DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
hostapd/wpa_supplicant/pasn_supplicant.c

981 lines
25 KiB
C
Raw Normal View History

PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
/*
* wpa_supplicant - PASN processing
*
* Copyright (C) 2019 Intel Corporation
*
* This software may be distributed under the terms of the BSD license.
* See README for more details.
*/
#include "includes.h"
#include "common/ieee802_11_defs.h"
#include "common/ieee802_11_common.h"
#include "common/dragonfly.h"
#include "common/ptksa_cache.h"
#include "utils/eloop.h"
#include "drivers/driver.h"
#include "crypto/crypto.h"
PASN: Support PASN with FILS key derivation As the PASN FILS authentication is only defined for FILS SK without PFS, and to support PASN authentication with FILS, implement the PASN with FILS processing as part of the PASN handling and not as part of the WPA state machine. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:55 +01:00
#include "crypto/random.h"
#include "eap_common/eap_defs.h"
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
#include "rsn_supp/wpa.h"
#include "rsn_supp/pmksa_cache.h"
#include "wpa_supplicant_i.h"
#include "driver_i.h"
#include "bss.h"
PASN: Offload handshake for multiple peers from the driver This brings in the functionality to hold multiple peers and perform PASN authentication with each peer at a time and send the PASN response to the driver. PASN parameters such as AKMP and cipher suite are obtained from the BSS information of the cached scan results. Also add functionality to trigger deauthentication to the peer for which PASN request with action PASN_ACTION_DELETE_SECURE_RANGING_CONTEXT is received. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-26 09:50:48 +02:00
#include "scan.h"
PASN: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:52 +01:00
#include "config.h"
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
static const int dot11RSNAConfigPMKLifetime = 43200;
struct wpa_pasn_auth_work {
Add own MAC address in PASN supplicant start and deauthentication The driver requests PASN authentication for a peer with a specified source (own) MAC address. Use the specified own MAC address for PASN operations. This is needed to allow random MAC addresses to be used. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-20 10:59:49 +01:00
u8 own_addr[ETH_ALEN];
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
u8 peer_addr[ETH_ALEN];
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
int akmp;
int cipher;
u16 group;
PASN: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:52 +01:00
int network_id;
PASN: Add support for comeback flow to wpa_supplicant Process the received comeback cookie and retry automatically if the AP allows this. Otherwise, provide the cookie to upper layers to allow a later attempt with the cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:09 +01:00
struct wpabuf *comeback;
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
};
PASN: Function handler to transmit Authentication frames Introduce a function handler to transmit PASN Authentication frames to the driver. This removes the wpa_s dependency from PASN functionality for sending the frames. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-29 15:01:29 +02:00
static int wpas_pasn_send_mlme(void *ctx, const u8 *data, size_t data_len,
int noack, unsigned int freq, unsigned int wait)
{
struct wpa_supplicant *wpa_s = ctx;
return wpa_drv_send_mlme(wpa_s, data, data_len, noack, freq, wait);
}
PASN: Use a helper function to free radio work data This is safer in avoiding memory leaks now that there is a dynamically allocated member within the data struct. Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-21 17:33:17 +01:00
static void wpas_pasn_free_auth_work(struct wpa_pasn_auth_work *awork)
{
wpabuf_free(awork->comeback);
awork->comeback = NULL;
os_free(awork);
}
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
static void wpas_pasn_auth_work_timeout(void *eloop_ctx, void *timeout_ctx)
{
struct wpa_supplicant *wpa_s = eloop_ctx;
wpa_printf(MSG_DEBUG, "PASN: Auth work timeout - stopping auth");
wpas_pasn_auth_stop(wpa_s);
PASN: Offload handshake for multiple peers from the driver This brings in the functionality to hold multiple peers and perform PASN authentication with each peer at a time and send the PASN response to the driver. PASN parameters such as AKMP and cipher suite are obtained from the BSS information of the cached scan results. Also add functionality to trigger deauthentication to the peer for which PASN request with action PASN_ACTION_DELETE_SECURE_RANGING_CONTEXT is received. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-26 09:50:48 +02:00
wpas_pasn_auth_work_done(wpa_s, PASN_STATUS_FAILURE);
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
}
static void wpas_pasn_cancel_auth_work(struct wpa_supplicant *wpa_s)
{
wpa_printf(MSG_DEBUG, "PASN: Cancel pasn-start-auth work");
/* Remove pending/started work */
radio_remove_works(wpa_s, "pasn-start-auth", 0);
}
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
static void wpas_pasn_auth_status(struct wpa_supplicant *wpa_s,
const u8 *peer_addr,
PASN: Add support for comeback flow to wpa_supplicant Process the received comeback cookie and retry automatically if the AP allows this. Otherwise, provide the cookie to upper layers to allow a later attempt with the cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:09 +01:00
int akmp, int cipher, u8 status,
struct wpabuf *comeback,
u16 comeback_after)
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
{
PASN: Add support for comeback flow to wpa_supplicant Process the received comeback cookie and retry automatically if the AP allows this. Otherwise, provide the cookie to upper layers to allow a later attempt with the cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:09 +01:00
if (comeback) {
size_t comeback_len = wpabuf_len(comeback);
size_t buflen = comeback_len * 2 + 1;
char *comeback_txt = os_malloc(buflen);
if (comeback_txt) {
wpa_snprintf_hex(comeback_txt, buflen,
wpabuf_head(comeback), comeback_len);
wpa_msg(wpa_s, MSG_INFO, PASN_AUTH_STATUS MACSTR
" akmp=%s, status=%u comeback_after=%u comeback=%s",
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
MAC2STR(peer_addr),
PASN: Add support for comeback flow to wpa_supplicant Process the received comeback cookie and retry automatically if the AP allows this. Otherwise, provide the cookie to upper layers to allow a later attempt with the cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:09 +01:00
wpa_key_mgmt_txt(akmp, WPA_PROTO_RSN),
status, comeback_after, comeback_txt);
os_free(comeback_txt);
return;
}
}
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
wpa_msg(wpa_s, MSG_INFO,
PASN_AUTH_STATUS MACSTR " akmp=%s, status=%u",
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
MAC2STR(peer_addr), wpa_key_mgmt_txt(akmp, WPA_PROTO_RSN),
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
status);
}
PASN: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:52 +01:00
#ifdef CONFIG_SAE
PASN: Remove dependency of wpa_ssid for initiator Get ssid and derive required information for SAE and FILS tunneled PASN authentication to remove struct wpa_ssid dependency for PASN initiator. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-07 11:04:48 +02:00
static struct sae_pt *
wpas_pasn_sae_derive_pt(struct wpa_ssid *ssid, int group)
PASN: Change PASN flows to use SAE H2E only Do so for both wpa_supplicant and hostapd. While this was not explicitly required in IEEE P802.11az/D3.0, likely direction for the draft is to start requiring use of H2E for all cases where SAE is used with PASN. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-04-08 11:06:24 +02:00
{
const char *password = ssid->sae_password;
int groups[2] = { group, 0 };
if (!password)
password = ssid->passphrase;
if (!password) {
PASN: Remove dependency of wpa_ssid for initiator Get ssid and derive required information for SAE and FILS tunneled PASN authentication to remove struct wpa_ssid dependency for PASN initiator. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-07 11:04:48 +02:00
wpa_printf(MSG_DEBUG, "PASN: SAE without a password");
return NULL;
}
return sae_derive_pt(groups, ssid->ssid, ssid->ssid_len,
(const u8 *) password, os_strlen(password),
ssid->sae_password_id);
}
static int wpas_pasn_sae_setup_pt(struct wpa_ssid *ssid, int group)
{
if (!ssid->sae_password && !ssid->passphrase) {
PASN: Change PASN flows to use SAE H2E only Do so for both wpa_supplicant and hostapd. While this was not explicitly required in IEEE P802.11az/D3.0, likely direction for the draft is to start requiring use of H2E for all cases where SAE is used with PASN. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-04-08 11:06:24 +02:00
wpa_printf(MSG_DEBUG, "PASN: SAE without a password");
return -1;
}
if (ssid->pt)
return 0; /* PT already derived */
PASN: Remove dependency of wpa_ssid for initiator Get ssid and derive required information for SAE and FILS tunneled PASN authentication to remove struct wpa_ssid dependency for PASN initiator. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-07 11:04:48 +02:00
ssid->pt = wpas_pasn_sae_derive_pt(ssid, group);
PASN: Change PASN flows to use SAE H2E only Do so for both wpa_supplicant and hostapd. While this was not explicitly required in IEEE P802.11az/D3.0, likely direction for the draft is to start requiring use of H2E for all cases where SAE is used with PASN. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-04-08 11:06:24 +02:00
return ssid->pt ? 0 : -1;
}
PASN: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:52 +01:00
#endif /* CONFIG_SAE */
PASN: Offload handshake for multiple peers from the driver This brings in the functionality to hold multiple peers and perform PASN authentication with each peer at a time and send the PASN response to the driver. PASN parameters such as AKMP and cipher suite are obtained from the BSS information of the cached scan results. Also add functionality to trigger deauthentication to the peer for which PASN request with action PASN_ACTION_DELETE_SECURE_RANGING_CONTEXT is received. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-26 09:50:48 +02:00
static int wpas_pasn_get_params_from_bss(struct wpa_supplicant *wpa_s,
struct pasn_peer *peer)
{
int ret;
const u8 *rsne, *rsnxe;
struct wpa_bss *bss;
struct wpa_ie_data rsne_data;
int sel, key_mgmt, pairwise_cipher;
int network_id = 0, group = 19;
struct wpa_ssid *ssid = NULL;
size_t ssid_str_len = 0;
const u8 *ssid_str = NULL;
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
const u8 *peer_addr = peer->peer_addr;
PASN: Offload handshake for multiple peers from the driver This brings in the functionality to hold multiple peers and perform PASN authentication with each peer at a time and send the PASN response to the driver. PASN parameters such as AKMP and cipher suite are obtained from the BSS information of the cached scan results. Also add functionality to trigger deauthentication to the peer for which PASN request with action PASN_ACTION_DELETE_SECURE_RANGING_CONTEXT is received. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-26 09:50:48 +02:00
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
bss = wpa_bss_get_bssid(wpa_s, peer_addr);
PASN: Offload handshake for multiple peers from the driver This brings in the functionality to hold multiple peers and perform PASN authentication with each peer at a time and send the PASN response to the driver. PASN parameters such as AKMP and cipher suite are obtained from the BSS information of the cached scan results. Also add functionality to trigger deauthentication to the peer for which PASN request with action PASN_ACTION_DELETE_SECURE_RANGING_CONTEXT is received. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-26 09:50:48 +02:00
if (!bss) {
Optimize internal BSS table updates based on a specific BSSID When wpa_supplicant needed to update the internal BSS table with the latest scan results from the driver, it fetched all BSSs and processed them all. This is unnecessary for cases where an update is needed only for a specific BSS. Optimize this by filtering out the unnecessary entries from the results. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-20 10:20:43 +01:00
wpa_supplicant_update_scan_results(wpa_s, peer_addr);
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
bss = wpa_bss_get_bssid(wpa_s, peer_addr);
PASN: Offload handshake for multiple peers from the driver This brings in the functionality to hold multiple peers and perform PASN authentication with each peer at a time and send the PASN response to the driver. PASN parameters such as AKMP and cipher suite are obtained from the BSS information of the cached scan results. Also add functionality to trigger deauthentication to the peer for which PASN request with action PASN_ACTION_DELETE_SECURE_RANGING_CONTEXT is received. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-26 09:50:48 +02:00
if (!bss) {
wpa_printf(MSG_DEBUG, "PASN: BSS not found");
return -1;
}
}
rsne = wpa_bss_get_ie(bss, WLAN_EID_RSN);
if (!rsne) {
wpa_printf(MSG_DEBUG, "PASN: BSS without RSNE");
return -1;
}
ret = wpa_parse_wpa_ie(rsne, *(rsne + 1) + 2, &rsne_data);
if (ret) {
wpa_printf(MSG_DEBUG, "PASN: Failed parsing RSNE data");
return -1;
}
rsnxe = wpa_bss_get_ie(bss, WLAN_EID_RSNX);
ssid_str_len = bss->ssid_len;
ssid_str = bss->ssid;
/* Get the network configuration based on the obtained SSID */
for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
if (!wpas_network_disabled(wpa_s, ssid) &&
ssid_str_len == ssid->ssid_len &&
os_memcmp(ssid_str, ssid->ssid, ssid_str_len) == 0)
break;
}
if (ssid)
network_id = ssid->id;
sel = rsne_data.pairwise_cipher;
if (ssid && ssid->pairwise_cipher)
sel &= ssid->pairwise_cipher;
wpa_printf(MSG_DEBUG, "PASN: peer pairwise 0x%x, select 0x%x",
rsne_data.pairwise_cipher, sel);
pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
if (pairwise_cipher < 0) {
wpa_msg(wpa_s, MSG_WARNING,
"PASN: Failed to select pairwise cipher");
return -1;
}
sel = rsne_data.key_mgmt;
if (ssid && ssid->key_mgmt)
sel &= ssid->key_mgmt;
wpa_printf(MSG_DEBUG, "PASN: peer AKMP 0x%x, select 0x%x",
rsne_data.key_mgmt, sel);
#ifdef CONFIG_SAE
if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE) || !ssid)
sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_SAE_EXT_KEY |
WPA_KEY_MGMT_FT_SAE | WPA_KEY_MGMT_FT_SAE_EXT_KEY);
#endif /* CONFIG_SAE */
#ifdef CONFIG_IEEE80211R
if (!(wpa_s->drv_flags & (WPA_DRIVER_FLAGS_SME |
WPA_DRIVER_FLAGS_UPDATE_FT_IES)))
sel &= ~WPA_KEY_MGMT_FT;
#endif /* CONFIG_IEEE80211R */
if (0) {
#ifdef CONFIG_IEEE80211R
#ifdef CONFIG_SHA384
} else if ((sel & WPA_KEY_MGMT_FT_IEEE8021X_SHA384) &&
os_strcmp(wpa_supplicant_get_eap_mode(wpa_s), "LEAP") != 0) {
key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X_SHA384;
wpa_printf(MSG_DEBUG, "PASN: using KEY_MGMT FT/802.1X-SHA384");
if (ssid && !ssid->ft_eap_pmksa_caching &&
pmksa_cache_get_current(wpa_s->wpa)) {
/* PMKSA caching with FT may have interoperability
* issues, so disable that case by default for now.
*/
wpa_printf(MSG_DEBUG,
"PASN: Disable PMKSA caching for FT/802.1X connection");
pmksa_cache_clear_current(wpa_s->wpa);
}
#endif /* CONFIG_SHA384 */
#endif /* CONFIG_IEEE80211R */
#ifdef CONFIG_SAE
} else if ((sel & WPA_KEY_MGMT_SAE_EXT_KEY) &&
(ieee802_11_rsnx_capab(rsnxe,
WLAN_RSNX_CAPAB_SAE_H2E)) &&
PASN: Remove unused wpa_s parameter for wpas_pasn_sae_setup_pt() This removes unnecessary struct wpa_supplicant dependency for wpas_pasn_sae_setup_pt(). Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-28 21:18:18 +02:00
(wpas_pasn_sae_setup_pt(ssid, group) == 0)) {
PASN: Offload handshake for multiple peers from the driver This brings in the functionality to hold multiple peers and perform PASN authentication with each peer at a time and send the PASN response to the driver. PASN parameters such as AKMP and cipher suite are obtained from the BSS information of the cached scan results. Also add functionality to trigger deauthentication to the peer for which PASN request with action PASN_ACTION_DELETE_SECURE_RANGING_CONTEXT is received. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-26 09:50:48 +02:00
key_mgmt = WPA_KEY_MGMT_SAE_EXT_KEY;
wpa_printf(MSG_DEBUG, "PASN: using KEY_MGMT SAE (ext key)");
} else if ((sel & WPA_KEY_MGMT_SAE) &&
(ieee802_11_rsnx_capab(rsnxe,
WLAN_RSNX_CAPAB_SAE_H2E)) &&
PASN: Remove unused wpa_s parameter for wpas_pasn_sae_setup_pt() This removes unnecessary struct wpa_supplicant dependency for wpas_pasn_sae_setup_pt(). Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-28 21:18:18 +02:00
(wpas_pasn_sae_setup_pt(ssid, group) == 0)) {
PASN: Offload handshake for multiple peers from the driver This brings in the functionality to hold multiple peers and perform PASN authentication with each peer at a time and send the PASN response to the driver. PASN parameters such as AKMP and cipher suite are obtained from the BSS information of the cached scan results. Also add functionality to trigger deauthentication to the peer for which PASN request with action PASN_ACTION_DELETE_SECURE_RANGING_CONTEXT is received. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-26 09:50:48 +02:00
key_mgmt = WPA_KEY_MGMT_SAE;
wpa_printf(MSG_DEBUG, "PASN: using KEY_MGMT SAE");
#endif /* CONFIG_SAE */
#ifdef CONFIG_FILS
} else if (sel & WPA_KEY_MGMT_FILS_SHA384) {
key_mgmt = WPA_KEY_MGMT_FILS_SHA384;
wpa_printf(MSG_DEBUG, "PASN: using KEY_MGMT FILS-SHA384");
} else if (sel & WPA_KEY_MGMT_FILS_SHA256) {
key_mgmt = WPA_KEY_MGMT_FILS_SHA256;
wpa_printf(MSG_DEBUG, "PASN: using KEY_MGMT FILS-SHA256");
#endif /* CONFIG_FILS */
#ifdef CONFIG_IEEE80211R
} else if ((sel & WPA_KEY_MGMT_FT_IEEE8021X) &&
os_strcmp(wpa_supplicant_get_eap_mode(wpa_s), "LEAP") != 0) {
key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
wpa_printf(MSG_DEBUG, "PASN: using KEY_MGMT FT/802.1X");
if (ssid && !ssid->ft_eap_pmksa_caching &&
pmksa_cache_get_current(wpa_s->wpa)) {
/* PMKSA caching with FT may have interoperability
* issues, so disable that case by default for now.
*/
wpa_printf(MSG_DEBUG,
"PASN: Disable PMKSA caching for FT/802.1X connection");
pmksa_cache_clear_current(wpa_s->wpa);
}
} else if (sel & WPA_KEY_MGMT_FT_PSK) {
key_mgmt = WPA_KEY_MGMT_FT_PSK;
wpa_printf(MSG_DEBUG, "PASN: using KEY_MGMT FT/PSK");
#endif /* CONFIG_IEEE80211R */
} else if (sel & WPA_KEY_MGMT_PASN) {
key_mgmt = WPA_KEY_MGMT_PASN;
wpa_printf(MSG_DEBUG, "PASN: using KEY_MGMT PASN");
} else {
wpa_printf(MSG_DEBUG, "PASN: invalid AKMP");
return -1;
}
peer->akmp = key_mgmt;
peer->cipher = pairwise_cipher;
peer->network_id = network_id;
peer->group = group;
return 0;
}
PASN: Set keys from PTKSA cache for a valid PTKSA entry Set secure ranging context to the driver for a valid PTKSA entry in the PTKSA cache, if available. When the driver requests for PASN keys, wpa_supplicant configures the keys from its cache if the keys for the peer derived with the same own MAC address are available in the cache instead of doing the full PASN handshake again. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-26 10:26:03 +02:00
static int wpas_pasn_set_keys_from_cache(struct wpa_supplicant *wpa_s,
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
const u8 *own_addr,
const u8 *peer_addr,
PASN: Set keys from PTKSA cache for a valid PTKSA entry Set secure ranging context to the driver for a valid PTKSA entry in the PTKSA cache, if available. When the driver requests for PASN keys, wpa_supplicant configures the keys from its cache if the keys for the peer derived with the same own MAC address are available in the cache instead of doing the full PASN handshake again. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-26 10:26:03 +02:00
int cipher, int akmp)
{
struct ptksa_cache_entry *entry;
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
entry = ptksa_cache_get(wpa_s->ptksa, peer_addr, cipher);
PASN: Set keys from PTKSA cache for a valid PTKSA entry Set secure ranging context to the driver for a valid PTKSA entry in the PTKSA cache, if available. When the driver requests for PASN keys, wpa_supplicant configures the keys from its cache if the keys for the peer derived with the same own MAC address are available in the cache instead of doing the full PASN handshake again. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-26 10:26:03 +02:00
if (!entry) {
wpa_printf(MSG_DEBUG, "PASN: peer " MACSTR
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
" not present in PTKSA cache", MAC2STR(peer_addr));
PASN: Set keys from PTKSA cache for a valid PTKSA entry Set secure ranging context to the driver for a valid PTKSA entry in the PTKSA cache, if available. When the driver requests for PASN keys, wpa_supplicant configures the keys from its cache if the keys for the peer derived with the same own MAC address are available in the cache instead of doing the full PASN handshake again. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-26 10:26:03 +02:00
return -1;
}
Use ether_addr_equal() to compare whether two MAC addresses are equal This was done with spatch using the following semantic patch and minor manual edits to clean up coding style and avoid compiler warnings in driver_wext.c: @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) == 0 + ether_addr_equal(a, b) @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) != 0 + !ether_addr_equal(a, b) @@ expression a,b; @@ - !os_memcmp(a, b, ETH_ALEN) + ether_addr_equal(a, b) Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 22:15:36 +01:00
if (!ether_addr_equal(entry->own_addr, own_addr)) {
PASN: Set keys from PTKSA cache for a valid PTKSA entry Set secure ranging context to the driver for a valid PTKSA entry in the PTKSA cache, if available. When the driver requests for PASN keys, wpa_supplicant configures the keys from its cache if the keys for the peer derived with the same own MAC address are available in the cache instead of doing the full PASN handshake again. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-26 10:26:03 +02:00
wpa_printf(MSG_DEBUG,
"PASN: own addr " MACSTR " and PTKSA entry own addr "
MACSTR " differ",
MAC2STR(own_addr), MAC2STR(entry->own_addr));
return -1;
}
wpa_printf(MSG_DEBUG, "PASN: " MACSTR " present in PTKSA cache",
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
MAC2STR(peer_addr));
wpa_drv_set_secure_ranging_ctx(wpa_s, own_addr, peer_addr, cipher,
PASN: Set keys from PTKSA cache for a valid PTKSA entry Set secure ranging context to the driver for a valid PTKSA entry in the PTKSA cache, if available. When the driver requests for PASN keys, wpa_supplicant configures the keys from its cache if the keys for the peer derived with the same own MAC address are available in the cache instead of doing the full PASN handshake again. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-26 10:26:03 +02:00
entry->ptk.tk_len,
entry->ptk.tk,
entry->ptk.ltf_keyseed_len,
entry->ptk.ltf_keyseed, 0);
return 0;
}
PASN: Offload handshake for multiple peers from the driver This brings in the functionality to hold multiple peers and perform PASN authentication with each peer at a time and send the PASN response to the driver. PASN parameters such as AKMP and cipher suite are obtained from the BSS information of the cached scan results. Also add functionality to trigger deauthentication to the peer for which PASN request with action PASN_ACTION_DELETE_SECURE_RANGING_CONTEXT is received. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-26 09:50:48 +02:00
static void wpas_pasn_configure_next_peer(struct wpa_supplicant *wpa_s,
struct pasn_auth *pasn_params)
{
struct pasn_peer *peer;
u8 comeback_len = 0;
const u8 *comeback = NULL;
if (!pasn_params)
return;
while (wpa_s->pasn_count < pasn_params->num_peers) {
peer = &pasn_params->peer[wpa_s->pasn_count];
Use ether_addr_equal() to compare whether two MAC addresses are equal This was done with spatch using the following semantic patch and minor manual edits to clean up coding style and avoid compiler warnings in driver_wext.c: @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) == 0 + ether_addr_equal(a, b) @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) != 0 + !ether_addr_equal(a, b) @@ expression a,b; @@ - !os_memcmp(a, b, ETH_ALEN) + ether_addr_equal(a, b) Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 22:15:36 +01:00
if (ether_addr_equal(wpa_s->bssid, peer->peer_addr)) {
PASN: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:52 +01:00
wpa_printf(MSG_DEBUG,
PASN: Move initiator changes into a separate file PASN initiator functionality builds auth 1 and auth 3 frames, and processes auth 2 frame received from the responder. Wi-Fi Aware modules can reuse this functionality through a shared library libpasn.so generated from this code. Move the PASN functionality that is now decoupled from the wpa_s context into a separate file in a common directory to make it easier to build such a library. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 13:48:16 +01:00
"PASN: Associated peer is not expected");
peer->status = PASN_STATUS_FAILURE;
wpa_s->pasn_count++;
continue;
PASN: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:52 +01:00
}
PASN: Move initiator changes into a separate file PASN initiator functionality builds auth 1 and auth 3 frames, and processes auth 2 frame received from the responder. Wi-Fi Aware modules can reuse this functionality through a shared library libpasn.so generated from this code. Move the PASN functionality that is now decoupled from the wpa_s context into a separate file in a common directory to make it easier to build such a library. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 13:48:16 +01:00
if (wpas_pasn_set_keys_from_cache(wpa_s, peer->own_addr,
peer->peer_addr,
peer->cipher,
peer->akmp) == 0) {
peer->status = PASN_STATUS_SUCCESS;
wpa_s->pasn_count++;
continue;
}
PASN: Support PASN with FILS key derivation As the PASN FILS authentication is only defined for FILS SK without PFS, and to support PASN authentication with FILS, implement the PASN with FILS processing as part of the PASN handling and not as part of the WPA state machine. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:55 +01:00
PASN: Move initiator changes into a separate file PASN initiator functionality builds auth 1 and auth 3 frames, and processes auth 2 frame received from the responder. Wi-Fi Aware modules can reuse this functionality through a shared library libpasn.so generated from this code. Move the PASN functionality that is now decoupled from the wpa_s context into a separate file in a common directory to make it easier to build such a library. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 13:48:16 +01:00
if (wpas_pasn_get_params_from_bss(wpa_s, peer)) {
peer->status = PASN_STATUS_FAILURE;
wpa_s->pasn_count++;
continue;
PASN: Support PASN with FILS key derivation As the PASN FILS authentication is only defined for FILS SK without PFS, and to support PASN authentication with FILS, implement the PASN with FILS processing as part of the PASN handling and not as part of the WPA state machine. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:55 +01:00
}
PASN: Move initiator changes into a separate file PASN initiator functionality builds auth 1 and auth 3 frames, and processes auth 2 frame received from the responder. Wi-Fi Aware modules can reuse this functionality through a shared library libpasn.so generated from this code. Move the PASN functionality that is now decoupled from the wpa_s context into a separate file in a common directory to make it easier to build such a library. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 13:48:16 +01:00
if (wpas_pasn_auth_start(wpa_s, peer->own_addr,
peer->peer_addr, peer->akmp,
peer->cipher, peer->group,
peer->network_id,
comeback, comeback_len)) {
peer->status = PASN_STATUS_FAILURE;
wpa_s->pasn_count++;
continue;
}
wpa_printf(MSG_DEBUG, "PASN: Sent PASN auth start for " MACSTR,
MAC2STR(peer->peer_addr));
return;
PASN: Support PASN with FILS key derivation As the PASN FILS authentication is only defined for FILS SK without PFS, and to support PASN authentication with FILS, implement the PASN with FILS processing as part of the PASN handling and not as part of the WPA state machine. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:55 +01:00
}
PASN: Move initiator changes into a separate file PASN initiator functionality builds auth 1 and auth 3 frames, and processes auth 2 frame received from the responder. Wi-Fi Aware modules can reuse this functionality through a shared library libpasn.so generated from this code. Move the PASN functionality that is now decoupled from the wpa_s context into a separate file in a common directory to make it easier to build such a library. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 13:48:16 +01:00
if (wpa_s->pasn_count == pasn_params->num_peers) {
wpa_drv_send_pasn_resp(wpa_s, pasn_params);
wpa_printf(MSG_DEBUG, "PASN: Response sent");
os_free(wpa_s->pasn_params);
wpa_s->pasn_params = NULL;
}
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
}
PASN: Move initiator changes into a separate file PASN initiator functionality builds auth 1 and auth 3 frames, and processes auth 2 frame received from the responder. Wi-Fi Aware modules can reuse this functionality through a shared library libpasn.so generated from this code. Move the PASN functionality that is now decoupled from the wpa_s context into a separate file in a common directory to make it easier to build such a library. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 13:48:16 +01:00
void wpas_pasn_auth_work_done(struct wpa_supplicant *wpa_s, int status)
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
{
PASN: Move initiator changes into a separate file PASN initiator functionality builds auth 1 and auth 3 frames, and processes auth 2 frame received from the responder. Wi-Fi Aware modules can reuse this functionality through a shared library libpasn.so generated from this code. Move the PASN functionality that is now decoupled from the wpa_s context into a separate file in a common directory to make it easier to build such a library. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 13:48:16 +01:00
if (!wpa_s->pasn_params)
return;
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
PASN: Move initiator changes into a separate file PASN initiator functionality builds auth 1 and auth 3 frames, and processes auth 2 frame received from the responder. Wi-Fi Aware modules can reuse this functionality through a shared library libpasn.so generated from this code. Move the PASN functionality that is now decoupled from the wpa_s context into a separate file in a common directory to make it easier to build such a library. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 13:48:16 +01:00
wpa_s->pasn_params->peer[wpa_s->pasn_count].status = status;
wpa_s->pasn_count++;
wpas_pasn_configure_next_peer(wpa_s, wpa_s->pasn_params);
}
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
PASN: Change PASN flows to use SAE H2E only Do so for both wpa_supplicant and hostapd. While this was not explicitly required in IEEE P802.11az/D3.0, likely direction for the draft is to start requiring use of H2E for all cases where SAE is used with PASN. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-04-08 11:06:24 +02:00
PASN: Move initiator changes into a separate file PASN initiator functionality builds auth 1 and auth 3 frames, and processes auth 2 frame received from the responder. Wi-Fi Aware modules can reuse this functionality through a shared library libpasn.so generated from this code. Move the PASN functionality that is now decoupled from the wpa_s context into a separate file in a common directory to make it easier to build such a library. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 13:48:16 +01:00
static void wpas_pasn_delete_peers(struct wpa_supplicant *wpa_s,
struct pasn_auth *pasn_params)
{
struct pasn_peer *peer;
unsigned int i;
PASN: Change PASN flows to use SAE H2E only Do so for both wpa_supplicant and hostapd. While this was not explicitly required in IEEE P802.11az/D3.0, likely direction for the draft is to start requiring use of H2E for all cases where SAE is used with PASN. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-04-08 11:06:24 +02:00
PASN: Move initiator changes into a separate file PASN initiator functionality builds auth 1 and auth 3 frames, and processes auth 2 frame received from the responder. Wi-Fi Aware modules can reuse this functionality through a shared library libpasn.so generated from this code. Move the PASN functionality that is now decoupled from the wpa_s context into a separate file in a common directory to make it easier to build such a library. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 13:48:16 +01:00
if (!pasn_params)
return;
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
PASN: Move initiator changes into a separate file PASN initiator functionality builds auth 1 and auth 3 frames, and processes auth 2 frame received from the responder. Wi-Fi Aware modules can reuse this functionality through a shared library libpasn.so generated from this code. Move the PASN functionality that is now decoupled from the wpa_s context into a separate file in a common directory to make it easier to build such a library. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 13:48:16 +01:00
for (i = 0; i < pasn_params->num_peers; i++) {
peer = &pasn_params->peer[i];
PASN: Avoid clearing secure context for the PASN deauthentication event PASN deauthentication event is sent by the underlying driver to delete the keys in wpa_supplicant PTKSA cache. So don't send clear secure context command to the driver again as it is already aware of it. Fixes: 74d894a2 ("PASN: Offload handshake for multiple peers from the driver") Signed-off-by: Vinay Gannevaram <quic_vganneva@quicinc.com>
2022-11-30 20:40:33 +01:00
ptksa_cache_flush(wpa_s->ptksa, peer->peer_addr,
WPA_CIPHER_NONE);
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
}
PASN: Move initiator changes into a separate file PASN initiator functionality builds auth 1 and auth 3 frames, and processes auth 2 frame received from the responder. Wi-Fi Aware modules can reuse this functionality through a shared library libpasn.so generated from this code. Move the PASN functionality that is now decoupled from the wpa_s context into a separate file in a common directory to make it easier to build such a library. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 13:48:16 +01:00
}
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
Fix compiler warnings on supplicant build with PASN but no FILS Get rid of unused variables and functions. Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 21:49:13 +01:00
#ifdef CONFIG_FILS
PASN: Rename struct wpas_pasn to pasn_data struct wpas_pasn is common to both initiator and responder, so rename it to pasn_data to avoid the "wpas_" prefix that could be seen as a reference to wpa_supplicant (PASN initiator). Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-03 09:02:06 +01:00
static void wpas_pasn_initiate_eapol(struct pasn_data *pasn,
PASN: Move initiator changes into a separate file PASN initiator functionality builds auth 1 and auth 3 frames, and processes auth 2 frame received from the responder. Wi-Fi Aware modules can reuse this functionality through a shared library libpasn.so generated from this code. Move the PASN functionality that is now decoupled from the wpa_s context into a separate file in a common directory to make it easier to build such a library. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 13:48:16 +01:00
struct wpa_ssid *ssid)
{
struct eapol_config eapol_conf;
PASN: Include RSNXE in the PASN negotiation IEEE P802.11az/D2.6 added definitions to include RSNXE in the PASN negotiation. Implement the new functionality in both wpa_supplicant and hostapd. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:01:38 +01:00
PASN: Move initiator changes into a separate file PASN initiator functionality builds auth 1 and auth 3 frames, and processes auth 2 frame received from the responder. Wi-Fi Aware modules can reuse this functionality through a shared library libpasn.so generated from this code. Move the PASN functionality that is now decoupled from the wpa_s context into a separate file in a common directory to make it easier to build such a library. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 13:48:16 +01:00
wpa_printf(MSG_DEBUG, "PASN: FILS: Initiating EAPOL");
PASN: Derive KDK only when required When a PTK derivation is done as part of PASN authentication flow, a KDK derivation should be done if and only if the higher layer protocol is supported by both parties. Fix the code accordingly, so KDK would be derived if and only if both sides support Secure LTF. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-04-08 11:06:20 +02:00
PASN: Move initiator changes into a separate file PASN initiator functionality builds auth 1 and auth 3 frames, and processes auth 2 frame received from the responder. Wi-Fi Aware modules can reuse this functionality through a shared library libpasn.so generated from this code. Move the PASN functionality that is now decoupled from the wpa_s context into a separate file in a common directory to make it easier to build such a library. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 13:48:16 +01:00
eapol_sm_notify_eap_success(pasn->eapol, false);
eapol_sm_notify_eap_fail(pasn->eapol, false);
eapol_sm_notify_portControl(pasn->eapol, Auto);
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
PASN: Move initiator changes into a separate file PASN initiator functionality builds auth 1 and auth 3 frames, and processes auth 2 frame received from the responder. Wi-Fi Aware modules can reuse this functionality through a shared library libpasn.so generated from this code. Move the PASN functionality that is now decoupled from the wpa_s context into a separate file in a common directory to make it easier to build such a library. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 13:48:16 +01:00
os_memset(&eapol_conf, 0, sizeof(eapol_conf));
eapol_conf.fast_reauth = pasn->fast_reauth;
eapol_conf.workaround = ssid->eap_workaround;
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
PASN: Move initiator changes into a separate file PASN initiator functionality builds auth 1 and auth 3 frames, and processes auth 2 frame received from the responder. Wi-Fi Aware modules can reuse this functionality through a shared library libpasn.so generated from this code. Move the PASN functionality that is now decoupled from the wpa_s context into a separate file in a common directory to make it easier to build such a library. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 13:48:16 +01:00
eapol_sm_notify_config(pasn->eapol, &ssid->eap, &eapol_conf);
}
Fix compiler warnings on supplicant build with PASN but no FILS Get rid of unused variables and functions. Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 21:49:13 +01:00
#endif /* CONFIG_FILS */
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
PASN: Move initiator changes into a separate file PASN initiator functionality builds auth 1 and auth 3 frames, and processes auth 2 frame received from the responder. Wi-Fi Aware modules can reuse this functionality through a shared library libpasn.so generated from this code. Move the PASN functionality that is now decoupled from the wpa_s context into a separate file in a common directory to make it easier to build such a library. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 13:48:16 +01:00
static void wpas_pasn_reset(struct wpa_supplicant *wpa_s)
{
PASN: Rename struct wpas_pasn to pasn_data struct wpas_pasn is common to both initiator and responder, so rename it to pasn_data to avoid the "wpas_" prefix that could be seen as a reference to wpa_supplicant (PASN initiator). Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-03 09:02:06 +01:00
struct pasn_data *pasn = &wpa_s->pasn;
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
PASN: Move initiator changes into a separate file PASN initiator functionality builds auth 1 and auth 3 frames, and processes auth 2 frame received from the responder. Wi-Fi Aware modules can reuse this functionality through a shared library libpasn.so generated from this code. Move the PASN functionality that is now decoupled from the wpa_s context into a separate file in a common directory to make it easier to build such a library. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 13:48:16 +01:00
wpas_pasn_cancel_auth_work(wpa_s);
wpa_s->pasn_auth_work = NULL;
eloop_cancel_timeout(wpas_pasn_auth_work_timeout, wpa_s, NULL);
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
PASN: Move initiator changes into a separate file PASN initiator functionality builds auth 1 and auth 3 frames, and processes auth 2 frame received from the responder. Wi-Fi Aware modules can reuse this functionality through a shared library libpasn.so generated from this code. Move the PASN functionality that is now decoupled from the wpa_s context into a separate file in a common directory to make it easier to build such a library. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 13:48:16 +01:00
wpa_pasn_reset(pasn);
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
}
static struct wpa_bss * wpas_pasn_allowed(struct wpa_supplicant *wpa_s,
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
const u8 *peer_addr, int akmp,
int cipher)
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
{
struct wpa_bss *bss;
const u8 *rsne;
struct wpa_ie_data rsne_data;
int ret;
Use ether_addr_equal() to compare whether two MAC addresses are equal This was done with spatch using the following semantic patch and minor manual edits to clean up coding style and avoid compiler warnings in driver_wext.c: @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) == 0 + ether_addr_equal(a, b) @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) != 0 + !ether_addr_equal(a, b) @@ expression a,b; @@ - !os_memcmp(a, b, ETH_ALEN) + ether_addr_equal(a, b) Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 22:15:36 +01:00
if (ether_addr_equal(wpa_s->bssid, peer_addr)) {
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
wpa_printf(MSG_DEBUG,
"PASN: Not doing authentication with current BSS");
return NULL;
}
PASN: Select the latest available BSS entry for a BSSID This is needed to work around some issues that show up mainly in testing scenarios when the same BSSID might be used with different configurations and the scan results from the driver might include both the old and new contents when two different SSIDs are used. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-21 18:44:32 +01:00
bss = wpa_bss_get_bssid_latest(wpa_s, peer_addr);
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
if (!bss) {
wpa_printf(MSG_DEBUG, "PASN: BSS not found");
return NULL;
}
rsne = wpa_bss_get_ie(bss, WLAN_EID_RSN);
if (!rsne) {
wpa_printf(MSG_DEBUG, "PASN: BSS without RSNE");
return NULL;
}
ret = wpa_parse_wpa_ie(rsne, *(rsne + 1) + 2, &rsne_data);
if (ret) {
wpa_printf(MSG_DEBUG, "PASN: Failed parsing RSNE data");
return NULL;
}
if (!(rsne_data.key_mgmt & akmp) ||
!(rsne_data.pairwise_cipher & cipher)) {
wpa_printf(MSG_DEBUG,
"PASN: AP does not support requested AKMP or cipher");
return NULL;
}
return bss;
}
static void wpas_pasn_auth_start_cb(struct wpa_radio_work *work, int deinit)
{
struct wpa_supplicant *wpa_s = work->wpa_s;
struct wpa_pasn_auth_work *awork = work->ctx;
PASN: Rename struct wpas_pasn to pasn_data struct wpas_pasn is common to both initiator and responder, so rename it to pasn_data to avoid the "wpas_" prefix that could be seen as a reference to wpa_supplicant (PASN initiator). Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-03 09:02:06 +01:00
struct pasn_data *pasn = &wpa_s->pasn;
PASN: Remove dependency of wpa_ssid for initiator Get ssid and derive required information for SAE and FILS tunneled PASN authentication to remove struct wpa_ssid dependency for PASN initiator. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-07 11:04:48 +02:00
struct wpa_ssid *ssid;
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
struct wpa_bss *bss;
PASN: Include RSNXE in the PASN negotiation IEEE P802.11az/D2.6 added definitions to include RSNXE in the PASN negotiation. Implement the new functionality in both wpa_supplicant and hostapd. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:01:38 +01:00
const u8 *rsne, *rsnxe;
Fix compiler warnings on supplicant build with PASN but no FILS Get rid of unused variables and functions. Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 21:49:13 +01:00
#ifdef CONFIG_FILS
PASN: Remove wpa_s dependency for FILS wrapped data To avoid reuse without struct wpa_supplicant, add new parameters to struct wpas_pasn for FILS. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 15:34:54 +02:00
const u8 *indic;
u16 fils_info;
Fix compiler warnings on supplicant build with PASN but no FILS Get rid of unused variables and functions. Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 21:49:13 +01:00
#endif /* CONFIG_FILS */
PASN: Remove wpa_s dependency for wpas_pasn_build_auth_1() Obtain RSNXE capabilities from the driver flags as well and save them in the wpas_pasn structure. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 19:43:54 +02:00
u16 capab = 0;
PASN: Remove wpa_s dependency for wpas_pasn_start() Before invoking wpas_pasn_start(), derive KDK and secure LTF flags. Instead of using network id for pasn_start(), use a pointer to the struct wpa_ssid. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 20:29:36 +02:00
bool derive_kdk;
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
int ret;
wpa_printf(MSG_DEBUG, "PASN: auth_start_cb: deinit=%d", deinit);
if (deinit) {
if (work->started) {
eloop_cancel_timeout(wpas_pasn_auth_work_timeout,
wpa_s, NULL);
wpa_s->pasn_auth_work = NULL;
}
PASN: Add support for comeback flow to wpa_supplicant Process the received comeback cookie and retry automatically if the AP allows this. Otherwise, provide the cookie to upper layers to allow a later attempt with the cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:09 +01:00
PASN: Use a helper function to free radio work data This is safer in avoiding memory leaks now that there is a dynamically allocated member within the data struct. Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-21 17:33:17 +01:00
wpas_pasn_free_auth_work(awork);
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
return;
}
/*
* It is possible that by the time the callback is called, the PASN
* authentication is not allowed, e.g., a connection with the AP was
* established.
*/
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
bss = wpas_pasn_allowed(wpa_s, awork->peer_addr, awork->akmp,
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
awork->cipher);
if (!bss) {
wpa_printf(MSG_DEBUG, "PASN: auth_start_cb: Not allowed");
goto fail;
}
rsne = wpa_bss_get_ie(bss, WLAN_EID_RSN);
if (!rsne) {
wpa_printf(MSG_DEBUG, "PASN: BSS without RSNE");
goto fail;
}
PASN: Include RSNXE in the PASN negotiation IEEE P802.11az/D2.6 added definitions to include RSNXE in the PASN negotiation. Implement the new functionality in both wpa_supplicant and hostapd. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:01:38 +01:00
rsnxe = wpa_bss_get_ie(bss, WLAN_EID_RSNX);
PASN: Remove wpa_s dependency for wpas_pasn_start() Before invoking wpas_pasn_start(), derive KDK and secure LTF flags. Instead of using network id for pasn_start(), use a pointer to the struct wpa_ssid. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 20:29:36 +02:00
derive_kdk = (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF_STA) &&
ieee802_11_rsnx_capab(rsnxe,
WLAN_RSNX_CAPAB_SECURE_LTF);
#ifdef CONFIG_TESTING_OPTIONS
if (!derive_kdk)
derive_kdk = wpa_s->conf->force_kdk_derivation;
#endif /* CONFIG_TESTING_OPTIONS */
if (derive_kdk)
PASN: Add set and get API for PASN data context Modules that use libpasn for PASN authentication need the context of PASN data. PASN data is a common context for the library and the modules using it. Hence, initialize the context through init and deinit functions. Also use set and get functions to update the parameters. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-29 10:47:42 +01:00
pasn_enable_kdk_derivation(pasn);
PASN: Remove wpa_s dependency for wpas_pasn_start() Before invoking wpas_pasn_start(), derive KDK and secure LTF flags. Instead of using network id for pasn_start(), use a pointer to the struct wpa_ssid. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 20:29:36 +02:00
else
PASN: Add set and get API for PASN data context Modules that use libpasn for PASN authentication need the context of PASN data. PASN data is a common context for the library and the modules using it. Hence, initialize the context through init and deinit functions. Also use set and get functions to update the parameters. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-29 10:47:42 +01:00
pasn_disable_kdk_derivation(pasn);
PASN: Remove wpa_s dependency for wpas_pasn_start() Before invoking wpas_pasn_start(), derive KDK and secure LTF flags. Instead of using network id for pasn_start(), use a pointer to the struct wpa_ssid. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 20:29:36 +02:00
wpa_printf(MSG_DEBUG, "PASN: kdk_len=%zu", pasn->kdk_len);
if ((wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF_STA) &&
ieee802_11_rsnx_capab(rsnxe, WLAN_RSNX_CAPAB_SECURE_LTF))
pasn->secure_ltf = true;
else
pasn->secure_ltf = false;
PASN: Remove wpa_s dependency for FILS wrapped data To avoid reuse without struct wpa_supplicant, add new parameters to struct wpas_pasn for FILS. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 15:34:54 +02:00
#ifdef CONFIG_TESTING_OPTIONS
pasn->corrupt_mic = wpa_s->conf->pasn_corrupt_mic;
#endif /* CONFIG_TESTING_OPTIONS */
PASN: Remove wpa_s dependency for wpas_pasn_build_auth_1() Obtain RSNXE capabilities from the driver flags as well and save them in the wpas_pasn structure. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 19:43:54 +02:00
capab |= BIT(WLAN_RSNX_CAPAB_SAE_H2E);
if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF_STA)
capab |= BIT(WLAN_RSNX_CAPAB_SECURE_LTF);
if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_RTT_STA)
capab |= BIT(WLAN_RSNX_CAPAB_SECURE_RTT);
if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_STA)
PASN: Align RSNXE with IEEE P802.11az/D7.0 definitions RSNXE bits were modified, so update the relevant places accordingly. Please note, WLAN_RSNX_CAPAB_PROT_RANGE_NEG was renamed to WLAN_RSNX_CAPAB_URNM_MFPR and the bit position is changed to 15 instead of 10, while BIT 10 is used for WLAN_RSNX_CAPAB_URNM_MFPR_X20 and is not supported yet. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-04 13:46:15 +01:00
capab |= BIT(WLAN_RSNX_CAPAB_URNM_MFPR);
PASN: Add set and get API for PASN data context Modules that use libpasn for PASN authentication need the context of PASN data. PASN data is a common context for the library and the modules using it. Hence, initialize the context through init and deinit functions. Also use set and get functions to update the parameters. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-29 10:47:42 +01:00
pasn_set_rsnxe_caps(pasn, capab);
pasn_register_callbacks(pasn, wpa_s, wpas_pasn_send_mlme, NULL);
PASN: Remove dependency of wpa_ssid for initiator Get ssid and derive required information for SAE and FILS tunneled PASN authentication to remove struct wpa_ssid dependency for PASN initiator. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-07 11:04:48 +02:00
ssid = wpa_config_get_network(wpa_s->conf, awork->network_id);
#ifdef CONFIG_SAE
if (awork->akmp == WPA_KEY_MGMT_SAE) {
if (!ssid) {
wpa_printf(MSG_DEBUG,
"PASN: No network profile found for SAE");
goto fail;
}
PASN: Add set and get API for PASN data context Modules that use libpasn for PASN authentication need the context of PASN data. PASN data is a common context for the library and the modules using it. Hence, initialize the context through init and deinit functions. Also use set and get functions to update the parameters. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-29 10:47:42 +01:00
pasn_set_pt(pasn, wpas_pasn_sae_derive_pt(ssid, awork->group));
PASN: Remove dependency of wpa_ssid for initiator Get ssid and derive required information for SAE and FILS tunneled PASN authentication to remove struct wpa_ssid dependency for PASN initiator. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-07 11:04:48 +02:00
if (!pasn->pt) {
wpa_printf(MSG_DEBUG, "PASN: Failed to derive PT");
goto fail;
}
pasn->network_id = ssid->id;
}
#endif /* CONFIG_SAE */
PASN: Remove wpa_s dependency for FILS wrapped data To avoid reuse without struct wpa_supplicant, add new parameters to struct wpas_pasn for FILS. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 15:34:54 +02:00
#ifdef CONFIG_FILS
/* Prepare needed information for wpas_pasn_wd_fils_auth(). */
if (awork->akmp == WPA_KEY_MGMT_FILS_SHA256 ||
awork->akmp == WPA_KEY_MGMT_FILS_SHA384) {
indic = wpa_bss_get_ie(bss, WLAN_EID_FILS_INDICATION);
PASN: Remove dependency of wpa_ssid for initiator Get ssid and derive required information for SAE and FILS tunneled PASN authentication to remove struct wpa_ssid dependency for PASN initiator. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-07 11:04:48 +02:00
if (!ssid) {
wpa_printf(MSG_DEBUG, "PASN: FILS: No network block");
} else if (!indic || indic[1] < 2) {
PASN: Remove wpa_s dependency for FILS wrapped data To avoid reuse without struct wpa_supplicant, add new parameters to struct wpas_pasn for FILS. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 15:34:54 +02:00
wpa_printf(MSG_DEBUG,
"PASN: Missing FILS Indication IE");
} else {
fils_info = WPA_GET_LE16(indic + 2);
PASN: Remove dependency of wpa_ssid for initiator Get ssid and derive required information for SAE and FILS tunneled PASN authentication to remove struct wpa_ssid dependency for PASN initiator. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-07 11:04:48 +02:00
if ((fils_info & BIT(9)) && ssid) {
PASN: Remove wpa_s dependency for FILS wrapped data To avoid reuse without struct wpa_supplicant, add new parameters to struct wpas_pasn for FILS. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 15:34:54 +02:00
pasn->eapol = wpa_s->eapol;
PASN: Remove dependency of wpa_ssid for initiator Get ssid and derive required information for SAE and FILS tunneled PASN authentication to remove struct wpa_ssid dependency for PASN initiator. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-07 11:04:48 +02:00
pasn->network_id = ssid->id;
wpas_pasn_initiate_eapol(pasn, ssid);
PASN: Remove wpa_s dependency for FILS wrapped data To avoid reuse without struct wpa_supplicant, add new parameters to struct wpas_pasn for FILS. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 15:34:54 +02:00
pasn->fils_eapol = true;
} else {
wpa_printf(MSG_DEBUG,
"PASN: FILS auth without PFS not supported");
}
}
pasn->fast_reauth = wpa_s->conf->fast_reauth;
}
#endif /* CONFIG_FILS */
PASN: Add set and get API for PASN data context Modules that use libpasn for PASN authentication need the context of PASN data. PASN data is a common context for the library and the modules using it. Hence, initialize the context through init and deinit functions. Also use set and get functions to update the parameters. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-29 10:47:42 +01:00
pasn_set_initiator_pmksa(pasn, wpa_sm_get_pmksa_cache(wpa_s->wpa));
PASN: Remove wpa_sm dependency to add an entry to PMKSA cache Store PMKSA cache entry in wpas_pasn and remove wpa_sm dependency to add an entry to PMKSA cache. This is a step towards allowing the PASN implementation to be used outside the context of wpa_supplicant. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 19:57:13 +02:00
PASN: Remove wpa_s dependency for wpas_pasn_build_auth_1() Obtain RSNXE capabilities from the driver flags as well and save them in the wpas_pasn structure. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 19:43:54 +02:00
if (wpa_key_mgmt_ft(awork->akmp)) {
#ifdef CONFIG_IEEE80211R
ret = wpa_pasn_ft_derive_pmk_r1(wpa_s->wpa, awork->akmp,
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
awork->peer_addr,
PASN: Remove wpa_s dependency for wpas_pasn_build_auth_1() Obtain RSNXE capabilities from the driver flags as well and save them in the wpas_pasn structure. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 19:43:54 +02:00
pasn->pmk_r1,
&pasn->pmk_r1_len,
pasn->pmk_r1_name);
if (ret) {
wpa_printf(MSG_DEBUG,
"PASN: FT: Failed to derive keys");
goto fail;
}
#else /* CONFIG_IEEE80211R */
goto fail;
#endif /* CONFIG_IEEE80211R */
}
PASN: Remove wpa_s dependency for wpas_pasn_start() Before invoking wpas_pasn_start(), derive KDK and secure LTF flags. Instead of using network id for pasn_start(), use a pointer to the struct wpa_ssid. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 20:29:36 +02:00
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
ret = wpas_pasn_start(pasn, awork->own_addr, awork->peer_addr,
PASN: Use separate variables for BSSID and peer address Using separate variables for BSSID and peer address is needed to support Wi-Fi Aware (NAN) use cases where the group address is used as the BSSID and that could be different from any other peer address. The infrastructure BSS cases will continue to use the AP's BSSID as both the peer address and BSSID for the PASN exchanges. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 11:45:31 +01:00
awork->peer_addr, awork->akmp, awork->cipher,
awork->group, bss->freq, rsne, *(rsne + 1) + 2,
PASN: Include RSNXE in the PASN negotiation IEEE P802.11az/D2.6 added definitions to include RSNXE in the PASN negotiation. Implement the new functionality in both wpa_supplicant and hostapd. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:01:38 +01:00
rsnxe, rsnxe ? *(rsnxe + 1) + 2 : 0,
PASN: Remove dependency of wpa_ssid for initiator Get ssid and derive required information for SAE and FILS tunneled PASN authentication to remove struct wpa_ssid dependency for PASN initiator. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-07 11:04:48 +02:00
awork->comeback);
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
if (ret) {
wpa_printf(MSG_DEBUG,
"PASN: Failed to start PASN authentication");
goto fail;
}
PASN: Remove wpa_s dependency for wpas_pasn_start() Before invoking wpas_pasn_start(), derive KDK and secure LTF flags. Instead of using network id for pasn_start(), use a pointer to the struct wpa_ssid. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 20:29:36 +02:00
eloop_register_timeout(2, 0, wpas_pasn_auth_work_timeout, wpa_s, NULL);
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
PASN: Add support for comeback flow to wpa_supplicant Process the received comeback cookie and retry automatically if the AP allows this. Otherwise, provide the cookie to upper layers to allow a later attempt with the cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:09 +01:00
/* comeback token is no longer needed at this stage */
wpabuf_free(awork->comeback);
awork->comeback = NULL;
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
wpa_s->pasn_auth_work = work;
return;
fail:
PASN: Use a helper function to free radio work data This is safer in avoiding memory leaks now that there is a dynamically allocated member within the data struct. Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-21 17:33:17 +01:00
wpas_pasn_free_auth_work(awork);
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
work->ctx = NULL;
radio_work_done(work);
}
Add own MAC address in PASN supplicant start and deauthentication The driver requests PASN authentication for a peer with a specified source (own) MAC address. Use the specified own MAC address for PASN operations. This is needed to allow random MAC addresses to be used. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-20 10:59:49 +01:00
int wpas_pasn_auth_start(struct wpa_supplicant *wpa_s,
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
const u8 *own_addr, const u8 *peer_addr,
PASN: Add support for comeback flow to wpa_supplicant Process the received comeback cookie and retry automatically if the AP allows this. Otherwise, provide the cookie to upper layers to allow a later attempt with the cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:09 +01:00
int akmp, int cipher, u16 group, int network_id,
const u8 *comeback, size_t comeback_len)
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
{
struct wpa_pasn_auth_work *awork;
struct wpa_bss *bss;
wpa_printf(MSG_DEBUG, "PASN: Start: " MACSTR " akmp=0x%x, cipher=0x%x",
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
MAC2STR(peer_addr), akmp, cipher);
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
/*
* TODO: Consider modifying the offchannel logic to handle additional
* Management frames other then Action frames. For now allow PASN only
* with drivers that support off-channel TX.
*/
if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX)) {
wpa_printf(MSG_DEBUG,
"PASN: Driver does not support offchannel TX");
return -1;
}
if (radio_work_pending(wpa_s, "pasn-start-auth")) {
wpa_printf(MSG_DEBUG,
"PASN: send_auth: Work is already pending");
return -1;
}
if (wpa_s->pasn_auth_work) {
wpa_printf(MSG_DEBUG, "PASN: send_auth: Already in progress");
return -1;
}
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
bss = wpas_pasn_allowed(wpa_s, peer_addr, akmp, cipher);
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
if (!bss)
return -1;
wpas_pasn_reset(wpa_s);
awork = os_zalloc(sizeof(*awork));
if (!awork)
return -1;
Add own MAC address in PASN supplicant start and deauthentication The driver requests PASN authentication for a peer with a specified source (own) MAC address. Use the specified own MAC address for PASN operations. This is needed to allow random MAC addresses to be used. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-20 10:59:49 +01:00
os_memcpy(awork->own_addr, own_addr, ETH_ALEN);
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
os_memcpy(awork->peer_addr, peer_addr, ETH_ALEN);
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
awork->akmp = akmp;
awork->cipher = cipher;
awork->group = group;
PASN: Support PASN with SAE key derivation Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:52 +01:00
awork->network_id = network_id;
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
PASN: Add support for comeback flow to wpa_supplicant Process the received comeback cookie and retry automatically if the AP allows this. Otherwise, provide the cookie to upper layers to allow a later attempt with the cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:09 +01:00
if (comeback && comeback_len) {
awork->comeback = wpabuf_alloc_copy(comeback, comeback_len);
if (!awork->comeback) {
PASN: Use a helper function to free radio work data This is safer in avoiding memory leaks now that there is a dynamically allocated member within the data struct. Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-21 17:33:17 +01:00
wpas_pasn_free_auth_work(awork);
PASN: Add support for comeback flow to wpa_supplicant Process the received comeback cookie and retry automatically if the AP allows this. Otherwise, provide the cookie to upper layers to allow a later attempt with the cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:09 +01:00
return -1;
}
}
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
if (radio_add_work(wpa_s, bss->freq, "pasn-start-auth", 1,
wpas_pasn_auth_start_cb, awork) < 0) {
PASN: Use a helper function to free radio work data This is safer in avoiding memory leaks now that there is a dynamically allocated member within the data struct. Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-21 17:33:17 +01:00
wpas_pasn_free_auth_work(awork);
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
return -1;
}
wpa_printf(MSG_DEBUG, "PASN: Auth work successfully added");
return 0;
}
void wpas_pasn_auth_stop(struct wpa_supplicant *wpa_s)
{
PASN: Rename struct wpas_pasn to pasn_data struct wpas_pasn is common to both initiator and responder, so rename it to pasn_data to avoid the "wpas_" prefix that could be seen as a reference to wpa_supplicant (PASN initiator). Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-03 09:02:06 +01:00
struct pasn_data *pasn = &wpa_s->pasn;
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
if (!wpa_s->pasn.ecdh)
return;
wpa_printf(MSG_DEBUG, "PASN: Stopping authentication");
PASN: Add set and get API for PASN data context Modules that use libpasn for PASN authentication need the context of PASN data. PASN data is a common context for the library and the modules using it. Hence, initialize the context through init and deinit functions. Also use set and get functions to update the parameters. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-29 10:47:42 +01:00
wpas_pasn_auth_status(wpa_s, pasn->peer_addr, pasn_get_akmp(pasn),
pasn_get_cipher(pasn),
PASN: Add support for comeback flow to wpa_supplicant Process the received comeback cookie and retry automatically if the AP allows this. Otherwise, provide the cookie to upper layers to allow a later attempt with the cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:09 +01:00
pasn->status, pasn->comeback,
pasn->comeback_after);
wpas_pasn_reset(wpa_s);
}
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
PASN: Add support for comeback flow to wpa_supplicant Process the received comeback cookie and retry automatically if the AP allows this. Otherwise, provide the cookie to upper layers to allow a later attempt with the cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:09 +01:00
static int wpas_pasn_immediate_retry(struct wpa_supplicant *wpa_s,
PASN: Rename struct wpas_pasn to pasn_data struct wpas_pasn is common to both initiator and responder, so rename it to pasn_data to avoid the "wpas_" prefix that could be seen as a reference to wpa_supplicant (PASN initiator). Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-03 09:02:06 +01:00
struct pasn_data *pasn,
PASN: Add support for comeback flow to wpa_supplicant Process the received comeback cookie and retry automatically if the AP allows this. Otherwise, provide the cookie to upper layers to allow a later attempt with the cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:09 +01:00
struct wpa_pasn_params_data *params)
{
PASN: Add set and get API for PASN data context Modules that use libpasn for PASN authentication need the context of PASN data. PASN data is a common context for the library and the modules using it. Hence, initialize the context through init and deinit functions. Also use set and get functions to update the parameters. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-29 10:47:42 +01:00
int akmp = pasn_get_akmp(pasn);
int cipher = pasn_get_cipher(pasn);
PASN: Add support for comeback flow to wpa_supplicant Process the received comeback cookie and retry automatically if the AP allows this. Otherwise, provide the cookie to upper layers to allow a later attempt with the cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:09 +01:00
u16 group = pasn->group;
Add own MAC address in PASN supplicant start and deauthentication The driver requests PASN authentication for a peer with a specified source (own) MAC address. Use the specified own MAC address for PASN operations. This is needed to allow random MAC addresses to be used. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-20 10:59:49 +01:00
u8 own_addr[ETH_ALEN];
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
u8 peer_addr[ETH_ALEN];
PASN: Add support for comeback flow to wpa_supplicant Process the received comeback cookie and retry automatically if the AP allows this. Otherwise, provide the cookie to upper layers to allow a later attempt with the cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:09 +01:00
wpa_printf(MSG_DEBUG, "PASN: Immediate retry");
Add own MAC address in PASN supplicant start and deauthentication The driver requests PASN authentication for a peer with a specified source (own) MAC address. Use the specified own MAC address for PASN operations. This is needed to allow random MAC addresses to be used. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-20 10:59:49 +01:00
os_memcpy(own_addr, pasn->own_addr, ETH_ALEN);
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
os_memcpy(peer_addr, pasn->peer_addr, ETH_ALEN);
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
wpas_pasn_reset(wpa_s);
PASN: Add support for comeback flow to wpa_supplicant Process the received comeback cookie and retry automatically if the AP allows this. Otherwise, provide the cookie to upper layers to allow a later attempt with the cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:09 +01:00
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
return wpas_pasn_auth_start(wpa_s, own_addr, peer_addr, akmp, cipher,
group, pasn->network_id,
PASN: Add support for comeback flow to wpa_supplicant Process the received comeback cookie and retry automatically if the AP allows this. Otherwise, provide the cookie to upper layers to allow a later attempt with the cookie. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-21 12:55:09 +01:00
params->comeback, params->comeback_len);
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
}
PASN: Deauthenticate on PTKSA cache entry expiration Add an option for an alternative processing of PTKSA life time expiry. Register a callback in wpa_supplicant to handle the life time expiry of the keys in PTKSA cache. Send PASN deauthentication when a PTKSA cache entry expires. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-08 08:11:01 +02:00
static void wpas_pasn_deauth_cb(struct ptksa_cache_entry *entry)
{
struct wpa_supplicant *wpa_s = entry->ctx;
PASN: Fix passing own address and peer address to pasn_deauthenticate() Need to copy own address and peer address locally and pass them to pasn_deauthenticate(), because this pointer data will be flushed from the PTKSA cache before sending the Deauthentication frame and these pointers to then-freed memory would be dereferenced. Fixes: 24929543 ("PASN: Deauthenticate on PTKSA cache entry expiration") Signed-off-by: Vinay Gannevaram <quic_vganneva@quicinc.com>
2022-11-11 19:45:36 +01:00
u8 own_addr[ETH_ALEN];
u8 peer_addr[ETH_ALEN];
PASN: Deauthenticate on PTKSA cache entry expiration Add an option for an alternative processing of PTKSA life time expiry. Register a callback in wpa_supplicant to handle the life time expiry of the keys in PTKSA cache. Send PASN deauthentication when a PTKSA cache entry expires. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-08 08:11:01 +02:00
PASN: Fix passing own address and peer address to pasn_deauthenticate() Need to copy own address and peer address locally and pass them to pasn_deauthenticate(), because this pointer data will be flushed from the PTKSA cache before sending the Deauthentication frame and these pointers to then-freed memory would be dereferenced. Fixes: 24929543 ("PASN: Deauthenticate on PTKSA cache entry expiration") Signed-off-by: Vinay Gannevaram <quic_vganneva@quicinc.com>
2022-11-11 19:45:36 +01:00
/* Use a copy of the addresses from the entry to avoid issues with the
* entry getting freed during deauthentication processing. */
os_memcpy(own_addr, entry->own_addr, ETH_ALEN);
os_memcpy(peer_addr, entry->addr, ETH_ALEN);
wpas_pasn_deauthenticate(wpa_s, own_addr, peer_addr);
PASN: Deauthenticate on PTKSA cache entry expiration Add an option for an alternative processing of PTKSA life time expiry. Register a callback in wpa_supplicant to handle the life time expiry of the keys in PTKSA cache. Send PASN deauthentication when a PTKSA cache entry expires. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-08 08:11:01 +02:00
}
PASN: Remove wpa_s dependency for the functions processing RX frames Remove wpa_s dependency for processing PASN M2 frame and preparing M3 frame. To hold the context of wpa_s when transmitting M3 frame, add cb ctx. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 15:43:45 +02:00
int wpas_pasn_auth_rx(struct wpa_supplicant *wpa_s,
const struct ieee80211_mgmt *mgmt, size_t len)
{
PASN: Rename struct wpas_pasn to pasn_data struct wpas_pasn is common to both initiator and responder, so rename it to pasn_data to avoid the "wpas_" prefix that could be seen as a reference to wpa_supplicant (PASN initiator). Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-03 09:02:06 +01:00
struct pasn_data *pasn = &wpa_s->pasn;
PASN: Remove wpa_s dependency for the functions processing RX frames Remove wpa_s dependency for processing PASN M2 frame and preparing M3 frame. To hold the context of wpa_s when transmitting M3 frame, add cb ctx. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 15:43:45 +02:00
struct wpa_pasn_params_data pasn_data;
int ret;
if (!wpa_s->pasn_auth_work)
return -2;
PASN: Add set and get API for PASN data context Modules that use libpasn for PASN authentication need the context of PASN data. PASN data is a common context for the library and the modules using it. Hence, initialize the context through init and deinit functions. Also use set and get functions to update the parameters. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-29 10:47:42 +01:00
pasn_register_callbacks(pasn, wpa_s, wpas_pasn_send_mlme, NULL);
PASN: Remove wpa_s dependency for the functions processing RX frames Remove wpa_s dependency for processing PASN M2 frame and preparing M3 frame. To hold the context of wpa_s when transmitting M3 frame, add cb ctx. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 15:43:45 +02:00
ret = wpa_pasn_auth_rx(pasn, (const u8 *) mgmt, len, &pasn_data);
if (ret == 0) {
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
ptksa_cache_add(wpa_s->ptksa, pasn->own_addr, pasn->peer_addr,
PASN: Add set and get API for PASN data context Modules that use libpasn for PASN authentication need the context of PASN data. PASN data is a common context for the library and the modules using it. Hence, initialize the context through init and deinit functions. Also use set and get functions to update the parameters. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-29 10:47:42 +01:00
pasn_get_cipher(pasn),
dot11RSNAConfigPMKLifetime,
pasn_get_ptk(pasn),
PASN: Remove wpa_s dependency for the functions processing RX frames Remove wpa_s dependency for processing PASN M2 frame and preparing M3 frame. To hold the context of wpa_s when transmitting M3 frame, add cb ctx. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 15:43:45 +02:00
wpa_s->pasn_params ? wpas_pasn_deauth_cb : NULL,
PASN: Add set and get API for PASN data context Modules that use libpasn for PASN authentication need the context of PASN data. PASN data is a common context for the library and the modules using it. Hence, initialize the context through init and deinit functions. Also use set and get functions to update the parameters. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-29 10:47:42 +01:00
wpa_s->pasn_params ? wpa_s : NULL,
pasn_get_akmp(pasn));
PASN: Remove wpa_s dependency for the functions processing RX frames Remove wpa_s dependency for processing PASN M2 frame and preparing M3 frame. To hold the context of wpa_s when transmitting M3 frame, add cb ctx. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 15:43:45 +02:00
if (pasn->pmksa_entry)
wpa_sm_set_cur_pmksa(wpa_s->wpa, pasn->pmksa_entry);
}
PASN: Add set and get API for PASN data context Modules that use libpasn for PASN authentication need the context of PASN data. PASN data is a common context for the library and the modules using it. Hence, initialize the context through init and deinit functions. Also use set and get functions to update the parameters. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-29 10:47:42 +01:00
forced_memzero(pasn_get_ptk(pasn), sizeof(pasn->ptk));
PASN: Remove wpa_s dependency for the functions processing RX frames Remove wpa_s dependency for processing PASN M2 frame and preparing M3 frame. To hold the context of wpa_s when transmitting M3 frame, add cb ctx. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 15:43:45 +02:00
if (ret == -1) {
wpas_pasn_auth_stop(wpa_s);
wpas_pasn_auth_work_done(wpa_s, PASN_STATUS_FAILURE);
}
if (ret == 1)
ret = wpas_pasn_immediate_retry(wpa_s, pasn, &pasn_data);
return ret;
}
PASN: Offload handshake for multiple peers from the driver This brings in the functionality to hold multiple peers and perform PASN authentication with each peer at a time and send the PASN response to the driver. PASN parameters such as AKMP and cipher suite are obtained from the BSS information of the cached scan results. Also add functionality to trigger deauthentication to the peer for which PASN request with action PASN_ACTION_DELETE_SECURE_RANGING_CONTEXT is received. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-26 09:50:48 +02:00
void wpas_pasn_auth_trigger(struct wpa_supplicant *wpa_s,
struct pasn_auth *pasn_auth)
{
struct pasn_peer *src, *dst;
unsigned int i, num_peers = pasn_auth->num_peers;
if (wpa_s->pasn_params) {
wpa_printf(MSG_DEBUG,
"PASN: auth_trigger: Already in progress");
return;
}
if (!num_peers || num_peers > WPAS_MAX_PASN_PEERS) {
wpa_printf(MSG_DEBUG,
"PASN: auth trigger: Invalid number of peers");
return;
}
wpa_s->pasn_params = os_zalloc(sizeof(struct pasn_auth));
if (!wpa_s->pasn_params) {
wpa_printf(MSG_DEBUG,
"PASN: auth trigger: Failed to allocate a buffer");
return;
}
wpa_s->pasn_count = 0;
wpa_s->pasn_params->num_peers = num_peers;
for (i = 0; i < num_peers; i++) {
dst = &wpa_s->pasn_params->peer[i];
src = &pasn_auth->peer[i];
os_memcpy(dst->own_addr, wpa_s->own_addr, ETH_ALEN);
os_memcpy(dst->peer_addr, src->peer_addr, ETH_ALEN);
dst->ltf_keyseed_required = src->ltf_keyseed_required;
dst->status = PASN_STATUS_SUCCESS;
if (!is_zero_ether_addr(src->own_addr)) {
os_memcpy(dst->own_addr, src->own_addr, ETH_ALEN);
wpa_printf(MSG_DEBUG, "PASN: Own (source) MAC addr: "
MACSTR, MAC2STR(dst->own_addr));
}
}
if (pasn_auth->action == PASN_ACTION_DELETE_SECURE_RANGING_CONTEXT) {
wpas_pasn_delete_peers(wpa_s, wpa_s->pasn_params);
os_free(wpa_s->pasn_params);
wpa_s->pasn_params = NULL;
} else if (pasn_auth->action == PASN_ACTION_AUTH) {
wpas_pasn_configure_next_peer(wpa_s, wpa_s->pasn_params);
}
}
PASN: Remove wpa_s dependency for wpas_pasn_auth_tx_status() This is a step towards allowing the PASN implementation to be used outside the context of wpa_supplicant. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 15:46:04 +02:00
int wpas_pasn_auth_tx_status(struct wpa_supplicant *wpa_s,
const u8 *data, size_t data_len, u8 acked)
{
PASN: Rename struct wpas_pasn to pasn_data struct wpas_pasn is common to both initiator and responder, so rename it to pasn_data to avoid the "wpas_" prefix that could be seen as a reference to wpa_supplicant (PASN initiator). Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-03 09:02:06 +01:00
struct pasn_data *pasn = &wpa_s->pasn;
PASN: Remove wpa_s dependency for wpas_pasn_auth_tx_status() This is a step towards allowing the PASN implementation to be used outside the context of wpa_supplicant. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 15:46:04 +02:00
int ret;
if (!wpa_s->pasn_auth_work) {
wpa_printf(MSG_DEBUG,
"PASN: auth_tx_status: no work in progress");
return -1;
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
}
PASN: Remove wpa_s dependency for wpas_pasn_auth_tx_status() This is a step towards allowing the PASN implementation to be used outside the context of wpa_supplicant. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 15:46:04 +02:00
ret = wpa_pasn_auth_tx_status(pasn, data, data_len, acked);
if (ret != 1)
return ret;
if (!wpa_s->pasn_params) {
wpas_pasn_auth_stop(wpa_s);
return 0;
}
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
wpas_pasn_set_keys_from_cache(wpa_s, pasn->own_addr, pasn->peer_addr,
PASN: Add set and get API for PASN data context Modules that use libpasn for PASN authentication need the context of PASN data. PASN data is a common context for the library and the modules using it. Hence, initialize the context through init and deinit functions. Also use set and get functions to update the parameters. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-29 10:47:42 +01:00
pasn_get_cipher(pasn),
pasn_get_akmp(pasn));
PASN: Remove wpa_s dependency for wpas_pasn_auth_tx_status() This is a step towards allowing the PASN implementation to be used outside the context of wpa_supplicant. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-18 15:46:04 +02:00
wpas_pasn_auth_stop(wpa_s);
wpas_pasn_auth_work_done(wpa_s, PASN_STATUS_SUCCESS);
PASN: Add support for PASN processing to wpa_supplicant Add PASN implementation to wpa_supplicant 1. Add functions to initialize and clear PASN data. 2. Add functions to construct PASN Authentication frames. 3. Add function to process PASN Authentication frame. 4. Add function to handle PASN frame TX status. 5. Implement the station side flow processing for PASN. The implementation is missing support for wrapped data and PMKSA establishment for base AKMs, and only supports PASN authentication or base AKM with PMKSA caching. The missing parts will be added in later patches. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-12-16 12:00:28 +01:00
return 0;
}
PASN: Add support for deauthentication flow in station The new wpa_supplicant control interface command "PASN_DEAUTH bssid=<BSSID>" can now be used to flush the local PTKSA cache for the specified BSS and to notify the AP to request it to drop its PTKSA as well. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:12 +01:00
Add own MAC address in PASN supplicant start and deauthentication The driver requests PASN authentication for a peer with a specified source (own) MAC address. Use the specified own MAC address for PASN operations. This is needed to allow random MAC addresses to be used. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-20 10:59:49 +01:00
int wpas_pasn_deauthenticate(struct wpa_supplicant *wpa_s, const u8 *own_addr,
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
const u8 *peer_addr)
PASN: Add support for deauthentication flow in station The new wpa_supplicant control interface command "PASN_DEAUTH bssid=<BSSID>" can now be used to flush the local PTKSA cache for the specified BSS and to notify the AP to request it to drop its PTKSA as well. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:12 +01:00
{
struct wpa_bss *bss;
struct wpabuf *buf;
struct ieee80211_mgmt *deauth;
int ret;
Use ether_addr_equal() to compare whether two MAC addresses are equal This was done with spatch using the following semantic patch and minor manual edits to clean up coding style and avoid compiler warnings in driver_wext.c: @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) == 0 + ether_addr_equal(a, b) @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) != 0 + !ether_addr_equal(a, b) @@ expression a,b; @@ - !os_memcmp(a, b, ETH_ALEN) + ether_addr_equal(a, b) Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 22:15:36 +01:00
if (ether_addr_equal(wpa_s->bssid, peer_addr)) {
PASN: Add support for deauthentication flow in station The new wpa_supplicant control interface command "PASN_DEAUTH bssid=<BSSID>" can now be used to flush the local PTKSA cache for the specified BSS and to notify the AP to request it to drop its PTKSA as well. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:12 +01:00
wpa_printf(MSG_DEBUG,
"PASN: Cannot deauthenticate from current BSS");
return -1;
}
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
wpa_drv_set_secure_ranging_ctx(wpa_s, own_addr, peer_addr, 0, 0, NULL,
0, NULL, 1);
PASN: Offload handshake for multiple peers from the driver This brings in the functionality to hold multiple peers and perform PASN authentication with each peer at a time and send the PASN response to the driver. PASN parameters such as AKMP and cipher suite are obtained from the BSS information of the cached scan results. Also add functionality to trigger deauthentication to the peer for which PASN request with action PASN_ACTION_DELETE_SECURE_RANGING_CONTEXT is received. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-26 09:50:48 +02:00
PASN: Add support for deauthentication flow in station The new wpa_supplicant control interface command "PASN_DEAUTH bssid=<BSSID>" can now be used to flush the local PTKSA cache for the specified BSS and to notify the AP to request it to drop its PTKSA as well. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:12 +01:00
wpa_printf(MSG_DEBUG, "PASN: deauth: Flushing all PTKSA entries for "
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
MACSTR, MAC2STR(peer_addr));
ptksa_cache_flush(wpa_s->ptksa, peer_addr, WPA_CIPHER_NONE);
PASN: Add support for deauthentication flow in station The new wpa_supplicant control interface command "PASN_DEAUTH bssid=<BSSID>" can now be used to flush the local PTKSA cache for the specified BSS and to notify the AP to request it to drop its PTKSA as well. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:12 +01:00
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
bss = wpa_bss_get_bssid(wpa_s, peer_addr);
PASN: Add support for deauthentication flow in station The new wpa_supplicant control interface command "PASN_DEAUTH bssid=<BSSID>" can now be used to flush the local PTKSA cache for the specified BSS and to notify the AP to request it to drop its PTKSA as well. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:12 +01:00
if (!bss) {
wpa_printf(MSG_DEBUG, "PASN: deauth: BSS not found");
return -1;
}
buf = wpabuf_alloc(64);
if (!buf) {
wpa_printf(MSG_DEBUG, "PASN: deauth: Failed wpabuf allocate");
return -1;
}
deauth = wpabuf_put(buf, offsetof(struct ieee80211_mgmt,
u.deauth.variable));
deauth->frame_control = host_to_le16((WLAN_FC_TYPE_MGMT << 2) |
(WLAN_FC_STYPE_DEAUTH << 4));
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
os_memcpy(deauth->da, peer_addr, ETH_ALEN);
Add own MAC address in PASN supplicant start and deauthentication The driver requests PASN authentication for a peer with a specified source (own) MAC address. Use the specified own MAC address for PASN operations. This is needed to allow random MAC addresses to be used. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-20 10:59:49 +01:00
os_memcpy(deauth->sa, own_addr, ETH_ALEN);
PASN: Use peer address instead of BSSID as the destination for initiator Rename struct pasn_data::bssid to peer_addr to be better aligned with different use cases of PASN and its extensions. This is a step towards having option to use different peer address and BSSID values for NAN use cases. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-30 17:17:28 +01:00
os_memcpy(deauth->bssid, peer_addr, ETH_ALEN);
PASN: Add support for deauthentication flow in station The new wpa_supplicant control interface command "PASN_DEAUTH bssid=<BSSID>" can now be used to flush the local PTKSA cache for the specified BSS and to notify the AP to request it to drop its PTKSA as well. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-15 13:57:12 +01:00
deauth->u.deauth.reason_code =
host_to_le16(WLAN_REASON_PREV_AUTH_NOT_VALID);
/*
* Since we do not expect any response from the AP, implement the
* Deauthentication frame transmission using direct call to the driver
* without a radio work.
*/
ret = wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1,
bss->freq, 0);
wpabuf_free(buf);
wpa_printf(MSG_DEBUG, "PASN: deauth: send_mlme ret=%d", ret);
return ret;
}
Reference in a new issue Copy permalink