123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943 |
- The WPA2 four-way handshake protocol is vulnerable to replay attacks which can
- result in unauthenticated clients gaining access to the network.
- Backport a number of patches from upstream to fix this.
- CVE: CVE-2017-13077
- CVE: CVE-2017-13078
- CVE: CVE-2017-13079
- CVE: CVE-2017-13080
- CVE: CVE-2017-13081
- CVE: CVE-2017-13082
- CVE: CVE-2017-13086
- CVE: CVE-2017-13087
- CVE: CVE-2017-13088
- Upstream-Status: Backport
- Signed-off-by: Ross Burton <ross.burton@intel.com>
- From 859e243137203d2389e20103a9947cf76082022e Mon Sep 17 00:00:00 2001
- From: Haiqing Bai <Haiqing.Bai@windriver.com>
- Date: Fri, 13 Oct 2017 09:37:06 +0800
- Subject: [PATCH 1/7] hostapd: Avoid key reinstallation in FT handshake
- Do not reinstall TK to the driver during Reassociation Response frame
- processing if the first attempt of setting the TK succeeded. This avoids
- issues related to clearing the TX/RX PN that could result in reusing
- same PN values for transmitted frames (e.g., due to CCM nonce reuse and
- also hitting replay protection on the receiver) and accepting replayed
- frames on RX side.
- This issue was introduced by the commit
- 0e84c25434e6a1f283c7b4e62e483729085b78d2 ('FT: Fix PTK configuration in
- authenticator') which allowed wpa_ft_install_ptk() to be called multiple
- times with the same PTK. While the second configuration attempt is
- needed with some drivers, it must be done only if the first attempt
- failed.
- Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
- Upstream-Status: Backport
- Signed-off-by: Haiqing Bai <Haiqing.Bai@windriver.com>
- ---
- src/ap/wpa_auth.c | 11 ++++++++++-
- src/ap/wpa_auth.h | 3 ++-
- src/ap/wpa_auth_ft.c | 10 ++++++++++
- src/ap/wpa_auth_i.h | 1 +
- 4 files changed, 23 insertions(+), 2 deletions(-)
- diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c
- index 9c5f609..0ebbdb5 100644
- --- a/src/ap/wpa_auth.c
- +++ b/src/ap/wpa_auth.c
- @@ -1715,6 +1715,9 @@ int wpa_auth_sm_event(struct wpa_state_machine *sm, wpa_event event)
- #else /* CONFIG_IEEE80211R */
- break;
- #endif /* CONFIG_IEEE80211R */
- + case WPA_DRV_STA_REMOVED:
- + sm->tk_already_set = FALSE;
- + return 0;
- }
-
- #ifdef CONFIG_IEEE80211R
- @@ -3168,7 +3171,13 @@ int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm)
- return sm->wpa;
- }
-
- -
- +int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm)
- +{
- + if (!sm || !wpa_key_mgmt_ft(sm->wpa_key_mgmt))
- + return 0;
- + return sm->tk_already_set;
- +}
- +
- int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm,
- struct rsn_pmksa_cache_entry *entry)
- {
- diff --git a/src/ap/wpa_auth.h b/src/ap/wpa_auth.h
- index 2788e65..8dee180 100644
- --- a/src/ap/wpa_auth.h
- +++ b/src/ap/wpa_auth.h
- @@ -253,7 +253,7 @@ void wpa_receive(struct wpa_authenticator *wpa_auth,
- u8 *data, size_t data_len);
- typedef enum {
- WPA_AUTH, WPA_ASSOC, WPA_DISASSOC, WPA_DEAUTH, WPA_REAUTH,
- - WPA_REAUTH_EAPOL, WPA_ASSOC_FT
- + WPA_REAUTH_EAPOL, WPA_ASSOC_FT, WPA_DRV_STA_REMOVED
- } wpa_event;
- void wpa_remove_ptk(struct wpa_state_machine *sm);
- int wpa_auth_sm_event(struct wpa_state_machine *sm, wpa_event event);
- @@ -266,6 +266,7 @@ int wpa_auth_pairwise_set(struct wpa_state_machine *sm);
- int wpa_auth_get_pairwise(struct wpa_state_machine *sm);
- int wpa_auth_sta_key_mgmt(struct wpa_state_machine *sm);
- int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm);
- +int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm);
- int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm,
- struct rsn_pmksa_cache_entry *entry);
- struct rsn_pmksa_cache_entry *
- diff --git a/src/ap/wpa_auth_ft.c b/src/ap/wpa_auth_ft.c
- index ef3249a..17e6039 100644
- --- a/src/ap/wpa_auth_ft.c
- +++ b/src/ap/wpa_auth_ft.c
- @@ -779,6 +779,14 @@ void wpa_ft_install_ptk(struct wpa_state_machine *sm)
- return;
- }
-
- + if (sm->tk_already_set) {
- + /* Must avoid TK reconfiguration to prevent clearing of TX/RX
- + * PN in the driver */
- + wpa_printf(MSG_DEBUG,
- + "FT: Do not re-install same PTK to the driver");
- + return;
- + }
- +
- /* FIX: add STA entry to kernel/driver here? The set_key will fail
- * most likely without this.. At the moment, STA entry is added only
- * after association has been completed. This function will be called
- @@ -791,6 +799,7 @@ void wpa_ft_install_ptk(struct wpa_state_machine *sm)
-
- /* FIX: MLME-SetProtection.Request(TA, Tx_Rx) */
- sm->pairwise_set = TRUE;
- + sm->tk_already_set = TRUE;
- }
-
-
- @@ -897,6 +906,7 @@ static int wpa_ft_process_auth_req(struct wpa_state_machine *sm,
-
- sm->pairwise = pairwise;
- sm->PTK_valid = TRUE;
- + sm->tk_already_set = FALSE;
- wpa_ft_install_ptk(sm);
-
- buflen = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) +
- diff --git a/src/ap/wpa_auth_i.h b/src/ap/wpa_auth_i.h
- index 7b2cd3e..0f3d504 100644
- --- a/src/ap/wpa_auth_i.h
- +++ b/src/ap/wpa_auth_i.h
- @@ -64,6 +64,7 @@ struct wpa_state_machine {
- struct wpa_ptk PTK;
- Boolean PTK_valid;
- Boolean pairwise_set;
- + Boolean tk_already_set;
- int keycount;
- Boolean Pair;
- struct wpa_key_replay_counter {
- --
- 1.9.1
- From 0779537c11d18045d0f09ce3dd7f535bdb245de3 Mon Sep 17 00:00:00 2001
- From: Haiqing Bai <Haiqing.Bai@windriver.com>
- Date: Fri, 13 Oct 2017 10:00:48 +0800
- Subject: [PATCH 2/7] Prevent reinstallation of an already in-use group key
- Track the current GTK and IGTK that is in use and when receiving a
- (possibly retransmitted) Group Message 1 or WNM-Sleep Mode Response, do
- not install the given key if it is already in use. This prevents an
- attacker from trying to trick the client into resetting or lowering the
- sequence counter associated to the group key.
- Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
- Upstream-Status: Backport
- Signed-off-by: Haiqing Bai <Haiqing.Bai@windriver.com>
- ---
- src/common/wpa_common.h | 11 +++++
- src/rsn_supp/wpa.c | 118 +++++++++++++++++++++++++++++-------------------
- src/rsn_supp/wpa_i.h | 4 ++
- 3 files changed, 87 insertions(+), 46 deletions(-)
- diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h
- index 091e317..66f9977 100644
- --- a/src/common/wpa_common.h
- +++ b/src/common/wpa_common.h
- @@ -224,6 +224,17 @@ struct wpa_ptk {
- size_t tk_len;
- };
-
- +struct wpa_gtk {
- + u8 gtk[WPA_GTK_MAX_LEN];
- + size_t gtk_len;
- +};
- +
- +#ifdef CONFIG_IEEE80211W
- +struct wpa_igtk {
- + u8 igtk[WPA_IGTK_MAX_LEN];
- + size_t igtk_len;
- +};
- +#endif /* CONFIG_IEEE80211W */
-
- /* WPA IE version 1
- * 00-50-f2:1 (OUI:OUI type)
- diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
- index 8adeef4..2c4d9a4 100644
- --- a/src/rsn_supp/wpa.c
- +++ b/src/rsn_supp/wpa.c
- @@ -686,6 +686,15 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
- const u8 *_gtk = gd->gtk;
- u8 gtk_buf[32];
-
- + /* Detect possible key reinstallation */
- + if (sm->gtk.gtk_len == (size_t) gd->gtk_len &&
- + os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) {
- + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
- + "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)",
- + gd->keyidx, gd->tx, gd->gtk_len);
- + return 0;
- + }
- +
- wpa_hexdump_key(MSG_DEBUG, "WPA: Group Key", gd->gtk, gd->gtk_len);
- wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
- "WPA: Installing GTK to the driver (keyidx=%d tx=%d len=%d)",
- @@ -720,6 +729,9 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
- }
- os_memset(gtk_buf, 0, sizeof(gtk_buf));
-
- + sm->gtk.gtk_len = gd->gtk_len;
- + os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
- +
- return 0;
- }
-
- @@ -790,6 +802,46 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm,
- return 0;
- }
-
- +#ifdef CONFIG_IEEE80211W
- +static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
- + const struct wpa_igtk_kde *igtk)
- +{
- + size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
- + u16 keyidx = WPA_GET_LE16(igtk->keyid);
- +
- + /* Detect possible key reinstallation */
- + if (sm->igtk.igtk_len == len &&
- + os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) {
- + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
- + "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)",
- + keyidx);
- + return 0;
- + }
- +
- + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
- + "WPA: IGTK keyid %d pn %02x%02x%02x%02x%02x%02x",
- + keyidx, MAC2STR(igtk->pn));
- + wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", igtk->igtk, len);
- + if (keyidx > 4095) {
- + wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
- + "WPA: Invalid IGTK KeyID %d", keyidx);
- + return -1;
- + }
- + if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
- + broadcast_ether_addr,
- + keyidx, 0, igtk->pn, sizeof(igtk->pn),
- + igtk->igtk, len) < 0) {
- + wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
- + "WPA: Failed to configure IGTK to the driver");
- + return -1;
- + }
- +
- + sm->igtk.igtk_len = len;
- + os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
- +
- + return 0;
- +}
- +#endif /* CONFIG_IEEE80211W */
-
- static int ieee80211w_set_keys(struct wpa_sm *sm,
- struct wpa_eapol_ie_parse *ie)
- @@ -801,30 +853,14 @@ static int ieee80211w_set_keys(struct wpa_sm *sm,
- if (ie->igtk) {
- size_t len;
- const struct wpa_igtk_kde *igtk;
- - u16 keyidx;
- +
- len = wpa_cipher_key_len(sm->mgmt_group_cipher);
- if (ie->igtk_len != WPA_IGTK_KDE_PREFIX_LEN + len)
- return -1;
- +
- igtk = (const struct wpa_igtk_kde *) ie->igtk;
- - keyidx = WPA_GET_LE16(igtk->keyid);
- - wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: IGTK keyid %d "
- - "pn %02x%02x%02x%02x%02x%02x",
- - keyidx, MAC2STR(igtk->pn));
- - wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK",
- - igtk->igtk, len);
- - if (keyidx > 4095) {
- - wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
- - "WPA: Invalid IGTK KeyID %d", keyidx);
- - return -1;
- - }
- - if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
- - broadcast_ether_addr,
- - keyidx, 0, igtk->pn, sizeof(igtk->pn),
- - igtk->igtk, len) < 0) {
- - wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
- - "WPA: Failed to configure IGTK to the driver");
- - return -1;
- - }
- + if (wpa_supplicant_install_igtk(sm, igtk) < 0)
- + return -1;
- }
-
- return 0;
- @@ -2228,7 +2264,7 @@ void wpa_sm_deinit(struct wpa_sm *sm)
- */
- void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
- {
- - int clear_ptk = 1;
- + int clear_keys = 1;
-
- if (sm == NULL)
- return;
- @@ -2254,11 +2290,11 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
- /* Prepare for the next transition */
- wpa_ft_prepare_auth_request(sm, NULL);
-
- - clear_ptk = 0;
- + clear_keys = 0;
- }
- #endif /* CONFIG_IEEE80211R */
-
- - if (clear_ptk) {
- + if (clear_keys) {
- /*
- * IEEE 802.11, 8.4.10: Delete PTK SA on (re)association if
- * this is not part of a Fast BSS Transition.
- @@ -2268,6 +2304,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
- os_memset(&sm->ptk, 0, sizeof(sm->ptk));
- sm->tptk_set = 0;
- os_memset(&sm->tptk, 0, sizeof(sm->tptk));
- + os_memset(&sm->gtk, 0, sizeof(sm->gtk));
- +#ifdef CONFIG_IEEE80211W
- + os_memset(&sm->igtk, 0, sizeof(sm->igtk));
- +#endif /* CONFIG_IEEE80211W */
- }
-
- #ifdef CONFIG_TDLS
- @@ -2784,6 +2824,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm)
- os_memset(sm->pmk, 0, sizeof(sm->pmk));
- os_memset(&sm->ptk, 0, sizeof(sm->ptk));
- os_memset(&sm->tptk, 0, sizeof(sm->tptk));
- + os_memset(&sm->gtk, 0, sizeof(sm->gtk));
- +#ifdef CONFIG_IEEE80211W
- + os_memset(&sm->igtk, 0, sizeof(sm->igtk));
- +#endif /* CONFIG_IEEE80211W */
- #ifdef CONFIG_IEEE80211R
- os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
- os_memset(sm->pmk_r0, 0, sizeof(sm->pmk_r0));
- @@ -2856,29 +2900,11 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf)
- os_memset(&gd, 0, sizeof(gd));
- #ifdef CONFIG_IEEE80211W
- } else if (subelem_id == WNM_SLEEP_SUBELEM_IGTK) {
- - struct wpa_igtk_kde igd;
- - u16 keyidx;
- -
- - os_memset(&igd, 0, sizeof(igd));
- - keylen = wpa_cipher_key_len(sm->mgmt_group_cipher);
- - os_memcpy(igd.keyid, buf + 2, 2);
- - os_memcpy(igd.pn, buf + 4, 6);
- -
- - keyidx = WPA_GET_LE16(igd.keyid);
- - os_memcpy(igd.igtk, buf + 10, keylen);
- -
- - wpa_hexdump_key(MSG_DEBUG, "Install IGTK (WNM SLEEP)",
- - igd.igtk, keylen);
- - if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
- - broadcast_ether_addr,
- - keyidx, 0, igd.pn, sizeof(igd.pn),
- - igd.igtk, keylen) < 0) {
- - wpa_printf(MSG_DEBUG, "Failed to install the IGTK in "
- - "WNM mode");
- - os_memset(&igd, 0, sizeof(igd));
- - return -1;
- - }
- - os_memset(&igd, 0, sizeof(igd));
- + const struct wpa_igtk_kde *igtk;
- +
- + igtk = (const struct wpa_igtk_kde *) (buf + 2);
- + if (wpa_supplicant_install_igtk(sm, igtk) < 0)
- + return -1;
- #endif /* CONFIG_IEEE80211W */
- } else {
- wpa_printf(MSG_DEBUG, "Unknown element id");
- diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h
- index 965a9c1..27b6123 100644
- --- a/src/rsn_supp/wpa_i.h
- +++ b/src/rsn_supp/wpa_i.h
- @@ -30,6 +30,10 @@ struct wpa_sm {
- u8 rx_replay_counter[WPA_REPLAY_COUNTER_LEN];
- int rx_replay_counter_set;
- u8 request_counter[WPA_REPLAY_COUNTER_LEN];
- + struct wpa_gtk gtk;
- +#ifdef CONFIG_IEEE80211W
- + struct wpa_igtk igtk;
- +#endif /* CONFIG_IEEE80211W */
-
- struct eapol_sm *eapol; /* EAPOL state machine from upper level code */
-
- --
- 1.9.1
- From 6e891ae64e9ec9edb17be8ca26dcf109e3250541 Mon Sep 17 00:00:00 2001
- From: Haiqing Bai <Haiqing.Bai@windriver.com>
- Date: Fri, 13 Oct 2017 10:24:29 +0800
- Subject: [PATCH 3/7] Extend protection of GTK/IGTK reinstallation of WNM-Sleep
- Mode cases
- This extends the protection to track last configured GTK/IGTK value
- separately from EAPOL-Key frames and WNM-Sleep Mode frames to cover a
- corner case where these two different mechanisms may get used when the
- GTK/IGTK has changed and tracking a single value is not sufficient to
- detect a possible key reconfiguration.
- Signed-off-by: Jouni Malinen <j@w1.fi>
- Upstream-Status: Backport
- Signed-off-by: Haiqing Bai <Haiqing.Bai@windriver.com>
- ---
- src/rsn_supp/wpa.c | 56 ++++++++++++++++++++++++++++++++++++----------------
- src/rsn_supp/wpa_i.h | 2 ++
- 2 files changed, 41 insertions(+), 17 deletions(-)
- diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
- index 2c4d9a4..19cc78b 100644
- --- a/src/rsn_supp/wpa.c
- +++ b/src/rsn_supp/wpa.c
- @@ -681,14 +681,17 @@ struct wpa_gtk_data {
-
- static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
- const struct wpa_gtk_data *gd,
- - const u8 *key_rsc)
- + const u8 *key_rsc, int wnm_sleep)
- {
- const u8 *_gtk = gd->gtk;
- u8 gtk_buf[32];
-
- /* Detect possible key reinstallation */
- - if (sm->gtk.gtk_len == (size_t) gd->gtk_len &&
- - os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) {
- + if ((sm->gtk.gtk_len == (size_t) gd->gtk_len &&
- + os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) ||
- + (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len &&
- + os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk,
- + sm->gtk_wnm_sleep.gtk_len) == 0)) {
- wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
- "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)",
- gd->keyidx, gd->tx, gd->gtk_len);
- @@ -729,13 +732,18 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
- }
- os_memset(gtk_buf, 0, sizeof(gtk_buf));
-
- - sm->gtk.gtk_len = gd->gtk_len;
- - os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
- + if (wnm_sleep) {
- + sm->gtk_wnm_sleep.gtk_len = gd->gtk_len;
- + os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk,
- + sm->gtk_wnm_sleep.gtk_len);
- + } else {
- + sm->gtk.gtk_len = gd->gtk_len;
- + os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
- + }
-
- return 0;
- }
-
- -
- static int wpa_supplicant_gtk_tx_bit_workaround(const struct wpa_sm *sm,
- int tx)
- {
- @@ -789,7 +797,7 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm,
- (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
- gtk_len, gtk_len,
- &gd.key_rsc_len, &gd.alg) ||
- - wpa_supplicant_install_gtk(sm, &gd, key->key_rsc))) {
- + wpa_supplicant_install_gtk(sm, &gd, key->key_rsc, 0))) {
- wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
- "RSN: Failed to install GTK");
- os_memset(&gd, 0, sizeof(gd));
- @@ -804,14 +812,18 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm,
-
- #ifdef CONFIG_IEEE80211W
- static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
- - const struct wpa_igtk_kde *igtk)
- + const struct wpa_igtk_kde *igtk,
- + int wnm_sleep)
- {
- size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
- u16 keyidx = WPA_GET_LE16(igtk->keyid);
-
- /* Detect possible key reinstallation */
- - if (sm->igtk.igtk_len == len &&
- - os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) {
- + if ((sm->igtk.igtk_len == len &&
- + os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) ||
- + (sm->igtk_wnm_sleep.igtk_len == len &&
- + os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk,
- + sm->igtk_wnm_sleep.igtk_len) == 0)) {
- wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
- "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)",
- keyidx);
- @@ -836,9 +848,15 @@ static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
- return -1;
- }
-
- - sm->igtk.igtk_len = len;
- - os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
- -
- + if (wnm_sleep) {
- + sm->igtk_wnm_sleep.igtk_len = len;
- + os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk,
- + sm->igtk_wnm_sleep.igtk_len);
- + } else {
- + sm->igtk.igtk_len = len;
- + os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
- + }
- +
- return 0;
- }
- #endif /* CONFIG_IEEE80211W */
- @@ -859,7 +877,7 @@ static int ieee80211w_set_keys(struct wpa_sm *sm,
- return -1;
-
- igtk = (const struct wpa_igtk_kde *) ie->igtk;
- - if (wpa_supplicant_install_igtk(sm, igtk) < 0)
- + if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0)
- return -1;
- }
-
- @@ -1502,7 +1520,7 @@ static void wpa_supplicant_process_1_of_2(struct wpa_sm *sm,
- if (ret)
- goto failed;
-
- - if (wpa_supplicant_install_gtk(sm, &gd, key->key_rsc) ||
- + if (wpa_supplicant_install_gtk(sm, &gd, key->key_rsc, 0) ||
- wpa_supplicant_send_2_of_2(sm, key, ver, key_info))
- goto failed;
- os_memset(&gd, 0, sizeof(gd));
- @@ -2305,8 +2323,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
- sm->tptk_set = 0;
- os_memset(&sm->tptk, 0, sizeof(sm->tptk));
- os_memset(&sm->gtk, 0, sizeof(sm->gtk));
- + os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
- #ifdef CONFIG_IEEE80211W
- os_memset(&sm->igtk, 0, sizeof(sm->igtk));
- + os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
- #endif /* CONFIG_IEEE80211W */
- }
-
- @@ -2825,8 +2845,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm)
- os_memset(&sm->ptk, 0, sizeof(sm->ptk));
- os_memset(&sm->tptk, 0, sizeof(sm->tptk));
- os_memset(&sm->gtk, 0, sizeof(sm->gtk));
- + os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
- #ifdef CONFIG_IEEE80211W
- os_memset(&sm->igtk, 0, sizeof(sm->igtk));
- + os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
- #endif /* CONFIG_IEEE80211W */
- #ifdef CONFIG_IEEE80211R
- os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
- @@ -2891,7 +2913,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf)
-
- wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)",
- gd.gtk, gd.gtk_len);
- - if (wpa_supplicant_install_gtk(sm, &gd, key_rsc)) {
- + if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) {
- os_memset(&gd, 0, sizeof(gd));
- wpa_printf(MSG_DEBUG, "Failed to install the GTK in "
- "WNM mode");
- @@ -2903,7 +2925,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf)
- const struct wpa_igtk_kde *igtk;
-
- igtk = (const struct wpa_igtk_kde *) (buf + 2);
- - if (wpa_supplicant_install_igtk(sm, igtk) < 0)
- + if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0)
- return -1;
- #endif /* CONFIG_IEEE80211W */
- } else {
- diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h
- index 27b6123..51753ee 100644
- --- a/src/rsn_supp/wpa_i.h
- +++ b/src/rsn_supp/wpa_i.h
- @@ -31,8 +31,10 @@ struct wpa_sm {
- int rx_replay_counter_set;
- u8 request_counter[WPA_REPLAY_COUNTER_LEN];
- struct wpa_gtk gtk;
- + struct wpa_gtk gtk_wnm_sleep;
- #ifdef CONFIG_IEEE80211W
- struct wpa_igtk igtk;
- + struct wpa_igtk igtk_wnm_sleep;
- #endif /* CONFIG_IEEE80211W */
-
- struct eapol_sm *eapol; /* EAPOL state machine from upper level code */
- --
- 1.9.1
- From 20280c8155506da6f1fc46f4fb345bc1ddaf1684 Mon Sep 17 00:00:00 2001
- From: Haiqing Bai <Haiqing.Bai@windriver.com>
- Date: Fri, 13 Oct 2017 10:32:52 +0800
- Subject: [PATCH 4/7] Prevent installation of an all-zero TK
- Properly track whether a PTK has already been installed to the driver
- and the TK part cleared from memory. This prevents an attacker from
- trying to trick the client into installing an all-zero TK.
- Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
- Upstream-Status: Backport
- Signed-off-by: Haiqing Bai <Haiqing.Bai@windriver.com>
- ---
- src/common/wpa_common.h | 1 +
- src/rsn_supp/wpa.c | 7 +++++++
- 2 files changed, 8 insertions(+)
- diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h
- index 66f9977..5632d37 100644
- --- a/src/common/wpa_common.h
- +++ b/src/common/wpa_common.h
- @@ -222,6 +222,7 @@ struct wpa_ptk {
- size_t kck_len;
- size_t kek_len;
- size_t tk_len;
- + int installed; /* 1 if key has already been installed to driver */
- };
-
- struct wpa_gtk {
- diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
- index 19cc78b..97de8d3 100644
- --- a/src/rsn_supp/wpa.c
- +++ b/src/rsn_supp/wpa.c
- @@ -594,6 +594,12 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm,
- const u8 *key_rsc;
- u8 null_rsc[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
-
- + if (sm->ptk.installed) {
- + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
- + "WPA: Do not re-install same PTK to the driver");
- + return 0;
- + }
- +
- wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
- "WPA: Installing PTK to the driver");
-
- @@ -632,6 +638,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm,
-
- /* TK is not needed anymore in supplicant */
- os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
- + sm->ptk.installed = 1;
-
- if (sm->wpa_ptk_rekey) {
- eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
- --
- 1.9.1
- From 39c0043c282ea1901eb37c902f663c8ab019fc63 Mon Sep 17 00:00:00 2001
- From: Haiqing Bai <Haiqing.Bai@windriver.com>
- Date: Fri, 13 Oct 2017 10:40:31 +0800
- Subject: [PATCH 5/7] Fix PTK rekeying to generate a new ANonce
- The Authenticator state machine path for PTK rekeying ended up bypassing
- the AUTHENTICATION2 state where a new ANonce is generated when going
- directly to the PTKSTART state since there is no need to try to
- determine the PMK again in such a case. This is far from ideal since the
- new PTK would depend on a new nonce only from the supplicant.
- Fix this by generating a new ANonce when moving to the PTKSTART state
- for the purpose of starting new 4-way handshake to rekey PTK.
- Signed-off-by: Jouni Malinen <j@w1.fi>
- Upstream-Status: Backport
- Signed-off-by: Haiqing Bai <Haiqing.Bai@windriver.com>
- ---
- src/ap/wpa_auth.c | 22 +++++++++++++++++++---
- 1 file changed, 19 insertions(+), 3 deletions(-)
- diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c
- index 0ebbdb5..5084b74 100644
- --- a/src/ap/wpa_auth.c
- +++ b/src/ap/wpa_auth.c
- @@ -1858,6 +1858,19 @@ SM_STATE(WPA_PTK, AUTHENTICATION2)
- sm->TimeoutCtr = 0;
- }
-
- +static int wpa_auth_sm_ptk_update(struct wpa_state_machine *sm)
- +{
- + if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) {
- + wpa_printf(MSG_ERROR,
- + "WPA: Failed to get random data for ANonce");
- + sm->Disconnect = TRUE;
- + return -1;
- + }
- + wpa_hexdump(MSG_DEBUG, "WPA: Assign new ANonce", sm->ANonce,
- + WPA_NONCE_LEN);
- + sm->TimeoutCtr = 0;
- + return 0;
- +}
-
- SM_STATE(WPA_PTK, INITPMK)
- {
- @@ -2377,9 +2390,12 @@ SM_STEP(WPA_PTK)
- SM_ENTER(WPA_PTK, AUTHENTICATION);
- else if (sm->ReAuthenticationRequest)
- SM_ENTER(WPA_PTK, AUTHENTICATION2);
- - else if (sm->PTKRequest)
- - SM_ENTER(WPA_PTK, PTKSTART);
- - else switch (sm->wpa_ptk_state) {
- + else if (sm->PTKRequest) {
- + if (wpa_auth_sm_ptk_update(sm) < 0)
- + SM_ENTER(WPA_PTK, DISCONNECTED);
- + else
- + SM_ENTER(WPA_PTK, PTKSTART);
- + } else switch (sm->wpa_ptk_state) {
- case WPA_PTK_INITIALIZE:
- break;
- case WPA_PTK_DISCONNECT:
- --
- 1.9.1
- From e1b4fa806a88ade798722fccf16ee07f6df1413a Mon Sep 17 00:00:00 2001
- From: Haiqing Bai <Haiqing.Bai@windriver.com>
- Date: Fri, 13 Oct 2017 10:55:03 +0800
- Subject: [PATCH 6/7] TDLS: Reject TPK-TK reconfiguration
- Do not try to reconfigure the same TPK-TK to the driver after it has
- been successfully configured. This is an explicit check to avoid issues
- related to resetting the TX/RX packet number. There was already a check
- for this for TPK M2 (retries of that message are ignored completely), so
- that behavior does not get modified.
- For TPK M3, the TPK-TK could have been reconfigured, but that was
- followed by immediate teardown of the link due to an issue in updating
- the STA entry. Furthermore, for TDLS with any real security (i.e.,
- ignoring open/WEP), the TPK message exchange is protected on the AP path
- and simple replay attacks are not feasible.
- As an additional corner case, make sure the local nonce gets updated if
- the peer uses a very unlikely "random nonce" of all zeros.
- Signed-off-by: Jouni Malinen <j@w1.fi>
- Upstream-Status: Backport
- Signed-off-by: Haiqing Bai <Haiqing.Bai@windriver.com>
- ---
- src/rsn_supp/tdls.c | 36 ++++++++++++++++++++++++++++++++++--
- 1 file changed, 34 insertions(+), 2 deletions(-)
- diff --git a/src/rsn_supp/tdls.c b/src/rsn_supp/tdls.c
- index c1d7749..8633b8f 100644
- --- a/src/rsn_supp/tdls.c
- +++ b/src/rsn_supp/tdls.c
- @@ -111,6 +111,7 @@ struct wpa_tdls_peer {
- u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */
- } tpk;
- int tpk_set;
- + int tk_set; /* TPK-TK configured to the driver */
- int tpk_success;
- int tpk_in_progress;
-
- @@ -191,6 +192,20 @@ static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
- u8 rsc[6];
- enum wpa_alg alg;
-
- + if (peer->tk_set) {
- + /*
- + * This same TPK-TK has already been configured to the driver
- + * and this new configuration attempt (likely due to an
- + * unexpected retransmitted frame) would result in clearing
- + * the TX/RX sequence number which can break security, so must
- + * not allow that to happen.
- + */
- + wpa_printf(MSG_INFO, "TDLS: TPK-TK for the peer " MACSTR
- + " has already been configured to the driver - do not reconfigure",
- + MAC2STR(peer->addr));
- + return -1;
- + }
- +
- os_memset(rsc, 0, 6);
-
- switch (peer->cipher) {
- @@ -208,12 +223,15 @@ static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
- return -1;
- }
-
- + wpa_printf(MSG_DEBUG, "TDLS: Configure pairwise key for peer " MACSTR,
- + MAC2STR(peer->addr));
- if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1,
- rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) {
- wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the "
- "driver");
- return -1;
- }
- + peer->tk_set = 1;
- return 0;
- }
-
- @@ -689,7 +707,7 @@ static void wpa_tdls_peer_clear(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
- peer->cipher = 0;
- peer->qos_info = 0;
- peer->wmm_capable = 0;
- - peer->tpk_set = peer->tpk_success = 0;
- + peer->tk_set = peer->tpk_set = peer->tpk_success = 0;
- peer->chan_switch_enabled = 0;
- os_memset(&peer->tpk, 0, sizeof(peer->tpk));
- os_memset(peer->inonce, 0, WPA_NONCE_LEN);
- @@ -1152,6 +1170,7 @@ skip_rsnie:
- wpa_tdls_peer_free(sm, peer);
- return -1;
- }
- + peer->tk_set = 0; /* A new nonce results in a new TK */
- wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake",
- peer->inonce, WPA_NONCE_LEN);
- os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
- @@ -1747,6 +1766,17 @@ static int wpa_tdls_addset_peer(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
- peer->supp_oper_classes_len);
- }
-
- +static int tdls_nonce_set(const u8 *nonce)
- +{
- + int i;
- +
- + for (i = 0; i < WPA_NONCE_LEN; i++) {
- + if (nonce[i])
- + return 1;
- + }
- +
- + return 0;
- +}
-
- static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr,
- const u8 *buf, size_t len)
- @@ -2001,7 +2031,8 @@ skip_rsn:
- peer->rsnie_i_len = kde.rsn_ie_len;
- peer->cipher = cipher;
-
- - if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) {
- + if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0 ||
- + !tdls_nonce_set(peer->inonce)) {
- /*
- * There is no point in updating the RNonce for every obtained
- * TPK M1 frame (e.g., retransmission due to timeout) with the
- @@ -2017,6 +2048,7 @@ skip_rsn:
- "TDLS: Failed to get random data for responder nonce");
- goto error;
- }
- + peer->tk_set = 0; /* A new nonce results in a new TK */
- }
-
- #if 0
- --
- 1.9.1
- From 6d966716df42d379c0aaa1b833f070b93a29aaec Mon Sep 17 00:00:00 2001
- From: Haiqing Bai <Haiqing.Bai@windriver.com>
- Date: Fri, 13 Oct 2017 11:07:21 +0800
- Subject: [PATCH 7/7] FT: Do not allow multiple Reassociation Response frames
- The driver is expected to not report a second association event without
- the station having explicitly request a new association. As such, this
- case should not be reachable. However, since reconfiguring the same
- pairwise or group keys to the driver could result in nonce reuse issues,
- be extra careful here and do an additional state check to avoid this
- even if the local driver ends up somehow accepting an unexpected
- Reassociation Response frame.
- Signed-off-by: Jouni Malinen <j@w1.fi>
- Upstream-Status: Backport
- Signed-off-by: Haiqing Bai <Haiqing.Bai@windriver.com>
- ---
- src/rsn_supp/wpa.c | 3 +++
- src/rsn_supp/wpa_ft.c | 8 ++++++++
- src/rsn_supp/wpa_i.h | 1 +
- 3 files changed, 12 insertions(+)
- diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
- index 97de8d3..b9c1ab5 100644
- --- a/src/rsn_supp/wpa.c
- +++ b/src/rsn_supp/wpa.c
- @@ -2366,6 +2366,9 @@ void wpa_sm_notify_disassoc(struct wpa_sm *sm)
- #ifdef CONFIG_TDLS
- wpa_tdls_disassoc(sm);
- #endif /* CONFIG_TDLS */
- +#ifdef CONFIG_IEEE80211R
- + sm->ft_reassoc_completed = 0;
- +#endif /* CONFIG_IEEE80211R */
-
- /* Keys are not needed in the WPA state machine anymore */
- wpa_sm_drop_sa(sm);
- diff --git a/src/rsn_supp/wpa_ft.c b/src/rsn_supp/wpa_ft.c
- index 06dea05..e8834dd 100644
- --- a/src/rsn_supp/wpa_ft.c
- +++ b/src/rsn_supp/wpa_ft.c
- @@ -153,6 +153,7 @@ static u8 * wpa_ft_gen_req_ies(struct wpa_sm *sm, size_t *len,
- u16 capab;
-
- sm->ft_completed = 0;
- + sm->ft_reassoc_completed = 0;
-
- buf_len = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) +
- 2 + sm->r0kh_id_len + ric_ies_len + 100;
- @@ -683,6 +684,11 @@ int wpa_ft_validate_reassoc_resp(struct wpa_sm *sm, const u8 *ies,
- return -1;
- }
-
- + if (sm->ft_reassoc_completed) {
- + wpa_printf(MSG_DEBUG, "FT: Reassociation has already been completed for this FT protocol instance - ignore unexpected retransmission");
- + return 0;
- + }
- +
- if (wpa_ft_parse_ies(ies, ies_len, &parse) < 0) {
- wpa_printf(MSG_DEBUG, "FT: Failed to parse IEs");
- return -1;
- @@ -783,6 +789,8 @@ int wpa_ft_validate_reassoc_resp(struct wpa_sm *sm, const u8 *ies,
- return -1;
- }
-
- + sm->ft_reassoc_completed = 1;
- +
- if (wpa_ft_process_gtk_subelem(sm, parse.gtk, parse.gtk_len) < 0)
- return -1;
-
- diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h
- index 51753ee..85cc862 100644
- --- a/src/rsn_supp/wpa_i.h
- +++ b/src/rsn_supp/wpa_i.h
- @@ -127,6 +127,7 @@ struct wpa_sm {
- size_t r0kh_id_len;
- u8 r1kh_id[FT_R1KH_ID_LEN];
- int ft_completed;
- + int ft_reassoc_completed;
- int over_the_ds_in_progress;
- u8 target_ap[ETH_ALEN]; /* over-the-DS target AP */
- int set_ptk_after_assoc;
- --
- 1.9.1
|