package/network/services/hostapd/patches/006-Prevent-reinstallation-of-an-already-in-use-group-ke.patch

   1 From: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
   2 Date: Wed, 12 Jul 2017 16:03:24 +0200
   3 Subject: [PATCH] Prevent reinstallation of an already in-use group key
   4
   5 Track the current GTK and IGTK that is in use and when receiving a
   6 (possibly retransmitted) Group Message 1 or WNM-Sleep Mode Response, do
   7 not install the given key if it is already in use. This prevents an
   8 attacker from trying to trick the client into resetting or lowering the
   9 sequence counter associated to the group key.
  10
  11 Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
  12 ---
  13
  14 --- a/src/common/wpa_common.h
  15 +++ b/src/common/wpa_common.h
  16 @@ -207,6 +207,17 @@ struct wpa_ptk {
  17         size_t tk_len;
  18  };
  19
  20 +struct wpa_gtk {
  21 +       u8 gtk[WPA_GTK_MAX_LEN];
  22 +       size_t gtk_len;
  23 +};
  24 +
  25 +#ifdef CONFIG_IEEE80211W
  26 +struct wpa_igtk {
  27 +       u8 igtk[WPA_IGTK_MAX_LEN];
  28 +       size_t igtk_len;
  29 +};
  30 +#endif /* CONFIG_IEEE80211W */
  31
  32  /* WPA IE version 1
  33   * 00-50-f2:1 (OUI:OUI type)
  34 --- a/src/rsn_supp/wpa.c
  35 +++ b/src/rsn_supp/wpa.c
  36 @@ -785,6 +785,15 @@ static int wpa_supplicant_install_gtk(st
  37         const u8 *_gtk = gd->gtk;
  38         u8 gtk_buf[32];
  39
  40 +       /* Detect possible key reinstallation */
  41 +       if (sm->gtk.gtk_len == (size_t) gd->gtk_len &&
  42 +           os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) {
  43 +               wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
  44 +                       "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)",
  45 +                       gd->keyidx, gd->tx, gd->gtk_len);
  46 +               return 0;
  47 +       }
  48 +
  49         wpa_hexdump_key(MSG_DEBUG, "WPA: Group Key", gd->gtk, gd->gtk_len);
  50         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
  51                 "WPA: Installing GTK to the driver (keyidx=%d tx=%d len=%d)",
  52 @@ -819,6 +828,9 @@ static int wpa_supplicant_install_gtk(st
  53         }
  54         os_memset(gtk_buf, 0, sizeof(gtk_buf));
  55
  56 +       sm->gtk.gtk_len = gd->gtk_len;
  57 +       os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
  58 +
  59         return 0;
  60  }
  61
  62 @@ -925,6 +937,48 @@ static int wpa_supplicant_pairwise_gtk(s
  63  }
  64
  65
  66 +#ifdef CONFIG_IEEE80211W
  67 +static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
  68 +                                      const struct wpa_igtk_kde *igtk)
  69 +{
  70 +       size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
  71 +       u16 keyidx = WPA_GET_LE16(igtk->keyid);
  72 +
  73 +       /* Detect possible key reinstallation */
  74 +       if (sm->igtk.igtk_len == len &&
  75 +           os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) {
  76 +               wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
  77 +                       "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)",
  78 +                       keyidx);
  79 +               return  0;
  80 +       }
  81 +
  82 +       wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
  83 +               "WPA: IGTK keyid %d pn %02x%02x%02x%02x%02x%02x",
  84 +               keyidx, MAC2STR(igtk->pn));
  85 +       wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", igtk->igtk, len);
  86 +       if (keyidx > 4095) {
  87 +               wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
  88 +                       "WPA: Invalid IGTK KeyID %d", keyidx);
  89 +               return -1;
  90 +       }
  91 +       if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
  92 +                          broadcast_ether_addr,
  93 +                          keyidx, 0, igtk->pn, sizeof(igtk->pn),
  94 +                          igtk->igtk, len) < 0) {
  95 +               wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
  96 +                       "WPA: Failed to configure IGTK to the driver");
  97 +               return -1;
  98 +       }
  99 +
 100 +       sm->igtk.igtk_len = len;
 101 +       os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
 102 +
 103 +       return 0;
 104 +}
 105 +#endif /* CONFIG_IEEE80211W */
 106 +
 107 +
 108  static int ieee80211w_set_keys(struct wpa_sm *sm,
 109                                struct wpa_eapol_ie_parse *ie)
 110  {
 111 @@ -935,30 +989,14 @@ static int ieee80211w_set_keys(struct wp
 112         if (ie->igtk) {
 113                 size_t len;
 114                 const struct wpa_igtk_kde *igtk;
 115 -               u16 keyidx;
 116 +
 117                 len = wpa_cipher_key_len(sm->mgmt_group_cipher);
 118                 if (ie->igtk_len != WPA_IGTK_KDE_PREFIX_LEN + len)
 119                         return -1;
 120 +
 121                 igtk = (const struct wpa_igtk_kde *) ie->igtk;
 122 -               keyidx = WPA_GET_LE16(igtk->keyid);
 123 -               wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: IGTK keyid %d "
 124 -                       "pn %02x%02x%02x%02x%02x%02x",
 125 -                       keyidx, MAC2STR(igtk->pn));
 126 -               wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK",
 127 -                               igtk->igtk, len);
 128 -               if (keyidx > 4095) {
 129 -                       wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
 130 -                               "WPA: Invalid IGTK KeyID %d", keyidx);
 131 +               if (wpa_supplicant_install_igtk(sm, igtk) < 0)
 132                         return -1;
 133 -               }
 134 -               if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
 135 -                                  broadcast_ether_addr,
 136 -                                  keyidx, 0, igtk->pn, sizeof(igtk->pn),
 137 -                                  igtk->igtk, len) < 0) {
 138 -                       wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
 139 -                               "WPA: Failed to configure IGTK to the driver");
 140 -                       return -1;
 141 -               }
 142         }
 143
 144         return 0;
 145 @@ -2451,7 +2489,7 @@ void wpa_sm_deinit(struct wpa_sm *sm)
 146   */
 147  void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
 148  {
 149 -       int clear_ptk = 1;
 150 +       int clear_keys = 1;
 151
 152         if (sm == NULL)
 153                 return;
 154 @@ -2477,7 +2515,7 @@ void wpa_sm_notify_assoc(struct wpa_sm *
 155                 /* Prepare for the next transition */
 156                 wpa_ft_prepare_auth_request(sm, NULL);
 157
 158 -               clear_ptk = 0;
 159 +               clear_keys = 0;
 160         }
 161  #endif /* CONFIG_IEEE80211R */
 162  #ifdef CONFIG_FILS
 163 @@ -2487,11 +2525,11 @@ void wpa_sm_notify_assoc(struct wpa_sm *
 164                  * AUTHENTICATED state to get the EAPOL port Authorized.
 165                  */
 166                 wpa_supplicant_key_neg_complete(sm, sm->bssid, 1);
 167 -               clear_ptk = 0;
 168 +               clear_keys = 0;
 169         }
 170  #endif /* CONFIG_FILS */
 171
 172 -       if (clear_ptk) {
 173 +       if (clear_keys) {
 174                 /*
 175                  * IEEE 802.11, 8.4.10: Delete PTK SA on (re)association if
 176                  * this is not part of a Fast BSS Transition.
 177 @@ -2501,6 +2539,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *
 178                 os_memset(&sm->ptk, 0, sizeof(sm->ptk));
 179                 sm->tptk_set = 0;
 180                 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
 181 +               os_memset(&sm->gtk, 0, sizeof(sm->gtk));
 182 +#ifdef CONFIG_IEEE80211W
 183 +               os_memset(&sm->igtk, 0, sizeof(sm->igtk));
 184 +#endif /* CONFIG_IEEE80211W */
 185         }
 186
 187  #ifdef CONFIG_TDLS
 188 @@ -3052,6 +3094,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm)
 189         os_memset(sm->pmk, 0, sizeof(sm->pmk));
 190         os_memset(&sm->ptk, 0, sizeof(sm->ptk));
 191         os_memset(&sm->tptk, 0, sizeof(sm->tptk));
 192 +       os_memset(&sm->gtk, 0, sizeof(sm->gtk));
 193 +#ifdef CONFIG_IEEE80211W
 194 +       os_memset(&sm->igtk, 0, sizeof(sm->igtk));
 195 +#endif /* CONFIG_IEEE80211W */
 196  #ifdef CONFIG_IEEE80211R
 197         os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
 198         os_memset(sm->pmk_r0, 0, sizeof(sm->pmk_r0));
 199 @@ -3124,29 +3170,11 @@ int wpa_wnmsleep_install_key(struct wpa_
 200                 os_memset(&gd, 0, sizeof(gd));
 201  #ifdef CONFIG_IEEE80211W
 202         } else if (subelem_id == WNM_SLEEP_SUBELEM_IGTK) {
 203 -               struct wpa_igtk_kde igd;
 204 -               u16 keyidx;
 205 +               const struct wpa_igtk_kde *igtk;
 206
 207 -               os_memset(&igd, 0, sizeof(igd));
 208 -               keylen = wpa_cipher_key_len(sm->mgmt_group_cipher);
 209 -               os_memcpy(igd.keyid, buf + 2, 2);
 210 -               os_memcpy(igd.pn, buf + 4, 6);
 211 -
 212 -               keyidx = WPA_GET_LE16(igd.keyid);
 213 -               os_memcpy(igd.igtk, buf + 10, keylen);
 214 -
 215 -               wpa_hexdump_key(MSG_DEBUG, "Install IGTK (WNM SLEEP)",
 216 -                               igd.igtk, keylen);
 217 -               if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
 218 -                                  broadcast_ether_addr,
 219 -                                  keyidx, 0, igd.pn, sizeof(igd.pn),
 220 -                                  igd.igtk, keylen) < 0) {
 221 -                       wpa_printf(MSG_DEBUG, "Failed to install the IGTK in "
 222 -                                  "WNM mode");
 223 -                       os_memset(&igd, 0, sizeof(igd));
 224 +               igtk = (const struct wpa_igtk_kde *) (buf + 2);
 225 +               if (wpa_supplicant_install_igtk(sm, igtk) < 0)
 226                         return -1;
 227 -               }
 228 -               os_memset(&igd, 0, sizeof(igd));
 229  #endif /* CONFIG_IEEE80211W */
 230         } else {
 231                 wpa_printf(MSG_DEBUG, "Unknown element id");
 232 --- a/src/rsn_supp/wpa_i.h
 233 +++ b/src/rsn_supp/wpa_i.h
 234 @@ -31,6 +31,10 @@ struct wpa_sm {
 235         u8 rx_replay_counter[WPA_REPLAY_COUNTER_LEN];
 236         int rx_replay_counter_set;
 237         u8 request_counter[WPA_REPLAY_COUNTER_LEN];
 238 +       struct wpa_gtk gtk;
 239 +#ifdef CONFIG_IEEE80211W
 240 +       struct wpa_igtk igtk;
 241 +#endif /* CONFIG_IEEE80211W */
 242
 243         struct eapol_sm *eapol; /* EAPOL state machine from upper level code */
 244