xref: /freebsd/contrib/wpa/src/ap/pmksa_cache_auth.c (revision d6b92ffa) 
1 /*
2  * hostapd - PMKSA cache for IEEE 802.11i RSN
3  * Copyright (c) 2004-2008, 2012-2015, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "utils/includes.h"
10 
11 #include "utils/common.h"
12 #include "utils/eloop.h"
13 #include "eapol_auth/eapol_auth_sm.h"
14 #include "eapol_auth/eapol_auth_sm_i.h"
15 #include "radius/radius_das.h"
16 #include "sta_info.h"
17 #include "ap_config.h"
18 #include "pmksa_cache_auth.h"
19 
20 
21 static const int pmksa_cache_max_entries = 1024;
22 static const int dot11RSNAConfigPMKLifetime = 43200;
23 
24 struct rsn_pmksa_cache {
25 #define PMKID_HASH_SIZE 128
26 #define PMKID_HASH(pmkid) (unsigned int) ((pmkid)[0] & 0x7f)
27 	struct rsn_pmksa_cache_entry *pmkid[PMKID_HASH_SIZE];
28 	struct rsn_pmksa_cache_entry *pmksa;
29 	int pmksa_count;
30 
31 	void (*free_cb)(struct rsn_pmksa_cache_entry *entry, void *ctx);
32 	void *ctx;
33 };
34 
35 
36 static void pmksa_cache_set_expiration(struct rsn_pmksa_cache *pmksa);
37 
38 
39 static void _pmksa_cache_free_entry(struct rsn_pmksa_cache_entry *entry)
40 {
41 	os_free(entry->identity);
42 	wpabuf_free(entry->cui);
43 #ifndef CONFIG_NO_RADIUS
44 	radius_free_class(&entry->radius_class);
45 #endif /* CONFIG_NO_RADIUS */
46 	bin_clear_free(entry, sizeof(*entry));
47 }
48 
49 
50 void pmksa_cache_free_entry(struct rsn_pmksa_cache *pmksa,
51 			    struct rsn_pmksa_cache_entry *entry)
52 {
53 	struct rsn_pmksa_cache_entry *pos, *prev;
54 	unsigned int hash;
55 
56 	pmksa->pmksa_count--;
57 	pmksa->free_cb(entry, pmksa->ctx);
58 
59 	/* unlink from hash list */
60 	hash = PMKID_HASH(entry->pmkid);
61 	pos = pmksa->pmkid[hash];
62 	prev = NULL;
63 	while (pos) {
64 		if (pos == entry) {
65 			if (prev != NULL)
66 				prev->hnext = entry->hnext;
67 			else
68 				pmksa->pmkid[hash] = entry->hnext;
69 			break;
70 		}
71 		prev = pos;
72 		pos = pos->hnext;
73 	}
74 
75 	/* unlink from entry list */
76 	pos = pmksa->pmksa;
77 	prev = NULL;
78 	while (pos) {
79 		if (pos == entry) {
80 			if (prev != NULL)
81 				prev->next = entry->next;
82 			else
83 				pmksa->pmksa = entry->next;
84 			break;
85 		}
86 		prev = pos;
87 		pos = pos->next;
88 	}
89 
90 	_pmksa_cache_free_entry(entry);
91 }
92 
93 
94 static void pmksa_cache_expire(void *eloop_ctx, void *timeout_ctx)
95 {
96 	struct rsn_pmksa_cache *pmksa = eloop_ctx;
97 	struct os_reltime now;
98 
99 	os_get_reltime(&now);
100 	while (pmksa->pmksa && pmksa->pmksa->expiration <= now.sec) {
101 		wpa_printf(MSG_DEBUG, "RSN: expired PMKSA cache entry for "
102 			   MACSTR, MAC2STR(pmksa->pmksa->spa));
103 		pmksa_cache_free_entry(pmksa, pmksa->pmksa);
104 	}
105 
106 	pmksa_cache_set_expiration(pmksa);
107 }
108 
109 
110 static void pmksa_cache_set_expiration(struct rsn_pmksa_cache *pmksa)
111 {
112 	int sec;
113 	struct os_reltime now;
114 
115 	eloop_cancel_timeout(pmksa_cache_expire, pmksa, NULL);
116 	if (pmksa->pmksa == NULL)
117 		return;
118 	os_get_reltime(&now);
119 	sec = pmksa->pmksa->expiration - now.sec;
120 	if (sec < 0)
121 		sec = 0;
122 	eloop_register_timeout(sec + 1, 0, pmksa_cache_expire, pmksa, NULL);
123 }
124 
125 
126 static void pmksa_cache_from_eapol_data(struct rsn_pmksa_cache_entry *entry,
127 					struct eapol_state_machine *eapol)
128 {
129 	if (eapol == NULL)
130 		return;
131 
132 	if (eapol->identity) {
133 		entry->identity = os_malloc(eapol->identity_len);
134 		if (entry->identity) {
135 			entry->identity_len = eapol->identity_len;
136 			os_memcpy(entry->identity, eapol->identity,
137 				  eapol->identity_len);
138 		}
139 	}
140 
141 	if (eapol->radius_cui)
142 		entry->cui = wpabuf_dup(eapol->radius_cui);
143 
144 #ifndef CONFIG_NO_RADIUS
145 	radius_copy_class(&entry->radius_class, &eapol->radius_class);
146 #endif /* CONFIG_NO_RADIUS */
147 
148 	entry->eap_type_authsrv = eapol->eap_type_authsrv;
149 	entry->vlan_id = ((struct sta_info *) eapol->sta)->vlan_id;
150 
151 	entry->acct_multi_session_id_hi = eapol->acct_multi_session_id_hi;
152 	entry->acct_multi_session_id_lo = eapol->acct_multi_session_id_lo;
153 }
154 
155 
156 void pmksa_cache_to_eapol_data(struct rsn_pmksa_cache_entry *entry,
157 			       struct eapol_state_machine *eapol)
158 {
159 	if (entry == NULL || eapol == NULL)
160 		return;
161 
162 	if (entry->identity) {
163 		os_free(eapol->identity);
164 		eapol->identity = os_malloc(entry->identity_len);
165 		if (eapol->identity) {
166 			eapol->identity_len = entry->identity_len;
167 			os_memcpy(eapol->identity, entry->identity,
168 				  entry->identity_len);
169 		}
170 		wpa_hexdump_ascii(MSG_DEBUG, "STA identity from PMKSA",
171 				  eapol->identity, eapol->identity_len);
172 	}
173 
174 	if (entry->cui) {
175 		wpabuf_free(eapol->radius_cui);
176 		eapol->radius_cui = wpabuf_dup(entry->cui);
177 	}
178 
179 #ifndef CONFIG_NO_RADIUS
180 	radius_free_class(&eapol->radius_class);
181 	radius_copy_class(&eapol->radius_class, &entry->radius_class);
182 #endif /* CONFIG_NO_RADIUS */
183 	if (eapol->radius_class.attr) {
184 		wpa_printf(MSG_DEBUG, "Copied %lu Class attribute(s) from "
185 			   "PMKSA", (unsigned long) eapol->radius_class.count);
186 	}
187 
188 	eapol->eap_type_authsrv = entry->eap_type_authsrv;
189 	((struct sta_info *) eapol->sta)->vlan_id = entry->vlan_id;
190 
191 	eapol->acct_multi_session_id_hi = entry->acct_multi_session_id_hi;
192 	eapol->acct_multi_session_id_lo = entry->acct_multi_session_id_lo;
193 }
194 
195 
196 static void pmksa_cache_link_entry(struct rsn_pmksa_cache *pmksa,
197 				   struct rsn_pmksa_cache_entry *entry)
198 {
199 	struct rsn_pmksa_cache_entry *pos, *prev;
200 	int hash;
201 
202 	/* Add the new entry; order by expiration time */
203 	pos = pmksa->pmksa;
204 	prev = NULL;
205 	while (pos) {
206 		if (pos->expiration > entry->expiration)
207 			break;
208 		prev = pos;
209 		pos = pos->next;
210 	}
211 	if (prev == NULL) {
212 		entry->next = pmksa->pmksa;
213 		pmksa->pmksa = entry;
214 	} else {
215 		entry->next = prev->next;
216 		prev->next = entry;
217 	}
218 
219 	hash = PMKID_HASH(entry->pmkid);
220 	entry->hnext = pmksa->pmkid[hash];
221 	pmksa->pmkid[hash] = entry;
222 
223 	pmksa->pmksa_count++;
224 	if (prev == NULL)
225 		pmksa_cache_set_expiration(pmksa);
226 	wpa_printf(MSG_DEBUG, "RSN: added PMKSA cache entry for " MACSTR,
227 		   MAC2STR(entry->spa));
228 	wpa_hexdump(MSG_DEBUG, "RSN: added PMKID", entry->pmkid, PMKID_LEN);
229 }
230 
231 
232 /**
233  * pmksa_cache_auth_add - Add a PMKSA cache entry
234  * @pmksa: Pointer to PMKSA cache data from pmksa_cache_auth_init()
235  * @pmk: The new pairwise master key
236  * @pmk_len: PMK length in bytes, usually PMK_LEN (32)
237  * @kck: Key confirmation key or %NULL if not yet derived
238  * @kck_len: KCK length in bytes
239  * @aa: Authenticator address
240  * @spa: Supplicant address
241  * @session_timeout: Session timeout
242  * @eapol: Pointer to EAPOL state machine data
243  * @akmp: WPA_KEY_MGMT_* used in key derivation
244  * Returns: Pointer to the added PMKSA cache entry or %NULL on error
245  *
246  * This function create a PMKSA entry for a new PMK and adds it to the PMKSA
247  * cache. If an old entry is already in the cache for the same Supplicant,
248  * this entry will be replaced with the new entry. PMKID will be calculated
249  * based on the PMK.
250  */
251 struct rsn_pmksa_cache_entry *
252 pmksa_cache_auth_add(struct rsn_pmksa_cache *pmksa,
253 		     const u8 *pmk, size_t pmk_len,
254 		     const u8 *kck, size_t kck_len,
255 		     const u8 *aa, const u8 *spa, int session_timeout,
256 		     struct eapol_state_machine *eapol, int akmp)
257 {
258 	struct rsn_pmksa_cache_entry *entry, *pos;
259 	struct os_reltime now;
260 
261 	if (pmk_len > PMK_LEN)
262 		return NULL;
263 
264 	if (wpa_key_mgmt_suite_b(akmp) && !kck)
265 		return NULL;
266 
267 	entry = os_zalloc(sizeof(*entry));
268 	if (entry == NULL)
269 		return NULL;
270 	os_memcpy(entry->pmk, pmk, pmk_len);
271 	entry->pmk_len = pmk_len;
272 	if (akmp == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
273 		rsn_pmkid_suite_b_192(kck, kck_len, aa, spa, entry->pmkid);
274 	else if (wpa_key_mgmt_suite_b(akmp))
275 		rsn_pmkid_suite_b(kck, kck_len, aa, spa, entry->pmkid);
276 	else
277 		rsn_pmkid(pmk, pmk_len, aa, spa, entry->pmkid,
278 			  wpa_key_mgmt_sha256(akmp));
279 	os_get_reltime(&now);
280 	entry->expiration = now.sec;
281 	if (session_timeout > 0)
282 		entry->expiration += session_timeout;
283 	else
284 		entry->expiration += dot11RSNAConfigPMKLifetime;
285 	entry->akmp = akmp;
286 	os_memcpy(entry->spa, spa, ETH_ALEN);
287 	pmksa_cache_from_eapol_data(entry, eapol);
288 
289 	/* Replace an old entry for the same STA (if found) with the new entry
290 	 */
291 	pos = pmksa_cache_auth_get(pmksa, spa, NULL);
292 	if (pos)
293 		pmksa_cache_free_entry(pmksa, pos);
294 
295 	if (pmksa->pmksa_count >= pmksa_cache_max_entries && pmksa->pmksa) {
296 		/* Remove the oldest entry to make room for the new entry */
297 		wpa_printf(MSG_DEBUG, "RSN: removed the oldest PMKSA cache "
298 			   "entry (for " MACSTR ") to make room for new one",
299 			   MAC2STR(pmksa->pmksa->spa));
300 		pmksa_cache_free_entry(pmksa, pmksa->pmksa);
301 	}
302 
303 	pmksa_cache_link_entry(pmksa, entry);
304 
305 	return entry;
306 }
307 
308 
309 struct rsn_pmksa_cache_entry *
310 pmksa_cache_add_okc(struct rsn_pmksa_cache *pmksa,
311 		    const struct rsn_pmksa_cache_entry *old_entry,
312 		    const u8 *aa, const u8 *pmkid)
313 {
314 	struct rsn_pmksa_cache_entry *entry;
315 
316 	entry = os_zalloc(sizeof(*entry));
317 	if (entry == NULL)
318 		return NULL;
319 	os_memcpy(entry->pmkid, pmkid, PMKID_LEN);
320 	os_memcpy(entry->pmk, old_entry->pmk, old_entry->pmk_len);
321 	entry->pmk_len = old_entry->pmk_len;
322 	entry->expiration = old_entry->expiration;
323 	entry->akmp = old_entry->akmp;
324 	os_memcpy(entry->spa, old_entry->spa, ETH_ALEN);
325 	entry->opportunistic = 1;
326 	if (old_entry->identity) {
327 		entry->identity = os_malloc(old_entry->identity_len);
328 		if (entry->identity) {
329 			entry->identity_len = old_entry->identity_len;
330 			os_memcpy(entry->identity, old_entry->identity,
331 				  old_entry->identity_len);
332 		}
333 	}
334 	if (old_entry->cui)
335 		entry->cui = wpabuf_dup(old_entry->cui);
336 #ifndef CONFIG_NO_RADIUS
337 	radius_copy_class(&entry->radius_class, &old_entry->radius_class);
338 #endif /* CONFIG_NO_RADIUS */
339 	entry->eap_type_authsrv = old_entry->eap_type_authsrv;
340 	entry->vlan_id = old_entry->vlan_id;
341 	entry->opportunistic = 1;
342 
343 	pmksa_cache_link_entry(pmksa, entry);
344 
345 	return entry;
346 }
347 
348 
349 /**
350  * pmksa_cache_auth_deinit - Free all entries in PMKSA cache
351  * @pmksa: Pointer to PMKSA cache data from pmksa_cache_auth_init()
352  */
353 void pmksa_cache_auth_deinit(struct rsn_pmksa_cache *pmksa)
354 {
355 	struct rsn_pmksa_cache_entry *entry, *prev;
356 	int i;
357 
358 	if (pmksa == NULL)
359 		return;
360 
361 	entry = pmksa->pmksa;
362 	while (entry) {
363 		prev = entry;
364 		entry = entry->next;
365 		_pmksa_cache_free_entry(prev);
366 	}
367 	eloop_cancel_timeout(pmksa_cache_expire, pmksa, NULL);
368 	pmksa->pmksa_count = 0;
369 	pmksa->pmksa = NULL;
370 	for (i = 0; i < PMKID_HASH_SIZE; i++)
371 		pmksa->pmkid[i] = NULL;
372 	os_free(pmksa);
373 }
374 
375 
376 /**
377  * pmksa_cache_auth_get - Fetch a PMKSA cache entry
378  * @pmksa: Pointer to PMKSA cache data from pmksa_cache_auth_init()
379  * @spa: Supplicant address or %NULL to match any
380  * @pmkid: PMKID or %NULL to match any
381  * Returns: Pointer to PMKSA cache entry or %NULL if no match was found
382  */
383 struct rsn_pmksa_cache_entry *
384 pmksa_cache_auth_get(struct rsn_pmksa_cache *pmksa,
385 		     const u8 *spa, const u8 *pmkid)
386 {
387 	struct rsn_pmksa_cache_entry *entry;
388 
389 	if (pmkid) {
390 		for (entry = pmksa->pmkid[PMKID_HASH(pmkid)]; entry;
391 		     entry = entry->hnext) {
392 			if ((spa == NULL ||
393 			     os_memcmp(entry->spa, spa, ETH_ALEN) == 0) &&
394 			    os_memcmp(entry->pmkid, pmkid, PMKID_LEN) == 0)
395 				return entry;
396 		}
397 	} else {
398 		for (entry = pmksa->pmksa; entry; entry = entry->next) {
399 			if (spa == NULL ||
400 			    os_memcmp(entry->spa, spa, ETH_ALEN) == 0)
401 				return entry;
402 		}
403 	}
404 
405 	return NULL;
406 }
407 
408 
409 /**
410  * pmksa_cache_get_okc - Fetch a PMKSA cache entry using OKC
411  * @pmksa: Pointer to PMKSA cache data from pmksa_cache_auth_init()
412  * @aa: Authenticator address
413  * @spa: Supplicant address
414  * @pmkid: PMKID
415  * Returns: Pointer to PMKSA cache entry or %NULL if no match was found
416  *
417  * Use opportunistic key caching (OKC) to find a PMK for a supplicant.
418  */
419 struct rsn_pmksa_cache_entry * pmksa_cache_get_okc(
420 	struct rsn_pmksa_cache *pmksa, const u8 *aa, const u8 *spa,
421 	const u8 *pmkid)
422 {
423 	struct rsn_pmksa_cache_entry *entry;
424 	u8 new_pmkid[PMKID_LEN];
425 
426 	for (entry = pmksa->pmksa; entry; entry = entry->next) {
427 		if (os_memcmp(entry->spa, spa, ETH_ALEN) != 0)
428 			continue;
429 		rsn_pmkid(entry->pmk, entry->pmk_len, aa, spa, new_pmkid,
430 			  wpa_key_mgmt_sha256(entry->akmp));
431 		if (os_memcmp(new_pmkid, pmkid, PMKID_LEN) == 0)
432 			return entry;
433 	}
434 	return NULL;
435 }
436 
437 
438 /**
439  * pmksa_cache_auth_init - Initialize PMKSA cache
440  * @free_cb: Callback function to be called when a PMKSA cache entry is freed
441  * @ctx: Context pointer for free_cb function
442  * Returns: Pointer to PMKSA cache data or %NULL on failure
443  */
444 struct rsn_pmksa_cache *
445 pmksa_cache_auth_init(void (*free_cb)(struct rsn_pmksa_cache_entry *entry,
446 				      void *ctx), void *ctx)
447 {
448 	struct rsn_pmksa_cache *pmksa;
449 
450 	pmksa = os_zalloc(sizeof(*pmksa));
451 	if (pmksa) {
452 		pmksa->free_cb = free_cb;
453 		pmksa->ctx = ctx;
454 	}
455 
456 	return pmksa;
457 }
458 
459 
460 static int das_attr_match(struct rsn_pmksa_cache_entry *entry,
461 			  struct radius_das_attrs *attr)
462 {
463 	int match = 0;
464 
465 	if (attr->sta_addr) {
466 		if (os_memcmp(attr->sta_addr, entry->spa, ETH_ALEN) != 0)
467 			return 0;
468 		match++;
469 	}
470 
471 	if (attr->acct_multi_session_id) {
472 		char buf[20];
473 
474 		if (attr->acct_multi_session_id_len != 17)
475 			return 0;
476 		os_snprintf(buf, sizeof(buf), "%08X+%08X",
477 			    entry->acct_multi_session_id_hi,
478 			    entry->acct_multi_session_id_lo);
479 		if (os_memcmp(attr->acct_multi_session_id, buf, 17) != 0)
480 			return 0;
481 		match++;
482 	}
483 
484 	if (attr->cui) {
485 		if (!entry->cui ||
486 		    attr->cui_len != wpabuf_len(entry->cui) ||
487 		    os_memcmp(attr->cui, wpabuf_head(entry->cui),
488 			      attr->cui_len) != 0)
489 			return 0;
490 		match++;
491 	}
492 
493 	if (attr->user_name) {
494 		if (!entry->identity ||
495 		    attr->user_name_len != entry->identity_len ||
496 		    os_memcmp(attr->user_name, entry->identity,
497 			      attr->user_name_len) != 0)
498 			return 0;
499 		match++;
500 	}
501 
502 	return match;
503 }
504 
505 
506 int pmksa_cache_auth_radius_das_disconnect(struct rsn_pmksa_cache *pmksa,
507 					   struct radius_das_attrs *attr)
508 {
509 	int found = 0;
510 	struct rsn_pmksa_cache_entry *entry, *prev;
511 
512 	if (attr->acct_session_id)
513 		return -1;
514 
515 	entry = pmksa->pmksa;
516 	while (entry) {
517 		if (das_attr_match(entry, attr)) {
518 			found++;
519 			prev = entry;
520 			entry = entry->next;
521 			pmksa_cache_free_entry(pmksa, prev);
522 			continue;
523 		}
524 		entry = entry->next;
525 	}
526 
527 	return found ? 0 : -1;
528 }
529