2 * IEEE 802.1X-2010 KaY Interface
3 * Copyright (c) 2019, The Linux Foundation
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
9 #include "utils/includes.h"
11 #include "utils/common.h"
12 #include "pae/ieee802_1x_key.h"
13 #include "pae/ieee802_1x_kay.h"
16 #include "wpa_auth_kay.h"
17 #include "ieee802_1x.h"
20 #define DEFAULT_KEY_LEN 16
21 /* secure Connectivity Association Key Name (CKN) */
22 #define DEFAULT_CKN_LEN 16
25 static int hapd_macsec_init(void *priv, struct macsec_init_params *params)
27 struct hostapd_data *hapd = priv;
29 if (!hapd->driver->macsec_init)
31 return hapd->driver->macsec_init(hapd->drv_priv, params);
35 static int hapd_macsec_deinit(void *priv)
37 struct hostapd_data *hapd = priv;
39 if (!hapd->driver->macsec_deinit)
41 return hapd->driver->macsec_deinit(hapd->drv_priv);
45 static int hapd_macsec_get_capability(void *priv, enum macsec_cap *cap)
47 struct hostapd_data *hapd = priv;
49 if (!hapd->driver->macsec_get_capability)
51 return hapd->driver->macsec_get_capability(hapd->drv_priv, cap);
55 static int hapd_enable_protect_frames(void *priv, Boolean enabled)
57 struct hostapd_data *hapd = priv;
59 if (!hapd->driver->enable_protect_frames)
61 return hapd->driver->enable_protect_frames(hapd->drv_priv, enabled);
65 static int hapd_enable_encrypt(void *priv, Boolean enabled)
67 struct hostapd_data *hapd = priv;
69 if (!hapd->driver->enable_encrypt)
71 return hapd->driver->enable_encrypt(hapd->drv_priv, enabled);
75 static int hapd_set_replay_protect(void *priv, Boolean enabled, u32 window)
77 struct hostapd_data *hapd = priv;
79 if (!hapd->driver->set_replay_protect)
81 return hapd->driver->set_replay_protect(hapd->drv_priv, enabled,
86 static int hapd_set_current_cipher_suite(void *priv, u64 cs)
88 struct hostapd_data *hapd = priv;
90 if (!hapd->driver->set_current_cipher_suite)
92 return hapd->driver->set_current_cipher_suite(hapd->drv_priv, cs);
96 static int hapd_enable_controlled_port(void *priv, Boolean enabled)
98 struct hostapd_data *hapd = priv;
100 if (!hapd->driver->enable_controlled_port)
102 return hapd->driver->enable_controlled_port(hapd->drv_priv, enabled);
106 static int hapd_get_receive_lowest_pn(void *priv, struct receive_sa *sa)
108 struct hostapd_data *hapd = priv;
110 if (!hapd->driver->get_receive_lowest_pn)
112 return hapd->driver->get_receive_lowest_pn(hapd->drv_priv, sa);
116 static int hapd_get_transmit_next_pn(void *priv, struct transmit_sa *sa)
118 struct hostapd_data *hapd = priv;
120 if (!hapd->driver->get_transmit_next_pn)
122 return hapd->driver->get_transmit_next_pn(hapd->drv_priv, sa);
126 static int hapd_set_transmit_next_pn(void *priv, struct transmit_sa *sa)
128 struct hostapd_data *hapd = priv;
130 if (!hapd->driver->set_transmit_next_pn)
132 return hapd->driver->set_transmit_next_pn(hapd->drv_priv, sa);
136 static unsigned int conf_offset_val(enum confidentiality_offset co)
139 case CONFIDENTIALITY_OFFSET_30:
142 case CONFIDENTIALITY_OFFSET_50:
150 static int hapd_create_receive_sc(void *priv, struct receive_sc *sc,
151 enum validate_frames vf,
152 enum confidentiality_offset co)
154 struct hostapd_data *hapd = priv;
156 if (!hapd->driver->create_receive_sc)
158 return hapd->driver->create_receive_sc(hapd->drv_priv, sc,
159 conf_offset_val(co), vf);
163 static int hapd_delete_receive_sc(void *priv, struct receive_sc *sc)
165 struct hostapd_data *hapd = priv;
167 if (!hapd->driver->delete_receive_sc)
169 return hapd->driver->delete_receive_sc(hapd->drv_priv, sc);
173 static int hapd_create_receive_sa(void *priv, struct receive_sa *sa)
175 struct hostapd_data *hapd = priv;
177 if (!hapd->driver->create_receive_sa)
179 return hapd->driver->create_receive_sa(hapd->drv_priv, sa);
183 static int hapd_delete_receive_sa(void *priv, struct receive_sa *sa)
185 struct hostapd_data *hapd = priv;
187 if (!hapd->driver->delete_receive_sa)
189 return hapd->driver->delete_receive_sa(hapd->drv_priv, sa);
193 static int hapd_enable_receive_sa(void *priv, struct receive_sa *sa)
195 struct hostapd_data *hapd = priv;
197 if (!hapd->driver->enable_receive_sa)
199 return hapd->driver->enable_receive_sa(hapd->drv_priv, sa);
203 static int hapd_disable_receive_sa(void *priv, struct receive_sa *sa)
205 struct hostapd_data *hapd = priv;
207 if (!hapd->driver->disable_receive_sa)
209 return hapd->driver->disable_receive_sa(hapd->drv_priv, sa);
214 hapd_create_transmit_sc(void *priv, struct transmit_sc *sc,
215 enum confidentiality_offset co)
217 struct hostapd_data *hapd = priv;
219 if (!hapd->driver->create_transmit_sc)
221 return hapd->driver->create_transmit_sc(hapd->drv_priv, sc,
222 conf_offset_val(co));
226 static int hapd_delete_transmit_sc(void *priv, struct transmit_sc *sc)
228 struct hostapd_data *hapd = priv;
230 if (!hapd->driver->delete_transmit_sc)
232 return hapd->driver->delete_transmit_sc(hapd->drv_priv, sc);
236 static int hapd_create_transmit_sa(void *priv, struct transmit_sa *sa)
238 struct hostapd_data *hapd = priv;
240 if (!hapd->driver->create_transmit_sa)
242 return hapd->driver->create_transmit_sa(hapd->drv_priv, sa);
246 static int hapd_delete_transmit_sa(void *priv, struct transmit_sa *sa)
248 struct hostapd_data *hapd = priv;
250 if (!hapd->driver->delete_transmit_sa)
252 return hapd->driver->delete_transmit_sa(hapd->drv_priv, sa);
256 static int hapd_enable_transmit_sa(void *priv, struct transmit_sa *sa)
258 struct hostapd_data *hapd = priv;
260 if (!hapd->driver->enable_transmit_sa)
262 return hapd->driver->enable_transmit_sa(hapd->drv_priv, sa);
266 static int hapd_disable_transmit_sa(void *priv, struct transmit_sa *sa)
268 struct hostapd_data *hapd = priv;
270 if (!hapd->driver->disable_transmit_sa)
272 return hapd->driver->disable_transmit_sa(hapd->drv_priv, sa);
276 int ieee802_1x_alloc_kay_sm_hapd(struct hostapd_data *hapd,
277 struct sta_info *sta)
279 struct ieee802_1x_kay_ctx *kay_ctx;
280 struct ieee802_1x_kay *res = NULL;
281 enum macsec_policy policy;
283 ieee802_1x_dealloc_kay_sm_hapd(hapd);
285 if (!hapd->conf || hapd->conf->macsec_policy == 0)
288 if (hapd->conf->macsec_policy == 1) {
289 if (hapd->conf->macsec_integ_only == 1)
290 policy = SHOULD_SECURE;
292 policy = SHOULD_ENCRYPT;
294 policy = DO_NOT_SECURE;
297 wpa_printf(MSG_DEBUG, "%s: if_name=%s", __func__, hapd->conf->iface);
298 kay_ctx = os_zalloc(sizeof(*kay_ctx));
304 kay_ctx->macsec_init = hapd_macsec_init;
305 kay_ctx->macsec_deinit = hapd_macsec_deinit;
306 kay_ctx->macsec_get_capability = hapd_macsec_get_capability;
307 kay_ctx->enable_protect_frames = hapd_enable_protect_frames;
308 kay_ctx->enable_encrypt = hapd_enable_encrypt;
309 kay_ctx->set_replay_protect = hapd_set_replay_protect;
310 kay_ctx->set_current_cipher_suite = hapd_set_current_cipher_suite;
311 kay_ctx->enable_controlled_port = hapd_enable_controlled_port;
312 kay_ctx->get_receive_lowest_pn = hapd_get_receive_lowest_pn;
313 kay_ctx->get_transmit_next_pn = hapd_get_transmit_next_pn;
314 kay_ctx->set_transmit_next_pn = hapd_set_transmit_next_pn;
315 kay_ctx->create_receive_sc = hapd_create_receive_sc;
316 kay_ctx->delete_receive_sc = hapd_delete_receive_sc;
317 kay_ctx->create_receive_sa = hapd_create_receive_sa;
318 kay_ctx->delete_receive_sa = hapd_delete_receive_sa;
319 kay_ctx->enable_receive_sa = hapd_enable_receive_sa;
320 kay_ctx->disable_receive_sa = hapd_disable_receive_sa;
321 kay_ctx->create_transmit_sc = hapd_create_transmit_sc;
322 kay_ctx->delete_transmit_sc = hapd_delete_transmit_sc;
323 kay_ctx->create_transmit_sa = hapd_create_transmit_sa;
324 kay_ctx->delete_transmit_sa = hapd_delete_transmit_sa;
325 kay_ctx->enable_transmit_sa = hapd_enable_transmit_sa;
326 kay_ctx->disable_transmit_sa = hapd_disable_transmit_sa;
328 res = ieee802_1x_kay_init(kay_ctx, policy,
329 hapd->conf->macsec_replay_protect,
330 hapd->conf->macsec_replay_window,
331 hapd->conf->macsec_port,
332 hapd->conf->mka_priority, hapd->conf->iface,
334 /* ieee802_1x_kay_init() frees kay_ctx on failure */
344 void ieee802_1x_dealloc_kay_sm_hapd(struct hostapd_data *hapd)
349 ieee802_1x_kay_deinit(hapd->kay);
354 static int ieee802_1x_auth_get_session_id(struct hostapd_data *hapd,
355 struct sta_info *sta, u8 *sid,
358 const u8 *session_id;
359 size_t id_len, need_len;
361 session_id = ieee802_1x_get_session_id(sta->eapol_sm, &id_len);
363 wpa_printf(MSG_DEBUG,
364 "MACsec: Failed to get SessionID from EAPOL state machines");
368 need_len = 1 + 2 * 32 /* random size */;
369 if (need_len > id_len) {
370 wpa_printf(MSG_DEBUG, "EAP Session-Id not long enough");
374 os_memcpy(sid, session_id, need_len);
381 static int ieee802_1x_auth_get_msk(struct hostapd_data *hapd,
382 struct sta_info *sta, u8 *msk, size_t *len)
390 key = ieee802_1x_get_key(sta->eapol_sm, &keylen);
392 wpa_printf(MSG_DEBUG,
393 "MACsec: Failed to get MSK from EAPOL state machines");
396 wpa_printf(MSG_DEBUG, "MACsec: Successfully fetched key (len=%lu)",
397 (unsigned long) keylen);
398 wpa_hexdump_key(MSG_DEBUG, "MSK: ", key, keylen);
402 os_memcpy(msk, key, keylen);
409 void * ieee802_1x_notify_create_actor_hapd(struct hostapd_data *hapd,
410 struct sta_info *sta)
413 size_t sid_len = 128;
414 struct mka_key_name *ckn;
419 if (!hapd->kay || hapd->kay->policy == DO_NOT_SECURE)
422 wpa_printf(MSG_DEBUG,
423 "IEEE 802.1X: External notification - Create MKA for "
424 MACSTR, MAC2STR(sta->addr));
426 msk = os_zalloc(sizeof(*msk));
427 sid = os_zalloc(sid_len);
428 ckn = os_zalloc(sizeof(*ckn));
429 cak = os_zalloc(sizeof(*cak));
430 if (!msk || !sid || !ckn || !cak)
433 msk->len = DEFAULT_KEY_LEN;
434 if (ieee802_1x_auth_get_msk(hapd, sta, msk->key, &msk->len)) {
435 wpa_printf(MSG_ERROR, "IEEE 802.1X: Could not get MSK");
439 if (ieee802_1x_auth_get_session_id(hapd, sta, sid, &sid_len))
441 wpa_printf(MSG_ERROR,
442 "IEEE 802.1X: Could not get EAP Session Id");
446 wpa_hexdump(MSG_DEBUG, "own_addr", hapd->own_addr, ETH_ALEN);
447 wpa_hexdump(MSG_DEBUG, "sta_addr", sta->addr, ETH_ALEN);
449 /* Derive CAK from MSK */
450 cak->len = DEFAULT_KEY_LEN;
451 if (ieee802_1x_cak_aes_cmac(msk->key, msk->len, hapd->own_addr,
452 sta->addr, cak->key, cak->len)) {
453 wpa_printf(MSG_ERROR, "IEEE 802.1X: Deriving CAK failed");
456 wpa_hexdump_key(MSG_DEBUG, "Derived CAK", cak->key, cak->len);
458 /* Derive CKN from MSK */
459 ckn->len = DEFAULT_CKN_LEN;
460 if (ieee802_1x_ckn_aes_cmac(msk->key, msk->len, hapd->own_addr,
461 sta->addr, sid, sid_len, ckn->name)) {
462 wpa_printf(MSG_ERROR, "IEEE 802.1X: Deriving CKN failed");
465 wpa_hexdump(MSG_DEBUG, "Derived CKN", ckn->name, ckn->len);
467 res = ieee802_1x_kay_create_mka(hapd->kay, ckn, cak, 0, EAP_EXCHANGE,
471 bin_clear_free(msk, sizeof(*msk));
474 bin_clear_free(cak, sizeof(*cak));
480 void * ieee802_1x_create_preshared_mka_hapd(struct hostapd_data *hapd,
481 struct sta_info *sta)
484 struct mka_key_name *ckn;
487 if ((hapd->conf->mka_psk_set & MKA_PSK_SET) != MKA_PSK_SET)
490 ckn = os_zalloc(sizeof(*ckn));
494 cak = os_zalloc(sizeof(*cak));
498 if (ieee802_1x_alloc_kay_sm_hapd(hapd, sta) < 0 || !hapd->kay)
501 if (hapd->kay->policy == DO_NOT_SECURE)
504 cak->len = hapd->conf->mka_cak_len;
505 os_memcpy(cak->key, hapd->conf->mka_cak, cak->len);
507 ckn->len = hapd->conf->mka_ckn_len;;
508 os_memcpy(ckn->name, hapd->conf->mka_ckn, ckn->len);
510 res = ieee802_1x_kay_create_mka(hapd->kay, ckn, cak, 0, PSK, TRUE);
515 /* Failed to create MKA */
516 ieee802_1x_dealloc_kay_sm_hapd(hapd);