Kernel/iwd
3
0
Fork 0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-12-18 17:22:50 +01:00
Code Releases Activity
514e483bc3
iwd/src/ft.c

1199 lines
29 KiB
C
Raw Normal View History

netdev: Handle the FT Authentication Response message Parse the second message of the FT transition, validate and build the third message, the Reassociation Request.
2017-01-12 09:36:01 +01:00
/*
*
* Wireless daemon for Linux
*
treewide: Move the Intel copyright forward to 2019
2019-10-25 00:43:08 +02:00
* Copyright (C) 2017-2019 Intel Corporation. All rights reserved.
netdev: Handle the FT Authentication Response message Parse the second message of the FT transition, validate and build the third message, the Reassociation Request.
2017-01-12 09:36:01 +01:00
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
*
*/
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
#include <ell/ell.h>
#include "src/ie.h"
#include "src/handshake.h"
#include "src/crypto.h"
ft: rename ftutil to ft (prep for auth-proto) Now the 'ft' module, previously ftutil, will be used to drive FT via the auth-proto virtual class. This renaming is in preparation as ftutil will become obsolete since all the IE building/processing is going to be moved out of netdev. The new ft.c module will utilize the existing ftutil functionality, but since this is now a full blown auth protocol naming it 'ft' is better suited.
2019-05-07 20:53:41 +02:00
#include "src/ft.h"
ftutil: add associate parser Helper to obtain RSNE, MDE, and FTE from associate frame.
2019-03-05 18:12:30 +01:00
#include "src/mpdu.h"
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
#include "src/auth-proto.h"
ft: sent OCI in Reassociate
2021-09-27 19:03:59 +02:00
#include "src/band.h"
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
#include "src/scan.h"
#include "src/util.h"
#include "src/netdev.h"
#include "src/module.h"
ft: implement offchannel authentication A new API was added, ft_authenticate, which will send an authentication frame offchannel via CMD_FRAME. This bypasses the kernel's authentication state allowing multiple auth attempts to take place without disconnecting.
2022-09-27 21:47:23 +02:00
#include "src/offchannel.h"
#include "src/wiphy.h"
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
ft: Introduce ft_authenticate_onchannel Currently when we try FT-over-Air, the Authenticate frame is always sent via offchannel infrastructure We request the driver to go offchannel, then send the Authenticate frame. This works fine as long as the target AP is on a different channel. On some networks some (or all) APs might actually be located on the same channel. In this case going offchannel will result in some drivers not actually sending the Authenticate frame until after the offchannel operation completes. Work around this by introducing a new ft_authenticate variant that will not request an offchannel operation first.
2023-03-01 16:30:24 +01:00
static const unsigned int FT_ONCHANNEL_TIME = 300u; /* ms */
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
static ft_tx_frame_func_t tx_frame = NULL;
static struct l_queue *info_list = NULL;
struct ft_info {
uint32_t ifindex;
uint8_t spa[6];
uint8_t aa[6];
uint8_t snonce[32];
uint8_t mde[3];
uint8_t *fte;
uint8_t *authenticator_ie;
uint8_t prev_bssid[6];
uint32_t frequency;
ft: gate FT-over-DS with a wiphy work item Queue the FT action just like we do with FT Authenticate which makes it able to be used the same way, i.e. call ft_action() then queue the ft_associate work right away. A timer was added to end the work item in case the target never responds.
2022-12-14 22:26:56 +01:00
uint32_t ds_frequency;
ft: implement offchannel authentication A new API was added, ft_authenticate, which will send an authentication frame offchannel via CMD_FRAME. This bypasses the kernel's authentication state allowing multiple auth attempts to take place without disconnecting.
2022-09-27 21:47:23 +02:00
uint32_t offchannel_id;
ft: track FT auth/action response status Certain return codes, though failures, can indicate that the AP is just confused or booting up and treating it as a full failure may not be the best route. For example in some production deployments if an AP is rebooted it may take some time for neighboring APs to exchange keys for current associations. If a client roams during that time it will reject saying the PMKID is invalid. Use the ft_associate call return to communicate the status (if any) that was in the auth/action response. If there was a parsing error or no response -ENOENT is still returned.
2023-08-31 14:39:22 +02:00
/* Status of Authenticate/Action frame response, or error (< 0) */
int status;
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
ft: gate FT-over-DS with a wiphy work item Queue the FT action just like we do with FT Authenticate which makes it able to be used the same way, i.e. call ft_action() then queue the ft_associate work right away. A timer was added to end the work item in case the target never responds.
2022-12-14 22:26:56 +01:00
struct l_timeout *timeout;
struct wiphy_radio_work_item work;
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
struct ie_ft_info ft_info;
ft: Introduce ft_authenticate_onchannel Currently when we try FT-over-Air, the Authenticate frame is always sent via offchannel infrastructure We request the driver to go offchannel, then send the Authenticate frame. This works fine as long as the target AP is on a different channel. On some networks some (or all) APs might actually be located on the same channel. In this case going offchannel will result in some drivers not actually sending the Authenticate frame until after the offchannel operation completes. Work around this by introducing a new ft_authenticate variant that will not request an offchannel operation first.
2023-03-01 16:30:24 +01:00
bool onchannel : 1;
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
};
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
netdev: Handle the FT Authentication Response message Parse the second message of the FT transition, validate and build the third message, the Reassociation Request.
2017-01-12 09:36:01 +01:00
/*
* Calculate the MIC field of the FTE and write it directly to that FTE,
* assuming it was all zeros before. See 12.8.4 and 12.8.5.
*/
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
static bool ft_calculate_fte_mic(struct handshake_state *hs, uint8_t seq_num,
netdev: Handle the FT Authentication Response message Parse the second message of the FT transition, validate and build the third message, the Reassociation Request.
2017-01-12 09:36:01 +01:00
const uint8_t *rsne, const uint8_t *fte,
const uint8_t *ric, uint8_t *out_mic)
{
struct iovec iov[10];
int iov_elems = 0;
struct l_checksum *checksum;
crypto/handshake/eapol: Allow other PTK lengths The crypto_ptk was hard coded for 16 byte KCK/KEK. Depending on the AKM these can be up to 32 bytes. This changes completely removes the crypto_ptk struct and adds getters to the handshake object for the kck and kek. Like before the PTK is derived into a continuous buffer, and the kck/kek getters take care of returning the proper key offset depending on AKM. To allow for larger than 16 byte keys aes_unwrap needed to be modified to take the kek length.
2019-01-17 21:25:30 +01:00
const uint8_t *kck = handshake_state_get_kck(hs);
ft: update for larger MIC/FILS-FT
2019-05-23 00:24:01 +02:00
size_t kck_len = handshake_state_get_kck_len(hs);
uint8_t zero_mic[24] = {};
netdev: Handle the FT Authentication Response message Parse the second message of the FT transition, validate and build the third message, the Reassociation Request.
2017-01-12 09:36:01 +01:00
iov[iov_elems].iov_base = hs->spa;
iov[iov_elems++].iov_len = 6;
iov[iov_elems].iov_base = hs->aa;
iov[iov_elems++].iov_len = 6;
iov[iov_elems].iov_base = &seq_num;
iov[iov_elems++].iov_len = 1;
if (rsne) {
iov[iov_elems].iov_base = (void *) rsne;
iov[iov_elems++].iov_len = rsne[1] + 2;
}
iov[iov_elems].iov_base = hs->mde;
iov[iov_elems++].iov_len = hs->mde[1] + 2;
if (fte) {
iov[iov_elems].iov_base = (void *) fte;
iov[iov_elems++].iov_len = 4;
iov[iov_elems].iov_base = zero_mic;
ft: update for larger MIC/FILS-FT
2019-05-23 00:24:01 +02:00
iov[iov_elems++].iov_len = kck_len;
netdev: Handle the FT Authentication Response message Parse the second message of the FT transition, validate and build the third message, the Reassociation Request.
2017-01-12 09:36:01 +01:00
ft: update for larger MIC/FILS-FT
2019-05-23 00:24:01 +02:00
iov[iov_elems].iov_base = (void *) (fte + 4 + kck_len);
iov[iov_elems++].iov_len = fte[1] + 2 - 4 - kck_len;
netdev: Handle the FT Authentication Response message Parse the second message of the FT transition, validate and build the third message, the Reassociation Request.
2017-01-12 09:36:01 +01:00
}
if (ric) {
iov[iov_elems].iov_base = (void *) ric;
iov[iov_elems++].iov_len = ric[1] + 2;
}
ft: update for larger MIC/FILS-FT
2019-05-23 00:24:01 +02:00
if (kck_len == 16)
checksum = l_checksum_new_cmac_aes(kck, kck_len);
else
checksum = l_checksum_new_hmac(L_CHECKSUM_SHA384, kck, kck_len);
netdev: Handle the FT Authentication Response message Parse the second message of the FT transition, validate and build the third message, the Reassociation Request.
2017-01-12 09:36:01 +01:00
if (!checksum)
return false;
l_checksum_updatev(checksum, iov, iov_elems);
ft: update for larger MIC/FILS-FT
2019-05-23 00:24:01 +02:00
l_checksum_get_digest(checksum, out_mic, kck_len);
netdev: Handle the FT Authentication Response message Parse the second message of the FT transition, validate and build the third message, the Reassociation Request.
2017-01-12 09:36:01 +01:00
l_checksum_free(checksum);
return true;
}
/*
* Validate the FC, the addresses, Auth Type and authentication sequence
* number of an FT Authentication Response frame, return status code, and
* the start of the IE array (RSN, MD, FT, TI and RIC).
* See 8.3.3.1 for the header and 8.3.3.11 for the body format.
*/
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
static bool ft_parse_authentication_resp_frame(const uint8_t *data, size_t len,
netdev: Handle the FT Authentication Response message Parse the second message of the FT transition, validate and build the third message, the Reassociation Request.
2017-01-12 09:36:01 +01:00
const uint8_t *addr1, const uint8_t *addr2,
const uint8_t *addr3, uint16_t auth_seq,
uint16_t *out_status, const uint8_t **out_ies,
size_t *out_ies_len)
{
uint16_t status = 0;
if (len < 30)
return false;
if (memcmp(data + 4, addr1, 6))
return false;
if (memcmp(data + 10, addr2, 6))
return false;
if (memcmp(data + 16, addr3, 6))
return false;
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
/* Check Authentication algorithm number is FT (2) */
if (l_get_le16(data + 24) != 2)
netdev: Handle the FT Authentication Response message Parse the second message of the FT transition, validate and build the third message, the Reassociation Request.
2017-01-12 09:36:01 +01:00
return false;
if (l_get_le16(data + 26) != auth_seq)
return false;
if (auth_seq == 2 || auth_seq == 4)
status = l_get_le16(data + 28);
if (out_status)
*out_status = status;
if (status == 0 && out_ies) {
*out_ies = data + 28;
*out_ies_len = len - 28;
}
return true;
}
ftutil: add associate parser Helper to obtain RSNE, MDE, and FTE from associate frame.
2019-03-05 18:12:30 +01:00
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
static bool ft_parse_associate_resp_frame(const uint8_t *frame, size_t frame_len,
ftutil: add associate parser Helper to obtain RSNE, MDE, and FTE from associate frame.
2019-03-05 18:12:30 +01:00
uint16_t *out_status, const uint8_t **rsne,
const uint8_t **mde, const uint8_t **fte)
{
const struct mmpdu_header *mpdu;
const struct mmpdu_association_response *body;
struct ie_tlv_iter iter;
mpdu = mpdu_validate(frame, frame_len);
if (!mpdu)
return false;
body = mmpdu_body(mpdu);
ie_tlv_iter_init(&iter, body->ies, (const uint8_t *) mpdu + frame_len -
body->ies);
while (ie_tlv_iter_next(&iter)) {
switch (ie_tlv_iter_get_tag(&iter)) {
case IE_TYPE_RSN:
if (*rsne)
return false;
*rsne = ie_tlv_iter_get_data(&iter) - 2;
break;
case IE_TYPE_MOBILITY_DOMAIN:
if (*mde)
return false;
*mde = ie_tlv_iter_get_data(&iter) - 2;
break;
case IE_TYPE_FAST_BSS_TRANSITION:
if (*fte)
return false;
*fte = ie_tlv_iter_get_data(&iter) - 2;
break;
}
}
ft: Fix endianness issues The use of mmpdu_association_response members marked as __le requires the relevant endianness conversion.
2019-05-23 23:55:54 +02:00
*out_status = L_LE16_TO_CPU(body->status_code);
ftutil: add associate parser Helper to obtain RSNE, MDE, and FTE from associate frame.
2019-03-05 18:12:30 +01:00
return true;
}
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
ft: rework ft_parse_ies This adds the RSNE verification to ft_parse_ies which will be common between over-Air and over-DS. The MDE check was also factored out into its own minimal function as to retain the spec comment but allow reuse elsewhere.
2021-04-30 01:08:35 +02:00
static bool ft_verify_rsne(const uint8_t *rsne, const uint8_t *pmk_r0_name,
const uint8_t *authenticator_ie)
{
/*
* In an RSN, check for an RSNE containing the PMK-R0-Name and
* the remaining fields same as in the advertised RSNE.
*
* 12.8.3: "The RSNE shall be present only if dot11RSNAActivated
* is true. If present, the RSNE shall be set as follows:
* - Version field shall be set to 1.
* - PMKID Count field shall be set to 1.
* - PMKID List field shall be set to the value contained in the
* first message of this sequence.
* - All other fields shall be identical to the contents of the
* RSNE advertised by the AP in Beacon and Probe Response frames."
*/
struct ie_rsn_info msg2_rsne;
if (!rsne)
return false;
if (ie_parse_rsne_from_data(rsne, rsne[1] + 2,
&msg2_rsne) < 0)
return false;
if (msg2_rsne.num_pmkids != 1 ||
memcmp(msg2_rsne.pmkids, pmk_r0_name, 16))
return false;
handshake: Only bitwise compare when needed handshake_util_ap_ie_matches() is used to make sure that the RSN element received from the Authenticator during handshake / association response is the same as the one advertised in Beacon/Probe Response frames. This utility tries to bitwise compare the element first, and only if that fails, compares RSN members individually. For FT, bitwise comparison will always fail since the PMKID has to be included by the Authenticator in any RSN IEs included in Authenticate & Association Response frames. Perform the bitwise comparison as an optimization only during processing of eapol message 3/4. Also keep the parsed rsn information for future use and to possibly avoid re-parsing it during later checks.
2021-09-17 16:09:43 +02:00
if (!handshake_util_ap_ie_matches(&msg2_rsne, authenticator_ie, false))
ft: rework ft_parse_ies This adds the RSNE verification to ft_parse_ies which will be common between over-Air and over-DS. The MDE check was also factored out into its own minimal function as to retain the spec comment but allow reuse elsewhere.
2021-04-30 01:08:35 +02:00
return false;
return true;
}
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
static int parse_ies(struct handshake_state *hs,
ft: check authenticator_ie from ft_ds_info, not handshake The handshake contains the current BSS's RSNE/WPA which may differ from the FT-over-DS target. When verifying the target BSS's RSNE/WPA IE needs to be checked, not the current BSS.
2021-09-29 00:25:49 +02:00
const uint8_t *authenticator_ie,
ft: rework ft_parse_ies This adds the RSNE verification to ft_parse_ies which will be common between over-Air and over-DS. The MDE check was also factored out into its own minimal function as to retain the spec comment but allow reuse elsewhere.
2021-04-30 01:08:35 +02:00
const uint8_t *ies, size_t ies_len,
const uint8_t **mde_out,
ft: factor out various parsing routines Break up the rather large code block which parses out IEs, verifies, and sets into the handshake. FT-over-DS needs these steps broken up in order to parse the action frame response without modifying the handshake.
2021-04-27 21:49:40 +02:00
const uint8_t **fte_out)
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
{
struct ie_tlv_iter iter;
const uint8_t *rsne = NULL;
const uint8_t *mde = NULL;
const uint8_t *fte = NULL;
ft: rework ft_parse_ies This adds the RSNE verification to ft_parse_ies which will be common between over-Air and over-DS. The MDE check was also factored out into its own minimal function as to retain the spec comment but allow reuse elsewhere.
2021-04-30 01:08:35 +02:00
bool is_rsn;
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
ie_tlv_iter_init(&iter, ies, ies_len);
while (ie_tlv_iter_next(&iter)) {
switch (ie_tlv_iter_get_tag(&iter)) {
case IE_TYPE_RSN:
if (rsne)
goto ft_error;
rsne = ie_tlv_iter_get_data(&iter) - 2;
break;
case IE_TYPE_MOBILITY_DOMAIN:
if (mde)
goto ft_error;
mde = ie_tlv_iter_get_data(&iter) - 2;
break;
case IE_TYPE_FAST_BSS_TRANSITION:
if (fte)
goto ft_error;
fte = ie_tlv_iter_get_data(&iter) - 2;
break;
}
}
ft: rework ft_parse_ies This adds the RSNE verification to ft_parse_ies which will be common between over-Air and over-DS. The MDE check was also factored out into its own minimal function as to retain the spec comment but allow reuse elsewhere.
2021-04-30 01:08:35 +02:00
is_rsn = hs->supplicant_ie != NULL;
if (is_rsn) {
ft: check authenticator_ie from ft_ds_info, not handshake The handshake contains the current BSS's RSNE/WPA which may differ from the FT-over-DS target. When verifying the target BSS's RSNE/WPA IE needs to be checked, not the current BSS.
2021-09-29 00:25:49 +02:00
if (!ft_verify_rsne(rsne, hs->pmk_r0_name, authenticator_ie))
ft: rework ft_parse_ies This adds the RSNE verification to ft_parse_ies which will be common between over-Air and over-DS. The MDE check was also factored out into its own minimal function as to retain the spec comment but allow reuse elsewhere.
2021-04-30 01:08:35 +02:00
goto ft_error;
} else if (rsne)
goto ft_error;
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
ft: factor out various parsing routines Break up the rather large code block which parses out IEs, verifies, and sets into the handshake. FT-over-DS needs these steps broken up in order to parse the action frame response without modifying the handshake.
2021-04-27 21:49:40 +02:00
if (mde_out)
*mde_out = mde;
if (fte_out)
*fte_out = fte;
return 0;
ft_error:
return -EINVAL;
}
static bool ft_parse_fte(struct handshake_state *hs,
const uint8_t *snonce,
const uint8_t *fte,
struct ie_ft_info *ft_info)
{
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
/*
* In an RSN, check for an FT IE with the same R0KH-ID and the same
* SNonce that we sent, and check that the R1KH-ID and the ANonce
* are present. Use them to generate new PMK-R1, PMK-R1-Name and PTK
* in handshake.c.
*
* 12.8.3: "The FTE shall be present only if dot11RSNAActivated is
* true. If present, the FTE shall be set as follows:
treewide: Get rid of non-ASCII characters
2021-04-28 21:16:06 +02:00
* - R0KH-ID shall be identical to the R0KH-ID provided by the FTO
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
* in the first message.
treewide: Get rid of non-ASCII characters
2021-04-28 21:16:06 +02:00
* - R1KH-ID shall be set to the R1KH-ID of the target AP, from
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
* dot11FTR1KeyHolderID.
treewide: Get rid of non-ASCII characters
2021-04-28 21:16:06 +02:00
* - ANonce shall be set to a value chosen randomly by the target AP,
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
* following the recommendations of 11.6.5.
treewide: Get rid of non-ASCII characters
2021-04-28 21:16:06 +02:00
* - SNonce shall be set to the value contained in the first message
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
* of this sequence.
treewide: Get rid of non-ASCII characters
2021-04-28 21:16:06 +02:00
* - All other fields shall be set to 0."
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
*/
ft: factor out various parsing routines Break up the rather large code block which parses out IEs, verifies, and sets into the handshake. FT-over-DS needs these steps broken up in order to parse the action frame response without modifying the handshake.
2021-04-27 21:49:40 +02:00
uint8_t zeros[24] = {};
uint32_t kck_len = handshake_state_get_kck_len(hs);
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
ft: factor out various parsing routines Break up the rather large code block which parses out IEs, verifies, and sets into the handshake. FT-over-DS needs these steps broken up in order to parse the action frame response without modifying the handshake.
2021-04-27 21:49:40 +02:00
if (!fte)
return false;
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
ft: factor out various parsing routines Break up the rather large code block which parses out IEs, verifies, and sets into the handshake. FT-over-DS needs these steps broken up in order to parse the action frame response without modifying the handshake.
2021-04-27 21:49:40 +02:00
if (ie_parse_fast_bss_transition_from_data(fte, fte[1] + 2,
kck_len, ft_info) < 0)
return false;
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
ft: factor out various parsing routines Break up the rather large code block which parses out IEs, verifies, and sets into the handshake. FT-over-DS needs these steps broken up in order to parse the action frame response without modifying the handshake.
2021-04-27 21:49:40 +02:00
if (ft_info->mic_element_count != 0 ||
memcmp(ft_info->mic, zeros, kck_len))
return false;
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
ft: factor out various parsing routines Break up the rather large code block which parses out IEs, verifies, and sets into the handshake. FT-over-DS needs these steps broken up in order to parse the action frame response without modifying the handshake.
2021-04-27 21:49:40 +02:00
if (hs->r0khid_len != ft_info->r0khid_len ||
memcmp(hs->r0khid, ft_info->r0khid,
hs->r0khid_len) ||
!ft_info->r1khid_present)
return false;
if (memcmp(ft_info->snonce, snonce, 32))
return false;
return true;
}
ft: rework ft_parse_ies This adds the RSNE verification to ft_parse_ies which will be common between over-Air and over-DS. The MDE check was also factored out into its own minimal function as to retain the spec comment but allow reuse elsewhere.
2021-04-30 01:08:35 +02:00
static bool mde_equal(const uint8_t *mde1, const uint8_t *mde2)
{
if (!mde1 || !mde2)
return false;
/*
* Check for an MD IE identical to the one we sent in message 1
*
* 12.8.3: "The MDE shall contain the MDID and FT Capability and
* Policy fields. This element shall be the same as the MDE
* advertised by the target AP in Beacon and Probe Response frames."
*/
return memcmp(mde1, mde1, mde1[1] + 2) == 0;
}
ft: remove auth-proto/ft_sm This is no longer used.
2022-09-27 21:47:31 +02:00
static int ft_over_ds_parse_action_response(const uint8_t *frame,
size_t frame_len,
ft: break up FT action parsing into two steps This is to prepare for multiple concurrent FT-over-DS action frames. A list will be kept in netdev and for lookup reasons it needs to parse the start of the frame to grab the aa/spa addresses. In this call the IEs are also returned and passed to the new ft_over_ds_parse_action_response. For now the address checks have been moved into netdev, but this will eventually turn into a queue lookup.
2021-05-13 01:01:40 +02:00
const uint8_t **spa_out,
const uint8_t **aa_out,
const uint8_t **ies_out,
size_t *ies_len)
ft: create class for FT-over-DS targets FT-over-DS is being separated into two independent stages. The first of which is the processing of the action frame response. This new class will hold all the parsed information from the action frame and allowing it to be retrieved at a later time when IWD needs to roam. Initial info class should be created when the action frame is being sent out. Once a response is received it can be parsed with ft_over_ds_parse_action_response. This verifies the frame and updates the ft_ds_info class with the parsed data. ft_over_ds_prepare_handshake is the final step prior to Reassociation. This sets all the stored IEs, anonce, and KH IDs into the handshake and derives the new PTK.
2021-04-30 01:08:36 +02:00
{
ft: update action response parsing to include header Now the full action frame including the header is provided to ft which breaks the existing parser since it assumes the buffer starts at the body of the message.
2022-09-27 21:47:26 +02:00
struct mmpdu_header *hdr = (struct mmpdu_header *)frame;
size_t hdr_len = mmpdu_header_len(hdr);
ft: create class for FT-over-DS targets FT-over-DS is being separated into two independent stages. The first of which is the processing of the action frame response. This new class will hold all the parsed information from the action frame and allowing it to be retrieved at a later time when IWD needs to roam. Initial info class should be created when the action frame is being sent out. Once a response is received it can be parsed with ft_over_ds_parse_action_response. This verifies the frame and updates the ft_ds_info class with the parsed data. ft_over_ds_prepare_handshake is the final step prior to Reassociation. This sets all the stored IEs, anonce, and KH IDs into the handshake and derives the new PTK.
2021-04-30 01:08:36 +02:00
uint16_t status;
ft: break up FT action parsing into two steps This is to prepare for multiple concurrent FT-over-DS action frames. A list will be kept in netdev and for lookup reasons it needs to parse the start of the frame to grab the aa/spa addresses. In this call the IEs are also returned and passed to the new ft_over_ds_parse_action_response. For now the address checks have been moved into netdev, but this will eventually turn into a queue lookup.
2021-05-13 01:01:40 +02:00
const uint8_t *aa;
const uint8_t *spa;
ft: create class for FT-over-DS targets FT-over-DS is being separated into two independent stages. The first of which is the processing of the action frame response. This new class will hold all the parsed information from the action frame and allowing it to be retrieved at a later time when IWD needs to roam. Initial info class should be created when the action frame is being sent out. Once a response is received it can be parsed with ft_over_ds_parse_action_response. This verifies the frame and updates the ft_ds_info class with the parsed data. ft_over_ds_prepare_handshake is the final step prior to Reassociation. This sets all the stored IEs, anonce, and KH IDs into the handshake and derives the new PTK.
2021-04-30 01:08:36 +02:00
ft: update action response parsing to include header Now the full action frame including the header is provided to ft which breaks the existing parser since it assumes the buffer starts at the body of the message.
2022-09-27 21:47:26 +02:00
if (frame_len < hdr_len + 16)
ft: create class for FT-over-DS targets FT-over-DS is being separated into two independent stages. The first of which is the processing of the action frame response. This new class will hold all the parsed information from the action frame and allowing it to be retrieved at a later time when IWD needs to roam. Initial info class should be created when the action frame is being sent out. Once a response is received it can be parsed with ft_over_ds_parse_action_response. This verifies the frame and updates the ft_ds_info class with the parsed data. ft_over_ds_prepare_handshake is the final step prior to Reassociation. This sets all the stored IEs, anonce, and KH IDs into the handshake and derives the new PTK.
2021-04-30 01:08:36 +02:00
return -EINVAL;
ft: update action response parsing to include header Now the full action frame including the header is provided to ft which breaks the existing parser since it assumes the buffer starts at the body of the message.
2022-09-27 21:47:26 +02:00
frame += hdr_len;
frame_len -= hdr_len;
ft: create class for FT-over-DS targets FT-over-DS is being separated into two independent stages. The first of which is the processing of the action frame response. This new class will hold all the parsed information from the action frame and allowing it to be retrieved at a later time when IWD needs to roam. Initial info class should be created when the action frame is being sent out. Once a response is received it can be parsed with ft_over_ds_parse_action_response. This verifies the frame and updates the ft_ds_info class with the parsed data. ft_over_ds_prepare_handshake is the final step prior to Reassociation. This sets all the stored IEs, anonce, and KH IDs into the handshake and derives the new PTK.
2021-04-30 01:08:36 +02:00
/* Category FT */
if (frame[0] != 6)
return -EINVAL;
/* FT Action */
if (frame[1] != 2)
return -EINVAL;
ft: break up FT action parsing into two steps This is to prepare for multiple concurrent FT-over-DS action frames. A list will be kept in netdev and for lookup reasons it needs to parse the start of the frame to grab the aa/spa addresses. In this call the IEs are also returned and passed to the new ft_over_ds_parse_action_response. For now the address checks have been moved into netdev, but this will eventually turn into a queue lookup.
2021-05-13 01:01:40 +02:00
spa = frame + 2;
aa = frame + 8;
ft: create class for FT-over-DS targets FT-over-DS is being separated into two independent stages. The first of which is the processing of the action frame response. This new class will hold all the parsed information from the action frame and allowing it to be retrieved at a later time when IWD needs to roam. Initial info class should be created when the action frame is being sent out. Once a response is received it can be parsed with ft_over_ds_parse_action_response. This verifies the frame and updates the ft_ds_info class with the parsed data. ft_over_ds_prepare_handshake is the final step prior to Reassociation. This sets all the stored IEs, anonce, and KH IDs into the handshake and derives the new PTK.
2021-04-30 01:08:36 +02:00
ft: update action response parsing to include header Now the full action frame including the header is provided to ft which breaks the existing parser since it assumes the buffer starts at the body of the message.
2022-09-27 21:47:26 +02:00
if (memcmp(spa, hdr->address_1, 6))
return -EINVAL;
ft: break up FT action parsing into two steps This is to prepare for multiple concurrent FT-over-DS action frames. A list will be kept in netdev and for lookup reasons it needs to parse the start of the frame to grab the aa/spa addresses. In this call the IEs are also returned and passed to the new ft_over_ds_parse_action_response. For now the address checks have been moved into netdev, but this will eventually turn into a queue lookup.
2021-05-13 01:01:40 +02:00
if (spa_out)
*spa_out = spa;
if (aa_out)
*aa_out = aa;
ft: track FT auth/action response status Certain return codes, though failures, can indicate that the AP is just confused or booting up and treating it as a full failure may not be the best route. For example in some production deployments if an AP is rebooted it may take some time for neighboring APs to exchange keys for current associations. If a client roams during that time it will reject saying the PMKID is invalid. Use the ft_associate call return to communicate the status (if any) that was in the auth/action response. If there was a parsing error or no response -ENOENT is still returned.
2023-08-31 14:39:22 +02:00
status = l_get_le16(frame + 14);
if (status != 0)
goto done;
ft: break up FT action parsing into two steps This is to prepare for multiple concurrent FT-over-DS action frames. A list will be kept in netdev and for lookup reasons it needs to parse the start of the frame to grab the aa/spa addresses. In this call the IEs are also returned and passed to the new ft_over_ds_parse_action_response. For now the address checks have been moved into netdev, but this will eventually turn into a queue lookup.
2021-05-13 01:01:40 +02:00
if (ies_out && ies_len) {
*ies_out = frame + 16;
*ies_len = frame_len - 16;
}
ft: create class for FT-over-DS targets FT-over-DS is being separated into two independent stages. The first of which is the processing of the action frame response. This new class will hold all the parsed information from the action frame and allowing it to be retrieved at a later time when IWD needs to roam. Initial info class should be created when the action frame is being sent out. Once a response is received it can be parsed with ft_over_ds_parse_action_response. This verifies the frame and updates the ft_ds_info class with the parsed data. ft_over_ds_prepare_handshake is the final step prior to Reassociation. This sets all the stored IEs, anonce, and KH IDs into the handshake and derives the new PTK.
2021-04-30 01:08:36 +02:00
ft: track FT auth/action response status Certain return codes, though failures, can indicate that the AP is just confused or booting up and treating it as a full failure may not be the best route. For example in some production deployments if an AP is rebooted it may take some time for neighboring APs to exchange keys for current associations. If a client roams during that time it will reject saying the PMKID is invalid. Use the ft_associate call return to communicate the status (if any) that was in the auth/action response. If there was a parsing error or no response -ENOENT is still returned.
2023-08-31 14:39:22 +02:00
done:
return (int)status;
ft: create class for FT-over-DS targets FT-over-DS is being separated into two independent stages. The first of which is the processing of the action frame response. This new class will hold all the parsed information from the action frame and allowing it to be retrieved at a later time when IWD needs to roam. Initial info class should be created when the action frame is being sent out. Once a response is received it can be parsed with ft_over_ds_parse_action_response. This verifies the frame and updates the ft_ds_info class with the parsed data. ft_over_ds_prepare_handshake is the final step prior to Reassociation. This sets all the stored IEs, anonce, and KH IDs into the handshake and derives the new PTK.
2021-04-30 01:08:36 +02:00
}
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
int __ft_rx_associate(uint32_t ifindex, const uint8_t *frame, size_t frame_len)
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
{
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
struct netdev *netdev = netdev_find(ifindex);
struct handshake_state *hs = netdev_get_handshake(netdev);
ie: allow 24 byte FTE MIC FT over FILS-SHA384 uses a 24 byte FT MIC rather than the 16 byte MIC used for all other AKMs. This change allows both the FT builder/parser to handle both lengths of MIC. The mic length is now passed directly into ie_parse_fast_bss_transition and ie_build_fast_bss_transition
2019-05-23 00:24:00 +02:00
uint32_t kck_len = handshake_state_get_kck_len(hs);
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
const uint8_t *rsne = NULL;
const uint8_t *mde = NULL;
const uint8_t *fte = NULL;
const uint8_t *sent_mde = hs->mde;
bool is_rsn = hs->supplicant_ie != NULL;
uint16_t out_status;
if (!ft_parse_associate_resp_frame(frame, frame_len, &out_status, &rsne,
&mde, &fte))
return -EBADMSG;
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
if (out_status != 0)
return (int)out_status;
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
/*
* During a transition in an RSN, check for an RSNE containing the
* PMK-R1-Name and the remaining fields same as in the advertised
* RSNE.
*
* 12.8.5: "The RSNE shall be present only if dot11RSNAActivated is
* true. If present, the RSNE shall be set as follows:
treewide: Get rid of non-ASCII characters
2021-04-28 21:16:06 +02:00
* - Version field shall be set to 1.
* - PMKID Count field shall be set to 1.
* - PMKID field shall contain the PMKR1Name
* - All other fields shall be identical to the contents of the RSNE
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
* advertised by the target AP in Beacon and Probe Response frames."
*/
if (is_rsn) {
struct ie_rsn_info msg4_rsne;
if (!rsne)
return -EBADMSG;
if (ie_parse_rsne_from_data(rsne, rsne[1] + 2,
&msg4_rsne) < 0)
return -EBADMSG;
if (msg4_rsne.num_pmkids != 1 ||
memcmp(msg4_rsne.pmkids, hs->pmk_r1_name, 16))
return -EBADMSG;
handshake: Only bitwise compare when needed handshake_util_ap_ie_matches() is used to make sure that the RSN element received from the Authenticator during handshake / association response is the same as the one advertised in Beacon/Probe Response frames. This utility tries to bitwise compare the element first, and only if that fails, compares RSN members individually. For FT, bitwise comparison will always fail since the PMKID has to be included by the Authenticator in any RSN IEs included in Authenticate & Association Response frames. Perform the bitwise comparison as an optimization only during processing of eapol message 3/4. Also keep the parsed rsn information for future use and to possibly avoid re-parsing it during later checks.
2021-09-17 16:09:43 +02:00
if (!handshake_util_ap_ie_matches(&msg4_rsne,
hs->authenticator_ie,
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
false))
return -EBADMSG;
} else {
if (rsne)
return -EBADMSG;
}
/* An MD IE identical to the one we sent must be present */
if (sent_mde && (!mde || memcmp(sent_mde, mde, sent_mde[1] + 2)))
return -EBADMSG;
/*
* An FT IE is required in an initial mobility domain
* association and re-associations in an RSN but not present
* in a non-RSN (12.4.2 vs. 12.4.3).
*/
if (sent_mde && is_rsn && !fte)
return -EBADMSG;
if (!(sent_mde && is_rsn) && fte)
return -EBADMSG;
if (fte) {
struct ie_ft_info ft_info;
ft: update for larger MIC/FILS-FT
2019-05-23 00:24:01 +02:00
uint8_t mic[24];
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
if (ie_parse_fast_bss_transition_from_data(fte, fte[1] + 2,
ie: allow 24 byte FTE MIC FT over FILS-SHA384 uses a 24 byte FT MIC rather than the 16 byte MIC used for all other AKMs. This change allows both the FT builder/parser to handle both lengths of MIC. The mic length is now passed directly into ie_parse_fast_bss_transition and ie_build_fast_bss_transition
2019-05-23 00:24:00 +02:00
kck_len, &ft_info) < 0)
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
return -EBADMSG;
/*
* In an RSN, check for an FT IE with the same
* R0KH-ID, R1KH-ID, ANonce and SNonce that we
* received in message 2, MIC Element Count
* of 6 and the correct MIC.
*/
if (!ft_calculate_fte_mic(hs, 6, rsne, fte, NULL, mic))
return -EBADMSG;
if (ft_info.mic_element_count != 3 ||
ft: update for larger MIC/FILS-FT
2019-05-23 00:24:01 +02:00
memcmp(ft_info.mic, mic, kck_len))
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
return -EBADMSG;
if (hs->r0khid_len != ft_info.r0khid_len ||
memcmp(hs->r0khid, ft_info.r0khid,
hs->r0khid_len) ||
!ft_info.r1khid_present ||
memcmp(hs->r1khid, ft_info.r1khid, 6))
return -EBADMSG;
if (memcmp(ft_info.anonce, hs->anonce, 32))
return -EBADMSG;
if (memcmp(ft_info.snonce, hs->snonce, 32))
return -EBADMSG;
if (ft_info.gtk_len) {
uint8_t gtk[32];
if (!handshake_decode_fte_key(hs, ft_info.gtk,
ft_info.gtk_len,
gtk))
return -EBADMSG;
if (ft_info.gtk_rsc[6] != 0x00 ||
ft_info.gtk_rsc[7] != 0x00)
return -EBADMSG;
handshake_state_install_gtk(hs, ft_info.gtk_key_id,
gtk, ft_info.gtk_len,
ft_info.gtk_rsc, 6);
}
if (ft_info.igtk_len) {
uint8_t igtk[16];
if (!handshake_decode_fte_key(hs, ft_info.igtk,
ft_info.igtk_len, igtk))
return -EBADMSG;
handshake_state_install_igtk(hs, ft_info.igtk_key_id,
igtk, ft_info.igtk_len,
ft_info.igtk_ipn);
}
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
handshake_state_install_ptk(hs);
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
}
return 0;
}
ft: remove auth-proto/ft_sm This is no longer used.
2022-09-27 21:47:31 +02:00
static bool ft_build_authenticate_ies(struct handshake_state *hs, bool ocvc,
ft: expose ft_build_authenticate_ies The building of the FT IEs for Action/Authenticate frames will need to be shared between ft and netdev once FT-over-DS is refactored. The building was refactored to work off the callers buffer rather than internal stack buffers. An argument 'new_snonce' was included as FT-over-DS will generate a new snonce for the initial action frame, hence the handshakes snonce cannot be used.
2021-04-27 21:49:41 +02:00
const uint8_t *new_snonce, uint8_t *buf,
size_t *len)
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
{
ie: allow 24 byte FTE MIC FT over FILS-SHA384 uses a 24 byte FT MIC rather than the 16 byte MIC used for all other AKMs. This change allows both the FT builder/parser to handle both lengths of MIC. The mic length is now passed directly into ie_parse_fast_bss_transition and ie_build_fast_bss_transition
2019-05-23 00:24:00 +02:00
uint32_t kck_len = handshake_state_get_kck_len(hs);
ft: netdev: move Authenticate IE building into ft.c Since FT already handles processing the FT IE's (and building for associate) it didn't make sense to have all the IE building inside netdev_build_cmd_ft_authenticate. Instead this logic was moved into ft.c, and an iovec is now passed from FT into netdev_ft_tx_authenticate. This leaves the netdev command builder unburdened by the details of FT, as well as prepares for FT-over-DS.
2019-05-09 19:14:12 +02:00
bool is_rsn = hs->supplicant_ie != NULL;
ft: expose ft_build_authenticate_ies The building of the FT IEs for Action/Authenticate frames will need to be shared between ft and netdev once FT-over-DS is refactored. The building was refactored to work off the callers buffer rather than internal stack buffers. An argument 'new_snonce' was included as FT-over-DS will generate a new snonce for the initial action frame, hence the handshakes snonce cannot be used.
2021-04-27 21:49:41 +02:00
uint8_t *ptr = buf;
ft: netdev: move Authenticate IE building into ft.c Since FT already handles processing the FT IE's (and building for associate) it didn't make sense to have all the IE building inside netdev_build_cmd_ft_authenticate. Instead this logic was moved into ft.c, and an iovec is now passed from FT into netdev_ft_tx_authenticate. This leaves the netdev command builder unburdened by the details of FT, as well as prepares for FT-over-DS.
2019-05-09 19:14:12 +02:00
if (is_rsn) {
struct ie_rsn_info rsn_info;
/*
* Rebuild the RSNE to include the PMKR0Name and append
* MDE + FTE.
*
* 12.8.2: "If present, the RSNE shall be set as follows:
treewide: Get rid of non-ASCII characters
2021-04-28 21:16:06 +02:00
* - Version field shall be set to 1.
* - PMKID Count field shall be set to 1.
* - PMKID List field shall contain the PMKR0Name.
* - All other fields shall be as specified in 8.4.2.27
ft: netdev: move Authenticate IE building into ft.c Since FT already handles processing the FT IE's (and building for associate) it didn't make sense to have all the IE building inside netdev_build_cmd_ft_authenticate. Instead this logic was moved into ft.c, and an iovec is now passed from FT into netdev_ft_tx_authenticate. This leaves the netdev command builder unburdened by the details of FT, as well as prepares for FT-over-DS.
2019-05-09 19:14:12 +02:00
* and 11.5.3."
*/
if (ie_parse_rsne_from_data(hs->supplicant_ie,
hs->supplicant_ie[1] + 2,
&rsn_info) < 0)
return false;
rsn_info.num_pmkids = 1;
rsn_info.pmkids = hs->pmk_r0_name;
ft: make Authenticate OCVC settable by caller The FT-over-DS action stage builds an FT-Request which contains an RSNE. Since FT-over-DS will not support OCV add a boolean to ft_build_authenticate_ies so the OCVC bit can be disabled rather than relying on the handshake setting.
2021-09-28 17:46:57 +02:00
rsn_info.ocvc = ocvc;
ft: netdev: move Authenticate IE building into ft.c Since FT already handles processing the FT IE's (and building for associate) it didn't make sense to have all the IE building inside netdev_build_cmd_ft_authenticate. Instead this logic was moved into ft.c, and an iovec is now passed from FT into netdev_ft_tx_authenticate. This leaves the netdev command builder unburdened by the details of FT, as well as prepares for FT-over-DS.
2019-05-09 19:14:12 +02:00
ft: expose ft_build_authenticate_ies The building of the FT IEs for Action/Authenticate frames will need to be shared between ft and netdev once FT-over-DS is refactored. The building was refactored to work off the callers buffer rather than internal stack buffers. An argument 'new_snonce' was included as FT-over-DS will generate a new snonce for the initial action frame, hence the handshakes snonce cannot be used.
2021-04-27 21:49:41 +02:00
ie_build_rsne(&rsn_info, ptr);
ptr += ptr[1] + 2;
ft: netdev: move Authenticate IE building into ft.c Since FT already handles processing the FT IE's (and building for associate) it didn't make sense to have all the IE building inside netdev_build_cmd_ft_authenticate. Instead this logic was moved into ft.c, and an iovec is now passed from FT into netdev_ft_tx_authenticate. This leaves the netdev command builder unburdened by the details of FT, as well as prepares for FT-over-DS.
2019-05-09 19:14:12 +02:00
}
/* The MDE advertised by the BSS must be passed verbatim */
ft: expose ft_build_authenticate_ies The building of the FT IEs for Action/Authenticate frames will need to be shared between ft and netdev once FT-over-DS is refactored. The building was refactored to work off the callers buffer rather than internal stack buffers. An argument 'new_snonce' was included as FT-over-DS will generate a new snonce for the initial action frame, hence the handshakes snonce cannot be used.
2021-04-27 21:49:41 +02:00
ptr[0] = IE_TYPE_MOBILITY_DOMAIN;
ptr[1] = 3;
memcpy(ptr + 2, hs->mde + 2, 3);
ptr += 5;
ft: netdev: move Authenticate IE building into ft.c Since FT already handles processing the FT IE's (and building for associate) it didn't make sense to have all the IE building inside netdev_build_cmd_ft_authenticate. Instead this logic was moved into ft.c, and an iovec is now passed from FT into netdev_ft_tx_authenticate. This leaves the netdev command builder unburdened by the details of FT, as well as prepares for FT-over-DS.
2019-05-09 19:14:12 +02:00
if (is_rsn) {
struct ie_ft_info ft_info;
/*
* 12.8.2: "If present, the FTE shall be set as follows:
treewide: Get rid of non-ASCII characters
2021-04-28 21:16:06 +02:00
* - R0KH-ID shall be the value of R0KH-ID obtained by the
ft: netdev: move Authenticate IE building into ft.c Since FT already handles processing the FT IE's (and building for associate) it didn't make sense to have all the IE building inside netdev_build_cmd_ft_authenticate. Instead this logic was moved into ft.c, and an iovec is now passed from FT into netdev_ft_tx_authenticate. This leaves the netdev command builder unburdened by the details of FT, as well as prepares for FT-over-DS.
2019-05-09 19:14:12 +02:00
* FTO during its FT initial mobility domain association
* exchange.
treewide: Get rid of non-ASCII characters
2021-04-28 21:16:06 +02:00
* - SNonce shall be set to a value chosen randomly by the
ft: netdev: move Authenticate IE building into ft.c Since FT already handles processing the FT IE's (and building for associate) it didn't make sense to have all the IE building inside netdev_build_cmd_ft_authenticate. Instead this logic was moved into ft.c, and an iovec is now passed from FT into netdev_ft_tx_authenticate. This leaves the netdev command builder unburdened by the details of FT, as well as prepares for FT-over-DS.
2019-05-09 19:14:12 +02:00
* FTO, following the recommendations of 11.6.5.
treewide: Get rid of non-ASCII characters
2021-04-28 21:16:06 +02:00
* - All other fields shall be set to 0."
ft: netdev: move Authenticate IE building into ft.c Since FT already handles processing the FT IE's (and building for associate) it didn't make sense to have all the IE building inside netdev_build_cmd_ft_authenticate. Instead this logic was moved into ft.c, and an iovec is now passed from FT into netdev_ft_tx_authenticate. This leaves the netdev command builder unburdened by the details of FT, as well as prepares for FT-over-DS.
2019-05-09 19:14:12 +02:00
*/
memset(&ft_info, 0, sizeof(ft_info));
memcpy(ft_info.r0khid, hs->r0khid, hs->r0khid_len);
ft_info.r0khid_len = hs->r0khid_len;
ft: expose ft_build_authenticate_ies The building of the FT IEs for Action/Authenticate frames will need to be shared between ft and netdev once FT-over-DS is refactored. The building was refactored to work off the callers buffer rather than internal stack buffers. An argument 'new_snonce' was included as FT-over-DS will generate a new snonce for the initial action frame, hence the handshakes snonce cannot be used.
2021-04-27 21:49:41 +02:00
memcpy(ft_info.snonce, new_snonce, 32);
ft: netdev: move Authenticate IE building into ft.c Since FT already handles processing the FT IE's (and building for associate) it didn't make sense to have all the IE building inside netdev_build_cmd_ft_authenticate. Instead this logic was moved into ft.c, and an iovec is now passed from FT into netdev_ft_tx_authenticate. This leaves the netdev command builder unburdened by the details of FT, as well as prepares for FT-over-DS.
2019-05-09 19:14:12 +02:00
ft: expose ft_build_authenticate_ies The building of the FT IEs for Action/Authenticate frames will need to be shared between ft and netdev once FT-over-DS is refactored. The building was refactored to work off the callers buffer rather than internal stack buffers. An argument 'new_snonce' was included as FT-over-DS will generate a new snonce for the initial action frame, hence the handshakes snonce cannot be used.
2021-04-27 21:49:41 +02:00
ie_build_fast_bss_transition(&ft_info, kck_len, ptr);
ft: netdev: move Authenticate IE building into ft.c Since FT already handles processing the FT IE's (and building for associate) it didn't make sense to have all the IE building inside netdev_build_cmd_ft_authenticate. Instead this logic was moved into ft.c, and an iovec is now passed from FT into netdev_ft_tx_authenticate. This leaves the netdev command builder unburdened by the details of FT, as well as prepares for FT-over-DS.
2019-05-09 19:14:12 +02:00
ft: expose ft_build_authenticate_ies The building of the FT IEs for Action/Authenticate frames will need to be shared between ft and netdev once FT-over-DS is refactored. The building was refactored to work off the callers buffer rather than internal stack buffers. An argument 'new_snonce' was included as FT-over-DS will generate a new snonce for the initial action frame, hence the handshakes snonce cannot be used.
2021-04-27 21:49:41 +02:00
ptr += ptr[1] + 2;
ft: netdev: move Authenticate IE building into ft.c Since FT already handles processing the FT IE's (and building for associate) it didn't make sense to have all the IE building inside netdev_build_cmd_ft_authenticate. Instead this logic was moved into ft.c, and an iovec is now passed from FT into netdev_ft_tx_authenticate. This leaves the netdev command builder unburdened by the details of FT, as well as prepares for FT-over-DS.
2019-05-09 19:14:12 +02:00
}
netdev: ft: refactor FT into an auth-proto Since FT operates over Authenticate/Associate, it makes the most sense for it to behave like the other auth-protos. This change moves all the FT specific processing out of netdev and into ft.c. The bulk of the changes were strait copy-pastes from netdev into ft.c with minor API changes (e.g. remove struct netdev). The 'in_ft' boolean unforunately is still required for a few reasons: - netdev_disconnect_event relies on this flag so it can ignore the disconnect which comes in when doing a fast transition. We cannot simply check netdev->ap because this would cause the other auth-protos to not handle a disconnect correctly. - netdev_associate_event needs to correctly setup the eapol_sm when in FT mode by setting require_handshake and use_eapol_start to false. This cannot be handled inside eapol by checking the AKM because an AP may only advertise a FT AKM, and the initial mobility association does require the 4-way handshake.
2019-05-07 20:53:42 +02:00
ft: expose ft_build_authenticate_ies The building of the FT IEs for Action/Authenticate frames will need to be shared between ft and netdev once FT-over-DS is refactored. The building was refactored to work off the callers buffer rather than internal stack buffers. An argument 'new_snonce' was included as FT-over-DS will generate a new snonce for the initial action frame, hence the handshakes snonce cannot be used.
2021-04-27 21:49:41 +02:00
if (len)
*len = ptr - buf;
return true;
}
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
void __ft_set_tx_frame_func(ft_tx_frame_func_t func)
{
tx_frame = func;
}
static bool ft_parse_ies(struct ft_info *info, struct handshake_state *hs,
const uint8_t *ies, size_t ies_len)
{
const uint8_t *mde = NULL;
const uint8_t *fte = NULL;
bool is_rsn = hs->supplicant_ie != NULL;
if (parse_ies(hs, info->authenticator_ie, ies, ies_len,
&mde, &fte) < 0)
return false;
if (!mde_equal(info->mde, mde))
goto ft_error;
if (is_rsn) {
if (!ft_parse_fte(hs, info->snonce, fte, &info->ft_info))
goto ft_error;
info->fte = l_memdup(fte, fte[1] + 2);
} else if (fte)
goto ft_error;
return true;
ft_error:
return false;
}
static struct ft_info *ft_info_find(uint32_t ifindex, const uint8_t *aa)
{
const struct l_queue_entry *e;
for (e = l_queue_get_entries(info_list); e; e = e->next) {
struct ft_info *info = e->data;
if (info->ifindex != ifindex)
continue;
if (aa && memcmp(info->aa, aa, 6))
continue;
return info;
}
return NULL;
}
void __ft_rx_action(uint32_t ifindex, const uint8_t *frame, size_t frame_len)
{
struct netdev *netdev = netdev_find(ifindex);
struct handshake_state *hs = netdev_get_handshake(netdev);
struct ft_info *info;
int ret;
const uint8_t *aa = NULL;
const uint8_t *spa = NULL;
const uint8_t *ies = NULL;
size_t ies_len = 0;
ret = ft_over_ds_parse_action_response(frame, frame_len, &spa, &aa,
&ies, &ies_len);
ft: track FT auth/action response status Certain return codes, though failures, can indicate that the AP is just confused or booting up and treating it as a full failure may not be the best route. For example in some production deployments if an AP is rebooted it may take some time for neighboring APs to exchange keys for current associations. If a client roams during that time it will reject saying the PMKID is invalid. Use the ft_associate call return to communicate the status (if any) that was in the auth/action response. If there was a parsing error or no response -ENOENT is still returned.
2023-08-31 14:39:22 +02:00
if (ret < 0) {
ft: add debug prints for FT-over-DS This is consistent with the over-Air path, and makes it clear when reading the logs if over-DS was used, if there was a response frame, and if the frame failed to parse in some way.
2023-06-21 21:36:33 +02:00
l_debug("Could not parse action response");
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
return;
ft: add debug prints for FT-over-DS This is consistent with the over-Air path, and makes it clear when reading the logs if over-DS was used, if there was a response frame, and if the frame failed to parse in some way.
2023-06-21 21:36:33 +02:00
}
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
info = ft_info_find(ifindex, aa);
ft: add debug prints for FT-over-DS This is consistent with the over-Air path, and makes it clear when reading the logs if over-DS was used, if there was a response frame, and if the frame failed to parse in some way.
2023-06-21 21:36:33 +02:00
if (!info) {
l_debug("No FT info found for BSS "MAC, MAC_STR(aa));
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
return;
ft: add debug prints for FT-over-DS This is consistent with the over-Air path, and makes it clear when reading the logs if over-DS was used, if there was a response frame, and if the frame failed to parse in some way.
2023-06-21 21:36:33 +02:00
}
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
ft: track FT auth/action response status Certain return codes, though failures, can indicate that the AP is just confused or booting up and treating it as a full failure may not be the best route. For example in some production deployments if an AP is rebooted it may take some time for neighboring APs to exchange keys for current associations. If a client roams during that time it will reject saying the PMKID is invalid. Use the ft_associate call return to communicate the status (if any) that was in the auth/action response. If there was a parsing error or no response -ENOENT is still returned.
2023-08-31 14:39:22 +02:00
if (ret != 0) {
l_debug("BSS "MAC" rejected FT action with status=%u",
MAC_STR(info->aa), ret);
info->status = ret;
goto done;
}
ft: add debug prints for FT-over-DS This is consistent with the over-Air path, and makes it clear when reading the logs if over-DS was used, if there was a response frame, and if the frame failed to parse in some way.
2023-06-21 21:36:33 +02:00
if (!ft_parse_ies(info, hs, ies, ies_len)) {
l_debug("Could not parse action response IEs");
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
goto ft_error;
ft: add debug prints for FT-over-DS This is consistent with the over-Air path, and makes it clear when reading the logs if over-DS was used, if there was a response frame, and if the frame failed to parse in some way.
2023-06-21 21:36:33 +02:00
}
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
ft: track FT auth/action response status Certain return codes, though failures, can indicate that the AP is just confused or booting up and treating it as a full failure may not be the best route. For example in some production deployments if an AP is rebooted it may take some time for neighboring APs to exchange keys for current associations. If a client roams during that time it will reject saying the PMKID is invalid. Use the ft_associate call return to communicate the status (if any) that was in the auth/action response. If there was a parsing error or no response -ENOENT is still returned.
2023-08-31 14:39:22 +02:00
info->status = ret;
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
ft: track FT auth/action response status Certain return codes, though failures, can indicate that the AP is just confused or booting up and treating it as a full failure may not be the best route. For example in some production deployments if an AP is rebooted it may take some time for neighboring APs to exchange keys for current associations. If a client roams during that time it will reject saying the PMKID is invalid. Use the ft_associate call return to communicate the status (if any) that was in the auth/action response. If there was a parsing error or no response -ENOENT is still returned.
2023-08-31 14:39:22 +02:00
done:
ft: gate FT-over-DS with a wiphy work item Queue the FT action just like we do with FT Authenticate which makes it able to be used the same way, i.e. call ft_action() then queue the ft_associate work right away. A timer was added to end the work item in case the target never responds.
2022-12-14 22:26:56 +01:00
l_timeout_remove(info->timeout);
info->timeout = NULL;
wiphy_radio_work_done(netdev_get_wiphy(netdev), info->work.id);
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
return;
ft_error:
l_debug("FT-over-DS authenticate to "MAC" failed", MAC_STR(info->aa));
}
static struct ft_info *ft_info_new(struct handshake_state *hs,
const struct scan_bss *target_bss)
{
struct ft_info *info = l_new(struct ft_info, 1);
info->ifindex = hs->ifindex;
memcpy(info->spa, hs->spa, 6);
memcpy(info->aa, target_bss->addr, 6);
memcpy(info->mde, target_bss->mde, sizeof(info->mde));
memcpy(info->prev_bssid, hs->aa, 6);
info->frequency = target_bss->frequency;
if (target_bss->rsne)
info->authenticator_ie = l_memdup(target_bss->rsne,
target_bss->rsne[1] + 2);
l_getrandom(info->snonce, 32);
ft: track FT auth/action response status Certain return codes, though failures, can indicate that the AP is just confused or booting up and treating it as a full failure may not be the best route. For example in some production deployments if an AP is rebooted it may take some time for neighboring APs to exchange keys for current associations. If a client roams during that time it will reject saying the PMKID is invalid. Use the ft_associate call return to communicate the status (if any) that was in the auth/action response. If there was a parsing error or no response -ENOENT is still returned.
2023-08-31 14:39:22 +02:00
info->status = -ENOENT;
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
return info;
}
static void ft_info_destroy(void *data)
{
struct ft_info *info = data;
if (info->fte)
l_free(info->fte);
if (info->authenticator_ie)
l_free(info->authenticator_ie);
ft: gate FT-over-DS with a wiphy work item Queue the FT action just like we do with FT Authenticate which makes it able to be used the same way, i.e. call ft_action() then queue the ft_associate work right away. A timer was added to end the work item in case the target never responds.
2022-12-14 22:26:56 +01:00
if (info->timeout)
l_timeout_remove(info->timeout);
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
l_free(info);
}
ft: add FTE/RSNE building to ft_prepare_handshake In preparation to remove ft_associate build the FTE/RSNE in ft_prepare_handshake and set into the handshake object directly.
2023-12-06 21:17:57 +01:00
static bool ft_prepare_handshake(struct ft_info *info,
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
struct handshake_state *hs)
{
ft: add FTE/RSNE building to ft_prepare_handshake In preparation to remove ft_associate build the FTE/RSNE in ft_prepare_handshake and set into the handshake object directly.
2023-12-06 21:17:57 +01:00
uint32_t kck_len = handshake_state_get_kck_len(hs);
struct ie_rsn_info rsn_info;
struct ie_ft_info ft_info;
uint8_t *fte;
uint8_t *rsne;
netdev: ft: complete FT refactor This finalizes the refactor by moving all the handshake prep into FT itself (most was already in there). The netdev-specific flags and state were added into netdev_ft_tx_associate which now avoids any need for a netdev API related to FT. The NETDEV_EVENT_FT_ROAMED event is now emitted once FT completes (netdev_connect_ok). This did require moving the 'in_ft' flag setting until after the keys are set into the kernel otherwise netdev_connect_ok has no context as to if this was FT or some other connection attempt. In addition the prev_snonce was removed from netdev. Restoring the snonce has no value once association begins. If association fails it will result in a disconnect regardless which requires a new snonce to be generated
2022-09-27 21:47:29 +02:00
handshake_state_set_authenticator_address(hs, info->aa);
memcpy(hs->mde + 2, info->mde, 3);
handshake_state_set_chandef(hs, NULL);
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
if (!hs->supplicant_ie)
ft: add FTE/RSNE building to ft_prepare_handshake In preparation to remove ft_associate build the FTE/RSNE in ft_prepare_handshake and set into the handshake object directly.
2023-12-06 21:17:57 +01:00
return true;
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
netdev: ft: complete FT refactor This finalizes the refactor by moving all the handshake prep into FT itself (most was already in there). The netdev-specific flags and state were added into netdev_ft_tx_associate which now avoids any need for a netdev API related to FT. The NETDEV_EVENT_FT_ROAMED event is now emitted once FT completes (netdev_connect_ok). This did require moving the 'in_ft' flag setting until after the keys are set into the kernel otherwise netdev_connect_ok has no context as to if this was FT or some other connection attempt. In addition the prev_snonce was removed from netdev. Restoring the snonce has no value once association begins. If association fails it will result in a disconnect regardless which requires a new snonce to be generated
2022-09-27 21:47:29 +02:00
if (info->authenticator_ie)
handshake_state_set_authenticator_ie(hs,
info->authenticator_ie);
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
memcpy(hs->snonce, info->snonce, sizeof(hs->snonce));
handshake: use authenticator_fte instead of 'fte'
2023-12-06 21:17:54 +01:00
handshake_state_set_authenticator_fte(hs, info->fte);
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
handshake_state_set_anonce(hs, info->ft_info.anonce);
handshake_state_set_kh_ids(hs, info->ft_info.r0khid,
info->ft_info.r0khid_len,
info->ft_info.r1khid);
handshake_state_derive_ptk(hs);
ft: add FTE/RSNE building to ft_prepare_handshake In preparation to remove ft_associate build the FTE/RSNE in ft_prepare_handshake and set into the handshake object directly.
2023-12-06 21:17:57 +01:00
/*
* Rebuild the RSNE to include the PMKR1Name and append
* MDE + FTE.
*
* 12.8.4: "If present, the RSNE shall be set as follows:
* - Version field shall be set to 1.
* - PMKID Count field shall be set to 1.
* - PMKID field shall contain the PMKR1Name.
* - All other fields shall be as specified in 8.4.2.27
* and 11.5.3."
*/
if (ie_parse_rsne_from_data(hs->supplicant_ie,
hs->supplicant_ie[1] + 2,
&rsn_info) < 0)
return false;
rsn_info.num_pmkids = 1;
rsn_info.pmkids = hs->pmk_r1_name;
/* Always set OCVC false for FT for now */
rsn_info.ocvc = false;
rsne = alloca(256);
ie_build_rsne(&rsn_info, rsne);
handshake_state_set_supplicant_ie(hs, rsne);
/*
* 12.8.4: "If present, the FTE shall be set as follows:
* - ANonce, SNonce, R0KH-ID, and R1KH-ID shall be set to
* the values contained in the second message of this
* sequence.
* - The Element Count field of the MIC Control field shall
* be set to the number of elements protected in this
* frame (variable).
* [...]
* - All other fields shall be set to 0."
*/
memset(&ft_info, 0, sizeof(ft_info));
ft_info.mic_element_count = 3;
memcpy(ft_info.r0khid, hs->r0khid, hs->r0khid_len);
ft_info.r0khid_len = hs->r0khid_len;
memcpy(ft_info.r1khid, hs->r1khid, 6);
ft_info.r1khid_present = true;
memcpy(ft_info.anonce, hs->anonce, 32);
memcpy(ft_info.snonce, hs->snonce, 32);
/*
* IEEE 802.11-2020 Section 13.7.1 FT reassociation in an RSN
*
* "If dot11RSNAOperatingChannelValidationActivated is true and
* the FTO indicates OCVC capability, the target AP shall
* ensure that OCI subelement of the FTE matches by ensuring
* that all of the following are true:
* - OCI subelement is present
* - Channel information in the OCI matches current
* operating channel parameters (see 12.2.9)"
*/
if (hs->supplicant_ocvc && hs->chandef) {
oci_from_chandef(hs->chandef, ft_info.oci);
ft_info.oci_present = true;
}
fte = alloca(256);
ie_build_fast_bss_transition(&ft_info, kck_len, fte);
if (!ft_calculate_fte_mic(hs, 5, rsne, fte, NULL, ft_info.mic))
return false;
/* Rebuild the FT IE now with the MIC included */
ie_build_fast_bss_transition(&ft_info, kck_len, fte);
handshake_state_set_supplicant_fte(hs, fte);
return true;
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
}
ft: gate FT-over-DS with a wiphy work item Queue the FT action just like we do with FT Authenticate which makes it able to be used the same way, i.e. call ft_action() then queue the ft_associate work right away. A timer was added to end the work item in case the target never responds.
2022-12-14 22:26:56 +01:00
static bool ft_send_action(struct wiphy_radio_work_item *work)
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
{
ft: gate FT-over-DS with a wiphy work item Queue the FT action just like we do with FT Authenticate which makes it able to be used the same way, i.e. call ft_action() then queue the ft_associate work right away. A timer was added to end the work item in case the target never responds.
2022-12-14 22:26:56 +01:00
struct ft_info *info = l_container_of(work, struct ft_info, work);
struct netdev *netdev = netdev_find(info->ifindex);
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
struct handshake_state *hs = netdev_get_handshake(netdev);
uint8_t ft_req[14];
struct iovec iov[5];
uint8_t ies[512];
size_t len;
int ret = -EINVAL;
ft_req[0] = 6; /* FT category */
ft_req[1] = 1; /* FT Request action */
memcpy(ft_req + 2, info->spa, 6);
memcpy(ft_req + 8, info->aa, 6);
ft: add debug prints for FT-over-DS This is consistent with the over-Air path, and makes it clear when reading the logs if over-DS was used, if there was a response frame, and if the frame failed to parse in some way.
2023-06-21 21:36:33 +02:00
l_debug("");
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
if (!ft_build_authenticate_ies(hs, hs->supplicant_ocvc, info->snonce,
ies, &len))
goto failed;
iov[0].iov_base = ft_req;
iov[0].iov_len = sizeof(ft_req);
iov[1].iov_base = ies;
iov[1].iov_len = len;
ft: gate FT-over-DS with a wiphy work item Queue the FT action just like we do with FT Authenticate which makes it able to be used the same way, i.e. call ft_action() then queue the ft_associate work right away. A timer was added to end the work item in case the target never responds.
2022-12-14 22:26:56 +01:00
ret = tx_frame(hs->ifindex, 0x00d0, info->ds_frequency, hs->aa, iov, 2);
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
if (ret < 0)
goto failed;
l_queue_push_tail(info_list, info);
ft: gate FT-over-DS with a wiphy work item Queue the FT action just like we do with FT Authenticate which makes it able to be used the same way, i.e. call ft_action() then queue the ft_associate work right away. A timer was added to end the work item in case the target never responds.
2022-12-14 22:26:56 +01:00
return false;
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
failed:
ft: gate FT-over-DS with a wiphy work item Queue the FT action just like we do with FT Authenticate which makes it able to be used the same way, i.e. call ft_action() then queue the ft_associate work right away. A timer was added to end the work item in case the target never responds.
2022-12-14 22:26:56 +01:00
l_debug("FT-over-DS action failed to "MAC, MAC_STR(hs->aa));
ft_info_destroy(info);
return true;
}
struct wiphy_radio_work_item_ops ft_ops = {
.do_work = ft_send_action,
};
static void ft_ds_timeout(struct l_timeout *timeout, void *user_data)
{
struct ft_info *info = user_data;
struct netdev *netdev = netdev_find(info->ifindex);
wiphy_radio_work_done(netdev_get_wiphy(netdev), info->work.id);
}
int ft_action(uint32_t ifindex, uint32_t freq, const struct scan_bss *target)
{
struct netdev *netdev = netdev_find(ifindex);
struct handshake_state *hs = netdev_get_handshake(netdev);
struct ft_info *info;
info = ft_info_new(hs, target);
info->ds_frequency = freq;
info->timeout = l_timeout_create_ms(200, ft_ds_timeout, info, NULL);
wiphy_radio_work_insert(netdev_get_wiphy(netdev), &info->work,
WIPHY_WORK_PRIORITY_FT, &ft_ops);
return 0;
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
}
ft: implement offchannel authentication A new API was added, ft_authenticate, which will send an authentication frame offchannel via CMD_FRAME. This bypasses the kernel's authentication state allowing multiple auth attempts to take place without disconnecting.
2022-09-27 21:47:23 +02:00
void __ft_rx_authenticate(uint32_t ifindex, const uint8_t *frame,
size_t frame_len)
{
struct netdev *netdev = netdev_find(ifindex);
struct handshake_state *hs = netdev_get_handshake(netdev);
struct ft_info *info;
uint16_t status;
const uint8_t *ies;
size_t ies_len;
info = ft_info_find(ifindex, NULL);
if (!info)
return;
if (!ft_parse_authentication_resp_frame(frame, frame_len,
info->spa, info->aa, info->aa, 2,
ft: add debugging in __ft_rx_authenticate If there was some problem during the FT authenticate stage its nice to know more of what happened: whether the AP didn't respond, rejected the attempt, or sent an invalid frame/IEs.
2023-06-06 17:04:16 +02:00
&status, &ies, &ies_len)) {
l_debug("Could not parse auth response");
ft: implement offchannel authentication A new API was added, ft_authenticate, which will send an authentication frame offchannel via CMD_FRAME. This bypasses the kernel's authentication state allowing multiple auth attempts to take place without disconnecting.
2022-09-27 21:47:23 +02:00
return;
ft: add debugging in __ft_rx_authenticate If there was some problem during the FT authenticate stage its nice to know more of what happened: whether the AP didn't respond, rejected the attempt, or sent an invalid frame/IEs.
2023-06-06 17:04:16 +02:00
}
ft: implement offchannel authentication A new API was added, ft_authenticate, which will send an authentication frame offchannel via CMD_FRAME. This bypasses the kernel's authentication state allowing multiple auth attempts to take place without disconnecting.
2022-09-27 21:47:23 +02:00
ft: add debugging in __ft_rx_authenticate If there was some problem during the FT authenticate stage its nice to know more of what happened: whether the AP didn't respond, rejected the attempt, or sent an invalid frame/IEs.
2023-06-06 17:04:16 +02:00
if (status != 0) {
l_debug("BSS "MAC" rejected FT auth with status=%u",
MAC_STR(info->aa), status);
ft: track FT auth/action response status Certain return codes, though failures, can indicate that the AP is just confused or booting up and treating it as a full failure may not be the best route. For example in some production deployments if an AP is rebooted it may take some time for neighboring APs to exchange keys for current associations. If a client roams during that time it will reject saying the PMKID is invalid. Use the ft_associate call return to communicate the status (if any) that was in the auth/action response. If there was a parsing error or no response -ENOENT is still returned.
2023-08-31 14:39:22 +02:00
info->status = status;
ft: clear ft_info inside offchannel destroy Once offchannel completes we can check if the info structure was parsed, indicating authentication succeeded. If not there is no reason to keep it around since IWD will either try another BSS or fail.
2022-09-28 01:15:48 +02:00
goto cancel;
ft: add debugging in __ft_rx_authenticate If there was some problem during the FT authenticate stage its nice to know more of what happened: whether the AP didn't respond, rejected the attempt, or sent an invalid frame/IEs.
2023-06-06 17:04:16 +02:00
}
ft: implement offchannel authentication A new API was added, ft_authenticate, which will send an authentication frame offchannel via CMD_FRAME. This bypasses the kernel's authentication state allowing multiple auth attempts to take place without disconnecting.
2022-09-27 21:47:23 +02:00
ft: add debugging in __ft_rx_authenticate If there was some problem during the FT authenticate stage its nice to know more of what happened: whether the AP didn't respond, rejected the attempt, or sent an invalid frame/IEs.
2023-06-06 17:04:16 +02:00
if (!ft_parse_ies(info, hs, ies, ies_len)) {
l_debug("Could not parse auth response IEs");
ft: clear ft_info inside offchannel destroy Once offchannel completes we can check if the info structure was parsed, indicating authentication succeeded. If not there is no reason to keep it around since IWD will either try another BSS or fail.
2022-09-28 01:15:48 +02:00
goto cancel;
ft: add debugging in __ft_rx_authenticate If there was some problem during the FT authenticate stage its nice to know more of what happened: whether the AP didn't respond, rejected the attempt, or sent an invalid frame/IEs.
2023-06-06 17:04:16 +02:00
}
ft: implement offchannel authentication A new API was added, ft_authenticate, which will send an authentication frame offchannel via CMD_FRAME. This bypasses the kernel's authentication state allowing multiple auth attempts to take place without disconnecting.
2022-09-27 21:47:23 +02:00
ft: track FT auth/action response status Certain return codes, though failures, can indicate that the AP is just confused or booting up and treating it as a full failure may not be the best route. For example in some production deployments if an AP is rebooted it may take some time for neighboring APs to exchange keys for current associations. If a client roams during that time it will reject saying the PMKID is invalid. Use the ft_associate call return to communicate the status (if any) that was in the auth/action response. If there was a parsing error or no response -ENOENT is still returned.
2023-08-31 14:39:22 +02:00
info->status = status;
ft: implement offchannel authentication A new API was added, ft_authenticate, which will send an authentication frame offchannel via CMD_FRAME. This bypasses the kernel's authentication state allowing multiple auth attempts to take place without disconnecting.
2022-09-27 21:47:23 +02:00
ft: clear ft_info inside offchannel destroy Once offchannel completes we can check if the info structure was parsed, indicating authentication succeeded. If not there is no reason to keep it around since IWD will either try another BSS or fail.
2022-09-28 01:15:48 +02:00
cancel:
ft: Introduce ft_authenticate_onchannel Currently when we try FT-over-Air, the Authenticate frame is always sent via offchannel infrastructure We request the driver to go offchannel, then send the Authenticate frame. This works fine as long as the target AP is on a different channel. On some networks some (or all) APs might actually be located on the same channel. In this case going offchannel will result in some drivers not actually sending the Authenticate frame until after the offchannel operation completes. Work around this by introducing a new ft_authenticate variant that will not request an offchannel operation first.
2023-03-01 16:30:24 +01:00
/*
* Verified to be expected target, offchannel or onchannel work can
* now be canceled
*/
if (info->onchannel) {
l_timeout_remove(info->timeout);
info->timeout = NULL;
wiphy_radio_work_done(netdev_get_wiphy(netdev), info->work.id);
} else
offchannel_cancel(netdev_get_wdev_id(netdev),
info->offchannel_id);
ft: implement offchannel authentication A new API was added, ft_authenticate, which will send an authentication frame offchannel via CMD_FRAME. This bypasses the kernel's authentication state allowing multiple auth attempts to take place without disconnecting.
2022-09-27 21:47:23 +02:00
}
static void ft_send_authenticate(void *user_data)
{
struct ft_info *info = user_data;
struct netdev *netdev = netdev_find(info->ifindex);
struct handshake_state *hs = netdev_get_handshake(netdev);
uint8_t ies[256];
size_t len;
struct iovec iov[2];
struct mmpdu_authentication auth;
ft: Introduce ft_authenticate_onchannel Currently when we try FT-over-Air, the Authenticate frame is always sent via offchannel infrastructure We request the driver to go offchannel, then send the Authenticate frame. This works fine as long as the target AP is on a different channel. On some networks some (or all) APs might actually be located on the same channel. In this case going offchannel will result in some drivers not actually sending the Authenticate frame until after the offchannel operation completes. Work around this by introducing a new ft_authenticate variant that will not request an offchannel operation first.
2023-03-01 16:30:24 +01:00
l_debug("");
ft: implement offchannel authentication A new API was added, ft_authenticate, which will send an authentication frame offchannel via CMD_FRAME. This bypasses the kernel's authentication state allowing multiple auth attempts to take place without disconnecting.
2022-09-27 21:47:23 +02:00
/* Authentication body */
auth.algorithm = L_CPU_TO_LE16(MMPDU_AUTH_ALGO_FT);
auth.transaction_sequence = L_CPU_TO_LE16(1);
auth.status = L_CPU_TO_LE16(0);
iov[0].iov_base = &auth;
iov[0].iov_len = sizeof(struct mmpdu_authentication);
if (!ft_build_authenticate_ies(hs, hs->supplicant_ocvc, info->snonce,
ies, &len))
return;
iov[1].iov_base = ies;
iov[1].iov_len = len;
tx_frame(info->ifindex, 0x00b0, info->frequency, info->aa, iov, 2);
}
static void ft_authenticate_destroy(int error, void *user_data)
{
struct ft_info *info = user_data;
info->offchannel_id = 0;
}
/*
* There is no callback here because its assumed that another work item will
* be inserted following this call which will check if authentication succeeded
ft: remove ft_associate and helpers The reassociation is done through netdev directly, these are no longer needed.
2023-12-06 21:18:01 +01:00
* via ft_handshake_setup.
ft: implement offchannel authentication A new API was added, ft_authenticate, which will send an authentication frame offchannel via CMD_FRAME. This bypasses the kernel's authentication state allowing multiple auth attempts to take place without disconnecting.
2022-09-27 21:47:23 +02:00
*
* If the netdev goes away while authentication is in-flight station will clear
* the authentications during cleanup, and in turn cancel the offchannel
* request.
*/
int ft_authenticate(uint32_t ifindex, const struct scan_bss *target)
{
struct netdev *netdev = netdev_find(ifindex);
struct handshake_state *hs = netdev_get_handshake(netdev);
struct ft_info *info = ft_info_new(hs, target);
info->offchannel_id = offchannel_start(netdev_get_wdev_id(netdev),
WIPHY_WORK_PRIORITY_FT,
target->frequency,
200, ft_send_authenticate, info,
ft_authenticate_destroy);
l_queue_push_tail(info_list, info);
return 0;
}
ft: Introduce ft_authenticate_onchannel Currently when we try FT-over-Air, the Authenticate frame is always sent via offchannel infrastructure We request the driver to go offchannel, then send the Authenticate frame. This works fine as long as the target AP is on a different channel. On some networks some (or all) APs might actually be located on the same channel. In this case going offchannel will result in some drivers not actually sending the Authenticate frame until after the offchannel operation completes. Work around this by introducing a new ft_authenticate variant that will not request an offchannel operation first.
2023-03-01 16:30:24 +01:00
static void ft_onchannel_timeout(struct l_timeout *timeout, void *user_data)
{
struct ft_info *info = user_data;
struct netdev *netdev = netdev_find(info->ifindex);
wiphy_radio_work_done(netdev_get_wiphy(netdev), info->work.id);
}
static bool ft_send_authenticate_onchannel(struct wiphy_radio_work_item *work)
{
struct ft_info *info = l_container_of(work, struct ft_info, work);
ft_send_authenticate(info);
info->timeout = l_timeout_create_ms(FT_ONCHANNEL_TIME,
ft_onchannel_timeout,
info, NULL);
return false;
}
struct wiphy_radio_work_item_ops ft_onchannel_ops = {
.do_work = ft_send_authenticate_onchannel,
};
int ft_authenticate_onchannel(uint32_t ifindex, const struct scan_bss *target)
{
struct netdev *netdev = netdev_find(ifindex);
struct handshake_state *hs = netdev_get_handshake(netdev);
struct ft_info *info = ft_info_new(hs, target);
info->onchannel = true;
wiphy_radio_work_insert(netdev_get_wiphy(netdev), &info->work,
WIPHY_WORK_PRIORITY_FT, &ft_onchannel_ops);
l_queue_push_tail(info_list, info);
return 0;
}
ft: add ft_handshake_setup This will be called from station after FT-authentication has finished. It sets up the handshake object to perform reassociation. This is essentially a copy-paste of ft_associate without sending the actual frame.
2023-12-06 21:17:58 +01:00
int ft_handshake_setup(uint32_t ifindex, const uint8_t *target)
{
struct netdev *netdev = netdev_find(ifindex);
struct handshake_state *hs = netdev_get_handshake(netdev);
struct ft_info *info;
int ret = 0;
info = ft_info_find(ifindex, target);
if (!info)
return -ENOENT;
/*
* Either failed or no response. This may have been an FT-over-DS
* attempt so clear out the entry so FT-over-Air can try again.
*/
if (info->status != 0) {
int status = info->status;
l_queue_remove(info_list, info);
ft_info_destroy(info);
return status;
}
/*
* This shouldn't ever fail:
* - supplicant_ie has already been validated long ago
* - l_checksum_* shouldn't fail since we presumable have kernel
* support, how else could we have made it this far.
* But just in case...
*/
if (L_WARN_ON(!ft_prepare_handshake(info, hs)))
ret = -EINVAL;
/* After this no previous auths will be valid */
ft_clear_authentications(ifindex);
return ret;
}
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
static bool remove_ifindex(void *data, void *user_data)
{
struct ft_info *info = data;
uint32_t ifindex = L_PTR_TO_UINT(user_data);
if (info->ifindex != ifindex)
return false;
ft: implement offchannel authentication A new API was added, ft_authenticate, which will send an authentication frame offchannel via CMD_FRAME. This bypasses the kernel's authentication state allowing multiple auth attempts to take place without disconnecting.
2022-09-27 21:47:23 +02:00
if (info->offchannel_id)
offchannel_cancel(netdev_get_wdev_id(netdev_find(ifindex)),
info->offchannel_id);
ft: netdev: prep for FT isolation into ft.c Currently netdev handles caching FT auth information and uses FT parsers/auth-proto to manage the protocol. This sets up to remove this state machine from netdev and isolate it into ft.c. This does not break the existing auth-proto (hence the slight modifications, which will be removed soon). Eventually the auth-proto will be removed from FT entirely, replaced just by an FT state machine, similar to how EAPoL works (netdev hooks to TX/RX frames).
2022-09-27 21:47:21 +02:00
ft_info_destroy(info);
return true;
}
void ft_clear_authentications(uint32_t ifindex)
{
l_queue_foreach_remove(info_list, remove_ifindex,
L_UINT_TO_PTR(ifindex));
}
static int ft_init(void)
{
info_list = l_queue_new();
return 0;
}
static void ft_exit(void)
{
if (!l_queue_isempty(info_list))
l_warn("stale FT info objects found!");
l_queue_destroy(info_list, ft_info_destroy);
}
IWD_MODULE(ft, ft_init, ft_exit);
Copy Permalink