narenas
/
opengnsys_ipxe
mirror of https://github.com/ipxe/ipxe.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[eapol] Replace EAPoL code 

Replace the GPL2+-only EAPoL code (currently used only for WPA) with
new code licensed under GPL2+-or-UBDL.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
pull/141/merge
Michael Brown 2021-01-19 12:34:10 +00:00
parent 8606204595
commit 274ad69012
3 changed files with 110 additions and 147 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

122
src/include/ipxe/eapol.h
View File

@ -1,114 +1,58 @@
/*
* Copyright (c) 2009 Joshua Oreman <oremanj@rwcr.net>.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as
* published by the Free Software Foundation; either version 2 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
#ifndef _IPXE_EAPOL_H #ifndef _IPXE_EAPOL_H
#define _IPXE_EAPOL_H #define _IPXE_EAPOL_H
/** @file /** @file
* *
* Definitions for EAPOL (Extensible Authentication Protocol over * Extensible Authentication Protocol over LAN (EAPoL)
* LANs) frames. Definitions for the packets usually encapsulated in *
* them are elsewhere.
*/ */
#include <ipxe/tables.h> FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
#include <stdint.h> #include <stdint.h>
#include <ipxe/netdevice.h>
#include <ipxe/tables.h>
FILE_LICENCE ( GPL2_OR_LATER ); /** EAPoL header */
struct eapol_header {
/** Version */
/** uint8_t version;
* @defgroup eapol_type EAPOL archetype identifiers /** Type */
* @{ uint8_t type;
*/ /** Payload length */
#define EAPOL_TYPE_EAP 0 /**< EAP authentication handshake packet */ uint16_t len;
#define EAPOL_TYPE_START 1 /**< Request by Peer to begin (no data) */
#define EAPOL_TYPE_LOGOFF 2 /**< Request by Peer to terminate (no data) */
#define EAPOL_TYPE_KEY 3 /**< EAPOL-Key packet */
/** @} */
/** Expected EAPOL version field value
*
* Version 2 is often seen and has no format differences from version 1;
* however, many older APs will completely drop version-2 packets, so
* we advertise ourselves as version 1.
*/
#define EAPOL_THIS_VERSION 1
/** Length of an EAPOL frame header */
#define EAPOL_HDR_LEN 4
/** An EAPOL frame
*
* This may encapsulate an eap_pkt, an eapol_key_pkt, or a Start or
* Logoff request with no data attached. It is transmitted directly in
* an Ethernet frame, with no IP packet header.
*/
struct eapol_frame
{
/** EAPOL version identifier, always 1 */
u8 version;
/** EAPOL archetype identifier indicating format of payload */
u8 type;
/** Length of payload, in network byte order */
u16 length;
/** Payload, if @a type is EAP or EAPOL-Key */
u8 data[0];
} __attribute__ (( packed )); } __attribute__ (( packed ));
/** 802.1X-2001 */
#define EAPOL_VERSION_2001 1
/** An EAPOL frame type handler /** EAPoL key */
* #define EAPOL_TYPE_KEY 5
* Normally there will be at most two of these, one for EAP and one
* for EAPOL-Key frames. The EAPOL interface code handles Start and
* Logoff directly.
*/
struct eapol_handler
{
/** EAPOL archetype identifier for payload this handler will handle */
u8 type;
/** Receive EAPOL-encapsulated packet of specified type /** An EAPoL handler */
struct eapol_handler {
/** Type */
uint8_t type;
/**
* Process received packet
* *
* @v iob I/O buffer containing packet payload * @v iobuf I/O buffer
* @v netdev Network device from which packet was received * @v netdev Network device
* @V ll_dest Destination link-layer address * @v ll_source Link-layer source address
* @v ll_source Source link-layer address
* @ret rc Return status code * @ret rc Return status code
* *
* The I/O buffer will have the EAPOL header pulled off it, so * This method takes ownership of the I/O buffer.
* @c iob->data points to the first byte of the payload.
*
* This function takes ownership of the I/O buffer passed to it.
*/ */
int ( * rx ) ( struct io_buffer *iob, struct net_device *netdev, int ( * rx ) ( struct io_buffer *iobuf, struct net_device *netdev,
const void *ll_dest, const void *ll_source ); const void *ll_source );
}; };
/** EAPoL handler table */
#define EAPOL_HANDLERS __table ( struct eapol_handler, "eapol_handlers" ) #define EAPOL_HANDLERS __table ( struct eapol_handler, "eapol_handlers" )
#define __eapol_handler __table_entry ( EAPOL_HANDLERS, 01 )
/** Declare an EAPoL handler */
#define __eapol_handler __table_entry ( EAPOL_HANDLERS, 01 )
extern struct net_protocol eapol_protocol __net_protocol; extern struct net_protocol eapol_protocol __net_protocol;
#endif /* _IPXE_EAPOL_H */ #endif /* _IPXE_EAPOL_H */

25
src/net/80211/wpa.c
View File

@ -414,12 +414,13 @@ static int wpa_maybe_install_gtk ( struct wpa_common_ctx *ctx,
static struct io_buffer * wpa_alloc_frame ( int kdlen ) static struct io_buffer * wpa_alloc_frame ( int kdlen )
{ {
struct io_buffer *ret = alloc_iob ( sizeof ( struct eapol_key_pkt ) + struct io_buffer *ret = alloc_iob ( sizeof ( struct eapol_key_pkt ) +
kdlen + EAPOL_HDR_LEN + kdlen +
sizeof ( struct eapol_header ) +
MAX_LL_HEADER_LEN ); MAX_LL_HEADER_LEN );
if ( ! ret ) if ( ! ret )
return NULL; return NULL;
iob_reserve ( ret, MAX_LL_HEADER_LEN + EAPOL_HDR_LEN ); iob_reserve ( ret, MAX_LL_HEADER_LEN + sizeof ( struct eapol_header ) );
memset ( iob_put ( ret, sizeof ( struct eapol_key_pkt ) ), 0, memset ( iob_put ( ret, sizeof ( struct eapol_key_pkt ) ), 0,
sizeof ( struct eapol_key_pkt ) ); sizeof ( struct eapol_key_pkt ) );
@ -442,19 +443,19 @@ static int wpa_send_eapol ( struct io_buffer *iob, struct wpa_common_ctx *ctx,
struct wpa_kie *kie ) struct wpa_kie *kie )
{ {
struct eapol_key_pkt *pkt = iob->data; struct eapol_key_pkt *pkt = iob->data;
struct eapol_frame *eapol = iob_push ( iob, EAPOL_HDR_LEN ); struct eapol_header *eapol = iob_push ( iob, sizeof ( *eapol ) );
pkt->info = htons ( pkt->info ); pkt->info = htons ( pkt->info );
pkt->keysize = htons ( pkt->keysize ); pkt->keysize = htons ( pkt->keysize );
pkt->datalen = htons ( pkt->datalen ); pkt->datalen = htons ( pkt->datalen );
pkt->replay = cpu_to_be64 ( pkt->replay ); pkt->replay = cpu_to_be64 ( pkt->replay );
eapol->version = EAPOL_THIS_VERSION; eapol->version = EAPOL_VERSION_2001;
eapol->type = EAPOL_TYPE_KEY; eapol->type = EAPOL_TYPE_KEY;
eapol->length = htons ( iob->tail - iob->data - sizeof ( *eapol ) ); eapol->len = htons ( iob->tail - iob->data - sizeof ( *eapol ) );
memset ( pkt->mic, 0, sizeof ( pkt->mic ) ); memset ( pkt->mic, 0, sizeof ( pkt->mic ) );
if ( kie ) if ( kie )
kie->mic ( &ctx->ptk.kck, eapol, EAPOL_HDR_LEN + kie->mic ( &ctx->ptk.kck, eapol, sizeof ( *eapol ) +
sizeof ( *pkt ) + ntohs ( pkt->datalen ), sizeof ( *pkt ) + ntohs ( pkt->datalen ),
pkt->mic ); pkt->mic );
@ -762,21 +763,23 @@ static int wpa_handle_1_of_2 ( struct wpa_common_ctx *ctx,
* *
* @v iob I/O buffer * @v iob I/O buffer
* @v netdev Network device * @v netdev Network device
* @v ll_dest Link-layer destination address
* @v ll_source Source link-layer address * @v ll_source Source link-layer address
*/ */
static int eapol_key_rx ( struct io_buffer *iob, struct net_device *netdev, static int eapol_key_rx ( struct io_buffer *iob, struct net_device *netdev,
const void *ll_dest __unused,
const void *ll_source ) const void *ll_source )
{ {
struct net80211_device *dev = net80211_get ( netdev ); struct net80211_device *dev = net80211_get ( netdev );
struct eapol_key_pkt *pkt = iob->data; struct eapol_header *eapol;
struct eapol_key_pkt *pkt;
int is_rsn, found_ctx; int is_rsn, found_ctx;
struct wpa_common_ctx *ctx; struct wpa_common_ctx *ctx;
int rc = 0; int rc = 0;
struct wpa_kie *kie; struct wpa_kie *kie;
u8 their_mic[16], our_mic[16]; u8 their_mic[16], our_mic[16];
eapol = iob->data;
pkt = ( ( ( void * ) eapol ) + sizeof ( *eapol ) );
if ( pkt->type != EAPOL_KEY_TYPE_WPA && if ( pkt->type != EAPOL_KEY_TYPE_WPA &&
pkt->type != EAPOL_KEY_TYPE_RSN ) { pkt->type != EAPOL_KEY_TYPE_RSN ) {
DBG ( "EAPOL-Key: packet not of 802.11 type\n" ); DBG ( "EAPOL-Key: packet not of 802.11 type\n" );
@ -840,8 +843,8 @@ static int eapol_key_rx ( struct io_buffer *iob, struct net_device *netdev,
if ( ntohs ( pkt->info ) & EAPOL_KEY_INFO_KEY_MIC ) { if ( ntohs ( pkt->info ) & EAPOL_KEY_INFO_KEY_MIC ) {
memcpy ( their_mic, pkt->mic, sizeof ( pkt->mic ) ); memcpy ( their_mic, pkt->mic, sizeof ( pkt->mic ) );
memset ( pkt->mic, 0, sizeof ( pkt->mic ) ); memset ( pkt->mic, 0, sizeof ( pkt->mic ) );
kie->mic ( &ctx->ptk.kck, ( void * ) pkt - EAPOL_HDR_LEN, kie->mic ( &ctx->ptk.kck, eapol,
EAPOL_HDR_LEN + sizeof ( *pkt ) + sizeof ( *eapol ) + sizeof ( *pkt ) +
ntohs ( pkt->datalen ), our_mic ); ntohs ( pkt->datalen ), our_mic );
DBGC2 ( ctx, "WPA %p MIC comparison (theirs, ours):\n", ctx ); DBGC2 ( ctx, "WPA %p MIC comparison (theirs, ours):\n", ctx );
DBGC2_HD ( ctx, their_mic, 16 ); DBGC2_HD ( ctx, their_mic, 16 );

102
src/net/eapol.c
View File

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 2009 Joshua Oreman <oremanj@rwcr.net>. * Copyright (C) 2021 Michael Brown <mbrown@fensystems.co.uk>.
* *
* This program is free software; you can redistribute it and/or * This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as * modify it under the terms of the GNU General Public License as
@ -15,74 +15,90 @@
* along with this program; if not, write to the Free Software * along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA. * 02110-1301, USA.
*
* You can also choose to distribute this program under the terms of
* the Unmodified Binary Distribution Licence (as given in the file
* COPYING.UBDL), provided that you have satisfied its requirements.
*/ */
FILE_LICENCE ( GPL2_OR_LATER ); FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
#include <assert.h>
#include <errno.h>
#include <byteswap.h>
#include <ipxe/iobuf.h>
#include <ipxe/if_ether.h>
#include <ipxe/netdevice.h>
#include <ipxe/eapol.h>
/** @file /** @file
* *
* 802.1X Extensible Authentication Protocol over LANs demultiplexer * Extensible Authentication Protocol over LAN (EAPoL)
* *
*/ */
#include <ipxe/netdevice.h>
#include <ipxe/iobuf.h>
#include <ipxe/if_ether.h>
#include <ipxe/eapol.h>
#include <errno.h>
#include <byteswap.h>
/** /**
* Receive EAPOL network-layer packet * Process EAPoL packet
* *
* @v iob I/O buffer * @v iobuf I/O buffer
* @v netdev Network device * @v netdev Network device
* @v ll_dest Link-layer destination address * @v ll_dest Link-layer destination address
* @v ll_source Link-layer source address * @v ll_source Link-layer source address
* @v flags Packet flags * @v flags Packet flags
* * @ret rc Return status code
* This function takes ownership of the I/O buffer passed to it.
*/ */
static int eapol_rx ( struct io_buffer *iob, struct net_device *netdev, static int eapol_rx ( struct io_buffer *iobuf, struct net_device *netdev,
const void *ll_dest, const void *ll_source, const void *ll_dest __unused, const void *ll_source,
unsigned int flags __unused ) { unsigned int flags __unused ) {
struct eapol_frame *eapol = iob->data; struct eapol_header *eapol;
struct eapol_handler *handler; struct eapol_handler *handler;
size_t remaining;
size_t len;
int rc;
if ( iob_len ( iob ) < EAPOL_HDR_LEN ) { /* Sanity checks */
free_iob ( iob ); if ( iob_len ( iobuf ) < sizeof ( *eapol ) ) {
return -EINVAL; DBGC ( netdev, "EAPOL %s underlength header:\n",
netdev->name );
DBGC_HDA ( netdev, 0, iobuf->data, iob_len ( iobuf ) );
rc = -EINVAL;
goto drop;
}
eapol = iobuf->data;
remaining = ( iob_len ( iobuf ) - sizeof ( *eapol ) );
len = ntohs ( eapol->len );
if ( len > remaining ) {
DBGC ( netdev, "EAPOL %s v%d type %d len %zd underlength "
"payload:\n", netdev->name, eapol->version,
eapol->type, len );
DBGC_HDA ( netdev, 0, iobuf->data, iob_len ( iobuf ) );
rc = -EINVAL;
goto drop;
} }
/* Strip any trailing padding */
iob_unput ( iobuf, ( len - remaining ) );
/* Handle according to type */
for_each_table_entry ( handler, EAPOL_HANDLERS ) { for_each_table_entry ( handler, EAPOL_HANDLERS ) {
if ( handler->type == eapol->type ) { if ( handler->type == eapol->type ) {
iob_pull ( iob, EAPOL_HDR_LEN ); return handler->rx ( iob_disown ( iobuf ) , netdev,
return handler->rx ( iob, netdev, ll_dest, ll_source ); ll_source );
} }
} }
rc = -ENOTSUP;
DBGC ( netdev, "EAPOL %s v%d type %d unsupported\n",
netdev->name, eapol->version, eapol->type );
DBGC_HDA ( netdev, 0, iobuf->data, iob_len ( iobuf ) );
drop:
free_iob ( iobuf );
return rc;
}
free_iob ( iob ); /** EAPoL protocol */
return -( ENOTSUP | ( ( eapol->type & 0x1f ) << 8 ) );
}
/**
* Transcribe EAPOL network-layer address
*
* @v net_addr Network-layer address
* @ret str String representation of network-layer address
*
* EAPOL doesn't have network-layer addresses, so we just return the
* string @c "<EAPOL>".
*/
static const char * eapol_ntoa ( const void *net_addr __unused )
{
return "<EAPOL>";
}
/** EAPOL network protocol */
struct net_protocol eapol_protocol __net_protocol = { struct net_protocol eapol_protocol __net_protocol = {
.name = "EAPOL", .name = "EAPOL",
.rx = eapol_rx,
.ntoa = eapol_ntoa,
.net_proto = htons ( ETH_P_EAPOL ), .net_proto = htons ( ETH_P_EAPOL ),
.rx = eapol_rx,
}; };