2 * Host AP (software wireless LAN access point) user space daemon for
3 * Host AP kernel driver / IEEE 802.1X Authenticator
4 * Copyright (c) 2002-2006, Jouni Malinen <jkmaline@cc.hut.fi>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
10 * Alternatively, this software may be distributed under the terms of BSD
13 * See README and COPYING for more details.
19 #include <netinet/in.h>
21 #include <sys/ioctl.h>
26 #include <sys/socket.h>
29 #include "ieee802_1x.h"
30 #include "accounting.h"
32 #include "radius_client.h"
43 static void ieee802_1x_new_auth_session(struct hostapd_data *hapd,
44 struct sta_info *sta);
47 static void ieee802_1x_send(hostapd *hapd, struct sta_info *sta, u8 type,
48 u8 *data, size_t datalen)
51 struct ieee802_1x_hdr *xhdr;
55 len = sizeof(*xhdr) + datalen;
58 printf("malloc() failed for ieee802_1x_send(len=%lu)\n",
66 * According to IEEE 802.1aa/D4 EAPOL-Key should be sent before any
67 * remaining EAP frames, if possible. This would allow rest of the
68 * frames to be encrypted. This code could be used to request
69 * encryption from the kernel driver. */
71 sta->eapol_sm->be_auth.state == BE_AUTH_SUCCESS &&
72 sta->eapol_sm->keyTxEnabled)
76 xhdr = (struct ieee802_1x_hdr *) buf;
77 xhdr->version = hapd->conf->eapol_version;
79 xhdr->length = htons(datalen);
81 if (datalen > 0 && data != NULL)
82 memcpy(xhdr + 1, data, datalen);
84 if (sta->wpa_sm && sta->wpa_sm->pairwise_set)
86 if (sta->flags & WLAN_STA_PREAUTH) {
87 rsn_preauth_send(hapd, sta, buf, len);
89 hostapd_send_eapol(hapd, sta->addr, buf, len, encrypt);
96 void ieee802_1x_set_sta_authorized(hostapd *hapd, struct sta_info *sta,
99 if (sta->flags & WLAN_STA_PREAUTH)
103 sta->flags |= WLAN_STA_AUTHORIZED;
104 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
105 HOSTAPD_LEVEL_DEBUG, "authorizing port");
107 sta->flags &= ~WLAN_STA_AUTHORIZED;
108 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
109 HOSTAPD_LEVEL_DEBUG, "unauthorizing port");
112 hostapd_set_sta_authorized(hapd, sta->addr, authorized);
114 accounting_sta_start(hapd, sta);
118 static void ieee802_1x_eap_timeout(void *eloop_ctx, void *timeout_ctx)
120 struct sta_info *sta = eloop_ctx;
121 struct eapol_state_machine *sm = sta->eapol_sm;
124 hostapd_logger(sm->hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
125 HOSTAPD_LEVEL_DEBUG, "EAP timeout");
126 sm->eapTimeout = TRUE;
131 void ieee802_1x_request_identity(struct hostapd_data *hapd,
132 struct sta_info *sta)
138 struct eapol_state_machine *sm = sta->eapol_sm;
140 if (hapd->conf->eap_server) {
141 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
142 "IEEE 802.1X: Integrated EAP server in "
143 "use - do not generate EAP-Request/Identity\n");
147 if (sm == NULL || !sm->auth_pae.eapRestart)
150 ieee802_1x_new_auth_session(hapd, sta);
152 tlen = sizeof(*eap) + 1 + hapd->conf->eap_req_id_text_len;
156 printf("Could not allocate memory for identity request\n");
160 memset(buf, 0, tlen);
162 eap = (struct eap_hdr *) buf;
163 eap->code = EAP_CODE_REQUEST;
164 eap->identifier = ++sm->currentId;
165 eap->length = htons(tlen);
166 pos = (u8 *) (eap + 1);
167 *pos++ = EAP_TYPE_IDENTITY;
168 if (hapd->conf->eap_req_id_text) {
169 memcpy(pos, hapd->conf->eap_req_id_text,
170 hapd->conf->eap_req_id_text_len);
173 sm->be_auth.eapReq = TRUE;
174 free(sm->last_eap_radius);
175 sm->last_eap_radius = buf;
176 sm->last_eap_radius_len = tlen;
178 eloop_cancel_timeout(ieee802_1x_eap_timeout, sta, NULL);
179 eloop_register_timeout(30, 0, ieee802_1x_eap_timeout, sta, NULL);
180 sm->eapTimeout = FALSE;
182 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
183 "IEEE 802.1X: Generated EAP Request-Identity for " MACSTR
184 " (identifier %d, timeout 30)\n", MAC2STR(sta->addr),
187 sm->auth_pae.eapRestart = FALSE;
191 void ieee802_1x_tx_canned_eap(struct hostapd_data *hapd, struct sta_info *sta,
195 struct eapol_state_machine *sm = sta->eapol_sm;
197 memset(&eap, 0, sizeof(eap));
199 eap.code = success ? EAP_CODE_SUCCESS : EAP_CODE_FAILURE;
201 if (sm && sm->last_eap_radius) {
202 struct eap_hdr *hdr = (struct eap_hdr *) sm->last_eap_radius;
203 eap.identifier = hdr->identifier + 1;
205 eap.length = htons(sizeof(eap));
207 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
208 "IEEE 802.1X: Sending canned EAP packet %s to " MACSTR
209 " (identifier %d)\n", success ? "SUCCESS" : "FAILURE",
210 MAC2STR(sta->addr), eap.identifier);
211 ieee802_1x_send(hapd, sta, IEEE802_1X_TYPE_EAP_PACKET, (u8 *) &eap,
214 sm->dot1xAuthEapolFramesTx++;
218 void ieee802_1x_tx_req(struct hostapd_data *hapd, struct sta_info *sta)
221 struct eapol_state_machine *sm = sta->eapol_sm;
226 if (sm->last_eap_radius == NULL) {
227 printf("Error: TxReq called for station " MACSTR ", but there "
228 "is no EAP request from the authentication server\n",
233 eap = (struct eap_hdr *) sm->last_eap_radius;
234 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
235 "IEEE 802.1X: Sending EAP Packet to " MACSTR
236 " (identifier %d)\n", MAC2STR(sm->addr),
238 sm->currentId = eap->identifier;
239 ieee802_1x_send(hapd, sta, IEEE802_1X_TYPE_EAP_PACKET,
240 sm->last_eap_radius, sm->last_eap_radius_len);
241 sm->dot1xAuthEapolFramesTx++;
242 type = (u8 *) (eap + 1);
243 if (sm->last_eap_radius_len > sizeof(*eap) &&
244 *type == EAP_TYPE_IDENTITY)
245 sm->dot1xAuthEapolReqIdFramesTx++;
247 sm->dot1xAuthEapolReqFramesTx++;
251 void hostapd_get_ntp_timestamp(u8 *buf)
256 /* 64-bit NTP timestamp (time from 1900-01-01 00:00:00) */
257 gettimeofday(&now, NULL);
258 sec = htonl(now.tv_sec + 2208988800U); /* Epoch to 1900 */
259 /* Estimate 2^32/10^6 = 4295 - 1/32 - 1/512 */
261 usec = htonl(4295 * usec - (usec >> 5) - (usec >> 9));
262 memcpy(buf, (u8 *) &sec, 4);
263 memcpy(buf + 4, (u8 *) &usec, 4);
267 static void ieee802_1x_tx_key_one(hostapd *hapd, struct sta_info *sta,
268 int index, int broadcast,
269 u8 *key_data, size_t key_len)
272 struct ieee802_1x_hdr *hdr;
273 struct ieee802_1x_eapol_key *key;
274 size_t len, ekey_len;
275 struct eapol_state_machine *sm = sta->eapol_sm;
280 len = sizeof(*key) + key_len;
281 buf = malloc(sizeof(*hdr) + len);
285 memset(buf, 0, sizeof(*hdr) + len);
286 hdr = (struct ieee802_1x_hdr *) buf;
287 key = (struct ieee802_1x_eapol_key *) (hdr + 1);
288 key->type = EAPOL_KEY_TYPE_RC4;
289 key->key_length = htons(key_len);
290 hostapd_get_ntp_timestamp(key->replay_counter);
292 if (hostapd_get_rand(key->key_iv, sizeof(key->key_iv))) {
293 printf("Could not get random numbers\n");
298 key->key_index = index | (broadcast ? 0 : BIT(7));
299 if (hapd->conf->eapol_key_index_workaround) {
300 /* According to some information, WinXP Supplicant seems to
301 * interpret bit7 as an indication whether the key is to be
302 * activated, so make it possible to enable workaround that
303 * sets this bit for all keys. */
304 key->key_index |= BIT(7);
307 /* Key is encrypted using "Key-IV + sm->eapol_key_crypt" as the
309 memcpy((u8 *) (key + 1), key_data, key_len);
310 ekey_len = sizeof(key->key_iv) + sm->eapol_key_crypt_len;
311 ekey = malloc(ekey_len);
313 printf("Could not encrypt key\n");
317 memcpy(ekey, key->key_iv, sizeof(key->key_iv));
318 memcpy(ekey + sizeof(key->key_iv), sm->eapol_key_crypt,
319 sm->eapol_key_crypt_len);
320 rc4((u8 *) (key + 1), key_len, ekey, ekey_len);
323 /* This header is needed here for HMAC-MD5, but it will be regenerated
324 * in ieee802_1x_send() */
325 hdr->version = hapd->conf->eapol_version;
326 hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
327 hdr->length = htons(len);
328 hmac_md5(sm->eapol_key_sign, sm->eapol_key_sign_len,
329 buf, sizeof(*hdr) + len,
332 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
333 "IEEE 802.1X: Sending EAPOL-Key to " MACSTR
334 " (%s index=%d)\n", MAC2STR(sm->addr),
335 broadcast ? "broadcast" : "unicast", index);
336 ieee802_1x_send(hapd, sta, IEEE802_1X_TYPE_EAPOL_KEY, (u8 *) key, len);
338 sta->eapol_sm->dot1xAuthEapolFramesTx++;
343 void ieee802_1x_tx_key(struct hostapd_data *hapd, struct sta_info *sta)
345 struct eapol_state_machine *sm = sta->eapol_sm;
347 if (sm == NULL || !sm->eapol_key_sign || !sm->eapol_key_crypt)
350 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
351 "IEEE 802.1X: Sending EAPOL-Key(s) to " MACSTR "\n",
354 if (hapd->default_wep_key)
355 ieee802_1x_tx_key_one(hapd, sta, hapd->default_wep_key_idx, 1,
356 hapd->default_wep_key,
357 hapd->conf->default_wep_key_len);
359 if (hapd->conf->individual_wep_key_len > 0) {
361 ikey = malloc(hapd->conf->individual_wep_key_len);
363 hostapd_get_rand(ikey,
364 hapd->conf->individual_wep_key_len)) {
365 printf("Could not generate random individual WEP "
371 if (HOSTAPD_DEBUG_COND(HOSTAPD_DEBUG_MINIMAL))
372 hostapd_hexdump("Individual WEP key",
374 hapd->conf->individual_wep_key_len);
376 ieee802_1x_tx_key_one(hapd, sta, 0, 0, ikey,
377 hapd->conf->individual_wep_key_len);
379 /* TODO: set encryption in TX callback, i.e., only after STA
380 * has ACKed EAPOL-Key frame */
381 if (hostapd_set_encryption(hapd, "WEP", sta->addr, 0, ikey,
383 individual_wep_key_len)) {
384 printf("Could not set individual WEP encryption.\n");
392 static void ieee802_1x_encapsulate_radius(hostapd *hapd, struct sta_info *sta,
395 struct radius_msg *msg;
397 struct eapol_state_machine *sm = sta->eapol_sm;
402 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
403 "Encapsulating EAP message into a RADIUS packet\n");
405 sm->radius_identifier = radius_client_get_id(hapd->radius);
406 msg = radius_msg_new(RADIUS_CODE_ACCESS_REQUEST,
407 sm->radius_identifier);
409 printf("Could not create net RADIUS packet\n");
413 radius_msg_make_authenticator(msg, (u8 *) sta, sizeof(*sta));
416 !radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME,
417 sm->identity, sm->identity_len)) {
418 printf("Could not add User-Name\n");
422 if (hapd->conf->own_ip_addr.af == AF_INET &&
423 !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IP_ADDRESS,
424 (u8 *) &hapd->conf->own_ip_addr.u.v4, 4)) {
425 printf("Could not add NAS-IP-Address\n");
430 if (hapd->conf->own_ip_addr.af == AF_INET6 &&
431 !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IPV6_ADDRESS,
432 (u8 *) &hapd->conf->own_ip_addr.u.v6, 16)) {
433 printf("Could not add NAS-IPv6-Address\n");
436 #endif /* CONFIG_IPV6 */
438 if (hapd->conf->nas_identifier &&
439 !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IDENTIFIER,
440 (u8 *) hapd->conf->nas_identifier,
441 strlen(hapd->conf->nas_identifier))) {
442 printf("Could not add NAS-Identifier\n");
446 if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_NAS_PORT, sta->aid)) {
447 printf("Could not add NAS-Port\n");
451 snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT ":%s",
452 MAC2STR(hapd->own_addr), hapd->conf->ssid);
453 if (!radius_msg_add_attr(msg, RADIUS_ATTR_CALLED_STATION_ID,
454 (u8 *) buf, strlen(buf))) {
455 printf("Could not add Called-Station-Id\n");
459 snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT,
461 if (!radius_msg_add_attr(msg, RADIUS_ATTR_CALLING_STATION_ID,
462 (u8 *) buf, strlen(buf))) {
463 printf("Could not add Calling-Station-Id\n");
467 /* TODO: should probably check MTU from driver config; 2304 is max for
468 * IEEE 802.11, but use 1400 to avoid problems with too large packets
470 if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_FRAMED_MTU, 1400)) {
471 printf("Could not add Framed-MTU\n");
475 if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_NAS_PORT_TYPE,
476 RADIUS_NAS_PORT_TYPE_IEEE_802_11)) {
477 printf("Could not add NAS-Port-Type\n");
481 snprintf(buf, sizeof(buf), "CONNECT 11Mbps 802.11b");
482 if (!radius_msg_add_attr(msg, RADIUS_ATTR_CONNECT_INFO,
483 (u8 *) buf, strlen(buf))) {
484 printf("Could not add Connect-Info\n");
488 if (eap && !radius_msg_add_eap(msg, eap, len)) {
489 printf("Could not add EAP-Message\n");
493 /* State attribute must be copied if and only if this packet is
494 * Access-Request reply to the previous Access-Challenge */
495 if (sm->last_recv_radius && sm->last_recv_radius->hdr->code ==
496 RADIUS_CODE_ACCESS_CHALLENGE) {
497 int res = radius_msg_copy_attr(msg, sm->last_recv_radius,
500 printf("Could not copy State attribute from previous "
501 "Access-Challenge\n");
505 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
506 " Copied RADIUS State Attribute\n");
510 radius_client_send(hapd->radius, msg, RADIUS_AUTH, sta->addr);
514 radius_msg_free(msg);
519 static char *eap_type_text(u8 type)
522 case EAP_TYPE_IDENTITY: return "Identity";
523 case EAP_TYPE_NOTIFICATION: return "Notification";
524 case EAP_TYPE_NAK: return "Nak";
525 case EAP_TYPE_MD5: return "MD5-Challenge";
526 case EAP_TYPE_OTP: return "One-Time Password";
527 case EAP_TYPE_GTC: return "Generic Token Card";
528 case EAP_TYPE_TLS: return "TLS";
529 case EAP_TYPE_TTLS: return "TTLS";
530 case EAP_TYPE_PEAP: return "PEAP";
531 default: return "Unknown";
536 static void handle_eap_response(hostapd *hapd, struct sta_info *sta,
537 struct eap_hdr *eap, u8 *data, size_t len)
540 struct eapol_state_machine *sm = sta->eapol_sm;
544 if (eap->identifier != sm->currentId) {
545 hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
547 "EAP Identifier of the Response-Identity does "
548 "not match (was %d, expected %d) - ignored",
549 eap->identifier, sm->currentId);
554 printf("handle_eap_response: too short response data\n");
558 eloop_cancel_timeout(ieee802_1x_eap_timeout, sta, NULL);
560 free(sm->last_eap_supp);
561 sm->last_eap_supp_len = sizeof(*eap) + len;
562 sm->last_eap_supp = (u8 *) malloc(sm->last_eap_supp_len);
563 if (sm->last_eap_supp == NULL) {
564 printf("Could not alloc memory for last EAP Response\n");
567 memcpy(sm->last_eap_supp, eap, sizeof(*eap));
568 memcpy(sm->last_eap_supp + sizeof(*eap), data, len);
574 hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
575 HOSTAPD_LEVEL_DEBUG, "received EAP packet (code=%d "
576 "id=%d len=%d) from STA: EAP Response-%s (%d)",
577 eap->code, eap->identifier, ntohs(eap->length),
578 eap_type_text(type), type);
580 if (type == EAP_TYPE_IDENTITY) {
583 buf = malloc(4 * len + 1);
586 for (i = 0; i < len; i++) {
587 if (data[i] >= 32 && data[i] < 127)
590 snprintf(pos, 5, "{%02x}", data[i]);
595 hostapd_logger(hapd, sm->addr,
596 HOSTAPD_MODULE_IEEE8021X,
598 "STA identity '%s'", buf);
602 sm->rx_identity = TRUE;
603 sm->dot1xAuthEapolRespIdFramesRx++;
605 /* Save station identity for future RADIUS packets */
607 sm->identity = malloc(len + 1);
609 memcpy(sm->identity, data, len);
610 sm->identity[len] = '\0';
611 sm->identity_len = len;
614 sm->dot1xAuthEapolRespFramesRx++;
620 /* Process incoming EAP packet from Supplicant */
621 static void handle_eap(hostapd *hapd, struct sta_info *sta, u8 *buf,
627 if (len < sizeof(*eap)) {
628 printf(" too short EAP packet\n");
632 eap = (struct eap_hdr *) buf;
634 eap_len = ntohs(eap->length);
635 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
636 " EAP: code=%d identifier=%d length=%d",
637 eap->code, eap->identifier, eap_len);
638 if (eap_len < sizeof(*eap)) {
639 printf(" Invalid EAP length\n");
641 } else if (eap_len > len) {
642 printf(" Too short frame to contain this EAP packet\n");
644 } else if (eap_len < len) {
645 printf(" Ignoring %lu extra bytes after EAP packet\n",
646 (unsigned long) len - eap_len);
649 eap_len -= sizeof(*eap);
652 case EAP_CODE_REQUEST:
653 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " (request)\n");
655 case EAP_CODE_RESPONSE:
656 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " (response)\n");
657 handle_eap_response(hapd, sta, eap, (u8 *) (eap + 1), eap_len);
659 case EAP_CODE_SUCCESS:
660 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " (success)\n");
662 case EAP_CODE_FAILURE:
663 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " (failure)\n");
666 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " (unknown code)\n");
672 /* Process the EAPOL frames from the Supplicant */
673 void ieee802_1x_receive(struct hostapd_data *hapd, const u8 *sa, const u8 *buf,
676 struct sta_info *sta;
677 struct ieee802_1x_hdr *hdr;
678 struct ieee802_1x_eapol_key *key;
681 if (!hapd->conf->ieee802_1x && !hapd->conf->wpa)
684 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
685 "IEEE 802.1X: %lu bytes from " MACSTR "\n",
686 (unsigned long) len, MAC2STR(sa));
687 sta = ap_get_sta(hapd, sa);
689 printf(" no station information available\n");
693 if (len < sizeof(*hdr)) {
694 printf(" too short IEEE 802.1X packet\n");
698 hdr = (struct ieee802_1x_hdr *) buf;
699 datalen = ntohs(hdr->length);
700 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
701 " IEEE 802.1X: version=%d type=%d length=%d\n",
702 hdr->version, hdr->type, datalen);
704 if (len - sizeof(*hdr) < datalen) {
705 printf(" frame too short for this IEEE 802.1X packet\n");
707 sta->eapol_sm->dot1xAuthEapLengthErrorFramesRx++;
710 if (len - sizeof(*hdr) > datalen) {
711 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
712 " ignoring %lu extra octets after IEEE 802.1X "
714 (unsigned long) len - sizeof(*hdr) - datalen);
718 sta->eapol_sm->dot1xAuthLastEapolFrameVersion = hdr->version;
719 sta->eapol_sm->dot1xAuthEapolFramesRx++;
722 key = (struct ieee802_1x_eapol_key *) (hdr + 1);
723 if (datalen >= sizeof(struct ieee802_1x_eapol_key) &&
724 hdr->type == IEEE802_1X_TYPE_EAPOL_KEY &&
725 (key->type == EAPOL_KEY_TYPE_WPA ||
726 key->type == EAPOL_KEY_TYPE_RSN)) {
727 wpa_receive(hapd, sta, (u8 *) hdr, sizeof(*hdr) + datalen);
731 if (!hapd->conf->ieee802_1x || sta->wpa_key_mgmt == WPA_KEY_MGMT_PSK)
734 if (!sta->eapol_sm) {
735 sta->eapol_sm = eapol_sm_alloc(hapd, sta);
740 /* since we support version 1, we can ignore version field and proceed
741 * as specified in version 1 standard [IEEE Std 802.1X-2001, 7.5.5] */
742 /* TODO: actually, we are not version 1 anymore.. However, Version 2
743 * does not change frame contents, so should be ok to process frames
744 * more or less identically. Some changes might be needed for
745 * verification of fields. */
748 case IEEE802_1X_TYPE_EAP_PACKET:
749 handle_eap(hapd, sta, (u8 *) (hdr + 1), datalen);
752 case IEEE802_1X_TYPE_EAPOL_START:
753 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
754 HOSTAPD_LEVEL_DEBUG, "received EAPOL-Start "
757 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA,
758 HOSTAPD_LEVEL_DEBUG, "cached PMKSA "
759 "available - ignore it since "
760 "STA sent EAPOL-Start");
763 sta->eapol_sm->auth_pae.eapolStart = TRUE;
764 sta->eapol_sm->dot1xAuthEapolStartFramesRx++;
765 wpa_sm_event(hapd, sta, WPA_REAUTH_EAPOL);
768 case IEEE802_1X_TYPE_EAPOL_LOGOFF:
769 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
770 HOSTAPD_LEVEL_DEBUG, "received EAPOL-Logoff "
772 sta->acct_terminate_cause =
773 RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
774 sta->eapol_sm->auth_pae.eapolLogoff = TRUE;
775 sta->eapol_sm->dot1xAuthEapolLogoffFramesRx++;
778 case IEEE802_1X_TYPE_EAPOL_KEY:
779 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " EAPOL-Key\n");
780 if (!(sta->flags & WLAN_STA_AUTHORIZED)) {
781 printf(" Dropped key data from unauthorized "
787 case IEEE802_1X_TYPE_EAPOL_ENCAPSULATED_ASF_ALERT:
788 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
789 " EAPOL-Encapsulated-ASF-Alert\n");
790 /* TODO: implement support for this; show data */
794 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
795 " unknown IEEE 802.1X packet type\n");
796 sta->eapol_sm->dot1xAuthInvalidEapolFramesRx++;
800 eapol_sm_step(sta->eapol_sm);
804 void ieee802_1x_new_station(hostapd *hapd, struct sta_info *sta)
806 if (!hapd->conf->ieee802_1x || sta->wpa_key_mgmt == WPA_KEY_MGMT_PSK)
809 if (sta->eapol_sm == NULL) {
810 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
811 HOSTAPD_LEVEL_DEBUG, "start authentication");
812 sta->eapol_sm = eapol_sm_alloc(hapd, sta);
813 if (sta->eapol_sm == NULL) {
814 hostapd_logger(hapd, sta->addr,
815 HOSTAPD_MODULE_IEEE8021X,
817 "failed to allocate state machine");
822 sta->eapol_sm->portEnabled = TRUE;
825 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
827 "PMK from PMKSA cache - skip IEEE 802.1X/EAP");
828 /* Setup EAPOL state machines to already authenticated state
829 * because of existing PMKSA information in the cache. */
830 sta->eapol_sm->keyRun = TRUE;
831 sta->eapol_sm->keyAvailable = TRUE;
832 sta->eapol_sm->auth_pae.state = AUTH_PAE_AUTHENTICATING;
833 sta->eapol_sm->be_auth.state = BE_AUTH_SUCCESS;
834 sta->eapol_sm->authSuccess = TRUE;
835 if (sta->eapol_sm->eap)
836 eap_sm_notify_cached(sta->eapol_sm->eap);
838 eapol_sm_step(sta->eapol_sm);
842 void ieee802_1x_free_radius_class(struct radius_class_data *class)
847 for (i = 0; i < class->count; i++)
848 free(class->attr[i].data);
855 int ieee802_1x_copy_radius_class(struct radius_class_data *dst,
856 struct radius_class_data *src)
860 if (src->attr == NULL)
863 dst->attr = malloc(src->count * sizeof(struct radius_attr_data));
864 if (dst->attr == NULL)
867 memset(dst->attr, 0, src->count * sizeof(struct radius_attr_data));
870 for (i = 0; i < src->count; i++) {
871 dst->attr[i].data = malloc(src->attr[i].len);
872 if (dst->attr[i].data == NULL)
875 memcpy(dst->attr[i].data, src->attr[i].data, src->attr[i].len);
876 dst->attr[i].len = src->attr[i].len;
883 void ieee802_1x_free_station(struct sta_info *sta)
885 struct eapol_state_machine *sm = sta->eapol_sm;
887 eloop_cancel_timeout(ieee802_1x_eap_timeout, sta, NULL);
892 sta->eapol_sm = NULL;
894 if (sm->last_recv_radius) {
895 radius_msg_free(sm->last_recv_radius);
896 free(sm->last_recv_radius);
899 free(sm->last_eap_supp);
900 free(sm->last_eap_radius);
902 ieee802_1x_free_radius_class(&sm->radius_class);
903 free(sm->eapol_key_sign);
904 free(sm->eapol_key_crypt);
909 static void ieee802_1x_decapsulate_radius(hostapd *hapd, struct sta_info *sta)
916 struct radius_msg *msg;
917 struct eapol_state_machine *sm = sta->eapol_sm;
919 if (sm == NULL || sm->last_recv_radius == NULL) {
921 sm->be_auth.eapNoReq = TRUE;
925 msg = sm->last_recv_radius;
927 eap = radius_msg_get_eap(msg, &len);
929 /* draft-aboba-radius-rfc2869bis-20.txt, Chap. 2.6.3:
930 * RADIUS server SHOULD NOT send Access-Reject/no EAP-Message
932 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
933 HOSTAPD_LEVEL_WARNING, "could not extract "
934 "EAP-Message from RADIUS message");
935 free(sm->last_eap_radius);
936 sm->last_eap_radius = NULL;
937 sm->last_eap_radius_len = 0;
938 sm->be_auth.eapNoReq = TRUE;
942 if (len < sizeof(*hdr)) {
943 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
944 HOSTAPD_LEVEL_WARNING, "too short EAP packet "
945 "received from authentication server");
947 sm->be_auth.eapNoReq = TRUE;
951 if (len > sizeof(*hdr))
952 eap_type = eap[sizeof(*hdr)];
954 hdr = (struct eap_hdr *) eap;
956 case EAP_CODE_REQUEST:
957 snprintf(buf, sizeof(buf), "EAP-Request-%s (%d)",
958 eap_type >= 0 ? eap_type_text(eap_type) : "??",
961 case EAP_CODE_RESPONSE:
962 snprintf(buf, sizeof(buf), "EAP Response-%s (%d)",
963 eap_type >= 0 ? eap_type_text(eap_type) : "??",
966 case EAP_CODE_SUCCESS:
967 snprintf(buf, sizeof(buf), "EAP Success");
969 case EAP_CODE_FAILURE:
970 snprintf(buf, sizeof(buf), "EAP Failure");
973 snprintf(buf, sizeof(buf), "unknown EAP code");
976 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
977 HOSTAPD_LEVEL_DEBUG, "decapsulated EAP packet (code=%d "
978 "id=%d len=%d) from RADIUS server: %s",
979 hdr->code, hdr->identifier, ntohs(hdr->length), buf);
980 sm->be_auth.eapReq = TRUE;
982 free(sm->last_eap_radius);
983 sm->last_eap_radius = eap;
984 sm->last_eap_radius_len = len;
988 static void ieee802_1x_get_keys(hostapd *hapd, struct sta_info *sta,
989 struct radius_msg *msg, struct radius_msg *req,
990 u8 *shared_secret, size_t shared_secret_len)
992 struct radius_ms_mppe_keys *keys;
993 struct eapol_state_machine *sm = sta->eapol_sm;
997 keys = radius_msg_get_ms_keys(msg, req, shared_secret,
1001 if (HOSTAPD_DEBUG_COND(HOSTAPD_DEBUG_MINIMAL) && keys->send) {
1003 printf("MS-MPPE-Send-Key (len=%lu):",
1004 (unsigned long) keys->send_len);
1005 for (i = 0; i < keys->send_len; i++)
1006 printf(" %02x", keys->send[i]);
1009 if (HOSTAPD_DEBUG_COND(HOSTAPD_DEBUG_MINIMAL) && keys->recv) {
1011 printf("MS-MPPE-Recv-Key (len=%lu):",
1012 (unsigned long) keys->recv_len);
1013 for (i = 0; i < keys->recv_len; i++)
1014 printf(" %02x", keys->recv[i]);
1018 if (keys->send && keys->recv) {
1019 free(sm->eapol_key_sign);
1020 free(sm->eapol_key_crypt);
1021 sm->eapol_key_sign = keys->send;
1022 sm->eapol_key_sign_len = keys->send_len;
1023 sm->eapol_key_crypt = keys->recv;
1024 sm->eapol_key_crypt_len = keys->recv_len;
1025 if (hapd->default_wep_key ||
1026 hapd->conf->individual_wep_key_len > 0 ||
1028 sta->eapol_sm->keyAvailable = TRUE;
1038 static void ieee802_1x_store_radius_class(struct hostapd_data *hapd,
1039 struct sta_info *sta,
1040 struct radius_msg *msg)
1044 struct eapol_state_machine *sm = sta->eapol_sm;
1046 struct radius_attr_data *nclass;
1047 size_t nclass_count;
1049 if (!hapd->conf->radius->acct_server || hapd->radius == NULL ||
1053 ieee802_1x_free_radius_class(&sm->radius_class);
1054 count = radius_msg_count_attr(msg, RADIUS_ATTR_CLASS, 1);
1058 nclass = malloc(count * sizeof(struct radius_attr_data));
1063 memset(nclass, 0, count * sizeof(struct radius_attr_data));
1066 for (i = 0; i < count; i++) {
1068 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_CLASS,
1074 } while (class_len < 1);
1076 nclass[nclass_count].data = malloc(class_len);
1077 if (nclass[nclass_count].data == NULL)
1080 memcpy(nclass[nclass_count].data, class, class_len);
1081 nclass[nclass_count].len = class_len;
1085 sm->radius_class.attr = nclass;
1086 sm->radius_class.count = nclass_count;
1087 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "IEEE 802.1X: Stored %lu RADIUS "
1088 "Class attributes for " MACSTR "\n",
1089 (unsigned long) sm->radius_class.count,
1090 MAC2STR(sta->addr));
1094 /* Update sta->identity based on User-Name attribute in Access-Accept */
1095 static void ieee802_1x_update_sta_identity(struct hostapd_data *hapd,
1096 struct sta_info *sta,
1097 struct radius_msg *msg)
1101 struct eapol_state_machine *sm = sta->eapol_sm;
1106 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_USER_NAME, &buf, &len,
1110 identity = malloc(len + 1);
1111 if (identity == NULL)
1114 memcpy(identity, buf, len);
1115 identity[len] = '\0';
1117 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1118 HOSTAPD_LEVEL_DEBUG, "old identity '%s' updated with "
1119 "User-Name from Access-Accept '%s'",
1120 sm->identity ? (char *) sm->identity : "N/A",
1124 sm->identity = identity;
1125 sm->identity_len = len;
1129 struct sta_id_search {
1131 struct eapol_state_machine *sm;
1135 static int ieee802_1x_select_radius_identifier(struct hostapd_data *hapd,
1136 struct sta_info *sta,
1139 struct sta_id_search *id_search = ctx;
1140 struct eapol_state_machine *sm = sta->eapol_sm;
1142 if (sm && sm->radius_identifier >= 0 &&
1143 sm->radius_identifier == id_search->identifier) {
1151 static struct eapol_state_machine *
1152 ieee802_1x_search_radius_identifier(struct hostapd_data *hapd, u8 identifier)
1154 struct sta_id_search id_search;
1155 id_search.identifier = identifier;
1156 id_search.sm = NULL;
1157 ap_for_each_sta(hapd, ieee802_1x_select_radius_identifier, &id_search);
1158 return id_search.sm;
1162 /* Process the RADIUS frames from Authentication Server */
1163 static RadiusRxResult
1164 ieee802_1x_receive_auth(struct radius_msg *msg, struct radius_msg *req,
1165 u8 *shared_secret, size_t shared_secret_len,
1168 struct hostapd_data *hapd = data;
1169 struct sta_info *sta;
1170 u32 session_timeout = 0, termination_action, acct_interim_interval;
1171 int session_timeout_set;
1173 struct eapol_state_machine *sm;
1174 int override_eapReq = 0;
1176 sm = ieee802_1x_search_radius_identifier(hapd, msg->hdr->identifier);
1178 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "IEEE 802.1X: Could not "
1179 "find matching station for this RADIUS "
1181 return RADIUS_RX_UNKNOWN;
1185 /* RFC 2869, Ch. 5.13: valid Message-Authenticator attribute MUST be
1186 * present when packet contains an EAP-Message attribute */
1187 if (msg->hdr->code == RADIUS_CODE_ACCESS_REJECT &&
1188 radius_msg_get_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR, NULL,
1190 radius_msg_get_attr(msg, RADIUS_ATTR_EAP_MESSAGE, NULL, 0) < 0) {
1191 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "Allowing RADIUS "
1192 "Access-Reject without Message-Authenticator "
1193 "since it does not include EAP-Message\n");
1194 } else if (radius_msg_verify(msg, shared_secret, shared_secret_len,
1196 printf("Incoming RADIUS packet did not have correct "
1197 "Message-Authenticator - dropped\n");
1198 return RADIUS_RX_INVALID_AUTHENTICATOR;
1201 if (msg->hdr->code != RADIUS_CODE_ACCESS_ACCEPT &&
1202 msg->hdr->code != RADIUS_CODE_ACCESS_REJECT &&
1203 msg->hdr->code != RADIUS_CODE_ACCESS_CHALLENGE) {
1204 printf("Unknown RADIUS message code\n");
1205 return RADIUS_RX_UNKNOWN;
1208 sm->radius_identifier = -1;
1209 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
1210 "RADIUS packet matching with station " MACSTR "\n",
1211 MAC2STR(sta->addr));
1213 if (sm->last_recv_radius) {
1214 radius_msg_free(sm->last_recv_radius);
1215 free(sm->last_recv_radius);
1218 sm->last_recv_radius = msg;
1220 session_timeout_set =
1221 !radius_msg_get_attr_int32(msg, RADIUS_ATTR_SESSION_TIMEOUT,
1223 if (radius_msg_get_attr_int32(msg, RADIUS_ATTR_TERMINATION_ACTION,
1224 &termination_action))
1225 termination_action = RADIUS_TERMINATION_ACTION_DEFAULT;
1227 if (hapd->conf->radius->acct_interim_interval == 0 &&
1228 msg->hdr->code == RADIUS_CODE_ACCESS_ACCEPT &&
1229 radius_msg_get_attr_int32(msg, RADIUS_ATTR_ACCT_INTERIM_INTERVAL,
1230 &acct_interim_interval) == 0) {
1231 if (acct_interim_interval < 60) {
1232 hostapd_logger(hapd, sta->addr,
1233 HOSTAPD_MODULE_IEEE8021X,
1235 "ignored too small "
1236 "Acct-Interim-Interval %d",
1237 acct_interim_interval);
1239 sta->acct_interim_interval = acct_interim_interval;
1243 switch (msg->hdr->code) {
1244 case RADIUS_CODE_ACCESS_ACCEPT:
1245 /* RFC 3580, Ch. 3.17 */
1246 if (session_timeout_set && termination_action ==
1247 RADIUS_TERMINATION_ACTION_RADIUS_REQUEST) {
1248 sm->reauth_timer.reAuthPeriod = session_timeout;
1249 } else if (session_timeout_set)
1250 ap_sta_session_timeout(hapd, sta, session_timeout);
1252 sm->eapSuccess = TRUE;
1253 override_eapReq = 1;
1254 ieee802_1x_get_keys(hapd, sta, msg, req, shared_secret,
1256 ieee802_1x_store_radius_class(hapd, sta, msg);
1257 ieee802_1x_update_sta_identity(hapd, sta, msg);
1258 if (sm->keyAvailable) {
1259 pmksa_cache_add(hapd, sta, sm->eapol_key_crypt,
1260 session_timeout_set ?
1261 session_timeout : -1);
1264 case RADIUS_CODE_ACCESS_REJECT:
1266 override_eapReq = 1;
1268 case RADIUS_CODE_ACCESS_CHALLENGE:
1269 if (session_timeout_set) {
1270 /* RFC 2869, Ch. 2.3.2; RFC 3580, Ch. 3.17 */
1271 eap_timeout = session_timeout;
1274 hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
1275 HOSTAPD_LEVEL_DEBUG,
1276 "using EAP timeout of %d seconds%s",
1278 session_timeout_set ? " (from RADIUS)" : "");
1279 eloop_cancel_timeout(ieee802_1x_eap_timeout, sta, NULL);
1280 eloop_register_timeout(eap_timeout, 0, ieee802_1x_eap_timeout,
1282 sm->eapTimeout = FALSE;
1286 ieee802_1x_decapsulate_radius(hapd, sta);
1287 if (override_eapReq)
1288 sm->be_auth.eapReq = FALSE;
1292 return RADIUS_RX_QUEUED;
1296 /* Handler for EAPOL Backend Authentication state machine sendRespToServer.
1297 * Forward the EAP Response from Supplicant to Authentication Server. */
1298 void ieee802_1x_send_resp_to_server(hostapd *hapd, struct sta_info *sta)
1300 struct eapol_state_machine *sm = sta->eapol_sm;
1304 if (hapd->conf->eap_server) {
1305 eap_set_eapRespData(sm->eap, sm->last_eap_supp,
1306 sm->last_eap_supp_len);
1308 ieee802_1x_encapsulate_radius(hapd, sta, sm->last_eap_supp,
1309 sm->last_eap_supp_len);
1314 void ieee802_1x_abort_auth(struct hostapd_data *hapd, struct sta_info *sta)
1316 struct eapol_state_machine *sm = sta->eapol_sm;
1320 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1321 HOSTAPD_LEVEL_DEBUG, "aborting authentication");
1323 if (sm->last_recv_radius) {
1324 radius_msg_free(sm->last_recv_radius);
1325 free(sm->last_recv_radius);
1326 sm->last_recv_radius = NULL;
1328 free(sm->last_eap_supp);
1329 sm->last_eap_supp = NULL;
1330 sm->last_eap_supp_len = 0;
1331 free(sm->last_eap_radius);
1332 sm->last_eap_radius = NULL;
1333 sm->last_eap_radius_len = 0;
1337 void ieee802_1x_set_port_enabled(hostapd *hapd, struct sta_info *sta,
1343 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
1344 "IEEE 802.1X: station " MACSTR " port %s\n",
1345 MAC2STR(sta->addr), enabled ? "enabled" : "disabled");
1346 sta->eapol_sm->portEnabled = enabled ? TRUE : FALSE;
1347 eapol_sm_step(sta->eapol_sm);
1351 #ifdef HOSTAPD_DUMP_STATE
1352 void ieee802_1x_dump_state(FILE *f, const char *prefix, struct sta_info *sta)
1354 struct eapol_state_machine *sm = sta->eapol_sm;
1358 fprintf(f, "%sIEEE 802.1X:\n", prefix);
1362 fprintf(f, "%sidentity=", prefix);
1363 for (i = 0; i < sm->identity_len; i++)
1364 fprint_char(f, sm->identity[i]);
1368 fprintf(f, "%scached_packets=%s%s%s\n", prefix,
1369 sm->last_recv_radius ? "[RX RADIUS]" : "",
1370 sm->last_eap_radius ? "[EAP RADIUS]" : "",
1371 sm->last_eap_supp ? "[EAP SUPPLICANT]" : "");
1373 eapol_sm_dump_state(f, prefix, sm);
1375 #endif /* HOSTAPD_DUMP_STATE */
1378 static int ieee802_1x_rekey_broadcast(hostapd *hapd)
1380 if (hapd->conf->default_wep_key_len < 1)
1383 free(hapd->default_wep_key);
1384 hapd->default_wep_key = malloc(hapd->conf->default_wep_key_len);
1385 if (hapd->default_wep_key == NULL ||
1386 hostapd_get_rand(hapd->default_wep_key,
1387 hapd->conf->default_wep_key_len)) {
1388 printf("Could not generate random WEP key.\n");
1389 free(hapd->default_wep_key);
1390 hapd->default_wep_key = NULL;
1394 if (HOSTAPD_DEBUG_COND(HOSTAPD_DEBUG_MINIMAL)) {
1395 hostapd_hexdump("IEEE 802.1X: New default WEP key",
1396 hapd->default_wep_key,
1397 hapd->conf->default_wep_key_len);
1404 static int ieee802_1x_sta_key_available(struct hostapd_data *hapd,
1405 struct sta_info *sta, void *ctx)
1407 if (sta->eapol_sm) {
1408 sta->eapol_sm->keyAvailable = TRUE;
1409 eapol_sm_step(sta->eapol_sm);
1415 static void ieee802_1x_rekey(void *eloop_ctx, void *timeout_ctx)
1417 struct hostapd_data *hapd = eloop_ctx;
1419 if (hapd->default_wep_key_idx >= 3)
1420 hapd->default_wep_key_idx =
1421 hapd->conf->individual_wep_key_len > 0 ? 1 : 0;
1423 hapd->default_wep_key_idx++;
1425 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "IEEE 802.1X: New default WEP "
1426 "key index %d\n", hapd->default_wep_key_idx);
1428 if (ieee802_1x_rekey_broadcast(hapd)) {
1429 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE8021X,
1430 HOSTAPD_LEVEL_WARNING, "failed to generate a "
1431 "new broadcast key");
1432 free(hapd->default_wep_key);
1433 hapd->default_wep_key = NULL;
1437 /* TODO: Could setup key for RX here, but change default TX keyid only
1438 * after new broadcast key has been sent to all stations. */
1439 if (hostapd_set_encryption(hapd, "WEP", NULL,
1440 hapd->default_wep_key_idx,
1441 hapd->default_wep_key,
1442 hapd->conf->default_wep_key_len)) {
1443 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE8021X,
1444 HOSTAPD_LEVEL_WARNING, "failed to configure a "
1445 "new broadcast key");
1446 free(hapd->default_wep_key);
1447 hapd->default_wep_key = NULL;
1451 ap_for_each_sta(hapd, ieee802_1x_sta_key_available, NULL);
1453 if (hapd->conf->wep_rekeying_period > 0) {
1454 eloop_register_timeout(hapd->conf->wep_rekeying_period, 0,
1455 ieee802_1x_rekey, hapd, NULL);
1460 int ieee802_1x_init(hostapd *hapd)
1464 if ((hapd->conf->ieee802_1x || hapd->conf->wpa) &&
1465 hostapd_set_ieee8021x(hapd, 1))
1468 if (radius_client_register(hapd->radius, RADIUS_AUTH,
1469 ieee802_1x_receive_auth, hapd))
1472 if (hapd->conf->default_wep_key_len) {
1473 for (i = 0; i < 4; i++)
1474 hostapd_set_encryption(hapd, "none", NULL, i, NULL, 0);
1476 ieee802_1x_rekey(hapd, NULL);
1478 if (hapd->default_wep_key == NULL)
1486 void ieee802_1x_deinit(hostapd *hapd)
1488 if (hapd->driver != NULL &&
1489 (hapd->conf->ieee802_1x || hapd->conf->wpa))
1490 hostapd_set_ieee8021x(hapd, 0);
1494 static void ieee802_1x_new_auth_session(struct hostapd_data *hapd,
1495 struct sta_info *sta)
1497 struct eapol_state_machine *sm = sta->eapol_sm;
1501 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
1502 "IEEE 802.1X: station " MACSTR " - new auth session, "
1503 "clearing State\n", MAC2STR(sta->addr));
1505 if (sm->last_recv_radius) {
1506 radius_msg_free(sm->last_recv_radius);
1507 free(sm->last_recv_radius);
1508 sm->last_recv_radius = NULL;
1511 sm->eapSuccess = FALSE;
1512 sm->eapFail = FALSE;
1516 int ieee802_1x_tx_status(hostapd *hapd, struct sta_info *sta, u8 *buf,
1517 size_t len, int ack)
1519 struct ieee80211_hdr *hdr;
1520 struct ieee802_1x_hdr *xhdr;
1521 struct ieee802_1x_eapol_key *key;
1526 if (len < sizeof(*hdr) + sizeof(rfc1042_header) + 2 + sizeof(*xhdr))
1529 hdr = (struct ieee80211_hdr *) buf;
1530 pos = (u8 *) (hdr + 1);
1531 if (memcmp(pos, rfc1042_header, sizeof(rfc1042_header)) != 0)
1533 pos += sizeof(rfc1042_header);
1534 if (((pos[0] << 8) | pos[1]) != ETH_P_PAE)
1538 xhdr = (struct ieee802_1x_hdr *) pos;
1539 pos += sizeof(*xhdr);
1541 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "IEEE 802.1X: " MACSTR
1542 " TX status - version=%d type=%d length=%d - ack=%d\n",
1543 MAC2STR(sta->addr), xhdr->version, xhdr->type,
1544 ntohs(xhdr->length), ack);
1546 /* EAPOL EAP-Packet packets are eventually re-sent by either Supplicant
1547 * or Authenticator state machines, but EAPOL-Key packets are not
1548 * retransmitted in case of failure. Try to re-sent failed EAPOL-Key
1549 * packets couple of times because otherwise STA keys become
1550 * unsynchronized with AP. */
1551 if (xhdr->type == IEEE802_1X_TYPE_EAPOL_KEY && !ack &&
1552 pos + sizeof(*key) <= buf + len) {
1553 key = (struct ieee802_1x_eapol_key *) pos;
1554 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1555 HOSTAPD_LEVEL_DEBUG, "did not Ack EAPOL-Key "
1556 "frame (%scast index=%d)",
1557 key->key_index & BIT(7) ? "uni" : "broad",
1558 key->key_index & ~BIT(7));
1559 /* TODO: re-send EAPOL-Key couple of times (with short delay
1560 * between them?). If all attempt fail, report error and
1561 * deauthenticate STA so that it will get new keys when
1562 * authenticating again (e.g., after returning in range).
1563 * Separate limit/transmit state needed both for unicast and
1564 * broadcast keys(?) */
1566 /* TODO: could move unicast key configuration from ieee802_1x_tx_key()
1567 * to here and change the key only if the EAPOL-Key packet was Acked.
1574 u8 * ieee802_1x_get_identity(struct eapol_state_machine *sm, size_t *len)
1576 if (sm == NULL || sm->identity == NULL)
1579 *len = sm->identity_len;
1580 return sm->identity;
1584 u8 * ieee802_1x_get_radius_class(struct eapol_state_machine *sm, size_t *len,
1587 if (sm == NULL || sm->radius_class.attr == NULL ||
1588 idx >= sm->radius_class.count)
1591 *len = sm->radius_class.attr[idx].len;
1592 return sm->radius_class.attr[idx].data;
1596 u8 * ieee802_1x_get_key_crypt(struct eapol_state_machine *sm, size_t *len)
1601 *len = sm->eapol_key_crypt_len;
1602 return sm->eapol_key_crypt;
1606 void ieee802_1x_notify_port_enabled(struct eapol_state_machine *sm,
1611 sm->portEnabled = enabled ? TRUE : FALSE;
1616 void ieee802_1x_notify_port_valid(struct eapol_state_machine *sm,
1621 sm->portValid = valid ? TRUE : FALSE;
1626 void ieee802_1x_notify_pre_auth(struct eapol_state_machine *sm, int pre_auth)
1631 sm->flags |= EAPOL_SM_PREAUTH;
1633 sm->flags &= ~EAPOL_SM_PREAUTH;
1637 static const char * bool_txt(Boolean bool)
1639 return bool ? "TRUE" : "FALSE";
1643 int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
1650 int ieee802_1x_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta,
1651 char *buf, size_t buflen)
1654 struct eapol_state_machine *sm = sta->eapol_sm;
1659 len += snprintf(buf + len, buflen - len,
1660 "dot1xPaePortNumber=%d\n"
1661 "dot1xPaePortProtocolVersion=%d\n"
1662 "dot1xPaePortCapabilities=1\n"
1663 "dot1xPaePortInitialize=%d\n"
1664 "dot1xPaePortReauthenticate=FALSE\n",
1669 /* dot1xAuthConfigTable */
1670 len += snprintf(buf + len, buflen - len,
1671 "dot1xAuthPaeState=%d\n"
1672 "dot1xAuthBackendAuthState=%d\n"
1673 "dot1xAuthAdminControlledDirections=%d\n"
1674 "dot1xAuthOperControlledDirections=%d\n"
1675 "dot1xAuthAuthControlledPortStatus=%d\n"
1676 "dot1xAuthAuthControlledPortControl=%d\n"
1677 "dot1xAuthQuietPeriod=%u\n"
1678 "dot1xAuthServerTimeout=%u\n"
1679 "dot1xAuthReAuthPeriod=%u\n"
1680 "dot1xAuthReAuthEnabled=%s\n"
1681 "dot1xAuthKeyTxEnabled=%s\n",
1682 sm->auth_pae.state + 1,
1683 sm->be_auth.state + 1,
1684 sm->ctrl_dir.adminControlledDirections,
1685 sm->ctrl_dir.operControlledDirections,
1688 sm->auth_pae.quietPeriod,
1689 sm->be_auth.serverTimeout,
1690 sm->reauth_timer.reAuthPeriod,
1691 bool_txt(sm->reauth_timer.reAuthEnabled),
1692 bool_txt(sm->keyTxEnabled));
1694 /* dot1xAuthStatsTable */
1695 len += snprintf(buf + len, buflen - len,
1696 "dot1xAuthEapolFramesRx=%u\n"
1697 "dot1xAuthEapolFramesTx=%u\n"
1698 "dot1xAuthEapolStartFramesRx=%u\n"
1699 "dot1xAuthEapolLogoffFramesRx=%u\n"
1700 "dot1xAuthEapolRespIdFramesRx=%u\n"
1701 "dot1xAuthEapolRespFramesRx=%u\n"
1702 "dot1xAuthEapolReqIdFramesTx=%u\n"
1703 "dot1xAuthEapolReqFramesTx=%u\n"
1704 "dot1xAuthInvalidEapolFramesRx=%u\n"
1705 "dot1xAuthEapLengthErrorFramesRx=%u\n"
1706 "dot1xAuthLastEapolFrameVersion=%u\n"
1707 "dot1xAuthLastEapolFrameSource=" MACSTR "\n",
1708 sm->dot1xAuthEapolFramesRx,
1709 sm->dot1xAuthEapolFramesTx,
1710 sm->dot1xAuthEapolStartFramesRx,
1711 sm->dot1xAuthEapolLogoffFramesRx,
1712 sm->dot1xAuthEapolRespIdFramesRx,
1713 sm->dot1xAuthEapolRespFramesRx,
1714 sm->dot1xAuthEapolReqIdFramesTx,
1715 sm->dot1xAuthEapolReqFramesTx,
1716 sm->dot1xAuthInvalidEapolFramesRx,
1717 sm->dot1xAuthEapLengthErrorFramesRx,
1718 sm->dot1xAuthLastEapolFrameVersion,
1721 /* dot1xAuthDiagTable */
1722 len += snprintf(buf + len, buflen - len,
1723 "dot1xAuthEntersConnecting=%u\n"
1724 "dot1xAuthEapLogoffsWhileConnecting=%u\n"
1725 "dot1xAuthEntersAuthenticating=%u\n"
1726 "dot1xAuthAuthSuccessesWhileAuthenticating=%u\n"
1727 "dot1xAuthAuthTimeoutsWhileAuthenticating=%u\n"
1728 "dot1xAuthAuthFailWhileAuthenticating=%u\n"
1729 "dot1xAuthAuthEapStartsWhileAuthenticating=%u\n"
1730 "dot1xAuthAuthEapLogoffWhileAuthenticating=%u\n"
1731 "dot1xAuthAuthReauthsWhileAuthenticated=%u\n"
1732 "dot1xAuthAuthEapStartsWhileAuthenticated=%u\n"
1733 "dot1xAuthAuthEapLogoffWhileAuthenticated=%u\n"
1734 "dot1xAuthBackendResponses=%u\n"
1735 "dot1xAuthBackendAccessChallenges=%u\n"
1736 "dot1xAuthBackendOtherRequestsToSupplicant=%u\n"
1737 "dot1xAuthBackendAuthSuccesses=%u\n"
1738 "dot1xAuthBackendAuthFails=%u\n",
1739 sm->auth_pae.authEntersConnecting,
1740 sm->auth_pae.authEapLogoffsWhileConnecting,
1741 sm->auth_pae.authEntersAuthenticating,
1742 sm->auth_pae.authAuthSuccessesWhileAuthenticating,
1743 sm->auth_pae.authAuthTimeoutsWhileAuthenticating,
1744 sm->auth_pae.authAuthFailWhileAuthenticating,
1745 sm->auth_pae.authAuthEapStartsWhileAuthenticating,
1746 sm->auth_pae.authAuthEapLogoffWhileAuthenticating,
1747 sm->auth_pae.authAuthReauthsWhileAuthenticated,
1748 sm->auth_pae.authAuthEapStartsWhileAuthenticated,
1749 sm->auth_pae.authAuthEapLogoffWhileAuthenticated,
1750 sm->be_auth.backendResponses,
1751 sm->be_auth.backendAccessChallenges,
1752 sm->be_auth.backendOtherRequestsToSupplicant,
1753 sm->be_auth.backendAuthSuccesses,
1754 sm->be_auth.backendAuthFails);
1756 /* dot1xAuthSessionStatsTable */
1757 len += snprintf(buf + len, buflen - len,
1758 /* TODO: dot1xAuthSessionOctetsRx */
1759 /* TODO: dot1xAuthSessionOctetsTx */
1760 /* TODO: dot1xAuthSessionFramesRx */
1761 /* TODO: dot1xAuthSessionFramesTx */
1762 "dot1xAuthSessionId=%08X-%08X\n"
1763 "dot1xAuthSessionAuthenticMethod=%d\n"
1764 "dot1xAuthSessionTime=%u\n"
1765 "dot1xAuthSessionTerminateCause=999\n"
1766 "dot1xAuthSessionUserName=%s\n",
1767 sta->acct_session_id_hi, sta->acct_session_id_lo,
1768 sta->wpa_key_mgmt == WPA_KEY_MGMT_IEEE8021X ? 1 : 2,
1769 (unsigned int) (time(NULL) - sta->acct_session_start),
1776 void ieee802_1x_finished(struct hostapd_data *hapd, struct sta_info *sta,
1781 /* TODO: get PMKLifetime from WPA parameters */
1782 static const int dot11RSNAConfigPMKLifetime = 43200;
1784 key = ieee802_1x_get_key_crypt(sta->eapol_sm, &len);
1785 if (success && key) {
1786 pmksa_cache_add(hapd, sta, key, dot11RSNAConfigPMKLifetime);