[pkg-wpa-devel] [wpa] 07/07: Optional AP side workaround for key reinstallation attacks
Andrew Shadura
andrewsh at debian.org
Fri Nov 24 16:28:17 UTC 2017
This is an automated email from the git hooks/post-receive script.
andrewsh pushed a commit to branch debian/experimental
in repository wpa.
commit c7f7a172a83891decb3a48693d05f843f000c931
Author: Andrew Shadura <andrew.shadura at collabora.co.uk>
Date: Fri Nov 24 16:24:53 2017 +0000
Optional AP side workaround for key reinstallation attacks
LP: #1730399
---
debian/patches/series | 1 +
debian/patches/wpa_disable_eapol_key_retries.patch | 222 +++++++++++++++++++++
2 files changed, 223 insertions(+)
diff --git a/debian/patches/series b/debian/patches/series
index 1dec87e..b72b558 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -21,3 +21,4 @@ VU-228519/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch
VU-228519/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch
VU-228519/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch
VU-228519/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch
+wpa_disable_eapol_key_retries.patch
diff --git a/debian/patches/wpa_disable_eapol_key_retries.patch b/debian/patches/wpa_disable_eapol_key_retries.patch
new file mode 100644
index 0000000..e3a3cfb
--- /dev/null
+++ b/debian/patches/wpa_disable_eapol_key_retries.patch
@@ -0,0 +1,222 @@
+From 6f234c1e2ee1ede29f2412b7012b3345ed8e52d3 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j at w1.fi>
+Date: Mon, 16 Oct 2017 18:37:43 +0300
+Subject: Optional AP side workaround for key reinstallation attacks
+
+This adds a new hostapd configuration parameter
+wpa_disable_eapol_key_retries=1 that can be used to disable
+retransmission of EAPOL-Key frames that are used to install
+keys (EAPOL-Key message 3/4 and group message 1/2). This is
+similar to setting wpa_group_update_count=1 and
+wpa_pairwise_update_count=1, but with no impact to message 1/4
+retries and with extended timeout for messages 4/4 and group
+message 2/2 to avoid causing issues with stations that may use
+aggressive power saving have very long time in replying to the
+EAPOL-Key messages.
+
+This option can be used to work around key reinstallation attacks
+on the station (supplicant) side in cases those station devices
+cannot be updated for some reason. By removing the
+retransmissions the attacker cannot cause key reinstallation with
+a delayed frame transmission. This is related to the station side
+vulnerabilities CVE-2017-13077, CVE-2017-13078, CVE-2017-13079,
+CVE-2017-13080, and CVE-2017-13081.
+
+This workaround might cause interoperability issues and reduced
+robustness of key negotiation especially in environments with
+heavy traffic load due to the number of attempts to perform the
+key exchange is reduced significantly. As such, this workaround
+is disabled by default (unless overridden in build
+configuration). To enable this, set the parameter to 1.
+
+It is also possible to enable this in the build by default by
+adding the following to the build configuration:
+
+CFLAGS += -DDEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES=1
+
+Signed-off-by: Jouni Malinen <j at w1.fi>
+---
+ hostapd/config_file.c | 2 ++
+ hostapd/defconfig | 4 ++++
+ hostapd/hostapd.conf | 24 ++++++++++++++++++++++++
+ src/ap/ap_config.c | 6 ++++++
+ src/ap/ap_config.h | 1 +
+ src/ap/wpa_auth.c | 22 ++++++++++++++++++++--
+ src/ap/wpa_auth.h | 1 +
+ src/ap/wpa_auth_glue.c | 2 ++
+ 8 files changed, 60 insertions(+), 2 deletions(-)
+
+
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -2440,6 +2440,8 @@
+ bss->wpa_gmk_rekey = atoi(pos);
+ } else if (os_strcmp(buf, "wpa_ptk_rekey") == 0) {
+ bss->wpa_ptk_rekey = atoi(pos);
++ } else if (os_strcmp(buf, "wpa_disable_eapol_key_retries") == 0) {
++ bss->wpa_disable_eapol_key_retries = atoi(pos);
+ } else if (os_strcmp(buf, "wpa_passphrase") == 0) {
+ int len = os_strlen(pos);
+ if (len < 8 || len > 63) {
+--- a/hostapd/defconfig
++++ b/hostapd/defconfig
+@@ -343,3 +343,7 @@
+ # a client, from which a signature can be produced which can identify the model
+ # of client device like "Nexus 6P" or "iPhone 5s".
+ #CONFIG_TAXONOMY=y
++
++# Override default value for the wpa_disable_eapol_key_retries configuration
++# parameter. See that parameter in hostapd.conf for more details.
++#CFLAGS += -DDEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES=1
+--- a/hostapd/hostapd.conf
++++ b/hostapd/hostapd.conf
+@@ -1196,6 +1196,30 @@
+ # PTK to mitigate some attacks against TKIP deficiencies.
+ #wpa_ptk_rekey=600
+
++# Workaround for key reinstallation attacks
++#
++# This parameter can be used to disable retransmission of EAPOL-Key frames that
++# are used to install keys (EAPOL-Key message 3/4 and group message 1/2). This
++# is similar to setting wpa_group_update_count=1 and
++# wpa_pairwise_update_count=1, but with no impact to message 1/4 and with
++# extended timeout on the response to avoid causing issues with stations that
++# may use aggressive power saving have very long time in replying to the
++# EAPOL-Key messages.
++#
++# This option can be used to work around key reinstallation attacks on the
++# station (supplicant) side in cases those station devices cannot be updated
++# for some reason. By removing the retransmissions the attacker cannot cause
++# key reinstallation with a delayed frame transmission. This is related to the
++# station side vulnerabilities CVE-2017-13077, CVE-2017-13078, CVE-2017-13079,
++# CVE-2017-13080, and CVE-2017-13081.
++#
++# This workaround might cause interoperability issues and reduced robustness of
++# key negotiation especially in environments with heavy traffic load due to the
++# number of attempts to perform the key exchange is reduced significantly. As
++# such, this workaround is disabled by default (unless overridden in build
++# configuration). To enable this, set the parameter to 1.
++#wpa_disable_eapol_key_retries=1
++
+ # Enable IEEE 802.11i/RSN/WPA2 pre-authentication. This is used to speed up
+ # roaming be pre-authenticating IEEE 802.1X/EAP part of the full RSN
+ # authentication and key handshake before actually associating with a new AP.
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -36,6 +36,10 @@
+ }
+
+
++#ifndef DEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES
++#define DEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES 0
++#endif /* DEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES */
++
+ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
+ {
+ dl_list_init(&bss->anqp_elem);
+@@ -55,6 +59,8 @@
+
+ bss->wpa_group_rekey = 600;
+ bss->wpa_gmk_rekey = 86400;
++ bss->wpa_disable_eapol_key_retries =
++ DEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES;
+ bss->wpa_key_mgmt = WPA_KEY_MGMT_PSK;
+ bss->wpa_pairwise = WPA_CIPHER_TKIP;
+ bss->wpa_group = WPA_CIPHER_TKIP;
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -324,6 +324,7 @@
+ int wpa_strict_rekey;
+ int wpa_gmk_rekey;
+ int wpa_ptk_rekey;
++ int wpa_disable_eapol_key_retries;
+ int rsn_pairwise;
+ int rsn_preauth;
+ char *rsn_preauth_interfaces;
+--- a/src/ap/wpa_auth.c
++++ b/src/ap/wpa_auth.c
+@@ -58,6 +58,7 @@
+ static const u32 eapol_key_timeout_first = 100; /* ms */
+ static const u32 eapol_key_timeout_subseq = 1000; /* ms */
+ static const u32 eapol_key_timeout_first_group = 500; /* ms */
++static const u32 eapol_key_timeout_no_retrans = 4000; /* ms */
+
+ /* TODO: make these configurable */
+ static const int dot11RSNAConfigPMKLifetime = 43200;
+@@ -1627,6 +1628,9 @@
+ eapol_key_timeout_first_group;
+ else
+ timeout_ms = eapol_key_timeout_subseq;
++ if (wpa_auth->conf.wpa_disable_eapol_key_retries &&
++ (!pairwise || (key_info & WPA_KEY_INFO_MIC)))
++ timeout_ms = eapol_key_timeout_no_retrans;
+ if (pairwise && ctr == 1 && !(key_info & WPA_KEY_INFO_MIC))
+ sm->pending_1_of_4_timeout = 1;
+ wpa_printf(MSG_DEBUG, "WPA: Use EAPOL-Key timeout of %u ms (retry "
+@@ -2229,6 +2233,11 @@
+ sm->TimeoutEvt = FALSE;
+
+ sm->TimeoutCtr++;
++ if (sm->wpa_auth->conf.wpa_disable_eapol_key_retries &&
++ sm->TimeoutCtr > 1) {
++ /* Do not allow retransmission of EAPOL-Key msg 3/4 */
++ return;
++ }
+ if (sm->TimeoutCtr > (int) dot11RSNAConfigPairwiseUpdateCount) {
+ /* No point in sending the EAPOL-Key - we will disconnect
+ * immediately following this. */
+@@ -2554,7 +2563,9 @@
+ sm->EAPOLKeyPairwise && sm->MICVerified)
+ SM_ENTER(WPA_PTK, PTKINITDONE);
+ else if (sm->TimeoutCtr >
+- (int) dot11RSNAConfigPairwiseUpdateCount) {
++ (int) dot11RSNAConfigPairwiseUpdateCount ||
++ (sm->wpa_auth->conf.wpa_disable_eapol_key_retries &&
++ sm->TimeoutCtr > 1)) {
+ wpa_auth->dot11RSNA4WayHandshakeFailures++;
+ wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
+ "PTKINITNEGOTIATING: Retry limit %d "
+@@ -2594,6 +2605,11 @@
+ SM_ENTRY_MA(WPA_PTK_GROUP, REKEYNEGOTIATING, wpa_ptk_group);
+
+ sm->GTimeoutCtr++;
++ if (sm->wpa_auth->conf.wpa_disable_eapol_key_retries &&
++ sm->GTimeoutCtr > 1) {
++ /* Do not allow retransmission of EAPOL-Key group msg 1/2 */
++ return;
++ }
+ if (sm->GTimeoutCtr > (int) dot11RSNAConfigGroupUpdateCount) {
+ /* No point in sending the EAPOL-Key - we will disconnect
+ * immediately following this. */
+@@ -2691,7 +2707,9 @@
+ !sm->EAPOLKeyPairwise && sm->MICVerified)
+ SM_ENTER(WPA_PTK_GROUP, REKEYESTABLISHED);
+ else if (sm->GTimeoutCtr >
+- (int) dot11RSNAConfigGroupUpdateCount)
++ (int) dot11RSNAConfigGroupUpdateCount ||
++ (sm->wpa_auth->conf.wpa_disable_eapol_key_retries &&
++ sm->GTimeoutCtr > 1))
+ SM_ENTER(WPA_PTK_GROUP, KEYERROR);
+ else if (sm->TimeoutEvt)
+ SM_ENTER(WPA_PTK_GROUP, REKEYNEGOTIATING);
+--- a/src/ap/wpa_auth_glue.c
++++ b/src/ap/wpa_auth_glue.c
+@@ -41,6 +41,8 @@
+ wconf->wpa_strict_rekey = conf->wpa_strict_rekey;
+ wconf->wpa_gmk_rekey = conf->wpa_gmk_rekey;
+ wconf->wpa_ptk_rekey = conf->wpa_ptk_rekey;
++ wconf->wpa_disable_eapol_key_retries =
++ conf->wpa_disable_eapol_key_retries;
+ wconf->rsn_pairwise = conf->rsn_pairwise;
+ wconf->rsn_preauth = conf->rsn_preauth;
+ wconf->eapol_version = conf->eapol_version;
+--- a/src/ap/wpa_auth.h
++++ b/src/ap/wpa_auth.h
+@@ -144,6 +144,7 @@
+ int wpa_strict_rekey;
+ int wpa_gmk_rekey;
+ int wpa_ptk_rekey;
++ int wpa_disable_eapol_key_retries;
+ int rsn_pairwise;
+ int rsn_preauth;
+ int eapol_version;
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/collab-maint/wpa.git
More information about the Pkg-wpa-devel
mailing list