?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Sync with FreeBSD - add OpenBSD 4.2.
[dragonfly.git] / contrib / hostapd-0.5.8 / ieee802_1x.c
bloba7c726409658dfe779963e65c0086bd37848c333
1 /*
2 * hostapd / IEEE 802.1X Authenticator
3 * Copyright (c) 2002-2006, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 */
14
15 #include "includes.h"
16 #include <assert.h>
17
18 #include "hostapd.h"
19 #include "ieee802_1x.h"
20 #include "accounting.h"
21 #include "radius.h"
22 #include "radius_client.h"
23 #include "eapol_sm.h"
24 #include "md5.h"
25 #include "rc4.h"
26 #include "eloop.h"
27 #include "sta_info.h"
28 #include "wpa.h"
29 #include "preauth.h"
30 #include "pmksa_cache.h"
31 #include "driver.h"
32 #include "hw_features.h"
33 #include "eap.h"
34
35
36 static void ieee802_1x_new_auth_session(struct hostapd_data *hapd,
37 struct sta_info *sta);
38
39
40 static void ieee802_1x_send(struct hostapd_data *hapd, struct sta_info *sta,
41 u8 type, u8 *data, size_t datalen)
42 {
43 u8 *buf;
44 struct ieee802_1x_hdr *xhdr;
45 size_t len;
46 int encrypt = 0;
47
48 len = sizeof(*xhdr) + datalen;
49 buf = wpa_zalloc(len);
50 if (buf == NULL) {
51 printf("malloc() failed for ieee802_1x_send(len=%lu)\n",
52 (unsigned long) len);
53 return;
54 }
55
56 #if 0
57 /* TODO:
58 * According to IEEE 802.1aa/D4 EAPOL-Key should be sent before any
59 * remaining EAP frames, if possible. This would allow rest of the
60 * frames to be encrypted. This code could be used to request
61 * encryption from the kernel driver. */
62 if (sta->eapol_sm &&
63 sta->eapol_sm->be_auth.state == BE_AUTH_SUCCESS &&
64 sta->eapol_sm->keyTxEnabled)
65 encrypt = 1;
66 #endif
67
68 xhdr = (struct ieee802_1x_hdr *) buf;
69 xhdr->version = hapd->conf->eapol_version;
70 xhdr->type = type;
71 xhdr->length = htons(datalen);
72
73 if (datalen > 0 && data != NULL)
74 memcpy(xhdr + 1, data, datalen);
75
76 if (wpa_auth_pairwise_set(sta->wpa_sm))
77 encrypt = 1;
78 if (sta->flags & WLAN_STA_PREAUTH) {
79 rsn_preauth_send(hapd, sta, buf, len);
80 } else {
81 hostapd_send_eapol(hapd, sta->addr, buf, len, encrypt);
82 }
83
84 free(buf);
85 }
86
87
88 void ieee802_1x_set_sta_authorized(struct hostapd_data *hapd,
89 struct sta_info *sta, int authorized)
90 {
91 int res;
92
93 if (sta->flags & WLAN_STA_PREAUTH)
94 return;
95
96 if (authorized) {
97 sta->flags |= WLAN_STA_AUTHORIZED;
98 res = hostapd_sta_set_flags(hapd, sta->addr,
99 WLAN_STA_AUTHORIZED, ~0);
100 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
101 HOSTAPD_LEVEL_DEBUG, "authorizing port");
102 } else {
103 sta->flags &= ~WLAN_STA_AUTHORIZED;
104 res = hostapd_sta_set_flags(hapd, sta->addr,
105 0, ~WLAN_STA_AUTHORIZED);
106 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
107 HOSTAPD_LEVEL_DEBUG, "unauthorizing port");
108 }
109
110 if (res && errno != ENOENT) {
111 printf("Could not set station " MACSTR " flags for kernel "
112 "driver (errno=%d).\n", MAC2STR(sta->addr), errno);
113 }
114
115 if (authorized)
116 accounting_sta_start(hapd, sta);
117 }
118
119
120 static void ieee802_1x_eap_timeout(void *eloop_ctx, void *timeout_ctx)
121 {
122 struct sta_info *sta = eloop_ctx;
123 struct eapol_state_machine *sm = sta->eapol_sm;
124 if (sm == NULL)
125 return;
126 hostapd_logger(sm->hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
127 HOSTAPD_LEVEL_DEBUG, "EAP timeout");
128 sm->eapTimeout = TRUE;
129 eapol_sm_step(sm);
130 }
131
132
133 void ieee802_1x_request_identity(struct hostapd_data *hapd,
134 struct sta_info *sta)
135 {
136 u8 *buf;
137 struct eap_hdr *eap;
138 int tlen;
139 u8 *pos;
140 struct eapol_state_machine *sm = sta->eapol_sm;
141
142 if (hapd->conf->eap_server) {
143 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
144 "IEEE 802.1X: Integrated EAP server in "
145 "use - do not generate EAP-Request/Identity\n");
146 return;
147 }
148
149 if (sm == NULL || !sm->eapRestart)
150 return;
151
152 ieee802_1x_new_auth_session(hapd, sta);
153
154 tlen = sizeof(*eap) + 1 + hapd->conf->eap_req_id_text_len;
155
156 buf = wpa_zalloc(tlen);
157 if (buf == NULL) {
158 printf("Could not allocate memory for identity request\n");
159 return;
160 }
161
162 eap = (struct eap_hdr *) buf;
163 eap->code = EAP_CODE_REQUEST;
164 eap->identifier = ++sm->currentId;
165 eap->length = htons(tlen);
166 pos = (u8 *) (eap + 1);
167 *pos++ = EAP_TYPE_IDENTITY;
168 if (hapd->conf->eap_req_id_text) {
169 memcpy(pos, hapd->conf->eap_req_id_text,
170 hapd->conf->eap_req_id_text_len);
171 }
172
173 sm->eapReq = TRUE;
174 free(sm->last_eap_radius);
175 sm->last_eap_radius = buf;
176 sm->last_eap_radius_len = tlen;
177
178 eloop_cancel_timeout(ieee802_1x_eap_timeout, sta, NULL);
179 eloop_register_timeout(30, 0, ieee802_1x_eap_timeout, sta, NULL);
180 sm->eapTimeout = FALSE;
181
182 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
183 "IEEE 802.1X: Generated EAP Request-Identity for " MACSTR
184 " (identifier %d, timeout 30)\n", MAC2STR(sta->addr),
185 eap->identifier);
186
187 sm->eapRestart = FALSE;
188 }
189
190
191 void ieee802_1x_tx_canned_eap(struct hostapd_data *hapd, struct sta_info *sta,
192 int success)
193 {
194 struct eap_hdr eap;
195 struct eapol_state_machine *sm = sta->eapol_sm;
196
197 memset(&eap, 0, sizeof(eap));
198
199 eap.code = success ? EAP_CODE_SUCCESS : EAP_CODE_FAILURE;
200 eap.identifier = 1;
201 if (sm && sm->last_eap_radius) {
202 struct eap_hdr *hdr = (struct eap_hdr *) sm->last_eap_radius;
203 eap.identifier = hdr->identifier + 1;
204 }
205 eap.length = htons(sizeof(eap));
206
207 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
208 "IEEE 802.1X: Sending canned EAP packet %s to " MACSTR
209 " (identifier %d)\n", success ? "SUCCESS" : "FAILURE",
210 MAC2STR(sta->addr), eap.identifier);
211 ieee802_1x_send(hapd, sta, IEEE802_1X_TYPE_EAP_PACKET, (u8 *) &eap,
212 sizeof(eap));
213 if (sm)
214 sm->dot1xAuthEapolFramesTx++;
215 }
216
217
218 void ieee802_1x_tx_req(struct hostapd_data *hapd, struct sta_info *sta)
219 {
220 struct eap_hdr *eap;
221 struct eapol_state_machine *sm = sta->eapol_sm;
222 u8 *type;
223 if (sm == NULL)
224 return;
225
226 if (sm->last_eap_radius == NULL) {
227 printf("Error: TxReq called for station " MACSTR ", but there "
228 "is no EAP request from the authentication server\n",
229 MAC2STR(sm->addr));
230 return;
231 }
232
233 eap = (struct eap_hdr *) sm->last_eap_radius;
234 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
235 "IEEE 802.1X: Sending EAP Packet to " MACSTR
236 " (identifier %d)\n", MAC2STR(sm->addr),
237 eap->identifier);
238 sm->currentId = eap->identifier;
239 ieee802_1x_send(hapd, sta, IEEE802_1X_TYPE_EAP_PACKET,
240 sm->last_eap_radius, sm->last_eap_radius_len);
241 sm->dot1xAuthEapolFramesTx++;
242 type = (u8 *) (eap + 1);
243 if (sm->last_eap_radius_len > sizeof(*eap) &&
244 *type == EAP_TYPE_IDENTITY)
245 sm->dot1xAuthEapolReqIdFramesTx++;
246 else
247 sm->dot1xAuthEapolReqFramesTx++;
248 }
249
250
251 static void ieee802_1x_tx_key_one(struct hostapd_data *hapd,
252 struct sta_info *sta,
253 int idx, int broadcast,
254 u8 *key_data, size_t key_len)
255 {
256 u8 *buf, *ekey;
257 struct ieee802_1x_hdr *hdr;
258 struct ieee802_1x_eapol_key *key;
259 size_t len, ekey_len;
260 struct eapol_state_machine *sm = sta->eapol_sm;
261
262 if (sm == NULL)
263 return;
264
265 len = sizeof(*key) + key_len;
266 buf = wpa_zalloc(sizeof(*hdr) + len);
267 if (buf == NULL)
268 return;
269
270 hdr = (struct ieee802_1x_hdr *) buf;
271 key = (struct ieee802_1x_eapol_key *) (hdr + 1);
272 key->type = EAPOL_KEY_TYPE_RC4;
273 key->key_length = htons(key_len);
274 wpa_get_ntp_timestamp(key->replay_counter);
275
276 if (hostapd_get_rand(key->key_iv, sizeof(key->key_iv))) {
277 printf("Could not get random numbers\n");
278 free(buf);
279 return;
280 }
281
282 key->key_index = idx | (broadcast ? 0 : BIT(7));
283 if (hapd->conf->eapol_key_index_workaround) {
284 /* According to some information, WinXP Supplicant seems to
285 * interpret bit7 as an indication whether the key is to be
286 * activated, so make it possible to enable workaround that
287 * sets this bit for all keys. */
288 key->key_index |= BIT(7);
289 }
290
291 /* Key is encrypted using "Key-IV + sm->eapol_key_crypt" as the
292 * RC4-key */
293 memcpy((u8 *) (key + 1), key_data, key_len);
294 ekey_len = sizeof(key->key_iv) + sm->eapol_key_crypt_len;
295 ekey = malloc(ekey_len);
296 if (ekey == NULL) {
297 printf("Could not encrypt key\n");
298 free(buf);
299 return;
300 }
301 memcpy(ekey, key->key_iv, sizeof(key->key_iv));
302 memcpy(ekey + sizeof(key->key_iv), sm->eapol_key_crypt,
303 sm->eapol_key_crypt_len);
304 rc4((u8 *) (key + 1), key_len, ekey, ekey_len);
305 free(ekey);
306
307 /* This header is needed here for HMAC-MD5, but it will be regenerated
308 * in ieee802_1x_send() */
309 hdr->version = hapd->conf->eapol_version;
310 hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
311 hdr->length = htons(len);
312 hmac_md5(sm->eapol_key_sign, sm->eapol_key_sign_len,
313 buf, sizeof(*hdr) + len,
314 key->key_signature);
315
316 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
317 "IEEE 802.1X: Sending EAPOL-Key to " MACSTR
318 " (%s index=%d)\n", MAC2STR(sm->addr),
319 broadcast ? "broadcast" : "unicast", idx);
320 ieee802_1x_send(hapd, sta, IEEE802_1X_TYPE_EAPOL_KEY, (u8 *) key, len);
321 if (sta->eapol_sm)
322 sta->eapol_sm->dot1xAuthEapolFramesTx++;
323 free(buf);
324 }
325
326
327 static struct hostapd_wep_keys *
328 ieee802_1x_group_alloc(struct hostapd_data *hapd, const char *ifname)
329 {
330 struct hostapd_wep_keys *key;
331
332 key = wpa_zalloc(sizeof(*key));
333 if (key == NULL)
334 return NULL;
335
336 key->default_len = hapd->conf->default_wep_key_len;
337
338 if (key->idx >= hapd->conf->broadcast_key_idx_max ||
339 key->idx < hapd->conf->broadcast_key_idx_min)
340 key->idx = hapd->conf->broadcast_key_idx_min;
341 else
342 key->idx++;
343
344 if (!key->key[key->idx])
345 key->key[key->idx] = malloc(key->default_len);
346 if (key->key[key->idx] == NULL ||
347 hostapd_get_rand(key->key[key->idx], key->default_len)) {
348 printf("Could not generate random WEP key (dynamic VLAN).\n");
349 free(key->key[key->idx]);
350 key->key[key->idx] = NULL;
351 free(key);
352 return NULL;
353 }
354 key->len[key->idx] = key->default_len;
355
356 if (HOSTAPD_DEBUG_COND(HOSTAPD_DEBUG_MINIMAL)) {
357 printf("%s: Default WEP idx %d for dynamic VLAN\n",
358 ifname, key->idx);
359 wpa_hexdump_key(MSG_DEBUG, "Default WEP key (dynamic VLAN)",
360 key->key[key->idx], key->len[key->idx]);
361 }
362
363 if (hostapd_set_encryption(ifname, hapd, "WEP", NULL, key->idx,
364 key->key[key->idx], key->len[key->idx], 1))
365 printf("Could not set dynamic VLAN WEP encryption key.\n");
366
367 hostapd_set_ieee8021x(ifname, hapd, 1);
368
369 return key;
370 }
371
372
373 static struct hostapd_wep_keys *
374 ieee802_1x_get_group(struct hostapd_data *hapd, struct hostapd_ssid *ssid,
375 size_t vlan_id)
376 {
377 const char *ifname;
378
379 if (vlan_id == 0)
380 return &ssid->wep;
381
382 if (vlan_id <= ssid->max_dyn_vlan_keys && ssid->dyn_vlan_keys &&
383 ssid->dyn_vlan_keys[vlan_id])
384 return ssid->dyn_vlan_keys[vlan_id];
385
386 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "IEEE 802.1X: Creating new group "
387 "state machine for VLAN ID %lu\n",
388 (unsigned long) vlan_id);
389
390 ifname = hostapd_get_vlan_id_ifname(hapd->conf->vlan, vlan_id);
391 if (ifname == NULL) {
392 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "IEEE 802.1X: Unknown "
393 "VLAN ID %lu - cannot create group key state "
394 "machine\n", (unsigned long) vlan_id);
395 return NULL;
396 }
397
398 if (ssid->dyn_vlan_keys == NULL) {
399 int size = (vlan_id + 1) * sizeof(ssid->dyn_vlan_keys[0]);
400 ssid->dyn_vlan_keys = wpa_zalloc(size);
401 if (ssid->dyn_vlan_keys == NULL)
402 return NULL;
403 ssid->max_dyn_vlan_keys = vlan_id;
404 }
405
406 if (ssid->max_dyn_vlan_keys < vlan_id) {
407 struct hostapd_wep_keys **na;
408 int size = (vlan_id + 1) * sizeof(ssid->dyn_vlan_keys[0]);
409 na = realloc(ssid->dyn_vlan_keys, size);
410 if (na == NULL)
411 return NULL;
412 ssid->dyn_vlan_keys = na;
413 memset(&ssid->dyn_vlan_keys[ssid->max_dyn_vlan_keys + 1], 0,
414 (vlan_id - ssid->max_dyn_vlan_keys) *
415 sizeof(ssid->dyn_vlan_keys[0]));
416 ssid->max_dyn_vlan_keys = vlan_id;
417 }
418
419 ssid->dyn_vlan_keys[vlan_id] = ieee802_1x_group_alloc(hapd, ifname);
420
421 return ssid->dyn_vlan_keys[vlan_id];
422 }
423
424
425 void ieee802_1x_tx_key(struct hostapd_data *hapd, struct sta_info *sta)
426 {
427 struct hostapd_wep_keys *key = NULL;
428 struct eapol_state_machine *sm = sta->eapol_sm;
429 int vlan_id;
430
431 if (sm == NULL || !sm->eapol_key_sign || !sm->eapol_key_crypt)
432 return;
433
434 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
435 "IEEE 802.1X: Sending EAPOL-Key(s) to " MACSTR "\n",
436 MAC2STR(sta->addr));
437
438 vlan_id = sta->vlan_id;
439 if (vlan_id < 0 || vlan_id > MAX_VLAN_ID)
440 vlan_id = 0;
441
442 if (vlan_id) {
443 key = ieee802_1x_get_group(hapd, sta->ssid, vlan_id);
444 if (key && key->key[key->idx])
445 ieee802_1x_tx_key_one(hapd, sta, key->idx, 1,
446 key->key[key->idx],
447 key->len[key->idx]);
448 } else if (hapd->default_wep_key) {
449 ieee802_1x_tx_key_one(hapd, sta, hapd->default_wep_key_idx, 1,
450 hapd->default_wep_key,
451 hapd->conf->default_wep_key_len);
452 }
453
454 if (hapd->conf->individual_wep_key_len > 0) {
455 u8 *ikey;
456 ikey = malloc(hapd->conf->individual_wep_key_len);
457 if (ikey == NULL ||
458 hostapd_get_rand(ikey,
459 hapd->conf->individual_wep_key_len)) {
460 printf("Could not generate random individual WEP "
461 "key.\n");
462 free(ikey);
463 return;
464 }
465
466 wpa_hexdump_key(MSG_DEBUG, "Individual WEP key",
467 ikey, hapd->conf->individual_wep_key_len);
468
469 ieee802_1x_tx_key_one(hapd, sta, 0, 0, ikey,
470 hapd->conf->individual_wep_key_len);
471
472 /* TODO: set encryption in TX callback, i.e., only after STA
473 * has ACKed EAPOL-Key frame */
474 if (hostapd_set_encryption(hapd->conf->iface, hapd, "WEP",
475 sta->addr, 0, ikey,
476 hapd->conf->individual_wep_key_len,
477 1)) {
478 printf("Could not set individual WEP encryption.\n");
479 }
480
481 free(ikey);
482 }
483 }
484
485
486 const char *radius_mode_txt(struct hostapd_data *hapd)
487 {
488 if (hapd->iface->current_mode == NULL)
489 return "802.11";
490
491 switch (hapd->iface->current_mode->mode) {
492 case HOSTAPD_MODE_IEEE80211A:
493 return "802.11a";
494 case HOSTAPD_MODE_IEEE80211G:
495 return "802.11g";
496 case HOSTAPD_MODE_IEEE80211B:
497 default:
498 return "802.11b";
499 }
500 }
501
502
503 int radius_sta_rate(struct hostapd_data *hapd, struct sta_info *sta)
504 {
505 int i;
506 u8 rate = 0;
507
508 for (i = 0; i < sta->supported_rates_len; i++)
509 if ((sta->supported_rates[i] & 0x7f) > rate)
510 rate = sta->supported_rates[i] & 0x7f;
511
512 return rate;
513 }
514
515
516 static void ieee802_1x_encapsulate_radius(struct hostapd_data *hapd,
517 struct sta_info *sta,
518 u8 *eap, size_t len)
519 {
520 struct radius_msg *msg;
521 char buf[128];
522 struct eapol_state_machine *sm = sta->eapol_sm;
523
524 if (sm == NULL)
525 return;
526
527 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
528 "Encapsulating EAP message into a RADIUS packet\n");
529
530 sm->radius_identifier = radius_client_get_id(hapd->radius);
531 msg = radius_msg_new(RADIUS_CODE_ACCESS_REQUEST,
532 sm->radius_identifier);
533 if (msg == NULL) {
534 printf("Could not create net RADIUS packet\n");
535 return;
536 }
537
538 radius_msg_make_authenticator(msg, (u8 *) sta, sizeof(*sta));
539
540 if (sm->identity &&
541 !radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME,
542 sm->identity, sm->identity_len)) {
543 printf("Could not add User-Name\n");
544 goto fail;
545 }
546
547 if (hapd->conf->own_ip_addr.af == AF_INET &&
548 !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IP_ADDRESS,
549 (u8 *) &hapd->conf->own_ip_addr.u.v4, 4)) {
550 printf("Could not add NAS-IP-Address\n");
551 goto fail;
552 }
553
554 #ifdef CONFIG_IPV6
555 if (hapd->conf->own_ip_addr.af == AF_INET6 &&
556 !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IPV6_ADDRESS,
557 (u8 *) &hapd->conf->own_ip_addr.u.v6, 16)) {
558 printf("Could not add NAS-IPv6-Address\n");
559 goto fail;
560 }
561 #endif /* CONFIG_IPV6 */
562
563 if (hapd->conf->nas_identifier &&
564 !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IDENTIFIER,
565 (u8 *) hapd->conf->nas_identifier,
566 strlen(hapd->conf->nas_identifier))) {
567 printf("Could not add NAS-Identifier\n");
568 goto fail;
569 }
570
571 if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_NAS_PORT, sta->aid)) {
572 printf("Could not add NAS-Port\n");
573 goto fail;
574 }
575
576 snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT ":%s",
577 MAC2STR(hapd->own_addr), hapd->conf->ssid.ssid);
578 buf[sizeof(buf) - 1] = '\0';
579 if (!radius_msg_add_attr(msg, RADIUS_ATTR_CALLED_STATION_ID,
580 (u8 *) buf, strlen(buf))) {
581 printf("Could not add Called-Station-Id\n");
582 goto fail;
583 }
584
585 snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT,
586 MAC2STR(sta->addr));
587 buf[sizeof(buf) - 1] = '\0';
588 if (!radius_msg_add_attr(msg, RADIUS_ATTR_CALLING_STATION_ID,
589 (u8 *) buf, strlen(buf))) {
590 printf("Could not add Calling-Station-Id\n");
591 goto fail;
592 }
593
594 /* TODO: should probably check MTU from driver config; 2304 is max for
595 * IEEE 802.11, but use 1400 to avoid problems with too large packets
596 */
597 if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_FRAMED_MTU, 1400)) {
598 printf("Could not add Framed-MTU\n");
599 goto fail;
600 }
601
602 if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_NAS_PORT_TYPE,
603 RADIUS_NAS_PORT_TYPE_IEEE_802_11)) {
604 printf("Could not add NAS-Port-Type\n");
605 goto fail;
606 }
607
608 if (sta->flags & WLAN_STA_PREAUTH) {
609 snprintf(buf, sizeof(buf), "IEEE 802.11i Pre-Authentication");
610 } else {
611 snprintf(buf, sizeof(buf), "CONNECT %d%sMbps %s",
612 radius_sta_rate(hapd, sta) / 2,
613 (radius_sta_rate(hapd, sta) & 1) ? ".5" : "",
614 radius_mode_txt(hapd));
615 }
616 buf[sizeof(buf) - 1] = '\0';
617 if (!radius_msg_add_attr(msg, RADIUS_ATTR_CONNECT_INFO,
618 (u8 *) buf, strlen(buf))) {
619 printf("Could not add Connect-Info\n");
620 goto fail;
621 }
622
623 if (eap && !radius_msg_add_eap(msg, eap, len)) {
624 printf("Could not add EAP-Message\n");
625 goto fail;
626 }
627
628 /* State attribute must be copied if and only if this packet is
629 * Access-Request reply to the previous Access-Challenge */
630 if (sm->last_recv_radius && sm->last_recv_radius->hdr->code ==
631 RADIUS_CODE_ACCESS_CHALLENGE) {
632 int res = radius_msg_copy_attr(msg, sm->last_recv_radius,
633 RADIUS_ATTR_STATE);
634 if (res < 0) {
635 printf("Could not copy State attribute from previous "
636 "Access-Challenge\n");
637 goto fail;
638 }
639 if (res > 0) {
640 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
641 " Copied RADIUS State Attribute\n");
642 }
643 }
644
645 radius_client_send(hapd->radius, msg, RADIUS_AUTH, sta->addr);
646 return;
647
648 fail:
649 radius_msg_free(msg);
650 free(msg);
651 }
652
653
654 char *eap_type_text(u8 type)
655 {
656 switch (type) {
657 case EAP_TYPE_IDENTITY: return "Identity";
658 case EAP_TYPE_NOTIFICATION: return "Notification";
659 case EAP_TYPE_NAK: return "Nak";
660 case EAP_TYPE_MD5: return "MD5-Challenge";
661 case EAP_TYPE_OTP: return "One-Time Password";
662 case EAP_TYPE_GTC: return "Generic Token Card";
663 case EAP_TYPE_TLS: return "TLS";
664 case EAP_TYPE_TTLS: return "TTLS";
665 case EAP_TYPE_PEAP: return "PEAP";
666 case EAP_TYPE_SIM: return "SIM";
667 case EAP_TYPE_FAST: return "FAST";
668 case EAP_TYPE_SAKE: return "SAKE";
669 case EAP_TYPE_PSK: return "PSK";
670 default: return "Unknown";
671 }
672 }
673
674
675 static void handle_eap_response(struct hostapd_data *hapd,
676 struct sta_info *sta, struct eap_hdr *eap,
677 u8 *data, size_t len)
678 {
679 u8 type;
680 struct eapol_state_machine *sm = sta->eapol_sm;
681 if (sm == NULL)
682 return;
683
684 if (eap->identifier != sm->currentId) {
685 hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
686 HOSTAPD_LEVEL_DEBUG,
687 "EAP Identifier of the Response-Identity does "
688 "not match (was %d, expected %d) - ignored",
689 eap->identifier, sm->currentId);
690 return;
691 }
692
693 if (len < 1) {
694 printf("handle_eap_response: too short response data\n");
695 return;
696 }
697
698 eloop_cancel_timeout(ieee802_1x_eap_timeout, sta, NULL);
699
700 free(sm->last_eap_supp);
701 sm->last_eap_supp_len = sizeof(*eap) + len;
702 sm->last_eap_supp = (u8 *) malloc(sm->last_eap_supp_len);
703 if (sm->last_eap_supp == NULL) {
704 printf("Could not alloc memory for last EAP Response\n");
705 return;
706 }
707 memcpy(sm->last_eap_supp, eap, sizeof(*eap));
708 memcpy(sm->last_eap_supp + sizeof(*eap), data, len);
709
710 sm->eap_type_supp = type = data[0];
711 data++;
712 len--;
713
714 hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
715 HOSTAPD_LEVEL_DEBUG, "received EAP packet (code=%d "
716 "id=%d len=%d) from STA: EAP Response-%s (%d)",
717 eap->code, eap->identifier, ntohs(eap->length),
718 eap_type_text(type), type);
719
720 if (type == EAP_TYPE_IDENTITY) {
721 char *buf, *pos;
722 size_t i;
723 buf = malloc(4 * len + 1);
724 if (buf) {
725 pos = buf;
726 for (i = 0; i < len; i++) {
727 if (data[i] >= 32 && data[i] < 127)
728 *pos++ = data[i];
729 else {
730 snprintf(pos, 5, "{%02x}", data[i]);
731 pos += 4;
732 }
733 }
734 *pos = '\0';
735 hostapd_logger(hapd, sm->addr,
736 HOSTAPD_MODULE_IEEE8021X,
737 HOSTAPD_LEVEL_DEBUG,
738 "STA identity '%s'", buf);
739 free(buf);
740 }
741
742 sm->rx_identity = TRUE;
743 sm->dot1xAuthEapolRespIdFramesRx++;
744
745 /* Save station identity for future RADIUS packets */
746 free(sm->identity);
747 sm->identity = malloc(len + 1);
748 if (sm->identity) {
749 memcpy(sm->identity, data, len);
750 sm->identity[len] = '\0';
751 sm->identity_len = len;
752 }
753 } else
754 sm->dot1xAuthEapolRespFramesRx++;
755
756 sm->eapolEap = TRUE;
757 }
758
759
760 /* Process incoming EAP packet from Supplicant */
761 static void handle_eap(struct hostapd_data *hapd, struct sta_info *sta,
762 u8 *buf, size_t len)
763 {
764 struct eap_hdr *eap;
765 u16 eap_len;
766
767 if (len < sizeof(*eap)) {
768 printf(" too short EAP packet\n");
769 return;
770 }
771
772 eap = (struct eap_hdr *) buf;
773
774 eap_len = ntohs(eap->length);
775 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
776 " EAP: code=%d identifier=%d length=%d",
777 eap->code, eap->identifier, eap_len);
778 if (eap_len < sizeof(*eap)) {
779 printf(" Invalid EAP length\n");
780 return;
781 } else if (eap_len > len) {
782 printf(" Too short frame to contain this EAP packet\n");
783 return;
784 } else if (eap_len < len) {
785 printf(" Ignoring %lu extra bytes after EAP packet\n",
786 (unsigned long) len - eap_len);
787 }
788
789 eap_len -= sizeof(*eap);
790
791 switch (eap->code) {
792 case EAP_CODE_REQUEST:
793 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " (request)\n");
794 return;
795 case EAP_CODE_RESPONSE:
796 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " (response)\n");
797 handle_eap_response(hapd, sta, eap, (u8 *) (eap + 1), eap_len);
798 break;
799 case EAP_CODE_SUCCESS:
800 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " (success)\n");
801 return;
802 case EAP_CODE_FAILURE:
803 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " (failure)\n");
804 return;
805 default:
806 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " (unknown code)\n");
807 return;
808 }
809 }
810
811
812 /* Process the EAPOL frames from the Supplicant */
813 void ieee802_1x_receive(struct hostapd_data *hapd, const u8 *sa, const u8 *buf,
814 size_t len)
815 {
816 struct sta_info *sta;
817 struct ieee802_1x_hdr *hdr;
818 struct ieee802_1x_eapol_key *key;
819 u16 datalen;
820 struct rsn_pmksa_cache_entry *pmksa;
821
822 if (!hapd->conf->ieee802_1x && !hapd->conf->wpa)
823 return;
824
825 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
826 "IEEE 802.1X: %lu bytes from " MACSTR "\n",
827 (unsigned long) len, MAC2STR(sa));
828 sta = ap_get_sta(hapd, sa);
829 if (!sta) {
830 printf(" no station information available\n");
831 return;
832 }
833
834 if (len < sizeof(*hdr)) {
835 printf(" too short IEEE 802.1X packet\n");
836 return;
837 }
838
839 hdr = (struct ieee802_1x_hdr *) buf;
840 datalen = ntohs(hdr->length);
841 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
842 " IEEE 802.1X: version=%d type=%d length=%d\n",
843 hdr->version, hdr->type, datalen);
844
845 if (len - sizeof(*hdr) < datalen) {
846 printf(" frame too short for this IEEE 802.1X packet\n");
847 if (sta->eapol_sm)
848 sta->eapol_sm->dot1xAuthEapLengthErrorFramesRx++;
849 return;
850 }
851 if (len - sizeof(*hdr) > datalen) {
852 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
853 " ignoring %lu extra octets after IEEE 802.1X "
854 "packet\n",
855 (unsigned long) len - sizeof(*hdr) - datalen);
856 }
857
858 if (sta->eapol_sm) {
859 sta->eapol_sm->dot1xAuthLastEapolFrameVersion = hdr->version;
860 sta->eapol_sm->dot1xAuthEapolFramesRx++;
861 }
862
863 key = (struct ieee802_1x_eapol_key *) (hdr + 1);
864 if (datalen >= sizeof(struct ieee802_1x_eapol_key) &&
865 hdr->type == IEEE802_1X_TYPE_EAPOL_KEY &&
866 (key->type == EAPOL_KEY_TYPE_WPA ||
867 key->type == EAPOL_KEY_TYPE_RSN)) {
868 wpa_receive(hapd->wpa_auth, sta->wpa_sm, (u8 *) hdr,
869 sizeof(*hdr) + datalen);
870 return;
871 }
872
873 if (!hapd->conf->ieee802_1x ||
874 wpa_auth_sta_key_mgmt(sta->wpa_sm) == WPA_KEY_MGMT_PSK)
875 return;
876
877 if (!sta->eapol_sm) {
878 sta->eapol_sm = eapol_sm_alloc(hapd, sta);
879 if (!sta->eapol_sm)
880 return;
881 }
882
883 /* since we support version 1, we can ignore version field and proceed
884 * as specified in version 1 standard [IEEE Std 802.1X-2001, 7.5.5] */
885 /* TODO: actually, we are not version 1 anymore.. However, Version 2
886 * does not change frame contents, so should be ok to process frames
887 * more or less identically. Some changes might be needed for
888 * verification of fields. */
889
890 switch (hdr->type) {
891 case IEEE802_1X_TYPE_EAP_PACKET:
892 handle_eap(hapd, sta, (u8 *) (hdr + 1), datalen);
893 break;
894
895 case IEEE802_1X_TYPE_EAPOL_START:
896 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
897 HOSTAPD_LEVEL_DEBUG, "received EAPOL-Start "
898 "from STA");
899 pmksa = wpa_auth_sta_get_pmksa(sta->wpa_sm);
900 if (pmksa) {
901 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA,
902 HOSTAPD_LEVEL_DEBUG, "cached PMKSA "
903 "available - ignore it since "
904 "STA sent EAPOL-Start");
905 wpa_auth_sta_clear_pmksa(sta->wpa_sm, pmksa);
906 }
907 sta->eapol_sm->eapolStart = TRUE;
908 sta->eapol_sm->dot1xAuthEapolStartFramesRx++;
909 wpa_auth_sm_event(sta->wpa_sm, WPA_REAUTH_EAPOL);
910 break;
911
912 case IEEE802_1X_TYPE_EAPOL_LOGOFF:
913 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
914 HOSTAPD_LEVEL_DEBUG, "received EAPOL-Logoff "
915 "from STA");
916 sta->acct_terminate_cause =
917 RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
918 sta->eapol_sm->eapolLogoff = TRUE;
919 sta->eapol_sm->dot1xAuthEapolLogoffFramesRx++;
920 break;
921
922 case IEEE802_1X_TYPE_EAPOL_KEY:
923 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " EAPOL-Key\n");
924 if (!(sta->flags & WLAN_STA_AUTHORIZED)) {
925 printf(" Dropped key data from unauthorized "
926 "Supplicant\n");
927 break;
928 }
929 break;
930
931 case IEEE802_1X_TYPE_EAPOL_ENCAPSULATED_ASF_ALERT:
932 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
933 " EAPOL-Encapsulated-ASF-Alert\n");
934 /* TODO: implement support for this; show data */
935 break;
936
937 default:
938 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
939 " unknown IEEE 802.1X packet type\n");
940 sta->eapol_sm->dot1xAuthInvalidEapolFramesRx++;
941 break;
942 }
943
944 eapol_sm_step(sta->eapol_sm);
945 }
946
947
948 void ieee802_1x_new_station(struct hostapd_data *hapd, struct sta_info *sta)
949 {
950 struct rsn_pmksa_cache_entry *pmksa;
951 int reassoc = 1;
952
953 if (!hapd->conf->ieee802_1x ||
954 wpa_auth_sta_key_mgmt(sta->wpa_sm) == WPA_KEY_MGMT_PSK)
955 return;
956
957 if (sta->eapol_sm == NULL) {
958 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
959 HOSTAPD_LEVEL_DEBUG, "start authentication");
960 sta->eapol_sm = eapol_sm_alloc(hapd, sta);
961 if (sta->eapol_sm == NULL) {
962 hostapd_logger(hapd, sta->addr,
963 HOSTAPD_MODULE_IEEE8021X,
964 HOSTAPD_LEVEL_INFO,
965 "failed to allocate state machine");
966 return;
967 }
968 reassoc = 0;
969 }
970
971 sta->eapol_sm->portEnabled = TRUE;
972
973 pmksa = wpa_auth_sta_get_pmksa(sta->wpa_sm);
974 if (pmksa) {
975 int old_vlanid;
976
977 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
978 HOSTAPD_LEVEL_DEBUG,
979 "PMK from PMKSA cache - skip IEEE 802.1X/EAP");
980 /* Setup EAPOL state machines to already authenticated state
981 * because of existing PMKSA information in the cache. */
982 sta->eapol_sm->keyRun = TRUE;
983 sta->eapol_sm->keyAvailable = TRUE;
984 sta->eapol_sm->auth_pae_state = AUTH_PAE_AUTHENTICATING;
985 sta->eapol_sm->be_auth_state = BE_AUTH_SUCCESS;
986 sta->eapol_sm->authSuccess = TRUE;
987 if (sta->eapol_sm->eap)
988 eap_sm_notify_cached(sta->eapol_sm->eap);
989 old_vlanid = sta->vlan_id;
990 pmksa_cache_to_eapol_data(pmksa, sta->eapol_sm);
991 if (sta->ssid->dynamic_vlan == DYNAMIC_VLAN_DISABLED)
992 sta->vlan_id = 0;
993 ap_sta_bind_vlan(hapd, sta, old_vlanid);
994 } else {
995 if (reassoc) {
996 /*
997 * Force EAPOL state machines to start
998 * re-authentication without having to wait for the
999 * Supplicant to send EAPOL-Start.
1000 */
1001 sta->eapol_sm->reAuthenticate = TRUE;
1002 }
1003 eapol_sm_step(sta->eapol_sm);
1004 }
1005 }
1006
1007
1008 void ieee802_1x_free_radius_class(struct radius_class_data *class)
1009 {
1010 size_t i;
1011 if (class == NULL)
1012 return;
1013 for (i = 0; i < class->count; i++)
1014 free(class->attr[i].data);
1015 free(class->attr);
1016 class->attr = NULL;
1017 class->count = 0;
1018 }
1019
1020
1021 int ieee802_1x_copy_radius_class(struct radius_class_data *dst,
1022 struct radius_class_data *src)
1023 {
1024 size_t i;
1025
1026 if (src->attr == NULL)
1027 return 0;
1028
1029 dst->attr = wpa_zalloc(src->count * sizeof(struct radius_attr_data));
1030 if (dst->attr == NULL)
1031 return -1;
1032
1033 dst->count = 0;
1034
1035 for (i = 0; i < src->count; i++) {
1036 dst->attr[i].data = malloc(src->attr[i].len);
1037 if (dst->attr[i].data == NULL)
1038 break;
1039 dst->count++;
1040 memcpy(dst->attr[i].data, src->attr[i].data, src->attr[i].len);
1041 dst->attr[i].len = src->attr[i].len;
1042 }
1043
1044 return 0;
1045 }
1046
1047
1048 void ieee802_1x_free_station(struct sta_info *sta)
1049 {
1050 struct eapol_state_machine *sm = sta->eapol_sm;
1051
1052 eloop_cancel_timeout(ieee802_1x_eap_timeout, sta, NULL);
1053
1054 if (sm == NULL)
1055 return;
1056
1057 sta->eapol_sm = NULL;
1058
1059 if (sm->last_recv_radius) {
1060 radius_msg_free(sm->last_recv_radius);
1061 free(sm->last_recv_radius);
1062 }
1063
1064 free(sm->last_eap_supp);
1065 free(sm->last_eap_radius);
1066 free(sm->identity);
1067 ieee802_1x_free_radius_class(&sm->radius_class);
1068 free(sm->eapol_key_sign);
1069 free(sm->eapol_key_crypt);
1070 eapol_sm_free(sm);
1071 }
1072
1073
1074 static void ieee802_1x_decapsulate_radius(struct hostapd_data *hapd,
1075 struct sta_info *sta)
1076 {
1077 u8 *eap;
1078 size_t len;
1079 struct eap_hdr *hdr;
1080 int eap_type = -1;
1081 char buf[64];
1082 struct radius_msg *msg;
1083 struct eapol_state_machine *sm = sta->eapol_sm;
1084
1085 if (sm == NULL || sm->last_recv_radius == NULL) {
1086 if (sm)
1087 sm->eapNoReq = TRUE;
1088 return;
1089 }
1090
1091 msg = sm->last_recv_radius;
1092
1093 eap = radius_msg_get_eap(msg, &len);
1094 if (eap == NULL) {
1095 /* draft-aboba-radius-rfc2869bis-20.txt, Chap. 2.6.3:
1096 * RADIUS server SHOULD NOT send Access-Reject/no EAP-Message
1097 * attribute */
1098 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1099 HOSTAPD_LEVEL_WARNING, "could not extract "
1100 "EAP-Message from RADIUS message");
1101 free(sm->last_eap_radius);
1102 sm->last_eap_radius = NULL;
1103 sm->last_eap_radius_len = 0;
1104 sm->eapNoReq = TRUE;
1105 return;
1106 }
1107
1108 if (len < sizeof(*hdr)) {
1109 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1110 HOSTAPD_LEVEL_WARNING, "too short EAP packet "
1111 "received from authentication server");
1112 free(eap);
1113 sm->eapNoReq = TRUE;
1114 return;
1115 }
1116
1117 if (len > sizeof(*hdr))
1118 eap_type = eap[sizeof(*hdr)];
1119
1120 hdr = (struct eap_hdr *) eap;
1121 switch (hdr->code) {
1122 case EAP_CODE_REQUEST:
1123 if (eap_type >= 0)
1124 sm->eap_type_authsrv = eap_type;
1125 snprintf(buf, sizeof(buf), "EAP-Request-%s (%d)",
1126 eap_type >= 0 ? eap_type_text(eap_type) : "??",
1127 eap_type);
1128 break;
1129 case EAP_CODE_RESPONSE:
1130 snprintf(buf, sizeof(buf), "EAP Response-%s (%d)",
1131 eap_type >= 0 ? eap_type_text(eap_type) : "??",
1132 eap_type);
1133 break;
1134 case EAP_CODE_SUCCESS:
1135 snprintf(buf, sizeof(buf), "EAP Success");
1136 break;
1137 case EAP_CODE_FAILURE:
1138 snprintf(buf, sizeof(buf), "EAP Failure");
1139 break;
1140 default:
1141 snprintf(buf, sizeof(buf), "unknown EAP code");
1142 break;
1143 }
1144 buf[sizeof(buf) - 1] = '\0';
1145 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1146 HOSTAPD_LEVEL_DEBUG, "decapsulated EAP packet (code=%d "
1147 "id=%d len=%d) from RADIUS server: %s",
1148 hdr->code, hdr->identifier, ntohs(hdr->length), buf);
1149 sm->eapReq = TRUE;
1150
1151 free(sm->last_eap_radius);
1152 sm->last_eap_radius = eap;
1153 sm->last_eap_radius_len = len;
1154 }
1155
1156
1157 static void ieee802_1x_get_keys(struct hostapd_data *hapd,
1158 struct sta_info *sta, struct radius_msg *msg,
1159 struct radius_msg *req,
1160 u8 *shared_secret, size_t shared_secret_len)
1161 {
1162 struct radius_ms_mppe_keys *keys;
1163 struct eapol_state_machine *sm = sta->eapol_sm;
1164 if (sm == NULL)
1165 return;
1166
1167 keys = radius_msg_get_ms_keys(msg, req, shared_secret,
1168 shared_secret_len);
1169
1170 if (keys) {
1171 if (keys->send) {
1172 wpa_hexdump_key(MSG_DEBUG, "MS-MPPE-Send-Key",
1173 keys->send, keys->send_len);
1174 }
1175 if (keys->recv) {
1176 wpa_hexdump_key(MSG_DEBUG, "MS-MPPE-Recv-Key",
1177 keys->recv, keys->recv_len);
1178 }
1179
1180 if (keys->send && keys->recv) {
1181 free(sm->eapol_key_sign);
1182 free(sm->eapol_key_crypt);
1183 sm->eapol_key_sign = keys->send;
1184 sm->eapol_key_sign_len = keys->send_len;
1185 sm->eapol_key_crypt = keys->recv;
1186 sm->eapol_key_crypt_len = keys->recv_len;
1187 if (hapd->default_wep_key ||
1188 hapd->conf->individual_wep_key_len > 0 ||
1189 hapd->conf->wpa)
1190 sta->eapol_sm->keyAvailable = TRUE;
1191 } else {
1192 free(keys->send);
1193 free(keys->recv);
1194 }
1195 free(keys);
1196 }
1197 }
1198
1199
1200 static void ieee802_1x_store_radius_class(struct hostapd_data *hapd,
1201 struct sta_info *sta,
1202 struct radius_msg *msg)
1203 {
1204 u8 *class;
1205 size_t class_len;
1206 struct eapol_state_machine *sm = sta->eapol_sm;
1207 int count, i;
1208 struct radius_attr_data *nclass;
1209 size_t nclass_count;
1210
1211 if (!hapd->conf->radius->acct_server || hapd->radius == NULL ||
1212 sm == NULL)
1213 return;
1214
1215 ieee802_1x_free_radius_class(&sm->radius_class);
1216 count = radius_msg_count_attr(msg, RADIUS_ATTR_CLASS, 1);
1217 if (count <= 0)
1218 return;
1219
1220 nclass = wpa_zalloc(count * sizeof(struct radius_attr_data));
1221 if (nclass == NULL)
1222 return;
1223
1224 nclass_count = 0;
1225
1226 class = NULL;
1227 for (i = 0; i < count; i++) {
1228 do {
1229 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_CLASS,
1230 &class, &class_len,
1231 class) < 0) {
1232 i = count;
1233 break;
1234 }
1235 } while (class_len < 1);
1236
1237 nclass[nclass_count].data = malloc(class_len);
1238 if (nclass[nclass_count].data == NULL)
1239 break;
1240
1241 memcpy(nclass[nclass_count].data, class, class_len);
1242 nclass[nclass_count].len = class_len;
1243 nclass_count++;
1244 }
1245
1246 sm->radius_class.attr = nclass;
1247 sm->radius_class.count = nclass_count;
1248 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "IEEE 802.1X: Stored %lu RADIUS "
1249 "Class attributes for " MACSTR "\n",
1250 (unsigned long) sm->radius_class.count,
1251 MAC2STR(sta->addr));
1252 }
1253
1254
1255 /* Update sta->identity based on User-Name attribute in Access-Accept */
1256 static void ieee802_1x_update_sta_identity(struct hostapd_data *hapd,
1257 struct sta_info *sta,
1258 struct radius_msg *msg)
1259 {
1260 u8 *buf, *identity;
1261 size_t len;
1262 struct eapol_state_machine *sm = sta->eapol_sm;
1263
1264 if (sm == NULL)
1265 return;
1266
1267 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_USER_NAME, &buf, &len,
1268 NULL) < 0)
1269 return;
1270
1271 identity = malloc(len + 1);
1272 if (identity == NULL)
1273 return;
1274
1275 memcpy(identity, buf, len);
1276 identity[len] = '\0';
1277
1278 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1279 HOSTAPD_LEVEL_DEBUG, "old identity '%s' updated with "
1280 "User-Name from Access-Accept '%s'",
1281 sm->identity ? (char *) sm->identity : "N/A",
1282 (char *) identity);
1283
1284 free(sm->identity);
1285 sm->identity = identity;
1286 sm->identity_len = len;
1287 }
1288
1289
1290 struct sta_id_search {
1291 u8 identifier;
1292 struct eapol_state_machine *sm;
1293 };
1294
1295
1296 static int ieee802_1x_select_radius_identifier(struct hostapd_data *hapd,
1297 struct sta_info *sta,
1298 void *ctx)
1299 {
1300 struct sta_id_search *id_search = ctx;
1301 struct eapol_state_machine *sm = sta->eapol_sm;
1302
1303 if (sm && sm->radius_identifier >= 0 &&
1304 sm->radius_identifier == id_search->identifier) {
1305 id_search->sm = sm;
1306 return 1;
1307 }
1308 return 0;
1309 }
1310
1311
1312 static struct eapol_state_machine *
1313 ieee802_1x_search_radius_identifier(struct hostapd_data *hapd, u8 identifier)
1314 {
1315 struct sta_id_search id_search;
1316 id_search.identifier = identifier;
1317 id_search.sm = NULL;
1318 ap_for_each_sta(hapd, ieee802_1x_select_radius_identifier, &id_search);
1319 return id_search.sm;
1320 }
1321
1322
1323 /* Process the RADIUS frames from Authentication Server */
1324 static RadiusRxResult
1325 ieee802_1x_receive_auth(struct radius_msg *msg, struct radius_msg *req,
1326 u8 *shared_secret, size_t shared_secret_len,
1327 void *data)
1328 {
1329 struct hostapd_data *hapd = data;
1330 struct sta_info *sta;
1331 u32 session_timeout = 0, termination_action, acct_interim_interval;
1332 int session_timeout_set, old_vlanid = 0;
1333 int eap_timeout;
1334 struct eapol_state_machine *sm;
1335 int override_eapReq = 0;
1336
1337 sm = ieee802_1x_search_radius_identifier(hapd, msg->hdr->identifier);
1338 if (sm == NULL) {
1339 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "IEEE 802.1X: Could not "
1340 "find matching station for this RADIUS "
1341 "message\n");
1342 return RADIUS_RX_UNKNOWN;
1343 }
1344 sta = sm->sta;
1345
1346 /* RFC 2869, Ch. 5.13: valid Message-Authenticator attribute MUST be
1347 * present when packet contains an EAP-Message attribute */
1348 if (msg->hdr->code == RADIUS_CODE_ACCESS_REJECT &&
1349 radius_msg_get_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR, NULL,
1350 0) < 0 &&
1351 radius_msg_get_attr(msg, RADIUS_ATTR_EAP_MESSAGE, NULL, 0) < 0) {
1352 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "Allowing RADIUS "
1353 "Access-Reject without Message-Authenticator "
1354 "since it does not include EAP-Message\n");
1355 } else if (radius_msg_verify(msg, shared_secret, shared_secret_len,
1356 req, 1)) {
1357 printf("Incoming RADIUS packet did not have correct "
1358 "Message-Authenticator - dropped\n");
1359 return RADIUS_RX_INVALID_AUTHENTICATOR;
1360 }
1361
1362 if (msg->hdr->code != RADIUS_CODE_ACCESS_ACCEPT &&
1363 msg->hdr->code != RADIUS_CODE_ACCESS_REJECT &&
1364 msg->hdr->code != RADIUS_CODE_ACCESS_CHALLENGE) {
1365 printf("Unknown RADIUS message code\n");
1366 return RADIUS_RX_UNKNOWN;
1367 }
1368
1369 sm->radius_identifier = -1;
1370 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
1371 "RADIUS packet matching with station " MACSTR "\n",
1372 MAC2STR(sta->addr));
1373
1374 if (sm->last_recv_radius) {
1375 radius_msg_free(sm->last_recv_radius);
1376 free(sm->last_recv_radius);
1377 }
1378
1379 sm->last_recv_radius = msg;
1380
1381 session_timeout_set =
1382 !radius_msg_get_attr_int32(msg, RADIUS_ATTR_SESSION_TIMEOUT,
1383 &session_timeout);
1384 if (radius_msg_get_attr_int32(msg, RADIUS_ATTR_TERMINATION_ACTION,
1385 &termination_action))
1386 termination_action = RADIUS_TERMINATION_ACTION_DEFAULT;
1387
1388 if (hapd->conf->radius->acct_interim_interval == 0 &&
1389 msg->hdr->code == RADIUS_CODE_ACCESS_ACCEPT &&
1390 radius_msg_get_attr_int32(msg, RADIUS_ATTR_ACCT_INTERIM_INTERVAL,
1391 &acct_interim_interval) == 0) {
1392 if (acct_interim_interval < 60) {
1393 hostapd_logger(hapd, sta->addr,
1394 HOSTAPD_MODULE_IEEE8021X,
1395 HOSTAPD_LEVEL_INFO,
1396 "ignored too small "
1397 "Acct-Interim-Interval %d",
1398 acct_interim_interval);
1399 } else
1400 sta->acct_interim_interval = acct_interim_interval;
1401 }
1402
1403
1404 switch (msg->hdr->code) {
1405 case RADIUS_CODE_ACCESS_ACCEPT:
1406 if (sta->ssid->dynamic_vlan == DYNAMIC_VLAN_DISABLED)
1407 sta->vlan_id = 0;
1408 else {
1409 old_vlanid = sta->vlan_id;
1410 sta->vlan_id = radius_msg_get_vlanid(msg);
1411 }
1412 if (sta->vlan_id > 0 &&
1413 hostapd_get_vlan_id_ifname(hapd->conf->vlan,
1414 sta->vlan_id)) {
1415 hostapd_logger(hapd, sta->addr,
1416 HOSTAPD_MODULE_RADIUS,
1417 HOSTAPD_LEVEL_INFO,
1418 "VLAN ID %d", sta->vlan_id);
1419 } else if (sta->ssid->dynamic_vlan == DYNAMIC_VLAN_REQUIRED) {
1420 sta->eapol_sm->authFail = TRUE;
1421 hostapd_logger(hapd, sta->addr,
1422 HOSTAPD_MODULE_IEEE8021X,
1423 HOSTAPD_LEVEL_INFO, "authentication "
1424 "server did not include required VLAN "
1425 "ID in Access-Accept");
1426 break;
1427 }
1428
1429 ap_sta_bind_vlan(hapd, sta, old_vlanid);
1430
1431 /* RFC 3580, Ch. 3.17 */
1432 if (session_timeout_set && termination_action ==
1433 RADIUS_TERMINATION_ACTION_RADIUS_REQUEST) {
1434 sm->reAuthPeriod = session_timeout;
1435 } else if (session_timeout_set)
1436 ap_sta_session_timeout(hapd, sta, session_timeout);
1437
1438 sm->eapSuccess = TRUE;
1439 override_eapReq = 1;
1440 ieee802_1x_get_keys(hapd, sta, msg, req, shared_secret,
1441 shared_secret_len);
1442 ieee802_1x_store_radius_class(hapd, sta, msg);
1443 ieee802_1x_update_sta_identity(hapd, sta, msg);
1444 if (sm->keyAvailable &&
1445 wpa_auth_pmksa_add(sta->wpa_sm, sm->eapol_key_crypt,
1446 session_timeout_set ?
1447 (int) session_timeout : -1, sm) == 0) {
1448 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA,
1449 HOSTAPD_LEVEL_DEBUG,
1450 "Added PMKSA cache entry");
1451 }
1452 break;
1453 case RADIUS_CODE_ACCESS_REJECT:
1454 sm->eapFail = TRUE;
1455 override_eapReq = 1;
1456 break;
1457 case RADIUS_CODE_ACCESS_CHALLENGE:
1458 if (session_timeout_set) {
1459 /* RFC 2869, Ch. 2.3.2; RFC 3580, Ch. 3.17 */
1460 eap_timeout = session_timeout;
1461 } else
1462 eap_timeout = 30;
1463 hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
1464 HOSTAPD_LEVEL_DEBUG,
1465 "using EAP timeout of %d seconds%s",
1466 eap_timeout,
1467 session_timeout_set ? " (from RADIUS)" : "");
1468 eloop_cancel_timeout(ieee802_1x_eap_timeout, sta, NULL);
1469 eloop_register_timeout(eap_timeout, 0, ieee802_1x_eap_timeout,
1470 sta, NULL);
1471 sm->eapTimeout = FALSE;
1472 break;
1473 }
1474
1475 ieee802_1x_decapsulate_radius(hapd, sta);
1476 if (override_eapReq)
1477 sm->eapReq = FALSE;
1478
1479 eapol_sm_step(sm);
1480
1481 return RADIUS_RX_QUEUED;
1482 }
1483
1484
1485 /* Handler for EAPOL Backend Authentication state machine sendRespToServer.
1486 * Forward the EAP Response from Supplicant to Authentication Server. */
1487 void ieee802_1x_send_resp_to_server(struct hostapd_data *hapd,
1488 struct sta_info *sta)
1489 {
1490 struct eapol_state_machine *sm = sta->eapol_sm;
1491 if (sm == NULL)
1492 return;
1493
1494 if (hapd->conf->eap_server) {
1495 eap_set_eapRespData(sm->eap, sm->last_eap_supp,
1496 sm->last_eap_supp_len);
1497 } else {
1498 ieee802_1x_encapsulate_radius(hapd, sta, sm->last_eap_supp,
1499 sm->last_eap_supp_len);
1500 }
1501 }
1502
1503
1504 void ieee802_1x_abort_auth(struct hostapd_data *hapd, struct sta_info *sta)
1505 {
1506 struct eapol_state_machine *sm = sta->eapol_sm;
1507 if (sm == NULL)
1508 return;
1509
1510 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1511 HOSTAPD_LEVEL_DEBUG, "aborting authentication");
1512
1513 if (sm->last_recv_radius) {
1514 radius_msg_free(sm->last_recv_radius);
1515 free(sm->last_recv_radius);
1516 sm->last_recv_radius = NULL;
1517 }
1518 free(sm->last_eap_supp);
1519 sm->last_eap_supp = NULL;
1520 sm->last_eap_supp_len = 0;
1521 free(sm->last_eap_radius);
1522 sm->last_eap_radius = NULL;
1523 sm->last_eap_radius_len = 0;
1524 }
1525
1526
1527 #ifdef HOSTAPD_DUMP_STATE
1528 static void fprint_char(FILE *f, char c)
1529 {
1530 if (c >= 32 && c < 127)
1531 fprintf(f, "%c", c);
1532 else
1533 fprintf(f, "<%02x>", c);
1534 }
1535
1536
1537 void ieee802_1x_dump_state(FILE *f, const char *prefix, struct sta_info *sta)
1538 {
1539 struct eapol_state_machine *sm = sta->eapol_sm;
1540 if (sm == NULL)
1541 return;
1542
1543 fprintf(f, "%sIEEE 802.1X:\n", prefix);
1544
1545 if (sm->identity) {
1546 size_t i;
1547 fprintf(f, "%sidentity=", prefix);
1548 for (i = 0; i < sm->identity_len; i++)
1549 fprint_char(f, sm->identity[i]);
1550 fprintf(f, "\n");
1551 }
1552
1553 fprintf(f, "%slast EAP type: Authentication Server: %d (%s) "
1554 "Supplicant: %d (%s)\n", prefix,
1555 sm->eap_type_authsrv, eap_type_text(sm->eap_type_authsrv),
1556 sm->eap_type_supp, eap_type_text(sm->eap_type_supp));
1557
1558 fprintf(f, "%scached_packets=%s%s%s\n", prefix,
1559 sm->last_recv_radius ? "[RX RADIUS]" : "",
1560 sm->last_eap_radius ? "[EAP RADIUS]" : "",
1561 sm->last_eap_supp ? "[EAP SUPPLICANT]" : "");
1562
1563 eapol_sm_dump_state(f, prefix, sm);
1564 }
1565 #endif /* HOSTAPD_DUMP_STATE */
1566
1567
1568 static int ieee802_1x_rekey_broadcast(struct hostapd_data *hapd)
1569 {
1570 if (hapd->conf->default_wep_key_len < 1)
1571 return 0;
1572
1573 free(hapd->default_wep_key);
1574 hapd->default_wep_key = malloc(hapd->conf->default_wep_key_len);
1575 if (hapd->default_wep_key == NULL ||
1576 hostapd_get_rand(hapd->default_wep_key,
1577 hapd->conf->default_wep_key_len)) {
1578 printf("Could not generate random WEP key.\n");
1579 free(hapd->default_wep_key);
1580 hapd->default_wep_key = NULL;
1581 return -1;
1582 }
1583
1584 wpa_hexdump_key(MSG_DEBUG, "IEEE 802.1X: New default WEP key",
1585 hapd->default_wep_key,
1586 hapd->conf->default_wep_key_len);
1587
1588 return 0;
1589 }
1590
1591
1592 static int ieee802_1x_sta_key_available(struct hostapd_data *hapd,
1593 struct sta_info *sta, void *ctx)
1594 {
1595 if (sta->eapol_sm) {
1596 sta->eapol_sm->keyAvailable = TRUE;
1597 eapol_sm_step(sta->eapol_sm);
1598 }
1599 return 0;
1600 }
1601
1602
1603 static void ieee802_1x_rekey(void *eloop_ctx, void *timeout_ctx)
1604 {
1605 struct hostapd_data *hapd = eloop_ctx;
1606
1607 if (hapd->default_wep_key_idx >= 3)
1608 hapd->default_wep_key_idx =
1609 hapd->conf->individual_wep_key_len > 0 ? 1 : 0;
1610 else
1611 hapd->default_wep_key_idx++;
1612
1613 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "IEEE 802.1X: New default WEP "
1614 "key index %d\n", hapd->default_wep_key_idx);
1615
1616 if (ieee802_1x_rekey_broadcast(hapd)) {
1617 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE8021X,
1618 HOSTAPD_LEVEL_WARNING, "failed to generate a "
1619 "new broadcast key");
1620 free(hapd->default_wep_key);
1621 hapd->default_wep_key = NULL;
1622 return;
1623 }
1624
1625 /* TODO: Could setup key for RX here, but change default TX keyid only
1626 * after new broadcast key has been sent to all stations. */
1627 if (hostapd_set_encryption(hapd->conf->iface, hapd, "WEP", NULL,
1628 hapd->default_wep_key_idx,
1629 hapd->default_wep_key,
1630 hapd->conf->default_wep_key_len, 1)) {
1631 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE8021X,
1632 HOSTAPD_LEVEL_WARNING, "failed to configure a "
1633 "new broadcast key");
1634 free(hapd->default_wep_key);
1635 hapd->default_wep_key = NULL;
1636 return;
1637 }
1638
1639 ap_for_each_sta(hapd, ieee802_1x_sta_key_available, NULL);
1640
1641 if (hapd->conf->wep_rekeying_period > 0) {
1642 eloop_register_timeout(hapd->conf->wep_rekeying_period, 0,
1643 ieee802_1x_rekey, hapd, NULL);
1644 }
1645 }
1646
1647
1648 int ieee802_1x_init(struct hostapd_data *hapd)
1649 {
1650 int i;
1651
1652 if ((hapd->conf->ieee802_1x || hapd->conf->wpa) &&
1653 hostapd_set_ieee8021x(hapd->conf->iface, hapd, 1))
1654 return -1;
1655
1656 if (radius_client_register(hapd->radius, RADIUS_AUTH,
1657 ieee802_1x_receive_auth, hapd))
1658 return -1;
1659
1660 if (hapd->conf->default_wep_key_len) {
1661 hostapd_set_privacy(hapd, 1);
1662
1663 for (i = 0; i < 4; i++)
1664 hostapd_set_encryption(hapd->conf->iface, hapd,
1665 "none", NULL, i, NULL, 0, 0);
1666
1667 ieee802_1x_rekey(hapd, NULL);
1668
1669 if (hapd->default_wep_key == NULL)
1670 return -1;
1671 }
1672
1673 return 0;
1674 }
1675
1676
1677 void ieee802_1x_deinit(struct hostapd_data *hapd)
1678 {
1679 if (hapd->driver != NULL &&
1680 (hapd->conf->ieee802_1x || hapd->conf->wpa))
1681 hostapd_set_ieee8021x(hapd->conf->iface, hapd, 0);
1682 }
1683
1684
1685 int ieee802_1x_reconfig(struct hostapd_data *hapd,
1686 struct hostapd_config *oldconf,
1687 struct hostapd_bss_config *oldbss)
1688 {
1689 ieee802_1x_deinit(hapd);
1690 return ieee802_1x_init(hapd);
1691 }
1692
1693
1694 static void ieee802_1x_new_auth_session(struct hostapd_data *hapd,
1695 struct sta_info *sta)
1696 {
1697 struct eapol_state_machine *sm = sta->eapol_sm;
1698 if (sm == NULL)
1699 return;
1700
1701 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
1702 "IEEE 802.1X: station " MACSTR " - new auth session, "
1703 "clearing State\n", MAC2STR(sta->addr));
1704
1705 if (sm->last_recv_radius) {
1706 radius_msg_free(sm->last_recv_radius);
1707 free(sm->last_recv_radius);
1708 sm->last_recv_radius = NULL;
1709 }
1710
1711 sm->eapSuccess = FALSE;
1712 sm->eapFail = FALSE;
1713 }
1714
1715
1716 int ieee802_1x_tx_status(struct hostapd_data *hapd, struct sta_info *sta,
1717 u8 *buf, size_t len, int ack)
1718 {
1719 struct ieee80211_hdr *hdr;
1720 struct ieee802_1x_hdr *xhdr;
1721 struct ieee802_1x_eapol_key *key;
1722 u8 *pos;
1723
1724 if (sta == NULL)
1725 return -1;
1726 if (len < sizeof(*hdr) + sizeof(rfc1042_header) + 2 + sizeof(*xhdr))
1727 return 0;
1728
1729 hdr = (struct ieee80211_hdr *) buf;
1730 pos = (u8 *) (hdr + 1);
1731 if (memcmp(pos, rfc1042_header, sizeof(rfc1042_header)) != 0)
1732 return 0;
1733 pos += sizeof(rfc1042_header);
1734 if (((pos[0] << 8) | pos[1]) != ETH_P_PAE)
1735 return 0;
1736 pos += 2;
1737
1738 xhdr = (struct ieee802_1x_hdr *) pos;
1739 pos += sizeof(*xhdr);
1740
1741 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "IEEE 802.1X: " MACSTR
1742 " TX status - version=%d type=%d length=%d - ack=%d\n",
1743 MAC2STR(sta->addr), xhdr->version, xhdr->type,
1744 ntohs(xhdr->length), ack);
1745
1746 /* EAPOL EAP-Packet packets are eventually re-sent by either Supplicant
1747 * or Authenticator state machines, but EAPOL-Key packets are not
1748 * retransmitted in case of failure. Try to re-sent failed EAPOL-Key
1749 * packets couple of times because otherwise STA keys become
1750 * unsynchronized with AP. */
1751 if (xhdr->type == IEEE802_1X_TYPE_EAPOL_KEY && !ack &&
1752 pos + sizeof(*key) <= buf + len) {
1753 key = (struct ieee802_1x_eapol_key *) pos;
1754 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1755 HOSTAPD_LEVEL_DEBUG, "did not Ack EAPOL-Key "
1756 "frame (%scast index=%d)",
1757 key->key_index & BIT(7) ? "uni" : "broad",
1758 key->key_index & ~BIT(7));
1759 /* TODO: re-send EAPOL-Key couple of times (with short delay
1760 * between them?). If all attempt fail, report error and
1761 * deauthenticate STA so that it will get new keys when
1762 * authenticating again (e.g., after returning in range).
1763 * Separate limit/transmit state needed both for unicast and
1764 * broadcast keys(?) */
1765 }
1766 /* TODO: could move unicast key configuration from ieee802_1x_tx_key()
1767 * to here and change the key only if the EAPOL-Key packet was Acked.
1768 */
1769
1770 return 1;
1771 }
1772
1773
1774 u8 * ieee802_1x_get_identity(struct eapol_state_machine *sm, size_t *len)
1775 {
1776 if (sm == NULL || sm->identity == NULL)
1777 return NULL;
1778
1779 *len = sm->identity_len;
1780 return sm->identity;
1781 }
1782
1783
1784 u8 * ieee802_1x_get_radius_class(struct eapol_state_machine *sm, size_t *len,
1785 int idx)
1786 {
1787 if (sm == NULL || sm->radius_class.attr == NULL ||
1788 idx >= (int) sm->radius_class.count)
1789 return NULL;
1790
1791 *len = sm->radius_class.attr[idx].len;
1792 return sm->radius_class.attr[idx].data;
1793 }
1794
1795
1796 u8 * ieee802_1x_get_key_crypt(struct eapol_state_machine *sm, size_t *len)
1797 {
1798 if (sm == NULL)
1799 return NULL;
1800
1801 *len = sm->eapol_key_crypt_len;
1802 return sm->eapol_key_crypt;
1803 }
1804
1805
1806 void ieee802_1x_notify_port_enabled(struct eapol_state_machine *sm,
1807 int enabled)
1808 {
1809 if (sm == NULL)
1810 return;
1811 sm->portEnabled = enabled ? TRUE : FALSE;
1812 eapol_sm_step(sm);
1813 }
1814
1815
1816 void ieee802_1x_notify_port_valid(struct eapol_state_machine *sm,
1817 int valid)
1818 {
1819 if (sm == NULL)
1820 return;
1821 sm->portValid = valid ? TRUE : FALSE;
1822 eapol_sm_step(sm);
1823 }
1824
1825
1826 void ieee802_1x_notify_pre_auth(struct eapol_state_machine *sm, int pre_auth)
1827 {
1828 if (sm == NULL)
1829 return;
1830 if (pre_auth)
1831 sm->flags |= EAPOL_SM_PREAUTH;
1832 else
1833 sm->flags &= ~EAPOL_SM_PREAUTH;
1834 }
1835
1836
1837 static const char * bool_txt(Boolean bool)
1838 {
1839 return bool ? "TRUE" : "FALSE";
1840 }
1841
1842
1843 int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
1844 {
1845 /* TODO */
1846 return 0;
1847 }
1848
1849
1850 int ieee802_1x_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta,
1851 char *buf, size_t buflen)
1852 {
1853 int len = 0, ret;
1854 struct eapol_state_machine *sm = sta->eapol_sm;
1855
1856 if (sm == NULL)
1857 return 0;
1858
1859 ret = snprintf(buf + len, buflen - len,
1860 "dot1xPaePortNumber=%d\n"
1861 "dot1xPaePortProtocolVersion=%d\n"
1862 "dot1xPaePortCapabilities=1\n"
1863 "dot1xPaePortInitialize=%d\n"
1864 "dot1xPaePortReauthenticate=FALSE\n",
1865 sta->aid,
1866 EAPOL_VERSION,
1867 sm->initialize);
1868 if (ret < 0 || (size_t) ret >= buflen - len)
1869 return len;
1870 len += ret;
1871
1872 /* dot1xAuthConfigTable */
1873 ret = snprintf(buf + len, buflen - len,
1874 "dot1xAuthPaeState=%d\n"
1875 "dot1xAuthBackendAuthState=%d\n"
1876 "dot1xAuthAdminControlledDirections=%d\n"
1877 "dot1xAuthOperControlledDirections=%d\n"
1878 "dot1xAuthAuthControlledPortStatus=%d\n"
1879 "dot1xAuthAuthControlledPortControl=%d\n"
1880 "dot1xAuthQuietPeriod=%u\n"
1881 "dot1xAuthServerTimeout=%u\n"
1882 "dot1xAuthReAuthPeriod=%u\n"
1883 "dot1xAuthReAuthEnabled=%s\n"
1884 "dot1xAuthKeyTxEnabled=%s\n",
1885 sm->auth_pae_state + 1,
1886 sm->be_auth_state + 1,
1887 sm->adminControlledDirections,
1888 sm->operControlledDirections,
1889 sm->authPortStatus,
1890 sm->portControl,
1891 sm->quietPeriod,
1892 sm->serverTimeout,
1893 sm->reAuthPeriod,
1894 bool_txt(sm->reAuthEnabled),
1895 bool_txt(sm->keyTxEnabled));
1896 if (ret < 0 || (size_t) ret >= buflen - len)
1897 return len;
1898 len += ret;
1899
1900 /* dot1xAuthStatsTable */
1901 ret = snprintf(buf + len, buflen - len,
1902 "dot1xAuthEapolFramesRx=%u\n"
1903 "dot1xAuthEapolFramesTx=%u\n"
1904 "dot1xAuthEapolStartFramesRx=%u\n"
1905 "dot1xAuthEapolLogoffFramesRx=%u\n"
1906 "dot1xAuthEapolRespIdFramesRx=%u\n"
1907 "dot1xAuthEapolRespFramesRx=%u\n"
1908 "dot1xAuthEapolReqIdFramesTx=%u\n"
1909 "dot1xAuthEapolReqFramesTx=%u\n"
1910 "dot1xAuthInvalidEapolFramesRx=%u\n"
1911 "dot1xAuthEapLengthErrorFramesRx=%u\n"
1912 "dot1xAuthLastEapolFrameVersion=%u\n"
1913 "dot1xAuthLastEapolFrameSource=" MACSTR "\n",
1914 sm->dot1xAuthEapolFramesRx,
1915 sm->dot1xAuthEapolFramesTx,
1916 sm->dot1xAuthEapolStartFramesRx,
1917 sm->dot1xAuthEapolLogoffFramesRx,
1918 sm->dot1xAuthEapolRespIdFramesRx,
1919 sm->dot1xAuthEapolRespFramesRx,
1920 sm->dot1xAuthEapolReqIdFramesTx,
1921 sm->dot1xAuthEapolReqFramesTx,
1922 sm->dot1xAuthInvalidEapolFramesRx,
1923 sm->dot1xAuthEapLengthErrorFramesRx,
1924 sm->dot1xAuthLastEapolFrameVersion,
1925 MAC2STR(sm->addr));
1926 if (ret < 0 || (size_t) ret >= buflen - len)
1927 return len;
1928 len += ret;
1929
1930 /* dot1xAuthDiagTable */
1931 ret = snprintf(buf + len, buflen - len,
1932 "dot1xAuthEntersConnecting=%u\n"
1933 "dot1xAuthEapLogoffsWhileConnecting=%u\n"
1934 "dot1xAuthEntersAuthenticating=%u\n"
1935 "dot1xAuthAuthSuccessesWhileAuthenticating=%u\n"
1936 "dot1xAuthAuthTimeoutsWhileAuthenticating=%u\n"
1937 "dot1xAuthAuthFailWhileAuthenticating=%u\n"
1938 "dot1xAuthAuthEapStartsWhileAuthenticating=%u\n"
1939 "dot1xAuthAuthEapLogoffWhileAuthenticating=%u\n"
1940 "dot1xAuthAuthReauthsWhileAuthenticated=%u\n"
1941 "dot1xAuthAuthEapStartsWhileAuthenticated=%u\n"
1942 "dot1xAuthAuthEapLogoffWhileAuthenticated=%u\n"
1943 "dot1xAuthBackendResponses=%u\n"
1944 "dot1xAuthBackendAccessChallenges=%u\n"
1945 "dot1xAuthBackendOtherRequestsToSupplicant=%u\n"
1946 "dot1xAuthBackendAuthSuccesses=%u\n"
1947 "dot1xAuthBackendAuthFails=%u\n",
1948 sm->authEntersConnecting,
1949 sm->authEapLogoffsWhileConnecting,
1950 sm->authEntersAuthenticating,
1951 sm->authAuthSuccessesWhileAuthenticating,
1952 sm->authAuthTimeoutsWhileAuthenticating,
1953 sm->authAuthFailWhileAuthenticating,
1954 sm->authAuthEapStartsWhileAuthenticating,
1955 sm->authAuthEapLogoffWhileAuthenticating,
1956 sm->authAuthReauthsWhileAuthenticated,
1957 sm->authAuthEapStartsWhileAuthenticated,
1958 sm->authAuthEapLogoffWhileAuthenticated,
1959 sm->backendResponses,
1960 sm->backendAccessChallenges,
1961 sm->backendOtherRequestsToSupplicant,
1962 sm->backendAuthSuccesses,
1963 sm->backendAuthFails);
1964 if (ret < 0 || (size_t) ret >= buflen - len)
1965 return len;
1966 len += ret;
1967
1968 /* dot1xAuthSessionStatsTable */
1969 ret = snprintf(buf + len, buflen - len,
1970 /* TODO: dot1xAuthSessionOctetsRx */
1971 /* TODO: dot1xAuthSessionOctetsTx */
1972 /* TODO: dot1xAuthSessionFramesRx */
1973 /* TODO: dot1xAuthSessionFramesTx */
1974 "dot1xAuthSessionId=%08X-%08X\n"
1975 "dot1xAuthSessionAuthenticMethod=%d\n"
1976 "dot1xAuthSessionTime=%u\n"
1977 "dot1xAuthSessionTerminateCause=999\n"
1978 "dot1xAuthSessionUserName=%s\n",
1979 sta->acct_session_id_hi, sta->acct_session_id_lo,
1980 wpa_auth_sta_key_mgmt(sta->wpa_sm) ==
1981 WPA_KEY_MGMT_IEEE8021X ? 1 : 2,
1982 (unsigned int) (time(NULL) - sta->acct_session_start),
1983 sm->identity);
1984 if (ret < 0 || (size_t) ret >= buflen - len)
1985 return len;
1986 len += ret;
1987
1988 return len;
1989 }
1990
1991
1992 void ieee802_1x_finished(struct hostapd_data *hapd, struct sta_info *sta,
1993 int success)
1994 {
1995 u8 *key;
1996 size_t len;
1997 /* TODO: get PMKLifetime from WPA parameters */
1998 static const int dot11RSNAConfigPMKLifetime = 43200;
1999
2000 key = ieee802_1x_get_key_crypt(sta->eapol_sm, &len);
2001 if (success && key &&
2002 wpa_auth_pmksa_add(sta->wpa_sm, key, dot11RSNAConfigPMKLifetime,
2003 sta->eapol_sm) == 0) {
2004 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA,
2005 HOSTAPD_LEVEL_DEBUG,
2006 "Added PMKSA cache entry (IEEE 802.1X)");
2007 }
2008 }
DragonFly BSD