2 * Host AP (software wireless LAN access point) user space daemon for
3 * Host AP kernel driver / IEEE 802.1X Authenticator
4 * Copyright (c) 2002-2006, Jouni Malinen <jkmaline@cc.hut.fi>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
10 * Alternatively, this software may be distributed under the terms of BSD
13 * See README and COPYING for more details.
19 #include <netinet/in.h>
21 #include <sys/ioctl.h>
26 #include <sys/socket.h>
29 #include "ieee802_1x.h"
30 #include "accounting.h"
32 #include "radius_client.h"
43 static void ieee802_1x_new_auth_session(struct hostapd_data
*hapd
,
44 struct sta_info
*sta
);
47 static void ieee802_1x_send(hostapd
*hapd
, struct sta_info
*sta
, u8 type
,
48 u8
*data
, size_t datalen
)
51 struct ieee802_1x_hdr
*xhdr
;
55 len
= sizeof(*xhdr
) + datalen
;
58 printf("malloc() failed for ieee802_1x_send(len=%lu)\n",
66 * According to IEEE 802.1aa/D4 EAPOL-Key should be sent before any
67 * remaining EAP frames, if possible. This would allow rest of the
68 * frames to be encrypted. This code could be used to request
69 * encryption from the kernel driver. */
71 sta
->eapol_sm
->be_auth
.state
== BE_AUTH_SUCCESS
&&
72 sta
->eapol_sm
->keyTxEnabled
)
76 xhdr
= (struct ieee802_1x_hdr
*) buf
;
77 xhdr
->version
= hapd
->conf
->eapol_version
;
79 xhdr
->length
= htons(datalen
);
81 if (datalen
> 0 && data
!= NULL
)
82 memcpy(xhdr
+ 1, data
, datalen
);
84 if (sta
->wpa_sm
&& sta
->wpa_sm
->pairwise_set
)
86 if (sta
->flags
& WLAN_STA_PREAUTH
) {
87 rsn_preauth_send(hapd
, sta
, buf
, len
);
89 hostapd_send_eapol(hapd
, sta
->addr
, buf
, len
, encrypt
);
96 void ieee802_1x_set_sta_authorized(hostapd
*hapd
, struct sta_info
*sta
,
99 if (sta
->flags
& WLAN_STA_PREAUTH
)
103 sta
->flags
|= WLAN_STA_AUTHORIZED
;
104 hostapd_logger(hapd
, sta
->addr
, HOSTAPD_MODULE_IEEE8021X
,
105 HOSTAPD_LEVEL_DEBUG
, "authorizing port");
107 sta
->flags
&= ~WLAN_STA_AUTHORIZED
;
108 hostapd_logger(hapd
, sta
->addr
, HOSTAPD_MODULE_IEEE8021X
,
109 HOSTAPD_LEVEL_DEBUG
, "unauthorizing port");
112 hostapd_set_sta_authorized(hapd
, sta
->addr
, authorized
);
114 accounting_sta_start(hapd
, sta
);
118 static void ieee802_1x_eap_timeout(void *eloop_ctx
, void *timeout_ctx
)
120 struct sta_info
*sta
= eloop_ctx
;
121 struct eapol_state_machine
*sm
= sta
->eapol_sm
;
124 hostapd_logger(sm
->hapd
, sta
->addr
, HOSTAPD_MODULE_IEEE8021X
,
125 HOSTAPD_LEVEL_DEBUG
, "EAP timeout");
126 sm
->eapTimeout
= TRUE
;
131 void ieee802_1x_request_identity(struct hostapd_data
*hapd
,
132 struct sta_info
*sta
)
138 struct eapol_state_machine
*sm
= sta
->eapol_sm
;
140 if (hapd
->conf
->eap_server
) {
141 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
,
142 "IEEE 802.1X: Integrated EAP server in "
143 "use - do not generate EAP-Request/Identity\n");
147 if (sm
== NULL
|| !sm
->auth_pae
.eapRestart
)
150 ieee802_1x_new_auth_session(hapd
, sta
);
152 tlen
= sizeof(*eap
) + 1 + hapd
->conf
->eap_req_id_text_len
;
156 printf("Could not allocate memory for identity request\n");
160 memset(buf
, 0, tlen
);
162 eap
= (struct eap_hdr
*) buf
;
163 eap
->code
= EAP_CODE_REQUEST
;
164 eap
->identifier
= ++sm
->currentId
;
165 eap
->length
= htons(tlen
);
166 pos
= (u8
*) (eap
+ 1);
167 *pos
++ = EAP_TYPE_IDENTITY
;
168 if (hapd
->conf
->eap_req_id_text
) {
169 memcpy(pos
, hapd
->conf
->eap_req_id_text
,
170 hapd
->conf
->eap_req_id_text_len
);
173 sm
->be_auth
.eapReq
= TRUE
;
174 free(sm
->last_eap_radius
);
175 sm
->last_eap_radius
= buf
;
176 sm
->last_eap_radius_len
= tlen
;
178 eloop_cancel_timeout(ieee802_1x_eap_timeout
, sta
, NULL
);
179 eloop_register_timeout(30, 0, ieee802_1x_eap_timeout
, sta
, NULL
);
180 sm
->eapTimeout
= FALSE
;
182 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
,
183 "IEEE 802.1X: Generated EAP Request-Identity for " MACSTR
184 " (identifier %d, timeout 30)\n", MAC2STR(sta
->addr
),
187 sm
->auth_pae
.eapRestart
= FALSE
;
191 void ieee802_1x_tx_canned_eap(struct hostapd_data
*hapd
, struct sta_info
*sta
,
195 struct eapol_state_machine
*sm
= sta
->eapol_sm
;
197 memset(&eap
, 0, sizeof(eap
));
199 eap
.code
= success
? EAP_CODE_SUCCESS
: EAP_CODE_FAILURE
;
201 if (sm
&& sm
->last_eap_radius
) {
202 struct eap_hdr
*hdr
= (struct eap_hdr
*) sm
->last_eap_radius
;
203 eap
.identifier
= hdr
->identifier
+ 1;
205 eap
.length
= htons(sizeof(eap
));
207 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
,
208 "IEEE 802.1X: Sending canned EAP packet %s to " MACSTR
209 " (identifier %d)\n", success
? "SUCCESS" : "FAILURE",
210 MAC2STR(sta
->addr
), eap
.identifier
);
211 ieee802_1x_send(hapd
, sta
, IEEE802_1X_TYPE_EAP_PACKET
, (u8
*) &eap
,
214 sm
->dot1xAuthEapolFramesTx
++;
218 void ieee802_1x_tx_req(struct hostapd_data
*hapd
, struct sta_info
*sta
)
221 struct eapol_state_machine
*sm
= sta
->eapol_sm
;
226 if (sm
->last_eap_radius
== NULL
) {
227 printf("Error: TxReq called for station " MACSTR
", but there "
228 "is no EAP request from the authentication server\n",
233 eap
= (struct eap_hdr
*) sm
->last_eap_radius
;
234 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
,
235 "IEEE 802.1X: Sending EAP Packet to " MACSTR
236 " (identifier %d)\n", MAC2STR(sm
->addr
),
238 sm
->currentId
= eap
->identifier
;
239 ieee802_1x_send(hapd
, sta
, IEEE802_1X_TYPE_EAP_PACKET
,
240 sm
->last_eap_radius
, sm
->last_eap_radius_len
);
241 sm
->dot1xAuthEapolFramesTx
++;
242 type
= (u8
*) (eap
+ 1);
243 if (sm
->last_eap_radius_len
> sizeof(*eap
) &&
244 *type
== EAP_TYPE_IDENTITY
)
245 sm
->dot1xAuthEapolReqIdFramesTx
++;
247 sm
->dot1xAuthEapolReqFramesTx
++;
251 void hostapd_get_ntp_timestamp(u8
*buf
)
256 /* 64-bit NTP timestamp (time from 1900-01-01 00:00:00) */
257 gettimeofday(&now
, NULL
);
258 sec
= htonl(now
.tv_sec
+ 2208988800U); /* Epoch to 1900 */
259 /* Estimate 2^32/10^6 = 4295 - 1/32 - 1/512 */
261 usec
= htonl(4295 * usec
- (usec
>> 5) - (usec
>> 9));
262 memcpy(buf
, (u8
*) &sec
, 4);
263 memcpy(buf
+ 4, (u8
*) &usec
, 4);
267 static void ieee802_1x_tx_key_one(hostapd
*hapd
, struct sta_info
*sta
,
268 int index
, int broadcast
,
269 u8
*key_data
, size_t key_len
)
272 struct ieee802_1x_hdr
*hdr
;
273 struct ieee802_1x_eapol_key
*key
;
274 size_t len
, ekey_len
;
275 struct eapol_state_machine
*sm
= sta
->eapol_sm
;
280 len
= sizeof(*key
) + key_len
;
281 buf
= malloc(sizeof(*hdr
) + len
);
285 memset(buf
, 0, sizeof(*hdr
) + len
);
286 hdr
= (struct ieee802_1x_hdr
*) buf
;
287 key
= (struct ieee802_1x_eapol_key
*) (hdr
+ 1);
288 key
->type
= EAPOL_KEY_TYPE_RC4
;
289 key
->key_length
= htons(key_len
);
290 hostapd_get_ntp_timestamp(key
->replay_counter
);
292 if (hostapd_get_rand(key
->key_iv
, sizeof(key
->key_iv
))) {
293 printf("Could not get random numbers\n");
298 key
->key_index
= index
| (broadcast
? 0 : BIT(7));
299 if (hapd
->conf
->eapol_key_index_workaround
) {
300 /* According to some information, WinXP Supplicant seems to
301 * interpret bit7 as an indication whether the key is to be
302 * activated, so make it possible to enable workaround that
303 * sets this bit for all keys. */
304 key
->key_index
|= BIT(7);
307 /* Key is encrypted using "Key-IV + sm->eapol_key_crypt" as the
309 memcpy((u8
*) (key
+ 1), key_data
, key_len
);
310 ekey_len
= sizeof(key
->key_iv
) + sm
->eapol_key_crypt_len
;
311 ekey
= malloc(ekey_len
);
313 printf("Could not encrypt key\n");
317 memcpy(ekey
, key
->key_iv
, sizeof(key
->key_iv
));
318 memcpy(ekey
+ sizeof(key
->key_iv
), sm
->eapol_key_crypt
,
319 sm
->eapol_key_crypt_len
);
320 rc4((u8
*) (key
+ 1), key_len
, ekey
, ekey_len
);
323 /* This header is needed here for HMAC-MD5, but it will be regenerated
324 * in ieee802_1x_send() */
325 hdr
->version
= hapd
->conf
->eapol_version
;
326 hdr
->type
= IEEE802_1X_TYPE_EAPOL_KEY
;
327 hdr
->length
= htons(len
);
328 hmac_md5(sm
->eapol_key_sign
, sm
->eapol_key_sign_len
,
329 buf
, sizeof(*hdr
) + len
,
332 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
,
333 "IEEE 802.1X: Sending EAPOL-Key to " MACSTR
334 " (%s index=%d)\n", MAC2STR(sm
->addr
),
335 broadcast
? "broadcast" : "unicast", index
);
336 ieee802_1x_send(hapd
, sta
, IEEE802_1X_TYPE_EAPOL_KEY
, (u8
*) key
, len
);
338 sta
->eapol_sm
->dot1xAuthEapolFramesTx
++;
343 void ieee802_1x_tx_key(struct hostapd_data
*hapd
, struct sta_info
*sta
)
345 struct eapol_state_machine
*sm
= sta
->eapol_sm
;
347 if (sm
== NULL
|| !sm
->eapol_key_sign
|| !sm
->eapol_key_crypt
)
350 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
,
351 "IEEE 802.1X: Sending EAPOL-Key(s) to " MACSTR
"\n",
354 if (hapd
->default_wep_key
)
355 ieee802_1x_tx_key_one(hapd
, sta
, hapd
->default_wep_key_idx
, 1,
356 hapd
->default_wep_key
,
357 hapd
->conf
->default_wep_key_len
);
359 if (hapd
->conf
->individual_wep_key_len
> 0) {
361 ikey
= malloc(hapd
->conf
->individual_wep_key_len
);
363 hostapd_get_rand(ikey
,
364 hapd
->conf
->individual_wep_key_len
)) {
365 printf("Could not generate random individual WEP "
371 if (HOSTAPD_DEBUG_COND(HOSTAPD_DEBUG_MINIMAL
))
372 hostapd_hexdump("Individual WEP key",
374 hapd
->conf
->individual_wep_key_len
);
376 ieee802_1x_tx_key_one(hapd
, sta
, 0, 0, ikey
,
377 hapd
->conf
->individual_wep_key_len
);
379 /* TODO: set encryption in TX callback, i.e., only after STA
380 * has ACKed EAPOL-Key frame */
381 if (hostapd_set_encryption(hapd
, "WEP", sta
->addr
, 0, ikey
,
383 individual_wep_key_len
)) {
384 printf("Could not set individual WEP encryption.\n");
392 static void ieee802_1x_encapsulate_radius(hostapd
*hapd
, struct sta_info
*sta
,
395 struct radius_msg
*msg
;
397 struct eapol_state_machine
*sm
= sta
->eapol_sm
;
402 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
,
403 "Encapsulating EAP message into a RADIUS packet\n");
405 sm
->radius_identifier
= radius_client_get_id(hapd
->radius
);
406 msg
= radius_msg_new(RADIUS_CODE_ACCESS_REQUEST
,
407 sm
->radius_identifier
);
409 printf("Could not create net RADIUS packet\n");
413 radius_msg_make_authenticator(msg
, (u8
*) sta
, sizeof(*sta
));
416 !radius_msg_add_attr(msg
, RADIUS_ATTR_USER_NAME
,
417 sm
->identity
, sm
->identity_len
)) {
418 printf("Could not add User-Name\n");
422 if (hapd
->conf
->own_ip_addr
.af
== AF_INET
&&
423 !radius_msg_add_attr(msg
, RADIUS_ATTR_NAS_IP_ADDRESS
,
424 (u8
*) &hapd
->conf
->own_ip_addr
.u
.v4
, 4)) {
425 printf("Could not add NAS-IP-Address\n");
430 if (hapd
->conf
->own_ip_addr
.af
== AF_INET6
&&
431 !radius_msg_add_attr(msg
, RADIUS_ATTR_NAS_IPV6_ADDRESS
,
432 (u8
*) &hapd
->conf
->own_ip_addr
.u
.v6
, 16)) {
433 printf("Could not add NAS-IPv6-Address\n");
436 #endif /* CONFIG_IPV6 */
438 if (hapd
->conf
->nas_identifier
&&
439 !radius_msg_add_attr(msg
, RADIUS_ATTR_NAS_IDENTIFIER
,
440 (u8
*) hapd
->conf
->nas_identifier
,
441 strlen(hapd
->conf
->nas_identifier
))) {
442 printf("Could not add NAS-Identifier\n");
446 if (!radius_msg_add_attr_int32(msg
, RADIUS_ATTR_NAS_PORT
, sta
->aid
)) {
447 printf("Could not add NAS-Port\n");
451 snprintf(buf
, sizeof(buf
), RADIUS_802_1X_ADDR_FORMAT
":%s",
452 MAC2STR(hapd
->own_addr
), hapd
->conf
->ssid
);
453 if (!radius_msg_add_attr(msg
, RADIUS_ATTR_CALLED_STATION_ID
,
454 (u8
*) buf
, strlen(buf
))) {
455 printf("Could not add Called-Station-Id\n");
459 snprintf(buf
, sizeof(buf
), RADIUS_802_1X_ADDR_FORMAT
,
461 if (!radius_msg_add_attr(msg
, RADIUS_ATTR_CALLING_STATION_ID
,
462 (u8
*) buf
, strlen(buf
))) {
463 printf("Could not add Calling-Station-Id\n");
467 /* TODO: should probably check MTU from driver config; 2304 is max for
468 * IEEE 802.11, but use 1400 to avoid problems with too large packets
470 if (!radius_msg_add_attr_int32(msg
, RADIUS_ATTR_FRAMED_MTU
, 1400)) {
471 printf("Could not add Framed-MTU\n");
475 if (!radius_msg_add_attr_int32(msg
, RADIUS_ATTR_NAS_PORT_TYPE
,
476 RADIUS_NAS_PORT_TYPE_IEEE_802_11
)) {
477 printf("Could not add NAS-Port-Type\n");
481 snprintf(buf
, sizeof(buf
), "CONNECT 11Mbps 802.11b");
482 if (!radius_msg_add_attr(msg
, RADIUS_ATTR_CONNECT_INFO
,
483 (u8
*) buf
, strlen(buf
))) {
484 printf("Could not add Connect-Info\n");
488 if (eap
&& !radius_msg_add_eap(msg
, eap
, len
)) {
489 printf("Could not add EAP-Message\n");
493 /* State attribute must be copied if and only if this packet is
494 * Access-Request reply to the previous Access-Challenge */
495 if (sm
->last_recv_radius
&& sm
->last_recv_radius
->hdr
->code
==
496 RADIUS_CODE_ACCESS_CHALLENGE
) {
497 int res
= radius_msg_copy_attr(msg
, sm
->last_recv_radius
,
500 printf("Could not copy State attribute from previous "
501 "Access-Challenge\n");
505 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
,
506 " Copied RADIUS State Attribute\n");
510 radius_client_send(hapd
->radius
, msg
, RADIUS_AUTH
, sta
->addr
);
514 radius_msg_free(msg
);
519 static char *eap_type_text(u8 type
)
522 case EAP_TYPE_IDENTITY
: return "Identity";
523 case EAP_TYPE_NOTIFICATION
: return "Notification";
524 case EAP_TYPE_NAK
: return "Nak";
525 case EAP_TYPE_MD5
: return "MD5-Challenge";
526 case EAP_TYPE_OTP
: return "One-Time Password";
527 case EAP_TYPE_GTC
: return "Generic Token Card";
528 case EAP_TYPE_TLS
: return "TLS";
529 case EAP_TYPE_TTLS
: return "TTLS";
530 case EAP_TYPE_PEAP
: return "PEAP";
531 default: return "Unknown";
536 static void handle_eap_response(hostapd
*hapd
, struct sta_info
*sta
,
537 struct eap_hdr
*eap
, u8
*data
, size_t len
)
540 struct eapol_state_machine
*sm
= sta
->eapol_sm
;
544 if (eap
->identifier
!= sm
->currentId
) {
545 hostapd_logger(hapd
, sm
->addr
, HOSTAPD_MODULE_IEEE8021X
,
547 "EAP Identifier of the Response-Identity does "
548 "not match (was %d, expected %d) - ignored",
549 eap
->identifier
, sm
->currentId
);
554 printf("handle_eap_response: too short response data\n");
558 eloop_cancel_timeout(ieee802_1x_eap_timeout
, sta
, NULL
);
560 free(sm
->last_eap_supp
);
561 sm
->last_eap_supp_len
= sizeof(*eap
) + len
;
562 sm
->last_eap_supp
= (u8
*) malloc(sm
->last_eap_supp_len
);
563 if (sm
->last_eap_supp
== NULL
) {
564 printf("Could not alloc memory for last EAP Response\n");
567 memcpy(sm
->last_eap_supp
, eap
, sizeof(*eap
));
568 memcpy(sm
->last_eap_supp
+ sizeof(*eap
), data
, len
);
574 hostapd_logger(hapd
, sm
->addr
, HOSTAPD_MODULE_IEEE8021X
,
575 HOSTAPD_LEVEL_DEBUG
, "received EAP packet (code=%d "
576 "id=%d len=%d) from STA: EAP Response-%s (%d)",
577 eap
->code
, eap
->identifier
, ntohs(eap
->length
),
578 eap_type_text(type
), type
);
580 if (type
== EAP_TYPE_IDENTITY
) {
583 buf
= malloc(4 * len
+ 1);
586 for (i
= 0; i
< len
; i
++) {
587 if (data
[i
] >= 32 && data
[i
] < 127)
590 snprintf(pos
, 5, "{%02x}", data
[i
]);
595 hostapd_logger(hapd
, sm
->addr
,
596 HOSTAPD_MODULE_IEEE8021X
,
598 "STA identity '%s'", buf
);
602 sm
->rx_identity
= TRUE
;
603 sm
->dot1xAuthEapolRespIdFramesRx
++;
605 /* Save station identity for future RADIUS packets */
607 sm
->identity
= malloc(len
+ 1);
609 memcpy(sm
->identity
, data
, len
);
610 sm
->identity
[len
] = '\0';
611 sm
->identity_len
= len
;
614 sm
->dot1xAuthEapolRespFramesRx
++;
620 /* Process incoming EAP packet from Supplicant */
621 static void handle_eap(hostapd
*hapd
, struct sta_info
*sta
, u8
*buf
,
627 if (len
< sizeof(*eap
)) {
628 printf(" too short EAP packet\n");
632 eap
= (struct eap_hdr
*) buf
;
634 eap_len
= ntohs(eap
->length
);
635 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
,
636 " EAP: code=%d identifier=%d length=%d",
637 eap
->code
, eap
->identifier
, eap_len
);
638 if (eap_len
< sizeof(*eap
)) {
639 printf(" Invalid EAP length\n");
641 } else if (eap_len
> len
) {
642 printf(" Too short frame to contain this EAP packet\n");
644 } else if (eap_len
< len
) {
645 printf(" Ignoring %lu extra bytes after EAP packet\n",
646 (unsigned long) len
- eap_len
);
649 eap_len
-= sizeof(*eap
);
652 case EAP_CODE_REQUEST
:
653 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
, " (request)\n");
655 case EAP_CODE_RESPONSE
:
656 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
, " (response)\n");
657 handle_eap_response(hapd
, sta
, eap
, (u8
*) (eap
+ 1), eap_len
);
659 case EAP_CODE_SUCCESS
:
660 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
, " (success)\n");
662 case EAP_CODE_FAILURE
:
663 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
, " (failure)\n");
666 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
, " (unknown code)\n");
672 /* Process the EAPOL frames from the Supplicant */
673 void ieee802_1x_receive(struct hostapd_data
*hapd
, const u8
*sa
, const u8
*buf
,
676 struct sta_info
*sta
;
677 struct ieee802_1x_hdr
*hdr
;
678 struct ieee802_1x_eapol_key
*key
;
681 if (!hapd
->conf
->ieee802_1x
&& !hapd
->conf
->wpa
)
684 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
,
685 "IEEE 802.1X: %lu bytes from " MACSTR
"\n",
686 (unsigned long) len
, MAC2STR(sa
));
687 sta
= ap_get_sta(hapd
, sa
);
689 printf(" no station information available\n");
693 if (len
< sizeof(*hdr
)) {
694 printf(" too short IEEE 802.1X packet\n");
698 hdr
= (struct ieee802_1x_hdr
*) buf
;
699 datalen
= ntohs(hdr
->length
);
700 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
,
701 " IEEE 802.1X: version=%d type=%d length=%d\n",
702 hdr
->version
, hdr
->type
, datalen
);
704 if (len
- sizeof(*hdr
) < datalen
) {
705 printf(" frame too short for this IEEE 802.1X packet\n");
707 sta
->eapol_sm
->dot1xAuthEapLengthErrorFramesRx
++;
710 if (len
- sizeof(*hdr
) > datalen
) {
711 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
,
712 " ignoring %lu extra octets after IEEE 802.1X "
714 (unsigned long) len
- sizeof(*hdr
) - datalen
);
718 sta
->eapol_sm
->dot1xAuthLastEapolFrameVersion
= hdr
->version
;
719 sta
->eapol_sm
->dot1xAuthEapolFramesRx
++;
722 key
= (struct ieee802_1x_eapol_key
*) (hdr
+ 1);
723 if (datalen
>= sizeof(struct ieee802_1x_eapol_key
) &&
724 hdr
->type
== IEEE802_1X_TYPE_EAPOL_KEY
&&
725 (key
->type
== EAPOL_KEY_TYPE_WPA
||
726 key
->type
== EAPOL_KEY_TYPE_RSN
)) {
727 wpa_receive(hapd
, sta
, (u8
*) hdr
, sizeof(*hdr
) + datalen
);
731 if (!hapd
->conf
->ieee802_1x
|| sta
->wpa_key_mgmt
== WPA_KEY_MGMT_PSK
)
734 if (!sta
->eapol_sm
) {
735 sta
->eapol_sm
= eapol_sm_alloc(hapd
, sta
);
740 /* since we support version 1, we can ignore version field and proceed
741 * as specified in version 1 standard [IEEE Std 802.1X-2001, 7.5.5] */
742 /* TODO: actually, we are not version 1 anymore.. However, Version 2
743 * does not change frame contents, so should be ok to process frames
744 * more or less identically. Some changes might be needed for
745 * verification of fields. */
748 case IEEE802_1X_TYPE_EAP_PACKET
:
749 handle_eap(hapd
, sta
, (u8
*) (hdr
+ 1), datalen
);
752 case IEEE802_1X_TYPE_EAPOL_START
:
753 hostapd_logger(hapd
, sta
->addr
, HOSTAPD_MODULE_IEEE8021X
,
754 HOSTAPD_LEVEL_DEBUG
, "received EAPOL-Start "
757 hostapd_logger(hapd
, sta
->addr
, HOSTAPD_MODULE_WPA
,
758 HOSTAPD_LEVEL_DEBUG
, "cached PMKSA "
759 "available - ignore it since "
760 "STA sent EAPOL-Start");
763 sta
->eapol_sm
->auth_pae
.eapolStart
= TRUE
;
764 sta
->eapol_sm
->dot1xAuthEapolStartFramesRx
++;
765 wpa_sm_event(hapd
, sta
, WPA_REAUTH_EAPOL
);
768 case IEEE802_1X_TYPE_EAPOL_LOGOFF
:
769 hostapd_logger(hapd
, sta
->addr
, HOSTAPD_MODULE_IEEE8021X
,
770 HOSTAPD_LEVEL_DEBUG
, "received EAPOL-Logoff "
772 sta
->acct_terminate_cause
=
773 RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST
;
774 sta
->eapol_sm
->auth_pae
.eapolLogoff
= TRUE
;
775 sta
->eapol_sm
->dot1xAuthEapolLogoffFramesRx
++;
778 case IEEE802_1X_TYPE_EAPOL_KEY
:
779 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
, " EAPOL-Key\n");
780 if (!(sta
->flags
& WLAN_STA_AUTHORIZED
)) {
781 printf(" Dropped key data from unauthorized "
787 case IEEE802_1X_TYPE_EAPOL_ENCAPSULATED_ASF_ALERT
:
788 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
,
789 " EAPOL-Encapsulated-ASF-Alert\n");
790 /* TODO: implement support for this; show data */
794 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
,
795 " unknown IEEE 802.1X packet type\n");
796 sta
->eapol_sm
->dot1xAuthInvalidEapolFramesRx
++;
800 eapol_sm_step(sta
->eapol_sm
);
804 void ieee802_1x_new_station(hostapd
*hapd
, struct sta_info
*sta
)
806 if (!hapd
->conf
->ieee802_1x
|| sta
->wpa_key_mgmt
== WPA_KEY_MGMT_PSK
)
809 if (sta
->eapol_sm
== NULL
) {
810 hostapd_logger(hapd
, sta
->addr
, HOSTAPD_MODULE_IEEE8021X
,
811 HOSTAPD_LEVEL_DEBUG
, "start authentication");
812 sta
->eapol_sm
= eapol_sm_alloc(hapd
, sta
);
813 if (sta
->eapol_sm
== NULL
) {
814 hostapd_logger(hapd
, sta
->addr
,
815 HOSTAPD_MODULE_IEEE8021X
,
817 "failed to allocate state machine");
822 sta
->eapol_sm
->portEnabled
= TRUE
;
825 hostapd_logger(hapd
, sta
->addr
, HOSTAPD_MODULE_IEEE8021X
,
827 "PMK from PMKSA cache - skip IEEE 802.1X/EAP");
828 /* Setup EAPOL state machines to already authenticated state
829 * because of existing PMKSA information in the cache. */
830 sta
->eapol_sm
->keyRun
= TRUE
;
831 sta
->eapol_sm
->keyAvailable
= TRUE
;
832 sta
->eapol_sm
->auth_pae
.state
= AUTH_PAE_AUTHENTICATING
;
833 sta
->eapol_sm
->be_auth
.state
= BE_AUTH_SUCCESS
;
834 sta
->eapol_sm
->authSuccess
= TRUE
;
835 if (sta
->eapol_sm
->eap
)
836 eap_sm_notify_cached(sta
->eapol_sm
->eap
);
838 eapol_sm_step(sta
->eapol_sm
);
842 void ieee802_1x_free_radius_class(struct radius_class_data
*class)
847 for (i
= 0; i
< class->count
; i
++)
848 free(class->attr
[i
].data
);
855 int ieee802_1x_copy_radius_class(struct radius_class_data
*dst
,
856 struct radius_class_data
*src
)
860 if (src
->attr
== NULL
)
863 dst
->attr
= malloc(src
->count
* sizeof(struct radius_attr_data
));
864 if (dst
->attr
== NULL
)
867 memset(dst
->attr
, 0, src
->count
* sizeof(struct radius_attr_data
));
870 for (i
= 0; i
< src
->count
; i
++) {
871 dst
->attr
[i
].data
= malloc(src
->attr
[i
].len
);
872 if (dst
->attr
[i
].data
== NULL
)
875 memcpy(dst
->attr
[i
].data
, src
->attr
[i
].data
, src
->attr
[i
].len
);
876 dst
->attr
[i
].len
= src
->attr
[i
].len
;
883 void ieee802_1x_free_station(struct sta_info
*sta
)
885 struct eapol_state_machine
*sm
= sta
->eapol_sm
;
887 eloop_cancel_timeout(ieee802_1x_eap_timeout
, sta
, NULL
);
892 sta
->eapol_sm
= NULL
;
894 if (sm
->last_recv_radius
) {
895 radius_msg_free(sm
->last_recv_radius
);
896 free(sm
->last_recv_radius
);
899 free(sm
->last_eap_supp
);
900 free(sm
->last_eap_radius
);
902 ieee802_1x_free_radius_class(&sm
->radius_class
);
903 free(sm
->eapol_key_sign
);
904 free(sm
->eapol_key_crypt
);
909 static void ieee802_1x_decapsulate_radius(hostapd
*hapd
, struct sta_info
*sta
)
916 struct radius_msg
*msg
;
917 struct eapol_state_machine
*sm
= sta
->eapol_sm
;
919 if (sm
== NULL
|| sm
->last_recv_radius
== NULL
) {
921 sm
->be_auth
.eapNoReq
= TRUE
;
925 msg
= sm
->last_recv_radius
;
927 eap
= radius_msg_get_eap(msg
, &len
);
929 /* draft-aboba-radius-rfc2869bis-20.txt, Chap. 2.6.3:
930 * RADIUS server SHOULD NOT send Access-Reject/no EAP-Message
932 hostapd_logger(hapd
, sta
->addr
, HOSTAPD_MODULE_IEEE8021X
,
933 HOSTAPD_LEVEL_WARNING
, "could not extract "
934 "EAP-Message from RADIUS message");
935 free(sm
->last_eap_radius
);
936 sm
->last_eap_radius
= NULL
;
937 sm
->last_eap_radius_len
= 0;
938 sm
->be_auth
.eapNoReq
= TRUE
;
942 if (len
< sizeof(*hdr
)) {
943 hostapd_logger(hapd
, sta
->addr
, HOSTAPD_MODULE_IEEE8021X
,
944 HOSTAPD_LEVEL_WARNING
, "too short EAP packet "
945 "received from authentication server");
947 sm
->be_auth
.eapNoReq
= TRUE
;
951 if (len
> sizeof(*hdr
))
952 eap_type
= eap
[sizeof(*hdr
)];
954 hdr
= (struct eap_hdr
*) eap
;
956 case EAP_CODE_REQUEST
:
957 snprintf(buf
, sizeof(buf
), "EAP-Request-%s (%d)",
958 eap_type
>= 0 ? eap_type_text(eap_type
) : "??",
961 case EAP_CODE_RESPONSE
:
962 snprintf(buf
, sizeof(buf
), "EAP Response-%s (%d)",
963 eap_type
>= 0 ? eap_type_text(eap_type
) : "??",
966 case EAP_CODE_SUCCESS
:
967 snprintf(buf
, sizeof(buf
), "EAP Success");
969 case EAP_CODE_FAILURE
:
970 snprintf(buf
, sizeof(buf
), "EAP Failure");
973 snprintf(buf
, sizeof(buf
), "unknown EAP code");
976 hostapd_logger(hapd
, sta
->addr
, HOSTAPD_MODULE_IEEE8021X
,
977 HOSTAPD_LEVEL_DEBUG
, "decapsulated EAP packet (code=%d "
978 "id=%d len=%d) from RADIUS server: %s",
979 hdr
->code
, hdr
->identifier
, ntohs(hdr
->length
), buf
);
980 sm
->be_auth
.eapReq
= TRUE
;
982 free(sm
->last_eap_radius
);
983 sm
->last_eap_radius
= eap
;
984 sm
->last_eap_radius_len
= len
;
988 static void ieee802_1x_get_keys(hostapd
*hapd
, struct sta_info
*sta
,
989 struct radius_msg
*msg
, struct radius_msg
*req
,
990 u8
*shared_secret
, size_t shared_secret_len
)
992 struct radius_ms_mppe_keys
*keys
;
993 struct eapol_state_machine
*sm
= sta
->eapol_sm
;
997 keys
= radius_msg_get_ms_keys(msg
, req
, shared_secret
,
1001 if (HOSTAPD_DEBUG_COND(HOSTAPD_DEBUG_MINIMAL
) && keys
->send
) {
1003 printf("MS-MPPE-Send-Key (len=%lu):",
1004 (unsigned long) keys
->send_len
);
1005 for (i
= 0; i
< keys
->send_len
; i
++)
1006 printf(" %02x", keys
->send
[i
]);
1009 if (HOSTAPD_DEBUG_COND(HOSTAPD_DEBUG_MINIMAL
) && keys
->recv
) {
1011 printf("MS-MPPE-Recv-Key (len=%lu):",
1012 (unsigned long) keys
->recv_len
);
1013 for (i
= 0; i
< keys
->recv_len
; i
++)
1014 printf(" %02x", keys
->recv
[i
]);
1018 if (keys
->send
&& keys
->recv
) {
1019 free(sm
->eapol_key_sign
);
1020 free(sm
->eapol_key_crypt
);
1021 sm
->eapol_key_sign
= keys
->send
;
1022 sm
->eapol_key_sign_len
= keys
->send_len
;
1023 sm
->eapol_key_crypt
= keys
->recv
;
1024 sm
->eapol_key_crypt_len
= keys
->recv_len
;
1025 if (hapd
->default_wep_key
||
1026 hapd
->conf
->individual_wep_key_len
> 0 ||
1028 sta
->eapol_sm
->keyAvailable
= TRUE
;
1038 static void ieee802_1x_store_radius_class(struct hostapd_data
*hapd
,
1039 struct sta_info
*sta
,
1040 struct radius_msg
*msg
)
1044 struct eapol_state_machine
*sm
= sta
->eapol_sm
;
1046 struct radius_attr_data
*nclass
;
1047 size_t nclass_count
;
1049 if (!hapd
->conf
->radius
->acct_server
|| hapd
->radius
== NULL
||
1053 ieee802_1x_free_radius_class(&sm
->radius_class
);
1054 count
= radius_msg_count_attr(msg
, RADIUS_ATTR_CLASS
, 1);
1058 nclass
= malloc(count
* sizeof(struct radius_attr_data
));
1063 memset(nclass
, 0, count
* sizeof(struct radius_attr_data
));
1066 for (i
= 0; i
< count
; i
++) {
1068 if (radius_msg_get_attr_ptr(msg
, RADIUS_ATTR_CLASS
,
1074 } while (class_len
< 1);
1076 nclass
[nclass_count
].data
= malloc(class_len
);
1077 if (nclass
[nclass_count
].data
== NULL
)
1080 memcpy(nclass
[nclass_count
].data
, class, class_len
);
1081 nclass
[nclass_count
].len
= class_len
;
1085 sm
->radius_class
.attr
= nclass
;
1086 sm
->radius_class
.count
= nclass_count
;
1087 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
, "IEEE 802.1X: Stored %lu RADIUS "
1088 "Class attributes for " MACSTR
"\n",
1089 (unsigned long) sm
->radius_class
.count
,
1090 MAC2STR(sta
->addr
));
1094 /* Update sta->identity based on User-Name attribute in Access-Accept */
1095 static void ieee802_1x_update_sta_identity(struct hostapd_data
*hapd
,
1096 struct sta_info
*sta
,
1097 struct radius_msg
*msg
)
1101 struct eapol_state_machine
*sm
= sta
->eapol_sm
;
1106 if (radius_msg_get_attr_ptr(msg
, RADIUS_ATTR_USER_NAME
, &buf
, &len
,
1110 identity
= malloc(len
+ 1);
1111 if (identity
== NULL
)
1114 memcpy(identity
, buf
, len
);
1115 identity
[len
] = '\0';
1117 hostapd_logger(hapd
, sta
->addr
, HOSTAPD_MODULE_IEEE8021X
,
1118 HOSTAPD_LEVEL_DEBUG
, "old identity '%s' updated with "
1119 "User-Name from Access-Accept '%s'",
1120 sm
->identity
? (char *) sm
->identity
: "N/A",
1124 sm
->identity
= identity
;
1125 sm
->identity_len
= len
;
1129 struct sta_id_search
{
1131 struct eapol_state_machine
*sm
;
1135 static int ieee802_1x_select_radius_identifier(struct hostapd_data
*hapd
,
1136 struct sta_info
*sta
,
1139 struct sta_id_search
*id_search
= ctx
;
1140 struct eapol_state_machine
*sm
= sta
->eapol_sm
;
1142 if (sm
&& sm
->radius_identifier
>= 0 &&
1143 sm
->radius_identifier
== id_search
->identifier
) {
1151 static struct eapol_state_machine
*
1152 ieee802_1x_search_radius_identifier(struct hostapd_data
*hapd
, u8 identifier
)
1154 struct sta_id_search id_search
;
1155 id_search
.identifier
= identifier
;
1156 id_search
.sm
= NULL
;
1157 ap_for_each_sta(hapd
, ieee802_1x_select_radius_identifier
, &id_search
);
1158 return id_search
.sm
;
1162 /* Process the RADIUS frames from Authentication Server */
1163 static RadiusRxResult
1164 ieee802_1x_receive_auth(struct radius_msg
*msg
, struct radius_msg
*req
,
1165 u8
*shared_secret
, size_t shared_secret_len
,
1168 struct hostapd_data
*hapd
= data
;
1169 struct sta_info
*sta
;
1170 u32 session_timeout
= 0, termination_action
, acct_interim_interval
;
1171 int session_timeout_set
;
1173 struct eapol_state_machine
*sm
;
1174 int override_eapReq
= 0;
1176 sm
= ieee802_1x_search_radius_identifier(hapd
, msg
->hdr
->identifier
);
1178 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
, "IEEE 802.1X: Could not "
1179 "find matching station for this RADIUS "
1181 return RADIUS_RX_UNKNOWN
;
1185 /* RFC 2869, Ch. 5.13: valid Message-Authenticator attribute MUST be
1186 * present when packet contains an EAP-Message attribute */
1187 if (msg
->hdr
->code
== RADIUS_CODE_ACCESS_REJECT
&&
1188 radius_msg_get_attr(msg
, RADIUS_ATTR_MESSAGE_AUTHENTICATOR
, NULL
,
1190 radius_msg_get_attr(msg
, RADIUS_ATTR_EAP_MESSAGE
, NULL
, 0) < 0) {
1191 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
, "Allowing RADIUS "
1192 "Access-Reject without Message-Authenticator "
1193 "since it does not include EAP-Message\n");
1194 } else if (radius_msg_verify(msg
, shared_secret
, shared_secret_len
,
1196 printf("Incoming RADIUS packet did not have correct "
1197 "Message-Authenticator - dropped\n");
1198 return RADIUS_RX_INVALID_AUTHENTICATOR
;
1201 if (msg
->hdr
->code
!= RADIUS_CODE_ACCESS_ACCEPT
&&
1202 msg
->hdr
->code
!= RADIUS_CODE_ACCESS_REJECT
&&
1203 msg
->hdr
->code
!= RADIUS_CODE_ACCESS_CHALLENGE
) {
1204 printf("Unknown RADIUS message code\n");
1205 return RADIUS_RX_UNKNOWN
;
1208 sm
->radius_identifier
= -1;
1209 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
,
1210 "RADIUS packet matching with station " MACSTR
"\n",
1211 MAC2STR(sta
->addr
));
1213 if (sm
->last_recv_radius
) {
1214 radius_msg_free(sm
->last_recv_radius
);
1215 free(sm
->last_recv_radius
);
1218 sm
->last_recv_radius
= msg
;
1220 session_timeout_set
=
1221 !radius_msg_get_attr_int32(msg
, RADIUS_ATTR_SESSION_TIMEOUT
,
1223 if (radius_msg_get_attr_int32(msg
, RADIUS_ATTR_TERMINATION_ACTION
,
1224 &termination_action
))
1225 termination_action
= RADIUS_TERMINATION_ACTION_DEFAULT
;
1227 if (hapd
->conf
->radius
->acct_interim_interval
== 0 &&
1228 msg
->hdr
->code
== RADIUS_CODE_ACCESS_ACCEPT
&&
1229 radius_msg_get_attr_int32(msg
, RADIUS_ATTR_ACCT_INTERIM_INTERVAL
,
1230 &acct_interim_interval
) == 0) {
1231 if (acct_interim_interval
< 60) {
1232 hostapd_logger(hapd
, sta
->addr
,
1233 HOSTAPD_MODULE_IEEE8021X
,
1235 "ignored too small "
1236 "Acct-Interim-Interval %d",
1237 acct_interim_interval
);
1239 sta
->acct_interim_interval
= acct_interim_interval
;
1243 switch (msg
->hdr
->code
) {
1244 case RADIUS_CODE_ACCESS_ACCEPT
:
1245 /* RFC 3580, Ch. 3.17 */
1246 if (session_timeout_set
&& termination_action
==
1247 RADIUS_TERMINATION_ACTION_RADIUS_REQUEST
) {
1248 sm
->reauth_timer
.reAuthPeriod
= session_timeout
;
1249 } else if (session_timeout_set
)
1250 ap_sta_session_timeout(hapd
, sta
, session_timeout
);
1252 sm
->eapSuccess
= TRUE
;
1253 override_eapReq
= 1;
1254 ieee802_1x_get_keys(hapd
, sta
, msg
, req
, shared_secret
,
1256 ieee802_1x_store_radius_class(hapd
, sta
, msg
);
1257 ieee802_1x_update_sta_identity(hapd
, sta
, msg
);
1258 if (sm
->keyAvailable
) {
1259 pmksa_cache_add(hapd
, sta
, sm
->eapol_key_crypt
,
1260 session_timeout_set
?
1261 session_timeout
: -1);
1264 case RADIUS_CODE_ACCESS_REJECT
:
1266 override_eapReq
= 1;
1268 case RADIUS_CODE_ACCESS_CHALLENGE
:
1269 if (session_timeout_set
) {
1270 /* RFC 2869, Ch. 2.3.2; RFC 3580, Ch. 3.17 */
1271 eap_timeout
= session_timeout
;
1274 hostapd_logger(hapd
, sm
->addr
, HOSTAPD_MODULE_IEEE8021X
,
1275 HOSTAPD_LEVEL_DEBUG
,
1276 "using EAP timeout of %d seconds%s",
1278 session_timeout_set
? " (from RADIUS)" : "");
1279 eloop_cancel_timeout(ieee802_1x_eap_timeout
, sta
, NULL
);
1280 eloop_register_timeout(eap_timeout
, 0, ieee802_1x_eap_timeout
,
1282 sm
->eapTimeout
= FALSE
;
1286 ieee802_1x_decapsulate_radius(hapd
, sta
);
1287 if (override_eapReq
)
1288 sm
->be_auth
.eapReq
= FALSE
;
1292 return RADIUS_RX_QUEUED
;
1296 /* Handler for EAPOL Backend Authentication state machine sendRespToServer.
1297 * Forward the EAP Response from Supplicant to Authentication Server. */
1298 void ieee802_1x_send_resp_to_server(hostapd
*hapd
, struct sta_info
*sta
)
1300 struct eapol_state_machine
*sm
= sta
->eapol_sm
;
1304 if (hapd
->conf
->eap_server
) {
1305 eap_set_eapRespData(sm
->eap
, sm
->last_eap_supp
,
1306 sm
->last_eap_supp_len
);
1308 ieee802_1x_encapsulate_radius(hapd
, sta
, sm
->last_eap_supp
,
1309 sm
->last_eap_supp_len
);
1314 void ieee802_1x_abort_auth(struct hostapd_data
*hapd
, struct sta_info
*sta
)
1316 struct eapol_state_machine
*sm
= sta
->eapol_sm
;
1320 hostapd_logger(hapd
, sta
->addr
, HOSTAPD_MODULE_IEEE8021X
,
1321 HOSTAPD_LEVEL_DEBUG
, "aborting authentication");
1323 if (sm
->last_recv_radius
) {
1324 radius_msg_free(sm
->last_recv_radius
);
1325 free(sm
->last_recv_radius
);
1326 sm
->last_recv_radius
= NULL
;
1328 free(sm
->last_eap_supp
);
1329 sm
->last_eap_supp
= NULL
;
1330 sm
->last_eap_supp_len
= 0;
1331 free(sm
->last_eap_radius
);
1332 sm
->last_eap_radius
= NULL
;
1333 sm
->last_eap_radius_len
= 0;
1337 void ieee802_1x_set_port_enabled(hostapd
*hapd
, struct sta_info
*sta
,
1343 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
,
1344 "IEEE 802.1X: station " MACSTR
" port %s\n",
1345 MAC2STR(sta
->addr
), enabled
? "enabled" : "disabled");
1346 sta
->eapol_sm
->portEnabled
= enabled
? TRUE
: FALSE
;
1347 eapol_sm_step(sta
->eapol_sm
);
1351 #ifdef HOSTAPD_DUMP_STATE
1352 void ieee802_1x_dump_state(FILE *f
, const char *prefix
, struct sta_info
*sta
)
1354 struct eapol_state_machine
*sm
= sta
->eapol_sm
;
1358 fprintf(f
, "%sIEEE 802.1X:\n", prefix
);
1362 fprintf(f
, "%sidentity=", prefix
);
1363 for (i
= 0; i
< sm
->identity_len
; i
++)
1364 fprint_char(f
, sm
->identity
[i
]);
1368 fprintf(f
, "%scached_packets=%s%s%s\n", prefix
,
1369 sm
->last_recv_radius
? "[RX RADIUS]" : "",
1370 sm
->last_eap_radius
? "[EAP RADIUS]" : "",
1371 sm
->last_eap_supp
? "[EAP SUPPLICANT]" : "");
1373 eapol_sm_dump_state(f
, prefix
, sm
);
1375 #endif /* HOSTAPD_DUMP_STATE */
1378 static int ieee802_1x_rekey_broadcast(hostapd
*hapd
)
1380 if (hapd
->conf
->default_wep_key_len
< 1)
1383 free(hapd
->default_wep_key
);
1384 hapd
->default_wep_key
= malloc(hapd
->conf
->default_wep_key_len
);
1385 if (hapd
->default_wep_key
== NULL
||
1386 hostapd_get_rand(hapd
->default_wep_key
,
1387 hapd
->conf
->default_wep_key_len
)) {
1388 printf("Could not generate random WEP key.\n");
1389 free(hapd
->default_wep_key
);
1390 hapd
->default_wep_key
= NULL
;
1394 if (HOSTAPD_DEBUG_COND(HOSTAPD_DEBUG_MINIMAL
)) {
1395 hostapd_hexdump("IEEE 802.1X: New default WEP key",
1396 hapd
->default_wep_key
,
1397 hapd
->conf
->default_wep_key_len
);
1404 static int ieee802_1x_sta_key_available(struct hostapd_data
*hapd
,
1405 struct sta_info
*sta
, void *ctx
)
1407 if (sta
->eapol_sm
) {
1408 sta
->eapol_sm
->keyAvailable
= TRUE
;
1409 eapol_sm_step(sta
->eapol_sm
);
1415 static void ieee802_1x_rekey(void *eloop_ctx
, void *timeout_ctx
)
1417 struct hostapd_data
*hapd
= eloop_ctx
;
1419 if (hapd
->default_wep_key_idx
>= 3)
1420 hapd
->default_wep_key_idx
=
1421 hapd
->conf
->individual_wep_key_len
> 0 ? 1 : 0;
1423 hapd
->default_wep_key_idx
++;
1425 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
, "IEEE 802.1X: New default WEP "
1426 "key index %d\n", hapd
->default_wep_key_idx
);
1428 if (ieee802_1x_rekey_broadcast(hapd
)) {
1429 hostapd_logger(hapd
, NULL
, HOSTAPD_MODULE_IEEE8021X
,
1430 HOSTAPD_LEVEL_WARNING
, "failed to generate a "
1431 "new broadcast key");
1432 free(hapd
->default_wep_key
);
1433 hapd
->default_wep_key
= NULL
;
1437 /* TODO: Could setup key for RX here, but change default TX keyid only
1438 * after new broadcast key has been sent to all stations. */
1439 if (hostapd_set_encryption(hapd
, "WEP", NULL
,
1440 hapd
->default_wep_key_idx
,
1441 hapd
->default_wep_key
,
1442 hapd
->conf
->default_wep_key_len
)) {
1443 hostapd_logger(hapd
, NULL
, HOSTAPD_MODULE_IEEE8021X
,
1444 HOSTAPD_LEVEL_WARNING
, "failed to configure a "
1445 "new broadcast key");
1446 free(hapd
->default_wep_key
);
1447 hapd
->default_wep_key
= NULL
;
1451 ap_for_each_sta(hapd
, ieee802_1x_sta_key_available
, NULL
);
1453 if (hapd
->conf
->wep_rekeying_period
> 0) {
1454 eloop_register_timeout(hapd
->conf
->wep_rekeying_period
, 0,
1455 ieee802_1x_rekey
, hapd
, NULL
);
1460 int ieee802_1x_init(hostapd
*hapd
)
1464 if ((hapd
->conf
->ieee802_1x
|| hapd
->conf
->wpa
) &&
1465 hostapd_set_ieee8021x(hapd
, 1))
1468 if (radius_client_register(hapd
->radius
, RADIUS_AUTH
,
1469 ieee802_1x_receive_auth
, hapd
))
1472 if (hapd
->conf
->default_wep_key_len
) {
1473 for (i
= 0; i
< 4; i
++)
1474 hostapd_set_encryption(hapd
, "none", NULL
, i
, NULL
, 0);
1476 ieee802_1x_rekey(hapd
, NULL
);
1478 if (hapd
->default_wep_key
== NULL
)
1486 void ieee802_1x_deinit(hostapd
*hapd
)
1488 if (hapd
->driver
!= NULL
&&
1489 (hapd
->conf
->ieee802_1x
|| hapd
->conf
->wpa
))
1490 hostapd_set_ieee8021x(hapd
, 0);
1494 static void ieee802_1x_new_auth_session(struct hostapd_data
*hapd
,
1495 struct sta_info
*sta
)
1497 struct eapol_state_machine
*sm
= sta
->eapol_sm
;
1501 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
,
1502 "IEEE 802.1X: station " MACSTR
" - new auth session, "
1503 "clearing State\n", MAC2STR(sta
->addr
));
1505 if (sm
->last_recv_radius
) {
1506 radius_msg_free(sm
->last_recv_radius
);
1507 free(sm
->last_recv_radius
);
1508 sm
->last_recv_radius
= NULL
;
1511 sm
->eapSuccess
= FALSE
;
1512 sm
->eapFail
= FALSE
;
1516 int ieee802_1x_tx_status(hostapd
*hapd
, struct sta_info
*sta
, u8
*buf
,
1517 size_t len
, int ack
)
1519 struct ieee80211_hdr
*hdr
;
1520 struct ieee802_1x_hdr
*xhdr
;
1521 struct ieee802_1x_eapol_key
*key
;
1526 if (len
< sizeof(*hdr
) + sizeof(rfc1042_header
) + 2 + sizeof(*xhdr
))
1529 hdr
= (struct ieee80211_hdr
*) buf
;
1530 pos
= (u8
*) (hdr
+ 1);
1531 if (memcmp(pos
, rfc1042_header
, sizeof(rfc1042_header
)) != 0)
1533 pos
+= sizeof(rfc1042_header
);
1534 if (((pos
[0] << 8) | pos
[1]) != ETH_P_PAE
)
1538 xhdr
= (struct ieee802_1x_hdr
*) pos
;
1539 pos
+= sizeof(*xhdr
);
1541 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL
, "IEEE 802.1X: " MACSTR
1542 " TX status - version=%d type=%d length=%d - ack=%d\n",
1543 MAC2STR(sta
->addr
), xhdr
->version
, xhdr
->type
,
1544 ntohs(xhdr
->length
), ack
);
1546 /* EAPOL EAP-Packet packets are eventually re-sent by either Supplicant
1547 * or Authenticator state machines, but EAPOL-Key packets are not
1548 * retransmitted in case of failure. Try to re-sent failed EAPOL-Key
1549 * packets couple of times because otherwise STA keys become
1550 * unsynchronized with AP. */
1551 if (xhdr
->type
== IEEE802_1X_TYPE_EAPOL_KEY
&& !ack
&&
1552 pos
+ sizeof(*key
) <= buf
+ len
) {
1553 key
= (struct ieee802_1x_eapol_key
*) pos
;
1554 hostapd_logger(hapd
, sta
->addr
, HOSTAPD_MODULE_IEEE8021X
,
1555 HOSTAPD_LEVEL_DEBUG
, "did not Ack EAPOL-Key "
1556 "frame (%scast index=%d)",
1557 key
->key_index
& BIT(7) ? "uni" : "broad",
1558 key
->key_index
& ~BIT(7));
1559 /* TODO: re-send EAPOL-Key couple of times (with short delay
1560 * between them?). If all attempt fail, report error and
1561 * deauthenticate STA so that it will get new keys when
1562 * authenticating again (e.g., after returning in range).
1563 * Separate limit/transmit state needed both for unicast and
1564 * broadcast keys(?) */
1566 /* TODO: could move unicast key configuration from ieee802_1x_tx_key()
1567 * to here and change the key only if the EAPOL-Key packet was Acked.
1574 u8
* ieee802_1x_get_identity(struct eapol_state_machine
*sm
, size_t *len
)
1576 if (sm
== NULL
|| sm
->identity
== NULL
)
1579 *len
= sm
->identity_len
;
1580 return sm
->identity
;
1584 u8
* ieee802_1x_get_radius_class(struct eapol_state_machine
*sm
, size_t *len
,
1587 if (sm
== NULL
|| sm
->radius_class
.attr
== NULL
||
1588 idx
>= sm
->radius_class
.count
)
1591 *len
= sm
->radius_class
.attr
[idx
].len
;
1592 return sm
->radius_class
.attr
[idx
].data
;
1596 u8
* ieee802_1x_get_key_crypt(struct eapol_state_machine
*sm
, size_t *len
)
1601 *len
= sm
->eapol_key_crypt_len
;
1602 return sm
->eapol_key_crypt
;
1606 void ieee802_1x_notify_port_enabled(struct eapol_state_machine
*sm
,
1611 sm
->portEnabled
= enabled
? TRUE
: FALSE
;
1616 void ieee802_1x_notify_port_valid(struct eapol_state_machine
*sm
,
1621 sm
->portValid
= valid
? TRUE
: FALSE
;
1626 void ieee802_1x_notify_pre_auth(struct eapol_state_machine
*sm
, int pre_auth
)
1631 sm
->flags
|= EAPOL_SM_PREAUTH
;
1633 sm
->flags
&= ~EAPOL_SM_PREAUTH
;
1637 static const char * bool_txt(Boolean
bool)
1639 return bool ? "TRUE" : "FALSE";
1643 int ieee802_1x_get_mib(struct hostapd_data
*hapd
, char *buf
, size_t buflen
)
1650 int ieee802_1x_get_mib_sta(struct hostapd_data
*hapd
, struct sta_info
*sta
,
1651 char *buf
, size_t buflen
)
1654 struct eapol_state_machine
*sm
= sta
->eapol_sm
;
1659 len
+= snprintf(buf
+ len
, buflen
- len
,
1660 "dot1xPaePortNumber=%d\n"
1661 "dot1xPaePortProtocolVersion=%d\n"
1662 "dot1xPaePortCapabilities=1\n"
1663 "dot1xPaePortInitialize=%d\n"
1664 "dot1xPaePortReauthenticate=FALSE\n",
1669 /* dot1xAuthConfigTable */
1670 len
+= snprintf(buf
+ len
, buflen
- len
,
1671 "dot1xAuthPaeState=%d\n"
1672 "dot1xAuthBackendAuthState=%d\n"
1673 "dot1xAuthAdminControlledDirections=%d\n"
1674 "dot1xAuthOperControlledDirections=%d\n"
1675 "dot1xAuthAuthControlledPortStatus=%d\n"
1676 "dot1xAuthAuthControlledPortControl=%d\n"
1677 "dot1xAuthQuietPeriod=%u\n"
1678 "dot1xAuthServerTimeout=%u\n"
1679 "dot1xAuthReAuthPeriod=%u\n"
1680 "dot1xAuthReAuthEnabled=%s\n"
1681 "dot1xAuthKeyTxEnabled=%s\n",
1682 sm
->auth_pae
.state
+ 1,
1683 sm
->be_auth
.state
+ 1,
1684 sm
->ctrl_dir
.adminControlledDirections
,
1685 sm
->ctrl_dir
.operControlledDirections
,
1688 sm
->auth_pae
.quietPeriod
,
1689 sm
->be_auth
.serverTimeout
,
1690 sm
->reauth_timer
.reAuthPeriod
,
1691 bool_txt(sm
->reauth_timer
.reAuthEnabled
),
1692 bool_txt(sm
->keyTxEnabled
));
1694 /* dot1xAuthStatsTable */
1695 len
+= snprintf(buf
+ len
, buflen
- len
,
1696 "dot1xAuthEapolFramesRx=%u\n"
1697 "dot1xAuthEapolFramesTx=%u\n"
1698 "dot1xAuthEapolStartFramesRx=%u\n"
1699 "dot1xAuthEapolLogoffFramesRx=%u\n"
1700 "dot1xAuthEapolRespIdFramesRx=%u\n"
1701 "dot1xAuthEapolRespFramesRx=%u\n"
1702 "dot1xAuthEapolReqIdFramesTx=%u\n"
1703 "dot1xAuthEapolReqFramesTx=%u\n"
1704 "dot1xAuthInvalidEapolFramesRx=%u\n"
1705 "dot1xAuthEapLengthErrorFramesRx=%u\n"
1706 "dot1xAuthLastEapolFrameVersion=%u\n"
1707 "dot1xAuthLastEapolFrameSource=" MACSTR
"\n",
1708 sm
->dot1xAuthEapolFramesRx
,
1709 sm
->dot1xAuthEapolFramesTx
,
1710 sm
->dot1xAuthEapolStartFramesRx
,
1711 sm
->dot1xAuthEapolLogoffFramesRx
,
1712 sm
->dot1xAuthEapolRespIdFramesRx
,
1713 sm
->dot1xAuthEapolRespFramesRx
,
1714 sm
->dot1xAuthEapolReqIdFramesTx
,
1715 sm
->dot1xAuthEapolReqFramesTx
,
1716 sm
->dot1xAuthInvalidEapolFramesRx
,
1717 sm
->dot1xAuthEapLengthErrorFramesRx
,
1718 sm
->dot1xAuthLastEapolFrameVersion
,
1721 /* dot1xAuthDiagTable */
1722 len
+= snprintf(buf
+ len
, buflen
- len
,
1723 "dot1xAuthEntersConnecting=%u\n"
1724 "dot1xAuthEapLogoffsWhileConnecting=%u\n"
1725 "dot1xAuthEntersAuthenticating=%u\n"
1726 "dot1xAuthAuthSuccessesWhileAuthenticating=%u\n"
1727 "dot1xAuthAuthTimeoutsWhileAuthenticating=%u\n"
1728 "dot1xAuthAuthFailWhileAuthenticating=%u\n"
1729 "dot1xAuthAuthEapStartsWhileAuthenticating=%u\n"
1730 "dot1xAuthAuthEapLogoffWhileAuthenticating=%u\n"
1731 "dot1xAuthAuthReauthsWhileAuthenticated=%u\n"
1732 "dot1xAuthAuthEapStartsWhileAuthenticated=%u\n"
1733 "dot1xAuthAuthEapLogoffWhileAuthenticated=%u\n"
1734 "dot1xAuthBackendResponses=%u\n"
1735 "dot1xAuthBackendAccessChallenges=%u\n"
1736 "dot1xAuthBackendOtherRequestsToSupplicant=%u\n"
1737 "dot1xAuthBackendAuthSuccesses=%u\n"
1738 "dot1xAuthBackendAuthFails=%u\n",
1739 sm
->auth_pae
.authEntersConnecting
,
1740 sm
->auth_pae
.authEapLogoffsWhileConnecting
,
1741 sm
->auth_pae
.authEntersAuthenticating
,
1742 sm
->auth_pae
.authAuthSuccessesWhileAuthenticating
,
1743 sm
->auth_pae
.authAuthTimeoutsWhileAuthenticating
,
1744 sm
->auth_pae
.authAuthFailWhileAuthenticating
,
1745 sm
->auth_pae
.authAuthEapStartsWhileAuthenticating
,
1746 sm
->auth_pae
.authAuthEapLogoffWhileAuthenticating
,
1747 sm
->auth_pae
.authAuthReauthsWhileAuthenticated
,
1748 sm
->auth_pae
.authAuthEapStartsWhileAuthenticated
,
1749 sm
->auth_pae
.authAuthEapLogoffWhileAuthenticated
,
1750 sm
->be_auth
.backendResponses
,
1751 sm
->be_auth
.backendAccessChallenges
,
1752 sm
->be_auth
.backendOtherRequestsToSupplicant
,
1753 sm
->be_auth
.backendAuthSuccesses
,
1754 sm
->be_auth
.backendAuthFails
);
1756 /* dot1xAuthSessionStatsTable */
1757 len
+= snprintf(buf
+ len
, buflen
- len
,
1758 /* TODO: dot1xAuthSessionOctetsRx */
1759 /* TODO: dot1xAuthSessionOctetsTx */
1760 /* TODO: dot1xAuthSessionFramesRx */
1761 /* TODO: dot1xAuthSessionFramesTx */
1762 "dot1xAuthSessionId=%08X-%08X\n"
1763 "dot1xAuthSessionAuthenticMethod=%d\n"
1764 "dot1xAuthSessionTime=%u\n"
1765 "dot1xAuthSessionTerminateCause=999\n"
1766 "dot1xAuthSessionUserName=%s\n",
1767 sta
->acct_session_id_hi
, sta
->acct_session_id_lo
,
1768 sta
->wpa_key_mgmt
== WPA_KEY_MGMT_IEEE8021X
? 1 : 2,
1769 (unsigned int) (time(NULL
) - sta
->acct_session_start
),
1776 void ieee802_1x_finished(struct hostapd_data
*hapd
, struct sta_info
*sta
,
1781 /* TODO: get PMKLifetime from WPA parameters */
1782 static const int dot11RSNAConfigPMKLifetime
= 43200;
1784 key
= ieee802_1x_get_key_crypt(sta
->eapol_sm
, &len
);
1785 if (success
&& key
) {
1786 pmksa_cache_add(hapd
, sta
, key
, dot11RSNAConfigPMKLifetime
);