]>
Commit | Line | Data |
---|---|---|
6fc6879b JM |
1 | /* |
2 | * hostapd - WPA/RSN IE and KDE definitions | |
56586197 | 3 | * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi> |
6fc6879b JM |
4 | * |
5 | * This program is free software; you can redistribute it and/or modify | |
6 | * it under the terms of the GNU General Public License version 2 as | |
7 | * published by the Free Software Foundation. | |
8 | * | |
9 | * Alternatively, this software may be distributed under the terms of BSD | |
10 | * license. | |
11 | * | |
12 | * See README and COPYING for more details. | |
13 | */ | |
14 | ||
6226e38d | 15 | #include "utils/includes.h" |
6fc6879b | 16 | |
6226e38d | 17 | #include "utils/common.h" |
281c950b | 18 | #include "eapol_auth/eapol_auth_sm.h" |
6226e38d JM |
19 | #include "ap_config.h" |
20 | #include "ieee802_11.h" | |
21 | #include "wpa_auth.h" | |
22 | #include "pmksa_cache_auth.h" | |
6fc6879b JM |
23 | #include "wpa_auth_ie.h" |
24 | #include "wpa_auth_i.h" | |
25 | ||
26 | ||
27 | static int wpa_write_wpa_ie(struct wpa_auth_config *conf, u8 *buf, size_t len) | |
28 | { | |
29 | struct wpa_ie_hdr *hdr; | |
30 | int num_suites; | |
31 | u8 *pos, *count; | |
32 | ||
33 | hdr = (struct wpa_ie_hdr *) buf; | |
34 | hdr->elem_id = WLAN_EID_VENDOR_SPECIFIC; | |
35 | RSN_SELECTOR_PUT(hdr->oui, WPA_OUI_TYPE); | |
36 | WPA_PUT_LE16(hdr->version, WPA_VERSION); | |
37 | pos = (u8 *) (hdr + 1); | |
38 | ||
39 | if (conf->wpa_group == WPA_CIPHER_CCMP) { | |
40 | RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_CCMP); | |
41 | } else if (conf->wpa_group == WPA_CIPHER_TKIP) { | |
42 | RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_TKIP); | |
43 | } else if (conf->wpa_group == WPA_CIPHER_WEP104) { | |
44 | RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_WEP104); | |
45 | } else if (conf->wpa_group == WPA_CIPHER_WEP40) { | |
46 | RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_WEP40); | |
47 | } else { | |
48 | wpa_printf(MSG_DEBUG, "Invalid group cipher (%d).", | |
49 | conf->wpa_group); | |
50 | return -1; | |
51 | } | |
52 | pos += WPA_SELECTOR_LEN; | |
53 | ||
54 | num_suites = 0; | |
55 | count = pos; | |
56 | pos += 2; | |
57 | ||
58 | if (conf->wpa_pairwise & WPA_CIPHER_CCMP) { | |
59 | RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_CCMP); | |
60 | pos += WPA_SELECTOR_LEN; | |
61 | num_suites++; | |
62 | } | |
63 | if (conf->wpa_pairwise & WPA_CIPHER_TKIP) { | |
64 | RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_TKIP); | |
65 | pos += WPA_SELECTOR_LEN; | |
66 | num_suites++; | |
67 | } | |
68 | if (conf->wpa_pairwise & WPA_CIPHER_NONE) { | |
69 | RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_NONE); | |
70 | pos += WPA_SELECTOR_LEN; | |
71 | num_suites++; | |
72 | } | |
73 | ||
74 | if (num_suites == 0) { | |
75 | wpa_printf(MSG_DEBUG, "Invalid pairwise cipher (%d).", | |
76 | conf->wpa_pairwise); | |
77 | return -1; | |
78 | } | |
79 | WPA_PUT_LE16(count, num_suites); | |
80 | ||
81 | num_suites = 0; | |
82 | count = pos; | |
83 | pos += 2; | |
84 | ||
85 | if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) { | |
86 | RSN_SELECTOR_PUT(pos, WPA_AUTH_KEY_MGMT_UNSPEC_802_1X); | |
87 | pos += WPA_SELECTOR_LEN; | |
88 | num_suites++; | |
89 | } | |
90 | if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) { | |
91 | RSN_SELECTOR_PUT(pos, WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X); | |
92 | pos += WPA_SELECTOR_LEN; | |
93 | num_suites++; | |
94 | } | |
95 | ||
96 | if (num_suites == 0) { | |
97 | wpa_printf(MSG_DEBUG, "Invalid key management type (%d).", | |
98 | conf->wpa_key_mgmt); | |
99 | return -1; | |
100 | } | |
101 | WPA_PUT_LE16(count, num_suites); | |
102 | ||
103 | /* WPA Capabilities; use defaults, so no need to include it */ | |
104 | ||
105 | hdr->len = (pos - buf) - 2; | |
106 | ||
107 | return pos - buf; | |
108 | } | |
109 | ||
110 | ||
111 | int wpa_write_rsn_ie(struct wpa_auth_config *conf, u8 *buf, size_t len, | |
112 | const u8 *pmkid) | |
113 | { | |
114 | struct rsn_ie_hdr *hdr; | |
115 | int num_suites; | |
116 | u8 *pos, *count; | |
117 | u16 capab; | |
118 | ||
119 | hdr = (struct rsn_ie_hdr *) buf; | |
120 | hdr->elem_id = WLAN_EID_RSN; | |
121 | WPA_PUT_LE16(hdr->version, RSN_VERSION); | |
122 | pos = (u8 *) (hdr + 1); | |
123 | ||
124 | if (conf->wpa_group == WPA_CIPHER_CCMP) { | |
125 | RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP); | |
126 | } else if (conf->wpa_group == WPA_CIPHER_TKIP) { | |
127 | RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_TKIP); | |
128 | } else if (conf->wpa_group == WPA_CIPHER_WEP104) { | |
129 | RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_WEP104); | |
130 | } else if (conf->wpa_group == WPA_CIPHER_WEP40) { | |
131 | RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_WEP40); | |
132 | } else { | |
133 | wpa_printf(MSG_DEBUG, "Invalid group cipher (%d).", | |
134 | conf->wpa_group); | |
135 | return -1; | |
136 | } | |
137 | pos += RSN_SELECTOR_LEN; | |
138 | ||
139 | num_suites = 0; | |
140 | count = pos; | |
141 | pos += 2; | |
142 | ||
143 | if (conf->rsn_pairwise & WPA_CIPHER_CCMP) { | |
144 | RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP); | |
145 | pos += RSN_SELECTOR_LEN; | |
146 | num_suites++; | |
147 | } | |
148 | if (conf->rsn_pairwise & WPA_CIPHER_TKIP) { | |
149 | RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_TKIP); | |
150 | pos += RSN_SELECTOR_LEN; | |
151 | num_suites++; | |
152 | } | |
153 | if (conf->rsn_pairwise & WPA_CIPHER_NONE) { | |
154 | RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NONE); | |
155 | pos += RSN_SELECTOR_LEN; | |
156 | num_suites++; | |
157 | } | |
158 | ||
159 | if (num_suites == 0) { | |
160 | wpa_printf(MSG_DEBUG, "Invalid pairwise cipher (%d).", | |
161 | conf->rsn_pairwise); | |
162 | return -1; | |
163 | } | |
164 | WPA_PUT_LE16(count, num_suites); | |
165 | ||
166 | num_suites = 0; | |
167 | count = pos; | |
168 | pos += 2; | |
169 | ||
170 | if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) { | |
171 | RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_UNSPEC_802_1X); | |
172 | pos += RSN_SELECTOR_LEN; | |
173 | num_suites++; | |
174 | } | |
175 | if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) { | |
176 | RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X); | |
177 | pos += RSN_SELECTOR_LEN; | |
178 | num_suites++; | |
179 | } | |
180 | #ifdef CONFIG_IEEE80211R | |
181 | if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) { | |
182 | RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_802_1X); | |
183 | pos += RSN_SELECTOR_LEN; | |
184 | num_suites++; | |
185 | } | |
186 | if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_PSK) { | |
187 | RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_PSK); | |
188 | pos += RSN_SELECTOR_LEN; | |
189 | num_suites++; | |
190 | } | |
191 | #endif /* CONFIG_IEEE80211R */ | |
56586197 JM |
192 | #ifdef CONFIG_IEEE80211W |
193 | if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) { | |
194 | RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SHA256); | |
195 | pos += RSN_SELECTOR_LEN; | |
196 | num_suites++; | |
197 | } | |
198 | if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK_SHA256) { | |
199 | RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PSK_SHA256); | |
200 | pos += RSN_SELECTOR_LEN; | |
201 | num_suites++; | |
202 | } | |
203 | #endif /* CONFIG_IEEE80211W */ | |
6fc6879b JM |
204 | |
205 | if (num_suites == 0) { | |
206 | wpa_printf(MSG_DEBUG, "Invalid key management type (%d).", | |
207 | conf->wpa_key_mgmt); | |
208 | return -1; | |
209 | } | |
210 | WPA_PUT_LE16(count, num_suites); | |
211 | ||
212 | /* RSN Capabilities */ | |
213 | capab = 0; | |
214 | if (conf->rsn_preauth) | |
215 | capab |= WPA_CAPABILITY_PREAUTH; | |
216 | if (conf->peerkey) | |
217 | capab |= WPA_CAPABILITY_PEERKEY_ENABLED; | |
3ae0800c JM |
218 | if (conf->wmm_enabled) { |
219 | /* 4 PTKSA replay counters when using WMM */ | |
6fc6879b JM |
220 | capab |= (RSN_NUM_REPLAY_COUNTERS_16 << 2); |
221 | } | |
222 | #ifdef CONFIG_IEEE80211W | |
0b60b0aa JM |
223 | if (conf->ieee80211w != WPA_NO_IEEE80211W) { |
224 | capab |= WPA_CAPABILITY_MFPC; | |
225 | if (conf->ieee80211w == IEEE80211W_REQUIRED) | |
226 | capab |= WPA_CAPABILITY_MFPR; | |
227 | } | |
6fc6879b JM |
228 | #endif /* CONFIG_IEEE80211W */ |
229 | WPA_PUT_LE16(pos, capab); | |
230 | pos += 2; | |
231 | ||
232 | if (pmkid) { | |
233 | if (pos + 2 + PMKID_LEN > buf + len) | |
234 | return -1; | |
235 | /* PMKID Count */ | |
236 | WPA_PUT_LE16(pos, 1); | |
237 | pos += 2; | |
238 | os_memcpy(pos, pmkid, PMKID_LEN); | |
239 | pos += PMKID_LEN; | |
240 | } | |
241 | ||
242 | #ifdef CONFIG_IEEE80211W | |
243 | if (conf->ieee80211w != WPA_NO_IEEE80211W) { | |
244 | if (pos + 2 + 4 > buf + len) | |
245 | return -1; | |
246 | if (pmkid == NULL) { | |
247 | /* PMKID Count */ | |
248 | WPA_PUT_LE16(pos, 0); | |
249 | pos += 2; | |
250 | } | |
251 | ||
252 | /* Management Group Cipher Suite */ | |
253 | RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC); | |
254 | pos += RSN_SELECTOR_LEN; | |
255 | } | |
256 | #endif /* CONFIG_IEEE80211W */ | |
257 | ||
258 | hdr->len = (pos - buf) - 2; | |
259 | ||
260 | return pos - buf; | |
261 | } | |
262 | ||
263 | ||
264 | int wpa_auth_gen_wpa_ie(struct wpa_authenticator *wpa_auth) | |
265 | { | |
266 | u8 *pos, buf[128]; | |
267 | int res; | |
268 | ||
269 | pos = buf; | |
270 | ||
271 | if (wpa_auth->conf.wpa & WPA_PROTO_RSN) { | |
272 | res = wpa_write_rsn_ie(&wpa_auth->conf, | |
273 | pos, buf + sizeof(buf) - pos, NULL); | |
274 | if (res < 0) | |
275 | return res; | |
276 | pos += res; | |
277 | } | |
278 | #ifdef CONFIG_IEEE80211R | |
279 | if (wpa_auth->conf.wpa_key_mgmt & | |
280 | (WPA_KEY_MGMT_FT_IEEE8021X | WPA_KEY_MGMT_FT_PSK)) { | |
281 | res = wpa_write_mdie(&wpa_auth->conf, pos, | |
282 | buf + sizeof(buf) - pos); | |
283 | if (res < 0) | |
284 | return res; | |
285 | pos += res; | |
286 | } | |
287 | #endif /* CONFIG_IEEE80211R */ | |
288 | if (wpa_auth->conf.wpa & WPA_PROTO_WPA) { | |
289 | res = wpa_write_wpa_ie(&wpa_auth->conf, | |
290 | pos, buf + sizeof(buf) - pos); | |
291 | if (res < 0) | |
292 | return res; | |
293 | pos += res; | |
294 | } | |
295 | ||
296 | os_free(wpa_auth->wpa_ie); | |
297 | wpa_auth->wpa_ie = os_malloc(pos - buf); | |
298 | if (wpa_auth->wpa_ie == NULL) | |
299 | return -1; | |
300 | os_memcpy(wpa_auth->wpa_ie, buf, pos - buf); | |
301 | wpa_auth->wpa_ie_len = pos - buf; | |
302 | ||
303 | return 0; | |
304 | } | |
305 | ||
306 | ||
307 | u8 * wpa_add_kde(u8 *pos, u32 kde, const u8 *data, size_t data_len, | |
308 | const u8 *data2, size_t data2_len) | |
309 | { | |
310 | *pos++ = WLAN_EID_VENDOR_SPECIFIC; | |
311 | *pos++ = RSN_SELECTOR_LEN + data_len + data2_len; | |
312 | RSN_SELECTOR_PUT(pos, kde); | |
313 | pos += RSN_SELECTOR_LEN; | |
314 | os_memcpy(pos, data, data_len); | |
315 | pos += data_len; | |
316 | if (data2) { | |
317 | os_memcpy(pos, data2, data2_len); | |
318 | pos += data2_len; | |
319 | } | |
320 | return pos; | |
321 | } | |
322 | ||
323 | ||
324 | static int wpa_selector_to_bitfield(const u8 *s) | |
325 | { | |
326 | if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_NONE) | |
327 | return WPA_CIPHER_NONE; | |
328 | if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_WEP40) | |
329 | return WPA_CIPHER_WEP40; | |
330 | if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_TKIP) | |
331 | return WPA_CIPHER_TKIP; | |
332 | if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_CCMP) | |
333 | return WPA_CIPHER_CCMP; | |
334 | if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_WEP104) | |
335 | return WPA_CIPHER_WEP104; | |
336 | return 0; | |
337 | } | |
338 | ||
339 | ||
340 | static int wpa_key_mgmt_to_bitfield(const u8 *s) | |
341 | { | |
342 | if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_UNSPEC_802_1X) | |
343 | return WPA_KEY_MGMT_IEEE8021X; | |
344 | if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X) | |
345 | return WPA_KEY_MGMT_PSK; | |
346 | if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_NONE) | |
347 | return WPA_KEY_MGMT_WPA_NONE; | |
348 | return 0; | |
349 | } | |
350 | ||
351 | ||
352 | static int wpa_parse_wpa_ie_wpa(const u8 *wpa_ie, size_t wpa_ie_len, | |
353 | struct wpa_ie_data *data) | |
354 | { | |
355 | const struct wpa_ie_hdr *hdr; | |
356 | const u8 *pos; | |
357 | int left; | |
358 | int i, count; | |
359 | ||
360 | os_memset(data, 0, sizeof(*data)); | |
361 | data->pairwise_cipher = WPA_CIPHER_TKIP; | |
362 | data->group_cipher = WPA_CIPHER_TKIP; | |
363 | data->key_mgmt = WPA_KEY_MGMT_IEEE8021X; | |
364 | data->mgmt_group_cipher = 0; | |
365 | ||
366 | if (wpa_ie_len < sizeof(struct wpa_ie_hdr)) | |
367 | return -1; | |
368 | ||
369 | hdr = (const struct wpa_ie_hdr *) wpa_ie; | |
370 | ||
371 | if (hdr->elem_id != WLAN_EID_VENDOR_SPECIFIC || | |
372 | hdr->len != wpa_ie_len - 2 || | |
373 | RSN_SELECTOR_GET(hdr->oui) != WPA_OUI_TYPE || | |
374 | WPA_GET_LE16(hdr->version) != WPA_VERSION) { | |
375 | return -2; | |
376 | } | |
377 | ||
378 | pos = (const u8 *) (hdr + 1); | |
379 | left = wpa_ie_len - sizeof(*hdr); | |
380 | ||
381 | if (left >= WPA_SELECTOR_LEN) { | |
382 | data->group_cipher = wpa_selector_to_bitfield(pos); | |
383 | pos += WPA_SELECTOR_LEN; | |
384 | left -= WPA_SELECTOR_LEN; | |
385 | } else if (left > 0) | |
386 | return -3; | |
387 | ||
388 | if (left >= 2) { | |
389 | data->pairwise_cipher = 0; | |
390 | count = WPA_GET_LE16(pos); | |
391 | pos += 2; | |
392 | left -= 2; | |
393 | if (count == 0 || left < count * WPA_SELECTOR_LEN) | |
394 | return -4; | |
395 | for (i = 0; i < count; i++) { | |
396 | data->pairwise_cipher |= wpa_selector_to_bitfield(pos); | |
397 | pos += WPA_SELECTOR_LEN; | |
398 | left -= WPA_SELECTOR_LEN; | |
399 | } | |
400 | } else if (left == 1) | |
401 | return -5; | |
402 | ||
403 | if (left >= 2) { | |
404 | data->key_mgmt = 0; | |
405 | count = WPA_GET_LE16(pos); | |
406 | pos += 2; | |
407 | left -= 2; | |
408 | if (count == 0 || left < count * WPA_SELECTOR_LEN) | |
409 | return -6; | |
410 | for (i = 0; i < count; i++) { | |
411 | data->key_mgmt |= wpa_key_mgmt_to_bitfield(pos); | |
412 | pos += WPA_SELECTOR_LEN; | |
413 | left -= WPA_SELECTOR_LEN; | |
414 | } | |
415 | } else if (left == 1) | |
416 | return -7; | |
417 | ||
418 | if (left >= 2) { | |
419 | data->capabilities = WPA_GET_LE16(pos); | |
420 | pos += 2; | |
421 | left -= 2; | |
422 | } | |
423 | ||
424 | if (left > 0) { | |
425 | return -8; | |
426 | } | |
427 | ||
428 | return 0; | |
429 | } | |
430 | ||
431 | ||
bf98f7f3 JM |
432 | struct wpa_auth_okc_iter_data { |
433 | struct rsn_pmksa_cache_entry *pmksa; | |
434 | const u8 *aa; | |
435 | const u8 *spa; | |
436 | const u8 *pmkid; | |
437 | }; | |
438 | ||
439 | ||
440 | static int wpa_auth_okc_iter(struct wpa_authenticator *a, void *ctx) | |
441 | { | |
442 | struct wpa_auth_okc_iter_data *data = ctx; | |
443 | data->pmksa = pmksa_cache_get_okc(a->pmksa, data->aa, data->spa, | |
444 | data->pmkid); | |
445 | if (data->pmksa) | |
446 | return 1; | |
447 | return 0; | |
448 | } | |
449 | ||
450 | ||
6fc6879b JM |
451 | int wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth, |
452 | struct wpa_state_machine *sm, | |
453 | const u8 *wpa_ie, size_t wpa_ie_len, | |
454 | const u8 *mdie, size_t mdie_len) | |
455 | { | |
456 | struct wpa_ie_data data; | |
457 | int ciphers, key_mgmt, res, version; | |
458 | u32 selector; | |
459 | size_t i; | |
bf98f7f3 | 460 | const u8 *pmkid = NULL; |
6fc6879b JM |
461 | |
462 | if (wpa_auth == NULL || sm == NULL) | |
463 | return WPA_NOT_ENABLED; | |
464 | ||
465 | if (wpa_ie == NULL || wpa_ie_len < 1) | |
466 | return WPA_INVALID_IE; | |
467 | ||
468 | if (wpa_ie[0] == WLAN_EID_RSN) | |
469 | version = WPA_PROTO_RSN; | |
470 | else | |
471 | version = WPA_PROTO_WPA; | |
472 | ||
2100a768 JM |
473 | if (!(wpa_auth->conf.wpa & version)) { |
474 | wpa_printf(MSG_DEBUG, "Invalid WPA proto (%d) from " MACSTR, | |
475 | version, MAC2STR(sm->addr)); | |
476 | return WPA_INVALID_PROTO; | |
477 | } | |
478 | ||
6fc6879b JM |
479 | if (version == WPA_PROTO_RSN) { |
480 | res = wpa_parse_wpa_ie_rsn(wpa_ie, wpa_ie_len, &data); | |
481 | ||
482 | selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X; | |
483 | if (0) { | |
484 | } | |
485 | #ifdef CONFIG_IEEE80211R | |
486 | else if (data.key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) | |
487 | selector = RSN_AUTH_KEY_MGMT_FT_802_1X; | |
488 | else if (data.key_mgmt & WPA_KEY_MGMT_FT_PSK) | |
489 | selector = RSN_AUTH_KEY_MGMT_FT_PSK; | |
490 | #endif /* CONFIG_IEEE80211R */ | |
56586197 JM |
491 | #ifdef CONFIG_IEEE80211W |
492 | else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) | |
493 | selector = RSN_AUTH_KEY_MGMT_802_1X_SHA256; | |
494 | else if (data.key_mgmt & WPA_KEY_MGMT_PSK_SHA256) | |
495 | selector = RSN_AUTH_KEY_MGMT_PSK_SHA256; | |
496 | #endif /* CONFIG_IEEE80211W */ | |
6fc6879b JM |
497 | else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X) |
498 | selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X; | |
499 | else if (data.key_mgmt & WPA_KEY_MGMT_PSK) | |
500 | selector = RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X; | |
501 | wpa_auth->dot11RSNAAuthenticationSuiteSelected = selector; | |
502 | ||
503 | selector = RSN_CIPHER_SUITE_CCMP; | |
504 | if (data.pairwise_cipher & WPA_CIPHER_CCMP) | |
505 | selector = RSN_CIPHER_SUITE_CCMP; | |
506 | else if (data.pairwise_cipher & WPA_CIPHER_TKIP) | |
507 | selector = RSN_CIPHER_SUITE_TKIP; | |
508 | else if (data.pairwise_cipher & WPA_CIPHER_WEP104) | |
509 | selector = RSN_CIPHER_SUITE_WEP104; | |
510 | else if (data.pairwise_cipher & WPA_CIPHER_WEP40) | |
511 | selector = RSN_CIPHER_SUITE_WEP40; | |
512 | else if (data.pairwise_cipher & WPA_CIPHER_NONE) | |
513 | selector = RSN_CIPHER_SUITE_NONE; | |
514 | wpa_auth->dot11RSNAPairwiseCipherSelected = selector; | |
515 | ||
516 | selector = RSN_CIPHER_SUITE_CCMP; | |
517 | if (data.group_cipher & WPA_CIPHER_CCMP) | |
518 | selector = RSN_CIPHER_SUITE_CCMP; | |
519 | else if (data.group_cipher & WPA_CIPHER_TKIP) | |
520 | selector = RSN_CIPHER_SUITE_TKIP; | |
521 | else if (data.group_cipher & WPA_CIPHER_WEP104) | |
522 | selector = RSN_CIPHER_SUITE_WEP104; | |
523 | else if (data.group_cipher & WPA_CIPHER_WEP40) | |
524 | selector = RSN_CIPHER_SUITE_WEP40; | |
525 | else if (data.group_cipher & WPA_CIPHER_NONE) | |
526 | selector = RSN_CIPHER_SUITE_NONE; | |
527 | wpa_auth->dot11RSNAGroupCipherSelected = selector; | |
528 | } else { | |
529 | res = wpa_parse_wpa_ie_wpa(wpa_ie, wpa_ie_len, &data); | |
530 | ||
531 | selector = WPA_AUTH_KEY_MGMT_UNSPEC_802_1X; | |
532 | if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X) | |
533 | selector = WPA_AUTH_KEY_MGMT_UNSPEC_802_1X; | |
534 | else if (data.key_mgmt & WPA_KEY_MGMT_PSK) | |
535 | selector = WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X; | |
536 | wpa_auth->dot11RSNAAuthenticationSuiteSelected = selector; | |
537 | ||
538 | selector = WPA_CIPHER_SUITE_TKIP; | |
539 | if (data.pairwise_cipher & WPA_CIPHER_CCMP) | |
540 | selector = WPA_CIPHER_SUITE_CCMP; | |
541 | else if (data.pairwise_cipher & WPA_CIPHER_TKIP) | |
542 | selector = WPA_CIPHER_SUITE_TKIP; | |
543 | else if (data.pairwise_cipher & WPA_CIPHER_WEP104) | |
544 | selector = WPA_CIPHER_SUITE_WEP104; | |
545 | else if (data.pairwise_cipher & WPA_CIPHER_WEP40) | |
546 | selector = WPA_CIPHER_SUITE_WEP40; | |
547 | else if (data.pairwise_cipher & WPA_CIPHER_NONE) | |
548 | selector = WPA_CIPHER_SUITE_NONE; | |
549 | wpa_auth->dot11RSNAPairwiseCipherSelected = selector; | |
550 | ||
551 | selector = WPA_CIPHER_SUITE_TKIP; | |
552 | if (data.group_cipher & WPA_CIPHER_CCMP) | |
553 | selector = WPA_CIPHER_SUITE_CCMP; | |
554 | else if (data.group_cipher & WPA_CIPHER_TKIP) | |
555 | selector = WPA_CIPHER_SUITE_TKIP; | |
556 | else if (data.group_cipher & WPA_CIPHER_WEP104) | |
557 | selector = WPA_CIPHER_SUITE_WEP104; | |
558 | else if (data.group_cipher & WPA_CIPHER_WEP40) | |
559 | selector = WPA_CIPHER_SUITE_WEP40; | |
560 | else if (data.group_cipher & WPA_CIPHER_NONE) | |
561 | selector = WPA_CIPHER_SUITE_NONE; | |
562 | wpa_auth->dot11RSNAGroupCipherSelected = selector; | |
563 | } | |
564 | if (res) { | |
565 | wpa_printf(MSG_DEBUG, "Failed to parse WPA/RSN IE from " | |
566 | MACSTR " (res=%d)", MAC2STR(sm->addr), res); | |
567 | wpa_hexdump(MSG_DEBUG, "WPA/RSN IE", wpa_ie, wpa_ie_len); | |
568 | return WPA_INVALID_IE; | |
569 | } | |
570 | ||
571 | if (data.group_cipher != wpa_auth->conf.wpa_group) { | |
572 | wpa_printf(MSG_DEBUG, "Invalid WPA group cipher (0x%x) from " | |
573 | MACSTR, data.group_cipher, MAC2STR(sm->addr)); | |
574 | return WPA_INVALID_GROUP; | |
575 | } | |
576 | ||
577 | key_mgmt = data.key_mgmt & wpa_auth->conf.wpa_key_mgmt; | |
578 | if (!key_mgmt) { | |
579 | wpa_printf(MSG_DEBUG, "Invalid WPA key mgmt (0x%x) from " | |
580 | MACSTR, data.key_mgmt, MAC2STR(sm->addr)); | |
581 | return WPA_INVALID_AKMP; | |
582 | } | |
583 | if (0) { | |
584 | } | |
585 | #ifdef CONFIG_IEEE80211R | |
586 | else if (key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) | |
587 | sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X; | |
588 | else if (key_mgmt & WPA_KEY_MGMT_FT_PSK) | |
589 | sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_PSK; | |
590 | #endif /* CONFIG_IEEE80211R */ | |
56586197 JM |
591 | #ifdef CONFIG_IEEE80211W |
592 | else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) | |
593 | sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256; | |
594 | else if (key_mgmt & WPA_KEY_MGMT_PSK_SHA256) | |
595 | sm->wpa_key_mgmt = WPA_KEY_MGMT_PSK_SHA256; | |
596 | #endif /* CONFIG_IEEE80211W */ | |
6fc6879b JM |
597 | else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X) |
598 | sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X; | |
599 | else | |
600 | sm->wpa_key_mgmt = WPA_KEY_MGMT_PSK; | |
601 | ||
602 | if (version == WPA_PROTO_RSN) | |
603 | ciphers = data.pairwise_cipher & wpa_auth->conf.rsn_pairwise; | |
604 | else | |
605 | ciphers = data.pairwise_cipher & wpa_auth->conf.wpa_pairwise; | |
606 | if (!ciphers) { | |
607 | wpa_printf(MSG_DEBUG, "Invalid %s pairwise cipher (0x%x) " | |
608 | "from " MACSTR, | |
609 | version == WPA_PROTO_RSN ? "RSN" : "WPA", | |
610 | data.pairwise_cipher, MAC2STR(sm->addr)); | |
611 | return WPA_INVALID_PAIRWISE; | |
612 | } | |
613 | ||
614 | #ifdef CONFIG_IEEE80211W | |
615 | if (wpa_auth->conf.ieee80211w == WPA_IEEE80211W_REQUIRED) { | |
0b60b0aa | 616 | if (!(data.capabilities & WPA_CAPABILITY_MFPC)) { |
6fc6879b JM |
617 | wpa_printf(MSG_DEBUG, "Management frame protection " |
618 | "required, but client did not enable it"); | |
619 | return WPA_MGMT_FRAME_PROTECTION_VIOLATION; | |
620 | } | |
621 | ||
622 | if (ciphers & WPA_CIPHER_TKIP) { | |
623 | wpa_printf(MSG_DEBUG, "Management frame protection " | |
624 | "cannot use TKIP"); | |
625 | return WPA_MGMT_FRAME_PROTECTION_VIOLATION; | |
626 | } | |
627 | ||
628 | if (data.mgmt_group_cipher != WPA_CIPHER_AES_128_CMAC) { | |
629 | wpa_printf(MSG_DEBUG, "Unsupported management group " | |
630 | "cipher %d", data.mgmt_group_cipher); | |
631 | return WPA_INVALID_MGMT_GROUP_CIPHER; | |
632 | } | |
633 | } | |
634 | ||
635 | if (wpa_auth->conf.ieee80211w == WPA_NO_IEEE80211W || | |
0b60b0aa | 636 | !(data.capabilities & WPA_CAPABILITY_MFPC)) |
6fc6879b JM |
637 | sm->mgmt_frame_prot = 0; |
638 | else | |
639 | sm->mgmt_frame_prot = 1; | |
640 | #endif /* CONFIG_IEEE80211W */ | |
641 | ||
642 | #ifdef CONFIG_IEEE80211R | |
56586197 | 643 | if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) { |
6fc6879b JM |
644 | if (mdie == NULL || mdie_len < MOBILITY_DOMAIN_ID_LEN + 1) { |
645 | wpa_printf(MSG_DEBUG, "RSN: Trying to use FT, but " | |
646 | "MDIE not included"); | |
647 | return WPA_INVALID_MDIE; | |
648 | } | |
649 | if (os_memcmp(mdie, wpa_auth->conf.mobility_domain, | |
650 | MOBILITY_DOMAIN_ID_LEN) != 0) { | |
651 | wpa_hexdump(MSG_DEBUG, "RSN: Attempted to use unknown " | |
652 | "MDIE", mdie, MOBILITY_DOMAIN_ID_LEN); | |
653 | return WPA_INVALID_MDIE; | |
654 | } | |
655 | } | |
656 | #endif /* CONFIG_IEEE80211R */ | |
657 | ||
658 | if (ciphers & WPA_CIPHER_CCMP) | |
659 | sm->pairwise = WPA_CIPHER_CCMP; | |
660 | else | |
661 | sm->pairwise = WPA_CIPHER_TKIP; | |
662 | ||
663 | /* TODO: clear WPA/WPA2 state if STA changes from one to another */ | |
664 | if (wpa_ie[0] == WLAN_EID_RSN) | |
665 | sm->wpa = WPA_VERSION_WPA2; | |
666 | else | |
667 | sm->wpa = WPA_VERSION_WPA; | |
668 | ||
bf98f7f3 | 669 | sm->pmksa = NULL; |
6fc6879b JM |
670 | for (i = 0; i < data.num_pmkid; i++) { |
671 | wpa_hexdump(MSG_DEBUG, "RSN IE: STA PMKID", | |
672 | &data.pmkid[i * PMKID_LEN], PMKID_LEN); | |
4bb081f1 JM |
673 | sm->pmksa = pmksa_cache_auth_get(wpa_auth->pmksa, sm->addr, |
674 | &data.pmkid[i * PMKID_LEN]); | |
6fc6879b | 675 | if (sm->pmksa) { |
bf98f7f3 JM |
676 | pmkid = sm->pmksa->pmkid; |
677 | break; | |
678 | } | |
679 | } | |
680 | for (i = 0; sm->pmksa == NULL && wpa_auth->conf.okc && | |
681 | i < data.num_pmkid; i++) { | |
682 | struct wpa_auth_okc_iter_data idata; | |
683 | idata.pmksa = NULL; | |
684 | idata.aa = wpa_auth->addr; | |
685 | idata.spa = sm->addr; | |
686 | idata.pmkid = &data.pmkid[i * PMKID_LEN]; | |
687 | wpa_auth_for_each_auth(wpa_auth, wpa_auth_okc_iter, &idata); | |
688 | if (idata.pmksa) { | |
6fc6879b | 689 | wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, |
bf98f7f3 JM |
690 | "OKC match for PMKID"); |
691 | sm->pmksa = pmksa_cache_add_okc(wpa_auth->pmksa, | |
692 | idata.pmksa, | |
693 | wpa_auth->addr, | |
694 | idata.pmkid); | |
695 | pmkid = idata.pmkid; | |
6fc6879b JM |
696 | break; |
697 | } | |
698 | } | |
bf98f7f3 JM |
699 | if (sm->pmksa) { |
700 | wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, | |
701 | "PMKID found from PMKSA cache " | |
702 | "eap_type=%d vlan_id=%d", | |
703 | sm->pmksa->eap_type_authsrv, | |
704 | sm->pmksa->vlan_id); | |
705 | os_memcpy(wpa_auth->dot11RSNAPMKIDUsed, pmkid, PMKID_LEN); | |
706 | } | |
6fc6879b JM |
707 | |
708 | if (sm->wpa_ie == NULL || sm->wpa_ie_len < wpa_ie_len) { | |
709 | os_free(sm->wpa_ie); | |
710 | sm->wpa_ie = os_malloc(wpa_ie_len); | |
711 | if (sm->wpa_ie == NULL) | |
712 | return WPA_ALLOC_FAIL; | |
713 | } | |
714 | os_memcpy(sm->wpa_ie, wpa_ie, wpa_ie_len); | |
715 | sm->wpa_ie_len = wpa_ie_len; | |
716 | ||
717 | return WPA_IE_OK; | |
718 | } | |
719 | ||
720 | ||
721 | /** | |
722 | * wpa_parse_generic - Parse EAPOL-Key Key Data Generic IEs | |
723 | * @pos: Pointer to the IE header | |
724 | * @end: Pointer to the end of the Key Data buffer | |
725 | * @ie: Pointer to parsed IE data | |
726 | * Returns: 0 on success, 1 if end mark is found, -1 on failure | |
727 | */ | |
728 | static int wpa_parse_generic(const u8 *pos, const u8 *end, | |
729 | struct wpa_eapol_ie_parse *ie) | |
730 | { | |
731 | if (pos[1] == 0) | |
732 | return 1; | |
733 | ||
734 | if (pos[1] >= 6 && | |
735 | RSN_SELECTOR_GET(pos + 2) == WPA_OUI_TYPE && | |
736 | pos[2 + WPA_SELECTOR_LEN] == 1 && | |
737 | pos[2 + WPA_SELECTOR_LEN + 1] == 0) { | |
738 | ie->wpa_ie = pos; | |
739 | ie->wpa_ie_len = pos[1] + 2; | |
740 | return 0; | |
741 | } | |
742 | ||
743 | if (pos + 1 + RSN_SELECTOR_LEN < end && | |
744 | pos[1] >= RSN_SELECTOR_LEN + PMKID_LEN && | |
745 | RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_PMKID) { | |
746 | ie->pmkid = pos + 2 + RSN_SELECTOR_LEN; | |
747 | return 0; | |
748 | } | |
749 | ||
750 | if (pos[1] > RSN_SELECTOR_LEN + 2 && | |
751 | RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_GROUPKEY) { | |
752 | ie->gtk = pos + 2 + RSN_SELECTOR_LEN; | |
753 | ie->gtk_len = pos[1] - RSN_SELECTOR_LEN; | |
754 | return 0; | |
755 | } | |
756 | ||
757 | if (pos[1] > RSN_SELECTOR_LEN + 2 && | |
758 | RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_MAC_ADDR) { | |
759 | ie->mac_addr = pos + 2 + RSN_SELECTOR_LEN; | |
760 | ie->mac_addr_len = pos[1] - RSN_SELECTOR_LEN; | |
761 | return 0; | |
762 | } | |
763 | ||
764 | #ifdef CONFIG_PEERKEY | |
765 | if (pos[1] > RSN_SELECTOR_LEN + 2 && | |
766 | RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_SMK) { | |
767 | ie->smk = pos + 2 + RSN_SELECTOR_LEN; | |
768 | ie->smk_len = pos[1] - RSN_SELECTOR_LEN; | |
769 | return 0; | |
770 | } | |
771 | ||
772 | if (pos[1] > RSN_SELECTOR_LEN + 2 && | |
773 | RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_NONCE) { | |
774 | ie->nonce = pos + 2 + RSN_SELECTOR_LEN; | |
775 | ie->nonce_len = pos[1] - RSN_SELECTOR_LEN; | |
776 | return 0; | |
777 | } | |
778 | ||
779 | if (pos[1] > RSN_SELECTOR_LEN + 2 && | |
780 | RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_LIFETIME) { | |
781 | ie->lifetime = pos + 2 + RSN_SELECTOR_LEN; | |
782 | ie->lifetime_len = pos[1] - RSN_SELECTOR_LEN; | |
783 | return 0; | |
784 | } | |
785 | ||
786 | if (pos[1] > RSN_SELECTOR_LEN + 2 && | |
787 | RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_ERROR) { | |
788 | ie->error = pos + 2 + RSN_SELECTOR_LEN; | |
789 | ie->error_len = pos[1] - RSN_SELECTOR_LEN; | |
790 | return 0; | |
791 | } | |
792 | #endif /* CONFIG_PEERKEY */ | |
793 | ||
794 | #ifdef CONFIG_IEEE80211W | |
795 | if (pos[1] > RSN_SELECTOR_LEN + 2 && | |
796 | RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_IGTK) { | |
797 | ie->igtk = pos + 2 + RSN_SELECTOR_LEN; | |
798 | ie->igtk_len = pos[1] - RSN_SELECTOR_LEN; | |
799 | return 0; | |
800 | } | |
801 | #endif /* CONFIG_IEEE80211W */ | |
802 | ||
803 | return 0; | |
804 | } | |
805 | ||
806 | ||
807 | /** | |
808 | * wpa_parse_kde_ies - Parse EAPOL-Key Key Data IEs | |
809 | * @buf: Pointer to the Key Data buffer | |
810 | * @len: Key Data Length | |
811 | * @ie: Pointer to parsed IE data | |
812 | * Returns: 0 on success, -1 on failure | |
813 | */ | |
814 | int wpa_parse_kde_ies(const u8 *buf, size_t len, struct wpa_eapol_ie_parse *ie) | |
815 | { | |
816 | const u8 *pos, *end; | |
817 | int ret = 0; | |
818 | ||
819 | os_memset(ie, 0, sizeof(*ie)); | |
820 | for (pos = buf, end = pos + len; pos + 1 < end; pos += 2 + pos[1]) { | |
821 | if (pos[0] == 0xdd && | |
822 | ((pos == buf + len - 1) || pos[1] == 0)) { | |
823 | /* Ignore padding */ | |
824 | break; | |
825 | } | |
826 | if (pos + 2 + pos[1] > end) { | |
827 | wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key Key Data " | |
828 | "underflow (ie=%d len=%d pos=%d)", | |
829 | pos[0], pos[1], (int) (pos - buf)); | |
830 | wpa_hexdump_key(MSG_DEBUG, "WPA: Key Data", | |
831 | buf, len); | |
832 | ret = -1; | |
833 | break; | |
834 | } | |
835 | if (*pos == WLAN_EID_RSN) { | |
836 | ie->rsn_ie = pos; | |
837 | ie->rsn_ie_len = pos[1] + 2; | |
838 | #ifdef CONFIG_IEEE80211R | |
839 | } else if (*pos == WLAN_EID_MOBILITY_DOMAIN) { | |
840 | ie->mdie = pos; | |
841 | ie->mdie_len = pos[1] + 2; | |
842 | #endif /* CONFIG_IEEE80211R */ | |
843 | } else if (*pos == WLAN_EID_VENDOR_SPECIFIC) { | |
844 | ret = wpa_parse_generic(pos, end, ie); | |
845 | if (ret < 0) | |
846 | break; | |
847 | if (ret > 0) { | |
848 | ret = 0; | |
849 | break; | |
850 | } | |
851 | } else { | |
852 | wpa_hexdump(MSG_DEBUG, "WPA: Unrecognized EAPOL-Key " | |
853 | "Key Data IE", pos, 2 + pos[1]); | |
854 | } | |
855 | } | |
856 | ||
857 | return ret; | |
858 | } | |
f3f7540e JM |
859 | |
860 | ||
861 | int wpa_auth_uses_mfp(struct wpa_state_machine *sm) | |
862 | { | |
863 | return sm ? sm->mgmt_frame_prot : 0; | |
864 | } |