wok-next rev 20090
wpa_supplicant: security fix for KRACK (thanks mojo)
line diff
1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000 1.2 +++ b/wpa_supplicant/stuff/patches/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch Sat Oct 28 11:29:09 2017 +0200 1.3 @@ -0,0 +1,174 @@ 1.4 +From cf4cab804c7afd5c45505528a8d16e46163243a2 Mon Sep 17 00:00:00 2001 1.5 +From: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be> 1.6 +Date: Fri, 14 Jul 2017 15:15:35 +0200 1.7 +Subject: [PATCH 1/8] hostapd: Avoid key reinstallation in FT handshake 1.8 + 1.9 +Do not reinstall TK to the driver during Reassociation Response frame 1.10 +processing if the first attempt of setting the TK succeeded. This avoids 1.11 +issues related to clearing the TX/RX PN that could result in reusing 1.12 +same PN values for transmitted frames (e.g., due to CCM nonce reuse and 1.13 +also hitting replay protection on the receiver) and accepting replayed 1.14 +frames on RX side. 1.15 + 1.16 +This issue was introduced by the commit 1.17 +0e84c25434e6a1f283c7b4e62e483729085b78d2 ('FT: Fix PTK configuration in 1.18 +authenticator') which allowed wpa_ft_install_ptk() to be called multiple 1.19 +times with the same PTK. While the second configuration attempt is 1.20 +needed with some drivers, it must be done only if the first attempt 1.21 +failed. 1.22 + 1.23 +Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be> 1.24 +--- 1.25 + src/ap/ieee802_11.c | 16 +++++++++++++--- 1.26 + src/ap/wpa_auth.c | 11 +++++++++++ 1.27 + src/ap/wpa_auth.h | 3 ++- 1.28 + src/ap/wpa_auth_ft.c | 10 ++++++++++ 1.29 + src/ap/wpa_auth_i.h | 1 + 1.30 + 5 files changed, 37 insertions(+), 4 deletions(-) 1.31 + 1.32 +diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c 1.33 +index 4e04169..333035f 100644 1.34 +--- a/src/ap/ieee802_11.c 1.35 ++++ b/src/ap/ieee802_11.c 1.36 +@@ -1841,6 +1841,7 @@ static int add_associated_sta(struct hostapd_data *hapd, 1.37 + { 1.38 + struct ieee80211_ht_capabilities ht_cap; 1.39 + struct ieee80211_vht_capabilities vht_cap; 1.40 ++ int set = 1; 1.41 + 1.42 + /* 1.43 + * Remove the STA entry to ensure the STA PS state gets cleared and 1.44 +@@ -1848,9 +1849,18 @@ static int add_associated_sta(struct hostapd_data *hapd, 1.45 + * FT-over-the-DS, where a station re-associates back to the same AP but 1.46 + * skips the authentication flow, or if working with a driver that 1.47 + * does not support full AP client state. 1.48 ++ * 1.49 ++ * Skip this if the STA has already completed FT reassociation and the 1.50 ++ * TK has been configured since the TX/RX PN must not be reset to 0 for 1.51 ++ * the same key. 1.52 + */ 1.53 +- if (!sta->added_unassoc) 1.54 ++ if (!sta->added_unassoc && 1.55 ++ (!(sta->flags & WLAN_STA_AUTHORIZED) || 1.56 ++ !wpa_auth_sta_ft_tk_already_set(sta->wpa_sm))) { 1.57 + hostapd_drv_sta_remove(hapd, sta->addr); 1.58 ++ wpa_auth_sm_event(sta->wpa_sm, WPA_DRV_STA_REMOVED); 1.59 ++ set = 0; 1.60 ++ } 1.61 + 1.62 + #ifdef CONFIG_IEEE80211N 1.63 + if (sta->flags & WLAN_STA_HT) 1.64 +@@ -1873,11 +1883,11 @@ static int add_associated_sta(struct hostapd_data *hapd, 1.65 + sta->flags & WLAN_STA_VHT ? &vht_cap : NULL, 1.66 + sta->flags | WLAN_STA_ASSOC, sta->qosinfo, 1.67 + sta->vht_opmode, sta->p2p_ie ? 1 : 0, 1.68 +- sta->added_unassoc)) { 1.69 ++ set)) { 1.70 + hostapd_logger(hapd, sta->addr, 1.71 + HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_NOTICE, 1.72 + "Could not %s STA to kernel driver", 1.73 +- sta->added_unassoc ? "set" : "add"); 1.74 ++ set ? "set" : "add"); 1.75 + 1.76 + if (sta->added_unassoc) { 1.77 + hostapd_drv_sta_remove(hapd, sta->addr); 1.78 +diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c 1.79 +index 3587086..707971d 100644 1.80 +--- a/src/ap/wpa_auth.c 1.81 ++++ b/src/ap/wpa_auth.c 1.82 +@@ -1745,6 +1745,9 @@ int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event) 1.83 + #else /* CONFIG_IEEE80211R */ 1.84 + break; 1.85 + #endif /* CONFIG_IEEE80211R */ 1.86 ++ case WPA_DRV_STA_REMOVED: 1.87 ++ sm->tk_already_set = FALSE; 1.88 ++ return 0; 1.89 + } 1.90 + 1.91 + #ifdef CONFIG_IEEE80211R 1.92 +@@ -3250,6 +3253,14 @@ int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm) 1.93 + } 1.94 + 1.95 + 1.96 ++int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm) 1.97 ++{ 1.98 ++ if (!sm || !wpa_key_mgmt_ft(sm->wpa_key_mgmt)) 1.99 ++ return 0; 1.100 ++ return sm->tk_already_set; 1.101 ++} 1.102 ++ 1.103 ++ 1.104 + int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm, 1.105 + struct rsn_pmksa_cache_entry *entry) 1.106 + { 1.107 +diff --git a/src/ap/wpa_auth.h b/src/ap/wpa_auth.h 1.108 +index 0de8d97..97461b0 100644 1.109 +--- a/src/ap/wpa_auth.h 1.110 ++++ b/src/ap/wpa_auth.h 1.111 +@@ -267,7 +267,7 @@ void wpa_receive(struct wpa_authenticator *wpa_auth, 1.112 + u8 *data, size_t data_len); 1.113 + enum wpa_event { 1.114 + WPA_AUTH, WPA_ASSOC, WPA_DISASSOC, WPA_DEAUTH, WPA_REAUTH, 1.115 +- WPA_REAUTH_EAPOL, WPA_ASSOC_FT 1.116 ++ WPA_REAUTH_EAPOL, WPA_ASSOC_FT, WPA_DRV_STA_REMOVED 1.117 + }; 1.118 + void wpa_remove_ptk(struct wpa_state_machine *sm); 1.119 + int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event); 1.120 +@@ -280,6 +280,7 @@ int wpa_auth_pairwise_set(struct wpa_state_machine *sm); 1.121 + int wpa_auth_get_pairwise(struct wpa_state_machine *sm); 1.122 + int wpa_auth_sta_key_mgmt(struct wpa_state_machine *sm); 1.123 + int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm); 1.124 ++int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm); 1.125 + int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm, 1.126 + struct rsn_pmksa_cache_entry *entry); 1.127 + struct rsn_pmksa_cache_entry * 1.128 +diff --git a/src/ap/wpa_auth_ft.c b/src/ap/wpa_auth_ft.c 1.129 +index 42242a5..e63b99a 100644 1.130 +--- a/src/ap/wpa_auth_ft.c 1.131 ++++ b/src/ap/wpa_auth_ft.c 1.132 +@@ -780,6 +780,14 @@ void wpa_ft_install_ptk(struct wpa_state_machine *sm) 1.133 + return; 1.134 + } 1.135 + 1.136 ++ if (sm->tk_already_set) { 1.137 ++ /* Must avoid TK reconfiguration to prevent clearing of TX/RX 1.138 ++ * PN in the driver */ 1.139 ++ wpa_printf(MSG_DEBUG, 1.140 ++ "FT: Do not re-install same PTK to the driver"); 1.141 ++ return; 1.142 ++ } 1.143 ++ 1.144 + /* FIX: add STA entry to kernel/driver here? The set_key will fail 1.145 + * most likely without this.. At the moment, STA entry is added only 1.146 + * after association has been completed. This function will be called 1.147 +@@ -792,6 +800,7 @@ void wpa_ft_install_ptk(struct wpa_state_machine *sm) 1.148 + 1.149 + /* FIX: MLME-SetProtection.Request(TA, Tx_Rx) */ 1.150 + sm->pairwise_set = TRUE; 1.151 ++ sm->tk_already_set = TRUE; 1.152 + } 1.153 + 1.154 + 1.155 +@@ -898,6 +907,7 @@ static int wpa_ft_process_auth_req(struct wpa_state_machine *sm, 1.156 + 1.157 + sm->pairwise = pairwise; 1.158 + sm->PTK_valid = TRUE; 1.159 ++ sm->tk_already_set = FALSE; 1.160 + wpa_ft_install_ptk(sm); 1.161 + 1.162 + buflen = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) + 1.163 +diff --git a/src/ap/wpa_auth_i.h b/src/ap/wpa_auth_i.h 1.164 +index 72b7eb3..7fd8f05 100644 1.165 +--- a/src/ap/wpa_auth_i.h 1.166 ++++ b/src/ap/wpa_auth_i.h 1.167 +@@ -65,6 +65,7 @@ struct wpa_state_machine { 1.168 + struct wpa_ptk PTK; 1.169 + Boolean PTK_valid; 1.170 + Boolean pairwise_set; 1.171 ++ Boolean tk_already_set; 1.172 + int keycount; 1.173 + Boolean Pair; 1.174 + struct wpa_key_replay_counter { 1.175 +-- 1.176 +2.7.4 1.177 +
2.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000 2.2 +++ b/wpa_supplicant/stuff/patches/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch Sat Oct 28 11:29:09 2017 +0200 2.3 @@ -0,0 +1,250 @@ 2.4 +From 927f891007c402fefd1ff384645b3f07597c3ede Mon Sep 17 00:00:00 2001 2.5 +From: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be> 2.6 +Date: Wed, 12 Jul 2017 16:03:24 +0200 2.7 +Subject: [PATCH 2/8] Prevent reinstallation of an already in-use group key 2.8 + 2.9 +Track the current GTK and IGTK that is in use and when receiving a 2.10 +(possibly retransmitted) Group Message 1 or WNM-Sleep Mode Response, do 2.11 +not install the given key if it is already in use. This prevents an 2.12 +attacker from trying to trick the client into resetting or lowering the 2.13 +sequence counter associated to the group key. 2.14 + 2.15 +Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be> 2.16 +--- 2.17 + src/common/wpa_common.h | 11 +++++ 2.18 + src/rsn_supp/wpa.c | 116 ++++++++++++++++++++++++++++++------------------ 2.19 + src/rsn_supp/wpa_i.h | 4 ++ 2.20 + 3 files changed, 87 insertions(+), 44 deletions(-) 2.21 + 2.22 +diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h 2.23 +index af1d0f0..d200285 100644 2.24 +--- a/src/common/wpa_common.h 2.25 ++++ b/src/common/wpa_common.h 2.26 +@@ -217,6 +217,17 @@ struct wpa_ptk { 2.27 + size_t tk_len; 2.28 + }; 2.29 + 2.30 ++struct wpa_gtk { 2.31 ++ u8 gtk[WPA_GTK_MAX_LEN]; 2.32 ++ size_t gtk_len; 2.33 ++}; 2.34 ++ 2.35 ++#ifdef CONFIG_IEEE80211W 2.36 ++struct wpa_igtk { 2.37 ++ u8 igtk[WPA_IGTK_MAX_LEN]; 2.38 ++ size_t igtk_len; 2.39 ++}; 2.40 ++#endif /* CONFIG_IEEE80211W */ 2.41 + 2.42 + /* WPA IE version 1 2.43 + * 00-50-f2:1 (OUI:OUI type) 2.44 +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c 2.45 +index 3c47879..95bd7be 100644 2.46 +--- a/src/rsn_supp/wpa.c 2.47 ++++ b/src/rsn_supp/wpa.c 2.48 +@@ -714,6 +714,15 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, 2.49 + const u8 *_gtk = gd->gtk; 2.50 + u8 gtk_buf[32]; 2.51 + 2.52 ++ /* Detect possible key reinstallation */ 2.53 ++ if (sm->gtk.gtk_len == (size_t) gd->gtk_len && 2.54 ++ os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) { 2.55 ++ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, 2.56 ++ "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)", 2.57 ++ gd->keyidx, gd->tx, gd->gtk_len); 2.58 ++ return 0; 2.59 ++ } 2.60 ++ 2.61 + wpa_hexdump_key(MSG_DEBUG, "WPA: Group Key", gd->gtk, gd->gtk_len); 2.62 + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, 2.63 + "WPA: Installing GTK to the driver (keyidx=%d tx=%d len=%d)", 2.64 +@@ -748,6 +757,9 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, 2.65 + } 2.66 + os_memset(gtk_buf, 0, sizeof(gtk_buf)); 2.67 + 2.68 ++ sm->gtk.gtk_len = gd->gtk_len; 2.69 ++ os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); 2.70 ++ 2.71 + return 0; 2.72 + } 2.73 + 2.74 +@@ -854,6 +866,48 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, 2.75 + } 2.76 + 2.77 + 2.78 ++#ifdef CONFIG_IEEE80211W 2.79 ++static int wpa_supplicant_install_igtk(struct wpa_sm *sm, 2.80 ++ const struct wpa_igtk_kde *igtk) 2.81 ++{ 2.82 ++ size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher); 2.83 ++ u16 keyidx = WPA_GET_LE16(igtk->keyid); 2.84 ++ 2.85 ++ /* Detect possible key reinstallation */ 2.86 ++ if (sm->igtk.igtk_len == len && 2.87 ++ os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) { 2.88 ++ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, 2.89 ++ "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)", 2.90 ++ keyidx); 2.91 ++ return 0; 2.92 ++ } 2.93 ++ 2.94 ++ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, 2.95 ++ "WPA: IGTK keyid %d pn %02x%02x%02x%02x%02x%02x", 2.96 ++ keyidx, MAC2STR(igtk->pn)); 2.97 ++ wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", igtk->igtk, len); 2.98 ++ if (keyidx > 4095) { 2.99 ++ wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, 2.100 ++ "WPA: Invalid IGTK KeyID %d", keyidx); 2.101 ++ return -1; 2.102 ++ } 2.103 ++ if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher), 2.104 ++ broadcast_ether_addr, 2.105 ++ keyidx, 0, igtk->pn, sizeof(igtk->pn), 2.106 ++ igtk->igtk, len) < 0) { 2.107 ++ wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, 2.108 ++ "WPA: Failed to configure IGTK to the driver"); 2.109 ++ return -1; 2.110 ++ } 2.111 ++ 2.112 ++ sm->igtk.igtk_len = len; 2.113 ++ os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); 2.114 ++ 2.115 ++ return 0; 2.116 ++} 2.117 ++#endif /* CONFIG_IEEE80211W */ 2.118 ++ 2.119 ++ 2.120 + static int ieee80211w_set_keys(struct wpa_sm *sm, 2.121 + struct wpa_eapol_ie_parse *ie) 2.122 + { 2.123 +@@ -864,30 +918,14 @@ static int ieee80211w_set_keys(struct wpa_sm *sm, 2.124 + if (ie->igtk) { 2.125 + size_t len; 2.126 + const struct wpa_igtk_kde *igtk; 2.127 +- u16 keyidx; 2.128 ++ 2.129 + len = wpa_cipher_key_len(sm->mgmt_group_cipher); 2.130 + if (ie->igtk_len != WPA_IGTK_KDE_PREFIX_LEN + len) 2.131 + return -1; 2.132 ++ 2.133 + igtk = (const struct wpa_igtk_kde *) ie->igtk; 2.134 +- keyidx = WPA_GET_LE16(igtk->keyid); 2.135 +- wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: IGTK keyid %d " 2.136 +- "pn %02x%02x%02x%02x%02x%02x", 2.137 +- keyidx, MAC2STR(igtk->pn)); 2.138 +- wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", 2.139 +- igtk->igtk, len); 2.140 +- if (keyidx > 4095) { 2.141 +- wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, 2.142 +- "WPA: Invalid IGTK KeyID %d", keyidx); 2.143 +- return -1; 2.144 +- } 2.145 +- if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher), 2.146 +- broadcast_ether_addr, 2.147 +- keyidx, 0, igtk->pn, sizeof(igtk->pn), 2.148 +- igtk->igtk, len) < 0) { 2.149 +- wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, 2.150 +- "WPA: Failed to configure IGTK to the driver"); 2.151 ++ if (wpa_supplicant_install_igtk(sm, igtk) < 0) 2.152 + return -1; 2.153 +- } 2.154 + } 2.155 + 2.156 + return 0; 2.157 +@@ -2307,7 +2345,7 @@ void wpa_sm_deinit(struct wpa_sm *sm) 2.158 + */ 2.159 + void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) 2.160 + { 2.161 +- int clear_ptk = 1; 2.162 ++ int clear_keys = 1; 2.163 + 2.164 + if (sm == NULL) 2.165 + return; 2.166 +@@ -2333,11 +2371,11 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) 2.167 + /* Prepare for the next transition */ 2.168 + wpa_ft_prepare_auth_request(sm, NULL); 2.169 + 2.170 +- clear_ptk = 0; 2.171 ++ clear_keys = 0; 2.172 + } 2.173 + #endif /* CONFIG_IEEE80211R */ 2.174 + 2.175 +- if (clear_ptk) { 2.176 ++ if (clear_keys) { 2.177 + /* 2.178 + * IEEE 802.11, 8.4.10: Delete PTK SA on (re)association if 2.179 + * this is not part of a Fast BSS Transition. 2.180 +@@ -2347,6 +2385,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) 2.181 + os_memset(&sm->ptk, 0, sizeof(sm->ptk)); 2.182 + sm->tptk_set = 0; 2.183 + os_memset(&sm->tptk, 0, sizeof(sm->tptk)); 2.184 ++ os_memset(&sm->gtk, 0, sizeof(sm->gtk)); 2.185 ++#ifdef CONFIG_IEEE80211W 2.186 ++ os_memset(&sm->igtk, 0, sizeof(sm->igtk)); 2.187 ++#endif /* CONFIG_IEEE80211W */ 2.188 + } 2.189 + 2.190 + #ifdef CONFIG_TDLS 2.191 +@@ -2877,6 +2919,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm) 2.192 + os_memset(sm->pmk, 0, sizeof(sm->pmk)); 2.193 + os_memset(&sm->ptk, 0, sizeof(sm->ptk)); 2.194 + os_memset(&sm->tptk, 0, sizeof(sm->tptk)); 2.195 ++ os_memset(&sm->gtk, 0, sizeof(sm->gtk)); 2.196 ++#ifdef CONFIG_IEEE80211W 2.197 ++ os_memset(&sm->igtk, 0, sizeof(sm->igtk)); 2.198 ++#endif /* CONFIG_IEEE80211W */ 2.199 + #ifdef CONFIG_IEEE80211R 2.200 + os_memset(sm->xxkey, 0, sizeof(sm->xxkey)); 2.201 + os_memset(sm->pmk_r0, 0, sizeof(sm->pmk_r0)); 2.202 +@@ -2949,29 +2995,11 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) 2.203 + os_memset(&gd, 0, sizeof(gd)); 2.204 + #ifdef CONFIG_IEEE80211W 2.205 + } else if (subelem_id == WNM_SLEEP_SUBELEM_IGTK) { 2.206 +- struct wpa_igtk_kde igd; 2.207 +- u16 keyidx; 2.208 +- 2.209 +- os_memset(&igd, 0, sizeof(igd)); 2.210 +- keylen = wpa_cipher_key_len(sm->mgmt_group_cipher); 2.211 +- os_memcpy(igd.keyid, buf + 2, 2); 2.212 +- os_memcpy(igd.pn, buf + 4, 6); 2.213 +- 2.214 +- keyidx = WPA_GET_LE16(igd.keyid); 2.215 +- os_memcpy(igd.igtk, buf + 10, keylen); 2.216 +- 2.217 +- wpa_hexdump_key(MSG_DEBUG, "Install IGTK (WNM SLEEP)", 2.218 +- igd.igtk, keylen); 2.219 +- if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher), 2.220 +- broadcast_ether_addr, 2.221 +- keyidx, 0, igd.pn, sizeof(igd.pn), 2.222 +- igd.igtk, keylen) < 0) { 2.223 +- wpa_printf(MSG_DEBUG, "Failed to install the IGTK in " 2.224 +- "WNM mode"); 2.225 +- os_memset(&igd, 0, sizeof(igd)); 2.226 ++ const struct wpa_igtk_kde *igtk; 2.227 ++ 2.228 ++ igtk = (const struct wpa_igtk_kde *) (buf + 2); 2.229 ++ if (wpa_supplicant_install_igtk(sm, igtk) < 0) 2.230 + return -1; 2.231 +- } 2.232 +- os_memset(&igd, 0, sizeof(igd)); 2.233 + #endif /* CONFIG_IEEE80211W */ 2.234 + } else { 2.235 + wpa_printf(MSG_DEBUG, "Unknown element id"); 2.236 +diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h 2.237 +index f653ba6..afc9e37 100644 2.238 +--- a/src/rsn_supp/wpa_i.h 2.239 ++++ b/src/rsn_supp/wpa_i.h 2.240 +@@ -31,6 +31,10 @@ struct wpa_sm { 2.241 + u8 rx_replay_counter[WPA_REPLAY_COUNTER_LEN]; 2.242 + int rx_replay_counter_set; 2.243 + u8 request_counter[WPA_REPLAY_COUNTER_LEN]; 2.244 ++ struct wpa_gtk gtk; 2.245 ++#ifdef CONFIG_IEEE80211W 2.246 ++ struct wpa_igtk igtk; 2.247 ++#endif /* CONFIG_IEEE80211W */ 2.248 + 2.249 + struct eapol_sm *eapol; /* EAPOL state machine from upper level code */ 2.250 + 2.251 +-- 2.252 +2.7.4 2.253 +
3.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000 3.2 +++ b/wpa_supplicant/stuff/patches/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch Sat Oct 28 11:29:09 2017 +0200 3.3 @@ -0,0 +1,184 @@ 3.4 +From 8280294e74846ea342389a0cd17215050fa5afe8 Mon Sep 17 00:00:00 2001 3.5 +From: Jouni Malinen <j@w1.fi> 3.6 +Date: Sun, 1 Oct 2017 12:12:24 +0300 3.7 +Subject: [PATCH 3/8] Extend protection of GTK/IGTK reinstallation of WNM-Sleep 3.8 + Mode cases 3.9 + 3.10 +This extends the protection to track last configured GTK/IGTK value 3.11 +separately from EAPOL-Key frames and WNM-Sleep Mode frames to cover a 3.12 +corner case where these two different mechanisms may get used when the 3.13 +GTK/IGTK has changed and tracking a single value is not sufficient to 3.14 +detect a possible key reconfiguration. 3.15 + 3.16 +Signed-off-by: Jouni Malinen <j@w1.fi> 3.17 +--- 3.18 + src/rsn_supp/wpa.c | 53 +++++++++++++++++++++++++++++++++++++--------------- 3.19 + src/rsn_supp/wpa_i.h | 2 ++ 3.20 + 2 files changed, 40 insertions(+), 15 deletions(-) 3.21 + 3.22 +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c 3.23 +index 95bd7be..7a2c68d 100644 3.24 +--- a/src/rsn_supp/wpa.c 3.25 ++++ b/src/rsn_supp/wpa.c 3.26 +@@ -709,14 +709,17 @@ struct wpa_gtk_data { 3.27 + 3.28 + static int wpa_supplicant_install_gtk(struct wpa_sm *sm, 3.29 + const struct wpa_gtk_data *gd, 3.30 +- const u8 *key_rsc) 3.31 ++ const u8 *key_rsc, int wnm_sleep) 3.32 + { 3.33 + const u8 *_gtk = gd->gtk; 3.34 + u8 gtk_buf[32]; 3.35 + 3.36 + /* Detect possible key reinstallation */ 3.37 +- if (sm->gtk.gtk_len == (size_t) gd->gtk_len && 3.38 +- os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) { 3.39 ++ if ((sm->gtk.gtk_len == (size_t) gd->gtk_len && 3.40 ++ os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) || 3.41 ++ (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len && 3.42 ++ os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk, 3.43 ++ sm->gtk_wnm_sleep.gtk_len) == 0)) { 3.44 + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, 3.45 + "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)", 3.46 + gd->keyidx, gd->tx, gd->gtk_len); 3.47 +@@ -757,8 +760,14 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, 3.48 + } 3.49 + os_memset(gtk_buf, 0, sizeof(gtk_buf)); 3.50 + 3.51 +- sm->gtk.gtk_len = gd->gtk_len; 3.52 +- os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); 3.53 ++ if (wnm_sleep) { 3.54 ++ sm->gtk_wnm_sleep.gtk_len = gd->gtk_len; 3.55 ++ os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk, 3.56 ++ sm->gtk_wnm_sleep.gtk_len); 3.57 ++ } else { 3.58 ++ sm->gtk.gtk_len = gd->gtk_len; 3.59 ++ os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); 3.60 ++ } 3.61 + 3.62 + return 0; 3.63 + } 3.64 +@@ -852,7 +861,7 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, 3.65 + (wpa_supplicant_check_group_cipher(sm, sm->group_cipher, 3.66 + gtk_len, gtk_len, 3.67 + &gd.key_rsc_len, &gd.alg) || 3.68 +- wpa_supplicant_install_gtk(sm, &gd, key_rsc))) { 3.69 ++ wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) { 3.70 + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, 3.71 + "RSN: Failed to install GTK"); 3.72 + os_memset(&gd, 0, sizeof(gd)); 3.73 +@@ -868,14 +877,18 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, 3.74 + 3.75 + #ifdef CONFIG_IEEE80211W 3.76 + static int wpa_supplicant_install_igtk(struct wpa_sm *sm, 3.77 +- const struct wpa_igtk_kde *igtk) 3.78 ++ const struct wpa_igtk_kde *igtk, 3.79 ++ int wnm_sleep) 3.80 + { 3.81 + size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher); 3.82 + u16 keyidx = WPA_GET_LE16(igtk->keyid); 3.83 + 3.84 + /* Detect possible key reinstallation */ 3.85 +- if (sm->igtk.igtk_len == len && 3.86 +- os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) { 3.87 ++ if ((sm->igtk.igtk_len == len && 3.88 ++ os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) || 3.89 ++ (sm->igtk_wnm_sleep.igtk_len == len && 3.90 ++ os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk, 3.91 ++ sm->igtk_wnm_sleep.igtk_len) == 0)) { 3.92 + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, 3.93 + "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)", 3.94 + keyidx); 3.95 +@@ -900,8 +913,14 @@ static int wpa_supplicant_install_igtk(struct wpa_sm *sm, 3.96 + return -1; 3.97 + } 3.98 + 3.99 +- sm->igtk.igtk_len = len; 3.100 +- os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); 3.101 ++ if (wnm_sleep) { 3.102 ++ sm->igtk_wnm_sleep.igtk_len = len; 3.103 ++ os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk, 3.104 ++ sm->igtk_wnm_sleep.igtk_len); 3.105 ++ } else { 3.106 ++ sm->igtk.igtk_len = len; 3.107 ++ os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); 3.108 ++ } 3.109 + 3.110 + return 0; 3.111 + } 3.112 +@@ -924,7 +943,7 @@ static int ieee80211w_set_keys(struct wpa_sm *sm, 3.113 + return -1; 3.114 + 3.115 + igtk = (const struct wpa_igtk_kde *) ie->igtk; 3.116 +- if (wpa_supplicant_install_igtk(sm, igtk) < 0) 3.117 ++ if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0) 3.118 + return -1; 3.119 + } 3.120 + 3.121 +@@ -1574,7 +1593,7 @@ static void wpa_supplicant_process_1_of_2(struct wpa_sm *sm, 3.122 + if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc)) 3.123 + key_rsc = null_rsc; 3.124 + 3.125 +- if (wpa_supplicant_install_gtk(sm, &gd, key_rsc) || 3.126 ++ if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) || 3.127 + wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0) 3.128 + goto failed; 3.129 + os_memset(&gd, 0, sizeof(gd)); 3.130 +@@ -2386,8 +2405,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) 3.131 + sm->tptk_set = 0; 3.132 + os_memset(&sm->tptk, 0, sizeof(sm->tptk)); 3.133 + os_memset(&sm->gtk, 0, sizeof(sm->gtk)); 3.134 ++ os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep)); 3.135 + #ifdef CONFIG_IEEE80211W 3.136 + os_memset(&sm->igtk, 0, sizeof(sm->igtk)); 3.137 ++ os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep)); 3.138 + #endif /* CONFIG_IEEE80211W */ 3.139 + } 3.140 + 3.141 +@@ -2920,8 +2941,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm) 3.142 + os_memset(&sm->ptk, 0, sizeof(sm->ptk)); 3.143 + os_memset(&sm->tptk, 0, sizeof(sm->tptk)); 3.144 + os_memset(&sm->gtk, 0, sizeof(sm->gtk)); 3.145 ++ os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep)); 3.146 + #ifdef CONFIG_IEEE80211W 3.147 + os_memset(&sm->igtk, 0, sizeof(sm->igtk)); 3.148 ++ os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep)); 3.149 + #endif /* CONFIG_IEEE80211W */ 3.150 + #ifdef CONFIG_IEEE80211R 3.151 + os_memset(sm->xxkey, 0, sizeof(sm->xxkey)); 3.152 +@@ -2986,7 +3009,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) 3.153 + 3.154 + wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)", 3.155 + gd.gtk, gd.gtk_len); 3.156 +- if (wpa_supplicant_install_gtk(sm, &gd, key_rsc)) { 3.157 ++ if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) { 3.158 + os_memset(&gd, 0, sizeof(gd)); 3.159 + wpa_printf(MSG_DEBUG, "Failed to install the GTK in " 3.160 + "WNM mode"); 3.161 +@@ -2998,7 +3021,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) 3.162 + const struct wpa_igtk_kde *igtk; 3.163 + 3.164 + igtk = (const struct wpa_igtk_kde *) (buf + 2); 3.165 +- if (wpa_supplicant_install_igtk(sm, igtk) < 0) 3.166 ++ if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0) 3.167 + return -1; 3.168 + #endif /* CONFIG_IEEE80211W */ 3.169 + } else { 3.170 +diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h 3.171 +index afc9e37..9a54631 100644 3.172 +--- a/src/rsn_supp/wpa_i.h 3.173 ++++ b/src/rsn_supp/wpa_i.h 3.174 +@@ -32,8 +32,10 @@ struct wpa_sm { 3.175 + int rx_replay_counter_set; 3.176 + u8 request_counter[WPA_REPLAY_COUNTER_LEN]; 3.177 + struct wpa_gtk gtk; 3.178 ++ struct wpa_gtk gtk_wnm_sleep; 3.179 + #ifdef CONFIG_IEEE80211W 3.180 + struct wpa_igtk igtk; 3.181 ++ struct wpa_igtk igtk_wnm_sleep; 3.182 + #endif /* CONFIG_IEEE80211W */ 3.183 + 3.184 + struct eapol_sm *eapol; /* EAPOL state machine from upper level code */ 3.185 +-- 3.186 +2.7.4 3.187 +
4.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000 4.2 +++ b/wpa_supplicant/stuff/patches/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch Sat Oct 28 11:29:09 2017 +0200 4.3 @@ -0,0 +1,79 @@ 4.4 +From 8f82bc94e8697a9d47fa8774dfdaaede1084912c Mon Sep 17 00:00:00 2001 4.5 +From: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be> 4.6 +Date: Fri, 29 Sep 2017 04:22:51 +0200 4.7 +Subject: [PATCH 4/8] Prevent installation of an all-zero TK 4.8 + 4.9 +Properly track whether a PTK has already been installed to the driver 4.10 +and the TK part cleared from memory. This prevents an attacker from 4.11 +trying to trick the client into installing an all-zero TK. 4.12 + 4.13 +This fixes the earlier fix in commit 4.14 +ad00d64e7d8827b3cebd665a0ceb08adabf15e1e ('Fix TK configuration to the 4.15 +driver in EAPOL-Key 3/4 retry case') which did not take into account 4.16 +possibility of an extra message 1/4 showing up between retries of 4.17 +message 3/4. 4.18 + 4.19 +Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be> 4.20 +--- 4.21 + src/common/wpa_common.h | 1 + 4.22 + src/rsn_supp/wpa.c | 5 ++--- 4.23 + src/rsn_supp/wpa_i.h | 1 - 4.24 + 3 files changed, 3 insertions(+), 4 deletions(-) 4.25 + 4.26 +diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h 4.27 +index d200285..1021ccb 100644 4.28 +--- a/src/common/wpa_common.h 4.29 ++++ b/src/common/wpa_common.h 4.30 +@@ -215,6 +215,7 @@ struct wpa_ptk { 4.31 + size_t kck_len; 4.32 + size_t kek_len; 4.33 + size_t tk_len; 4.34 ++ int installed; /* 1 if key has already been installed to driver */ 4.35 + }; 4.36 + 4.37 + struct wpa_gtk { 4.38 +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c 4.39 +index 7a2c68d..0550a41 100644 4.40 +--- a/src/rsn_supp/wpa.c 4.41 ++++ b/src/rsn_supp/wpa.c 4.42 +@@ -510,7 +510,6 @@ static void wpa_supplicant_process_1_of_4(struct wpa_sm *sm, 4.43 + os_memset(buf, 0, sizeof(buf)); 4.44 + } 4.45 + sm->tptk_set = 1; 4.46 +- sm->tk_to_set = 1; 4.47 + 4.48 + kde = sm->assoc_wpa_ie; 4.49 + kde_len = sm->assoc_wpa_ie_len; 4.50 +@@ -615,7 +614,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm, 4.51 + enum wpa_alg alg; 4.52 + const u8 *key_rsc; 4.53 + 4.54 +- if (!sm->tk_to_set) { 4.55 ++ if (sm->ptk.installed) { 4.56 + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, 4.57 + "WPA: Do not re-install same PTK to the driver"); 4.58 + return 0; 4.59 +@@ -659,7 +658,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm, 4.60 + 4.61 + /* TK is not needed anymore in supplicant */ 4.62 + os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN); 4.63 +- sm->tk_to_set = 0; 4.64 ++ sm->ptk.installed = 1; 4.65 + 4.66 + if (sm->wpa_ptk_rekey) { 4.67 + eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL); 4.68 +diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h 4.69 +index 9a54631..41f371f 100644 4.70 +--- a/src/rsn_supp/wpa_i.h 4.71 ++++ b/src/rsn_supp/wpa_i.h 4.72 +@@ -24,7 +24,6 @@ struct wpa_sm { 4.73 + struct wpa_ptk ptk, tptk; 4.74 + int ptk_set, tptk_set; 4.75 + unsigned int msg_3_of_4_ok:1; 4.76 +- unsigned int tk_to_set:1; 4.77 + u8 snonce[WPA_NONCE_LEN]; 4.78 + u8 anonce[WPA_NONCE_LEN]; /* ANonce from the last 1/4 msg */ 4.79 + int renew_snonce; 4.80 +-- 4.81 +2.7.4 4.82 +
5.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000 5.2 +++ b/wpa_supplicant/stuff/patches/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch Sat Oct 28 11:29:09 2017 +0200 5.3 @@ -0,0 +1,64 @@ 5.4 +From 12fac09b437a1dc8a0f253e265934a8aaf4d2f8b Mon Sep 17 00:00:00 2001 5.5 +From: Jouni Malinen <j@w1.fi> 5.6 +Date: Sun, 1 Oct 2017 12:32:57 +0300 5.7 +Subject: [PATCH 5/8] Fix PTK rekeying to generate a new ANonce 5.8 + 5.9 +The Authenticator state machine path for PTK rekeying ended up bypassing 5.10 +the AUTHENTICATION2 state where a new ANonce is generated when going 5.11 +directly to the PTKSTART state since there is no need to try to 5.12 +determine the PMK again in such a case. This is far from ideal since the 5.13 +new PTK would depend on a new nonce only from the supplicant. 5.14 + 5.15 +Fix this by generating a new ANonce when moving to the PTKSTART state 5.16 +for the purpose of starting new 4-way handshake to rekey PTK. 5.17 + 5.18 +Signed-off-by: Jouni Malinen <j@w1.fi> 5.19 +--- 5.20 + src/ap/wpa_auth.c | 24 +++++++++++++++++++++--- 5.21 + 1 file changed, 21 insertions(+), 3 deletions(-) 5.22 + 5.23 +diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c 5.24 +index 707971d..bf10cc1 100644 5.25 +--- a/src/ap/wpa_auth.c 5.26 ++++ b/src/ap/wpa_auth.c 5.27 +@@ -1901,6 +1901,21 @@ SM_STATE(WPA_PTK, AUTHENTICATION2) 5.28 + } 5.29 + 5.30 + 5.31 ++static int wpa_auth_sm_ptk_update(struct wpa_state_machine *sm) 5.32 ++{ 5.33 ++ if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) { 5.34 ++ wpa_printf(MSG_ERROR, 5.35 ++ "WPA: Failed to get random data for ANonce"); 5.36 ++ sm->Disconnect = TRUE; 5.37 ++ return -1; 5.38 ++ } 5.39 ++ wpa_hexdump(MSG_DEBUG, "WPA: Assign new ANonce", sm->ANonce, 5.40 ++ WPA_NONCE_LEN); 5.41 ++ sm->TimeoutCtr = 0; 5.42 ++ return 0; 5.43 ++} 5.44 ++ 5.45 ++ 5.46 + SM_STATE(WPA_PTK, INITPMK) 5.47 + { 5.48 + u8 msk[2 * PMK_LEN]; 5.49 +@@ -2458,9 +2473,12 @@ SM_STEP(WPA_PTK) 5.50 + SM_ENTER(WPA_PTK, AUTHENTICATION); 5.51 + else if (sm->ReAuthenticationRequest) 5.52 + SM_ENTER(WPA_PTK, AUTHENTICATION2); 5.53 +- else if (sm->PTKRequest) 5.54 +- SM_ENTER(WPA_PTK, PTKSTART); 5.55 +- else switch (sm->wpa_ptk_state) { 5.56 ++ else if (sm->PTKRequest) { 5.57 ++ if (wpa_auth_sm_ptk_update(sm) < 0) 5.58 ++ SM_ENTER(WPA_PTK, DISCONNECTED); 5.59 ++ else 5.60 ++ SM_ENTER(WPA_PTK, PTKSTART); 5.61 ++ } else switch (sm->wpa_ptk_state) { 5.62 + case WPA_PTK_INITIALIZE: 5.63 + break; 5.64 + case WPA_PTK_DISCONNECT: 5.65 +-- 5.66 +2.7.4 5.67 +
6.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000 6.2 +++ b/wpa_supplicant/stuff/patches/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch Sat Oct 28 11:29:09 2017 +0200 6.3 @@ -0,0 +1,132 @@ 6.4 +From 6c4bed4f47d1960ec04981a9d50e5076aea5223d Mon Sep 17 00:00:00 2001 6.5 +From: Jouni Malinen <j@w1.fi> 6.6 +Date: Fri, 22 Sep 2017 11:03:15 +0300 6.7 +Subject: [PATCH 6/8] TDLS: Reject TPK-TK reconfiguration 6.8 + 6.9 +Do not try to reconfigure the same TPK-TK to the driver after it has 6.10 +been successfully configured. This is an explicit check to avoid issues 6.11 +related to resetting the TX/RX packet number. There was already a check 6.12 +for this for TPK M2 (retries of that message are ignored completely), so 6.13 +that behavior does not get modified. 6.14 + 6.15 +For TPK M3, the TPK-TK could have been reconfigured, but that was 6.16 +followed by immediate teardown of the link due to an issue in updating 6.17 +the STA entry. Furthermore, for TDLS with any real security (i.e., 6.18 +ignoring open/WEP), the TPK message exchange is protected on the AP path 6.19 +and simple replay attacks are not feasible. 6.20 + 6.21 +As an additional corner case, make sure the local nonce gets updated if 6.22 +the peer uses a very unlikely "random nonce" of all zeros. 6.23 + 6.24 +Signed-off-by: Jouni Malinen <j@w1.fi> 6.25 +--- 6.26 + src/rsn_supp/tdls.c | 38 ++++++++++++++++++++++++++++++++++++-- 6.27 + 1 file changed, 36 insertions(+), 2 deletions(-) 6.28 + 6.29 +diff --git a/src/rsn_supp/tdls.c b/src/rsn_supp/tdls.c 6.30 +index e424168..9eb9738 100644 6.31 +--- a/src/rsn_supp/tdls.c 6.32 ++++ b/src/rsn_supp/tdls.c 6.33 +@@ -112,6 +112,7 @@ struct wpa_tdls_peer { 6.34 + u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */ 6.35 + } tpk; 6.36 + int tpk_set; 6.37 ++ int tk_set; /* TPK-TK configured to the driver */ 6.38 + int tpk_success; 6.39 + int tpk_in_progress; 6.40 + 6.41 +@@ -192,6 +193,20 @@ static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 6.42 + u8 rsc[6]; 6.43 + enum wpa_alg alg; 6.44 + 6.45 ++ if (peer->tk_set) { 6.46 ++ /* 6.47 ++ * This same TPK-TK has already been configured to the driver 6.48 ++ * and this new configuration attempt (likely due to an 6.49 ++ * unexpected retransmitted frame) would result in clearing 6.50 ++ * the TX/RX sequence number which can break security, so must 6.51 ++ * not allow that to happen. 6.52 ++ */ 6.53 ++ wpa_printf(MSG_INFO, "TDLS: TPK-TK for the peer " MACSTR 6.54 ++ " has already been configured to the driver - do not reconfigure", 6.55 ++ MAC2STR(peer->addr)); 6.56 ++ return -1; 6.57 ++ } 6.58 ++ 6.59 + os_memset(rsc, 0, 6); 6.60 + 6.61 + switch (peer->cipher) { 6.62 +@@ -209,12 +224,15 @@ static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 6.63 + return -1; 6.64 + } 6.65 + 6.66 ++ wpa_printf(MSG_DEBUG, "TDLS: Configure pairwise key for peer " MACSTR, 6.67 ++ MAC2STR(peer->addr)); 6.68 + if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1, 6.69 + rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) { 6.70 + wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the " 6.71 + "driver"); 6.72 + return -1; 6.73 + } 6.74 ++ peer->tk_set = 1; 6.75 + return 0; 6.76 + } 6.77 + 6.78 +@@ -696,7 +714,7 @@ static void wpa_tdls_peer_clear(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 6.79 + peer->cipher = 0; 6.80 + peer->qos_info = 0; 6.81 + peer->wmm_capable = 0; 6.82 +- peer->tpk_set = peer->tpk_success = 0; 6.83 ++ peer->tk_set = peer->tpk_set = peer->tpk_success = 0; 6.84 + peer->chan_switch_enabled = 0; 6.85 + os_memset(&peer->tpk, 0, sizeof(peer->tpk)); 6.86 + os_memset(peer->inonce, 0, WPA_NONCE_LEN); 6.87 +@@ -1159,6 +1177,7 @@ skip_rsnie: 6.88 + wpa_tdls_peer_free(sm, peer); 6.89 + return -1; 6.90 + } 6.91 ++ peer->tk_set = 0; /* A new nonce results in a new TK */ 6.92 + wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake", 6.93 + peer->inonce, WPA_NONCE_LEN); 6.94 + os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 6.95 +@@ -1751,6 +1770,19 @@ static int wpa_tdls_addset_peer(struct wpa_sm *sm, struct wpa_tdls_peer *peer, 6.96 + } 6.97 + 6.98 + 6.99 ++static int tdls_nonce_set(const u8 *nonce) 6.100 ++{ 6.101 ++ int i; 6.102 ++ 6.103 ++ for (i = 0; i < WPA_NONCE_LEN; i++) { 6.104 ++ if (nonce[i]) 6.105 ++ return 1; 6.106 ++ } 6.107 ++ 6.108 ++ return 0; 6.109 ++} 6.110 ++ 6.111 ++ 6.112 + static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr, 6.113 + const u8 *buf, size_t len) 6.114 + { 6.115 +@@ -2004,7 +2036,8 @@ skip_rsn: 6.116 + peer->rsnie_i_len = kde.rsn_ie_len; 6.117 + peer->cipher = cipher; 6.118 + 6.119 +- if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) { 6.120 ++ if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0 || 6.121 ++ !tdls_nonce_set(peer->inonce)) { 6.122 + /* 6.123 + * There is no point in updating the RNonce for every obtained 6.124 + * TPK M1 frame (e.g., retransmission due to timeout) with the 6.125 +@@ -2020,6 +2053,7 @@ skip_rsn: 6.126 + "TDLS: Failed to get random data for responder nonce"); 6.127 + goto error; 6.128 + } 6.129 ++ peer->tk_set = 0; /* A new nonce results in a new TK */ 6.130 + } 6.131 + 6.132 + #if 0 6.133 +-- 6.134 +2.7.4 6.135 +
7.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000 7.2 +++ b/wpa_supplicant/stuff/patches/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch Sat Oct 28 11:29:09 2017 +0200 7.3 @@ -0,0 +1,43 @@ 7.4 +From 53c5eb58e95004f86e65ee9fbfccbc291b139057 Mon Sep 17 00:00:00 2001 7.5 +From: Jouni Malinen <j@w1.fi> 7.6 +Date: Fri, 22 Sep 2017 11:25:02 +0300 7.7 +Subject: [PATCH 7/8] WNM: Ignore WNM-Sleep Mode Response without pending 7.8 + request 7.9 + 7.10 +Commit 03ed0a52393710be6bdae657d1b36efa146520e5 ('WNM: Ignore WNM-Sleep 7.11 +Mode Response if WNM-Sleep Mode has not been used') started ignoring the 7.12 +response when no WNM-Sleep Mode Request had been used during the 7.13 +association. This can be made tighter by clearing the used flag when 7.14 +successfully processing a response. This adds an additional layer of 7.15 +protection against unexpected retransmissions of the response frame. 7.16 + 7.17 +Signed-off-by: Jouni Malinen <j@w1.fi> 7.18 +--- 7.19 + wpa_supplicant/wnm_sta.c | 4 +++- 7.20 + 1 file changed, 3 insertions(+), 1 deletion(-) 7.21 + 7.22 +diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c 7.23 +index 1b3409c..67a07ff 100644 7.24 +--- a/wpa_supplicant/wnm_sta.c 7.25 ++++ b/wpa_supplicant/wnm_sta.c 7.26 +@@ -260,7 +260,7 @@ static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s, 7.27 + 7.28 + if (!wpa_s->wnmsleep_used) { 7.29 + wpa_printf(MSG_DEBUG, 7.30 +- "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode has not been used in this association"); 7.31 ++ "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode operation has not been requested"); 7.32 + return; 7.33 + } 7.34 + 7.35 +@@ -299,6 +299,8 @@ static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s, 7.36 + return; 7.37 + } 7.38 + 7.39 ++ wpa_s->wnmsleep_used = 0; 7.40 ++ 7.41 + if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT || 7.42 + wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) { 7.43 + wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response " 7.44 +-- 7.45 +2.7.4 7.46 +
8.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000 8.2 +++ b/wpa_supplicant/stuff/patches/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch Sat Oct 28 11:29:09 2017 +0200 8.3 @@ -0,0 +1,82 @@ 8.4 +From b372ab0b7daea719749194dc554b26e6367603f2 Mon Sep 17 00:00:00 2001 8.5 +From: Jouni Malinen <j@w1.fi> 8.6 +Date: Fri, 22 Sep 2017 12:06:37 +0300 8.7 +Subject: [PATCH 8/8] FT: Do not allow multiple Reassociation Response frames 8.8 + 8.9 +The driver is expected to not report a second association event without 8.10 +the station having explicitly request a new association. As such, this 8.11 +case should not be reachable. However, since reconfiguring the same 8.12 +pairwise or group keys to the driver could result in nonce reuse issues, 8.13 +be extra careful here and do an additional state check to avoid this 8.14 +even if the local driver ends up somehow accepting an unexpected 8.15 +Reassociation Response frame. 8.16 + 8.17 +Signed-off-by: Jouni Malinen <j@w1.fi> 8.18 +--- 8.19 + src/rsn_supp/wpa.c | 3 +++ 8.20 + src/rsn_supp/wpa_ft.c | 8 ++++++++ 8.21 + src/rsn_supp/wpa_i.h | 1 + 8.22 + 3 files changed, 12 insertions(+) 8.23 + 8.24 +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c 8.25 +index 0550a41..2a53c6f 100644 8.26 +--- a/src/rsn_supp/wpa.c 8.27 ++++ b/src/rsn_supp/wpa.c 8.28 +@@ -2440,6 +2440,9 @@ void wpa_sm_notify_disassoc(struct wpa_sm *sm) 8.29 + #ifdef CONFIG_TDLS 8.30 + wpa_tdls_disassoc(sm); 8.31 + #endif /* CONFIG_TDLS */ 8.32 ++#ifdef CONFIG_IEEE80211R 8.33 ++ sm->ft_reassoc_completed = 0; 8.34 ++#endif /* CONFIG_IEEE80211R */ 8.35 + 8.36 + /* Keys are not needed in the WPA state machine anymore */ 8.37 + wpa_sm_drop_sa(sm); 8.38 +diff --git a/src/rsn_supp/wpa_ft.c b/src/rsn_supp/wpa_ft.c 8.39 +index 205793e..d45bb45 100644 8.40 +--- a/src/rsn_supp/wpa_ft.c 8.41 ++++ b/src/rsn_supp/wpa_ft.c 8.42 +@@ -153,6 +153,7 @@ static u8 * wpa_ft_gen_req_ies(struct wpa_sm *sm, size_t *len, 8.43 + u16 capab; 8.44 + 8.45 + sm->ft_completed = 0; 8.46 ++ sm->ft_reassoc_completed = 0; 8.47 + 8.48 + buf_len = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) + 8.49 + 2 + sm->r0kh_id_len + ric_ies_len + 100; 8.50 +@@ -681,6 +682,11 @@ int wpa_ft_validate_reassoc_resp(struct wpa_sm *sm, const u8 *ies, 8.51 + return -1; 8.52 + } 8.53 + 8.54 ++ if (sm->ft_reassoc_completed) { 8.55 ++ wpa_printf(MSG_DEBUG, "FT: Reassociation has already been completed for this FT protocol instance - ignore unexpected retransmission"); 8.56 ++ return 0; 8.57 ++ } 8.58 ++ 8.59 + if (wpa_ft_parse_ies(ies, ies_len, &parse) < 0) { 8.60 + wpa_printf(MSG_DEBUG, "FT: Failed to parse IEs"); 8.61 + return -1; 8.62 +@@ -781,6 +787,8 @@ int wpa_ft_validate_reassoc_resp(struct wpa_sm *sm, const u8 *ies, 8.63 + return -1; 8.64 + } 8.65 + 8.66 ++ sm->ft_reassoc_completed = 1; 8.67 ++ 8.68 + if (wpa_ft_process_gtk_subelem(sm, parse.gtk, parse.gtk_len) < 0) 8.69 + return -1; 8.70 + 8.71 +diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h 8.72 +index 41f371f..56f88dc 100644 8.73 +--- a/src/rsn_supp/wpa_i.h 8.74 ++++ b/src/rsn_supp/wpa_i.h 8.75 +@@ -128,6 +128,7 @@ struct wpa_sm { 8.76 + size_t r0kh_id_len; 8.77 + u8 r1kh_id[FT_R1KH_ID_LEN]; 8.78 + int ft_completed; 8.79 ++ int ft_reassoc_completed; 8.80 + int over_the_ds_in_progress; 8.81 + u8 target_ap[ETH_ALEN]; /* over-the-DS target AP */ 8.82 + int set_ptk_after_assoc; 8.83 +-- 8.84 +2.7.4 8.85 +
9.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000 9.2 +++ b/wpa_supplicant/stuff/patches/series Sat Oct 28 11:29:09 2017 +0200 9.3 @@ -0,0 +1,8 @@ 9.4 +rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch 9.5 +rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch 9.6 +rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch 9.7 +rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch 9.8 +rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch 9.9 +rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch 9.10 +rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch 9.11 +rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch