2 * hostapd / IEEE 802.1X Authenticator
3 * Copyright (c) 2002-2006, Jouni Malinen <j@w1.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Alternatively, this software may be distributed under the terms of BSD
12 * See README and COPYING for more details.
21 #include "ieee802_1x.h"
22 #include "accounting.h"
24 #include "radius_client.h"
32 #include "pmksa_cache.h"
34 #include "hw_features.h"
38 static void ieee802_1x_new_auth_session(struct hostapd_data *hapd,
39 struct sta_info *sta);
42 static void ieee802_1x_send(struct hostapd_data *hapd, struct sta_info *sta,
43 u8 type, u8 *data, size_t datalen)
46 struct ieee802_1x_hdr *xhdr;
50 len = sizeof(*xhdr) + datalen;
51 buf = wpa_zalloc(len);
53 printf("malloc() failed for ieee802_1x_send(len=%lu)\n",
60 * According to IEEE 802.1aa/D4 EAPOL-Key should be sent before any
61 * remaining EAP frames, if possible. This would allow rest of the
62 * frames to be encrypted. This code could be used to request
63 * encryption from the kernel driver. */
65 sta->eapol_sm->be_auth.state == BE_AUTH_SUCCESS &&
66 sta->eapol_sm->keyTxEnabled)
70 xhdr = (struct ieee802_1x_hdr *) buf;
71 xhdr->version = hapd->conf->eapol_version;
73 xhdr->length = htons(datalen);
75 if (datalen > 0 && data != NULL)
76 memcpy(xhdr + 1, data, datalen);
78 if (wpa_auth_pairwise_set(sta->wpa_sm))
80 if (sta->flags & WLAN_STA_PREAUTH) {
81 rsn_preauth_send(hapd, sta, buf, len);
83 hostapd_send_eapol(hapd, sta->addr, buf, len, encrypt);
90 void ieee802_1x_set_sta_authorized(struct hostapd_data *hapd,
91 struct sta_info *sta, int authorized)
95 if (sta->flags & WLAN_STA_PREAUTH)
99 sta->flags |= WLAN_STA_AUTHORIZED;
100 res = hostapd_sta_set_flags(hapd, sta->addr,
101 WLAN_STA_AUTHORIZED, ~0);
102 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
103 HOSTAPD_LEVEL_DEBUG, "authorizing port");
105 sta->flags &= ~WLAN_STA_AUTHORIZED;
106 res = hostapd_sta_set_flags(hapd, sta->addr,
107 0, ~WLAN_STA_AUTHORIZED);
108 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
109 HOSTAPD_LEVEL_DEBUG, "unauthorizing port");
112 if (res && errno != ENOENT) {
113 printf("Could not set station " MACSTR " flags for kernel "
114 "driver (errno=%d).\n", MAC2STR(sta->addr), errno);
118 accounting_sta_start(hapd, sta);
122 static void ieee802_1x_eap_timeout(void *eloop_ctx, void *timeout_ctx)
124 struct sta_info *sta = eloop_ctx;
125 struct eapol_state_machine *sm = sta->eapol_sm;
128 hostapd_logger(sm->hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
129 HOSTAPD_LEVEL_DEBUG, "EAP timeout");
130 sm->eapTimeout = TRUE;
135 void ieee802_1x_request_identity(struct hostapd_data *hapd,
136 struct sta_info *sta)
142 struct eapol_state_machine *sm = sta->eapol_sm;
144 if (hapd->conf->eap_server) {
145 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
146 "IEEE 802.1X: Integrated EAP server in "
147 "use - do not generate EAP-Request/Identity\n");
151 if (sm == NULL || !sm->eapRestart)
154 ieee802_1x_new_auth_session(hapd, sta);
156 tlen = sizeof(*eap) + 1 + hapd->conf->eap_req_id_text_len;
158 buf = wpa_zalloc(tlen);
160 printf("Could not allocate memory for identity request\n");
164 eap = (struct eap_hdr *) buf;
165 eap->code = EAP_CODE_REQUEST;
166 eap->identifier = ++sm->currentId;
167 eap->length = htons(tlen);
168 pos = (u8 *) (eap + 1);
169 *pos++ = EAP_TYPE_IDENTITY;
170 if (hapd->conf->eap_req_id_text) {
171 memcpy(pos, hapd->conf->eap_req_id_text,
172 hapd->conf->eap_req_id_text_len);
176 free(sm->last_eap_radius);
177 sm->last_eap_radius = buf;
178 sm->last_eap_radius_len = tlen;
180 eloop_cancel_timeout(ieee802_1x_eap_timeout, sta, NULL);
181 eloop_register_timeout(30, 0, ieee802_1x_eap_timeout, sta, NULL);
182 sm->eapTimeout = FALSE;
184 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
185 "IEEE 802.1X: Generated EAP Request-Identity for " MACSTR
186 " (identifier %d, timeout 30)\n", MAC2STR(sta->addr),
189 sm->eapRestart = FALSE;
193 void ieee802_1x_tx_canned_eap(struct hostapd_data *hapd, struct sta_info *sta,
197 struct eapol_state_machine *sm = sta->eapol_sm;
199 memset(&eap, 0, sizeof(eap));
201 eap.code = success ? EAP_CODE_SUCCESS : EAP_CODE_FAILURE;
203 if (sm && sm->last_eap_radius) {
204 struct eap_hdr *hdr = (struct eap_hdr *) sm->last_eap_radius;
205 eap.identifier = hdr->identifier + 1;
207 eap.length = htons(sizeof(eap));
209 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
210 "IEEE 802.1X: Sending canned EAP packet %s to " MACSTR
211 " (identifier %d)\n", success ? "SUCCESS" : "FAILURE",
212 MAC2STR(sta->addr), eap.identifier);
213 ieee802_1x_send(hapd, sta, IEEE802_1X_TYPE_EAP_PACKET, (u8 *) &eap,
216 sm->dot1xAuthEapolFramesTx++;
220 void ieee802_1x_tx_req(struct hostapd_data *hapd, struct sta_info *sta)
223 struct eapol_state_machine *sm = sta->eapol_sm;
228 if (sm->last_eap_radius == NULL) {
229 printf("Error: TxReq called for station " MACSTR ", but there "
230 "is no EAP request from the authentication server\n",
235 eap = (struct eap_hdr *) sm->last_eap_radius;
236 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
237 "IEEE 802.1X: Sending EAP Packet to " MACSTR
238 " (identifier %d)\n", MAC2STR(sm->addr),
240 sm->currentId = eap->identifier;
241 ieee802_1x_send(hapd, sta, IEEE802_1X_TYPE_EAP_PACKET,
242 sm->last_eap_radius, sm->last_eap_radius_len);
243 sm->dot1xAuthEapolFramesTx++;
244 type = (u8 *) (eap + 1);
245 if (sm->last_eap_radius_len > sizeof(*eap) &&
246 *type == EAP_TYPE_IDENTITY)
247 sm->dot1xAuthEapolReqIdFramesTx++;
249 sm->dot1xAuthEapolReqFramesTx++;
253 static void ieee802_1x_tx_key_one(struct hostapd_data *hapd,
254 struct sta_info *sta,
255 int idx, int broadcast,
256 u8 *key_data, size_t key_len)
259 struct ieee802_1x_hdr *hdr;
260 struct ieee802_1x_eapol_key *key;
261 size_t len, ekey_len;
262 struct eapol_state_machine *sm = sta->eapol_sm;
267 len = sizeof(*key) + key_len;
268 buf = wpa_zalloc(sizeof(*hdr) + len);
272 hdr = (struct ieee802_1x_hdr *) buf;
273 key = (struct ieee802_1x_eapol_key *) (hdr + 1);
274 key->type = EAPOL_KEY_TYPE_RC4;
275 key->key_length = htons(key_len);
276 wpa_get_ntp_timestamp(key->replay_counter);
278 if (hostapd_get_rand(key->key_iv, sizeof(key->key_iv))) {
279 printf("Could not get random numbers\n");
284 key->key_index = idx | (broadcast ? 0 : BIT(7));
285 if (hapd->conf->eapol_key_index_workaround) {
286 /* According to some information, WinXP Supplicant seems to
287 * interpret bit7 as an indication whether the key is to be
288 * activated, so make it possible to enable workaround that
289 * sets this bit for all keys. */
290 key->key_index |= BIT(7);
293 /* Key is encrypted using "Key-IV + sm->eapol_key_crypt" as the
295 memcpy((u8 *) (key + 1), key_data, key_len);
296 ekey_len = sizeof(key->key_iv) + sm->eapol_key_crypt_len;
297 ekey = malloc(ekey_len);
299 printf("Could not encrypt key\n");
303 memcpy(ekey, key->key_iv, sizeof(key->key_iv));
304 memcpy(ekey + sizeof(key->key_iv), sm->eapol_key_crypt,
305 sm->eapol_key_crypt_len);
306 rc4((u8 *) (key + 1), key_len, ekey, ekey_len);
309 /* This header is needed here for HMAC-MD5, but it will be regenerated
310 * in ieee802_1x_send() */
311 hdr->version = hapd->conf->eapol_version;
312 hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
313 hdr->length = htons(len);
314 hmac_md5(sm->eapol_key_sign, sm->eapol_key_sign_len,
315 buf, sizeof(*hdr) + len,
318 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
319 "IEEE 802.1X: Sending EAPOL-Key to " MACSTR
320 " (%s index=%d)\n", MAC2STR(sm->addr),
321 broadcast ? "broadcast" : "unicast", idx);
322 ieee802_1x_send(hapd, sta, IEEE802_1X_TYPE_EAPOL_KEY, (u8 *) key, len);
324 sta->eapol_sm->dot1xAuthEapolFramesTx++;
329 static struct hostapd_wep_keys *
330 ieee802_1x_group_alloc(struct hostapd_data *hapd, const char *ifname)
332 struct hostapd_wep_keys *key;
334 key = wpa_zalloc(sizeof(*key));
338 key->default_len = hapd->conf->default_wep_key_len;
340 if (key->idx >= hapd->conf->broadcast_key_idx_max ||
341 key->idx < hapd->conf->broadcast_key_idx_min)
342 key->idx = hapd->conf->broadcast_key_idx_min;
346 if (!key->key[key->idx])
347 key->key[key->idx] = malloc(key->default_len);
348 if (key->key[key->idx] == NULL ||
349 hostapd_get_rand(key->key[key->idx], key->default_len)) {
350 printf("Could not generate random WEP key (dynamic VLAN).\n");
351 free(key->key[key->idx]);
352 key->key[key->idx] = NULL;
356 key->len[key->idx] = key->default_len;
358 if (HOSTAPD_DEBUG_COND(HOSTAPD_DEBUG_MINIMAL)) {
359 printf("%s: Default WEP idx %d for dynamic VLAN\n",
361 wpa_hexdump_key(MSG_DEBUG, "Default WEP key (dynamic VLAN)",
362 key->key[key->idx], key->len[key->idx]);
365 if (hostapd_set_encryption(ifname, hapd, "WEP", NULL, key->idx,
366 key->key[key->idx], key->len[key->idx], 1))
367 printf("Could not set dynamic VLAN WEP encryption key.\n");
369 hostapd_set_ieee8021x(ifname, hapd, 1);
375 static struct hostapd_wep_keys *
376 ieee802_1x_get_group(struct hostapd_data *hapd, struct hostapd_ssid *ssid,
384 if (vlan_id <= ssid->max_dyn_vlan_keys && ssid->dyn_vlan_keys &&
385 ssid->dyn_vlan_keys[vlan_id])
386 return ssid->dyn_vlan_keys[vlan_id];
388 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "IEEE 802.1X: Creating new group "
389 "state machine for VLAN ID %lu\n",
390 (unsigned long) vlan_id);
392 ifname = hostapd_get_vlan_id_ifname(hapd->conf->vlan, vlan_id);
393 if (ifname == NULL) {
394 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "IEEE 802.1X: Unknown "
395 "VLAN ID %lu - cannot create group key state "
396 "machine\n", (unsigned long) vlan_id);
400 if (ssid->dyn_vlan_keys == NULL) {
401 int size = (vlan_id + 1) * sizeof(ssid->dyn_vlan_keys[0]);
402 ssid->dyn_vlan_keys = wpa_zalloc(size);
403 if (ssid->dyn_vlan_keys == NULL)
405 ssid->max_dyn_vlan_keys = vlan_id;
408 if (ssid->max_dyn_vlan_keys < vlan_id) {
409 struct hostapd_wep_keys **na;
410 int size = (vlan_id + 1) * sizeof(ssid->dyn_vlan_keys[0]);
411 na = realloc(ssid->dyn_vlan_keys, size);
414 ssid->dyn_vlan_keys = na;
415 memset(&ssid->dyn_vlan_keys[ssid->max_dyn_vlan_keys + 1], 0,
416 (vlan_id - ssid->max_dyn_vlan_keys) *
417 sizeof(ssid->dyn_vlan_keys[0]));
418 ssid->max_dyn_vlan_keys = vlan_id;
421 ssid->dyn_vlan_keys[vlan_id] = ieee802_1x_group_alloc(hapd, ifname);
423 return ssid->dyn_vlan_keys[vlan_id];
427 void ieee802_1x_tx_key(struct hostapd_data *hapd, struct sta_info *sta)
429 struct hostapd_wep_keys *key = NULL;
430 struct eapol_state_machine *sm = sta->eapol_sm;
433 if (sm == NULL || !sm->eapol_key_sign || !sm->eapol_key_crypt)
436 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
437 "IEEE 802.1X: Sending EAPOL-Key(s) to " MACSTR "\n",
440 vlan_id = sta->vlan_id;
441 if (vlan_id < 0 || vlan_id > MAX_VLAN_ID)
445 key = ieee802_1x_get_group(hapd, sta->ssid, vlan_id);
446 if (key && key->key[key->idx])
447 ieee802_1x_tx_key_one(hapd, sta, key->idx, 1,
450 } else if (hapd->default_wep_key) {
451 ieee802_1x_tx_key_one(hapd, sta, hapd->default_wep_key_idx, 1,
452 hapd->default_wep_key,
453 hapd->conf->default_wep_key_len);
456 if (hapd->conf->individual_wep_key_len > 0) {
458 ikey = malloc(hapd->conf->individual_wep_key_len);
460 hostapd_get_rand(ikey,
461 hapd->conf->individual_wep_key_len)) {
462 printf("Could not generate random individual WEP "
468 wpa_hexdump_key(MSG_DEBUG, "Individual WEP key",
469 ikey, hapd->conf->individual_wep_key_len);
471 ieee802_1x_tx_key_one(hapd, sta, 0, 0, ikey,
472 hapd->conf->individual_wep_key_len);
474 /* TODO: set encryption in TX callback, i.e., only after STA
475 * has ACKed EAPOL-Key frame */
476 if (hostapd_set_encryption(hapd->conf->iface, hapd, "WEP",
478 hapd->conf->individual_wep_key_len,
480 printf("Could not set individual WEP encryption.\n");
488 const char *radius_mode_txt(struct hostapd_data *hapd)
490 if (hapd->iface->current_mode == NULL)
493 switch (hapd->iface->current_mode->mode) {
494 case HOSTAPD_MODE_IEEE80211A:
496 case HOSTAPD_MODE_IEEE80211G:
498 case HOSTAPD_MODE_IEEE80211B:
505 int radius_sta_rate(struct hostapd_data *hapd, struct sta_info *sta)
510 for (i = 0; i < sta->supported_rates_len; i++)
511 if ((sta->supported_rates[i] & 0x7f) > rate)
512 rate = sta->supported_rates[i] & 0x7f;
518 static void ieee802_1x_encapsulate_radius(struct hostapd_data *hapd,
519 struct sta_info *sta,
522 struct radius_msg *msg;
524 struct eapol_state_machine *sm = sta->eapol_sm;
529 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
530 "Encapsulating EAP message into a RADIUS packet\n");
532 sm->radius_identifier = radius_client_get_id(hapd->radius);
533 msg = radius_msg_new(RADIUS_CODE_ACCESS_REQUEST,
534 sm->radius_identifier);
536 printf("Could not create net RADIUS packet\n");
540 radius_msg_make_authenticator(msg, (u8 *) sta, sizeof(*sta));
543 !radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME,
544 sm->identity, sm->identity_len)) {
545 printf("Could not add User-Name\n");
549 if (hapd->conf->own_ip_addr.af == AF_INET &&
550 !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IP_ADDRESS,
551 (u8 *) &hapd->conf->own_ip_addr.u.v4, 4)) {
552 printf("Could not add NAS-IP-Address\n");
557 if (hapd->conf->own_ip_addr.af == AF_INET6 &&
558 !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IPV6_ADDRESS,
559 (u8 *) &hapd->conf->own_ip_addr.u.v6, 16)) {
560 printf("Could not add NAS-IPv6-Address\n");
563 #endif /* CONFIG_IPV6 */
565 if (hapd->conf->nas_identifier &&
566 !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IDENTIFIER,
567 (u8 *) hapd->conf->nas_identifier,
568 strlen(hapd->conf->nas_identifier))) {
569 printf("Could not add NAS-Identifier\n");
573 if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_NAS_PORT, sta->aid)) {
574 printf("Could not add NAS-Port\n");
578 snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT ":%s",
579 MAC2STR(hapd->own_addr), hapd->conf->ssid.ssid);
580 buf[sizeof(buf) - 1] = '\0';
581 if (!radius_msg_add_attr(msg, RADIUS_ATTR_CALLED_STATION_ID,
582 (u8 *) buf, strlen(buf))) {
583 printf("Could not add Called-Station-Id\n");
587 snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT,
589 buf[sizeof(buf) - 1] = '\0';
590 if (!radius_msg_add_attr(msg, RADIUS_ATTR_CALLING_STATION_ID,
591 (u8 *) buf, strlen(buf))) {
592 printf("Could not add Calling-Station-Id\n");
596 /* TODO: should probably check MTU from driver config; 2304 is max for
597 * IEEE 802.11, but use 1400 to avoid problems with too large packets
599 if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_FRAMED_MTU, 1400)) {
600 printf("Could not add Framed-MTU\n");
604 if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_NAS_PORT_TYPE,
605 RADIUS_NAS_PORT_TYPE_IEEE_802_11)) {
606 printf("Could not add NAS-Port-Type\n");
610 if (sta->flags & WLAN_STA_PREAUTH) {
611 snprintf(buf, sizeof(buf), "IEEE 802.11i Pre-Authentication");
613 snprintf(buf, sizeof(buf), "CONNECT %d%sMbps %s",
614 radius_sta_rate(hapd, sta) / 2,
615 (radius_sta_rate(hapd, sta) & 1) ? ".5" : "",
616 radius_mode_txt(hapd));
618 buf[sizeof(buf) - 1] = '\0';
619 if (!radius_msg_add_attr(msg, RADIUS_ATTR_CONNECT_INFO,
620 (u8 *) buf, strlen(buf))) {
621 printf("Could not add Connect-Info\n");
625 if (eap && !radius_msg_add_eap(msg, eap, len)) {
626 printf("Could not add EAP-Message\n");
630 /* State attribute must be copied if and only if this packet is
631 * Access-Request reply to the previous Access-Challenge */
632 if (sm->last_recv_radius && sm->last_recv_radius->hdr->code ==
633 RADIUS_CODE_ACCESS_CHALLENGE) {
634 int res = radius_msg_copy_attr(msg, sm->last_recv_radius,
637 printf("Could not copy State attribute from previous "
638 "Access-Challenge\n");
642 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
643 " Copied RADIUS State Attribute\n");
647 radius_client_send(hapd->radius, msg, RADIUS_AUTH, sta->addr);
651 radius_msg_free(msg);
656 char *eap_type_text(u8 type)
659 case EAP_TYPE_IDENTITY: return "Identity";
660 case EAP_TYPE_NOTIFICATION: return "Notification";
661 case EAP_TYPE_NAK: return "Nak";
662 case EAP_TYPE_MD5: return "MD5-Challenge";
663 case EAP_TYPE_OTP: return "One-Time Password";
664 case EAP_TYPE_GTC: return "Generic Token Card";
665 case EAP_TYPE_TLS: return "TLS";
666 case EAP_TYPE_TTLS: return "TTLS";
667 case EAP_TYPE_PEAP: return "PEAP";
668 case EAP_TYPE_SIM: return "SIM";
669 case EAP_TYPE_FAST: return "FAST";
670 case EAP_TYPE_SAKE: return "SAKE";
671 case EAP_TYPE_PSK: return "PSK";
672 default: return "Unknown";
677 static void handle_eap_response(struct hostapd_data *hapd,
678 struct sta_info *sta, struct eap_hdr *eap,
679 u8 *data, size_t len)
682 struct eapol_state_machine *sm = sta->eapol_sm;
686 if (eap->identifier != sm->currentId) {
687 hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
689 "EAP Identifier of the Response-Identity does "
690 "not match (was %d, expected %d) - ignored",
691 eap->identifier, sm->currentId);
696 printf("handle_eap_response: too short response data\n");
700 eloop_cancel_timeout(ieee802_1x_eap_timeout, sta, NULL);
702 free(sm->last_eap_supp);
703 sm->last_eap_supp_len = sizeof(*eap) + len;
704 sm->last_eap_supp = (u8 *) malloc(sm->last_eap_supp_len);
705 if (sm->last_eap_supp == NULL) {
706 printf("Could not alloc memory for last EAP Response\n");
709 memcpy(sm->last_eap_supp, eap, sizeof(*eap));
710 memcpy(sm->last_eap_supp + sizeof(*eap), data, len);
712 sm->eap_type_supp = type = data[0];
716 hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
717 HOSTAPD_LEVEL_DEBUG, "received EAP packet (code=%d "
718 "id=%d len=%d) from STA: EAP Response-%s (%d)",
719 eap->code, eap->identifier, ntohs(eap->length),
720 eap_type_text(type), type);
722 if (type == EAP_TYPE_IDENTITY) {
725 buf = malloc(4 * len + 1);
728 for (i = 0; i < len; i++) {
729 if (data[i] >= 32 && data[i] < 127)
732 snprintf(pos, 5, "{%02x}", data[i]);
737 hostapd_logger(hapd, sm->addr,
738 HOSTAPD_MODULE_IEEE8021X,
740 "STA identity '%s'", buf);
744 sm->rx_identity = TRUE;
745 sm->dot1xAuthEapolRespIdFramesRx++;
747 /* Save station identity for future RADIUS packets */
749 sm->identity = malloc(len + 1);
751 memcpy(sm->identity, data, len);
752 sm->identity[len] = '\0';
753 sm->identity_len = len;
756 sm->dot1xAuthEapolRespFramesRx++;
762 /* Process incoming EAP packet from Supplicant */
763 static void handle_eap(struct hostapd_data *hapd, struct sta_info *sta,
769 if (len < sizeof(*eap)) {
770 printf(" too short EAP packet\n");
774 eap = (struct eap_hdr *) buf;
776 eap_len = ntohs(eap->length);
777 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
778 " EAP: code=%d identifier=%d length=%d",
779 eap->code, eap->identifier, eap_len);
780 if (eap_len < sizeof(*eap)) {
781 printf(" Invalid EAP length\n");
783 } else if (eap_len > len) {
784 printf(" Too short frame to contain this EAP packet\n");
786 } else if (eap_len < len) {
787 printf(" Ignoring %lu extra bytes after EAP packet\n",
788 (unsigned long) len - eap_len);
791 eap_len -= sizeof(*eap);
794 case EAP_CODE_REQUEST:
795 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " (request)\n");
797 case EAP_CODE_RESPONSE:
798 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " (response)\n");
799 handle_eap_response(hapd, sta, eap, (u8 *) (eap + 1), eap_len);
801 case EAP_CODE_SUCCESS:
802 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " (success)\n");
804 case EAP_CODE_FAILURE:
805 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " (failure)\n");
808 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " (unknown code)\n");
814 /* Process the EAPOL frames from the Supplicant */
815 void ieee802_1x_receive(struct hostapd_data *hapd, const u8 *sa, const u8 *buf,
818 struct sta_info *sta;
819 struct ieee802_1x_hdr *hdr;
820 struct ieee802_1x_eapol_key *key;
822 struct rsn_pmksa_cache_entry *pmksa;
824 if (!hapd->conf->ieee802_1x && !hapd->conf->wpa)
827 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
828 "IEEE 802.1X: %lu bytes from " MACSTR "\n",
829 (unsigned long) len, MAC2STR(sa));
830 sta = ap_get_sta(hapd, sa);
832 printf(" no station information available\n");
836 if (len < sizeof(*hdr)) {
837 printf(" too short IEEE 802.1X packet\n");
841 hdr = (struct ieee802_1x_hdr *) buf;
842 datalen = ntohs(hdr->length);
843 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
844 " IEEE 802.1X: version=%d type=%d length=%d\n",
845 hdr->version, hdr->type, datalen);
847 if (len - sizeof(*hdr) < datalen) {
848 printf(" frame too short for this IEEE 802.1X packet\n");
850 sta->eapol_sm->dot1xAuthEapLengthErrorFramesRx++;
853 if (len - sizeof(*hdr) > datalen) {
854 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
855 " ignoring %lu extra octets after IEEE 802.1X "
857 (unsigned long) len - sizeof(*hdr) - datalen);
861 sta->eapol_sm->dot1xAuthLastEapolFrameVersion = hdr->version;
862 sta->eapol_sm->dot1xAuthEapolFramesRx++;
865 key = (struct ieee802_1x_eapol_key *) (hdr + 1);
866 if (datalen >= sizeof(struct ieee802_1x_eapol_key) &&
867 hdr->type == IEEE802_1X_TYPE_EAPOL_KEY &&
868 (key->type == EAPOL_KEY_TYPE_WPA ||
869 key->type == EAPOL_KEY_TYPE_RSN)) {
870 wpa_receive(hapd->wpa_auth, sta->wpa_sm, (u8 *) hdr,
871 sizeof(*hdr) + datalen);
875 if (!hapd->conf->ieee802_1x ||
876 wpa_auth_sta_key_mgmt(sta->wpa_sm) == WPA_KEY_MGMT_PSK)
879 if (!sta->eapol_sm) {
880 sta->eapol_sm = eapol_sm_alloc(hapd, sta);
885 /* since we support version 1, we can ignore version field and proceed
886 * as specified in version 1 standard [IEEE Std 802.1X-2001, 7.5.5] */
887 /* TODO: actually, we are not version 1 anymore.. However, Version 2
888 * does not change frame contents, so should be ok to process frames
889 * more or less identically. Some changes might be needed for
890 * verification of fields. */
893 case IEEE802_1X_TYPE_EAP_PACKET:
894 handle_eap(hapd, sta, (u8 *) (hdr + 1), datalen);
897 case IEEE802_1X_TYPE_EAPOL_START:
898 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
899 HOSTAPD_LEVEL_DEBUG, "received EAPOL-Start "
901 pmksa = wpa_auth_sta_get_pmksa(sta->wpa_sm);
903 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA,
904 HOSTAPD_LEVEL_DEBUG, "cached PMKSA "
905 "available - ignore it since "
906 "STA sent EAPOL-Start");
907 wpa_auth_sta_clear_pmksa(sta->wpa_sm, pmksa);
909 sta->eapol_sm->eapolStart = TRUE;
910 sta->eapol_sm->dot1xAuthEapolStartFramesRx++;
911 wpa_auth_sm_event(sta->wpa_sm, WPA_REAUTH_EAPOL);
914 case IEEE802_1X_TYPE_EAPOL_LOGOFF:
915 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
916 HOSTAPD_LEVEL_DEBUG, "received EAPOL-Logoff "
918 sta->acct_terminate_cause =
919 RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
920 sta->eapol_sm->eapolLogoff = TRUE;
921 sta->eapol_sm->dot1xAuthEapolLogoffFramesRx++;
924 case IEEE802_1X_TYPE_EAPOL_KEY:
925 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, " EAPOL-Key\n");
926 if (!(sta->flags & WLAN_STA_AUTHORIZED)) {
927 printf(" Dropped key data from unauthorized "
933 case IEEE802_1X_TYPE_EAPOL_ENCAPSULATED_ASF_ALERT:
934 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
935 " EAPOL-Encapsulated-ASF-Alert\n");
936 /* TODO: implement support for this; show data */
940 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
941 " unknown IEEE 802.1X packet type\n");
942 sta->eapol_sm->dot1xAuthInvalidEapolFramesRx++;
946 eapol_sm_step(sta->eapol_sm);
950 void ieee802_1x_new_station(struct hostapd_data *hapd, struct sta_info *sta)
952 struct rsn_pmksa_cache_entry *pmksa;
955 if (!hapd->conf->ieee802_1x ||
956 wpa_auth_sta_key_mgmt(sta->wpa_sm) == WPA_KEY_MGMT_PSK)
959 if (sta->eapol_sm == NULL) {
960 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
961 HOSTAPD_LEVEL_DEBUG, "start authentication");
962 sta->eapol_sm = eapol_sm_alloc(hapd, sta);
963 if (sta->eapol_sm == NULL) {
964 hostapd_logger(hapd, sta->addr,
965 HOSTAPD_MODULE_IEEE8021X,
967 "failed to allocate state machine");
973 sta->eapol_sm->portEnabled = TRUE;
975 pmksa = wpa_auth_sta_get_pmksa(sta->wpa_sm);
979 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
981 "PMK from PMKSA cache - skip IEEE 802.1X/EAP");
982 /* Setup EAPOL state machines to already authenticated state
983 * because of existing PMKSA information in the cache. */
984 sta->eapol_sm->keyRun = TRUE;
985 sta->eapol_sm->keyAvailable = TRUE;
986 sta->eapol_sm->auth_pae_state = AUTH_PAE_AUTHENTICATING;
987 sta->eapol_sm->be_auth_state = BE_AUTH_SUCCESS;
988 sta->eapol_sm->authSuccess = TRUE;
989 if (sta->eapol_sm->eap)
990 eap_sm_notify_cached(sta->eapol_sm->eap);
991 old_vlanid = sta->vlan_id;
992 pmksa_cache_to_eapol_data(pmksa, sta->eapol_sm);
993 if (sta->ssid->dynamic_vlan == DYNAMIC_VLAN_DISABLED)
995 ap_sta_bind_vlan(hapd, sta, old_vlanid);
999 * Force EAPOL state machines to start
1000 * re-authentication without having to wait for the
1001 * Supplicant to send EAPOL-Start.
1003 sta->eapol_sm->reAuthenticate = TRUE;
1005 eapol_sm_step(sta->eapol_sm);
1010 void ieee802_1x_free_radius_class(struct radius_class_data *class)
1015 for (i = 0; i < class->count; i++)
1016 free(class->attr[i].data);
1023 int ieee802_1x_copy_radius_class(struct radius_class_data *dst,
1024 struct radius_class_data *src)
1028 if (src->attr == NULL)
1031 dst->attr = wpa_zalloc(src->count * sizeof(struct radius_attr_data));
1032 if (dst->attr == NULL)
1037 for (i = 0; i < src->count; i++) {
1038 dst->attr[i].data = malloc(src->attr[i].len);
1039 if (dst->attr[i].data == NULL)
1042 memcpy(dst->attr[i].data, src->attr[i].data, src->attr[i].len);
1043 dst->attr[i].len = src->attr[i].len;
1050 void ieee802_1x_free_station(struct sta_info *sta)
1052 struct eapol_state_machine *sm = sta->eapol_sm;
1054 eloop_cancel_timeout(ieee802_1x_eap_timeout, sta, NULL);
1059 sta->eapol_sm = NULL;
1061 if (sm->last_recv_radius) {
1062 radius_msg_free(sm->last_recv_radius);
1063 free(sm->last_recv_radius);
1066 free(sm->last_eap_supp);
1067 free(sm->last_eap_radius);
1069 ieee802_1x_free_radius_class(&sm->radius_class);
1070 free(sm->eapol_key_sign);
1071 free(sm->eapol_key_crypt);
1076 static void ieee802_1x_decapsulate_radius(struct hostapd_data *hapd,
1077 struct sta_info *sta)
1081 struct eap_hdr *hdr;
1084 struct radius_msg *msg;
1085 struct eapol_state_machine *sm = sta->eapol_sm;
1087 if (sm == NULL || sm->last_recv_radius == NULL) {
1089 sm->eapNoReq = TRUE;
1093 msg = sm->last_recv_radius;
1095 eap = radius_msg_get_eap(msg, &len);
1097 /* draft-aboba-radius-rfc2869bis-20.txt, Chap. 2.6.3:
1098 * RADIUS server SHOULD NOT send Access-Reject/no EAP-Message
1100 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1101 HOSTAPD_LEVEL_WARNING, "could not extract "
1102 "EAP-Message from RADIUS message");
1103 free(sm->last_eap_radius);
1104 sm->last_eap_radius = NULL;
1105 sm->last_eap_radius_len = 0;
1106 sm->eapNoReq = TRUE;
1110 if (len < sizeof(*hdr)) {
1111 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1112 HOSTAPD_LEVEL_WARNING, "too short EAP packet "
1113 "received from authentication server");
1115 sm->eapNoReq = TRUE;
1119 if (len > sizeof(*hdr))
1120 eap_type = eap[sizeof(*hdr)];
1122 hdr = (struct eap_hdr *) eap;
1123 switch (hdr->code) {
1124 case EAP_CODE_REQUEST:
1126 sm->eap_type_authsrv = eap_type;
1127 snprintf(buf, sizeof(buf), "EAP-Request-%s (%d)",
1128 eap_type >= 0 ? eap_type_text(eap_type) : "??",
1131 case EAP_CODE_RESPONSE:
1132 snprintf(buf, sizeof(buf), "EAP Response-%s (%d)",
1133 eap_type >= 0 ? eap_type_text(eap_type) : "??",
1136 case EAP_CODE_SUCCESS:
1137 snprintf(buf, sizeof(buf), "EAP Success");
1139 case EAP_CODE_FAILURE:
1140 snprintf(buf, sizeof(buf), "EAP Failure");
1143 snprintf(buf, sizeof(buf), "unknown EAP code");
1146 buf[sizeof(buf) - 1] = '\0';
1147 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1148 HOSTAPD_LEVEL_DEBUG, "decapsulated EAP packet (code=%d "
1149 "id=%d len=%d) from RADIUS server: %s",
1150 hdr->code, hdr->identifier, ntohs(hdr->length), buf);
1153 free(sm->last_eap_radius);
1154 sm->last_eap_radius = eap;
1155 sm->last_eap_radius_len = len;
1159 static void ieee802_1x_get_keys(struct hostapd_data *hapd,
1160 struct sta_info *sta, struct radius_msg *msg,
1161 struct radius_msg *req,
1162 u8 *shared_secret, size_t shared_secret_len)
1164 struct radius_ms_mppe_keys *keys;
1165 struct eapol_state_machine *sm = sta->eapol_sm;
1169 keys = radius_msg_get_ms_keys(msg, req, shared_secret,
1174 wpa_hexdump_key(MSG_DEBUG, "MS-MPPE-Send-Key",
1175 keys->send, keys->send_len);
1178 wpa_hexdump_key(MSG_DEBUG, "MS-MPPE-Recv-Key",
1179 keys->recv, keys->recv_len);
1182 if (keys->send && keys->recv) {
1183 free(sm->eapol_key_sign);
1184 free(sm->eapol_key_crypt);
1185 sm->eapol_key_sign = keys->send;
1186 sm->eapol_key_sign_len = keys->send_len;
1187 sm->eapol_key_crypt = keys->recv;
1188 sm->eapol_key_crypt_len = keys->recv_len;
1189 if (hapd->default_wep_key ||
1190 hapd->conf->individual_wep_key_len > 0 ||
1192 sta->eapol_sm->keyAvailable = TRUE;
1202 static void ieee802_1x_store_radius_class(struct hostapd_data *hapd,
1203 struct sta_info *sta,
1204 struct radius_msg *msg)
1208 struct eapol_state_machine *sm = sta->eapol_sm;
1210 struct radius_attr_data *nclass;
1211 size_t nclass_count;
1213 if (!hapd->conf->radius->acct_server || hapd->radius == NULL ||
1217 ieee802_1x_free_radius_class(&sm->radius_class);
1218 count = radius_msg_count_attr(msg, RADIUS_ATTR_CLASS, 1);
1222 nclass = wpa_zalloc(count * sizeof(struct radius_attr_data));
1229 for (i = 0; i < count; i++) {
1231 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_CLASS,
1237 } while (class_len < 1);
1239 nclass[nclass_count].data = malloc(class_len);
1240 if (nclass[nclass_count].data == NULL)
1243 memcpy(nclass[nclass_count].data, class, class_len);
1244 nclass[nclass_count].len = class_len;
1248 sm->radius_class.attr = nclass;
1249 sm->radius_class.count = nclass_count;
1250 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "IEEE 802.1X: Stored %lu RADIUS "
1251 "Class attributes for " MACSTR "\n",
1252 (unsigned long) sm->radius_class.count,
1253 MAC2STR(sta->addr));
1257 /* Update sta->identity based on User-Name attribute in Access-Accept */
1258 static void ieee802_1x_update_sta_identity(struct hostapd_data *hapd,
1259 struct sta_info *sta,
1260 struct radius_msg *msg)
1264 struct eapol_state_machine *sm = sta->eapol_sm;
1269 if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_USER_NAME, &buf, &len,
1273 identity = malloc(len + 1);
1274 if (identity == NULL)
1277 memcpy(identity, buf, len);
1278 identity[len] = '\0';
1280 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1281 HOSTAPD_LEVEL_DEBUG, "old identity '%s' updated with "
1282 "User-Name from Access-Accept '%s'",
1283 sm->identity ? (char *) sm->identity : "N/A",
1287 sm->identity = identity;
1288 sm->identity_len = len;
1292 struct sta_id_search {
1294 struct eapol_state_machine *sm;
1298 static int ieee802_1x_select_radius_identifier(struct hostapd_data *hapd,
1299 struct sta_info *sta,
1302 struct sta_id_search *id_search = ctx;
1303 struct eapol_state_machine *sm = sta->eapol_sm;
1305 if (sm && sm->radius_identifier >= 0 &&
1306 sm->radius_identifier == id_search->identifier) {
1314 static struct eapol_state_machine *
1315 ieee802_1x_search_radius_identifier(struct hostapd_data *hapd, u8 identifier)
1317 struct sta_id_search id_search;
1318 id_search.identifier = identifier;
1319 id_search.sm = NULL;
1320 ap_for_each_sta(hapd, ieee802_1x_select_radius_identifier, &id_search);
1321 return id_search.sm;
1325 /* Process the RADIUS frames from Authentication Server */
1326 static RadiusRxResult
1327 ieee802_1x_receive_auth(struct radius_msg *msg, struct radius_msg *req,
1328 u8 *shared_secret, size_t shared_secret_len,
1331 struct hostapd_data *hapd = data;
1332 struct sta_info *sta;
1333 u32 session_timeout = 0, termination_action, acct_interim_interval;
1334 int session_timeout_set, old_vlanid = 0;
1336 struct eapol_state_machine *sm;
1337 int override_eapReq = 0;
1339 sm = ieee802_1x_search_radius_identifier(hapd, msg->hdr->identifier);
1341 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "IEEE 802.1X: Could not "
1342 "find matching station for this RADIUS "
1344 return RADIUS_RX_UNKNOWN;
1348 /* RFC 2869, Ch. 5.13: valid Message-Authenticator attribute MUST be
1349 * present when packet contains an EAP-Message attribute */
1350 if (msg->hdr->code == RADIUS_CODE_ACCESS_REJECT &&
1351 radius_msg_get_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR, NULL,
1353 radius_msg_get_attr(msg, RADIUS_ATTR_EAP_MESSAGE, NULL, 0) < 0) {
1354 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "Allowing RADIUS "
1355 "Access-Reject without Message-Authenticator "
1356 "since it does not include EAP-Message\n");
1357 } else if (radius_msg_verify(msg, shared_secret, shared_secret_len,
1359 printf("Incoming RADIUS packet did not have correct "
1360 "Message-Authenticator - dropped\n");
1361 return RADIUS_RX_INVALID_AUTHENTICATOR;
1364 if (msg->hdr->code != RADIUS_CODE_ACCESS_ACCEPT &&
1365 msg->hdr->code != RADIUS_CODE_ACCESS_REJECT &&
1366 msg->hdr->code != RADIUS_CODE_ACCESS_CHALLENGE) {
1367 printf("Unknown RADIUS message code\n");
1368 return RADIUS_RX_UNKNOWN;
1371 sm->radius_identifier = -1;
1372 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
1373 "RADIUS packet matching with station " MACSTR "\n",
1374 MAC2STR(sta->addr));
1376 if (sm->last_recv_radius) {
1377 radius_msg_free(sm->last_recv_radius);
1378 free(sm->last_recv_radius);
1381 sm->last_recv_radius = msg;
1383 session_timeout_set =
1384 !radius_msg_get_attr_int32(msg, RADIUS_ATTR_SESSION_TIMEOUT,
1386 if (radius_msg_get_attr_int32(msg, RADIUS_ATTR_TERMINATION_ACTION,
1387 &termination_action))
1388 termination_action = RADIUS_TERMINATION_ACTION_DEFAULT;
1390 if (hapd->conf->radius->acct_interim_interval == 0 &&
1391 msg->hdr->code == RADIUS_CODE_ACCESS_ACCEPT &&
1392 radius_msg_get_attr_int32(msg, RADIUS_ATTR_ACCT_INTERIM_INTERVAL,
1393 &acct_interim_interval) == 0) {
1394 if (acct_interim_interval < 60) {
1395 hostapd_logger(hapd, sta->addr,
1396 HOSTAPD_MODULE_IEEE8021X,
1398 "ignored too small "
1399 "Acct-Interim-Interval %d",
1400 acct_interim_interval);
1402 sta->acct_interim_interval = acct_interim_interval;
1406 switch (msg->hdr->code) {
1407 case RADIUS_CODE_ACCESS_ACCEPT:
1408 if (sta->ssid->dynamic_vlan == DYNAMIC_VLAN_DISABLED)
1411 old_vlanid = sta->vlan_id;
1412 sta->vlan_id = radius_msg_get_vlanid(msg);
1414 if (sta->vlan_id > 0 &&
1415 hostapd_get_vlan_id_ifname(hapd->conf->vlan,
1417 hostapd_logger(hapd, sta->addr,
1418 HOSTAPD_MODULE_RADIUS,
1420 "VLAN ID %d", sta->vlan_id);
1421 } else if (sta->ssid->dynamic_vlan == DYNAMIC_VLAN_REQUIRED) {
1422 sta->eapol_sm->authFail = TRUE;
1423 hostapd_logger(hapd, sta->addr,
1424 HOSTAPD_MODULE_IEEE8021X,
1425 HOSTAPD_LEVEL_INFO, "authentication "
1426 "server did not include required VLAN "
1427 "ID in Access-Accept");
1431 ap_sta_bind_vlan(hapd, sta, old_vlanid);
1433 /* RFC 3580, Ch. 3.17 */
1434 if (session_timeout_set && termination_action ==
1435 RADIUS_TERMINATION_ACTION_RADIUS_REQUEST) {
1436 sm->reAuthPeriod = session_timeout;
1437 } else if (session_timeout_set)
1438 ap_sta_session_timeout(hapd, sta, session_timeout);
1440 sm->eapSuccess = TRUE;
1441 override_eapReq = 1;
1442 ieee802_1x_get_keys(hapd, sta, msg, req, shared_secret,
1444 ieee802_1x_store_radius_class(hapd, sta, msg);
1445 ieee802_1x_update_sta_identity(hapd, sta, msg);
1446 if (sm->keyAvailable &&
1447 wpa_auth_pmksa_add(sta->wpa_sm, sm->eapol_key_crypt,
1448 session_timeout_set ?
1449 (int) session_timeout : -1, sm) == 0) {
1450 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA,
1451 HOSTAPD_LEVEL_DEBUG,
1452 "Added PMKSA cache entry");
1455 case RADIUS_CODE_ACCESS_REJECT:
1457 override_eapReq = 1;
1459 case RADIUS_CODE_ACCESS_CHALLENGE:
1460 if (session_timeout_set) {
1461 /* RFC 2869, Ch. 2.3.2; RFC 3580, Ch. 3.17 */
1462 eap_timeout = session_timeout;
1465 hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
1466 HOSTAPD_LEVEL_DEBUG,
1467 "using EAP timeout of %d seconds%s",
1469 session_timeout_set ? " (from RADIUS)" : "");
1470 eloop_cancel_timeout(ieee802_1x_eap_timeout, sta, NULL);
1471 eloop_register_timeout(eap_timeout, 0, ieee802_1x_eap_timeout,
1473 sm->eapTimeout = FALSE;
1477 ieee802_1x_decapsulate_radius(hapd, sta);
1478 if (override_eapReq)
1483 return RADIUS_RX_QUEUED;
1487 /* Handler for EAPOL Backend Authentication state machine sendRespToServer.
1488 * Forward the EAP Response from Supplicant to Authentication Server. */
1489 void ieee802_1x_send_resp_to_server(struct hostapd_data *hapd,
1490 struct sta_info *sta)
1492 struct eapol_state_machine *sm = sta->eapol_sm;
1496 if (hapd->conf->eap_server) {
1497 eap_set_eapRespData(sm->eap, sm->last_eap_supp,
1498 sm->last_eap_supp_len);
1500 ieee802_1x_encapsulate_radius(hapd, sta, sm->last_eap_supp,
1501 sm->last_eap_supp_len);
1506 void ieee802_1x_abort_auth(struct hostapd_data *hapd, struct sta_info *sta)
1508 struct eapol_state_machine *sm = sta->eapol_sm;
1512 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1513 HOSTAPD_LEVEL_DEBUG, "aborting authentication");
1515 if (sm->last_recv_radius) {
1516 radius_msg_free(sm->last_recv_radius);
1517 free(sm->last_recv_radius);
1518 sm->last_recv_radius = NULL;
1520 free(sm->last_eap_supp);
1521 sm->last_eap_supp = NULL;
1522 sm->last_eap_supp_len = 0;
1523 free(sm->last_eap_radius);
1524 sm->last_eap_radius = NULL;
1525 sm->last_eap_radius_len = 0;
1529 #ifdef HOSTAPD_DUMP_STATE
1530 static void fprint_char(FILE *f, char c)
1532 if (c >= 32 && c < 127)
1533 fprintf(f, "%c", c);
1535 fprintf(f, "<%02x>", c);
1539 void ieee802_1x_dump_state(FILE *f, const char *prefix, struct sta_info *sta)
1541 struct eapol_state_machine *sm = sta->eapol_sm;
1545 fprintf(f, "%sIEEE 802.1X:\n", prefix);
1549 fprintf(f, "%sidentity=", prefix);
1550 for (i = 0; i < sm->identity_len; i++)
1551 fprint_char(f, sm->identity[i]);
1555 fprintf(f, "%slast EAP type: Authentication Server: %d (%s) "
1556 "Supplicant: %d (%s)\n", prefix,
1557 sm->eap_type_authsrv, eap_type_text(sm->eap_type_authsrv),
1558 sm->eap_type_supp, eap_type_text(sm->eap_type_supp));
1560 fprintf(f, "%scached_packets=%s%s%s\n", prefix,
1561 sm->last_recv_radius ? "[RX RADIUS]" : "",
1562 sm->last_eap_radius ? "[EAP RADIUS]" : "",
1563 sm->last_eap_supp ? "[EAP SUPPLICANT]" : "");
1565 eapol_sm_dump_state(f, prefix, sm);
1567 #endif /* HOSTAPD_DUMP_STATE */
1570 static int ieee802_1x_rekey_broadcast(struct hostapd_data *hapd)
1572 if (hapd->conf->default_wep_key_len < 1)
1575 free(hapd->default_wep_key);
1576 hapd->default_wep_key = malloc(hapd->conf->default_wep_key_len);
1577 if (hapd->default_wep_key == NULL ||
1578 hostapd_get_rand(hapd->default_wep_key,
1579 hapd->conf->default_wep_key_len)) {
1580 printf("Could not generate random WEP key.\n");
1581 free(hapd->default_wep_key);
1582 hapd->default_wep_key = NULL;
1586 wpa_hexdump_key(MSG_DEBUG, "IEEE 802.1X: New default WEP key",
1587 hapd->default_wep_key,
1588 hapd->conf->default_wep_key_len);
1594 static int ieee802_1x_sta_key_available(struct hostapd_data *hapd,
1595 struct sta_info *sta, void *ctx)
1597 if (sta->eapol_sm) {
1598 sta->eapol_sm->keyAvailable = TRUE;
1599 eapol_sm_step(sta->eapol_sm);
1605 static void ieee802_1x_rekey(void *eloop_ctx, void *timeout_ctx)
1607 struct hostapd_data *hapd = eloop_ctx;
1609 if (hapd->default_wep_key_idx >= 3)
1610 hapd->default_wep_key_idx =
1611 hapd->conf->individual_wep_key_len > 0 ? 1 : 0;
1613 hapd->default_wep_key_idx++;
1615 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "IEEE 802.1X: New default WEP "
1616 "key index %d\n", hapd->default_wep_key_idx);
1618 if (ieee802_1x_rekey_broadcast(hapd)) {
1619 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE8021X,
1620 HOSTAPD_LEVEL_WARNING, "failed to generate a "
1621 "new broadcast key");
1622 free(hapd->default_wep_key);
1623 hapd->default_wep_key = NULL;
1627 /* TODO: Could setup key for RX here, but change default TX keyid only
1628 * after new broadcast key has been sent to all stations. */
1629 if (hostapd_set_encryption(hapd->conf->iface, hapd, "WEP", NULL,
1630 hapd->default_wep_key_idx,
1631 hapd->default_wep_key,
1632 hapd->conf->default_wep_key_len, 1)) {
1633 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE8021X,
1634 HOSTAPD_LEVEL_WARNING, "failed to configure a "
1635 "new broadcast key");
1636 free(hapd->default_wep_key);
1637 hapd->default_wep_key = NULL;
1641 ap_for_each_sta(hapd, ieee802_1x_sta_key_available, NULL);
1643 if (hapd->conf->wep_rekeying_period > 0) {
1644 eloop_register_timeout(hapd->conf->wep_rekeying_period, 0,
1645 ieee802_1x_rekey, hapd, NULL);
1650 int ieee802_1x_init(struct hostapd_data *hapd)
1654 if ((hapd->conf->ieee802_1x || hapd->conf->wpa) &&
1655 hostapd_set_ieee8021x(hapd->conf->iface, hapd, 1))
1658 if (radius_client_register(hapd->radius, RADIUS_AUTH,
1659 ieee802_1x_receive_auth, hapd))
1662 if (hapd->conf->default_wep_key_len) {
1663 hostapd_set_privacy(hapd, 1);
1665 for (i = 0; i < 4; i++)
1666 hostapd_set_encryption(hapd->conf->iface, hapd,
1667 "none", NULL, i, NULL, 0, 0);
1669 ieee802_1x_rekey(hapd, NULL);
1671 if (hapd->default_wep_key == NULL)
1679 void ieee802_1x_deinit(struct hostapd_data *hapd)
1681 eloop_cancel_timeout(ieee802_1x_rekey, hapd, NULL);
1683 if (hapd->driver != NULL &&
1684 (hapd->conf->ieee802_1x || hapd->conf->wpa))
1685 hostapd_set_ieee8021x(hapd->conf->iface, hapd, 0);
1689 int ieee802_1x_reconfig(struct hostapd_data *hapd,
1690 struct hostapd_config *oldconf,
1691 struct hostapd_bss_config *oldbss)
1693 ieee802_1x_deinit(hapd);
1694 return ieee802_1x_init(hapd);
1698 static void ieee802_1x_new_auth_session(struct hostapd_data *hapd,
1699 struct sta_info *sta)
1701 struct eapol_state_machine *sm = sta->eapol_sm;
1705 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
1706 "IEEE 802.1X: station " MACSTR " - new auth session, "
1707 "clearing State\n", MAC2STR(sta->addr));
1709 if (sm->last_recv_radius) {
1710 radius_msg_free(sm->last_recv_radius);
1711 free(sm->last_recv_radius);
1712 sm->last_recv_radius = NULL;
1715 sm->eapSuccess = FALSE;
1716 sm->eapFail = FALSE;
1720 int ieee802_1x_tx_status(struct hostapd_data *hapd, struct sta_info *sta,
1721 u8 *buf, size_t len, int ack)
1723 struct ieee80211_hdr *hdr;
1724 struct ieee802_1x_hdr *xhdr;
1725 struct ieee802_1x_eapol_key *key;
1730 if (len < sizeof(*hdr) + sizeof(rfc1042_header) + 2 + sizeof(*xhdr))
1733 hdr = (struct ieee80211_hdr *) buf;
1734 pos = (u8 *) (hdr + 1);
1735 if (memcmp(pos, rfc1042_header, sizeof(rfc1042_header)) != 0)
1737 pos += sizeof(rfc1042_header);
1738 if (((pos[0] << 8) | pos[1]) != ETH_P_PAE)
1742 xhdr = (struct ieee802_1x_hdr *) pos;
1743 pos += sizeof(*xhdr);
1745 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "IEEE 802.1X: " MACSTR
1746 " TX status - version=%d type=%d length=%d - ack=%d\n",
1747 MAC2STR(sta->addr), xhdr->version, xhdr->type,
1748 ntohs(xhdr->length), ack);
1750 /* EAPOL EAP-Packet packets are eventually re-sent by either Supplicant
1751 * or Authenticator state machines, but EAPOL-Key packets are not
1752 * retransmitted in case of failure. Try to re-sent failed EAPOL-Key
1753 * packets couple of times because otherwise STA keys become
1754 * unsynchronized with AP. */
1755 if (xhdr->type == IEEE802_1X_TYPE_EAPOL_KEY && !ack &&
1756 pos + sizeof(*key) <= buf + len) {
1757 key = (struct ieee802_1x_eapol_key *) pos;
1758 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
1759 HOSTAPD_LEVEL_DEBUG, "did not Ack EAPOL-Key "
1760 "frame (%scast index=%d)",
1761 key->key_index & BIT(7) ? "uni" : "broad",
1762 key->key_index & ~BIT(7));
1763 /* TODO: re-send EAPOL-Key couple of times (with short delay
1764 * between them?). If all attempt fail, report error and
1765 * deauthenticate STA so that it will get new keys when
1766 * authenticating again (e.g., after returning in range).
1767 * Separate limit/transmit state needed both for unicast and
1768 * broadcast keys(?) */
1770 /* TODO: could move unicast key configuration from ieee802_1x_tx_key()
1771 * to here and change the key only if the EAPOL-Key packet was Acked.
1778 u8 * ieee802_1x_get_identity(struct eapol_state_machine *sm, size_t *len)
1780 if (sm == NULL || sm->identity == NULL)
1783 *len = sm->identity_len;
1784 return sm->identity;
1788 u8 * ieee802_1x_get_radius_class(struct eapol_state_machine *sm, size_t *len,
1791 if (sm == NULL || sm->radius_class.attr == NULL ||
1792 idx >= (int) sm->radius_class.count)
1795 *len = sm->radius_class.attr[idx].len;
1796 return sm->radius_class.attr[idx].data;
1800 u8 * ieee802_1x_get_key_crypt(struct eapol_state_machine *sm, size_t *len)
1805 *len = sm->eapol_key_crypt_len;
1806 return sm->eapol_key_crypt;
1810 void ieee802_1x_notify_port_enabled(struct eapol_state_machine *sm,
1815 sm->portEnabled = enabled ? TRUE : FALSE;
1820 void ieee802_1x_notify_port_valid(struct eapol_state_machine *sm,
1825 sm->portValid = valid ? TRUE : FALSE;
1830 void ieee802_1x_notify_pre_auth(struct eapol_state_machine *sm, int pre_auth)
1835 sm->flags |= EAPOL_SM_PREAUTH;
1837 sm->flags &= ~EAPOL_SM_PREAUTH;
1841 static const char * bool_txt(Boolean bool)
1843 return bool ? "TRUE" : "FALSE";
1847 int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
1854 int ieee802_1x_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta,
1855 char *buf, size_t buflen)
1858 struct eapol_state_machine *sm = sta->eapol_sm;
1863 ret = snprintf(buf + len, buflen - len,
1864 "dot1xPaePortNumber=%d\n"
1865 "dot1xPaePortProtocolVersion=%d\n"
1866 "dot1xPaePortCapabilities=1\n"
1867 "dot1xPaePortInitialize=%d\n"
1868 "dot1xPaePortReauthenticate=FALSE\n",
1872 if (ret < 0 || (size_t) ret >= buflen - len)
1876 /* dot1xAuthConfigTable */
1877 ret = snprintf(buf + len, buflen - len,
1878 "dot1xAuthPaeState=%d\n"
1879 "dot1xAuthBackendAuthState=%d\n"
1880 "dot1xAuthAdminControlledDirections=%d\n"
1881 "dot1xAuthOperControlledDirections=%d\n"
1882 "dot1xAuthAuthControlledPortStatus=%d\n"
1883 "dot1xAuthAuthControlledPortControl=%d\n"
1884 "dot1xAuthQuietPeriod=%u\n"
1885 "dot1xAuthServerTimeout=%u\n"
1886 "dot1xAuthReAuthPeriod=%u\n"
1887 "dot1xAuthReAuthEnabled=%s\n"
1888 "dot1xAuthKeyTxEnabled=%s\n",
1889 sm->auth_pae_state + 1,
1890 sm->be_auth_state + 1,
1891 sm->adminControlledDirections,
1892 sm->operControlledDirections,
1898 bool_txt(sm->reAuthEnabled),
1899 bool_txt(sm->keyTxEnabled));
1900 if (ret < 0 || (size_t) ret >= buflen - len)
1904 /* dot1xAuthStatsTable */
1905 ret = snprintf(buf + len, buflen - len,
1906 "dot1xAuthEapolFramesRx=%u\n"
1907 "dot1xAuthEapolFramesTx=%u\n"
1908 "dot1xAuthEapolStartFramesRx=%u\n"
1909 "dot1xAuthEapolLogoffFramesRx=%u\n"
1910 "dot1xAuthEapolRespIdFramesRx=%u\n"
1911 "dot1xAuthEapolRespFramesRx=%u\n"
1912 "dot1xAuthEapolReqIdFramesTx=%u\n"
1913 "dot1xAuthEapolReqFramesTx=%u\n"
1914 "dot1xAuthInvalidEapolFramesRx=%u\n"
1915 "dot1xAuthEapLengthErrorFramesRx=%u\n"
1916 "dot1xAuthLastEapolFrameVersion=%u\n"
1917 "dot1xAuthLastEapolFrameSource=" MACSTR "\n",
1918 sm->dot1xAuthEapolFramesRx,
1919 sm->dot1xAuthEapolFramesTx,
1920 sm->dot1xAuthEapolStartFramesRx,
1921 sm->dot1xAuthEapolLogoffFramesRx,
1922 sm->dot1xAuthEapolRespIdFramesRx,
1923 sm->dot1xAuthEapolRespFramesRx,
1924 sm->dot1xAuthEapolReqIdFramesTx,
1925 sm->dot1xAuthEapolReqFramesTx,
1926 sm->dot1xAuthInvalidEapolFramesRx,
1927 sm->dot1xAuthEapLengthErrorFramesRx,
1928 sm->dot1xAuthLastEapolFrameVersion,
1930 if (ret < 0 || (size_t) ret >= buflen - len)
1934 /* dot1xAuthDiagTable */
1935 ret = snprintf(buf + len, buflen - len,
1936 "dot1xAuthEntersConnecting=%u\n"
1937 "dot1xAuthEapLogoffsWhileConnecting=%u\n"
1938 "dot1xAuthEntersAuthenticating=%u\n"
1939 "dot1xAuthAuthSuccessesWhileAuthenticating=%u\n"
1940 "dot1xAuthAuthTimeoutsWhileAuthenticating=%u\n"
1941 "dot1xAuthAuthFailWhileAuthenticating=%u\n"
1942 "dot1xAuthAuthEapStartsWhileAuthenticating=%u\n"
1943 "dot1xAuthAuthEapLogoffWhileAuthenticating=%u\n"
1944 "dot1xAuthAuthReauthsWhileAuthenticated=%u\n"
1945 "dot1xAuthAuthEapStartsWhileAuthenticated=%u\n"
1946 "dot1xAuthAuthEapLogoffWhileAuthenticated=%u\n"
1947 "dot1xAuthBackendResponses=%u\n"
1948 "dot1xAuthBackendAccessChallenges=%u\n"
1949 "dot1xAuthBackendOtherRequestsToSupplicant=%u\n"
1950 "dot1xAuthBackendAuthSuccesses=%u\n"
1951 "dot1xAuthBackendAuthFails=%u\n",
1952 sm->authEntersConnecting,
1953 sm->authEapLogoffsWhileConnecting,
1954 sm->authEntersAuthenticating,
1955 sm->authAuthSuccessesWhileAuthenticating,
1956 sm->authAuthTimeoutsWhileAuthenticating,
1957 sm->authAuthFailWhileAuthenticating,
1958 sm->authAuthEapStartsWhileAuthenticating,
1959 sm->authAuthEapLogoffWhileAuthenticating,
1960 sm->authAuthReauthsWhileAuthenticated,
1961 sm->authAuthEapStartsWhileAuthenticated,
1962 sm->authAuthEapLogoffWhileAuthenticated,
1963 sm->backendResponses,
1964 sm->backendAccessChallenges,
1965 sm->backendOtherRequestsToSupplicant,
1966 sm->backendAuthSuccesses,
1967 sm->backendAuthFails);
1968 if (ret < 0 || (size_t) ret >= buflen - len)
1972 /* dot1xAuthSessionStatsTable */
1973 ret = snprintf(buf + len, buflen - len,
1974 /* TODO: dot1xAuthSessionOctetsRx */
1975 /* TODO: dot1xAuthSessionOctetsTx */
1976 /* TODO: dot1xAuthSessionFramesRx */
1977 /* TODO: dot1xAuthSessionFramesTx */
1978 "dot1xAuthSessionId=%08X-%08X\n"
1979 "dot1xAuthSessionAuthenticMethod=%d\n"
1980 "dot1xAuthSessionTime=%u\n"
1981 "dot1xAuthSessionTerminateCause=999\n"
1982 "dot1xAuthSessionUserName=%s\n",
1983 sta->acct_session_id_hi, sta->acct_session_id_lo,
1984 wpa_auth_sta_key_mgmt(sta->wpa_sm) ==
1985 WPA_KEY_MGMT_IEEE8021X ? 1 : 2,
1986 (unsigned int) (time(NULL) - sta->acct_session_start),
1988 if (ret < 0 || (size_t) ret >= buflen - len)
1996 void ieee802_1x_finished(struct hostapd_data *hapd, struct sta_info *sta,
2001 /* TODO: get PMKLifetime from WPA parameters */
2002 static const int dot11RSNAConfigPMKLifetime = 43200;
2004 key = ieee802_1x_get_key_crypt(sta->eapol_sm, &len);
2005 if (success && key &&
2006 wpa_auth_pmksa_add(sta->wpa_sm, key, dot11RSNAConfigPMKLifetime,
2007 sta->eapol_sm) == 0) {
2008 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_WPA,
2009 HOSTAPD_LEVEL_DEBUG,
2010 "Added PMKSA cache entry (IEEE 802.1X)");