aboutsummaryrefslogtreecommitdiffstats
path: root/src/ap/ieee802_1x.c
Commit message (Collapse)AuthorAgeFilesLines
* save eapol for later use (EAPOL Start race)Eliad Peller2012-08-021-0/+11
| | | | | | [ Includes null check missing from the original patch - Arik ] Signed-off-by: Arik Nemtsov <arik@wizery.com>
* hostapd: Allow addition of arbitrary RADIUS attributesJouni Malinen2012-05-051-8/+36
| | | | | | | | New configuration parameters radius_auth_req_attr and radius_acct_req_attr can now be used to add (or override) RADIUS attributes in Access-Request and Accounting-Request packets. Signed-hostap: Jouni Malinen <j@w1.fi>
* hostapd: Add optional Chargeable-User-Identity request (RFC 4372)Jouni Malinen2012-05-051-0/+19
| | | | | | | | radius_request_cui=1 configuration parameter can now be used to configure hostapd to request CUI from the RADIUS server by including Chargeable-User-Identity attribute into Access-Request packets. Signed-hostap: Jouni Malinen <j@w1.fi>
* hostapd: Copy Chargeable-User-Identity into accounting (RFC 4372)Jouni Malinen2012-05-051-0/+36
| | | | | | | If Access-Accept packet includes the Chargeable-User-Identity attribute, copy this attribute as-is into accounting messages. Signed-hostap: Jouni Malinen <j@w1.fi>
* Fix EAP/WPS to PSK transition on reassociation in authenticatorJouni Malinen2012-04-101-0/+10
| | | | | | | | | | | | | | | | | | A station may move from EAP/WPS key_mgmt to PSK using re-association. In practice, this can happen most likely with WPS when the station runs through the provisioning step (EAP/WPS) followed by PSK authentication. If a deauthentication event is missed from the station for whatever reason, the EAPOL authenticator state machine could have been left running. This can result in various issues, including unexpected disconnection of the station while both the 4-way handshake and EAPOL authenticator state machines (EAP) are running at the same time when the supplicant is trying to use PSK. Fix this by explicitly clearing EAPOL authenticator state machine on (re)association if the new association does not use it. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com> intended-for: hostap-1
* Remove the GPL notification from files contributed by Jouni MalinenJouni Malinen2012-02-111-8/+2
| | | | | | | Remove the GPL notification text from the files that were initially contributed by myself. Signed-hostap: Jouni Malinen <j@w1.fi>
* Clear EAPOL authenticator authFail for PMKSA caching/FTJouni Malinen2012-02-041-1/+3
| | | | | | | | | | | | | | | | This fixes a corner case where a STA that has PMKSA cache entry (or valid FT keys) could try to use full EAPOL/EAP authentication and fail. If the STA will then try to use the still valid PMKSA cache entry (or FT) before the STA entry has been cleared, authFail could have been left to TRUE. That will make EAPOL authenticator PAE state machine enter HELD state even though authSuccess was already forced to TRUE. This results in the STA getting disconnected even though it should be allowed to continue with 4-way handshake. While this is unlikely to happen in practice, it is better to get this fixed by clearing authFail when setting authSuccess. Signed-hostap: Jouni Malinen <j@w1.fi> intended-for: hostap-1
* AP: Improve disconnect and timeout related loggingBen Greear2011-12-101-0/+3
| | | | | | | This previously helped when debugging some auth issues when hitting the AP with 128 association attempts all at once. Signed-off-by: Ben Greear <greearb@candelatech.com>
* AP: Convert some wpa_printf to wpa_msg/dbgBen Greear2011-12-101-2/+2
| | | | | | | This generates better log messages when running multiple interfaces in one process. Signed-off-by: Ben Greear <greearb@candelatech.com>
* Fix wired EAPOL authenticatorJouni Malinen2011-11-201-1/+2
| | | | | | | | | | Commit 940a0ce9702095bb079bd97857a2605516f83157 moved the STA associated check from driver_*.c into ieee802_1x_receive(), but failed to take into account that wired networks and driver_wired.c do not mark the STA entry associated. Fix this by skipping the check if the driver wrapper is using a wired network. Signed-hostap: Jouni Malinen <j@w1.fi>
* AP: Add explicit EAPOL TX status eventJohannes Berg2011-11-191-9/+20
| | | | | | | | The new event can be used when EAPOL TX status can't be reported as a complete 802.11 frame but is instead reported as just the EAPOL data as originally passed to hapd_send_eapol(). Signed-hostap: Johannes Berg <johannes.berg@intel.com>
* Use a single define for maximum number of EAP methodsJouni Malinen2011-11-171-5/+2
| | | | | | | | This cleans up the code a bit by not having to deal with theoretical possibility of maximum number of EAP methods to be different between various components in hostapd. Signed-hostap: Jouni Malinen <j@w1.fi>
* Remove unnecessary include file inclusionJouni Malinen2011-11-131-1/+0
| | | | Signed-hostap: Jouni Malinen <j@w1.fi>
* Move AP events for STA connected/disconnected into one functionJouni Malinen2011-11-031-21/+0
| | | | | | | | Instead of trying to remember to add wpa_msg() calls for every possible path where a STA becomes authorized or unauthorized, use ap_sta_set_authorized() to send these events more consistently. Signed-hostap: Jouni Malinen <j@w1.fi>
* P2P: Append P2P Device Address to AP-STA-CONNECTED eventJithu Jance2011-10-251-3/+18
| | | | | | | | | | | | | | | For P2P, the p2p_connect takes in device address argument to make a connection. However the connected event AP-STA-CONNECTED comes with interface address. The application listening on events would find it difficult to map interface address to the p2p device address which is provided for connection. Append P2P Device Address to AP-STA-CONNECTED event for P2P Client connection. This will help applications to easily map the P2P Interface Address to P2P Device Address on CONNECTED event. For non-P2P case, it will just print the usual STA MAC address alone. Signed-off-by: Jithu Jance <jithu@broadcom.com>
* Fix typo in comment related to EAPOLBen Greear2011-10-221-1/+1
| | | | Signed-off-by: Ben Greear <greearb@candelatech.com>
* Fix NT-hash password use with integrated authentication serverB. J2011-10-151-0/+1
| | | | | | The password_hash parameter was not copied in case of the integrated authentication server (but was for RADIUS server). This broke EAP authentication when the user entry used NT-hash.
* EAPOL auth: Disconnect after IEEE 802.1X failureJouni Malinen2011-10-121-6/+9
| | | | | | | | | | | | | The EAPOL authenticator was previously forcing disconnection in the WPS use case. However, this can be benefitial operation with any IEEE 802.1X authentication mechanism and need not be limited to WPS. This helps some use cases like EAP-FAST where provisioning may require two authentication runs if the authentication server does not allow the PAC provisioning step to be used for normal data connection. While the station would be free to decide to re-associate in such a case, not all stations do and as such, it helps if the AP does that instead of leaving the association up with EAPOL state machine in HELD state for 60 seconds.
* Remove references to time_t/time()Per Ekman2011-09-121-2/+3
| | | | Use os_time() in AP mode instead of direct time() calls.
* WPS: Wait for EAPOL-Start unless WPS 2.0 station as workaroundJouni Malinen2011-08-281-11/+24
| | | | | | | | | | | Extend the code that waits for the station to send EAPOL-Start before initiating EAPOL authenticator operations to cover the case where the station includes WPS IE in (Re)Association Request frame if that IE does not include support for WPS 2.0. While this should not really be needed, this may help with some deployed WPS 1.0 stations that do not support EAPOL operations correctly and may get confused of the EAP-Request/Identity packets that would show up twice if EAPOL-Start is transmitted.
* Remove a compiler warning on uninitialized variableJouni Malinen2011-06-211-0/+1
| | | | | This is not really ever used, but better keep the compiler output cleaner.
* WPS: Add a workaround for Windows 7 capability discovery for PBCJouni Malinen2011-05-171-0/+1
| | | | | | | | | | | | Windows 7 uses incorrect way of figuring out AP's WPS capabilities by acting as a Registrar and using M1 from the AP. The config methods attribute in that message is supposed to indicate only the configuration method supported by the AP in Enrollee role, i.e., to add an external Registrar. For that case, PBC shall not be used and as such, the PushButton config method is removed from M1 by default. If pbc_in_m1=1 is included in the configuration file, the PushButton config method is left in M1 (if included in config_methods parameter) to allow Windows 7 to use PBC instead of PIN (e.g., from a label in the AP).
* Fix WPS AP mode regressionJouni Malinen2011-04-111-5/+24
| | | | | | | | | Commit 03d3f28a698ec2c269fed35b88be30373595eee2 broke initialization of EAPOL authenticator state machines since an error value from wpa_auth_sta_key_mgmt() (-1) was not handled properly and the fixed wpa_key_mgmt_wpa_psk() identified the value as a PSK-based AKM because of all bits being set to 1. The special error value needs to handled separately to avoid skipping EAPOL state machine initialization.
* nl80211: Send EAPOL frames as QoS data frames for QoS aware clientsFelix Fietkau2011-04-021-1/+1
| | | | | | | | | | | This should fix EAPOL reauthentication and rekeying timeout issues with Intel clients when using WMM (e.g., with IEEE 802.11n). These stations do not seem to be able to handle EAPOL data frames as non-QoS Data frames after the initial setup. This adds STA flags to hapd_send_eapol() driver op to allow driver_nl80211.c to mark the EAPOL frames as QoS Data frame when injecting it through the monitor interface.
* Work around SNonce updates on EAPOL-Key 1/4 retransmissionJouni Malinen2011-03-291-0/+10
| | | | | | | | | | | | | | | | | | | | Some deployed supplicants update their SNonce for every receive EAPOL-Key message 1/4 even when these messages happen during the same 4-way handshake. Furthermore, some of these supplicants fail to use the first SNonce that they sent and derive an incorrect PTK using another SNonce that does not match with what the authenticator is using from the first received message 2/4. This results in failed 4-way handshake whenever the EAPOL-Key 1/4 retransmission timeout is reached. The timeout for the first retry is fixed to 100 ms in the IEEE 802.11 standard and that seems to be short enough to make it difficult for some stations to get the response out before retransmission. Work around this issue by increasing the initial EAPOL-Key 1/4 timeout by 1000 ms (i.e., total timeout of 1100 ms) if the station acknowledges reception of the EAPOL-Key frame. If the driver does not indicate TX status for EAPOL frames, use longer initial timeout (1000 ms) unconditionally.
* FT: Fix FT-EAP to set EAPOL Authenticator into authenticated stateJouni Malinen2011-02-201-1/+20
| | | | | This is needed to avoid the EAPOL Authenticator from trying to start new authentication when FT protocol is used. [Bug 384]
* AP: Introduce sta authorized wrappersJohannes Berg2011-02-021-6/+5
| | | | | | | | To enable making state change notifications on the WLAN_STA_AUTHORIZED flag, introduce ap_sta_set_authorized(), and to reduce use of the flag itself also add a wrapper for testing the flag: ap_sta_is_authorized(). Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* Use set_key addr to distinguish default and multicast keysJouni Malinen2011-01-091-2/+4
| | | | | | | | Previously, both NULL and ff:ff:ff:ff:ff:ff addr were used in various places to indicate default/broadcast keys. Make this more consistent and useful by defining NULL to mean default key (i.e., used both for unicast and broadcast) and ff:ff:ff:ff:ff:ff to indicate broadcast key (i.e., used only with broadcast).
* Get rid of struct hostapd_driver_ops abstractionJouni Malinen2010-11-241-5/+5
| | | | | | This is not needed anymore and just makes things more difficult to understand, so move the remaining function pointers to direct function calls and get rid of the struct hostapd_driver_ops.
* hostapd_driver_ops reductionJouni Malinen2010-11-241-13/+16
| | | | | | send_eapol, set_key, read_sta_data, sta_clear_stats, set_radius_acl_auth, set_radius_acl_expire, and set_beacon to use inline functions instead of extra abstraction.
* Fix memory leak on EAPOL Authenticator error pathMasashi Honma2010-11-241-1/+3
| | | | | | | | | | | | | | wlan0: RADIUS No authentication server configured MEMLEAK[0x999feb8]: len 1040 WPA_TRACE: memleak - START [3]: ./hostapd(radius_msg_new+0x33) [0x8074f43] radius_msg_new() ../src/radius/radius.c:117 [4]: ./hostapd() [0x806095e] ieee802_1x_encapsulate_radius() ../src/ap/ieee802_1x.c:439 ieee802_1x_aaa_send() ../src/ap/ieee802_1x.c:1496 For example, this error occured when I used WPS hostapd without "eap_server=1" definition in configuration file.
* Annotate places depending on strong random numbersJouni Malinen2010-11-241-5/+7
| | | | | | | | | | | | | This commit adds a new wrapper, random_get_bytes(), that is currently defined to use os_get_random() as is. The places using random_get_bytes() depend on the returned value being strong random number, i.e., something that is infeasible for external device to figure out. These values are used either directly as a key or as nonces/challenges that are used as input for key derivation or authentication. The remaining direct uses of os_get_random() do not need as strong random numbers to function correctly.
* Fix EAP standalone serverJouni Malinen2010-11-071-0/+2
| | | | | | | | | Commit c3fc47ea8e1d3730e11eb9978d13831212727902 fixed EAP passthrough server to allow Logoff/Re-authentication to be used. However, it broke EAP standalone server while doing that. Fix this by reverting the earlier fix and by clearing the EAP Identity information in the EAP server code whenever an EAPOL-Start or EAPOL-Logoff packet is received.
* Allow EAPOL frames from pre-authenticating station to be processedJouni Malinen2010-10-271-2/+2
|
* EAP-pwd: Add support for EAP-pwd server and peer functionalityDan Harkins2010-09-141-0/+1
| | | | | This adds an initial EAP-pwd (RFC 5931) implementation. For now, this requires OpenSSL.
* P2P: Use PSK format in WPS CredentialJouni Malinen2010-09-091-1/+1
|
* EAP server: Add support for configuring fragment sizeJouni Malinen2010-07-201-0/+1
|
* WPS: Move from WLAN_STA_MAYBE_WPS to WLAN_STA_WPS based on EAP messagesJouni Malinen2010-07-181-0/+25
| | | | | | | If the station does not include WSC IE in Association Request, it is marked with WLAN_STA_MAYBE_WPS flag. We can update that to WLAN_STA_WPS if the station uses either of the WPS identity strings. This enables some workarounds for WPS stations.
* WPS: Force disconnection after provisioning stepJouni Malinen2010-07-181-0/+19
| | | | | This works around some problems where the station is unable to disconnect for some reason (e.g., if EAP-Failure gets dropped).
* Fix EAPOL_SM_USES_WPA flag to be set correctlyJouni Malinen2010-05-011-2/+1
| | | | | | | | | | | Commit c02d52b405fb017e1eec80082dbe433fec53d9c2 removed direct calls to the WPA authenticator, but the change here was incorrect. EAPOL_SM_USES_WPA was supposed to be set based on sta->wpa_sm being set, i.e., no need to check for PMKSA entries for that. While this could potentially change EAPOL Key TX state machine behavior, no clear problems have been identified so far. Anyway, better fix this to get the correct flags set for EAPOL authenticator state machine.
* Stop processing if STA VLAN bind failsJouni Malinen2010-04-151-1/+2
|
* AP: Add wpa_msg() events for EAP server state machineGregory Detal2010-04-071-0/+1
|
* Rename some src/ap files to avoid duplicate file namesJouni Malinen2009-12-261-9/+9
| | | | | | Doxygen and some build tools may get a bit confused about same file name being used in different directories. Clean this up a bit by renaming some of the duplicated file names in src/ap.
* Move generic AP functionality implementation into src/apJouni Malinen2009-12-251-0/+1980
This code can be shared by both hostapd and wpa_supplicant and this is an initial step in getting the generic code moved to be under the src directories. Couple of generic files still remain under the hostapd directory due to direct dependencies to files there. Once the dependencies have been removed, they will also be moved to the src/ap directory to allow wpa_supplicant to be built without requiring anything from the hostapd directory.
generated by cgit v1.1 at 2024-05-18 14:43:20 +0000