Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2025-01-30 08:44:03 -05:00
Code Issues Projects Releases Wiki Activity

Extend protection of GTK/IGTK reinstallation of WNM-Sleep Mode cases

Browse Source 
This extends the protection to track last configured GTK/IGTK value
separately from EAPOL-Key frames and WNM-Sleep Mode frames to cover a
corner case where these two different mechanisms may get used when the
GTK/IGTK has changed and tracking a single value is not sufficient to
detect a possible key reconfiguration.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2017-10-01 12:12:24 +03:00
parent cb5132bb35
commit 87e2db16ba
2 changed files with 41 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
src/rsn_supp/wpa.c
View File

@ -797,14 +797,17 @@ struct wpa_gtk_data {
static int wpa_supplicant_install_gtk(struct wpa_sm *sm, static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
const struct wpa_gtk_data *gd, const struct wpa_gtk_data *gd,
const u8 *key_rsc) const u8 *key_rsc, int wnm_sleep)
{ {
const u8 *_gtk = gd->gtk; const u8 *_gtk = gd->gtk;
u8 gtk_buf[32]; u8 gtk_buf[32];
/* Detect possible key reinstallation */ /* Detect possible key reinstallation */
if (sm->gtk.gtk_len == (size_t) gd->gtk_len && if ((sm->gtk.gtk_len == (size_t) gd->gtk_len &&
os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) { os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) ||
(sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len &&
os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk,
sm->gtk_wnm_sleep.gtk_len) == 0)) {
wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
"WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)", "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)",
gd->keyidx, gd->tx, gd->gtk_len); gd->keyidx, gd->tx, gd->gtk_len);
@ -845,8 +848,14 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
} }
os_memset(gtk_buf, 0, sizeof(gtk_buf)); os_memset(gtk_buf, 0, sizeof(gtk_buf));
if (wnm_sleep) {
sm->gtk_wnm_sleep.gtk_len = gd->gtk_len;
os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk,
sm->gtk_wnm_sleep.gtk_len);
} else {
sm->gtk.gtk_len = gd->gtk_len; sm->gtk.gtk_len = gd->gtk_len;
os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
}
return 0; return 0;
} }
@ -940,7 +949,7 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm,
(wpa_supplicant_check_group_cipher(sm, sm->group_cipher, (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
gtk_len, gtk_len, gtk_len, gtk_len,
&gd.key_rsc_len, &gd.alg) || &gd.key_rsc_len, &gd.alg) ||
wpa_supplicant_install_gtk(sm, &gd, key_rsc))) { wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) {
wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
"RSN: Failed to install GTK"); "RSN: Failed to install GTK");
os_memset(&gd, 0, sizeof(gd)); os_memset(&gd, 0, sizeof(gd));
@ -956,14 +965,18 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm,
#ifdef CONFIG_IEEE80211W #ifdef CONFIG_IEEE80211W
static int wpa_supplicant_install_igtk(struct wpa_sm *sm, static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
const struct wpa_igtk_kde *igtk) const struct wpa_igtk_kde *igtk,
int wnm_sleep)
{ {
size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher); size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
u16 keyidx = WPA_GET_LE16(igtk->keyid); u16 keyidx = WPA_GET_LE16(igtk->keyid);
/* Detect possible key reinstallation */ /* Detect possible key reinstallation */
if (sm->igtk.igtk_len == len && if ((sm->igtk.igtk_len == len &&
os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) { os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) ||
(sm->igtk_wnm_sleep.igtk_len == len &&
os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk,
sm->igtk_wnm_sleep.igtk_len) == 0)) {
wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
"WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)", "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)",
keyidx); keyidx);
@ -988,8 +1001,14 @@ static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
return -1; return -1;
} }
if (wnm_sleep) {
sm->igtk_wnm_sleep.igtk_len = len;
os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk,
sm->igtk_wnm_sleep.igtk_len);
} else {
sm->igtk.igtk_len = len; sm->igtk.igtk_len = len;
os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
}
return 0; return 0;
} }
@ -1012,7 +1031,7 @@ static int ieee80211w_set_keys(struct wpa_sm *sm,
return -1; return -1;
igtk = (const struct wpa_igtk_kde *) ie->igtk; igtk = (const struct wpa_igtk_kde *) ie->igtk;
if (wpa_supplicant_install_igtk(sm, igtk) < 0) if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0)
return -1; return -1;
} }
@ -1661,7 +1680,7 @@ static void wpa_supplicant_process_1_of_2(struct wpa_sm *sm,
if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc)) if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
key_rsc = null_rsc; key_rsc = null_rsc;
if (wpa_supplicant_install_gtk(sm, &gd, key_rsc) || if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) ||
wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0) wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0)
goto failed; goto failed;
os_memset(&gd, 0, sizeof(gd)); os_memset(&gd, 0, sizeof(gd));
@ -2582,8 +2601,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
sm->tptk_set = 0; sm->tptk_set = 0;
os_memset(&sm->tptk, 0, sizeof(sm->tptk)); os_memset(&sm->tptk, 0, sizeof(sm->tptk));
os_memset(&sm->gtk, 0, sizeof(sm->gtk)); os_memset(&sm->gtk, 0, sizeof(sm->gtk));
os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
#ifdef CONFIG_IEEE80211W #ifdef CONFIG_IEEE80211W
os_memset(&sm->igtk, 0, sizeof(sm->igtk)); os_memset(&sm->igtk, 0, sizeof(sm->igtk));
os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
#endif /* CONFIG_IEEE80211W */ #endif /* CONFIG_IEEE80211W */
} }
@ -3162,8 +3183,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm)
os_memset(&sm->ptk, 0, sizeof(sm->ptk)); os_memset(&sm->ptk, 0, sizeof(sm->ptk));
os_memset(&sm->tptk, 0, sizeof(sm->tptk)); os_memset(&sm->tptk, 0, sizeof(sm->tptk));
os_memset(&sm->gtk, 0, sizeof(sm->gtk)); os_memset(&sm->gtk, 0, sizeof(sm->gtk));
os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
#ifdef CONFIG_IEEE80211W #ifdef CONFIG_IEEE80211W
os_memset(&sm->igtk, 0, sizeof(sm->igtk)); os_memset(&sm->igtk, 0, sizeof(sm->igtk));
os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
#endif /* CONFIG_IEEE80211W */ #endif /* CONFIG_IEEE80211W */
#ifdef CONFIG_IEEE80211R #ifdef CONFIG_IEEE80211R
os_memset(sm->xxkey, 0, sizeof(sm->xxkey)); os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
@ -3228,7 +3251,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf)
wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)", wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)",
gd.gtk, gd.gtk_len); gd.gtk, gd.gtk_len);
if (wpa_supplicant_install_gtk(sm, &gd, key_rsc)) { if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) {
os_memset(&gd, 0, sizeof(gd)); os_memset(&gd, 0, sizeof(gd));
wpa_printf(MSG_DEBUG, "Failed to install the GTK in " wpa_printf(MSG_DEBUG, "Failed to install the GTK in "
"WNM mode"); "WNM mode");
@ -3240,7 +3263,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf)
const struct wpa_igtk_kde *igtk; const struct wpa_igtk_kde *igtk;
igtk = (const struct wpa_igtk_kde *) (buf + 2); igtk = (const struct wpa_igtk_kde *) (buf + 2);
if (wpa_supplicant_install_igtk(sm, igtk) < 0) if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0)
return -1; return -1;
#endif /* CONFIG_IEEE80211W */ #endif /* CONFIG_IEEE80211W */
} else { } else {
@ -4134,7 +4157,7 @@ int fils_process_assoc_resp(struct wpa_sm *sm, const u8 *resp, size_t len)
os_memcpy(gd.gtk, kde.gtk + 2, kde.gtk_len - 2); os_memcpy(gd.gtk, kde.gtk + 2, kde.gtk_len - 2);
wpa_printf(MSG_DEBUG, "FILS: Set GTK to driver"); wpa_printf(MSG_DEBUG, "FILS: Set GTK to driver");
if (wpa_supplicant_install_gtk(sm, &gd, elems.key_delivery) < 0) { if (wpa_supplicant_install_gtk(sm, &gd, elems.key_delivery, 0) < 0) {
wpa_printf(MSG_DEBUG, "FILS: Failed to set GTK"); wpa_printf(MSG_DEBUG, "FILS: Failed to set GTK");
goto fail; goto fail;
} }

2
src/rsn_supp/wpa_i.h
View File

@ -32,8 +32,10 @@ struct wpa_sm {
int rx_replay_counter_set; int rx_replay_counter_set;
u8 request_counter[WPA_REPLAY_COUNTER_LEN]; u8 request_counter[WPA_REPLAY_COUNTER_LEN];
struct wpa_gtk gtk; struct wpa_gtk gtk;
struct wpa_gtk gtk_wnm_sleep;
#ifdef CONFIG_IEEE80211W #ifdef CONFIG_IEEE80211W
struct wpa_igtk igtk; struct wpa_igtk igtk;
struct wpa_igtk igtk_wnm_sleep;
#endif /* CONFIG_IEEE80211W */ #endif /* CONFIG_IEEE80211W */
struct eapol_sm *eapol; /* EAPOL state machine from upper level code */ struct eapol_sm *eapol; /* EAPOL state machine from upper level code */