git.librecmc.org Git - librecmc/librecmc.git/blob

   1 From: Jouni Malinen <j@w1.fi>
   2 Date: Sun, 1 Oct 2017 12:12:24 +0300
   3 Subject: [PATCH] Extend protection of GTK/IGTK reinstallation of WNM-Sleep
   4  Mode cases
   5
   6 This extends the protection to track last configured GTK/IGTK value
   7 separately from EAPOL-Key frames and WNM-Sleep Mode frames to cover a
   8 corner case where these two different mechanisms may get used when the
   9 GTK/IGTK has changed and tracking a single value is not sufficient to
  10 detect a possible key reconfiguration.
  11
  12 Signed-off-by: Jouni Malinen <j@w1.fi>
  13 ---
  14
  15 --- a/src/rsn_supp/wpa.c
  16 +++ b/src/rsn_supp/wpa.c
  17 @@ -795,14 +795,17 @@ struct wpa_gtk_data {
  18
  19  static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
  20                                       const struct wpa_gtk_data *gd,
  21 -                                     const u8 *key_rsc)
  22 +                                     const u8 *key_rsc, int wnm_sleep)
  23  {
  24         const u8 *_gtk = gd->gtk;
  25         u8 gtk_buf[32];
  26
  27         /* Detect possible key reinstallation */
  28 -       if (sm->gtk.gtk_len == (size_t) gd->gtk_len &&
  29 -           os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) {
  30 +       if ((sm->gtk.gtk_len == (size_t) gd->gtk_len &&
  31 +            os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) ||
  32 +           (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len &&
  33 +            os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk,
  34 +                      sm->gtk_wnm_sleep.gtk_len) == 0)) {
  35                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
  36                         "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)",
  37                         gd->keyidx, gd->tx, gd->gtk_len);
  38 @@ -843,8 +846,14 @@ static int wpa_supplicant_install_gtk(st
  39         }
  40         os_memset(gtk_buf, 0, sizeof(gtk_buf));
  41
  42 -       sm->gtk.gtk_len = gd->gtk_len;
  43 -       os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
  44 +       if (wnm_sleep) {
  45 +               sm->gtk_wnm_sleep.gtk_len = gd->gtk_len;
  46 +               os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk,
  47 +                         sm->gtk_wnm_sleep.gtk_len);
  48 +       } else {
  49 +               sm->gtk.gtk_len = gd->gtk_len;
  50 +               os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
  51 +       }
  52
  53         return 0;
  54  }
  55 @@ -938,7 +947,7 @@ static int wpa_supplicant_pairwise_gtk(s
  56             (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
  57                                                gtk_len, gtk_len,
  58                                                &gd.key_rsc_len, &gd.alg) ||
  59 -            wpa_supplicant_install_gtk(sm, &gd, key_rsc))) {
  60 +            wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) {
  61                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
  62                         "RSN: Failed to install GTK");
  63                 os_memset(&gd, 0, sizeof(gd));
  64 @@ -954,14 +963,18 @@ static int wpa_supplicant_pairwise_gtk(s
  65
  66  #ifdef CONFIG_IEEE80211W
  67  static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
  68 -                                      const struct wpa_igtk_kde *igtk)
  69 +                                      const struct wpa_igtk_kde *igtk,
  70 +                                      int wnm_sleep)
  71  {
  72         size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
  73         u16 keyidx = WPA_GET_LE16(igtk->keyid);
  74
  75         /* Detect possible key reinstallation */
  76 -       if (sm->igtk.igtk_len == len &&
  77 -           os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) {
  78 +       if ((sm->igtk.igtk_len == len &&
  79 +            os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) ||
  80 +           (sm->igtk_wnm_sleep.igtk_len == len &&
  81 +            os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk,
  82 +                      sm->igtk_wnm_sleep.igtk_len) == 0)) {
  83                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
  84                         "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)",
  85                         keyidx);
  86 @@ -986,8 +999,14 @@ static int wpa_supplicant_install_igtk(s
  87                 return -1;
  88         }
  89
  90 -       sm->igtk.igtk_len = len;
  91 -       os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
  92 +       if (wnm_sleep) {
  93 +               sm->igtk_wnm_sleep.igtk_len = len;
  94 +               os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk,
  95 +                         sm->igtk_wnm_sleep.igtk_len);
  96 +       } else {
  97 +               sm->igtk.igtk_len = len;
  98 +               os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
  99 +       }
 100
 101         return 0;
 102  }
 103 @@ -1010,7 +1029,7 @@ static int ieee80211w_set_keys(struct wp
 104                         return -1;
 105
 106                 igtk = (const struct wpa_igtk_kde *) ie->igtk;
 107 -               if (wpa_supplicant_install_igtk(sm, igtk) < 0)
 108 +               if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0)
 109                         return -1;
 110         }
 111
 112 @@ -1659,7 +1678,7 @@ static void wpa_supplicant_process_1_of_
 113         if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
 114                 key_rsc = null_rsc;
 115
 116 -       if (wpa_supplicant_install_gtk(sm, &gd, key_rsc) ||
 117 +       if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) ||
 118             wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0)
 119                 goto failed;
 120         os_memset(&gd, 0, sizeof(gd));
 121 @@ -2580,8 +2599,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *
 122                 sm->tptk_set = 0;
 123                 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
 124                 os_memset(&sm->gtk, 0, sizeof(sm->gtk));
 125 +               os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
 126  #ifdef CONFIG_IEEE80211W
 127                 os_memset(&sm->igtk, 0, sizeof(sm->igtk));
 128 +               os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
 129  #endif /* CONFIG_IEEE80211W */
 130         }
 131
 132 @@ -3160,8 +3181,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm)
 133         os_memset(&sm->ptk, 0, sizeof(sm->ptk));
 134         os_memset(&sm->tptk, 0, sizeof(sm->tptk));
 135         os_memset(&sm->gtk, 0, sizeof(sm->gtk));
 136 +       os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
 137  #ifdef CONFIG_IEEE80211W
 138         os_memset(&sm->igtk, 0, sizeof(sm->igtk));
 139 +       os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
 140  #endif /* CONFIG_IEEE80211W */
 141  #ifdef CONFIG_IEEE80211R
 142         os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
 143 @@ -3226,7 +3249,7 @@ int wpa_wnmsleep_install_key(struct wpa_
 144
 145                 wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)",
 146                                 gd.gtk, gd.gtk_len);
 147 -               if (wpa_supplicant_install_gtk(sm, &gd, key_rsc)) {
 148 +               if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) {
 149                         os_memset(&gd, 0, sizeof(gd));
 150                         wpa_printf(MSG_DEBUG, "Failed to install the GTK in "
 151                                    "WNM mode");
 152 @@ -3238,7 +3261,7 @@ int wpa_wnmsleep_install_key(struct wpa_
 153                 const struct wpa_igtk_kde *igtk;
 154
 155                 igtk = (const struct wpa_igtk_kde *) (buf + 2);
 156 -               if (wpa_supplicant_install_igtk(sm, igtk) < 0)
 157 +               if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0)
 158                         return -1;
 159  #endif /* CONFIG_IEEE80211W */
 160         } else {
 161 @@ -4121,7 +4144,7 @@ int fils_process_assoc_resp(struct wpa_s
 162         os_memcpy(gd.gtk, kde.gtk + 2, kde.gtk_len - 2);
 163
 164         wpa_printf(MSG_DEBUG, "FILS: Set GTK to driver");
 165 -       if (wpa_supplicant_install_gtk(sm, &gd, elems.key_delivery) < 0) {
 166 +       if (wpa_supplicant_install_gtk(sm, &gd, elems.key_delivery, 0) < 0) {
 167                 wpa_printf(MSG_DEBUG, "FILS: Failed to set GTK");
 168                 goto fail;
 169         }
 170 --- a/src/rsn_supp/wpa_i.h
 171 +++ b/src/rsn_supp/wpa_i.h
 172 @@ -32,8 +32,10 @@ struct wpa_sm {
 173         int rx_replay_counter_set;
 174         u8 request_counter[WPA_REPLAY_COUNTER_LEN];
 175         struct wpa_gtk gtk;
 176 +       struct wpa_gtk gtk_wnm_sleep;
 177  #ifdef CONFIG_IEEE80211W
 178         struct wpa_igtk igtk;
 179 +       struct wpa_igtk igtk_wnm_sleep;
 180  #endif /* CONFIG_IEEE80211W */
 181
 182         struct eapol_sm *eapol; /* EAPOL state machine from upper level code */