summaryrefslogtreecommitdiffstats
path: root/sys/net80211/ieee80211_crypto.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Prevent ieee80211_get_txkey() from returning the integrity group temporalstsp2018-09-241-7/+6
| | | | | | | | | | key (IGTK) if a node doesn't have management frame protection (MFP) enabled. The IGTK is not initialized if MFP is disabled, so using it triggers this panic in ieee80211_encrypt(): panic("invalid key cipher 0x%x", k->k_cipher) (As far as I can tell, at present, MFP is never enabled.) Problem reported and fix tested by tj@ on athn(4) hostap
* Fix WEP key selection in ieee80211_get_txkey().stsp2018-04-281-2/+3
| | | | | | | | The WEP key index is stored in ic_def_txkey. The iGTK ("integrity group key") index is specific to WPA. The previous code happened to always select WEP key index 0 since the iGTK index is not yet used by any driver. ok phessler@
* If ieee80211_encrypt() is passed a key with an unrecognized cipherstsp2018-04-281-3/+2
| | | | | | type then panic immediately instead of silently dropping packets. ok phessler@
* Clear WPA group keys from memory before initiating a key exchangestsp2017-08-181-9/+15
| | | | | | | with an access point. Prevents false positive 'reused group key' warnings in dmesg when re-associating to the same access point. Problem reported by tb@ ok tb@
* Switch 802.11 crypto over to the new AESmikeb2017-05-021-2/+2
| | | | OK stsp@
* Use explicit_bzero() to wipe out key material and add some sizes to free().tb2017-03-231-2/+2
| | | | ok stsp
* Disable TKIP (WPA1) by default.stsp2016-12-201-5/+4
| | | | | | | | | | | | | | | | | | | | It is time for this legacy of WEP to die (remember WEP?). The 802.11-2012 standard says: The use of TKIP is deprecated. The TKIP algorithm is unsuitable for the purposes of this standard. TKIP has numerous problems. One of which is that TKIP allows a denial of service attack which can be triggered by any client. Report 2 Michael MIC failures to a TKIP AP to trigger "TKIP countermeasures". The AP is now required by the 802.11 standard to lock everyone out for at least 60 seconds. The network will remain unusable for as long as such MIC failure reports are sent twice per minute. TKIP remains available for interoperability purposes, for now. It must be enabled manually with ifconfig(8). Prompted by discussion with Mathy Vanhoef. ok deraadt@ sthen@ reyk@
* Complete our half-done implementation of TKIP countermeasures in hostap mode.stsp2016-12-171-1/+10
| | | | | | | | | | The previous code would disable the AP until next reboot upon MIC failure. Instead, disable the AP for 60 seconds, as required by the 802.11 standard. I randomly added a bit of time (up to 120 seconds total) just because we can. Problem reported by Mathy Vanhoef, thanks! ok deraadt@ random input reyk@
* No need to include <net/if_arp.h>mpi2015-11-241-2/+1
| | | | | | | | | This header is only needed because <netinet/if_ether.h> declares a structure that needs it. But it turns out that <net/if.h> already includes it as workaround. A proper solution would be to stop declarting "struct ether_arp" there. But no driver should need this header.
* unifdef some more INET. v4 4life.tedu2014-12-231-3/+1
|
* move arc4random prototype to systm.h. more appropriate for most codetedu2014-11-181-2/+1
| | | | to include that than rdnvar.h. ok deraadt dlg
* remove uneeded proc.h includesjsg2014-09-141-2/+1
| | | | ok mpi@ kspillner@
* add a size argument to free. will be used soon, but for now default to 0.tedu2014-07-121-2/+2
| | | | after discussions with beck deraadt kettenis.
* Remove unneeded include.mpi2013-11-211-2/+1
| | | | ok deraadt@
* for key material that is being being discarded, convert bzero() toderaadt2011-01-111-5/+5
| | | | | explicit_bzero() where required ok markus mikeb
* Switch some obvious network stack MAC comparisons from bcmp() tomatthew2010-07-201-2/+2
| | | | | | timingsafe_bcmp(). ok deraadt@; committed over WPA.
* Change ifconfig wpaakms default setting to `psk' instead of `psk,802.1x'.damien2009-02-131-3/+2
| | | | | | | | | | | | | | Some supplicants will autoselect 802.1X without giving users the possibility to choose between PSK or 802.1X. Similarly, no longer announce `PSK with SHA-256 based KDF' AKMP (defined in Draft 802.11w) by default in the RSN IE of beacons and probe responses as it confuses some broken supplicants. This kind of sacrifies security for interoperability with shitty (but unfortunately widespread) clients that do not follow the 802.11 standard properly. This fixes associations from Intel PROSet on XP and also reportedly fixes some Mac OS clients. I will likely make `psk-sha256' configurable through ifconfig wpaakms after the 4.5 release.
* Add some initial HT bits (not enabled yet) based on 802.11n Draft 7.01:damien2009-01-261-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - implement A-MPDU frames buffering and reordering - implement A-MSDU decapsulation - process/send ADDBA Request, ADDBA Response and DELBA action frames - process Block Ack Request control frames (including MTBAR) - implement PBAC support (Protected Block Ack) - add some incomplete HT Capabilities and HT Operation IEs parsing Add more Management Frame Protection bits based on 802.11w Draft 7.0: - implement SA Query procedure (both AP and STA) - cleanup BIP Fix some bugs: - fix check for WEP key length that otherwise caused a stack smash in ieee80211_wep_encrypt (pointed out by Xavier Santolaria on macppc) - properly stop EAPOL timeout: fixes a panic that occured in HostAP mode when turning the interface down while a 4-way handshake is in progress (pointed out by Doughertys) Did some code cleanup too. The HT bits are currently not compiled in (IEEE80211_NO_HT is defined) because they won't be ready until after the next release and I didn't want to grow the kernel or to inadvertently introduce new bugs. They are here such that other people can look at the code. Notice that I had to add an extra parameter to ic_send_mgmt() for action frames, that is why there are small changes in drivers defining their own ic_send_mgmt() handler. Sorry for the not very incremental diff but this has been sitting in my tree for too long now.
* Initial implementation of PMKSA caching and pre-authentication.damien2008-09-271-37/+111
| | | | | | | | | | | | | | | | | | This will be required for future WPA-Enterprise support (802.1X). Add ieee80211_needs_auth() function (not implemented yet) to notify the userland 802.1X PACP machine when an 802.1X port becomes enabled (that is after successfull 802.11 Open System authentication). Add SIOCS80211KEYRUN and SIOCS80211KEYAVAIL ioctls so that the PACP state machine can kick the 802.11 key state machine and install PMKs obtained from 802.1X (pre-)authentication. Enable SHA-256 based AKMPs by default while I'm here (TGw). This uses SHA-256 for key-derivation (instead of SHA1), AES-128-CMAC for data integrity, and AES Key Wrap for data protection of EAPOL-Key frames. An OpenBSD AP will always advertise this capability and an OpenBSD STA will always prefer SHA-256 based AKMPs over SHA1 based ones if both are supported by an AP.
* introduce new IEEE80211_STA_ONLY kernel option that can be set todamien2008-08-271-1/+3
| | | | | | | | | remove IBSS and HostAP support from net80211 and 802.11 drivers. it can be used to shrink RAMDISK kernels for instance (like what was done for wi(4)). it also has the benefit of highlighting what is specific to IBSS and HostAP modes in the code. the cost is that we now have two code paths to maintain.
* ieee80211_derive_pmkid() is not used eitherdamien2008-08-141-2/+4
|
* #ifdef notyet ieee80211_kdf() as it is not used yet (shrink kernel a bit)damien2008-08-141-1/+5
|
* add the code to encrypt/decrypt management frames, retrieve key iddamien2008-08-121-17/+61
| | | | | from MMIE etc... this code can't be triggered as no drivers claim MFP capability yet.
* missing SHA-256 bits.damien2008-08-121-2/+3
|
* new SHA-256 based AKMPs.damien2008-08-121-2/+2
|
* add support for EAPOL-Key v3 descriptors (similar to v2 except that thedamien2008-08-121-4/+54
| | | | | MIC is computed using AES-128-CMAC instead of HMAC-SHA1). add a SHA-256 based key derivation function (not used yet).
* the only integrity group cipher currently supported is AES-128-CMAC.damien2008-08-121-1/+4
|
* extend the ic_nw_keys[] array to 6 elements.damien2008-08-121-25/+26
| | | | | | indices 0-3 will be used for group data keys while indices 4-5 will be used for integrity group keys. add a ic_rsngroupmgmtcipher field too.
* get rid of the map_ptk()/map_gtk() functions, just inline themdamien2008-08-121-34/+1
| | | | which makes things easier to track.
* simplify ieee80211_derive_ptk() prototype.damien2008-08-121-6/+6
| | | | | pass the AKMP so we can support other key derivation functions in the future.
* use HMAC-MD5, HMAC-SHA1 and AES Key Wrap sys/crypto/damien2008-08-121-231/+78
|
* add ieee80211_priv.h file: contains definitions private to net80211.damien2008-07-211-12/+2
| | | | this must not be included by drivers.
* remove now useless casts since the rijndael_* protos have beendamien2008-06-161-3/+3
| | | | constified.
* move things from ieee80211_ifattach() to ieee80211_crypto_attach().damien2008-04-261-1/+12
|
* - do not process ethernet PAE frames if RSN is not enableddamien2008-04-211-3/+1
| | | | | | - add a ieee80211_recv_action() function (will be used later) - some cleanup, remove unused prototypes, get rid of the IEEE80211_VERIFY_* macros
* extend the if_ethersubr.c crc functions to support updating a runningdjm2008-04-181-50/+1
| | | | | | | | | | | crc in addition to the existing "oneshot" mode and use them to replace ieee80211_crc_update() with the new ether_crc32_le_update(). Saves 1k kernel bss + some code. Mark the new ether_crc32_[lb]e_update functions as __pure for a ~25x speedup (on my i386 at least). feedback and ok damien@
* call ieee80211_crc_init() only once, when the first 802.11 devicedamien2008-04-171-5/+11
| | | | | | attaches instead of at every attach. discussed with deraadt@
* Kernel implementation of the 4-way handshake and group-keydamien2008-04-161-506/+130
| | | | | | | | | | | | | | | | | | | | | | | | | | | handshake protocols (both supplicant and authenticator state machines) as defined in the IEEE 802.11i standard. Software implementation of the TKIP (Temporal Key Integrity Protocol) and CCMP (CTR with CBC-MAC Protocol) protocols. This diff doesn't implement any of the 802.1X authentication protocols and thus only PSK authentication (using pre-shared keys) is currently supported. In concrete terms, this adds support for WPA-PSK and WPA2-PSK protocols, both in station and hostap modes. The following drivers are marked as WPA-capable and should work: bwi(4), malo(4), ral(4), iwn(4), wpi(4), ural(4), rum(4), upgt(4), and zyd(4) The following options have been added to ifconfig(8): wpa, wpapsk, wpaprotos, wpaakms, wpaciphers, wpagroupcipher wpa-psk(8) can be used to generate keys from passphrases. tested by many@ ok deraadt@
* remove horrid casts now that SHA1Update() has been constified.damien2007-09-111-3/+3
|
* - use ieee80211_get_hdrlen() where appropriate.damien2007-08-291-12/+13
| | | | | | | | | - discard all EAPOL-Key frames with an unknown descriptor version. - when receiving message 3/4 of the 4-way handshake, do not install the PTK if the INSTALL bit is not set. this fixes 4-way handshake with APs using group keys only. - similarly, do not mark the 802.1X port as valid if the SECURE bit is not set (it will be marked as valid after group key handshake).
* fix ieee80211_map_ptk() for TKIP.damien2007-08-231-2/+2
|
* add a ieee80211_get_txkey() function to determine the key to use fordamien2007-08-221-11/+10
| | | | | | | transmitting a frame to a given node. change ieee80211_encrypt() so that it now takes the key as parameter. this change is required because drivers doing hardware crypto need to know what key is being used.
* - add k_rxmic and k_txmic fields to struct ieee80211_key to store thedamien2007-08-221-8/+47
| | | | | | | | | | | | | | | Tx/Rx MIC for TKIP. - add two functions to map a PTK and a GTK to an IEEE 802.11 key and use them in ieee80211_input.c instead of duplicating the same code. properly set Tx/Rx MIC in the IEEE 802.11 key in the case of TKIP. - add ic_psk to struct ieee80211com to store the pre-shared key. - fix setting of the SECURE bit in outgoing EAPOL-Key frames. - when receiving msg 2 of the 4-way handshake, deauthenticate the station if the RSN IE does not match that of the (Re)Association request. - before parsing an RSN or WPA IE, check that there's enough room for the version field (2 bytes) which is mandatory. - various tweaks while i'm here.
* add a ni_eapol_desc field to struct ieee80211_node to know whetherdamien2007-08-031-7/+98
| | | | | | | | | | | | a station is using WPA1 or RSN descriptors. make sure that a station that advertises WPA1 capability in an IE uses the WPA1 EAPOL-Key descriptor type and not the RSN one. fix construction of EAPOL-Key frames for WPA1. i can now successfuly complete a 4-way and group-key handshake with both a WPA1 and a WPA2 access point. add some TKIP encapsulation code (no SW crypto yet). ok deraadt@
* add generic ieee80211_encrypt() and ieee80211_decrypt() functions thatdamien2007-08-011-1/+149
| | | | | | | | | | | | can handle multiple ciphers (the key to use is determined automatically by these functions based on the frame's destination address). add ieee80211_ccmp_encrypt() and ieee80211_ccmp_decrypt(). those two functions only do encapsulation/decapsulation of CCMP frames for now (they don't do SW crypto). they will help to test things with drivers that can do HW crypto. add a ni_pairwise_key field to struct ieee80211_node to actually install the pairwise transient key. install the GTK in ic_nw_keys[].
* group key handshake message 1 is very different between RSN and WPA1.damien2007-08-011-2/+2
| | | | | | RSN uses a GTK KDE while WPA1 stores the GTK in the EAPOL-Key frame data field (encrypted) and uses some bits in the info field. split ieee80211_recv_group_msg1() in two separate functions.
* all WPA implementations i have tested use EAPOL-Key frames version 1,damien2007-08-011-3/+1
| | | | | | | | | so use that too and remove a check in ieee80211_recv_eapol(). WPA1 stores the group key id into bits 4-5 of the EAPOL-Key frame info field and uses bit 6 to indicate if the key is Rx/Tx or Rx only. remove a check in ieee80211_eapol_key_decrypt() because WPA1 encrypts the payload of message 1 of the group-key handshake without setting the encrypted bit in the info field.
* the EAPOL-Key MIC must be computed with the MIC bit set.damien2007-08-011-20/+5
| | | | | | | | this simplifies ieee80211_eapol_key_mic() and ieee80211_eapol_key_check_mic() quite a bit. set the EAPOL-Key body length before computing the MIC since the MIC is computed with the 802.1X header too. add a missing htons() while i'm here.
* extend the ieee80211_key structure with a key identifier, a flags fielddamien2007-07-281-19/+36
| | | | | | | | and a 64-bit receive sequence counter (for group keys). add a ieee80211_cipher_keylen() function to retrieve the key length in bytes used by a specific cipher. account for 802.1X header size when computing the Key MIC. some cleanup in comments and variable names while i'm here.
* new function to check the MIC of a received EAPOL-Key frame.damien2007-07-241-1/+24
|
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.