctx;
712 struct oui_deliver_later_data *data, *n;
713 struct eth_p_oui_ctx *oui_ctx;
714
715 dl_list_for_each_safe(data, n, &hapd->l2_oui_queue,
716 struct oui_deliver_later_data, list) {
717 oui_ctx = hostapd_wpa_get_oui(hapd, data->oui_suffix);
a422d9b4
JM		 718 wpa_printf(MSG_DEBUG, "RRB(%s): %s src=" MACSTR " dst=" MACSTR
719 " oui_suffix=%u data_len=%u data=%p",
720 hapd->conf->iface, __func__,
721 MAC2STR(data->src_addr), MAC2STR(data->dst_addr),
722 data->oui_suffix, (unsigned int) data->data_len,
723 data);
50bd8e0a
MB		 724 if (hapd->wpa_auth && oui_ctx) {
725 eth_p_oui_deliver(oui_ctx, data->src_addr,
726 data->dst_addr,
727 (const u8 *) (data + 1),
728 data->data_len);
729 }
730 dl_list_del(&data->list);
731 os_free(data);
732 }
733}
734
735
736struct wpa_auth_oui_iface_iter_data {
737 struct hostapd_data *src_hapd;
738 const u8 *dst_addr;
739 const u8 *data;
740 size_t data_len;
741 u8 oui_suffix;
742};
743
744static int hostapd_wpa_auth_oui_iter(struct hostapd_iface *iface, void *ctx)
745{
746 struct wpa_auth_oui_iface_iter_data *idata = ctx;
747 struct oui_deliver_later_data *data;
3cd4db23 748 struct hostapd_data *hapd, *src_hapd = idata->src_hapd;
50bd8e0a
MB		 749 size_t j;
750
751 for (j = 0; j < iface->num_bss; j++) {
752 hapd = iface->bss[j];
3cd4db23
JM		 753 if (hapd == src_hapd)
754 continue; /* don't deliver back to same interface */
755 if (!wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt) ||
756 hapd->conf->ssid.ssid_len !=
757 src_hapd->conf->ssid.ssid_len ||
758 os_memcmp(hapd->conf->ssid.ssid,
759 src_hapd->conf->ssid.ssid,
760 hapd->conf->ssid.ssid_len) != 0 ||
761 os_memcmp(hapd->conf->mobility_domain,
762 src_hapd->conf->mobility_domain,
c133c785 763 MOBILITY_DOMAIN_ID_LEN) != 0)
3cd4db23 764 continue; /* no matching FT SSID/mobility domain */
50bd8e0a
MB		 765 if (!is_multicast_ether_addr(idata->dst_addr) &&
766 os_memcmp(hapd->own_addr, idata->dst_addr, ETH_ALEN) != 0)
3cd4db23 767 continue; /* destination address does not match */
50bd8e0a
MB		 768
769 /* defer eth_p_oui_deliver until next eloop step as this is
770 * when it would be triggerd from reading from sock
771 * This avoids
772 * hapd0:send -> hapd1:recv -> hapd1:send -> hapd0:recv,
773 * that is calling hapd0:recv handler from within
774 * hapd0:send directly.
775 */
776 data = os_zalloc(sizeof(*data) + idata->data_len);
777 if (!data)
778 return 1;
a422d9b4
JM		 779 wpa_printf(MSG_DEBUG,
780 "RRB(%s): local delivery to %s dst=" MACSTR
781 " oui_suffix=%u data_len=%u data=%p",
3cd4db23 782 src_hapd->conf->iface, hapd->conf->iface,
a422d9b4
JM		 783 MAC2STR(idata->dst_addr), idata->oui_suffix,
784 (unsigned int) idata->data_len, data);
50bd8e0a 785
3cd4db23 786 os_memcpy(data->src_addr, src_hapd->own_addr, ETH_ALEN);
50bd8e0a
MB		 787 os_memcpy(data->dst_addr, idata->dst_addr, ETH_ALEN);
788 os_memcpy(data + 1, idata->data, idata->data_len);
789 data->data_len = idata->data_len;
790 data->oui_suffix = idata->oui_suffix;
791
7b1105af 792 dl_list_add_tail(&hapd->l2_oui_queue, &data->list);
50bd8e0a
MB		 793
794 if (!eloop_is_timeout_registered(hostapd_oui_deliver_later,
795 hapd, NULL))
796 eloop_register_timeout(0, 0,
797 hostapd_oui_deliver_later,
798 hapd, NULL);
799
4834c686
JW		 800 /* If dst_addr is a multicast address, do not return any
801 * non-zero value here. Otherwise, the iteration of
802 * for_each_interface() will be stopped. */
803 if (!is_multicast_ether_addr(idata->dst_addr))
804 return 1;
50bd8e0a
MB		 805 }
806
807 return 0;
808}
809
810#endif /* CONFIG_IEEE80211R_AP */
811
812
813static int hostapd_wpa_auth_send_oui(void *ctx, const u8 *dst, u8 oui_suffix,
814 const u8 *data, size_t data_len)
815{
816#ifdef CONFIG_ETH_P_OUI
817 struct hostapd_data *hapd = ctx;
818 struct eth_p_oui_ctx *oui_ctx;
819
a422d9b4
JM		 820 wpa_printf(MSG_DEBUG, "RRB(%s): send to dst=" MACSTR
821 " oui_suffix=%u data_len=%u",
822 hapd->conf->iface, MAC2STR(dst), oui_suffix,
823 (unsigned int) data_len);
50bd8e0a
MB		 824#ifdef CONFIG_IEEE80211R_AP
825 if (hapd->iface->interfaces &&
826 hapd->iface->interfaces->for_each_interface) {
827 struct wpa_auth_oui_iface_iter_data idata;
828 int res;
829
830 idata.src_hapd = hapd;
831 idata.dst_addr = dst;
832 idata.data = data;
833 idata.data_len = data_len;
834 idata.oui_suffix = oui_suffix;
835 res = hapd->iface->interfaces->for_each_interface(
836 hapd->iface->interfaces, hostapd_wpa_auth_oui_iter,
837 &idata);
838 if (res == 1)
839 return data_len;
840 }
841#endif /* CONFIG_IEEE80211R_AP */
842
843 oui_ctx = hostapd_wpa_get_oui(hapd, oui_suffix);
844 if (!oui_ctx)
845 return -1;
846
847 return eth_p_oui_send(oui_ctx, hapd->own_addr, dst, data, data_len);
848#else /* CONFIG_ETH_P_OUI */
849 return -1;
850#endif /* CONFIG_ETH_P_OUI */
851}
852
853
bef4d07a
MV		 854static int hostapd_channel_info(void *ctx, struct wpa_channel_info *ci)
855{
856 struct hostapd_data *hapd = ctx;
857
858 return hostapd_drv_channel_info(hapd, ci);
859}
860
1034f67b 861
dbfa691d
JM		 862static int hostapd_wpa_auth_update_vlan(void *ctx, const u8 *addr, int vlan_id)
863{
864#ifndef CONFIG_NO_VLAN
865 struct hostapd_data *hapd = ctx;
866 struct sta_info *sta;
dbfa691d
JM		 867
868 sta = ap_get_sta(hapd, addr);
869 if (!sta)
870 return -1;
871
99d8c4dc
GG		 872 if (!(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_VLAN_OFFLOAD)) {
873 struct vlan_description vlan_desc;
dbfa691d 874
99d8c4dc
GG		 875 os_memset(&vlan_desc, 0, sizeof(vlan_desc));
876 vlan_desc.notempty = 1;
877 vlan_desc.untagged = vlan_id;
878 if (!hostapd_vlan_valid(hapd->conf->vlan, &vlan_desc)) {
879 wpa_printf(MSG_INFO,
880 "Invalid VLAN ID %d in wpa_psk_file",
881 vlan_id);
882 return -1;
883 }
884
885 if (ap_sta_set_vlan(hapd, sta, &vlan_desc) < 0) {
886 wpa_printf(MSG_INFO,
887 "Failed to assign VLAN ID %d from wpa_psk_file to "
888 MACSTR, vlan_id, MAC2STR(sta->addr));
889 return -1;
890 }
891 } else {
892 sta->vlan_id = vlan_id;
dbfa691d
JM		 893 }
894
895 wpa_printf(MSG_INFO,
896 "Assigned VLAN ID %d from wpa_psk_file to " MACSTR,
897 vlan_id, MAC2STR(sta->addr));
898 if ((sta->flags & WLAN_STA_ASSOC) &&
899 ap_sta_bind_vlan(hapd, sta) < 0)
900 return -1;
901#endif /* CONFIG_NO_VLAN */
902
903 return 0;
904}
905
906
1034f67b
MV		 907#ifdef CONFIG_OCV
908static int hostapd_get_sta_tx_params(void *ctx, const u8 *addr,
909 int ap_max_chanwidth, int ap_seg1_idx,
910 int *bandwidth, int *seg1_idx)
911{
912 struct hostapd_data *hapd = ctx;
913 struct sta_info *sta;
914
915 sta = ap_get_sta(hapd, addr);
916 if (!sta) {
917 hostapd_wpa_auth_logger(hapd, addr, LOGGER_INFO,
918 "Failed to get STA info to validate received OCI");
919 return -1;
920 }
921
922 return get_tx_parameters(sta, ap_max_chanwidth, ap_seg1_idx, bandwidth,
923 seg1_idx);
924}
925#endif /* CONFIG_OCV */
926
927
4ec1fd8e 928#ifdef CONFIG_IEEE80211R_AP
c442055e
JM		 929
930static int hostapd_wpa_auth_send_ft_action(void *ctx, const u8 *dst,
931 const u8 *data, size_t data_len)
932{
933 struct hostapd_data *hapd = ctx;
934 int res;
935 struct ieee80211_mgmt *m;
936 size_t mlen;
937 struct sta_info *sta;
938
939 sta = ap_get_sta(hapd, dst);
940 if (sta == NULL || sta->wpa_sm == NULL)
941 return -1;
942
943 m = os_zalloc(sizeof(*m) + data_len);
944 if (m == NULL)
945 return -1;
946 mlen = ((u8 *) &m->u - (u8 *) m) + data_len;
947 m->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
948 WLAN_FC_STYPE_ACTION);
949 os_memcpy(m->da, dst, ETH_ALEN);
950 os_memcpy(m->sa, hapd->own_addr, ETH_ALEN);
951 os_memcpy(m->bssid, hapd->own_addr, ETH_ALEN);
952 os_memcpy(&m->u, data, data_len);
953
37100274 954 res = hostapd_drv_send_mlme(hapd, (u8 *) m, mlen, 0, NULL, 0, 0);
c442055e
JM		 955 os_free(m);
956 return res;
957}
958
959
960static struct wpa_state_machine *
961hostapd_wpa_auth_add_sta(void *ctx, const u8 *sta_addr)
962{
963 struct hostapd_data *hapd = ctx;
964 struct sta_info *sta;
df3b2e22 965 int ret;
c442055e 966
4cf5efec
JM		 967 wpa_printf(MSG_DEBUG, "Add station entry for " MACSTR
968 " based on WPA authenticator callback",
969 MAC2STR(sta_addr));
df3b2e22
SSG		 970 ret = hostapd_add_sta_node(hapd, sta_addr, WLAN_AUTH_FT);
971
972 /*
973 * The expected return values from hostapd_add_sta_node() are
974 * 0: successfully added STA entry
975 * -EOPNOTSUPP: driver or driver wrapper does not support/need this
976 * operations
977 * any other negative value: error in adding the STA entry */
978 if (ret < 0 && ret != -EOPNOTSUPP)
88b32a99
SP		 979 return NULL;
980
c442055e
JM		 981 sta = ap_sta_add(hapd, sta_addr);
982 if (sta == NULL)
983 return NULL;
df3b2e22 984 if (ret == 0)
4cf5efec 985 sta->added_unassoc = 1;
df3b2e22 986
4cf5efec 987 sta->ft_over_ds = 1;
21c9b690
JM		 988 if (sta->wpa_sm) {
989 sta->auth_alg = WLAN_AUTH_FT;
c442055e 990 return sta->wpa_sm;
21c9b690 991 }
c442055e 992
94ddef3e 993 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, sta->addr, NULL);
c442055e
JM		 994 if (sta->wpa_sm == NULL) {
995 ap_free_sta(hapd, sta);
996 return NULL;
997 }
998 sta->auth_alg = WLAN_AUTH_FT;
999
1000 return sta->wpa_sm;
1001}
1002
1003
47a039b0
MB		 1004static int hostapd_wpa_auth_set_vlan(void *ctx, const u8 *sta_addr,
1005 struct vlan_description *vlan)
1006{
1007 struct hostapd_data *hapd = ctx;
1008 struct sta_info *sta;
1009
1010 sta = ap_get_sta(hapd, sta_addr);
1011 if (!sta || !sta->wpa_sm)
1012 return -1;
1013
1014 if (vlan->notempty &&
1015 !hostapd_vlan_valid(hapd->conf->vlan, vlan)) {
1016 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1017 HOSTAPD_LEVEL_INFO,
1018 "Invalid VLAN %d%s received from FT",
1019 vlan->untagged, vlan->tagged[0] ? "+" : "");
1020 return -1;
1021 }
1022
1023 if (ap_sta_set_vlan(hapd, sta, vlan) < 0)
1024 return -1;
1025 /* Configure wpa_group for GTK but ignore error due to driver not
1026 * knowing this STA. */
1027 ap_sta_bind_vlan(hapd, sta);
1028
1029 if (sta->vlan_id)
1030 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1031 HOSTAPD_LEVEL_INFO, "VLAN ID %d", sta->vlan_id);
1032
1033 return 0;
1034}
1035
1036
1037static int hostapd_wpa_auth_get_vlan(void *ctx, const u8 *sta_addr,
1038 struct vlan_description *vlan)
1039{
1040 struct hostapd_data *hapd = ctx;
1041 struct sta_info *sta;
1042
1043 sta = ap_get_sta(hapd, sta_addr);
1044 if (!sta)
1045 return -1;
1046
1047 if (sta->vlan_desc)
1048 *vlan = *sta->vlan_desc;
1049 else
1050 os_memset(vlan, 0, sizeof(*vlan));
1051
1052 return 0;
1053}
1054
1055
8c345234
MB		 1056static int
1057hostapd_wpa_auth_set_identity(void *ctx, const u8 *sta_addr,
1058 const u8 *identity, size_t identity_len)
1059{
1060 struct hostapd_data *hapd = ctx;
1061 struct sta_info *sta;
1062
1063 sta = ap_get_sta(hapd, sta_addr);
1064 if (!sta)
1065 return -1;
1066
1067 os_free(sta->identity);
1068 sta->identity = NULL;
1069
1070 if (sta->eapol_sm) {
1071 os_free(sta->eapol_sm->identity);
1072 sta->eapol_sm->identity = NULL;
1073 sta->eapol_sm->identity_len = 0;
1074 }
1075
1076 if (!identity_len)
1077 return 0;
1078
1079 /* sta->identity is NULL terminated */
1080 sta->identity = os_zalloc(identity_len + 1);
1081 if (!sta->identity)
1082 return -1;
1083 os_memcpy(sta->identity, identity, identity_len);
1084
1085 if (sta->eapol_sm) {
1086 sta->eapol_sm->identity = os_zalloc(identity_len);
1087 if (!sta->eapol_sm->identity)
1088 return -1;
1089 os_memcpy(sta->eapol_sm->identity, identity, identity_len);
1090 sta->eapol_sm->identity_len = identity_len;
1091 }
1092
1093 return 0;
1094}
1095
1096
1097static size_t
1098hostapd_wpa_auth_get_identity(void *ctx, const u8 *sta_addr, const u8 **buf)
1099{
1100 struct hostapd_data *hapd = ctx;
1101 struct sta_info *sta;
1102 size_t len;
1103 char *identity;
1104
1105 sta = ap_get_sta(hapd, sta_addr);
1106 if (!sta)
1107 return 0;
1108
1109 *buf = ieee802_1x_get_identity(sta->eapol_sm, &len);
1110 if (*buf && len)
1111 return len;
1112
1113 if (!sta->identity) {
1114 *buf = NULL;
1115 return 0;
1116 }
1117
1118 identity = sta->identity;
1119 len = os_strlen(identity);
1120 *buf = (u8 *) identity;
1121
1122 return len;
1123}
1124
1125
1126static int
1127hostapd_wpa_auth_set_radius_cui(void *ctx, const u8 *sta_addr,
1128 const u8 *radius_cui, size_t radius_cui_len)
1129{
1130 struct hostapd_data *hapd = ctx;
1131 struct sta_info *sta;
1132
1133 sta = ap_get_sta(hapd, sta_addr);
1134 if (!sta)
1135 return -1;
1136
1137 os_free(sta->radius_cui);
1138 sta->radius_cui = NULL;
1139
1140 if (sta->eapol_sm) {
1141 wpabuf_free(sta->eapol_sm->radius_cui);
1142 sta->eapol_sm->radius_cui = NULL;
1143 }
1144
1145 if (!radius_cui)
1146 return 0;
1147
1148 /* sta->radius_cui is NULL terminated */
1149 sta->radius_cui = os_zalloc(radius_cui_len + 1);
1150 if (!sta->radius_cui)
1151 return -1;
1152 os_memcpy(sta->radius_cui, radius_cui, radius_cui_len);
1153
1154 if (sta->eapol_sm) {
1155 sta->eapol_sm->radius_cui = wpabuf_alloc_copy(radius_cui,
1156 radius_cui_len);
1157 if (!sta->eapol_sm->radius_cui)
1158 return -1;
1159 }
1160
1161 return 0;
1162}
1163
1164
1165static size_t
1166hostapd_wpa_auth_get_radius_cui(void *ctx, const u8 *sta_addr, const u8 **buf)
1167{
1168 struct hostapd_data *hapd = ctx;
1169 struct sta_info *sta;
1170 struct wpabuf *b;
1171 size_t len;
1172 char *radius_cui;
1173
1174 sta = ap_get_sta(hapd, sta_addr);
1175 if (!sta)
1176 return 0;
1177
1178 b = ieee802_1x_get_radius_cui(sta->eapol_sm);
1179 if (b) {
1180 len = wpabuf_len(b);
1181 *buf = wpabuf_head(b);
1182 return len;
1183 }
1184
1185 if (!sta->radius_cui) {
1186 *buf = NULL;
1187 return 0;
1188 }
1189
1190 radius_cui = sta->radius_cui;
1191 len = os_strlen(radius_cui);
1192 *buf = (u8 *) radius_cui;
1193
1194 return len;
1195}
1196
1197
3cb286ca
MB		 1198static void hostapd_wpa_auth_set_session_timeout(void *ctx, const u8 *sta_addr,
1199 int session_timeout)
1200{
1201 struct hostapd_data *hapd = ctx;
1202 struct sta_info *sta;
1203
1204 sta = ap_get_sta(hapd, sta_addr);
1205 if (!sta)
1206 return;
1207
1208 if (session_timeout) {
1209 os_get_reltime(&sta->session_timeout);
1210 sta->session_timeout.sec += session_timeout;
1211 sta->session_timeout_set = 1;
1212 ap_sta_session_timeout(hapd, sta, session_timeout);
1213 } else {
1214 sta->session_timeout_set = 0;
1215 ap_sta_no_session_timeout(hapd, sta);
1216 }
1217}
1218
1219
1220static int hostapd_wpa_auth_get_session_timeout(void *ctx, const u8 *sta_addr)
1221{
1222 struct hostapd_data *hapd = ctx;
1223 struct sta_info *sta;
1224 struct os_reltime now, remaining;
1225
1226 sta = ap_get_sta(hapd, sta_addr);
1227 if (!sta || !sta->session_timeout_set)
1228 return 0;
1229
1230 os_get_reltime(&now);
1231 if (os_reltime_before(&sta->session_timeout, &now)) {
1232 /* already expired, return >0 as timeout was set */
1233 return 1;
1234 }
1235
1236 os_reltime_sub(&sta->session_timeout, &now, &remaining);
1237
1238 return (remaining.sec > 0) ? remaining.sec : 1;
1239}
1240
1241
c442055e
JM		 1242static void hostapd_rrb_receive(void *ctx, const u8 *src_addr, const u8 *buf,
1243 size_t len)
1244{
1245 struct hostapd_data *hapd = ctx;
7e031850
JM		 1246 struct l2_ethhdr *ethhdr;
1247 if (len < sizeof(*ethhdr))
1248 return;
1249 ethhdr = (struct l2_ethhdr *) buf;
1250 wpa_printf(MSG_DEBUG, "FT: RRB received packet " MACSTR " -> "
1251 MACSTR, MAC2STR(ethhdr->h_source), MAC2STR(ethhdr->h_dest));
170c545a
MB		 1252 if (!is_multicast_ether_addr(ethhdr->h_dest) &&
1253 os_memcmp(hapd->own_addr, ethhdr->h_dest, ETH_ALEN) != 0)
1254 return;
7e031850
JM		 1255 wpa_ft_rrb_rx(hapd->wpa_auth, ethhdr->h_source, buf + sizeof(*ethhdr),
1256 len - sizeof(*ethhdr));
c442055e
JM		 1257}
1258
88b32a99 1259
50bd8e0a
MB		 1260static void hostapd_rrb_oui_receive(void *ctx, const u8 *src_addr,
1261 const u8 *dst_addr, u8 oui_suffix,
1262 const u8 *buf, size_t len)
1263{
1264 struct hostapd_data *hapd = ctx;
1265
1266 wpa_printf(MSG_DEBUG, "FT: RRB received packet " MACSTR " -> "
1267 MACSTR, MAC2STR(src_addr), MAC2STR(dst_addr));
1268 if (!is_multicast_ether_addr(dst_addr) &&
1269 os_memcmp(hapd->own_addr, dst_addr, ETH_ALEN) != 0)
1270 return;
1271 wpa_ft_rrb_oui_rx(hapd->wpa_auth, src_addr, dst_addr, oui_suffix, buf,
1272 len);
1273}
1274
1275
88b32a99
SP		 1276static int hostapd_wpa_auth_add_tspec(void *ctx, const u8 *sta_addr,
1277 u8 *tspec_ie, size_t tspec_ielen)
1278{
1279 struct hostapd_data *hapd = ctx;
1280 return hostapd_add_tspec(hapd, sta_addr, tspec_ie, tspec_ielen);
1281}
1282
50bd8e0a
MB		 1283
1284
1285static int hostapd_wpa_register_ft_oui(struct hostapd_data *hapd,
1286 const char *ft_iface)
1287{
1288 hapd->oui_pull = eth_p_oui_register(hapd, ft_iface,
1289 FT_PACKET_R0KH_R1KH_PULL,
1290 hostapd_rrb_oui_receive, hapd);
1291 if (!hapd->oui_pull)
1292 return -1;
1293
1294 hapd->oui_resp = eth_p_oui_register(hapd, ft_iface,
1295 FT_PACKET_R0KH_R1KH_RESP,
1296 hostapd_rrb_oui_receive, hapd);
1297 if (!hapd->oui_resp)
1298 return -1;
1299
1300 hapd->oui_push = eth_p_oui_register(hapd, ft_iface,
1301 FT_PACKET_R0KH_R1KH_PUSH,
1302 hostapd_rrb_oui_receive, hapd);
1303 if (!hapd->oui_push)
1304 return -1;
1305
eefe8630
MB		 1306 hapd->oui_sreq = eth_p_oui_register(hapd, ft_iface,
1307 FT_PACKET_R0KH_R1KH_SEQ_REQ,
1308 hostapd_rrb_oui_receive, hapd);
1309 if (!hapd->oui_sreq)
1310 return -1;
1311
1312 hapd->oui_sresp = eth_p_oui_register(hapd, ft_iface,
1313 FT_PACKET_R0KH_R1KH_SEQ_RESP,
1314 hostapd_rrb_oui_receive, hapd);
1315 if (!hapd->oui_sresp)
1316 return -1;
1317
50bd8e0a
MB		 1318 return 0;
1319}
1320
1321
1322static void hostapd_wpa_unregister_ft_oui(struct hostapd_data *hapd)
1323{
1324 eth_p_oui_unregister(hapd->oui_pull);
1325 hapd->oui_pull = NULL;
1326 eth_p_oui_unregister(hapd->oui_resp);
1327 hapd->oui_resp = NULL;
1328 eth_p_oui_unregister(hapd->oui_push);
1329 hapd->oui_push = NULL;
eefe8630
MB		 1330 eth_p_oui_unregister(hapd->oui_sreq);
1331 hapd->oui_sreq = NULL;
1332 eth_p_oui_unregister(hapd->oui_sresp);
1333 hapd->oui_sresp = NULL;
50bd8e0a 1334}
4ec1fd8e 1335#endif /* CONFIG_IEEE80211R_AP */
c442055e
JM		 1336
1337
1338int hostapd_setup_wpa(struct hostapd_data *hapd)
1339{
1340 struct wpa_auth_config _conf;
cef8fac0
JB		 1341 static const struct wpa_auth_callbacks cb = {
1342 .logger = hostapd_wpa_auth_logger,
1343 .disconnect = hostapd_wpa_auth_disconnect,
1344 .mic_failure_report = hostapd_wpa_auth_mic_failure_report,
1345 .psk_failure_report = hostapd_wpa_auth_psk_failure_report,
1346 .set_eapol = hostapd_wpa_auth_set_eapol,
1347 .get_eapol = hostapd_wpa_auth_get_eapol,
1348 .get_psk = hostapd_wpa_auth_get_psk,
1349 .get_msk = hostapd_wpa_auth_get_msk,
1350 .set_key = hostapd_wpa_auth_set_key,
1351 .get_seqnum = hostapd_wpa_auth_get_seqnum,
1352 .send_eapol = hostapd_wpa_auth_send_eapol,
1353 .for_each_sta = hostapd_wpa_auth_for_each_sta,
1354 .for_each_auth = hostapd_wpa_auth_for_each_auth,
1355 .send_ether = hostapd_wpa_auth_send_ether,
50bd8e0a 1356 .send_oui = hostapd_wpa_auth_send_oui,
bef4d07a 1357 .channel_info = hostapd_channel_info,
dbfa691d 1358 .update_vlan = hostapd_wpa_auth_update_vlan,
1034f67b
MV		 1359#ifdef CONFIG_OCV
1360 .get_sta_tx_params = hostapd_get_sta_tx_params,
1361#endif /* CONFIG_OCV */
cef8fac0
JB		 1362#ifdef CONFIG_IEEE80211R_AP
1363 .send_ft_action = hostapd_wpa_auth_send_ft_action,
1364 .add_sta = hostapd_wpa_auth_add_sta,
1365 .add_tspec = hostapd_wpa_auth_add_tspec,
47a039b0
MB		 1366 .set_vlan = hostapd_wpa_auth_set_vlan,
1367 .get_vlan = hostapd_wpa_auth_get_vlan,
8c345234
MB		 1368 .set_identity = hostapd_wpa_auth_set_identity,
1369 .get_identity = hostapd_wpa_auth_get_identity,
1370 .set_radius_cui = hostapd_wpa_auth_set_radius_cui,
1371 .get_radius_cui = hostapd_wpa_auth_get_radius_cui,
3cb286ca
MB		 1372 .set_session_timeout = hostapd_wpa_auth_set_session_timeout,
1373 .get_session_timeout = hostapd_wpa_auth_get_session_timeout,
cef8fac0
JB		 1374#endif /* CONFIG_IEEE80211R_AP */
1375 };
c442055e
JM		 1376 const u8 *wpa_ie;
1377 size_t wpa_ie_len;
1378
7af092a0 1379 hostapd_wpa_auth_conf(hapd->conf, hapd->iconf, &_conf);
e4bf4db9
JM		 1380 if (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_EAPOL_TX_STATUS)
1381 _conf.tx_status = 1;
88b32a99
SP		 1382 if (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_AP_MLME)
1383 _conf.ap_mlme = 1;
1a7963e3
AW		 1384
1385 if (!(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_WIRED) &&
1386 (hapd->conf->wpa_deny_ptk0_rekey == PTK0_REKEY_ALLOW_NEVER ||
1387 (hapd->conf->wpa_deny_ptk0_rekey == PTK0_REKEY_ALLOW_LOCAL_OK &&
1388 !(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_SAFE_PTK0_REKEYS)))) {
1389 wpa_msg(hapd->msg_ctx, MSG_INFO,
1390 "Disable PTK0 rekey support - replaced with disconnect");
1391 _conf.wpa_deny_ptk0_rekey = 1;
1392 }
1393
cef8fac0 1394 hapd->wpa_auth = wpa_init(hapd->own_addr, &_conf, &cb, hapd);
c442055e
JM		 1395 if (hapd->wpa_auth == NULL) {
1396 wpa_printf(MSG_ERROR, "WPA initialization failed.");
1397 return -1;
1398 }
1399
1400 if (hostapd_set_privacy(hapd, 1)) {
1401 wpa_printf(MSG_ERROR, "Could not set PrivacyInvoked "
1402 "for interface %s", hapd->conf->iface);
1403 return -1;
1404 }
1405
1406 wpa_ie = wpa_auth_get_wpa_ie(hapd->wpa_auth, &wpa_ie_len);
1407 if (hostapd_set_generic_elem(hapd, wpa_ie, wpa_ie_len)) {
1408 wpa_printf(MSG_ERROR, "Failed to configure WPA IE for "
1409 "the kernel driver.");
1410 return -1;
1411 }
1412
1413 if (rsn_preauth_iface_init(hapd)) {
1414 wpa_printf(MSG_ERROR, "Initialization of RSN "
1415 "pre-authentication failed.");
1416 return -1;
1417 }
1418
4ec1fd8e 1419#ifdef CONFIG_IEEE80211R_AP
b92d2a57 1420 if (!hostapd_drv_none(hapd) &&
66d46406 1421 wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt)) {
50bd8e0a
MB		 1422 const char *ft_iface;
1423
1424 ft_iface = hapd->conf->bridge[0] ? hapd->conf->bridge :
1425 hapd->conf->iface;
1426 hapd->l2 = l2_packet_init(ft_iface, NULL, ETH_P_RRB,
7e031850 1427 hostapd_rrb_receive, hapd, 1);
ccaabeaa 1428 if (!hapd->l2) {
c442055e
JM		 1429 wpa_printf(MSG_ERROR, "Failed to open l2_packet "
1430 "interface");
1431 return -1;
1432 }
50bd8e0a
MB		 1433
1434 if (hostapd_wpa_register_ft_oui(hapd, ft_iface)) {
1435 wpa_printf(MSG_ERROR,
1436 "Failed to open ETH_P_OUI interface");
1437 return -1;
1438 }
c442055e 1439 }
4ec1fd8e 1440#endif /* CONFIG_IEEE80211R_AP */
c442055e
JM		 1441
1442 return 0;
1443
1444}
1445
1446
1447void hostapd_reconfig_wpa(struct hostapd_data *hapd)
1448{
1449 struct wpa_auth_config wpa_auth_conf;
7af092a0 1450 hostapd_wpa_auth_conf(hapd->conf, hapd->iconf, &wpa_auth_conf);
c442055e
JM		 1451 wpa_reconfig(hapd->wpa_auth, &wpa_auth_conf);
1452}
1453
1454
1455void hostapd_deinit_wpa(struct hostapd_data *hapd)
1456{
01a17491 1457 ieee80211_tkip_countermeasures_deinit(hapd);
c442055e
JM		 1458 rsn_preauth_iface_deinit(hapd);
1459 if (hapd->wpa_auth) {
1460 wpa_deinit(hapd->wpa_auth);
1461 hapd->wpa_auth = NULL;
1462
1b822f52 1463 if (hapd->drv_priv && hostapd_set_privacy(hapd, 0)) {
c442055e
JM		 1464 wpa_printf(MSG_DEBUG, "Could not disable "
1465 "PrivacyInvoked for interface %s",
1466 hapd->conf->iface);
1467 }
1468
1b822f52
JM		 1469 if (hapd->drv_priv &&
1470 hostapd_set_generic_elem(hapd, (u8 *) "", 0)) {
c442055e
JM		 1471 wpa_printf(MSG_DEBUG, "Could not remove generic "
1472 "information element from interface %s",
1473 hapd->conf->iface);
1474 }
1475 }
1476 ieee802_1x_deinit(hapd);
1477
4ec1fd8e 1478#ifdef CONFIG_IEEE80211R_AP
c5fee160
MB		 1479 eloop_cancel_timeout(hostapd_wpa_ft_rrb_rx_later, hapd, ELOOP_ALL_CTX);
1480 hostapd_wpa_ft_rrb_rx_later(hapd, NULL); /* flush without delivering */
50bd8e0a
MB		 1481 eloop_cancel_timeout(hostapd_oui_deliver_later, hapd, ELOOP_ALL_CTX);
1482 hostapd_oui_deliver_later(hapd, NULL); /* flush without delivering */
c442055e 1483 l2_packet_deinit(hapd->l2);
66f4dd15 1484 hapd->l2 = NULL;
50bd8e0a 1485 hostapd_wpa_unregister_ft_oui(hapd);
4ec1fd8e 1486#endif /* CONFIG_IEEE80211R_AP */
c442055e 1487}
Unnamed repository; edit this file 'description' to name the repository.