1 From: Jouni Malinen <j@w1.fi>
2 Date: Sun, 1 Oct 2017 12:12:24 +0300
3 Subject: [PATCH] Extend protection of GTK/IGTK reinstallation of WNM-Sleep
6 This extends the protection to track last configured GTK/IGTK value
7 separately from EAPOL-Key frames and WNM-Sleep Mode frames to cover a
8 corner case where these two different mechanisms may get used when the
9 GTK/IGTK has changed and tracking a single value is not sufficient to
10 detect a possible key reconfiguration.
12 Signed-off-by: Jouni Malinen <j@w1.fi>
15 --- a/src/rsn_supp/wpa.c
16 +++ b/src/rsn_supp/wpa.c
17 @@ -780,14 +780,17 @@ struct wpa_gtk_data {
19 static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
20 const struct wpa_gtk_data *gd,
22 + const u8 *key_rsc, int wnm_sleep)
24 const u8 *_gtk = gd->gtk;
27 /* Detect possible key reinstallation */
28 - if (sm->gtk.gtk_len == (size_t) gd->gtk_len &&
29 - os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) {
30 + if ((sm->gtk.gtk_len == (size_t) gd->gtk_len &&
31 + os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) ||
32 + (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len &&
33 + os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk,
34 + sm->gtk_wnm_sleep.gtk_len) == 0)) {
35 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
36 "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)",
37 gd->keyidx, gd->tx, gd->gtk_len);
38 @@ -828,8 +831,14 @@ static int wpa_supplicant_install_gtk(st
40 os_memset(gtk_buf, 0, sizeof(gtk_buf));
42 - sm->gtk.gtk_len = gd->gtk_len;
43 - os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
45 + sm->gtk_wnm_sleep.gtk_len = gd->gtk_len;
46 + os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk,
47 + sm->gtk_wnm_sleep.gtk_len);
49 + sm->gtk.gtk_len = gd->gtk_len;
50 + os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
55 @@ -923,7 +932,7 @@ static int wpa_supplicant_pairwise_gtk(s
56 (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
58 &gd.key_rsc_len, &gd.alg) ||
59 - wpa_supplicant_install_gtk(sm, &gd, key_rsc))) {
60 + wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) {
61 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
62 "RSN: Failed to install GTK");
63 os_memset(&gd, 0, sizeof(gd));
64 @@ -939,14 +948,18 @@ static int wpa_supplicant_pairwise_gtk(s
66 #ifdef CONFIG_IEEE80211W
67 static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
68 - const struct wpa_igtk_kde *igtk)
69 + const struct wpa_igtk_kde *igtk,
72 size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
73 u16 keyidx = WPA_GET_LE16(igtk->keyid);
75 /* Detect possible key reinstallation */
76 - if (sm->igtk.igtk_len == len &&
77 - os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) {
78 + if ((sm->igtk.igtk_len == len &&
79 + os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) ||
80 + (sm->igtk_wnm_sleep.igtk_len == len &&
81 + os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk,
82 + sm->igtk_wnm_sleep.igtk_len) == 0)) {
83 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
84 "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)",
86 @@ -971,8 +984,14 @@ static int wpa_supplicant_install_igtk(s
90 - sm->igtk.igtk_len = len;
91 - os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
93 + sm->igtk_wnm_sleep.igtk_len = len;
94 + os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk,
95 + sm->igtk_wnm_sleep.igtk_len);
97 + sm->igtk.igtk_len = len;
98 + os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
103 @@ -995,7 +1014,7 @@ static int ieee80211w_set_keys(struct wp
106 igtk = (const struct wpa_igtk_kde *) ie->igtk;
107 - if (wpa_supplicant_install_igtk(sm, igtk) < 0)
108 + if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0)
112 @@ -1641,7 +1660,7 @@ static void wpa_supplicant_process_1_of_
113 if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
116 - if (wpa_supplicant_install_gtk(sm, &gd, key_rsc) ||
117 + if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) ||
118 wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0)
120 os_memset(&gd, 0, sizeof(gd));
121 @@ -2540,8 +2559,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *
123 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
124 os_memset(&sm->gtk, 0, sizeof(sm->gtk));
125 + os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
126 #ifdef CONFIG_IEEE80211W
127 os_memset(&sm->igtk, 0, sizeof(sm->igtk));
128 + os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
129 #endif /* CONFIG_IEEE80211W */
132 @@ -3095,8 +3116,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm)
133 os_memset(&sm->ptk, 0, sizeof(sm->ptk));
134 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
135 os_memset(&sm->gtk, 0, sizeof(sm->gtk));
136 + os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
137 #ifdef CONFIG_IEEE80211W
138 os_memset(&sm->igtk, 0, sizeof(sm->igtk));
139 + os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
140 #endif /* CONFIG_IEEE80211W */
141 #ifdef CONFIG_IEEE80211R
142 os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
143 @@ -3161,7 +3184,7 @@ int wpa_wnmsleep_install_key(struct wpa_
145 wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)",
147 - if (wpa_supplicant_install_gtk(sm, &gd, key_rsc)) {
148 + if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) {
149 os_memset(&gd, 0, sizeof(gd));
150 wpa_printf(MSG_DEBUG, "Failed to install the GTK in "
152 @@ -3173,7 +3196,7 @@ int wpa_wnmsleep_install_key(struct wpa_
153 const struct wpa_igtk_kde *igtk;
155 igtk = (const struct wpa_igtk_kde *) (buf + 2);
156 - if (wpa_supplicant_install_igtk(sm, igtk) < 0)
157 + if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0)
159 #endif /* CONFIG_IEEE80211W */
161 --- a/src/rsn_supp/wpa_i.h
162 +++ b/src/rsn_supp/wpa_i.h
163 @@ -32,8 +32,10 @@ struct wpa_sm {
164 int rx_replay_counter_set;
165 u8 request_counter[WPA_REPLAY_COUNTER_LEN];
167 + struct wpa_gtk gtk_wnm_sleep;
168 #ifdef CONFIG_IEEE80211W
169 struct wpa_igtk igtk;
170 + struct wpa_igtk igtk_wnm_sleep;
171 #endif /* CONFIG_IEEE80211W */
173 struct eapol_sm *eapol; /* EAPOL state machine from upper level code */