DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Fix PMKSA cache timeout from Session-Timeout in WPA/WPA2 cases

Browse source 
Previously, WPA/WPA2 case ended up using the hardcoded
dot11RSNAConfigPMKLifetime (43200 seconds) for PMKSA cache entries
instead of using the Session-Timeout value from the RADIUS server (if
included in Access-Accept). Store a copy of the Session-Timeout value
and use it instead of the default value so that WPA/WPA2 cases get the
proper timeout similarly to non-WPA/WPA2 cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2014-10-04 19:36:48 +03:00
parent 8e1fc78e1f
commit 47ea24c13d
2 changed files with 12 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
src/ap/ieee802_1x.c
View file

@ -1622,6 +1622,9 @@ ieee802_1x_receive_auth(struct radius_msg *msg, struct radius_msg *req,
if (ap_sta_bind_vlan(hapd, sta, old_vlanid) < 0) if (ap_sta_bind_vlan(hapd, sta, old_vlanid) < 0)
break; break;
sta->session_timeout_set = !!session_timeout_set;
sta->session_timeout = session_timeout;
/* RFC 3580, Ch. 3.17 */ /* RFC 3580, Ch. 3.17 */
if (session_timeout_set && termination_action == if (session_timeout_set && termination_action ==
RADIUS_TERMINATION_ACTION_RADIUS_REQUEST) { RADIUS_TERMINATION_ACTION_RADIUS_REQUEST) {
@ -2396,6 +2399,7 @@ static void ieee802_1x_finished(struct hostapd_data *hapd,
size_t len; size_t len;
/* TODO: get PMKLifetime from WPA parameters */ /* TODO: get PMKLifetime from WPA parameters */
static const int dot11RSNAConfigPMKLifetime = 43200; static const int dot11RSNAConfigPMKLifetime = 43200;
unsigned int session_timeout;
#ifdef CONFIG_HS20 #ifdef CONFIG_HS20
if (remediation && !sta->remediation) { if (remediation && !sta->remediation) {
@ -2430,9 +2434,13 @@ static void ieee802_1x_finished(struct hostapd_data *hapd,
#endif /* CONFIG_HS20 */ #endif /* CONFIG_HS20 */
key = ieee802_1x_get_key(sta->eapol_sm, &len); key = ieee802_1x_get_key(sta->eapol_sm, &len);
if (sta->session_timeout_set)
session_timeout = sta->session_timeout;
else
session_timeout = dot11RSNAConfigPMKLifetime;
if (success && key && len >= PMK_LEN && !sta->remediation && if (success && key && len >= PMK_LEN && !sta->remediation &&
!sta->hs20_deauth_requested && !sta->hs20_deauth_requested &&
wpa_auth_pmksa_add(sta->wpa_sm, key, dot11RSNAConfigPMKLifetime, wpa_auth_pmksa_add(sta->wpa_sm, key, session_timeout,
sta->eapol_sm) == 0) { sta->eapol_sm) == 0) {
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA, hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA,
HOSTAPD_LEVEL_DEBUG, HOSTAPD_LEVEL_DEBUG,

3
src/ap/sta_info.h
View file

@ -60,6 +60,7 @@ struct sta_info {
unsigned int qos_map_enabled:1; unsigned int qos_map_enabled:1;
unsigned int remediation:1; unsigned int remediation:1;
unsigned int hs20_deauth_requested:1; unsigned int hs20_deauth_requested:1;
unsigned int session_timeout_set:1;
u16 auth_alg; u16 auth_alg;
@ -135,6 +136,8 @@ struct sta_info {
#ifdef CONFIG_SAE #ifdef CONFIG_SAE
struct sae_data *sae; struct sae_data *sae;
#endif /* CONFIG_SAE */ #endif /* CONFIG_SAE */
u32 session_timeout; /* valid only if session_timeout_set == 1 */
}; };