preauth.c
Go to the documentation of this file.
00001 /*
00002  * RSN pre-authentication (supplicant)
00003  * Copyright (c) 2003-2010, Jouni Malinen <j@w1.fi>
00004  *
00005  * This program is free software; you can redistribute it and/or modify
00006  * it under the terms of the GNU General Public License version 2 as
00007  * published by the Free Software Foundation.
00008  *
00009  * Alternatively, this software may be distributed under the terms of BSD
00010  * license.
00011  *
00012  * See README and COPYING for more details.
00013  */
00014 
00015 #include "includes.h"
00016 
00017 #include "common.h"
00018 #include "wpa.h"
00019 #include "eloop.h"
00020 #include "l2_packet/l2_packet.h"
00021 #include "eapol_supp/eapol_supp_sm.h"
00022 #include "preauth.h"
00023 #include "pmksa_cache.h"
00024 #include "wpa_i.h"
00025 #include "common/ieee802_11_defs.h"
00026 
00027 
00028 #if defined(IEEE8021X_EAPOL) && !defined(CONFIG_NO_WPA2)
00029 
00030 #define PMKID_CANDIDATE_PRIO_SCAN 1000
00031 
00032 
00033 struct rsn_pmksa_candidate {
00034         struct dl_list list;
00035         u8 bssid[ETH_ALEN];
00036         int priority;
00037 };
00038 
00039 
00044 void pmksa_candidate_free(struct wpa_sm *sm)
00045 {
00046         struct rsn_pmksa_candidate *entry, *n;
00047 
00048         if (sm == NULL)
00049                 return;
00050 
00051         dl_list_for_each_safe(entry, n, &sm->pmksa_candidates,
00052                               struct rsn_pmksa_candidate, list) {
00053                 dl_list_del(&entry->list);
00054                 os_free(entry);
00055         }
00056 }
00057 
00058 
00059 static void rsn_preauth_receive(void *ctx, const u8 *src_addr,
00060                                 const u8 *buf, size_t len)
00061 {
00062         struct wpa_sm *sm = ctx;
00063 
00064         wpa_printf(MSG_DEBUG, "RX pre-auth from " MACSTR, MAC2STR(src_addr));
00065         wpa_hexdump(MSG_MSGDUMP, "RX pre-auth", buf, len);
00066 
00067         if (sm->preauth_eapol == NULL ||
00068             is_zero_ether_addr(sm->preauth_bssid) ||
00069             os_memcmp(sm->preauth_bssid, src_addr, ETH_ALEN) != 0) {
00070                 wpa_printf(MSG_WARNING, "RSN pre-auth frame received from "
00071                            "unexpected source " MACSTR " - dropped",
00072                            MAC2STR(src_addr));
00073                 return;
00074         }
00075 
00076         eapol_sm_rx_eapol(sm->preauth_eapol, src_addr, buf, len);
00077 }
00078 
00079 
00080 static void rsn_preauth_eapol_cb(struct eapol_sm *eapol, int success,
00081                                  void *ctx)
00082 {
00083         struct wpa_sm *sm = ctx;
00084         u8 pmk[PMK_LEN];
00085 
00086         if (success) {
00087                 int res, pmk_len;
00088                 pmk_len = PMK_LEN;
00089                 res = eapol_sm_get_key(eapol, pmk, PMK_LEN);
00090                 if (res) {
00091                         /*
00092                          * EAP-LEAP is an exception from other EAP methods: it
00093                          * uses only 16-byte PMK.
00094                          */
00095                         res = eapol_sm_get_key(eapol, pmk, 16);
00096                         pmk_len = 16;
00097                 }
00098                 if (res == 0) {
00099                         wpa_hexdump_key(MSG_DEBUG, "RSN: PMK from pre-auth",
00100                                         pmk, pmk_len);
00101                         sm->pmk_len = pmk_len;
00102                         pmksa_cache_add(sm->pmksa, pmk, pmk_len,
00103                                         sm->preauth_bssid, sm->own_addr,
00104                                         sm->network_ctx,
00105                                         WPA_KEY_MGMT_IEEE8021X);
00106                 } else {
00107                         wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
00108                                 "RSN: failed to get master session key from "
00109                                 "pre-auth EAPOL state machines");
00110                         success = 0;
00111                 }
00112         }
00113 
00114         wpa_msg(sm->ctx->msg_ctx, MSG_INFO, "RSN: pre-authentication with "
00115                 MACSTR " %s", MAC2STR(sm->preauth_bssid),
00116                 success ? "completed successfully" : "failed");
00117 
00118         rsn_preauth_deinit(sm);
00119         rsn_preauth_candidate_process(sm);
00120 }
00121 
00122 
00123 static void rsn_preauth_timeout(void *eloop_ctx, void *timeout_ctx)
00124 {
00125         struct wpa_sm *sm = eloop_ctx;
00126 
00127         wpa_msg(sm->ctx->msg_ctx, MSG_INFO, "RSN: pre-authentication with "
00128                 MACSTR " timed out", MAC2STR(sm->preauth_bssid));
00129         rsn_preauth_deinit(sm);
00130         rsn_preauth_candidate_process(sm);
00131 }
00132 
00133 
00134 static int rsn_preauth_eapol_send(void *ctx, int type, const u8 *buf,
00135                                   size_t len)
00136 {
00137         struct wpa_sm *sm = ctx;
00138         u8 *msg;
00139         size_t msglen;
00140         int res;
00141 
00142         /* TODO: could add l2_packet_sendmsg that allows fragments to avoid
00143          * extra copy here */
00144 
00145         if (sm->l2_preauth == NULL)
00146                 return -1;
00147 
00148         msg = wpa_sm_alloc_eapol(sm, type, buf, len, &msglen, NULL);
00149         if (msg == NULL)
00150                 return -1;
00151 
00152         wpa_hexdump(MSG_MSGDUMP, "TX EAPOL (preauth)", msg, msglen);
00153         res = l2_packet_send(sm->l2_preauth, sm->preauth_bssid,
00154                              ETH_P_RSN_PREAUTH, msg, msglen);
00155         os_free(msg);
00156         return res;
00157 }
00158 
00159 
00174 int rsn_preauth_init(struct wpa_sm *sm, const u8 *dst,
00175                      struct eap_peer_config *eap_conf)
00176 {
00177         struct eapol_config eapol_conf;
00178         struct eapol_ctx *ctx;
00179 
00180         if (sm->preauth_eapol)
00181                 return -1;
00182 
00183         wpa_msg(sm->ctx->msg_ctx, MSG_DEBUG,
00184                 "RSN: starting pre-authentication with " MACSTR, MAC2STR(dst));
00185 
00186         sm->l2_preauth = l2_packet_init(sm->ifname, sm->own_addr,
00187                                         ETH_P_RSN_PREAUTH,
00188                                         rsn_preauth_receive, sm, 0);
00189         if (sm->l2_preauth == NULL) {
00190                 wpa_printf(MSG_WARNING, "RSN: Failed to initialize L2 packet "
00191                            "processing for pre-authentication");
00192                 return -2;
00193         }
00194 
00195         if (sm->bridge_ifname) {
00196                 sm->l2_preauth_br = l2_packet_init(sm->bridge_ifname,
00197                                                    sm->own_addr,
00198                                                    ETH_P_RSN_PREAUTH,
00199                                                    rsn_preauth_receive, sm, 0);
00200                 if (sm->l2_preauth_br == NULL) {
00201                         wpa_printf(MSG_WARNING, "RSN: Failed to initialize L2 "
00202                                    "packet processing (bridge) for "
00203                                    "pre-authentication");
00204                         return -2;
00205                 }
00206         }
00207 
00208         ctx = os_zalloc(sizeof(*ctx));
00209         if (ctx == NULL) {
00210                 wpa_printf(MSG_WARNING, "Failed to allocate EAPOL context.");
00211                 return -4;
00212         }
00213         ctx->ctx = sm->ctx->ctx;
00214         ctx->msg_ctx = sm->ctx->ctx;
00215         ctx->preauth = 1;
00216         ctx->cb = rsn_preauth_eapol_cb;
00217         ctx->cb_ctx = sm;
00218         ctx->scard_ctx = sm->scard_ctx;
00219         ctx->eapol_send = rsn_preauth_eapol_send;
00220         ctx->eapol_send_ctx = sm;
00221         ctx->set_config_blob = sm->ctx->set_config_blob;
00222         ctx->get_config_blob = sm->ctx->get_config_blob;
00223 
00224         sm->preauth_eapol = eapol_sm_init(ctx);
00225         if (sm->preauth_eapol == NULL) {
00226                 os_free(ctx);
00227                 wpa_printf(MSG_WARNING, "RSN: Failed to initialize EAPOL "
00228                            "state machines for pre-authentication");
00229                 return -3;
00230         }
00231         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
00232         eapol_conf.accept_802_1x_keys = 0;
00233         eapol_conf.required_keys = 0;
00234         eapol_conf.fast_reauth = sm->fast_reauth;
00235         eapol_conf.workaround = sm->eap_workaround;
00236         eapol_sm_notify_config(sm->preauth_eapol, eap_conf, &eapol_conf);
00237         /*
00238          * Use a shorter startPeriod with preauthentication since the first
00239          * preauth EAPOL-Start frame may end up being dropped due to race
00240          * condition in the AP between the data receive and key configuration
00241          * after the 4-Way Handshake.
00242          */
00243         eapol_sm_configure(sm->preauth_eapol, -1, -1, 5, 6);
00244         os_memcpy(sm->preauth_bssid, dst, ETH_ALEN);
00245 
00246         eapol_sm_notify_portValid(sm->preauth_eapol, TRUE);
00247         /* 802.1X::portControl = Auto */
00248         eapol_sm_notify_portEnabled(sm->preauth_eapol, TRUE);
00249 
00250         eloop_register_timeout(sm->dot11RSNAConfigSATimeout, 0,
00251                                rsn_preauth_timeout, sm, NULL);
00252 
00253         return 0;
00254 }
00255 
00256 
00264 void rsn_preauth_deinit(struct wpa_sm *sm)
00265 {
00266         if (sm == NULL || !sm->preauth_eapol)
00267                 return;
00268 
00269         eloop_cancel_timeout(rsn_preauth_timeout, sm, NULL);
00270         eapol_sm_deinit(sm->preauth_eapol);
00271         sm->preauth_eapol = NULL;
00272         os_memset(sm->preauth_bssid, 0, ETH_ALEN);
00273 
00274         l2_packet_deinit(sm->l2_preauth);
00275         sm->l2_preauth = NULL;
00276         if (sm->l2_preauth_br) {
00277                 l2_packet_deinit(sm->l2_preauth_br);
00278                 sm->l2_preauth_br = NULL;
00279         }
00280 }
00281 
00282 
00291 void rsn_preauth_candidate_process(struct wpa_sm *sm)
00292 {
00293         struct rsn_pmksa_candidate *candidate, *n;
00294 
00295         if (dl_list_empty(&sm->pmksa_candidates))
00296                 return;
00297 
00298         /* TODO: drop priority for old candidate entries */
00299 
00300         wpa_msg(sm->ctx->msg_ctx, MSG_DEBUG, "RSN: processing PMKSA candidate "
00301                 "list");
00302         if (sm->preauth_eapol ||
00303             sm->proto != WPA_PROTO_RSN ||
00304             wpa_sm_get_state(sm) != WPA_COMPLETED ||
00305             (sm->key_mgmt != WPA_KEY_MGMT_IEEE8021X &&
00306              sm->key_mgmt != WPA_KEY_MGMT_IEEE8021X_SHA256)) {
00307                 wpa_msg(sm->ctx->msg_ctx, MSG_DEBUG, "RSN: not in suitable "
00308                         "state for new pre-authentication");
00309                 return; /* invalid state for new pre-auth */
00310         }
00311 
00312         dl_list_for_each_safe(candidate, n, &sm->pmksa_candidates,
00313                               struct rsn_pmksa_candidate, list) {
00314                 struct rsn_pmksa_cache_entry *p = NULL;
00315                 p = pmksa_cache_get(sm->pmksa, candidate->bssid, NULL);
00316                 if (os_memcmp(sm->bssid, candidate->bssid, ETH_ALEN) != 0 &&
00317                     (p == NULL || p->opportunistic)) {
00318                         wpa_msg(sm->ctx->msg_ctx, MSG_DEBUG, "RSN: PMKSA "
00319                                 "candidate " MACSTR
00320                                 " selected for pre-authentication",
00321                                 MAC2STR(candidate->bssid));
00322                         dl_list_del(&candidate->list);
00323                         rsn_preauth_init(sm, candidate->bssid,
00324                                          sm->eap_conf_ctx);
00325                         os_free(candidate);
00326                         return;
00327                 }
00328                 wpa_msg(sm->ctx->msg_ctx, MSG_DEBUG, "RSN: PMKSA candidate "
00329                         MACSTR " does not need pre-authentication anymore",
00330                         MAC2STR(candidate->bssid));
00331                 /* Some drivers (e.g., NDIS) expect to get notified about the
00332                  * PMKIDs again, so report the existing data now. */
00333                 if (p) {
00334                         wpa_sm_add_pmkid(sm, candidate->bssid, p->pmkid);
00335                 }
00336 
00337                 dl_list_del(&candidate->list);
00338                 os_free(candidate);
00339         }
00340         wpa_msg(sm->ctx->msg_ctx, MSG_DEBUG, "RSN: no more pending PMKSA "
00341                 "candidates");
00342 }
00343 
00344 
00356 void pmksa_candidate_add(struct wpa_sm *sm, const u8 *bssid,
00357                          int prio, int preauth)
00358 {
00359         struct rsn_pmksa_candidate *cand, *pos;
00360 
00361         if (sm->network_ctx && sm->proactive_key_caching)
00362                 pmksa_cache_get_opportunistic(sm->pmksa, sm->network_ctx,
00363                                               bssid);
00364 
00365         if (!preauth) {
00366                 wpa_printf(MSG_DEBUG, "RSN: Ignored PMKID candidate without "
00367                            "preauth flag");
00368                 return;
00369         }
00370 
00371         /* If BSSID already on candidate list, update the priority of the old
00372          * entry. Do not override priority based on normal scan results. */
00373         cand = NULL;
00374         dl_list_for_each(pos, &sm->pmksa_candidates,
00375                          struct rsn_pmksa_candidate, list) {
00376                 if (os_memcmp(pos->bssid, bssid, ETH_ALEN) == 0) {
00377                         cand = pos;
00378                         break;
00379                 }
00380         }
00381 
00382         if (cand) {
00383                 dl_list_del(&cand->list);
00384                 if (prio < PMKID_CANDIDATE_PRIO_SCAN)
00385                         cand->priority = prio;
00386         } else {
00387                 cand = os_zalloc(sizeof(*cand));
00388                 if (cand == NULL)
00389                         return;
00390                 os_memcpy(cand->bssid, bssid, ETH_ALEN);
00391                 cand->priority = prio;
00392         }
00393 
00394         /* Add candidate to the list; order by increasing priority value. i.e.,
00395          * highest priority (smallest value) first. */
00396         dl_list_for_each(pos, &sm->pmksa_candidates,
00397                          struct rsn_pmksa_candidate, list) {
00398                 if (cand->priority <= pos->priority) {
00399                         dl_list_add(pos->list.prev, &cand->list);
00400                         cand = NULL;
00401                         break;
00402                 }
00403         }
00404         if (cand)
00405                 dl_list_add_tail(&sm->pmksa_candidates, &cand->list);
00406 
00407         wpa_msg(sm->ctx->msg_ctx, MSG_DEBUG, "RSN: added PMKSA cache "
00408                 "candidate " MACSTR " prio %d", MAC2STR(bssid), prio);
00409         rsn_preauth_candidate_process(sm);
00410 }
00411 
00412 
00413 /* TODO: schedule periodic scans if current AP supports preauth */
00414 
00424 int rsn_preauth_scan_results(struct wpa_sm *sm)
00425 {
00426         if (sm->ssid_len == 0)
00427                 return -1;
00428 
00429         /*
00430          * TODO: is it ok to free all candidates? What about the entries
00431          * received from EVENT_PMKID_CANDIDATE?
00432          */
00433         pmksa_candidate_free(sm);
00434 
00435         return 0;
00436 }
00437 
00438 
00446 void rsn_preauth_scan_result(struct wpa_sm *sm, const u8 *bssid,
00447                              const u8 *ssid, const u8 *rsn)
00448 {
00449         struct wpa_ie_data ie;
00450         struct rsn_pmksa_cache_entry *pmksa;
00451 
00452         if (ssid[1] != sm->ssid_len ||
00453             os_memcmp(ssid + 2, sm->ssid, sm->ssid_len) != 0)
00454                 return; /* Not for the current SSID */
00455 
00456         if (os_memcmp(bssid, sm->bssid, ETH_ALEN) == 0)
00457                 return; /* Ignore current AP */
00458 
00459         if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie))
00460                 return;
00461 
00462         pmksa = pmksa_cache_get(sm->pmksa, bssid, NULL);
00463         if (pmksa && (!pmksa->opportunistic ||
00464                       !(ie.capabilities & WPA_CAPABILITY_PREAUTH)))
00465                 return;
00466 
00467         /* Give less priority to candidates found from normal scan results. */
00468         pmksa_candidate_add(sm, bssid, PMKID_CANDIDATE_PRIO_SCAN,
00469                             ie.capabilities & WPA_CAPABILITY_PREAUTH);
00470 }
00471 
00472 
00473 #ifdef CONFIG_CTRL_IFACE
00474 
00486 int rsn_preauth_get_status(struct wpa_sm *sm, char *buf, size_t buflen,
00487                            int verbose)
00488 {
00489         char *pos = buf, *end = buf + buflen;
00490         int res, ret;
00491 
00492         if (sm->preauth_eapol) {
00493                 ret = os_snprintf(pos, end - pos, "Pre-authentication "
00494                                   "EAPOL state machines:\n");
00495                 if (ret < 0 || ret >= end - pos)
00496                         return pos - buf;
00497                 pos += ret;
00498                 res = eapol_sm_get_status(sm->preauth_eapol,
00499                                           pos, end - pos, verbose);
00500                 if (res >= 0)
00501                         pos += res;
00502         }
00503 
00504         return pos - buf;
00505 }
00506 #endif /* CONFIG_CTRL_IFACE */
00507 
00508 
00513 int rsn_preauth_in_progress(struct wpa_sm *sm)
00514 {
00515         return sm->preauth_eapol != NULL;
00516 }
00517 
00518 #endif /* IEEE8021X_EAPOL and !CONFIG_NO_WPA2 */


wpa_supplicant_node
Author(s): Package maintained by Blaise Gassend
autogenerated on Thu Jan 2 2014 11:25:14