wifi: mac80211: Add support for IEEE 802.1X authentication protocol in non-AP STA...

Add support for the IEEE 802.1X authentication protocol in non-AP STA
mode, as specified in "IEEE P802.11bi/D4.0, 12.16.5".

IEEE 802.1X authentication involves multiple Authentication frame
exchanges, with the non-AP STA and AP alternating transaction
sequence numbers. The number of Authentication frame exchanges
depends on the EAP method in use. For IEEE 802.1X authentication,
process only Authentication frames with the expected transaction
sequence number.

For IEEE 802.1X Authentication, Table 9-71 specifies that the
Encapsulation Length field as specified in Clause 9.4.1.82 shall be
present in all IEEE 802.1X Authentication frames. Drop the frame in
the mac80211 if the Encapsulation Length field is missing.

After receiving the final Authentication frame with status code
WLAN_STATUS_8021X_AUTH_SUCCESS from the AP, mac80211 marks the state
as authenticated, as it indicates the EAP handshake has completed
successfully over the Authentication frames as specified in
Clause 12.16.5.

In the PMKSA caching case, only two Authentication frames are
exchanged if the AP identifies a valid PMKSA, then as specified
in Clause 12.16.8.3, the AP shall set the Status Code to
WLAN_STATUS_SUCCESS in the final Authentication frame and must not
include an encapsulated EAPOL PDU. This frame will be the final
Authentication frame from the AP when PMKSA caching is enabled,
and mac80211 marks the state as authenticated.

In case of authentication success or failure, forward the
Authentication frame to userspace(e.g. wpa_supplicant), and let
userspace validate the Authentication frame from the AP as per the
specification.

Signed-off-by: Kavita Kavita <kavita.kavita@oss.qualcomm.com>
Link: https://patch.msgid.link/20260226185553.1516290-5-kavita.kavita@oss.qualcomm.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 1bf806f853727434a15839f458cb950f6521c4b6..3651b2e6c518f3cea8910e92a7bda3e2741f3c10 100644 (file)
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -1508,6 +1508,7 @@ enum ieee80211_statuscode {
        WLAN_STATUS_SAE_PK = 127,
        WLAN_STATUS_DENIED_TID_TO_LINK_MAPPING = 133,
        WLAN_STATUS_PREF_TID_TO_LINK_MAPPING_SUGGESTED = 134,
+       WLAN_STATUS_8021X_AUTH_SUCCESS = 153,
 };
 
 

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 810bea1aacc5e5fd6088ed00f0e919c0b64fc7f2..7957eacc5ab716fc4efaa81bd1813ef06655502b 100644 (file)
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -4920,7 +4920,7 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
                                   struct ieee80211_mgmt *mgmt, size_t len)
 {
        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-       u16 auth_alg, auth_transaction, status_code;
+       u16 auth_alg, auth_transaction, status_code, encap_len;
        struct ieee80211_event event = {
                .type = MLME_EVENT,
                .u.mlme.data = AUTH_EVENT,
@@ -4929,6 +4929,7 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
                .subtype = IEEE80211_STYPE_AUTH,
        };
        bool sae_need_confirm = false;
+       bool auth_fail = false;
 
        lockdep_assert_wiphy(sdata->local->hw.wiphy);
 
@@ -4945,6 +4946,15 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
        auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
        status_code = le16_to_cpu(mgmt->u.auth.status_code);
 
+       /*
+        * IEEE 802.1X Authentication:
+        * Header + Authentication Algorithm Number(2 byte) + Authentication
+        * Transaction Sequence Number(2 byte) + Status Code(2 byte) +
+        * Encapsulation Length(2 byte).
+        */
+       if (auth_alg == WLAN_AUTH_IEEE8021X && len < 24 + 8)
+               return;
+
        info.link_id = ifmgd->auth_data->link_id;
 
        if (auth_alg != ifmgd->auth_data->algorithm ||
@@ -4960,7 +4970,24 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
                goto notify_driver;
        }
 
-       if (status_code != WLAN_STATUS_SUCCESS) {
+       switch (auth_alg) {
+       case WLAN_AUTH_IEEE8021X:
+               if (status_code != WLAN_STATUS_SUCCESS &&
+                   status_code != WLAN_STATUS_8021X_AUTH_SUCCESS)
+                       auth_fail = true;
+
+               if (!auth_fail) {
+                       /* Indicates length of encapsulated EAPOL PDU */
+                       encap_len = get_unaligned_le16(mgmt->u.auth.variable);
+               }
+               break;
+       default:
+               if (status_code != WLAN_STATUS_SUCCESS)
+                       auth_fail = true;
+               break;
+       }
+
+       if (auth_fail) {
                cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
 
                if (auth_alg == WLAN_AUTH_SAE &&
@@ -4997,6 +5024,7 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
        case WLAN_AUTH_FILS_SK_PFS:
        case WLAN_AUTH_FILS_PK:
        case WLAN_AUTH_EPPKE:
+       case WLAN_AUTH_IEEE8021X:
                break;
        case WLAN_AUTH_SHARED_KEY:
                if (ifmgd->auth_data->expected_transaction != 4) {
@@ -5017,8 +5045,37 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
        if (ifmgd->auth_data->algorithm != WLAN_AUTH_SAE ||
            (auth_transaction == 2 &&
             ifmgd->auth_data->expected_transaction == 2)) {
-               if (!ieee80211_mark_sta_auth(sdata))
-                       return; /* ignore frame -- wait for timeout */
+               switch (ifmgd->auth_data->algorithm) {
+               case WLAN_AUTH_IEEE8021X:
+                       /*
+                        * IEEE 802.1X authentication:
+                        * - When the full EAP handshake completes over the
+                        *   Authentication process, the responder sets the
+                        *   Status Code to WLAN_STATUS_8021X_AUTH_SUCCESS as
+                        *   specified in "IEEE P802.11bi/D4.0, 12.16.5".
+                        *
+                        * - In the PMKSA caching case, only two Authentication
+                        *   frames are exchanged if the responder (e.g., AP)
+                        *   identifies a valid PMKSA, then as specified in
+                        *   "IEEE P802.11bi/D4.0, 12.16.8.3", the responder
+                        *   shall set the Status Code to SUCCESS in the final
+                        *   Authentication frame and must not include an
+                        *   encapsulated EAPOL PDU.
+                        *
+                        * Both conditions are treated as successful
+                        * authentication, so mark the state to Authenticated.
+                        */
+                       if (status_code != WLAN_STATUS_8021X_AUTH_SUCCESS &&
+                           !(status_code == WLAN_STATUS_SUCCESS &&
+                             encap_len == 0))
+                               break;
+                       fallthrough;
+               default:
+                       if (!ieee80211_mark_sta_auth(sdata))
+                               return; /* ignore frame -- wait for timeout */
+
+                       break;
+               }
        } else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
                   auth_transaction == 1) {
                sae_need_confirm = true;
@@ -8460,6 +8517,10 @@ static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
        } else if (auth_data->algorithm == WLAN_AUTH_EPPKE) {
                trans = auth_data->trans;
                status = auth_data->status;
+       } else if (auth_data->algorithm == WLAN_AUTH_IEEE8021X) {
+               trans = auth_data->trans;
+               status = auth_data->status;
+               auth_data->expected_transaction = trans + 1;
        }
 
        if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
@@ -9117,7 +9178,8 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                }
 
                if (ifmgd->auth_data &&
-                   ifmgd->auth_data->algorithm == WLAN_AUTH_EPPKE)
+                   (ifmgd->auth_data->algorithm == WLAN_AUTH_EPPKE ||
+                    ifmgd->auth_data->algorithm == WLAN_AUTH_IEEE8021X))
                        new_sta->sta.epp_peer = true;
 
                new_sta->sta.mlo = mlo;
@@ -9377,6 +9439,9 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
        case NL80211_AUTHTYPE_EPPKE:
                auth_alg = WLAN_AUTH_EPPKE;
                break;
+       case NL80211_AUTHTYPE_IEEE8021X:
+               auth_alg = WLAN_AUTH_IEEE8021X;
+               break;
        default:
                return -EOPNOTSUPP;
        }
@@ -9402,7 +9467,8 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
 
        if (req->auth_data_len >= 4) {
                if (req->auth_type == NL80211_AUTHTYPE_SAE ||
-                   req->auth_type == NL80211_AUTHTYPE_EPPKE) {
+                   req->auth_type == NL80211_AUTHTYPE_EPPKE ||
+                   req->auth_type == NL80211_AUTHTYPE_IEEE8021X) {
                        __le16 *pos = (__le16 *) req->auth_data;
 
                        auth_data->trans = le16_to_cpu(pos[0]);