Support Extended Key ID in wpa_supplicant according to
IEEE 802.11-2016 for infrastructure (AP) associations.
Extended Key ID allows to rekey pairwise keys without the otherwise
unavoidable MPDU losses on a busy link. The standard is fully backward
compatible, allowing STAs to also connect to APs not supporting it.
Signed-off-by: Alexander Wetzel <alexander@xxxxxxxxxxxxxx>
---
src/rsn_supp/wpa.c | 122 +++++++++++++++++++++++++++--
src/rsn_supp/wpa.h | 16 +++-
src/rsn_supp/wpa_i.h | 3 +
src/rsn_supp/wpa_ie.c | 3 +
wpa_supplicant/ap.c | 1 +
wpa_supplicant/config.c | 2 +
wpa_supplicant/config_file.c | 1 +
wpa_supplicant/config_ssid.h | 10 +++
wpa_supplicant/ctrl_iface.c | 3 +
wpa_supplicant/driver_i.h | 8 +-
wpa_supplicant/notify.c | 3 +-
wpa_supplicant/wpa_cli.c | 2 +-
wpa_supplicant/wpa_supplicant.c | 31 +++++++-
wpa_supplicant/wpa_supplicant.conf | 6 ++
wpa_supplicant/wpas_glue.c | 4 +-
15 files changed, 199 insertions(+), 16 deletions(-)
diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
index 9c76cc34d..27e248bae 100644
--- a/src/rsn_supp/wpa.c
+++ b/src/rsn_supp/wpa.c
@@ -184,6 +184,7 @@ void wpa_sm_key_request(struct wpa_sm *sm, int error, int pairwise)
u8 bssid[ETH_ALEN], *rbuf, *key_mic, *mic;
if (pairwise && sm->wpa_deny_ptk0_rekey &&
+ !sm->use_extended_key_id &&
wpa_sm_get_state(sm) == WPA_COMPLETED) {
wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
"WPA: PTK0 rekey not allowed, reconnecting");
@@ -597,6 +598,52 @@ static int wpa_derive_ptk(struct wpa_sm *sm, const unsigned char *src_addr,
sm->pairwise_cipher, z, z_len);
}
+static int handle_extended_key_id(struct wpa_sm *sm,
+ struct wpa_eapol_ie_parse *kde)
+{
+ struct wpa_ie_data rsn;
+
+ /* IEEE 802.11-2016 requires the Extended Key ID bit to be set
+ * in the RSN capabilities for both STAs to use it with CCMP/GCMP
+ */
+ if (sm->wpa_extended_key_id && sm->ap_rsn_ie &&
+ sm->pairwise_cipher != WPA_CIPHER_TKIP &&
+ !wpa_parse_wpa_ie_rsn(sm->ap_rsn_ie, sm->ap_rsn_ie_len, &rsn) &&
+ rsn.capabilities & WPA_CAPABILITY_EXT_KEY_ID_FOR_UNICAST) {
+ if (!kde->key_id) {
+ wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
+ "WPA: No KeyID in Extended Key ID handshake");
+ return -1;
+ } else if (kde->key_id[0] & 0xfe) {
+ wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
+ "WPA: Invalid KeyID: %d", kde->key_id[0]);
+ return -1;
+ }
+ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
+ "WPA: Using Extended Key ID");
+ sm->keyidx_active = kde->key_id[0];
+ sm->use_extended_key_id = 1;
+ } else {
+ if (kde->key_id && kde->key_id[0]) {
+ wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
+ "WPA: Non-zero KeyID in legacy handshake");
+ return -1;
+ } else if (kde->key_id) {
+ wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
+ "WPA: KeyID in legacy handshake");
+ } else if (!sm->ap_rsn_ie ||
+ sm->pairwise_cipher == WPA_CIPHER_TKIP) {
+ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
+ "WPA: Extended Key ID requires wpa2 and CCMP/GCMP");
+ }
+ if (sm->wpa_extended_key_id)
+ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
+ "WPA: Not using Extended Key ID");
+ sm->keyidx_active = 0;
+ sm->use_extended_key_id = 0;
+ }
+ return 0;
+}
static void wpa_supplicant_process_1_of_4(struct wpa_sm *sm,
const unsigned char *src_addr,
@@ -616,6 +663,7 @@ static void wpa_supplicant_process_1_of_4(struct wpa_sm *sm,
return;
}
if (sm->wpa_deny_ptk0_rekey &&
+ !sm->use_extended_key_id &&
wpa_sm_get_state(sm) == WPA_COMPLETED) {
wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
"WPA: PTK0 rekey not allowed, reconnecting");
@@ -752,9 +800,10 @@ static void wpa_supplicant_key_neg_complete(struct wpa_sm *sm,
{
wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
"WPA: Key negotiation completed with "
- MACSTR " [PTK=%s GTK=%s]", MAC2STR(addr),
+ MACSTR " [PTK=%s GTK=%s%s]", MAC2STR(addr),
wpa_cipher_txt(sm->pairwise_cipher),
- wpa_cipher_txt(sm->group_cipher));
+ wpa_cipher_txt(sm->group_cipher),
+ sm->use_extended_key_id ? " Extended_Key_ID" : "");
wpa_sm_cancel_auth_timeout(sm);
wpa_sm_set_state(sm, WPA_COMPLETED);
@@ -849,13 +898,15 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm,
wpa_hexdump(MSG_DEBUG, "WPA: RSC", key_rsc, rsclen);
}
- if (wpa_sm_set_key(sm, alg, sm->bssid, 0, key_rsc, rsclen,
- sm->ptk.tk, keylen,
+ if (wpa_sm_set_key(sm, alg, sm->bssid, sm->keyidx_active, key_rsc,
+ rsclen, sm->ptk.tk, keylen,
KEY_FLAG_PAIRWISE | key_flag) < 0) {
wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
- "WPA: Failed to set PTK to the "
- "driver (alg=%d keylen=%d bssid=" MACSTR ")",
- alg, keylen, MAC2STR(sm->bssid));
+ "WPA: Failed to set PTK to the driver"
+ "(alg=%d keylen=%d bssid=" MACSTR
+ " idx=%d use_extended_key_id=%d key_flag=%d)",
+ alg, keylen, MAC2STR(sm->bssid),
+ sm->keyidx_active, sm->use_extended_key_id, key_flag);
return -1;
}
@@ -869,7 +920,22 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm,
eloop_register_timeout(sm->wpa_ptk_rekey, 0, wpa_sm_rekey_ptk,
sm, NULL);
}
+ return 0;
+}
+
+static int wpa_supplicant_activate_ptk(struct wpa_sm *sm)
+{
+ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
+ "WPA: Activate PTK (idx=%d bssid=" MACSTR ")",
+ sm->keyidx_active, MAC2STR(sm->bssid));
+ if (wpa_sm_set_key(sm, 0, sm->bssid, sm->keyidx_active,
+ 0, 0, NULL, 0, KEY_FLAG_PAIRWISE_RX_TX_MODIFY) < 0) {
+ wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
+ "WPA: Failed to activate PTK for Tx (idx=%d bssid="
+ MACSTR ")", sm->keyidx_active, MAC2STR(sm->bssid));
+ return -1;
+ }
return 0;
}
@@ -1507,6 +1573,9 @@ static void wpa_supplicant_process_3_of_4(struct wpa_sm *sm,
if (wpa_supplicant_validate_ie(sm, sm->bssid, &ie) < 0)
goto failed;
+ if (handle_extended_key_id(sm, &ie))
+ goto failed;
+
if (os_memcmp(sm->anonce, key->key_nonce, WPA_NONCE_LEN) != 0) {
wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
"WPA: ANonce from message 1 of 4-Way Handshake "
@@ -1551,6 +1620,10 @@ static void wpa_supplicant_process_3_of_4(struct wpa_sm *sm,
}
}
#endif /* CONFIG_OCV */
+ if (sm->use_extended_key_id) {
+ if (wpa_supplicant_install_ptk(sm, key, KEY_FLAG_RX))
+ goto failed;
+ }
if (wpa_supplicant_send_4_of_4(sm, sm->bssid, key, ver, key_info,
&sm->ptk) < 0) {
@@ -1563,8 +1636,13 @@ static void wpa_supplicant_process_3_of_4(struct wpa_sm *sm,
sm->renew_snonce = 1;
if (key_info & WPA_KEY_INFO_INSTALL) {
- if (wpa_supplicant_install_ptk(sm, key, KEY_FLAG_RX_TX))
+ if (sm->use_extended_key_id) {
+ if (wpa_supplicant_activate_ptk(sm))
+ goto failed;
+ } else if (wpa_supplicant_install_ptk(sm, key,
+ KEY_FLAG_RX_TX)) {
goto failed;
+ }
}
if (key_info & WPA_KEY_INFO_SECURE) {
@@ -2671,6 +2749,7 @@ struct wpa_sm * wpa_sm_init(struct wpa_sm_ctx *ctx)
return NULL;
dl_list_init(&sm->pmksa_candidates);
sm->renew_snonce = 1;
+ sm->keyidx_active = 0;
sm->ctx = ctx;
sm->dot11RSNAConfigPMKLifetime = 43200;
@@ -3064,6 +3143,9 @@ int wpa_sm_set_param(struct wpa_sm *sm, enum wpa_sm_conf_params param,
case WPA_PARAM_DENY_PTK0_REKEY:
sm->wpa_deny_ptk0_rekey = value;
break;
+ case WPA_PARAM_EXTENDED_KEY_ID:
+ sm->wpa_extended_key_id = value;
+ break;
case WPA_PARAM_GROUP:
sm->group_cipher = value;
break;
@@ -3159,6 +3241,18 @@ int wpa_sm_pmf_enabled(struct wpa_sm *sm)
}
+int wpa_sm_extended_key_id(struct wpa_sm *sm)
+{
+ return sm->wpa_extended_key_id;
+}
+
+
+int wpa_sm_extended_key_id_active(struct wpa_sm *sm)
+{
+ return sm->use_extended_key_id;
+}
+
+
int wpa_sm_ocv_enabled(struct wpa_sm *sm)
{
struct wpa_ie_data rsn;
@@ -3189,6 +3283,9 @@ int wpa_sm_set_assoc_wpa_ie_default(struct wpa_sm *sm, u8 *wpa_ie,
#ifdef CONFIG_TESTING_OPTIONS
if (sm->test_assoc_ie) {
+ struct wpa_eapol_ie_parse ie;
+ struct wpa_ie_data rsn;
+
wpa_printf(MSG_DEBUG,
"TESTING: Replace association WPA/RSN IE");
if (*wpa_ie_len < wpabuf_len(sm->test_assoc_ie))
@@ -3196,6 +3293,15 @@ int wpa_sm_set_assoc_wpa_ie_default(struct wpa_sm *sm, u8 *wpa_ie,
os_memcpy(wpa_ie, wpabuf_head(sm->test_assoc_ie),
wpabuf_len(sm->test_assoc_ie));
res = wpabuf_len(sm->test_assoc_ie);
+
+ if (wpa_supplicant_parse_ies(wpa_ie, res, &ie) ||
+ wpa_parse_wpa_ie_rsn(ie.rsn_ie, ie.rsn_ie_len, &rsn) ||
+ !(rsn.capabilities &
+ WPA_CAPABILITY_EXT_KEY_ID_FOR_UNICAST)) {
+ wpa_printf(MSG_DEBUG,
+ "TESTING: Force disable Extended Key ID");
+ sm->wpa_extended_key_id = 0;
+ }
} else
#endif /* CONFIG_TESTING_OPTIONS */
res = wpa_gen_wpa_ie(sm, wpa_ie, *wpa_ie_len);
diff --git a/src/rsn_supp/wpa.h b/src/rsn_supp/wpa.h
index 3909a995d..0d1d184d4 100644
--- a/src/rsn_supp/wpa.h
+++ b/src/rsn_supp/wpa.h
@@ -101,7 +101,8 @@ enum wpa_sm_conf_params {
WPA_PARAM_MFP,
WPA_PARAM_OCV,
WPA_PARAM_SAE_PWE,
- WPA_PARAM_DENY_PTK0_REKEY
+ WPA_PARAM_DENY_PTK0_REKEY,
+ WPA_PARAM_EXTENDED_KEY_ID
};
struct rsn_supp_config {
@@ -112,6 +113,7 @@ struct rsn_supp_config {
void *eap_conf_ctx;
const u8 *ssid;
size_t ssid_len;
+ int wpa_extended_key_id;
int wpa_ptk_rekey;
int wpa_deny_ptk0_rekey;
int p2p;
@@ -152,6 +154,8 @@ int wpa_sm_set_param(struct wpa_sm *sm, enum wpa_sm_conf_params param,
int wpa_sm_get_status(struct wpa_sm *sm, char *buf, size_t buflen,
int verbose);
int wpa_sm_pmf_enabled(struct wpa_sm *sm);
+int wpa_sm_extended_key_id(struct wpa_sm *sm);
+int wpa_sm_extended_key_id_active(struct wpa_sm *sm);
int wpa_sm_ocv_enabled(struct wpa_sm *sm);
void wpa_sm_key_request(struct wpa_sm *sm, int error, int pairwise);
@@ -297,6 +301,16 @@ static inline int wpa_sm_pmf_enabled(struct wpa_sm *sm)
return 0;
}
+static inline int wpa_sm_extended_key_id(struct wpa_sm *sm)
+{
+ return 0;
+}
+
+static inline int wpa_sm_extended_key_id_active(struct wpa_sm *sm)
+{
+ return 0;
+}
+
static inline int wpa_sm_ocv_enabled(struct wpa_sm *sm)
{
return 0;
diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h
index ca3c0a4be..9ff02e947 100644
--- a/src/rsn_supp/wpa_i.h
+++ b/src/rsn_supp/wpa_i.h
@@ -26,6 +26,7 @@ struct wpa_sm {
u8 snonce[WPA_NONCE_LEN];
u8 anonce[WPA_NONCE_LEN]; /* ANonce from the last 1/4 msg */
int renew_snonce;
+ int keyidx_active;
u8 rx_replay_counter[WPA_REPLAY_COUNTER_LEN];
int rx_replay_counter_set;
u8 request_counter[WPA_REPLAY_COUNTER_LEN];
@@ -64,6 +65,8 @@ struct wpa_sm {
int wpa_deny_ptk0_rekey:1;
int p2p;
int wpa_rsc_relaxation;
+ int wpa_extended_key_id;
+ int use_extended_key_id;
u8 own_addr[ETH_ALEN];
const char *ifname;
diff --git a/src/rsn_supp/wpa_ie.c b/src/rsn_supp/wpa_ie.c
index 03c0d7e85..c93b76bdc 100644
--- a/src/rsn_supp/wpa_ie.c
+++ b/src/rsn_supp/wpa_ie.c
@@ -221,6 +221,9 @@ static int wpa_gen_wpa_ie_rsn(u8 *rsn_ie, size_t rsn_ie_len,
capab |= WPA_CAPABILITY_MFPR;
if (sm->ocv)
capab |= WPA_CAPABILITY_OCVC;
+ if (sm->wpa_extended_key_id)
+ capab |= WPA_CAPABILITY_EXT_KEY_ID_FOR_UNICAST;
+
WPA_PUT_LE16(pos, capab);
pos += 2;
diff --git a/wpa_supplicant/ap.c b/wpa_supplicant/ap.c
index 004d86bc3..cdc29126f 100644
--- a/wpa_supplicant/ap.c
+++ b/wpa_supplicant/ap.c
@@ -350,6 +350,7 @@ static int wpa_supplicant_conf_ap(struct wpa_supplicant *wpa_s,
bss->isolate = !wpa_s->conf->p2p_intra_bss;
bss->force_per_enrollee_psk = wpa_s->global->p2p_per_sta_psk;
bss->wpa_deny_ptk0_rekey = ssid->wpa_deny_ptk0_rekey;
+ bss->wpa_extended_key_id = ssid->wpa_extended_key_id;
if (ssid->p2p_group) {
os_memcpy(bss->ip_addr_go, wpa_s->p2pdev->conf->ip_addr_go, 4);
diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c
index 02d5f0b07..8990c3ad1 100644
--- a/wpa_supplicant/config.c
+++ b/wpa_supplicant/config.c
@@ -2494,6 +2494,7 @@ static const struct parse_data ssid_fields[] = {
{ INT(dot11MeshConfirmTimeout) },
{ INT(dot11MeshHoldingTimeout) },
#endif /* CONFIG_MESH */
+ { INT_RANGE(wpa_extended_key_id, 0, 1) },
{ INT(wpa_ptk_rekey) },
{ INT_RANGE(wpa_deny_ptk0_rekey, 0, 2) },
{ INT(group_rekey) },
@@ -3018,6 +3019,7 @@ void wpa_config_set_network_defaults(struct wpa_ssid *ssid)
ssid->proto = DEFAULT_PROTO;
ssid->pairwise_cipher = DEFAULT_PAIRWISE;
ssid->wpa_deny_ptk0_rekey = PTK0_REKEY_ALLOW_NEVER;
+ ssid->wpa_extended_key_id = DEFAULT_EXTENDED_KEY_ID;
ssid->group_cipher = DEFAULT_GROUP;
ssid->key_mgmt = DEFAULT_KEY_MGMT;
ssid->bg_scan_period = DEFAULT_BG_SCAN_PERIOD;
diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c
index 16b5251d0..390e51c76 100644
--- a/wpa_supplicant/config_file.c
+++ b/wpa_supplicant/config_file.c
@@ -899,6 +899,7 @@ static void wpa_config_write_network(FILE *f, struct wpa_ssid *ssid)
INT_DEF(dot11MeshHoldingTimeout, DEFAULT_MESH_HOLDING_TIMEOUT);
INT_DEF(mesh_rssi_threshold, DEFAULT_MESH_RSSI_THRESHOLD);
#endif /* CONFIG_MESH */
+ INT(wpa_extended_key_id);
INT(wpa_ptk_rekey);
INT(wpa_deny_ptk0_rekey);
INT(group_rekey);
diff --git a/wpa_supplicant/config_ssid.h b/wpa_supplicant/config_ssid.h
index f4bbb7882..f6b8b1c64 100644
--- a/wpa_supplicant/config_ssid.h
+++ b/wpa_supplicant/config_ssid.h
@@ -22,6 +22,7 @@
#define DEFAULT_PAIRWISE (WPA_CIPHER_CCMP | WPA_CIPHER_TKIP)
#define DEFAULT_GROUP (WPA_CIPHER_CCMP | WPA_CIPHER_TKIP)
#define DEFAULT_FRAGMENT_SIZE 1398
+#define DEFAULT_EXTENDED_KEY_ID 1
#define DEFAULT_BG_SCAN_PERIOD -1
#define DEFAULT_MESH_MAX_RETRIES 2
@@ -545,6 +546,15 @@ struct wpa_ssid {
unsigned int vht_center_freq1;
unsigned int vht_center_freq2;
+ /** wpa_extended_key_id - Extended Key ID support
+ *
+ * IEEE 802.11-2016 optionally allows to use key id 0 and 1 for PTK keys
+ * default: auto (1)
+ * 0 = force off. Do not announce or use Extended Key ID.
+ * 1 = auto. Use Extended Key ID when possible.
+ */
+ int wpa_extended_key_id;
+
/**
* wpa_ptk_rekey - Maximum lifetime for PTK in seconds
*
diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c
index 4e7b455b2..b12bafd85 100644
--- a/wpa_supplicant/ctrl_iface.c
+++ b/wpa_supplicant/ctrl_iface.c
@@ -5360,6 +5360,9 @@ static void wpa_supplicant_ctrl_iface_drop_sa(struct wpa_supplicant *wpa_s)
wpa_drv_set_key(wpa_s, WPA_ALG_NONE, wpa_s->bssid, 0, NULL, 0, NULL,
0, KEY_FLAG_PAIRWISE);
+ if (wpa_sm_extended_key_id(wpa_s->wpa))
+ wpa_drv_set_key(wpa_s, WPA_ALG_NONE, wpa_s->bssid, 1, NULL,
+ 0, NULL, 0, KEY_FLAG_PAIRWISE);
/* MLME-SETPROTECTION.request(None) */
wpa_drv_mlme_setprotection(wpa_s, wpa_s->bssid,
MLME_SETPROTECTION_PROTECT_TYPE_NONE,
diff --git a/wpa_supplicant/driver_i.h b/wpa_supplicant/driver_i.h
index 85d0f4c7a..24dad4807 100644
--- a/wpa_supplicant/driver_i.h
+++ b/wpa_supplicant/driver_i.h
@@ -150,7 +150,13 @@ static inline int wpa_drv_set_key(struct wpa_supplicant *wpa_s,
enum key_flag key_flag)
{
if (alg != WPA_ALG_NONE) {
- if (key_idx >= 0 && key_idx <= 6)
+ /* keyidx = 1 can be either a broadcast or - with
+ * Extended Key ID - an unicast key. Use bit 6 for
+ * the pairwise keyidx 1.
+ */
+ if (key_idx == 1 && key_flag & KEY_FLAG_PAIRWISE)
+ wpa_s->keys_cleared &= ~BIT(6);
+ else if (key_idx >= 0 && key_idx <= 5)
wpa_s->keys_cleared &= ~BIT(key_idx);
else
wpa_s->keys_cleared = 0;
diff --git a/wpa_supplicant/notify.c b/wpa_supplicant/notify.c
index 6758e6cf0..5bc819855 100644
--- a/wpa_supplicant/notify.c
+++ b/wpa_supplicant/notify.c
@@ -853,7 +853,8 @@ void wpas_notify_eap_error(struct wpa_supplicant *wpa_s, int error_code)
int wpas_notify_eap_auth_start(struct wpa_supplicant *wpa_s)
{
- if (!wpa_s->new_connection && wpa_s->deny_ptk0_rekey) {
+ if (!wpa_s->new_connection && wpa_s->deny_ptk0_rekey &&
+ !wpa_sm_extended_key_id_active(wpa_s->wpa)) {
wpa_msg(wpa_s, MSG_WARNING,
"WPA: PTK0 rekey not allowed, reconnecting");
wpa_supplicant_reconnect(wpa_s);
diff --git a/wpa_supplicant/wpa_cli.c b/wpa_supplicant/wpa_cli.c
index 63c681ffa..c3c62e6c7 100644
--- a/wpa_supplicant/wpa_cli.c
+++ b/wpa_supplicant/wpa_cli.c
@@ -1440,7 +1440,7 @@ static const char *network_fields[] = {
"dot11MeshRetryTimeout", "dot11MeshConfirmTimeout",
"dot11MeshHoldingTimeout",
#endif /* CONFIG_MESH */
- "wpa_ptk_rekey",
+ "wpa_ptk_rekey", "wpa_extended_key_id",
"wpa_deny_ptk0_rekey", "bgscan",
"ignore_broadcast_ssid", "enable_edmg", "edmg_channel",
#ifdef CONFIG_P2P
diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index f5a49194f..8424800e1 100644
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -740,10 +740,15 @@ void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, NULL, 0,
NULL, 0, KEY_FLAG_GROUP);
}
- if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
+ /* Pairwise key idx 1 for Extended Key ID is tracked with bit 6 */
+ if (~wpa_s->keys_cleared & (BIT(0) | BIT(6)) && addr &&
!is_zero_ether_addr(addr)) {
- wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, NULL, 0, NULL,
- 0, KEY_FLAG_PAIRWISE);
+ if (!(wpa_s->keys_cleared & (BIT(0))))
+ wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, NULL,
+ 0, NULL, 0, KEY_FLAG_PAIRWISE);
+ if (!(wpa_s->keys_cleared & (BIT(6))))
+ wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 1, NULL,
+ 0, NULL, 0, KEY_FLAG_PAIRWISE);
/* MLME-SETPROTECTION.request(None) */
wpa_drv_mlme_setprotection(
wpa_s, addr,
@@ -1291,6 +1296,26 @@ int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_DENY_PTK0_REKEY, 0);
}
+ /* For now Extended Key ID support is only be implemented for INFRA
+ * mode
+ */
+ if (ssid->mode == WPAS_MODE_INFRA && ssid->wpa_extended_key_id &&
+ ssid->proto & WPA_PROTO_RSN &&
+ ssid->pairwise_cipher & (WPA_CIPHER_CCMP | WPA_CIPHER_CCMP_256 |
+ WPA_CIPHER_GCMP | WPA_CIPHER_GCMP_256) &&
+ wpa_s->drv_flags & WPA_DRIVER_FLAGS_EXTENDED_KEY_ID) {
+ wpa_msg(wpa_s, MSG_INFO, "Enable Extended Key ID support");
+ wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_EXTENDED_KEY_ID, 1);
+ } else {
+ if (ssid->wpa_extended_key_id)
+ wpa_msg(wpa_s, MSG_INFO,
+ "Extended Key ID not supported");
+ else
+ wpa_dbg(wpa_s, MSG_DEBUG,
+ "Extended Key ID support disabled");
+ wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_EXTENDED_KEY_ID, 0);
+ }
+
if (bss) {
bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
diff --git a/wpa_supplicant/wpa_supplicant.conf b/wpa_supplicant/wpa_supplicant.conf
index 2665a8d11..e252fa3fc 100644
--- a/wpa_supplicant/wpa_supplicant.conf
+++ b/wpa_supplicant/wpa_supplicant.conf
@@ -1099,6 +1099,12 @@ fast_reauth=1
# hex without quotation, e.g., 0102030405)
# wep_tx_keyidx: Default WEP key index (TX) (0..3)
#
+# wpa_extended_key_id:
+# "Extended Key ID support for Individually Addressed Frames" according to
+# IEEE 802.11-2016.
+# 0 = force off: Do not use Extended Key ID
+# 1 = auto: Use Extended Key ID when possible (default)
+#
# wpa_ptk_rekey: Maximum lifetime for PTK in seconds. This can be used to
# enforce rekeying of PTK to mitigate some attacks against TKIP deficiencies.
#
diff --git a/wpa_supplicant/wpas_glue.c b/wpa_supplicant/wpas_glue.c
index ced1e3ea3..d430b204e 100644
--- a/wpa_supplicant/wpas_glue.c
+++ b/wpa_supplicant/wpas_glue.c
@@ -516,7 +516,8 @@ static int wpa_supplicant_set_key(void *_wpa_s, enum wpa_alg alg,
}
#endif /* CONFIG_TESTING_GET_GTK */
#ifdef CONFIG_TESTING_OPTIONS
- if (addr && !is_broadcast_ether_addr(addr)) {
+ if (addr && !is_broadcast_ether_addr(addr) &&
+ key_flag != KEY_FLAG_PAIRWISE_RX_TX_MODIFY) {
wpa_s->last_tk_alg = alg;
os_memcpy(wpa_s->last_tk_addr, addr, ETH_ALEN);
wpa_s->last_tk_key_idx = key_idx;
@@ -1293,6 +1294,7 @@ void wpa_supplicant_rsn_supp_set_config(struct wpa_supplicant *wpa_s,
#endif /* IEEE8021X_EAPOL */
conf.ssid = ssid->ssid;
conf.ssid_len = ssid->ssid_len;
+ conf.wpa_extended_key_id = ssid->wpa_extended_key_id;
conf.wpa_ptk_rekey = ssid->wpa_ptk_rekey;
conf.wpa_deny_ptk0_rekey = ssid->wpa_deny_ptk0_rekey;
#ifdef CONFIG_P2P
--
2.24.1
_______________________________________________
Hostap mailing list
Hostap@xxxxxxxxxxxxxxxxxxx
http://lists.infradead.org/mailman/listinfo/hostap
