mbox series

[00/14] Support PASN with SAE, FILS and FT

Message ID 20200224091602.15306-1-ilan.peer@intel.com
Headers show
Series Support PASN with SAE, FILS and FT | expand

Message

Peer, Ilan Feb. 24, 2020, 9:15 a.m. UTC
The patch set continues the work introduced in the previous patch set:
"Support base Pre association Security Negotiation (PASN)"

The patch set adds support for SAE, FILS and FT key derivation as part
of PASN authentication.

In addition, support is also added for PASN comeback flow. As the anti
clogging for PASN can use the infra used for SAE anti clogging and
comeback, the patch set includes changes that allow sharing of code
for both SAE and PASN.

Ilan Peer (14):
  PASN: Support PASN with SAE key derivation
  AP: Support PASN with SAE key derivation
  tests: Add PASN tests with SAE
  PASN: Support PASN with FILS key derivation
  AP: Support PASN with FILS key derivation
  tests: Add PASN with FILS tests
  AP: Rename SAE anti clogging variables and functions
  AP: Move anti clogging handling code
  AP: Add support for PASN comeback flow
  PASN: Add support for comeback flow to the wpa_supplicant
  tests: Add PASN test with comeback flow
  PASN: Support PASN with FT key derivation
  AP: Support PASN with FT key derivation
  tests: Add PASN tests with FT key derivation

 hostapd/config_file.c             |    4 +-
 src/ap/ap_config.c                |    2 +-
 src/ap/ap_config.h                |    2 +-
 src/ap/hostapd.h                  |    8 +-
 src/ap/ieee802_11.c               | 1165 +++++++++++++++++++++++------
 src/ap/ieee802_1x.c               |    3 +-
 src/ap/sta_info.c                 |   14 +
 src/ap/sta_info.h                 |   26 +
 src/ap/wpa_auth.h                 |    8 +
 src/ap/wpa_auth_ft.c              |   14 +-
 src/rsn_supp/wpa.c                |   16 +
 src/rsn_supp/wpa.h                |   19 +
 src/rsn_supp/wpa_ft.c             |   97 +++
 src/rsn_supp/wpa_i.h              |   16 +
 tests/hwsim/test_pasn.py          |  330 +++++++-
 tests/hwsim/test_sae.py           |   12 +-
 wpa_supplicant/ctrl_iface.c       |   27 +-
 wpa_supplicant/pasn_supplicant.c  |  714 +++++++++++++++++-
 wpa_supplicant/wpa_cli.c          |    2 +-
 wpa_supplicant/wpa_supplicant_i.h |   38 +-
 20 files changed, 2222 insertions(+), 295 deletions(-)

Comments

Jouni Malinen Feb. 29, 2020, 10:28 p.m. UTC | #1
On Mon, Feb 24, 2020 at 11:15:48AM +0200, Ilan Peer wrote:
> The patch set continues the work introduced in the previous patch set:
> "Support base Pre association Security Negotiation (PASN)"
> 
> The patch set adds support for SAE, FILS and FT key derivation as part
> of PASN authentication.
> 
> In addition, support is also added for PASN comeback flow. As the anti
> clogging for PASN can use the infra used for SAE anti clogging and
> comeback, the patch set includes changes that allow sharing of code
> for both SAE and PASN.
> 
> Ilan Peer (14):
>   PASN: Support PASN with SAE key derivation
>   AP: Support PASN with SAE key derivation
>   tests: Add PASN tests with SAE
>   PASN: Support PASN with FILS key derivation
>   AP: Support PASN with FILS key derivation
>   tests: Add PASN with FILS tests
>   AP: Rename SAE anti clogging variables and functions
>   AP: Move anti clogging handling code
>   AP: Add support for PASN comeback flow
>   PASN: Add support for comeback flow to the wpa_supplicant
>   tests: Add PASN test with comeback flow
>   PASN: Support PASN with FT key derivation
>   AP: Support PASN with FT key derivation
>   tests: Add PASN tests with FT key derivation

Taken into account the comments I have on many (if not more or less all)
patches in the previous set regarding whether P802.11az/D2.0 is stable
enough to be included in hostap.git, I'd expect that most of these would
not be applicable without the earlier patches. As such, I'm dropping
this set from my queue until the previous set has been addressed (which
may need to wait for P802.11az to standard initial SA ballot to get the
ANA assignments done).

Does that sound fine to you or is there something in these that should
be considered earlier?
Peer, Ilan March 1, 2020, 8:36 a.m. UTC | #2
> -----Original Message-----
> From: Jouni Malinen <j@w1.fi>
> Sent: Sunday, March 01, 2020 00:28
> To: Peer, Ilan <ilan.peer@intel.com>
> Cc: hostap@lists.infradead.org
> Subject: Re: [PATCH 00/14] Support PASN with SAE, FILS and FT
> 
> On Mon, Feb 24, 2020 at 11:15:48AM +0200, Ilan Peer wrote:
> > The patch set continues the work introduced in the previous patch set:
> > "Support base Pre association Security Negotiation (PASN)"
> >
> > The patch set adds support for SAE, FILS and FT key derivation as part
> > of PASN authentication.
> >
> > In addition, support is also added for PASN comeback flow. As the anti
> > clogging for PASN can use the infra used for SAE anti clogging and
> > comeback, the patch set includes changes that allow sharing of code
> > for both SAE and PASN.
> >
> > Ilan Peer (14):
> >   PASN: Support PASN with SAE key derivation
> >   AP: Support PASN with SAE key derivation
> >   tests: Add PASN tests with SAE
> >   PASN: Support PASN with FILS key derivation
> >   AP: Support PASN with FILS key derivation
> >   tests: Add PASN with FILS tests
> >   AP: Rename SAE anti clogging variables and functions
> >   AP: Move anti clogging handling code
> >   AP: Add support for PASN comeback flow
> >   PASN: Add support for comeback flow to the wpa_supplicant
> >   tests: Add PASN test with comeback flow
> >   PASN: Support PASN with FT key derivation
> >   AP: Support PASN with FT key derivation
> >   tests: Add PASN tests with FT key derivation
> 
> Taken into account the comments I have on many (if not more or less all)
> patches in the previous set regarding whether P802.11az/D2.0 is stable
> enough to be included in hostap.git, I'd expect that most of these would not
> be applicable without the earlier patches. As such, I'm dropping this set from
> my queue until the previous set has been addressed (which may need to
> wait for P802.11az to standard initial SA ballot to get the ANA assignments
> done).
> 
> Does that sound fine to you or is there something in these that should be
> considered earlier?
> 

Sure. Lets wait for things to be more stable.

Thanks,

Ilan.