?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Add a note that ndp(8) uses these sources.
[dragonfly.git] / contrib / hostapd-0.4.9 / ieee802_1x.c
blobb5792e3ef0c0dc6dd1826b366df699765091a4d3
1 /*
2 * Host AP (software wireless LAN access point) user space daemon for
3 * Host AP kernel driver / IEEE 802.1X Authenticator
4 * Copyright (c) 2002-2006, Jouni Malinen <jkmaline@cc.hut.fi>
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 *
10 * Alternatively, this software may be distributed under the terms of BSD
11 * license.
12 *
13 * See README and COPYING for more details.
14 */
15
16 #include <stdlib.h>
17 #include <stdio.h>
18 #include <unistd.h>
19 #include <netinet/in.h>
20 #include <string.h>
21 #include <sys/ioctl.h>
22 #include <signal.h>
23 #include <assert.h>
24 #include <time.h>
25 #include <sys/time.h>
26 #include <sys/socket.h>
27
28 #include "hostapd.h"
29 #include "ieee802_1x.h"
30 #include "accounting.h"
31 #include "radius.h"
32 #include "radius_client.h"
33 #include "eapol_sm.h"
34 #include "md5.h"
35 #include "rc4.h"
36 #include "eloop.h"
37 #include "sta_info.h"
38 #include "wpa.h"
39 #include "driver.h"
40 #include "eap.h"
41
42
43 static void ieee802_1x_new_auth_session(struct hostapd_data *hapd,
44 struct sta_info *sta);
45
46
47 static void ieee802_1x_send(hostapd *hapd, struct sta_info *sta, u8 type,
48 u8 *data, size_t datalen)
49 {
50 u8 *buf;
51 struct ieee802_1x_hdr *xhdr;
52 size_t len;
53 int encrypt = 0;
54
55 len = sizeof(*xhdr) + datalen;
56 buf = malloc(len);
57 if (buf == NULL) {
58 printf("malloc() failed for ieee802_1x_send(len=%lu)\n",
59 (unsigned long) len);
60 return;
61 }
62
63 memset(buf, 0, len);
64 #if 0
65 /* TODO:
66 * According to IEEE 802.1aa/D4 EAPOL-Key should be sent before any
67 * remaining EAP frames, if possible. This would allow rest of the
68 * frames to be encrypted. This code could be used to request
69 * encryption from the kernel driver. */
70 if (sta->eapol_sm &&
71 sta->eapol_sm->be_auth.state == BE_AUTH_SUCCESS &&
72 sta->eapol_sm->keyTxEnabled)
73 encrypt = 1;
74 #endif
75
76 xhdr = (struct ieee802_1x_hdr *) buf;
77 xhdr->version = hapd->conf->eapol_version;
78 xhdr->type = type;
79 xhdr->length = htons(datalen);
80
81 if (datalen > 0 && data != NULL)
82 memcpy(xhdr + 1, data, datalen);
83
84 if (sta->wpa_sm && sta->wpa_sm->pairwise_set)
85 encrypt = 1;
86 if (sta->flags & WLAN_STA_PREAUTH) {
87 rsn_preauth_send(hapd, sta, buf, len);
88 } else {
89 hostapd_send_eapol(hapd, sta->addr, buf, len, encrypt);
90 }
91
92 free(buf);
93 }
94
95
96 void ieee802_1x_set_sta_authorized(hostapd *hapd, struct sta_info *sta,
97 int authorized)
98 {
99 if (sta->flags & WLAN_STA_PREAUTH)
100 return;
101
102 if (authorized) {
103 sta->flags |= WLAN_STA_AUTHORIZED;
104 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
105 HOSTAPD_LEVEL_DEBUG, "authorizing port");
106 } else {
107 sta->flags &= ~WLAN_STA_AUTHORIZED;
108 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
109 HOSTAPD_LEVEL_DEBUG, "unauthorizing port");
110 }
111
112 hostapd_set_sta_authorized(hapd, sta->addr, authorized);
113 if (authorized)
114 accounting_sta_start(hapd, sta);
115 }
116
117
118 static void ieee802_1x_eap_timeout(void *eloop_ctx, void *timeout_ctx)
119 {
120 struct sta_info *sta = eloop_ctx;
121 struct eapol_state_machine *sm = sta->eapol_sm;
122 if (sm == NULL)
123 return;
124 hostapd_logger(sm->hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
125 HOSTAPD_LEVEL_DEBUG, "EAP timeout");
126 sm->eapTimeout = TRUE;
127 eapol_sm_step(sm);
128 }
129
130
131 void ieee802_1x_request_identity(struct hostapd_data *hapd,
132 struct sta_info *sta)
133 {
134 u8 *buf;
135 struct eap_hdr *eap;
136 int tlen;
137 u8 *pos;
138 struct eapol_state_machine *sm = sta->eapol_sm;
139
140 if (hapd->conf->eap_server) {
141 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
142 "IEEE 802.1X: Integrated EAP server in "
143 "use - do not generate EAP-Request/Identity\n");
144 return;
145 }
146
147 if (sm == NULL || !sm->auth_pae.eapRestart)
148 return;
149
150 ieee802_1x_new_auth_session(hapd, sta);
151
152 tlen = sizeof(*eap) + 1 + hapd->conf->eap_req_id_text_len;
153
154 buf = malloc(tlen);
155 if (buf == NULL) {
156 printf("Could not allocate memory for identity request\n");
157 return;
158 }
159
160 memset(buf, 0, tlen);
161
162 eap = (struct eap_hdr *) buf;
163 eap->code = EAP_CODE_REQUEST;
164 eap->identifier = ++sm->currentId;
165 eap->length = htons(tlen);
166 pos = (u8 *) (eap + 1);
167 *pos++ = EAP_TYPE_IDENTITY;
168 if (hapd->conf->eap_req_id_text) {
169 memcpy(pos, hapd->conf->eap_req_id_text,
170 hapd->conf->eap_req_id_text_len);
171 }
172
173 sm->be_auth.eapReq = TRUE;
174 free(sm->last_eap_radius);
175 sm->last_eap_radius = buf;
176 sm->last_eap_radius_len = tlen;
177
178 eloop_cancel_timeout(ieee802_1x_eap_timeout, sta, NULL);
179 eloop_register_timeout(30, 0, ieee802_1x_eap_timeout, sta, NULL);
180 sm->eapTimeout = FALSE;
181
182 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
183 "IEEE 802.1X: Generated EAP Request-Identity for " MACSTR
184 " (identifier %d, timeout 30)\n", MAC2STR(sta->addr),
185 eap->identifier);
186
187 sm->auth_pae.eapRestart = FALSE;
188 }
189
190
191 void ieee802_1x_tx_canned_eap(struct hostapd_data *hapd, struct sta_info *sta,
192 int success)
193 {
194 struct eap_hdr eap;
195 struct eapol_state_machine *sm = sta->eapol_sm;
196
197 memset(&eap, 0, sizeof(eap));
198
199 eap.code = success ? EAP_CODE_SUCCESS : EAP_CODE_FAILURE;
200 eap.identifier = 1;
201 if (sm && sm->last_eap_radius) {
202 struct eap_hdr *hdr = (struct eap_hdr *) sm->last_eap_radius;
203 eap.identifier = hdr->identifier + 1;
204 }
205 eap.length = htons(sizeof(eap));
206
207 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
208 "IEEE 802.1X: Sending canned EAP packet %s to " MACSTR
209 " (identifier %d)\n", success ? "SUCCESS" : "FAILURE",
210 MAC2STR(sta->addr), eap.identifier);
211 ieee802_1x_send(hapd, sta, IEEE802_1X_TYPE_EAP_PACKET, (u8 *) &eap,
212 sizeof(eap));
213 if (sm)
214 sm->dot1xAuthEapolFramesTx++;
215 }
216
217
218 void ieee802_1x_tx_req(struct hostapd_data *hapd, struct sta_info *sta)
219 {
220 struct eap_hdr *eap;
221 struct eapol_state_machine *sm = sta->eapol_sm;
222 u8 *type;
223 if (sm == NULL)
224 return;
225
226 if (sm->last_eap_radius == NULL) {
227 printf("Error: TxReq called for station " MACSTR ", but there "
228 "is no EAP request from the authentication server\n",
229 MAC2STR(sm->addr));
230 return;
231 }
232
233 eap = (struct eap_hdr *) sm->last_eap_radius;
234 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
235 "IEEE 802.1X: Sending EAP Packet to " MACSTR
236 " (identifier %d)\n", MAC2STR(sm->addr),
237 eap->identifier);
238 sm->currentId = eap->identifier;
239 ieee802_1x_send(hapd, sta, IEEE802_1X_TYPE_EAP_PACKET,
240 sm->last_eap_radius, sm->last_eap_radius_len);
241 sm->dot1xAuthEapolFramesTx++;
242 type = (u8 *) (eap + 1);
243 if (sm->last_eap_radius_len > sizeof(*eap) &&
244 *type == EAP_TYPE_IDENTITY)
245 sm->dot1xAuthEapolReqIdFramesTx++;
246 else
247 sm->dot1xAuthEapolReqFramesTx++;
248 }
249
250
251 void hostapd_get_ntp_timestamp(u8 *buf)
252 {
253 struct timeval now;
254 u32 sec, usec;
255
256 /* 64-bit NTP timestamp (time from 1900-01-01 00:00:00) */
257 gettimeofday(&now, NULL);
258 sec = htonl(now.tv_sec + 2208988800U); /* Epoch to 1900 */
259 /* Estimate 2^32/10^6 = 4295 - 1/32 - 1/512 */
260 usec = now.tv_usec;
261 usec = htonl(4295 * usec - (usec >> 5) - (usec >> 9));
262 memcpy(buf, (u8 *) &sec, 4);
263 memcpy(buf + 4, (u8 *) &usec, 4);
264 }
265
266
267 static void ieee802_1x_tx_key_one(hostapd *hapd, struct sta_info *sta,
268 int index, int broadcast,
269 u8 *key_data, size_t key_len)
270 {
271 u8 *buf, *ekey;
272 struct ieee802_1x_hdr *hdr;
273 struct ieee802_1x_eapol_key *key;
274 size_t len, ekey_len;
275 struct eapol_state_machine *sm = sta->eapol_sm;
276
277 if (sm == NULL)
278 return;
279
280 len = sizeof(*key) + key_len;
281 buf = malloc(sizeof(*hdr) + len);
282 if (buf == NULL)
283 return;
284
285 memset(buf, 0, sizeof(*hdr) + len);
286 hdr = (struct ieee802_1x_hdr *) buf;
287 key = (struct ieee802_1x_eapol_key *) (hdr + 1);
288 key->type = EAPOL_KEY_TYPE_RC4;
289 key->key_length = htons(key_len);
290 hostapd_get_ntp_timestamp(key->replay_counter);
291
292 if (hostapd_get_rand(key->key_iv, sizeof(key->key_iv))) {
293 printf("Could not get random numbers\n");
294 free(buf);
295 return;
296 }
297
298 key->key_index = index | (broadcast ? 0 : BIT(7));
299 if (hapd->conf->eapol_key_index_workaround) {
300 /* According to some information, WinXP Supplicant seems to
301 * interpret bit7 as an indication whether the key is to be
302 * activated, so make it possible to enable workaround that
303 * sets this bit for all keys. */
304 key->key_index |= BIT(7);
305 }
306
307 /* Key is encrypted using "Key-IV + sm->eapol_key_crypt" as the
308 * RC4-key */
309 memcpy((u8 *) (key + 1), key_data, key_len);
310 ekey_len = sizeof(key->key_iv) + sm->eapol_key_crypt_len;
311 ekey = malloc(ekey_len);
312 if (ekey == NULL) {
313 printf("Could not encrypt key\n");
314 free(buf);
315 return;
316 }
317 memcpy(ekey, key->key_iv, sizeof(key->key_iv));
318 memcpy(ekey + sizeof(key->key_iv), sm->eapol_key_crypt,
319 sm->eapol_key_crypt_len);
320 rc4((u8 *) (key + 1), key_len, ekey, ekey_len);
321 free(ekey);
322
323 /* This header is needed here for HMAC-MD5, but it will be regenerated
324 * in ieee802_1x_send() */
325 hdr->version = hapd->conf->eapol_version;
326 hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
327 hdr->length = htons(len);
328 hmac_md5(sm->eapol_key_sign, sm->eapol_key_sign_len,
329 buf, sizeof(*hdr) + len,
330 key->key_signature);
331
332 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
333 "IEEE 802.1X: Sending EAPOL-Key to " MACSTR
334 " (%s index=%d)\n", MAC2STR(sm->addr),
335 broadcast ? "broadcast" : "unicast", index);
336 ieee802_1x_send(hapd, sta, IEEE802_1X_TYPE_EAPOL_KEY, (u8 *) key, len);
337 if (sta->eapol_sm)
338 sta->eapol_sm->dot1xAuthEapolFramesTx++;
339 free(buf);
340 }
341
342
343 void ieee802_1x_tx_key(struct hostapd_data *hapd, struct sta_info *sta)
344 {
345 struct eapol_state_machine *sm = sta->eapol_sm;
346
347 if (sm == NULL || !sm->eapol_key_sign || !sm->eapol_key_crypt)
348 return;
349
350 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
351 "IEEE 802.1X: Sending EAPOL-Key(s) to " MACSTR "\n",
352 MAC2STR(sta->addr));
353
354 if (hapd->default_wep_key)
355 ieee802_1x_tx_key_one(hapd, sta, hapd->default_wep_key_idx, 1,
356 hapd->default_wep_key,
357 hapd->conf->default_wep_key_len);
358
359 if (hapd->conf->individual_wep_key_len > 0) {
360 u8 *ikey;
361 ikey = malloc(hapd->conf->individual_wep_key_len);
362 if (ikey == NULL ||
363 hostapd_get_rand(ikey,
364 hapd->conf->individual_wep_key_len)) {
365 printf("Could not generate random individual WEP "
366 "key.\n");
367 free(ikey);
368 return;
369 }
370
371 if (HOSTAPD_DEBUG_COND(HOSTAPD_DEBUG_MINIMAL))
372 hostapd_hexdump("Individual WEP key",
373 ikey,
374 hapd->conf->individual_wep_key_len);
375
376 ieee802_1x_tx_key_one(hapd, sta, 0, 0, ikey,
377 hapd->conf->individual_wep_key_len);
378
379 /* TODO: set encryption in TX callback, i.e., only after STA
380 * has ACKed EAPOL-Key frame */
381 if (hostapd_set_encryption(hapd, "WEP", sta->addr, 0, ikey,
382 hapd->conf->
383 individual_wep_key_len)) {
384 printf("Could not set individual WEP encryption.\n");
385 }
386
387 free(ikey);
388 }
389 }
390
391
392 static void ieee802_1x_encapsulate_radius(hostapd *hapd, struct sta_info *sta,
393 u8 *eap, size_t len)
394 {
395 struct radius_msg *msg;
396 char buf[128];
397 struct eapol_state_machine *sm = sta->eapol_sm;
398
399 if (sm == NULL)
400 return;
401
402 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
403 "Encapsulating EAP message into a RADIUS packet\n");
404
405 sm->radius_identifier = radius_client_get_id(hapd->radius);
406 msg = radius_msg_new(RADIUS_CODE_ACCESS_REQUEST,
407 sm->radius_identifier);
408 if (msg == NULL) {
409 printf("Could not create net RADIUS packet\n");
410 return;
411 }
412
413 radius_msg_make_authenticator(msg, (u8 *) sta, sizeof(*sta));
414
415 if (sm->identity &&
416 !radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME,
417 sm->identity, sm->identity_len)) {
418 printf("Could not add User-Name\n");
419 goto fail;
420 }
421
422 if (hapd->conf->own_ip_addr.af == AF_INET &&
423 !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IP_ADDRESS,
424 (u8 *) &hapd->conf->own_ip_addr.u.v4, 4)) {
425 printf("Could not add NAS-IP-Address\n");
426 goto fail;
427 }
428
429 #ifdef CONFIG_IPV6
430 if (hapd->conf->own_ip_addr.af == AF_INET6 &&
431 !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IPV6_ADDRESS,
432 (u8 *) &hapd->conf->own_ip_addr.u.v6, 16)) {
433 printf("Could not add NAS-IPv6-Address\n");
434 goto fail;
435 }
436 #endif /* CONFIG_IPV6 */
437
438 if (hapd->conf->nas_identifier &&
439 !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IDENTIFIER,
440 (u8 *) hapd->conf->nas_identifier,
441 strlen(hapd->conf->nas_identifier))) {
442 printf("Could not add NAS-Identifier\n");
443 goto fail;
444 }
445
446 if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_NAS_PORT, sta->aid)) {
447 printf("Could not add NAS-Port\n");
448 goto fail;
449 }
450
451 snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT ":%s",
452 MAC2STR(hapd->own_addr), hapd->conf->ssid);
453 if (!radius_msg_add_attr(msg, RADIUS_ATTR_CALLED_STATION_ID,
454 (u8 *) buf, strlen(buf))) {
455 printf("Could not add Called-Station-Id\n");
456 goto fail;
457 }
458
459 snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT,
460 MAC2STR(sta->addr));
461 if (!radius_msg_add_attr(msg, RADIUS_ATTR_CALLING_STATION_ID,
462 (u8 *) buf, strlen(buf))) {
463 printf("Could not add Calling-Station-Id\n");
464 goto fail;
465 }
466
467 /* TODO: should probably check MTU from driver config; 2304 is max for
468 * IEEE 802.11, but use 1400 to avoid problems with too large packets
469 */
470 if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_FRAMED_MTU, 1400)) {
471 printf("Could not add Framed-MTU\n");
472 goto fail;
473 }
474
475 if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_NAS_PORT_TYPE,
476 RADIUS_NAS_PORT_TYPE_IEEE_802_11)) {
477 printf("Could not add NAS-Port-Type\n");
478 goto fail;
479 }
480
481 snprintf(buf, sizeof(buf), "CONNECT 11Mbps 802.11b");
482 if (!radius_msg_add_attr(msg, RADIUS_ATTR_CONNECT_INFO,
483 (u8 *) buf, strlen(buf))) {
484 printf("Could not add Connect-Info\n");
485 goto fail;
486 }
487
488 if (eap && !radius_msg_add_eap(msg, eap, len)) {
489 printf("Could not add EAP-Message\n");
490 goto fail;
491 }
492
493 /* State attribute must be copied if and only if this packet is
494 * Access-Request reply to the previous Access-Challenge */
495 if (sm->last_recv_radius && sm->last_recv_radius->hdr->code ==
496 RADIUS_CODE_ACCESS_CHALLENGE) {
497 int res = radius_msg_copy_attr(msg, sm->last_recv_radius,
498 RADIUS_ATTR_STATE);
499 if (res < 0) {
500 printf("Could not copy State attribute from previous "
501 "Access-Challenge\n");
502 goto fail;
503 }
504 if (res > 0) {
505 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
506 " Copied RADIUS State Attribute\n");
507 }
508 }
509
510 radius_client_send(hapd->radius, msg, RADIUS_AUTH, sta->addr);
511 return;
512
513 fail:
514 radius_msg_free(msg);
515 free(msg);
516 }
517
518
519 static char *eap_type_text(u8 type)
520 {
521 switch (type) {
522 case EAP_TYPE_IDENTITY: return "Identity";
523 case EAP_TYPE_NOTIFICATION: return "Notification";
524 case EAP_TYPE_NAK: return "Nak";
525 case EAP_TYPE_MD5: return "MD5-Challenge";
526 case EAP_TYPE_OTP: return "One-Time Password";
527 case EAP_TYPE_GTC: return "Generic Token Card";
528 case EAP_TYPE_TLS: return "TLS";
529 case EAP_TYPE_TTLS: return "TTLS";
530 case EAP_TYPE_PEAP: return "PEAP";
531 default: return "Unknown";
532 }
533 }
534
535
536 static void handle_eap_response(hostapd *hapd, struct sta_info *sta,
537 struct eap_hdr *eap, u8 *data, size_t len)
538 {
539 u8 type;
540 struct eapol_state_machine *sm = sta->eapol_sm;
541 if (sm == NULL)
542 return;
543
544 if (eap->identifier != sm->currentId) {
545 hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
546 HOSTAPD_LEVEL_DEBUG,
547 "EAP Identifier of the Response-Identity does "
548 "not match (was %d, expected %d) - ignored",
549 eap->identifier, sm->currentId);
550 return;
551 }
552
553 if (len < 1) {
554 printf("handle_eap_response: too short response data\n");
555 return;
556 }
557
558 eloop_cancel_timeout(ieee802_1x_eap_timeout, sta, NULL);
559
560 free(sm->last_eap_supp);
561 sm->last_eap_supp_len = sizeof(*eap) + len;
562 sm->last_eap_supp = (u8 *) malloc(sm->last_eap_supp_len);
563 if (sm->last_eap_supp == NULL) {
564 printf("Could not alloc memory for last EAP Response\n");
565 return;
566 }
567 memcpy(sm->last_eap_supp, eap, sizeof(*eap));
568 memcpy(sm->last_eap_supp + sizeof(*eap), data, len);
569
570 type = data[0];
571 data++;
572 len--;
573
574 hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
575 HOSTAPD_LEVEL_DEBUG, "received EAP packet (code=%d "
576 "id=%d len=%d) from STA: EAP Response-%s (%d)",
577 eap->code, eap->identifier, ntohs(eap->length),
578 eap_type_text(type), type);
579
580 if (type == EAP_TYPE_IDENTITY) {
581 char *buf, *pos;
582 int i;
583 buf = malloc(4 * len + 1);
584 if (buf) {
585 pos = buf;
586 for (i = 0; i < len; i++) {
587 if (data[i] >= 32 && data[i] < 127)
588 *pos++ = data[i];
589 else {
590 snprintf(pos, 5, "{%02x}", data[i]);
591 pos += 4;
592 }
593 }
594 *pos = '\0';
595 hostapd_logger(hapd, sm->addr,
596 HOSTAPD_MODULE_IEEE8021X,
597 HOSTAPD_LEVEL_DEBUG,
598 "STA identity '%s'", buf);
599 free(buf);
600 }
601
602 sm->rx_identity = TRUE;
603 sm->dot1xAuthEapolRespIdFramesRx++;
604
605 /* Save station identity for future RADIUS packets */
606 free(sm->identity);
607 sm->identity = malloc(len + 1);
608 if (sm->identity) {
609 memcpy(sm->identity, data, len);
610 sm->identity[len] = '\0';
611 sm->identity_len = len;
612 }
613 } else
614 sm->dot1xAuthEapolRespFramesRx++;
615
616 sm->eapolEap = TRUE;
617 }
618
619
620 /* Process incoming EAP packet from Supplicant */
621 static void handle_eap(hostapd *hapd, struct sta_info *sta, u8 *buf,
622 size_t len)
623 {
624 struct eap_hdr *eap;
625 u16 eap_len;
626
627 if (len < sizeof(*eap)) {
628 printf(" too short EAP packet\n");
629 return;
630 }
631
632 eap = (struct eap_hdr *) buf;
633
634 eap_len = ntohs(eap->length);
635 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
636 " EAP: code=%d identifier=%d length=%d",
637 eap->code, eap->identifier, eap_len);
638 if (eap_len < sizeof(*eap)) {
639 printf(" Invalid EAP length\n");
640 return;
641 } else if (eap_len > len) {
642 printf(" Too short frame to contain this EAP packet\n");
643 return;
644 } else if (eap_len < len) {
645 printf(" Ignoring %lu extra bytes after EAP packet\n",
646 (unsigned long) len - eap_len);
647 }
648
649 eap_len -= sizeof(*eap);
650
651 switch (eap->code) {
652 case EAP_CODE_REQUEST:
653 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " (request)\n");
654 return;
655 case EAP_CODE_RESPONSE:
656 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " (response)\n");
657 handle_eap_response(hapd, sta, eap, (u8 *) (eap + 1), eap_len);
658 break;
659 case EAP_CODE_SUCCESS:
660 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " (success)\n");
661 return;
662 case EAP_CODE_FAILURE:
663 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " (failure)\n");
664 return;
665 default:
666 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " (unknown code)\n");
667 return;
668 }
669 }
670
671
672 /* Process the EAPOL frames from the Supplicant */
673 void ieee802_1x_receive(struct hostapd_data *hapd, const u8 *sa, const u8 *buf,
674 size_t len)
675 {
676 struct sta_info *sta;
677 struct ieee802_1x_hdr *hdr;
678 struct ieee802_1x_eapol_key *key;
679 u16 datalen;
680
681 if (!hapd->conf->ieee802_1x && !hapd->conf->wpa)
682 return;
683
684 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
685 "IEEE 802.1X: %lu bytes from " MACSTR "\n",
686 (unsigned long) len, MAC2STR(sa));
687 sta = ap_get_sta(hapd, sa);
688 if (!sta) {
689 printf(" no station information available\n");
690 return;
691 }
692
693 if (len < sizeof(*hdr)) {
694 printf(" too short IEEE 802.1X packet\n");
695 return;
696 }
697
698 hdr = (struct ieee802_1x_hdr *) buf;
699 datalen = ntohs(hdr->length);
700 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
701 " IEEE 802.1X: version=%d type=%d length=%d\n",
702 hdr->version, hdr->type, datalen);
703
704 if (len - sizeof(*hdr) < datalen) {
705 printf(" frame too short for this IEEE 802.1X packet\n");
706 if (sta->eapol_sm)
707 sta->eapol_sm->dot1xAuthEapLengthErrorFramesRx++;
708 return;
709 }
710 if (len - sizeof(*hdr) > datalen) {
711 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
712 " ignoring %lu extra octets after IEEE 802.1X "
713 "packet\n",
714 (unsigned long) len - sizeof(*hdr) - datalen);
715 }
716
717 if (sta->eapol_sm) {
718 sta->eapol_sm->dot1xAuthLastEapolFrameVersion = hdr->version;
719 sta->eapol_sm->dot1xAuthEapolFramesRx++;
720 }
721
722 key = (struct ieee802_1x_eapol_key *) (hdr + 1);
723 if (datalen >= sizeof(struct ieee802_1x_eapol_key) &&
724 hdr->type == IEEE802_1X_TYPE_EAPOL_KEY &&
725 (key->type == EAPOL_KEY_TYPE_WPA ||
726 key->type == EAPOL_KEY_TYPE_RSN)) {
727 wpa_receive(hapd, sta, (u8 *) hdr, sizeof(*hdr) + datalen);
728 return;
729 }
730
731 if (!hapd->conf->ieee802_1x || sta->wpa_key_mgmt == WPA_KEY_MGMT_PSK)
732 return;
733
734 if (!sta->eapol_sm) {
735 sta->eapol_sm = eapol_sm_alloc(hapd, sta);
736 if (!sta->eapol_sm)
737 return;
738 }
739
740 /* since we support version 1, we can ignore version field and proceed
741 * as specified in version 1 standard [IEEE Std 802.1X-2001, 7.5.5] */
742 /* TODO: actually, we are not version 1 anymore.. However, Version 2
743 * does not change frame contents, so should be ok to process frames
744 * more or less identically. Some changes might be needed for
745 * verification of fields. */
746
747 switch (hdr->type) {
748 case IEEE802_1X_TYPE_EAP_PACKET:
749 handle_eap(hapd, sta, (u8 *) (hdr + 1), datalen);
750 break;
751
752 case IEEE802_1X_TYPE_EAPOL_START:
753 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
754 HOSTAPD_LEVEL_DEBUG, "received EAPOL-Start "
755 "from STA");
756 if (sta->pmksa) {
757 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA,
758 HOSTAPD_LEVEL_DEBUG, "cached PMKSA "
759 "available - ignore it since "
760 "STA sent EAPOL-Start");
761 sta->pmksa = NULL;
762 }
763 sta->eapol_sm->auth_pae.eapolStart = TRUE;
764 sta->eapol_sm->dot1xAuthEapolStartFramesRx++;
765 wpa_sm_event(hapd, sta, WPA_REAUTH_EAPOL);
766 break;
767
768 case IEEE802_1X_TYPE_EAPOL_LOGOFF:
769 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
770 HOSTAPD_LEVEL_DEBUG, "received EAPOL-Logoff "
771 "from STA");
772 sta->acct_terminate_cause =
773 RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
774 sta->eapol_sm->auth_pae.eapolLogoff = TRUE;
775 sta->eapol_sm->dot1xAuthEapolLogoffFramesRx++;
776 break;
777
778 case IEEE802_1X_TYPE_EAPOL_KEY:
779 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " EAPOL-Key\n");
780 if (!(sta->flags & WLAN_STA_AUTHORIZED)) {
781 printf(" Dropped key data from unauthorized "
782 "Supplicant\n");
783 break;
784 }
785 break;
786
787 case IEEE802_1X_TYPE_EAPOL_ENCAPSULATED_ASF_ALERT:
788 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
789 " EAPOL-Encapsulated-ASF-Alert\n");
790 /* TODO: implement support for this; show data */
791 break;
792
793 default:
794 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
795 " unknown IEEE 802.1X packet type\n");
796 sta->eapol_sm->dot1xAuthInvalidEapolFramesRx++;
797 break;
798 }
799
800 eapol_sm_step(sta->eapol_sm);
801 }
802
803
804 void ieee802_1x_new_station(hostapd *hapd, struct sta_info *sta)
805 {
806 if (!hapd->conf->ieee802_1x || sta->wpa_key_mgmt == WPA_KEY_MGMT_PSK)
807 return;
808
809 if (sta->eapol_sm == NULL) {
810 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
811 HOSTAPD_LEVEL_DEBUG, "start authentication");
812 sta->eapol_sm = eapol_sm_alloc(hapd, sta);
813 if (sta->eapol_sm == NULL) {
814 hostapd_logger(hapd, sta->addr,
815 HOSTAPD_MODULE_IEEE8021X,
816 HOSTAPD_LEVEL_INFO,
817 "failed to allocate state machine");
818 return;
819 }
820 }
821
822 sta->eapol_sm->portEnabled = TRUE;
823
824 if (sta->pmksa) {
825 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
826 HOSTAPD_LEVEL_DEBUG,
827 "PMK from PMKSA cache - skip IEEE 802.1X/EAP");
828 /* Setup EAPOL state machines to already authenticated state
829 * because of existing PMKSA information in the cache. */
830 sta->eapol_sm->keyRun = TRUE;
831 sta->eapol_sm->keyAvailable = TRUE;
832 sta->eapol_sm->auth_pae.state = AUTH_PAE_AUTHENTICATING;
833 sta->eapol_sm->be_auth.state = BE_AUTH_SUCCESS;
834 sta->eapol_sm->authSuccess = TRUE;
835 if (sta->eapol_sm->eap)
836 eap_sm_notify_cached(sta->eapol_sm->eap);
837 } else
838 eapol_sm_step(sta->eapol_sm);
839 }
840
841
842 void ieee802_1x_free_radius_class(struct radius_class_data *class)
843 {
844 int i;
845 if (class == NULL)
846 return;
847 for (i = 0; i < class->count; i++)
848 free(class->attr[i].data);
849 free(class->attr);
850 class->attr = NULL;
851 class->count = 0;
852 }
853
854
855 int ieee802_1x_copy_radius_class(struct radius_class_data *dst,
856 struct radius_class_data *src)
857 {
858 size_t i;
859
860 if (src->attr == NULL)
861 return 0;
862
863 dst->attr = malloc(src->count * sizeof(struct radius_attr_data));
864 if (dst->attr == NULL)
865 return -1;
866
867 memset(dst->attr, 0, src->count * sizeof(struct radius_attr_data));
868 dst->count = 0;
869
870 for (i = 0; i < src->count; i++) {
871 dst->attr[i].data = malloc(src->attr[i].len);
872 if (dst->attr[i].data == NULL)
873 break;
874 dst->count++;
875 memcpy(dst->attr[i].data, src->attr[i].data, src->attr[i].len);
876 dst->attr[i].len = src->attr[i].len;
877 }
878
879 return 0;
880 }
881
882
883 void ieee802_1x_free_station(struct sta_info *sta)
884 {
885 struct eapol_state_machine *sm = sta->eapol_sm;
886
887 eloop_cancel_timeout(ieee802_1x_eap_timeout, sta, NULL);
888
889 if (sm == NULL)
890 return;
891
892 sta->eapol_sm = NULL;
893
894 if (sm->last_recv_radius) {
895 radius_msg_free(sm->last_recv_radius);
896 free(sm->last_recv_radius);
897 }
898
899 free(sm->last_eap_supp);
900 free(sm->last_eap_radius);
901 free(sm->identity);
902 ieee802_1x_free_radius_class(&sm->radius_class);
903 free(sm->eapol_key_sign);
904 free(sm->eapol_key_crypt);
905 eapol_sm_free(sm);
906 }
907
908
909 static void ieee802_1x_decapsulate_radius(hostapd *hapd, struct sta_info *sta)
910 {
911 u8 *eap;
912 size_t len;
913 struct eap_hdr *hdr;
914 int eap_type = -1;
915 char buf[64];
916 struct radius_msg *msg;
917 struct eapol_state_machine *sm = sta->eapol_sm;
918
919 if (sm == NULL || sm->last_recv_radius == NULL) {
920 if (sm)
921 sm->be_auth.eapNoReq = TRUE;
922 return;
923 }
924
925 msg = sm->last_recv_radius;
926
927 eap = radius_msg_get_eap(msg, &len);
928 if (eap == NULL) {
929 /* draft-aboba-radius-rfc2869bis-20.txt, Chap. 2.6.3:
930 * RADIUS server SHOULD NOT send Access-Reject/no EAP-Message
931 * attribute */
932 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
933 HOSTAPD_LEVEL_WARNING, "could not extract "
934 "EAP-Message from RADIUS message");
935 free(sm->last_eap_radius);
936 sm->last_eap_radius = NULL;
937 sm->last_eap_radius_len = 0;
938 sm->be_auth.eapNoReq = TRUE;
939 return;
940 }
941
942 if (len < sizeof(*hdr)) {
943 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
944 HOSTAPD_LEVEL_WARNING, "too short EAP packet "
945 "received from authentication server");
946 free(eap);
947 sm->be_auth.eapNoReq = TRUE;
948 return;
949 }
950
951 if (len > sizeof(*hdr))
952 eap_type = eap[sizeof(*hdr)];
953
954 hdr = (struct eap_hdr *) eap;
955 switch (hdr->code) {
956 case EAP_CODE_REQUEST:
957 snprintf(buf, sizeof(buf), "EAP-Request-%s (%d)",
958 eap_type >= 0 ? eap_type_text(eap_type) : "??",
959 eap_type);
960 break;
961 case EAP_CODE_RESPONSE:
962 snprintf(buf, sizeof(buf), "EAP Response-%s (%d)",
963 eap_type >= 0 ? eap_type_text(eap_type) : "??",
964 eap_type);
965 break;
966 case EAP_CODE_SUCCESS:
967 snprintf(buf, sizeof(buf), "EAP Success");
968 break;
969 case EAP_CODE_FAILURE:
970 snprintf(buf, sizeof(buf), "EAP Failure");
971 break;
972 default:
973 snprintf(buf, sizeof(buf), "unknown EAP code");
974 break;
975 }
976 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
977 HOSTAPD_LEVEL_DEBUG, "decapsulated EAP packet (code=%d "
978 "id=%d len=%d) from RADIUS server: %s",
979 hdr->code, hdr->identifier, ntohs(hdr->length), buf);
980 sm->be_auth.eapReq = TRUE;
981
982 free(sm->last_eap_radius);
983 sm->last_eap_radius = eap;
984 sm->last_eap_radius_len = len;
985 }
986
987
988 static void ieee802_1x_get_keys(hostapd *hapd, struct sta_info *sta,
989 struct radius_msg *msg, struct radius_msg *req,
990 u8 *shared_secret, size_t shared_secret_len)
991 {
992 struct radius_ms_mppe_keys *keys;
993 struct eapol_state_machine *sm = sta->eapol_sm;
994 if (sm == NULL)
995 return;
996
997 keys = radius_msg_get_ms_keys(msg, req, shared_secret,
998 shared_secret_len);
999
1000 if (keys) {
1001 if (HOSTAPD_DEBUG_COND(HOSTAPD_DEBUG_MINIMAL) && keys->send) {
1002 size_t i;
1003 printf("MS-MPPE-Send-Key (len=%lu):",
1004 (unsigned long) keys->send_len);
1005 for (i = 0; i < keys->send_len; i++)
1006 printf(" %02x", keys->send[i]);
1007 printf("\n");
1008 }
1009 if (HOSTAPD_DEBUG_COND(HOSTAPD_DEBUG_MINIMAL) && keys->recv) {
1010 size_t i;
1011 printf("MS-MPPE-Recv-Key (len=%lu):",
1012 (unsigned long) keys->recv_len);
1013 for (i = 0; i < keys->recv_len; i++)
1014 printf(" %02x", keys->recv[i]);
1015 printf("\n");
1016 }
1017
1018 if (keys->send && keys->recv) {
1019 free(sm->eapol_key_sign);
1020 free(sm->eapol_key_crypt);
1021 sm->eapol_key_sign = keys->send;
1022 sm->eapol_key_sign_len = keys->send_len;
1023 sm->eapol_key_crypt = keys->recv;
1024 sm->eapol_key_crypt_len = keys->recv_len;
1025 if (hapd->default_wep_key ||
1026 hapd->conf->individual_wep_key_len > 0 ||
1027 hapd->conf->wpa)
1028 sta->eapol_sm->keyAvailable = TRUE;
1029 } else {
1030 free(keys->send);
1031 free(keys->recv);
1032 }
1033 free(keys);
1034 }
1035 }
1036
1037
1038 static void ieee802_1x_store_radius_class(struct hostapd_data *hapd,
1039 struct sta_info *sta,
1040 struct radius_msg *msg)
1041 {
1042 u8 *class;
1043 size_t class_len;
1044 struct eapol_state_machine *sm = sta->eapol_sm;
1045 int count, i;
1046 struct radius_attr_data *nclass;
1047 size_t nclass_count;
1048
1049 if (!hapd->conf->radius->acct_server || hapd->radius == NULL ||
1050 sm == NULL)
1051 return;
1052
1053 ieee802_1x_free_radius_class(&sm->radius_class);
1054 count = radius_msg_count_attr(msg, RADIUS_ATTR_CLASS, 1);
1055 if (count <= 0)
1056 return;
1057
1058 nclass = malloc(count * sizeof(struct radius_attr_data));
1059 if (nclass == NULL)
1060 return;
1061
1062 nclass_count = 0;
1063 memset(nclass, 0, count * sizeof(struct radius_attr_data));
1064
1065 class = NULL;
1066 for (i = 0; i < count; i++) {
1067 do {
1068 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_CLASS,
1069 &class, &class_len,
1070 class) < 0) {
1071 i = count;
1072 break;
1073 }
1074 } while (class_len < 1);
1075
1076 nclass[nclass_count].data = malloc(class_len);
1077 if (nclass[nclass_count].data == NULL)
1078 break;
1079
1080 memcpy(nclass[nclass_count].data, class, class_len);
1081 nclass[nclass_count].len = class_len;
1082 nclass_count++;
1083 }
1084
1085 sm->radius_class.attr = nclass;
1086 sm->radius_class.count = nclass_count;
1087 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "IEEE 802.1X: Stored %lu RADIUS "
1088 "Class attributes for " MACSTR "\n",
1089 (unsigned long) sm->radius_class.count,
1090 MAC2STR(sta->addr));
1091 }
1092
1093
1094 /* Update sta->identity based on User-Name attribute in Access-Accept */
1095 static void ieee802_1x_update_sta_identity(struct hostapd_data *hapd,
1096 struct sta_info *sta,
1097 struct radius_msg *msg)
1098 {
1099 u8 *buf, *identity;
1100 size_t len;
1101 struct eapol_state_machine *sm = sta->eapol_sm;
1102
1103 if (sm == NULL)
1104 return;
1105
1106 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_USER_NAME, &buf, &len,
1107 NULL) < 0)
1108 return;
1109
1110 identity = malloc(len + 1);
1111 if (identity == NULL)
1112 return;
1113
1114 memcpy(identity, buf, len);
1115 identity[len] = '\0';
1116
1117 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1118 HOSTAPD_LEVEL_DEBUG, "old identity '%s' updated with "
1119 "User-Name from Access-Accept '%s'",
1120 sm->identity ? (char *) sm->identity : "N/A",
1121 (char *) identity);
1122
1123 free(sm->identity);
1124 sm->identity = identity;
1125 sm->identity_len = len;
1126 }
1127
1128
1129 struct sta_id_search {
1130 u8 identifier;
1131 struct eapol_state_machine *sm;
1132 };
1133
1134
1135 static int ieee802_1x_select_radius_identifier(struct hostapd_data *hapd,
1136 struct sta_info *sta,
1137 void *ctx)
1138 {
1139 struct sta_id_search *id_search = ctx;
1140 struct eapol_state_machine *sm = sta->eapol_sm;
1141
1142 if (sm && sm->radius_identifier >= 0 &&
1143 sm->radius_identifier == id_search->identifier) {
1144 id_search->sm = sm;
1145 return 1;
1146 }
1147 return 0;
1148 }
1149
1150
1151 static struct eapol_state_machine *
1152 ieee802_1x_search_radius_identifier(struct hostapd_data *hapd, u8 identifier)
1153 {
1154 struct sta_id_search id_search;
1155 id_search.identifier = identifier;
1156 id_search.sm = NULL;
1157 ap_for_each_sta(hapd, ieee802_1x_select_radius_identifier, &id_search);
1158 return id_search.sm;
1159 }
1160
1161
1162 /* Process the RADIUS frames from Authentication Server */
1163 static RadiusRxResult
1164 ieee802_1x_receive_auth(struct radius_msg *msg, struct radius_msg *req,
1165 u8 *shared_secret, size_t shared_secret_len,
1166 void *data)
1167 {
1168 struct hostapd_data *hapd = data;
1169 struct sta_info *sta;
1170 u32 session_timeout = 0, termination_action, acct_interim_interval;
1171 int session_timeout_set;
1172 int eap_timeout;
1173 struct eapol_state_machine *sm;
1174 int override_eapReq = 0;
1175
1176 sm = ieee802_1x_search_radius_identifier(hapd, msg->hdr->identifier);
1177 if (sm == NULL) {
1178 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "IEEE 802.1X: Could not "
1179 "find matching station for this RADIUS "
1180 "message\n");
1181 return RADIUS_RX_UNKNOWN;
1182 }
1183 sta = sm->sta;
1184
1185 /* RFC 2869, Ch. 5.13: valid Message-Authenticator attribute MUST be
1186 * present when packet contains an EAP-Message attribute */
1187 if (msg->hdr->code == RADIUS_CODE_ACCESS_REJECT &&
1188 radius_msg_get_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR, NULL,
1189 0) < 0 &&
1190 radius_msg_get_attr(msg, RADIUS_ATTR_EAP_MESSAGE, NULL, 0) < 0) {
1191 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "Allowing RADIUS "
1192 "Access-Reject without Message-Authenticator "
1193 "since it does not include EAP-Message\n");
1194 } else if (radius_msg_verify(msg, shared_secret, shared_secret_len,
1195 req, 1)) {
1196 printf("Incoming RADIUS packet did not have correct "
1197 "Message-Authenticator - dropped\n");
1198 return RADIUS_RX_INVALID_AUTHENTICATOR;
1199 }
1200
1201 if (msg->hdr->code != RADIUS_CODE_ACCESS_ACCEPT &&
1202 msg->hdr->code != RADIUS_CODE_ACCESS_REJECT &&
1203 msg->hdr->code != RADIUS_CODE_ACCESS_CHALLENGE) {
1204 printf("Unknown RADIUS message code\n");
1205 return RADIUS_RX_UNKNOWN;
1206 }
1207
1208 sm->radius_identifier = -1;
1209 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
1210 "RADIUS packet matching with station " MACSTR "\n",
1211 MAC2STR(sta->addr));
1212
1213 if (sm->last_recv_radius) {
1214 radius_msg_free(sm->last_recv_radius);
1215 free(sm->last_recv_radius);
1216 }
1217
1218 sm->last_recv_radius = msg;
1219
1220 session_timeout_set =
1221 !radius_msg_get_attr_int32(msg, RADIUS_ATTR_SESSION_TIMEOUT,
1222 &session_timeout);
1223 if (radius_msg_get_attr_int32(msg, RADIUS_ATTR_TERMINATION_ACTION,
1224 &termination_action))
1225 termination_action = RADIUS_TERMINATION_ACTION_DEFAULT;
1226
1227 if (hapd->conf->radius->acct_interim_interval == 0 &&
1228 msg->hdr->code == RADIUS_CODE_ACCESS_ACCEPT &&
1229 radius_msg_get_attr_int32(msg, RADIUS_ATTR_ACCT_INTERIM_INTERVAL,
1230 &acct_interim_interval) == 0) {
1231 if (acct_interim_interval < 60) {
1232 hostapd_logger(hapd, sta->addr,
1233 HOSTAPD_MODULE_IEEE8021X,
1234 HOSTAPD_LEVEL_INFO,
1235 "ignored too small "
1236 "Acct-Interim-Interval %d",
1237 acct_interim_interval);
1238 } else
1239 sta->acct_interim_interval = acct_interim_interval;
1240 }
1241
1242
1243 switch (msg->hdr->code) {
1244 case RADIUS_CODE_ACCESS_ACCEPT:
1245 /* RFC 3580, Ch. 3.17 */
1246 if (session_timeout_set && termination_action ==
1247 RADIUS_TERMINATION_ACTION_RADIUS_REQUEST) {
1248 sm->reauth_timer.reAuthPeriod = session_timeout;
1249 } else if (session_timeout_set)
1250 ap_sta_session_timeout(hapd, sta, session_timeout);
1251
1252 sm->eapSuccess = TRUE;
1253 override_eapReq = 1;
1254 ieee802_1x_get_keys(hapd, sta, msg, req, shared_secret,
1255 shared_secret_len);
1256 ieee802_1x_store_radius_class(hapd, sta, msg);
1257 ieee802_1x_update_sta_identity(hapd, sta, msg);
1258 if (sm->keyAvailable) {
1259 pmksa_cache_add(hapd, sta, sm->eapol_key_crypt,
1260 session_timeout_set ?
1261 session_timeout : -1);
1262 }
1263 break;
1264 case RADIUS_CODE_ACCESS_REJECT:
1265 sm->eapFail = TRUE;
1266 override_eapReq = 1;
1267 break;
1268 case RADIUS_CODE_ACCESS_CHALLENGE:
1269 if (session_timeout_set) {
1270 /* RFC 2869, Ch. 2.3.2; RFC 3580, Ch. 3.17 */
1271 eap_timeout = session_timeout;
1272 } else
1273 eap_timeout = 30;
1274 hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
1275 HOSTAPD_LEVEL_DEBUG,
1276 "using EAP timeout of %d seconds%s",
1277 eap_timeout,
1278 session_timeout_set ? " (from RADIUS)" : "");
1279 eloop_cancel_timeout(ieee802_1x_eap_timeout, sta, NULL);
1280 eloop_register_timeout(eap_timeout, 0, ieee802_1x_eap_timeout,
1281 sta, NULL);
1282 sm->eapTimeout = FALSE;
1283 break;
1284 }
1285
1286 ieee802_1x_decapsulate_radius(hapd, sta);
1287 if (override_eapReq)
1288 sm->be_auth.eapReq = FALSE;
1289
1290 eapol_sm_step(sm);
1291
1292 return RADIUS_RX_QUEUED;
1293 }
1294
1295
1296 /* Handler for EAPOL Backend Authentication state machine sendRespToServer.
1297 * Forward the EAP Response from Supplicant to Authentication Server. */
1298 void ieee802_1x_send_resp_to_server(hostapd *hapd, struct sta_info *sta)
1299 {
1300 struct eapol_state_machine *sm = sta->eapol_sm;
1301 if (sm == NULL)
1302 return;
1303
1304 if (hapd->conf->eap_server) {
1305 eap_set_eapRespData(sm->eap, sm->last_eap_supp,
1306 sm->last_eap_supp_len);
1307 } else {
1308 ieee802_1x_encapsulate_radius(hapd, sta, sm->last_eap_supp,
1309 sm->last_eap_supp_len);
1310 }
1311 }
1312
1313
1314 void ieee802_1x_abort_auth(struct hostapd_data *hapd, struct sta_info *sta)
1315 {
1316 struct eapol_state_machine *sm = sta->eapol_sm;
1317 if (sm == NULL)
1318 return;
1319
1320 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1321 HOSTAPD_LEVEL_DEBUG, "aborting authentication");
1322
1323 if (sm->last_recv_radius) {
1324 radius_msg_free(sm->last_recv_radius);
1325 free(sm->last_recv_radius);
1326 sm->last_recv_radius = NULL;
1327 }
1328 free(sm->last_eap_supp);
1329 sm->last_eap_supp = NULL;
1330 sm->last_eap_supp_len = 0;
1331 free(sm->last_eap_radius);
1332 sm->last_eap_radius = NULL;
1333 sm->last_eap_radius_len = 0;
1334 }
1335
1336
1337 void ieee802_1x_set_port_enabled(hostapd *hapd, struct sta_info *sta,
1338 int enabled)
1339 {
1340 if (!sta->eapol_sm)
1341 return;
1342
1343 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
1344 "IEEE 802.1X: station " MACSTR " port %s\n",
1345 MAC2STR(sta->addr), enabled ? "enabled" : "disabled");
1346 sta->eapol_sm->portEnabled = enabled ? TRUE : FALSE;
1347 eapol_sm_step(sta->eapol_sm);
1348 }
1349
1350
1351 #ifdef HOSTAPD_DUMP_STATE
1352 void ieee802_1x_dump_state(FILE *f, const char *prefix, struct sta_info *sta)
1353 {
1354 struct eapol_state_machine *sm = sta->eapol_sm;
1355 if (sm == NULL)
1356 return;
1357
1358 fprintf(f, "%sIEEE 802.1X:\n", prefix);
1359
1360 if (sm->identity) {
1361 size_t i;
1362 fprintf(f, "%sidentity=", prefix);
1363 for (i = 0; i < sm->identity_len; i++)
1364 fprint_char(f, sm->identity[i]);
1365 fprintf(f, "\n");
1366 }
1367
1368 fprintf(f, "%scached_packets=%s%s%s\n", prefix,
1369 sm->last_recv_radius ? "[RX RADIUS]" : "",
1370 sm->last_eap_radius ? "[EAP RADIUS]" : "",
1371 sm->last_eap_supp ? "[EAP SUPPLICANT]" : "");
1372
1373 eapol_sm_dump_state(f, prefix, sm);
1374 }
1375 #endif /* HOSTAPD_DUMP_STATE */
1376
1377
1378 static int ieee802_1x_rekey_broadcast(hostapd *hapd)
1379 {
1380 if (hapd->conf->default_wep_key_len < 1)
1381 return 0;
1382
1383 free(hapd->default_wep_key);
1384 hapd->default_wep_key = malloc(hapd->conf->default_wep_key_len);
1385 if (hapd->default_wep_key == NULL ||
1386 hostapd_get_rand(hapd->default_wep_key,
1387 hapd->conf->default_wep_key_len)) {
1388 printf("Could not generate random WEP key.\n");
1389 free(hapd->default_wep_key);
1390 hapd->default_wep_key = NULL;
1391 return -1;
1392 }
1393
1394 if (HOSTAPD_DEBUG_COND(HOSTAPD_DEBUG_MINIMAL)) {
1395 hostapd_hexdump("IEEE 802.1X: New default WEP key",
1396 hapd->default_wep_key,
1397 hapd->conf->default_wep_key_len);
1398 }
1399
1400 return 0;
1401 }
1402
1403
1404 static int ieee802_1x_sta_key_available(struct hostapd_data *hapd,
1405 struct sta_info *sta, void *ctx)
1406 {
1407 if (sta->eapol_sm) {
1408 sta->eapol_sm->keyAvailable = TRUE;
1409 eapol_sm_step(sta->eapol_sm);
1410 }
1411 return 0;
1412 }
1413
1414
1415 static void ieee802_1x_rekey(void *eloop_ctx, void *timeout_ctx)
1416 {
1417 struct hostapd_data *hapd = eloop_ctx;
1418
1419 if (hapd->default_wep_key_idx >= 3)
1420 hapd->default_wep_key_idx =
1421 hapd->conf->individual_wep_key_len > 0 ? 1 : 0;
1422 else
1423 hapd->default_wep_key_idx++;
1424
1425 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "IEEE 802.1X: New default WEP "
1426 "key index %d\n", hapd->default_wep_key_idx);
1427
1428 if (ieee802_1x_rekey_broadcast(hapd)) {
1429 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE8021X,
1430 HOSTAPD_LEVEL_WARNING, "failed to generate a "
1431 "new broadcast key");
1432 free(hapd->default_wep_key);
1433 hapd->default_wep_key = NULL;
1434 return;
1435 }
1436
1437 /* TODO: Could setup key for RX here, but change default TX keyid only
1438 * after new broadcast key has been sent to all stations. */
1439 if (hostapd_set_encryption(hapd, "WEP", NULL,
1440 hapd->default_wep_key_idx,
1441 hapd->default_wep_key,
1442 hapd->conf->default_wep_key_len)) {
1443 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE8021X,
1444 HOSTAPD_LEVEL_WARNING, "failed to configure a "
1445 "new broadcast key");
1446 free(hapd->default_wep_key);
1447 hapd->default_wep_key = NULL;
1448 return;
1449 }
1450
1451 ap_for_each_sta(hapd, ieee802_1x_sta_key_available, NULL);
1452
1453 if (hapd->conf->wep_rekeying_period > 0) {
1454 eloop_register_timeout(hapd->conf->wep_rekeying_period, 0,
1455 ieee802_1x_rekey, hapd, NULL);
1456 }
1457 }
1458
1459
1460 int ieee802_1x_init(hostapd *hapd)
1461 {
1462 int i;
1463
1464 if ((hapd->conf->ieee802_1x || hapd->conf->wpa) &&
1465 hostapd_set_ieee8021x(hapd, 1))
1466 return -1;
1467
1468 if (radius_client_register(hapd->radius, RADIUS_AUTH,
1469 ieee802_1x_receive_auth, hapd))
1470 return -1;
1471
1472 if (hapd->conf->default_wep_key_len) {
1473 for (i = 0; i < 4; i++)
1474 hostapd_set_encryption(hapd, "none", NULL, i, NULL, 0);
1475
1476 ieee802_1x_rekey(hapd, NULL);
1477
1478 if (hapd->default_wep_key == NULL)
1479 return -1;
1480 }
1481
1482 return 0;
1483 }
1484
1485
1486 void ieee802_1x_deinit(hostapd *hapd)
1487 {
1488 if (hapd->driver != NULL &&
1489 (hapd->conf->ieee802_1x || hapd->conf->wpa))
1490 hostapd_set_ieee8021x(hapd, 0);
1491 }
1492
1493
1494 static void ieee802_1x_new_auth_session(struct hostapd_data *hapd,
1495 struct sta_info *sta)
1496 {
1497 struct eapol_state_machine *sm = sta->eapol_sm;
1498 if (sm == NULL)
1499 return;
1500
1501 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
1502 "IEEE 802.1X: station " MACSTR " - new auth session, "
1503 "clearing State\n", MAC2STR(sta->addr));
1504
1505 if (sm->last_recv_radius) {
1506 radius_msg_free(sm->last_recv_radius);
1507 free(sm->last_recv_radius);
1508 sm->last_recv_radius = NULL;
1509 }
1510
1511 sm->eapSuccess = FALSE;
1512 sm->eapFail = FALSE;
1513 }
1514
1515
1516 int ieee802_1x_tx_status(hostapd *hapd, struct sta_info *sta, u8 *buf,
1517 size_t len, int ack)
1518 {
1519 struct ieee80211_hdr *hdr;
1520 struct ieee802_1x_hdr *xhdr;
1521 struct ieee802_1x_eapol_key *key;
1522 u8 *pos;
1523
1524 if (sta == NULL)
1525 return -1;
1526 if (len < sizeof(*hdr) + sizeof(rfc1042_header) + 2 + sizeof(*xhdr))
1527 return 0;
1528
1529 hdr = (struct ieee80211_hdr *) buf;
1530 pos = (u8 *) (hdr + 1);
1531 if (memcmp(pos, rfc1042_header, sizeof(rfc1042_header)) != 0)
1532 return 0;
1533 pos += sizeof(rfc1042_header);
1534 if (((pos[0] << 8) | pos[1]) != ETH_P_PAE)
1535 return 0;
1536 pos += 2;
1537
1538 xhdr = (struct ieee802_1x_hdr *) pos;
1539 pos += sizeof(*xhdr);
1540
1541 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "IEEE 802.1X: " MACSTR
1542 " TX status - version=%d type=%d length=%d - ack=%d\n",
1543 MAC2STR(sta->addr), xhdr->version, xhdr->type,
1544 ntohs(xhdr->length), ack);
1545
1546 /* EAPOL EAP-Packet packets are eventually re-sent by either Supplicant
1547 * or Authenticator state machines, but EAPOL-Key packets are not
1548 * retransmitted in case of failure. Try to re-sent failed EAPOL-Key
1549 * packets couple of times because otherwise STA keys become
1550 * unsynchronized with AP. */
1551 if (xhdr->type == IEEE802_1X_TYPE_EAPOL_KEY && !ack &&
1552 pos + sizeof(*key) <= buf + len) {
1553 key = (struct ieee802_1x_eapol_key *) pos;
1554 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1555 HOSTAPD_LEVEL_DEBUG, "did not Ack EAPOL-Key "
1556 "frame (%scast index=%d)",
1557 key->key_index & BIT(7) ? "uni" : "broad",
1558 key->key_index & ~BIT(7));
1559 /* TODO: re-send EAPOL-Key couple of times (with short delay
1560 * between them?). If all attempt fail, report error and
1561 * deauthenticate STA so that it will get new keys when
1562 * authenticating again (e.g., after returning in range).
1563 * Separate limit/transmit state needed both for unicast and
1564 * broadcast keys(?) */
1565 }
1566 /* TODO: could move unicast key configuration from ieee802_1x_tx_key()
1567 * to here and change the key only if the EAPOL-Key packet was Acked.
1568 */
1569
1570 return 1;
1571 }
1572
1573
1574 u8 * ieee802_1x_get_identity(struct eapol_state_machine *sm, size_t *len)
1575 {
1576 if (sm == NULL || sm->identity == NULL)
1577 return NULL;
1578
1579 *len = sm->identity_len;
1580 return sm->identity;
1581 }
1582
1583
1584 u8 * ieee802_1x_get_radius_class(struct eapol_state_machine *sm, size_t *len,
1585 int idx)
1586 {
1587 if (sm == NULL || sm->radius_class.attr == NULL ||
1588 idx >= sm->radius_class.count)
1589 return NULL;
1590
1591 *len = sm->radius_class.attr[idx].len;
1592 return sm->radius_class.attr[idx].data;
1593 }
1594
1595
1596 u8 * ieee802_1x_get_key_crypt(struct eapol_state_machine *sm, size_t *len)
1597 {
1598 if (sm == NULL)
1599 return NULL;
1600
1601 *len = sm->eapol_key_crypt_len;
1602 return sm->eapol_key_crypt;
1603 }
1604
1605
1606 void ieee802_1x_notify_port_enabled(struct eapol_state_machine *sm,
1607 int enabled)
1608 {
1609 if (sm == NULL)
1610 return;
1611 sm->portEnabled = enabled ? TRUE : FALSE;
1612 eapol_sm_step(sm);
1613 }
1614
1615
1616 void ieee802_1x_notify_port_valid(struct eapol_state_machine *sm,
1617 int valid)
1618 {
1619 if (sm == NULL)
1620 return;
1621 sm->portValid = valid ? TRUE : FALSE;
1622 eapol_sm_step(sm);
1623 }
1624
1625
1626 void ieee802_1x_notify_pre_auth(struct eapol_state_machine *sm, int pre_auth)
1627 {
1628 if (sm == NULL)
1629 return;
1630 if (pre_auth)
1631 sm->flags |= EAPOL_SM_PREAUTH;
1632 else
1633 sm->flags &= ~EAPOL_SM_PREAUTH;
1634 }
1635
1636
1637 static const char * bool_txt(Boolean bool)
1638 {
1639 return bool ? "TRUE" : "FALSE";
1640 }
1641
1642
1643 int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
1644 {
1645 /* TODO */
1646 return 0;
1647 }
1648
1649
1650 int ieee802_1x_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta,
1651 char *buf, size_t buflen)
1652 {
1653 int len = 0;
1654 struct eapol_state_machine *sm = sta->eapol_sm;
1655
1656 if (sm == NULL)
1657 return 0;
1658
1659 len += snprintf(buf + len, buflen - len,
1660 "dot1xPaePortNumber=%d\n"
1661 "dot1xPaePortProtocolVersion=%d\n"
1662 "dot1xPaePortCapabilities=1\n"
1663 "dot1xPaePortInitialize=%d\n"
1664 "dot1xPaePortReauthenticate=FALSE\n",
1665 sta->aid,
1666 EAPOL_VERSION,
1667 sm->initialize);
1668
1669 /* dot1xAuthConfigTable */
1670 len += snprintf(buf + len, buflen - len,
1671 "dot1xAuthPaeState=%d\n"
1672 "dot1xAuthBackendAuthState=%d\n"
1673 "dot1xAuthAdminControlledDirections=%d\n"
1674 "dot1xAuthOperControlledDirections=%d\n"
1675 "dot1xAuthAuthControlledPortStatus=%d\n"
1676 "dot1xAuthAuthControlledPortControl=%d\n"
1677 "dot1xAuthQuietPeriod=%u\n"
1678 "dot1xAuthServerTimeout=%u\n"
1679 "dot1xAuthReAuthPeriod=%u\n"
1680 "dot1xAuthReAuthEnabled=%s\n"
1681 "dot1xAuthKeyTxEnabled=%s\n",
1682 sm->auth_pae.state + 1,
1683 sm->be_auth.state + 1,
1684 sm->ctrl_dir.adminControlledDirections,
1685 sm->ctrl_dir.operControlledDirections,
1686 sm->authPortStatus,
1687 sm->portControl,
1688 sm->auth_pae.quietPeriod,
1689 sm->be_auth.serverTimeout,
1690 sm->reauth_timer.reAuthPeriod,
1691 bool_txt(sm->reauth_timer.reAuthEnabled),
1692 bool_txt(sm->keyTxEnabled));
1693
1694 /* dot1xAuthStatsTable */
1695 len += snprintf(buf + len, buflen - len,
1696 "dot1xAuthEapolFramesRx=%u\n"
1697 "dot1xAuthEapolFramesTx=%u\n"
1698 "dot1xAuthEapolStartFramesRx=%u\n"
1699 "dot1xAuthEapolLogoffFramesRx=%u\n"
1700 "dot1xAuthEapolRespIdFramesRx=%u\n"
1701 "dot1xAuthEapolRespFramesRx=%u\n"
1702 "dot1xAuthEapolReqIdFramesTx=%u\n"
1703 "dot1xAuthEapolReqFramesTx=%u\n"
1704 "dot1xAuthInvalidEapolFramesRx=%u\n"
1705 "dot1xAuthEapLengthErrorFramesRx=%u\n"
1706 "dot1xAuthLastEapolFrameVersion=%u\n"
1707 "dot1xAuthLastEapolFrameSource=" MACSTR "\n",
1708 sm->dot1xAuthEapolFramesRx,
1709 sm->dot1xAuthEapolFramesTx,
1710 sm->dot1xAuthEapolStartFramesRx,
1711 sm->dot1xAuthEapolLogoffFramesRx,
1712 sm->dot1xAuthEapolRespIdFramesRx,
1713 sm->dot1xAuthEapolRespFramesRx,
1714 sm->dot1xAuthEapolReqIdFramesTx,
1715 sm->dot1xAuthEapolReqFramesTx,
1716 sm->dot1xAuthInvalidEapolFramesRx,
1717 sm->dot1xAuthEapLengthErrorFramesRx,
1718 sm->dot1xAuthLastEapolFrameVersion,
1719 MAC2STR(sm->addr));
1720
1721 /* dot1xAuthDiagTable */
1722 len += snprintf(buf + len, buflen - len,
1723 "dot1xAuthEntersConnecting=%u\n"
1724 "dot1xAuthEapLogoffsWhileConnecting=%u\n"
1725 "dot1xAuthEntersAuthenticating=%u\n"
1726 "dot1xAuthAuthSuccessesWhileAuthenticating=%u\n"
1727 "dot1xAuthAuthTimeoutsWhileAuthenticating=%u\n"
1728 "dot1xAuthAuthFailWhileAuthenticating=%u\n"
1729 "dot1xAuthAuthEapStartsWhileAuthenticating=%u\n"
1730 "dot1xAuthAuthEapLogoffWhileAuthenticating=%u\n"
1731 "dot1xAuthAuthReauthsWhileAuthenticated=%u\n"
1732 "dot1xAuthAuthEapStartsWhileAuthenticated=%u\n"
1733 "dot1xAuthAuthEapLogoffWhileAuthenticated=%u\n"
1734 "dot1xAuthBackendResponses=%u\n"
1735 "dot1xAuthBackendAccessChallenges=%u\n"
1736 "dot1xAuthBackendOtherRequestsToSupplicant=%u\n"
1737 "dot1xAuthBackendAuthSuccesses=%u\n"
1738 "dot1xAuthBackendAuthFails=%u\n",
1739 sm->auth_pae.authEntersConnecting,
1740 sm->auth_pae.authEapLogoffsWhileConnecting,
1741 sm->auth_pae.authEntersAuthenticating,
1742 sm->auth_pae.authAuthSuccessesWhileAuthenticating,
1743 sm->auth_pae.authAuthTimeoutsWhileAuthenticating,
1744 sm->auth_pae.authAuthFailWhileAuthenticating,
1745 sm->auth_pae.authAuthEapStartsWhileAuthenticating,
1746 sm->auth_pae.authAuthEapLogoffWhileAuthenticating,
1747 sm->auth_pae.authAuthReauthsWhileAuthenticated,
1748 sm->auth_pae.authAuthEapStartsWhileAuthenticated,
1749 sm->auth_pae.authAuthEapLogoffWhileAuthenticated,
1750 sm->be_auth.backendResponses,
1751 sm->be_auth.backendAccessChallenges,
1752 sm->be_auth.backendOtherRequestsToSupplicant,
1753 sm->be_auth.backendAuthSuccesses,
1754 sm->be_auth.backendAuthFails);
1755
1756 /* dot1xAuthSessionStatsTable */
1757 len += snprintf(buf + len, buflen - len,
1758 /* TODO: dot1xAuthSessionOctetsRx */
1759 /* TODO: dot1xAuthSessionOctetsTx */
1760 /* TODO: dot1xAuthSessionFramesRx */
1761 /* TODO: dot1xAuthSessionFramesTx */
1762 "dot1xAuthSessionId=%08X-%08X\n"
1763 "dot1xAuthSessionAuthenticMethod=%d\n"
1764 "dot1xAuthSessionTime=%u\n"
1765 "dot1xAuthSessionTerminateCause=999\n"
1766 "dot1xAuthSessionUserName=%s\n",
1767 sta->acct_session_id_hi, sta->acct_session_id_lo,
1768 sta->wpa_key_mgmt == WPA_KEY_MGMT_IEEE8021X ? 1 : 2,
1769 (unsigned int) (time(NULL) - sta->acct_session_start),
1770 sm->identity);
1771
1772 return len;
1773 }
1774
1775
1776 void ieee802_1x_finished(struct hostapd_data *hapd, struct sta_info *sta,
1777 int success)
1778 {
1779 u8 *key;
1780 size_t len;
1781 /* TODO: get PMKLifetime from WPA parameters */
1782 static const int dot11RSNAConfigPMKLifetime = 43200;
1783
1784 key = ieee802_1x_get_key_crypt(sta->eapol_sm, &len);
1785 if (success && key) {
1786 pmksa_cache_add(hapd, sta, key, dot11RSNAConfigPMKLifetime);
1787 }
1788 }
DragonFly BSD