Extended Key ID support for wpa_supplicant when in infrastructure mode.
Signed-off-by: Alexander Wetzel <alexander@xxxxxxxxxxxxxx>
---
Has the same testing as hostapd. Extended Key ID support for other than
Infrastructure is also planned but without any date, yet:-)
It takes care to not announce Extended Key ID support when not in
Infrastructure mode.
src/rsn_supp/wpa.c | 67 +++++++++++++++++++++++++-----
src/rsn_supp/wpa.h | 4 +-
src/rsn_supp/wpa_i.h | 3 ++
src/rsn_supp/wpa_ie.c | 11 +++++
src/rsn_supp/wpa_ie.h | 1 +
wpa_supplicant/config.c | 2 +
wpa_supplicant/config_file.c | 1 +
wpa_supplicant/config_ssid.h | 10 +++++
wpa_supplicant/wpa_cli.c | 2 +-
wpa_supplicant/wpa_supplicant.c | 8 ++++
wpa_supplicant/wpa_supplicant.conf | 5 +++
wpa_supplicant/wpas_glue.c | 1 +
12 files changed, 103 insertions(+), 12 deletions(-)
diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
index 8a5cbe2fe..d519c5d62 100644
--- a/src/rsn_supp/wpa.c
+++ b/src/rsn_supp/wpa.c
@@ -758,6 +758,16 @@ static void wpa_sm_rekey_ptk(void *eloop_ctx, void *timeout_ctx)
wpa_sm_key_request(sm, 0, 1);
}
+static void wpa_supplicant_ptk_installed(struct wpa_sm *sm)
+{
+ sm->ptk.installed = 1;
+
+ if (sm->wpa_ptk_rekey) {
+ eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
+ eloop_register_timeout(sm->wpa_ptk_rekey, 0, wpa_sm_rekey_ptk,
+ sm, NULL);
+ }
+}
static int wpa_supplicant_install_ptk(struct wpa_sm *sm,
const struct wpa_eapol_key *key,
@@ -805,26 +815,42 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm,
wpa_hexdump(MSG_DEBUG, "WPA: RSC", key_rsc, rsclen);
}
- if (wpa_sm_set_key(sm, alg, sm->bssid, 0, 1, key_rsc, rsclen,
- sm->ptk.tk, keylen, key_flag) < 0) {
+ if (wpa_sm_set_key(sm, alg, sm->bssid, sm->keyidx_active, 1, key_rsc,
+ rsclen, sm->ptk.tk, keylen, key_flag) < 0) {
wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
"WPA: Failed to set PTK to the "
- "driver (alg=%d keylen=%d bssid=" MACSTR ")",
- alg, keylen, MAC2STR(sm->bssid));
+ "driver (alg=%d keylen=%d bssid=" MACSTR
+ " idx=%d use_extended_key_id=%d key_flag=%d)",
+ alg, keylen, MAC2STR(sm->bssid),
+ sm->keyidx_active, sm->use_extended_key_id, key_flag);
return -1;
}
/* TK is not needed anymore in supplicant */
os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
sm->ptk.tk_len = 0;
- sm->ptk.installed = 1;
- if (sm->wpa_ptk_rekey) {
- eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
- eloop_register_timeout(sm->wpa_ptk_rekey, 0, wpa_sm_rekey_ptk,
- sm, NULL);
+ if (!(key_flag & KEY_FLAG_NO_AUTO_TX))
+ wpa_supplicant_ptk_installed(sm);
+
+ return 0;
+}
+
+static int wpa_supplicant_activate_ptk(struct wpa_sm *sm)
+{
+ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
+ "WPA: Activate PTK (idx=%d bssid=" MACSTR ")",
+ sm->keyidx_active, MAC2STR(sm->bssid));
+
+ if (wpa_sm_set_key(sm, 0, sm->bssid, sm->keyidx_active,
+ 0, 0, 0, NULL, 0, KEY_FLAG_SET_TX) < 0) {
+ wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
+ "WPA: Failed to activate PTK for Tx (idx=%d bssid="
+ MACSTR ")", sm->keyidx_active, MAC2STR(sm->bssid));
+ return -1;
}
+ wpa_supplicant_ptk_installed(sm);
return 0;
}
@@ -1430,6 +1456,15 @@ static void wpa_supplicant_process_3_of_4(struct wpa_sm *sm,
wpa_hexdump(MSG_DEBUG, "WPA: IE KeyData", key_data, key_data_len);
if (wpa_supplicant_parse_ies(key_data, key_data_len, &ie) < 0)
goto failed;
+
+ if (ie.key_id && sm->wpa_extended_key_id) {
+ sm->keyidx_active = ie.key_id[0];
+ sm->use_extended_key_id = 1;
+ } else {
+ sm->keyidx_active = 0;
+ sm->use_extended_key_id = 0;
+ }
+
if (ie.gtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
"WPA: GTK IE in unencrypted key data");
@@ -1500,6 +1535,10 @@ static void wpa_supplicant_process_3_of_4(struct wpa_sm *sm,
}
}
#endif /* CONFIG_OCV */
+ if (sm->use_extended_key_id) {
+ if (wpa_supplicant_install_ptk(sm, key, KEY_FLAG_NO_AUTO_TX))
+ goto failed;
+ }
if (wpa_supplicant_send_4_of_4(sm, sm->bssid, key, ver, key_info,
&sm->ptk) < 0) {
@@ -1512,8 +1551,12 @@ static void wpa_supplicant_process_3_of_4(struct wpa_sm *sm,
sm->renew_snonce = 1;
if (key_info & WPA_KEY_INFO_INSTALL) {
- if (wpa_supplicant_install_ptk(sm, key, 0))
+ if (sm->use_extended_key_id) {
+ if (wpa_supplicant_activate_ptk(sm))
+ goto failed;
+ } else if (wpa_supplicant_install_ptk(sm, key, 0)) {
goto failed;
+ }
}
if (key_info & WPA_KEY_INFO_SECURE) {
@@ -2627,6 +2670,7 @@ struct wpa_sm * wpa_sm_init(struct wpa_sm_ctx *ctx)
return NULL;
dl_list_init(&sm->pmksa_candidates);
sm->renew_snonce = 1;
+ sm->keyidx_active = 0;
sm->ctx = ctx;
sm->dot11RSNAConfigPMKLifetime = 43200;
@@ -3017,6 +3061,9 @@ int wpa_sm_set_param(struct wpa_sm *sm, enum wpa_sm_conf_params param,
case WPA_PARAM_PAIRWISE:
sm->pairwise_cipher = value;
break;
+ case WPA_PARAM_EXTENDED_KEY_ID:
+ sm->wpa_extended_key_id = value;
+ break;
case WPA_PARAM_GROUP:
sm->group_cipher = value;
break;
diff --git a/src/rsn_supp/wpa.h b/src/rsn_supp/wpa.h
index 7a100fddc..670e2b685 100644
--- a/src/rsn_supp/wpa.h
+++ b/src/rsn_supp/wpa.h
@@ -98,7 +98,8 @@ enum wpa_sm_conf_params {
WPA_PARAM_MGMT_GROUP,
WPA_PARAM_RSN_ENABLED,
WPA_PARAM_MFP,
- WPA_PARAM_OCV
+ WPA_PARAM_OCV,
+ WPA_PARAM_EXTENDED_KEY_ID
};
struct rsn_supp_config {
@@ -109,6 +110,7 @@ struct rsn_supp_config {
void *eap_conf_ctx;
const u8 *ssid;
size_t ssid_len;
+ int wpa_extended_key_id;
int wpa_ptk_rekey;
int p2p;
int wpa_rsc_relaxation;
diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h
index ed8cac767..4c9213075 100644
--- a/src/rsn_supp/wpa_i.h
+++ b/src/rsn_supp/wpa_i.h
@@ -26,6 +26,7 @@ struct wpa_sm {
u8 snonce[WPA_NONCE_LEN];
u8 anonce[WPA_NONCE_LEN]; /* ANonce from the last 1/4 msg */
int renew_snonce;
+ int keyidx_active;
u8 rx_replay_counter[WPA_REPLAY_COUNTER_LEN];
int rx_replay_counter_set;
u8 request_counter[WPA_REPLAY_COUNTER_LEN];
@@ -65,6 +66,8 @@ struct wpa_sm {
int wpa_ptk_rekey;
int p2p;
int wpa_rsc_relaxation;
+ int wpa_extended_key_id;
+ int use_extended_key_id;
u8 own_addr[ETH_ALEN];
const char *ifname;
diff --git a/src/rsn_supp/wpa_ie.c b/src/rsn_supp/wpa_ie.c
index ae9f4ca24..4016ec71a 100644
--- a/src/rsn_supp/wpa_ie.c
+++ b/src/rsn_supp/wpa_ie.c
@@ -225,6 +225,9 @@ static int wpa_gen_wpa_ie_rsn(u8 *rsn_ie, size_t rsn_ie_len,
#endif /* CONFIG_IEEE80211W */
if (sm->ocv)
capab |= WPA_CAPABILITY_OCVC;
+ if (sm->wpa_extended_key_id)
+ capab |= WPA_CAPABILITY_EXT_KEY_ID_FOR_UNICAST;
+
WPA_PUT_LE16(pos, capab);
pos += 2;
@@ -417,6 +420,14 @@ static int wpa_parse_generic(const u8 *pos, const u8 *end,
return 0;
}
+ if (pos[1] > RSN_SELECTOR_LEN + 1 &&
+ RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_KEYID) {
+ ie->key_id = pos + 2 + RSN_SELECTOR_LEN;
+ wpa_hexdump(MSG_DEBUG, "WPA: KeyID in EAPOL-Key",
+ pos, pos[1] + 2);
+ return 0;
+ }
+
if (pos[1] > RSN_SELECTOR_LEN + 2 &&
RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_GROUPKEY) {
ie->gtk = pos + 2 + RSN_SELECTOR_LEN;
diff --git a/src/rsn_supp/wpa_ie.h b/src/rsn_supp/wpa_ie.h
index 9d53973a9..f961e90e4 100644
--- a/src/rsn_supp/wpa_ie.h
+++ b/src/rsn_supp/wpa_ie.h
@@ -17,6 +17,7 @@ struct wpa_eapol_ie_parse {
const u8 *rsn_ie;
size_t rsn_ie_len;
const u8 *pmkid;
+ const u8 *key_id;
const u8 *gtk;
size_t gtk_len;
const u8 *mac_addr;
diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c
index 2058175f8..517a1b9dd 100644
--- a/wpa_supplicant/config.c
+++ b/wpa_supplicant/config.c
@@ -2334,6 +2334,7 @@ static const struct parse_data ssid_fields[] = {
{ INT(dot11MeshConfirmTimeout) },
{ INT(dot11MeshHoldingTimeout) },
#endif /* CONFIG_MESH */
+ { INT(wpa_extended_key_id) },
{ INT(wpa_ptk_rekey) },
{ INT(group_rekey) },
{ STR(bgscan) },
@@ -2853,6 +2854,7 @@ void wpa_config_set_network_defaults(struct wpa_ssid *ssid)
{
ssid->proto = DEFAULT_PROTO;
ssid->pairwise_cipher = DEFAULT_PAIRWISE;
+ ssid->wpa_extended_key_id = DEFAULT_EXTENDED_KEY_ID;
ssid->group_cipher = DEFAULT_GROUP;
ssid->key_mgmt = DEFAULT_KEY_MGMT;
ssid->bg_scan_period = DEFAULT_BG_SCAN_PERIOD;
diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c
index 26f6ee147..f9018022c 100644
--- a/wpa_supplicant/config_file.c
+++ b/wpa_supplicant/config_file.c
@@ -882,6 +882,7 @@ static void wpa_config_write_network(FILE *f, struct wpa_ssid *ssid)
INT_DEF(dot11MeshHoldingTimeout, DEFAULT_MESH_HOLDING_TIMEOUT);
INT_DEF(mesh_rssi_threshold, DEFAULT_MESH_RSSI_THRESHOLD);
#endif /* CONFIG_MESH */
+ INT(wpa_extended_key_id);
INT(wpa_ptk_rekey);
INT(group_rekey);
INT(ignore_broadcast_ssid);
diff --git a/wpa_supplicant/config_ssid.h b/wpa_supplicant/config_ssid.h
index 1b2b1f1a3..b681bb81c 100644
--- a/wpa_supplicant/config_ssid.h
+++ b/wpa_supplicant/config_ssid.h
@@ -22,6 +22,7 @@
#define DEFAULT_PAIRWISE (WPA_CIPHER_CCMP | WPA_CIPHER_TKIP)
#define DEFAULT_GROUP (WPA_CIPHER_CCMP | WPA_CIPHER_TKIP)
#define DEFAULT_FRAGMENT_SIZE 1398
+#define DEFAULT_EXTENDED_KEY_ID 1
#define DEFAULT_BG_SCAN_PERIOD -1
#define DEFAULT_MESH_MAX_RETRIES 2
@@ -526,6 +527,15 @@ struct wpa_ssid {
unsigned int vht_center_freq1;
unsigned int vht_center_freq2;
+ /** wpa_extended_key_id - Extended Key ID support
+ *
+ * IEEE 802.11-2016 optionally allows to use key id 0 and 1 for PTK keys
+ * default: auto (1)
+ * 0 = force off. Do not announce or use Extended Key ID.
+ * 1 = auto. Use Extended Key ID when possible.
+ */
+ int wpa_extended_key_id;
+
/**
* wpa_ptk_rekey - Maximum lifetime for PTK in seconds
*
diff --git a/wpa_supplicant/wpa_cli.c b/wpa_supplicant/wpa_cli.c
index 695fcbe04..9b7c4027e 100644
--- a/wpa_supplicant/wpa_cli.c
+++ b/wpa_supplicant/wpa_cli.c
@@ -1442,7 +1442,7 @@ static const char *network_fields[] = {
"dot11MeshRetryTimeout", "dot11MeshConfirmTimeout",
"dot11MeshHoldingTimeout",
#endif /* CONFIG_MESH */
- "wpa_ptk_rekey", "bgscan", "ignore_broadcast_ssid",
+ "wpa_extended_key_id", "wpa_ptk_rekey", "bgscan", "ignore_broadcast_ssid",
#ifdef CONFIG_P2P
"go_p2p_dev_addr", "p2p_client_list", "psk_list",
#endif /* CONFIG_P2P */
diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index 03e1658cc..917a071ee 100644
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -1226,6 +1226,14 @@ int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
int sel, proto;
const u8 *bss_wpa, *bss_rsn, *bss_osen;
+ if (ssid->mode == WPAS_MODE_INFRA && ssid->wpa_extended_key_id &&
+ wpa_s->drv_flags & WPA_DRIVER_FLAGS_EXTENDED_KEY_ID) {
+ wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Enable Extended Key ID support.");
+ wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_EXTENDED_KEY_ID, 1);
+ } else {
+ wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_EXTENDED_KEY_ID, 0);
+ }
+
if (bss) {
bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
diff --git a/wpa_supplicant/wpa_supplicant.conf b/wpa_supplicant/wpa_supplicant.conf
index a9205f0b8..3d29d269f 100644
--- a/wpa_supplicant/wpa_supplicant.conf
+++ b/wpa_supplicant/wpa_supplicant.conf
@@ -1062,6 +1062,11 @@ fast_reauth=1
# hex without quotation, e.g., 0102030405)
# wep_tx_keyidx: Default WEP key index (TX) (0..3)
#
+# wpa_extended_key_id:
+# Support the PTK rekey protocol "Extended Key ID" from IEEE 802.11 - 2016.
+# 0 = force off: Do not announce or use Extended Key ID
+# 1 = auto: Use Extended Key ID when possible (default)
+#
# wpa_ptk_rekey: Maximum lifetime for PTK in seconds. This can be used to
# enforce rekeying of PTK to mitigate some attacks against TKIP deficiencies.
#
diff --git a/wpa_supplicant/wpas_glue.c b/wpa_supplicant/wpas_glue.c
index 0b5da9c9f..6d3d11ee3 100644
--- a/wpa_supplicant/wpas_glue.c
+++ b/wpa_supplicant/wpas_glue.c
@@ -1273,6 +1273,7 @@ void wpa_supplicant_rsn_supp_set_config(struct wpa_supplicant *wpa_s,
#endif /* IEEE8021X_EAPOL */
conf.ssid = ssid->ssid;
conf.ssid_len = ssid->ssid_len;
+ conf.wpa_extended_key_id = ssid->wpa_extended_key_id;
conf.wpa_ptk_rekey = ssid->wpa_ptk_rekey;
#ifdef CONFIG_P2P
if (ssid->p2p_group && wpa_s->current_bss &&
--
2.21.0
_______________________________________________
Hostap mailing list
Hostap@xxxxxxxxxxxxxxxxxxx
http://lists.infradead.org/mailman/listinfo/hostap
