]> git.ipfire.org Git - thirdparty/hostap.git/blame - src/rsn_supp/wpa.c
projects / thirdparty / hostap.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Remove CONFIG_IEEE80211W build parameter
[thirdparty/hostap.git] / src / rsn_supp / wpa.c
CommitLineData
6fc6879b
JM		 1/*
2 * WPA Supplicant - WPA state machine and EAPOL-Key processing
a3e18dbb 3 * Copyright (c) 2003-2018, Jouni Malinen <j@w1.fi>
73ed03f3 4 * Copyright(c) 2015 Intel Deutschland GmbH
6fc6879b 5 *
0f3d578e
JM		 6 * This software may be distributed under the terms of the BSD license.
7 * See README for more details.
6fc6879b
JM		 8 */
9
10#include "includes.h"
11
12#include "common.h"
2022f1d0 13#include "crypto/aes.h"
03da66bd
JM		 14#include "crypto/aes_wrap.h"
15#include "crypto/crypto.h"
3642c431 16#include "crypto/random.h"
2022f1d0 17#include "crypto/aes_siv.h"
0a614799 18#include "crypto/sha256.h"
ec9f4837
JM		 19#include "crypto/sha384.h"
20#include "crypto/sha512.h"
03da66bd 21#include "common/ieee802_11_defs.h"
a6609937 22#include "common/ieee802_11_common.h"
17c2559c 23#include "common/ocv.h"
fcd3d6ce 24#include "eap_common/eap_defs.h"
03da66bd 25#include "eapol_supp/eapol_supp_sm.h"
17c2559c 26#include "drivers/driver.h"
6fc6879b
JM		 27#include "wpa.h"
28#include "eloop.h"
6fc6879b
JM		 29#include "preauth.h"
30#include "pmksa_cache.h"
31#include "wpa_i.h"
32#include "wpa_ie.h"
6fc6879b
JM		 33
34
73ed03f3
MS		 35static const u8 null_rsc[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
36
37
6fc6879b
JM		 38/**
39 * wpa_eapol_key_send - Send WPA/RSN EAPOL-Key message
40 * @sm: Pointer to WPA state machine data from wpa_sm_init()
1049af7e 41 * @ptk: PTK for Key Confirmation/Encryption Key
6fc6879b
JM		 42 * @ver: Version field from Key Info
43 * @dest: Destination address for the frame
44 * @proto: Ethertype (usually ETH_P_EAPOL)
45 * @msg: EAPOL-Key message
46 * @msg_len: Length of message
47 * @key_mic: Pointer to the buffer to which the EAPOL-Key MIC is written
c93b7e18 48 * Returns: >= 0 on success, < 0 on failure
6fc6879b 49 */
1049af7e 50int wpa_eapol_key_send(struct wpa_sm *sm, struct wpa_ptk *ptk,
c93b7e18
AA		 51 int ver, const u8 *dest, u16 proto,
52 u8 *msg, size_t msg_len, u8 *key_mic)
6fc6879b 53{
c93b7e18 54 int ret = -1;
567da5bb 55 size_t mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
98cd3d1c 56
ef9627cb
JM		 57 wpa_printf(MSG_DEBUG, "WPA: Send EAPOL-Key frame to " MACSTR
58 " ver=%d mic_len=%d key_mgmt=0x%x",
59 MAC2STR(dest), ver, (int) mic_len, sm->key_mgmt);
a8e16edc 60 if (is_zero_ether_addr(dest) && is_zero_ether_addr(sm->bssid)) {
6fc6879b
JM		 61 /*
62 * Association event was not yet received; try to fetch
63 * BSSID from the driver.
64 */
65 if (wpa_sm_get_bssid(sm, sm->bssid) < 0) {
f049052b
BG		 66 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
67 "WPA: Failed to read BSSID for "
68 "EAPOL-Key destination address");
6fc6879b
JM		 69 } else {
70 dest = sm->bssid;
f049052b
BG		 71 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
72 "WPA: Use BSSID (" MACSTR
73 ") as the destination for EAPOL-Key",
74 MAC2STR(dest));
6fc6879b
JM		 75 }
76 }
2022f1d0
JM		 77
78 if (mic_len) {
79 if (key_mic && (!ptk || !ptk->kck_len))
80 goto out;
81
82 if (key_mic &&
83 wpa_eapol_key_mic(ptk->kck, ptk->kck_len, sm->key_mgmt, ver,
84 msg, msg_len, key_mic)) {
85 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
86 "WPA: Failed to generate EAPOL-Key version %d key_mgmt 0x%x MIC",
87 ver, sm->key_mgmt);
88 goto out;
89 }
28fb9bb1
JM		 90 if (ptk)
91 wpa_hexdump_key(MSG_DEBUG, "WPA: KCK",
92 ptk->kck, ptk->kck_len);
2022f1d0
JM		 93 wpa_hexdump(MSG_DEBUG, "WPA: Derived Key MIC",
94 key_mic, mic_len);
95 } else {
96#ifdef CONFIG_FILS
97 /* AEAD cipher - Key MIC field not used */
98 struct ieee802_1x_hdr *s_hdr, *hdr;
99 struct wpa_eapol_key *s_key, *key;
100 u8 *buf, *s_key_data, *key_data;
101 size_t buf_len = msg_len + AES_BLOCK_SIZE;
102 size_t key_data_len;
103 u16 eapol_len;
104 const u8 *aad[1];
105 size_t aad_len[1];
106
107 if (!ptk || !ptk->kek_len)
108 goto out;
109
110 key_data_len = msg_len - sizeof(struct ieee802_1x_hdr) -
111 sizeof(struct wpa_eapol_key) - 2;
112
113 buf = os_malloc(buf_len);
114 if (!buf)
115 goto out;
116
117 os_memcpy(buf, msg, msg_len);
118 hdr = (struct ieee802_1x_hdr *) buf;
119 key = (struct wpa_eapol_key *) (hdr + 1);
120 key_data = ((u8 *) (key + 1)) + 2;
121
122 /* Update EAPOL header to include AES-SIV overhead */
123 eapol_len = be_to_host16(hdr->length);
124 eapol_len += AES_BLOCK_SIZE;
125 hdr->length = host_to_be16(eapol_len);
126
127 /* Update Key Data Length field to include AES-SIV overhead */
128 WPA_PUT_BE16((u8 *) (key + 1), AES_BLOCK_SIZE + key_data_len);
129
130 s_hdr = (struct ieee802_1x_hdr *) msg;
131 s_key = (struct wpa_eapol_key *) (s_hdr + 1);
132 s_key_data = ((u8 *) (s_key + 1)) + 2;
133
134 wpa_hexdump_key(MSG_DEBUG, "WPA: Plaintext Key Data",
135 s_key_data, key_data_len);
136
137 wpa_hexdump_key(MSG_DEBUG, "WPA: KEK", ptk->kek, ptk->kek_len);
138 /* AES-SIV AAD from EAPOL protocol version field (inclusive) to
139 * to Key Data (exclusive). */
140 aad[0] = buf;
141 aad_len[0] = key_data - buf;
142 if (aes_siv_encrypt(ptk->kek, ptk->kek_len,
143 s_key_data, key_data_len,
144 1, aad, aad_len, key_data) < 0) {
145 os_free(buf);
146 goto out;
147 }
148
149 wpa_hexdump(MSG_DEBUG, "WPA: Encrypted Key Data from SIV",
150 key_data, AES_BLOCK_SIZE + key_data_len);
151
152 os_free(msg);
153 msg = buf;
154 msg_len = buf_len;
155#else /* CONFIG_FILS */
04b6b3ed 156 goto out;
2022f1d0 157#endif /* CONFIG_FILS */
04b6b3ed 158 }
2022f1d0 159
6fc6879b 160 wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key", msg, msg_len);
c93b7e18 161 ret = wpa_sm_ether_send(sm, dest, proto, msg, msg_len);
6fc6879b 162 eapol_sm_notify_tx_eapol_key(sm->eapol);
04b6b3ed 163out:
6fc6879b 164 os_free(msg);
c93b7e18 165 return ret;
6fc6879b
JM		 166}
167
168
169/**
170 * wpa_sm_key_request - Send EAPOL-Key Request
171 * @sm: Pointer to WPA state machine data from wpa_sm_init()
172 * @error: Indicate whether this is an Michael MIC error report
173 * @pairwise: 1 = error report for pairwise packet, 0 = for group packet
6fc6879b
JM		 174 *
175 * Send an EAPOL-Key Request to the current authenticator. This function is
176 * used to request rekeying and it is usually called when a local Michael MIC
177 * failure is detected.
178 */
179void wpa_sm_key_request(struct wpa_sm *sm, int error, int pairwise)
180{
5e3b5197 181 size_t mic_len, hdrlen, rlen;
6fc6879b
JM		 182 struct wpa_eapol_key *reply;
183 int key_info, ver;
6d014ffc 184 u8 bssid[ETH_ALEN], *rbuf, *key_mic, *mic;
6fc6879b 185
4bc801ab 186 if (wpa_use_akm_defined(sm->key_mgmt))
df0f01d9
JM		 187 ver = WPA_KEY_INFO_TYPE_AKM_DEFINED;
188 else if (wpa_key_mgmt_ft(sm->key_mgmt) ||
189 wpa_key_mgmt_sha256(sm->key_mgmt))
6fc6879b 190 ver = WPA_KEY_INFO_TYPE_AES_128_CMAC;
eb7719ff 191 else if (sm->pairwise_cipher != WPA_CIPHER_TKIP)
6fc6879b
JM		 192 ver = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES;
193 else
194 ver = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4;
195
196 if (wpa_sm_get_bssid(sm, bssid) < 0) {
f049052b
BG		 197 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
198 "Failed to read BSSID for EAPOL-Key request");
6fc6879b
JM		 199 return;
200 }
201
567da5bb 202 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
6d014ffc 203 hdrlen = sizeof(*reply) + mic_len + 2;
6fc6879b 204 rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
5e3b5197 205 hdrlen, &rlen, (void *) &reply);
6fc6879b
JM		 206 if (rbuf == NULL)
207 return;
208
a14896e8
JM		 209 reply->type = (sm->proto == WPA_PROTO_RSN ||
210 sm->proto == WPA_PROTO_OSEN) ?
6fc6879b
JM		 211 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
212 key_info = WPA_KEY_INFO_REQUEST | ver;
213 if (sm->ptk_set)
4a26ccda
JM		 214 key_info |= WPA_KEY_INFO_SECURE;
215 if (sm->ptk_set && mic_len)
216 key_info |= WPA_KEY_INFO_MIC;
6fc6879b
JM		 217 if (error)
218 key_info |= WPA_KEY_INFO_ERROR;
219 if (pairwise)
220 key_info |= WPA_KEY_INFO_KEY_TYPE;
221 WPA_PUT_BE16(reply->key_info, key_info);
222 WPA_PUT_BE16(reply->key_length, 0);
223 os_memcpy(reply->replay_counter, sm->request_counter,
224 WPA_REPLAY_COUNTER_LEN);
225 inc_byte_array(sm->request_counter, WPA_REPLAY_COUNTER_LEN);
226
6d014ffc
JM		 227 mic = (u8 *) (reply + 1);
228 WPA_PUT_BE16(mic + mic_len, 0);
5e3b5197
JM		 229 if (!(key_info & WPA_KEY_INFO_MIC))
230 key_mic = NULL;
231 else
6d014ffc 232 key_mic = mic;
6fc6879b 233
f049052b
BG		 234 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
235 "WPA: Sending EAPOL-Key Request (error=%d "
236 "pairwise=%d ptk_set=%d len=%lu)",
237 error, pairwise, sm->ptk_set, (unsigned long) rlen);
1049af7e
JM		 238 wpa_eapol_key_send(sm, &sm->ptk, ver, bssid, ETH_P_EAPOL, rbuf, rlen,
239 key_mic);
6fc6879b
JM		 240}
241
242
b41f2684
CL		 243static void wpa_supplicant_key_mgmt_set_pmk(struct wpa_sm *sm)
244{
245#ifdef CONFIG_IEEE80211R
246 if (sm->key_mgmt == WPA_KEY_MGMT_FT_IEEE8021X) {
247 if (wpa_sm_key_mgmt_set_pmk(sm, sm->xxkey, sm->xxkey_len))
248 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
249 "RSN: Cannot set low order 256 bits of MSK for key management offload");
250 } else {
251#endif /* CONFIG_IEEE80211R */
252 if (wpa_sm_key_mgmt_set_pmk(sm, sm->pmk, sm->pmk_len))
253 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
254 "RSN: Cannot set PMK for key management offload");
255#ifdef CONFIG_IEEE80211R
256 }
257#endif /* CONFIG_IEEE80211R */
258}
259
260
6fc6879b
JM		 261static int wpa_supplicant_get_pmk(struct wpa_sm *sm,
262 const unsigned char *src_addr,
263 const u8 *pmkid)
264{
265 int abort_cached = 0;
266
267 if (pmkid && !sm->cur_pmksa) {
268 /* When using drivers that generate RSN IE, wpa_supplicant may
269 * not have enough time to get the association information
270 * event before receiving this 1/4 message, so try to find a
271 * matching PMKSA cache entry here. */
96efeeb6 272 sm->cur_pmksa = pmksa_cache_get(sm->pmksa, src_addr, pmkid,
852b2f27 273 NULL, 0);
6fc6879b 274 if (sm->cur_pmksa) {
f049052b
BG		 275 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
276 "RSN: found matching PMKID from PMKSA cache");
6fc6879b 277 } else {
f049052b
BG		 278 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
279 "RSN: no matching PMKID found");
6fc6879b
JM		 280 abort_cached = 1;
281 }
282 }
283
284 if (pmkid && sm->cur_pmksa &&
0d15b69f 285 os_memcmp_const(pmkid, sm->cur_pmksa->pmkid, PMKID_LEN) == 0) {
6fc6879b
JM		 286 wpa_hexdump(MSG_DEBUG, "RSN: matched PMKID", pmkid, PMKID_LEN);
287 wpa_sm_set_pmk_from_pmksa(sm);
288 wpa_hexdump_key(MSG_DEBUG, "RSN: PMK from PMKSA cache",
289 sm->pmk, sm->pmk_len);
290 eapol_sm_notify_cached(sm->eapol);
291#ifdef CONFIG_IEEE80211R
292 sm->xxkey_len = 0;
a03f9d17
JM		 293#ifdef CONFIG_SAE
294 if (sm->key_mgmt == WPA_KEY_MGMT_FT_SAE &&
295 sm->pmk_len == PMK_LEN) {
296 /* Need to allow FT key derivation to proceed with
297 * PMK from SAE being used as the XXKey in cases where
298 * the PMKID in msg 1/4 matches the PMKSA entry that was
299 * just added based on SAE authentication for the
300 * initial mobility domain association. */
301 os_memcpy(sm->xxkey, sm->pmk, sm->pmk_len);
302 sm->xxkey_len = sm->pmk_len;
303 }
304#endif /* CONFIG_SAE */
6fc6879b 305#endif /* CONFIG_IEEE80211R */
56586197 306 } else if (wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt) && sm->eapol) {
6fc6879b 307 int res, pmk_len;
16c51144
JM		 308#ifdef CONFIG_IEEE80211R
309 u8 buf[2 * PMK_LEN];
310#endif /* CONFIG_IEEE80211R */
207976f0 311
834c5d68 312 if (wpa_key_mgmt_sha384(sm->key_mgmt))
207976f0
JM		 313 pmk_len = PMK_LEN_SUITE_B_192;
314 else
315 pmk_len = PMK_LEN;
316 res = eapol_sm_get_key(sm->eapol, sm->pmk, pmk_len);
6fc6879b 317 if (res) {
207976f0
JM		 318 if (pmk_len == PMK_LEN) {
319 /*
320 * EAP-LEAP is an exception from other EAP
321 * methods: it uses only 16-byte PMK.
322 */
323 res = eapol_sm_get_key(sm->eapol, sm->pmk, 16);
324 pmk_len = 16;
325 }
16c51144 326 }
6fc6879b 327#ifdef CONFIG_IEEE80211R
16c51144
JM		 328 if (res == 0 &&
329 eapol_sm_get_key(sm->eapol, buf, 2 * PMK_LEN) == 0) {
330 if (wpa_key_mgmt_sha384(sm->key_mgmt)) {
331 os_memcpy(sm->xxkey, buf, SHA384_MAC_LEN);
332 sm->xxkey_len = SHA384_MAC_LEN;
333 } else {
334 os_memcpy(sm->xxkey, buf + PMK_LEN, PMK_LEN);
335 sm->xxkey_len = PMK_LEN;
336 }
31bc66e4 337 forced_memzero(buf, sizeof(buf));
16c51144
JM		 338 if (sm->proto == WPA_PROTO_RSN &&
339 wpa_key_mgmt_ft(sm->key_mgmt)) {
340 struct rsn_pmksa_cache_entry *sa = NULL;
341 const u8 *fils_cache_id = NULL;
342
343#ifdef CONFIG_FILS
344 if (sm->fils_cache_id_set)
345 fils_cache_id = sm->fils_cache_id;
346#endif /* CONFIG_FILS */
347 wpa_hexdump_key(MSG_DEBUG,
348 "FT: Cache XXKey/MPMK",
349 sm->xxkey, sm->xxkey_len);
350 sa = pmksa_cache_add(sm->pmksa,
351 sm->xxkey, sm->xxkey_len,
352 NULL, NULL, 0,
353 src_addr, sm->own_addr,
354 sm->network_ctx,
355 sm->key_mgmt,
356 fils_cache_id);
357 if (!sm->cur_pmksa)
358 sm->cur_pmksa = sa;
6fc6879b 359 }
6fc6879b 360 }
16c51144 361#endif /* CONFIG_IEEE80211R */
6fc6879b 362 if (res == 0) {
a7f10d65 363 struct rsn_pmksa_cache_entry *sa = NULL;
869af307
JM		 364 const u8 *fils_cache_id = NULL;
365
366#ifdef CONFIG_FILS
367 if (sm->fils_cache_id_set)
368 fils_cache_id = sm->fils_cache_id;
369#endif /* CONFIG_FILS */
370
6fc6879b
JM		 371 wpa_hexdump_key(MSG_DEBUG, "WPA: PMK from EAPOL state "
372 "machines", sm->pmk, pmk_len);
373 sm->pmk_len = pmk_len;
b41f2684 374 wpa_supplicant_key_mgmt_set_pmk(sm);
715ed737 375 if (sm->proto == WPA_PROTO_RSN &&
087a1f4e 376 !wpa_key_mgmt_suite_b(sm->key_mgmt) &&
715ed737 377 !wpa_key_mgmt_ft(sm->key_mgmt)) {
a7f10d65 378 sa = pmksa_cache_add(sm->pmksa,
70c93963 379 sm->pmk, pmk_len, NULL,
087a1f4e 380 NULL, 0,
a7f10d65
JM		 381 src_addr, sm->own_addr,
382 sm->network_ctx,
869af307
JM		 383 sm->key_mgmt,
384 fils_cache_id);
f5a51b58 385 }
6fc6879b 386 if (!sm->cur_pmksa && pmkid &&
852b2f27
JM		 387 pmksa_cache_get(sm->pmksa, src_addr, pmkid, NULL,
388 0)) {
f049052b
BG		 389 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
390 "RSN: the new PMK matches with the "
391 "PMKID");
6fc6879b 392 abort_cached = 0;
bddc51e8
JM		 393 } else if (sa && !sm->cur_pmksa && pmkid) {
394 /*
395 * It looks like the authentication server
396 * derived mismatching MSK. This should not
397 * really happen, but bugs happen.. There is not
398 * much we can do here without knowing what
399 * exactly caused the server to misbehave.
400 */
62417667 401 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
bddc51e8
JM		 402 "RSN: PMKID mismatch - authentication server may have derived different MSK?!");
403 return -1;
6fc6879b 404 }
a7f10d65
JM		 405
406 if (!sm->cur_pmksa)
407 sm->cur_pmksa = sa;
0a1a82db
JM		 408#ifdef CONFIG_IEEE80211R
409 } else if (wpa_key_mgmt_ft(sm->key_mgmt) && sm->ft_protocol) {
410 wpa_printf(MSG_DEBUG,
411 "FT: Continue 4-way handshake without PMK/PMKID for association using FT protocol");
412#endif /* CONFIG_IEEE80211R */
6fc6879b 413 } else {
0f057fb2 414 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
6fc6879b 415 "WPA: Failed to get master session key from "
f049052b
BG		 416 "EAPOL state machines - key handshake "
417 "aborted");
6fc6879b 418 if (sm->cur_pmksa) {
f049052b
BG		 419 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
420 "RSN: Cancelled PMKSA caching "
421 "attempt");
6fc6879b
JM		 422 sm->cur_pmksa = NULL;
423 abort_cached = 1;
1ac2d4a9 424 } else if (!abort_cached) {
6fc6879b
JM		 425 return -1;
426 }
427 }
428 }
429
715ed737 430 if (abort_cached && wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt) &&
087a1f4e 431 !wpa_key_mgmt_suite_b(sm->key_mgmt) &&
a14896e8
JM		 432 !wpa_key_mgmt_ft(sm->key_mgmt) && sm->key_mgmt != WPA_KEY_MGMT_OSEN)
433 {
6fc6879b
JM		 434 /* Send EAPOL-Start to trigger full EAP authentication. */
435 u8 *buf;
436 size_t buflen;
437
f049052b
BG		 438 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
439 "RSN: no PMKSA entry found - trigger "
440 "full EAP authentication");
6fc6879b
JM		 441 buf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_START,
442 NULL, 0, &buflen, NULL);
443 if (buf) {
444 wpa_sm_ether_send(sm, sm->bssid, ETH_P_EAPOL,
445 buf, buflen);
446 os_free(buf);
b4a1256d 447 return -2;
6fc6879b
JM		 448 }
449
450 return -1;
451 }
452
453 return 0;
454}
455
456
457/**
458 * wpa_supplicant_send_2_of_4 - Send message 2 of WPA/RSN 4-Way Handshake
459 * @sm: Pointer to WPA state machine data from wpa_sm_init()
460 * @dst: Destination address for the frame
461 * @key: Pointer to the EAPOL-Key frame header
462 * @ver: Version bits from EAPOL-Key Key Info
463 * @nonce: Nonce value for the EAPOL-Key frame
464 * @wpa_ie: WPA/RSN IE
465 * @wpa_ie_len: Length of the WPA/RSN IE
466 * @ptk: PTK to use for keyed hash and encryption
c93b7e18 467 * Returns: >= 0 on success, < 0 on failure
6fc6879b
JM		 468 */
469int wpa_supplicant_send_2_of_4(struct wpa_sm *sm, const unsigned char *dst,
470 const struct wpa_eapol_key *key,
471 int ver, const u8 *nonce,
472 const u8 *wpa_ie, size_t wpa_ie_len,
473 struct wpa_ptk *ptk)
474{
5e3b5197 475 size_t mic_len, hdrlen, rlen;
6fc6879b 476 struct wpa_eapol_key *reply;
5e3b5197 477 u8 *rbuf, *key_mic;
26e23750 478 u8 *rsn_ie_buf = NULL;
4a26ccda 479 u16 key_info;
6fc6879b
JM		 480
481 if (wpa_ie == NULL) {
f049052b
BG		 482 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "WPA: No wpa_ie set - "
483 "cannot generate msg 2/4");
6fc6879b
JM		 484 return -1;
485 }
486
26e23750
JM		 487#ifdef CONFIG_IEEE80211R
488 if (wpa_key_mgmt_ft(sm->key_mgmt)) {
489 int res;
490
55046414
JM		 491 /*
492 * Add PMKR1Name into RSN IE (PMKID-List) and add MDIE and
493 * FTIE from (Re)Association Response.
494 */
495 rsn_ie_buf = os_malloc(wpa_ie_len + 2 + 2 + PMKID_LEN +
496 sm->assoc_resp_ies_len);
26e23750
JM		 497 if (rsn_ie_buf == NULL)
498 return -1;
499 os_memcpy(rsn_ie_buf, wpa_ie, wpa_ie_len);
59e78c24 500 res = wpa_insert_pmkid(rsn_ie_buf, &wpa_ie_len,
26e23750
JM		 501 sm->pmk_r1_name);
502 if (res < 0) {
503 os_free(rsn_ie_buf);
504 return -1;
505 }
55046414
JM		 506
507 if (sm->assoc_resp_ies) {
508 os_memcpy(rsn_ie_buf + wpa_ie_len, sm->assoc_resp_ies,
509 sm->assoc_resp_ies_len);
510 wpa_ie_len += sm->assoc_resp_ies_len;
511 }
26e23750
JM		 512
513 wpa_ie = rsn_ie_buf;
26e23750
JM		 514 }
515#endif /* CONFIG_IEEE80211R */
516
6fc6879b
JM		 517 wpa_hexdump(MSG_DEBUG, "WPA: WPA IE for msg 2/4", wpa_ie, wpa_ie_len);
518
567da5bb 519 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
6d014ffc 520 hdrlen = sizeof(*reply) + mic_len + 2;
6fc6879b 521 rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY,
5e3b5197 522 NULL, hdrlen + wpa_ie_len,
6fc6879b 523 &rlen, (void *) &reply);
26e23750
JM		 524 if (rbuf == NULL) {
525 os_free(rsn_ie_buf);
6fc6879b 526 return -1;
26e23750 527 }
6fc6879b 528
a14896e8
JM		 529 reply->type = (sm->proto == WPA_PROTO_RSN ||
530 sm->proto == WPA_PROTO_OSEN) ?
6fc6879b 531 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
4a26ccda
JM		 532 key_info = ver | WPA_KEY_INFO_KEY_TYPE;
533 if (mic_len)
534 key_info |= WPA_KEY_INFO_MIC;
2022f1d0
JM		 535 else
536 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
4a26ccda 537 WPA_PUT_BE16(reply->key_info, key_info);
a14896e8 538 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN)
6fc6879b
JM		 539 WPA_PUT_BE16(reply->key_length, 0);
540 else
541 os_memcpy(reply->key_length, key->key_length, 2);
542 os_memcpy(reply->replay_counter, key->replay_counter,
543 WPA_REPLAY_COUNTER_LEN);
bc8318ac
JM		 544 wpa_hexdump(MSG_DEBUG, "WPA: Replay Counter", reply->replay_counter,
545 WPA_REPLAY_COUNTER_LEN);
6fc6879b 546
6d014ffc
JM		 547 key_mic = (u8 *) (reply + 1);
548 WPA_PUT_BE16(key_mic + mic_len, wpa_ie_len); /* Key Data Length */
549 os_memcpy(key_mic + mic_len + 2, wpa_ie, wpa_ie_len); /* Key Data */
26e23750 550 os_free(rsn_ie_buf);
6fc6879b
JM		 551
552 os_memcpy(reply->key_nonce, nonce, WPA_NONCE_LEN);
553
f049052b 554 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Sending EAPOL-Key 2/4");
1049af7e
JM		 555 return wpa_eapol_key_send(sm, ptk, ver, dst, ETH_P_EAPOL, rbuf, rlen,
556 key_mic);
6fc6879b
JM		 557}
558
559
560static int wpa_derive_ptk(struct wpa_sm *sm, const unsigned char *src_addr,
98cd3d1c 561 const struct wpa_eapol_key *key, struct wpa_ptk *ptk)
6fc6879b 562{
10ec6a5f
JM		 563 const u8 *z = NULL;
564 size_t z_len = 0;
565
6fc6879b 566#ifdef CONFIG_IEEE80211R
56586197 567 if (wpa_key_mgmt_ft(sm->key_mgmt))
98cd3d1c 568 return wpa_derive_ptk_ft(sm, src_addr, key, ptk);
6fc6879b
JM		 569#endif /* CONFIG_IEEE80211R */
570
10ec6a5f
JM		 571#ifdef CONFIG_DPP2
572 if (sm->key_mgmt == WPA_KEY_MGMT_DPP && sm->dpp_z) {
573 z = wpabuf_head(sm->dpp_z);
574 z_len = wpabuf_len(sm->dpp_z);
575 }
576#endif /* CONFIG_DPP2 */
577
98cd3d1c
JM		 578 return wpa_pmk_to_ptk(sm->pmk, sm->pmk_len, "Pairwise key expansion",
579 sm->own_addr, sm->bssid, sm->snonce,
580 key->key_nonce, ptk, sm->key_mgmt,
10ec6a5f 581 sm->pairwise_cipher, z, z_len);
6fc6879b
JM		 582}
583
584
585static void wpa_supplicant_process_1_of_4(struct wpa_sm *sm,
586 const unsigned char *src_addr,
587 const struct wpa_eapol_key *key,
e6270129
JM		 588 u16 ver, const u8 *key_data,
589 size_t key_data_len)
6fc6879b
JM		 590{
591 struct wpa_eapol_ie_parse ie;
592 struct wpa_ptk *ptk;
b4a1256d 593 int res;
25ef8529
JM		 594 u8 *kde, *kde_buf = NULL;
595 size_t kde_len;
6fc6879b
JM		 596
597 if (wpa_sm_get_network_ctx(sm) == NULL) {
f049052b
BG		 598 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "WPA: No SSID info "
599 "found (msg 1 of 4)");
6fc6879b
JM		 600 return;
601 }
602
603 wpa_sm_set_state(sm, WPA_4WAY_HANDSHAKE);
f049052b
BG		 604 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: RX message 1 of 4-Way "
605 "Handshake from " MACSTR " (ver=%d)", MAC2STR(src_addr), ver);
6fc6879b
JM		 606
607 os_memset(&ie, 0, sizeof(ie));
608
a14896e8 609 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) {
6fc6879b 610 /* RSN: msg 1/4 should contain PMKID for the selected PMK */
e6270129
JM		 611 wpa_hexdump(MSG_DEBUG, "RSN: msg 1/4 key data",
612 key_data, key_data_len);
613 if (wpa_supplicant_parse_ies(key_data, key_data_len, &ie) < 0)
d627a939 614 goto failed;
6fc6879b
JM		 615 if (ie.pmkid) {
616 wpa_hexdump(MSG_DEBUG, "RSN: PMKID from "
617 "Authenticator", ie.pmkid, PMKID_LEN);
618 }
619 }
6fc6879b 620
b4a1256d
JM		 621 res = wpa_supplicant_get_pmk(sm, src_addr, ie.pmkid);
622 if (res == -2) {
f049052b
BG		 623 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "RSN: Do not reply to "
624 "msg 1/4 - requesting full EAP authentication");
b4a1256d
JM		 625 return;
626 }
627 if (res)
83935317 628 goto failed;
6fc6879b
JM		 629
630 if (sm->renew_snonce) {
3642c431 631 if (random_get_bytes(sm->snonce, WPA_NONCE_LEN)) {
0f057fb2 632 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
6fc6879b 633 "WPA: Failed to get random data for SNonce");
83935317 634 goto failed;
6fc6879b
JM		 635 }
636 sm->renew_snonce = 0;
637 wpa_hexdump(MSG_DEBUG, "WPA: Renewed SNonce",
638 sm->snonce, WPA_NONCE_LEN);
639 }
640
641 /* Calculate PTK which will be stored as a temporary PTK until it has
642 * been verified when processing message 3/4. */
643 ptk = &sm->tptk;
b488a129
JM		 644 if (wpa_derive_ptk(sm, src_addr, key, ptk) < 0)
645 goto failed;
3b9c5176 646 if (sm->pairwise_cipher == WPA_CIPHER_TKIP) {
d2c33b91 647 u8 buf[8];
3b9c5176 648 /* Supplicant: swap tx/rx Mic keys */
98cd3d1c
JM		 649 os_memcpy(buf, &ptk->tk[16], 8);
650 os_memcpy(&ptk->tk[16], &ptk->tk[24], 8);
651 os_memcpy(&ptk->tk[24], buf, 8);
31bc66e4 652 forced_memzero(buf, sizeof(buf));
3b9c5176 653 }
6fc6879b
JM		 654 sm->tptk_set = 1;
655
25ef8529
JM		 656 kde = sm->assoc_wpa_ie;
657 kde_len = sm->assoc_wpa_ie_len;
658
17c2559c
MV		 659#ifdef CONFIG_OCV
660 if (wpa_sm_ocv_enabled(sm)) {
661 struct wpa_channel_info ci;
662 u8 *pos;
663
664 if (wpa_sm_channel_info(sm, &ci) != 0) {
665 wpa_printf(MSG_WARNING,
666 "Failed to get channel info for OCI element in EAPOL-Key 2/4");
667 goto failed;
668 }
669
670 kde_buf = os_malloc(kde_len + 2 + RSN_SELECTOR_LEN + 3);
671 if (!kde_buf) {
672 wpa_printf(MSG_WARNING,
673 "Failed to allocate memory for KDE with OCI in EAPOL-Key 2/4");
674 goto failed;
675 }
676
677 os_memcpy(kde_buf, kde, kde_len);
678 kde = kde_buf;
679 pos = kde + kde_len;
680 if (ocv_insert_oci_kde(&ci, &pos) < 0)
681 goto failed;
682 kde_len = pos - kde;
683 }
684#endif /* CONFIG_OCV */
685
25ef8529
JM		 686#ifdef CONFIG_P2P
687 if (sm->p2p) {
688 kde_buf = os_malloc(kde_len + 2 + RSN_SELECTOR_LEN + 1);
689 if (kde_buf) {
690 u8 *pos;
691 wpa_printf(MSG_DEBUG, "P2P: Add IP Address Request KDE "
692 "into EAPOL-Key 2/4");
693 os_memcpy(kde_buf, kde, kde_len);
694 kde = kde_buf;
695 pos = kde + kde_len;
696 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
697 *pos++ = RSN_SELECTOR_LEN + 1;
698 RSN_SELECTOR_PUT(pos, WFA_KEY_DATA_IP_ADDR_REQ);
699 pos += RSN_SELECTOR_LEN;
700 *pos++ = 0x01;
701 kde_len = pos - kde;
702 }
703 }
704#endif /* CONFIG_P2P */
705
6fc6879b 706 if (wpa_supplicant_send_2_of_4(sm, sm->bssid, key, ver, sm->snonce,
c93b7e18 707 kde, kde_len, ptk) < 0)
83935317 708 goto failed;
6fc6879b 709
25ef8529 710 os_free(kde_buf);
6fc6879b 711 os_memcpy(sm->anonce, key->key_nonce, WPA_NONCE_LEN);
83935317
JM		 712 return;
713
714failed:
25ef8529 715 os_free(kde_buf);
83935317 716 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
6fc6879b
JM		 717}
718
719
720static void wpa_sm_start_preauth(void *eloop_ctx, void *timeout_ctx)
721{
722 struct wpa_sm *sm = eloop_ctx;
723 rsn_preauth_candidate_process(sm);
724}
725
726
727static void wpa_supplicant_key_neg_complete(struct wpa_sm *sm,
728 const u8 *addr, int secure)
729{
0f057fb2
JM		 730 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
731 "WPA: Key negotiation completed with "
6fc6879b
JM		 732 MACSTR " [PTK=%s GTK=%s]", MAC2STR(addr),
733 wpa_cipher_txt(sm->pairwise_cipher),
734 wpa_cipher_txt(sm->group_cipher));
6fc6879b
JM		 735 wpa_sm_cancel_auth_timeout(sm);
736 wpa_sm_set_state(sm, WPA_COMPLETED);
737
738 if (secure) {
739 wpa_sm_mlme_setprotection(
740 sm, addr, MLME_SETPROTECTION_PROTECT_TYPE_RX_TX,
741 MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
742 eapol_sm_notify_portValid(sm->eapol, TRUE);
a1ea1b45 743 if (wpa_key_mgmt_wpa_psk(sm->key_mgmt) ||
567da5bb 744 sm->key_mgmt == WPA_KEY_MGMT_DPP ||
a1ea1b45 745 sm->key_mgmt == WPA_KEY_MGMT_OWE)
6fc6879b
JM		 746 eapol_sm_notify_eap_success(sm->eapol, TRUE);
747 /*
748 * Start preauthentication after a short wait to avoid a
749 * possible race condition between the data receive and key
750 * configuration after the 4-Way Handshake. This increases the
ffbf1eaa 751 * likelihood of the first preauth EAPOL-Start frame getting to
6fc6879b
JM		 752 * the target AP.
753 */
02a0a239
JM		 754 if (!dl_list_empty(&sm->pmksa_candidates))
755 eloop_register_timeout(1, 0, wpa_sm_start_preauth,
756 sm, NULL);
6fc6879b
JM		 757 }
758
759 if (sm->cur_pmksa && sm->cur_pmksa->opportunistic) {
f049052b
BG		 760 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
761 "RSN: Authenticator accepted "
762 "opportunistic PMKSA entry - marking it valid");
6fc6879b
JM		 763 sm->cur_pmksa->opportunistic = 0;
764 }
765
766#ifdef CONFIG_IEEE80211R
56586197 767 if (wpa_key_mgmt_ft(sm->key_mgmt)) {
6fc6879b 768 /* Prepare for the next transition */
76b7981d 769 wpa_ft_prepare_auth_request(sm, NULL);
6fc6879b
JM		 770 }
771#endif /* CONFIG_IEEE80211R */
772}
773
774
581a8cde
JM		 775static void wpa_sm_rekey_ptk(void *eloop_ctx, void *timeout_ctx)
776{
777 struct wpa_sm *sm = eloop_ctx;
f049052b 778 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Request PTK rekeying");
581a8cde
JM		 779 wpa_sm_key_request(sm, 0, 1);
780}
781
782
6fc6879b
JM		 783static int wpa_supplicant_install_ptk(struct wpa_sm *sm,
784 const struct wpa_eapol_key *key)
785{
786 int keylen, rsclen;
71934751 787 enum wpa_alg alg;
6fc6879b 788 const u8 *key_rsc;
6fc6879b 789
53bb18cc 790 if (sm->ptk.installed) {
ad00d64e
JM		 791 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
792 "WPA: Do not re-install same PTK to the driver");
793 return 0;
794 }
795
f049052b
BG		 796 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
797 "WPA: Installing PTK to the driver");
6fc6879b 798
c3550295 799 if (sm->pairwise_cipher == WPA_CIPHER_NONE) {
f049052b
BG		 800 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Pairwise Cipher "
801 "Suite: NONE - do not use pairwise keys");
6fc6879b 802 return 0;
c3550295
JM		 803 }
804
805 if (!wpa_cipher_valid_pairwise(sm->pairwise_cipher)) {
f049052b
BG		 806 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
807 "WPA: Unsupported pairwise cipher %d",
808 sm->pairwise_cipher);
6fc6879b
JM		 809 return -1;
810 }
811
c3550295
JM		 812 alg = wpa_cipher_to_alg(sm->pairwise_cipher);
813 keylen = wpa_cipher_key_len(sm->pairwise_cipher);
a6ea6653
JM		 814 if (keylen <= 0 || (unsigned int) keylen != sm->ptk.tk_len) {
815 wpa_printf(MSG_DEBUG, "WPA: TK length mismatch: %d != %lu",
816 keylen, (long unsigned int) sm->ptk.tk_len);
817 return -1;
818 }
c3550295
JM		 819 rsclen = wpa_cipher_rsc_len(sm->pairwise_cipher);
820
a14896e8 821 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) {
6fc6879b
JM		 822 key_rsc = null_rsc;
823 } else {
824 key_rsc = key->key_rsc;
825 wpa_hexdump(MSG_DEBUG, "WPA: RSC", key_rsc, rsclen);
826 }
827
828 if (wpa_sm_set_key(sm, alg, sm->bssid, 0, 1, key_rsc, rsclen,
98cd3d1c 829 sm->ptk.tk, keylen) < 0) {
f049052b
BG		 830 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
831 "WPA: Failed to set PTK to the "
832 "driver (alg=%d keylen=%d bssid=" MACSTR ")",
833 alg, keylen, MAC2STR(sm->bssid));
6fc6879b
JM		 834 return -1;
835 }
581a8cde 836
7d711541 837 /* TK is not needed anymore in supplicant */
98cd3d1c 838 os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
a6ea6653 839 sm->ptk.tk_len = 0;
53bb18cc 840 sm->ptk.installed = 1;
7d711541 841
581a8cde
JM		 842 if (sm->wpa_ptk_rekey) {
843 eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
844 eloop_register_timeout(sm->wpa_ptk_rekey, 0, wpa_sm_rekey_ptk,
845 sm, NULL);
846 }
847
6fc6879b
JM		 848 return 0;
849}
850
851
f049052b
BG		 852static int wpa_supplicant_check_group_cipher(struct wpa_sm *sm,
853 int group_cipher,
6fc6879b 854 int keylen, int maxkeylen,
71934751
JM		 855 int *key_rsc_len,
856 enum wpa_alg *alg)
6fc6879b 857{
c3550295 858 int klen;
6fc6879b 859
c3550295
JM		 860 *alg = wpa_cipher_to_alg(group_cipher);
861 if (*alg == WPA_ALG_NONE) {
f049052b
BG		 862 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
863 "WPA: Unsupported Group Cipher %d",
864 group_cipher);
6fc6879b
JM		 865 return -1;
866 }
c3550295 867 *key_rsc_len = wpa_cipher_rsc_len(group_cipher);
6fc6879b 868
c3550295
JM		 869 klen = wpa_cipher_key_len(group_cipher);
870 if (keylen != klen || maxkeylen < klen) {
f049052b
BG		 871 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
872 "WPA: Unsupported %s Group Cipher key length %d (%d)",
873 wpa_cipher_txt(group_cipher), keylen, maxkeylen);
c3550295 874 return -1;
6fc6879b 875 }
c3550295 876 return 0;
6fc6879b
JM		 877}
878
879
880struct wpa_gtk_data {
71934751 881 enum wpa_alg alg;
6fc6879b
JM		 882 int tx, key_rsc_len, keyidx;
883 u8 gtk[32];
884 int gtk_len;
885};
886
887
888static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
889 const struct wpa_gtk_data *gd,
87e2db16 890 const u8 *key_rsc, int wnm_sleep)
6fc6879b
JM		 891{
892 const u8 *_gtk = gd->gtk;
893 u8 gtk_buf[32];
894
cb5132bb 895 /* Detect possible key reinstallation */
87e2db16
JM		 896 if ((sm->gtk.gtk_len == (size_t) gd->gtk_len &&
897 os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) ||
898 (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len &&
899 os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk,
900 sm->gtk_wnm_sleep.gtk_len) == 0)) {
cb5132bb
MV		 901 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
902 "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)",
903 gd->keyidx, gd->tx, gd->gtk_len);
904 return 0;
905 }
906
6fc6879b 907 wpa_hexdump_key(MSG_DEBUG, "WPA: Group Key", gd->gtk, gd->gtk_len);
f049052b
BG		 908 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
909 "WPA: Installing GTK to the driver (keyidx=%d tx=%d len=%d)",
910 gd->keyidx, gd->tx, gd->gtk_len);
6fc6879b
JM		 911 wpa_hexdump(MSG_DEBUG, "WPA: RSC", key_rsc, gd->key_rsc_len);
912 if (sm->group_cipher == WPA_CIPHER_TKIP) {
913 /* Swap Tx/Rx keys for Michael MIC */
914 os_memcpy(gtk_buf, gd->gtk, 16);
915 os_memcpy(gtk_buf + 16, gd->gtk + 24, 8);
916 os_memcpy(gtk_buf + 24, gd->gtk + 16, 8);
917 _gtk = gtk_buf;
918 }
919 if (sm->pairwise_cipher == WPA_CIPHER_NONE) {
0382097e 920 if (wpa_sm_set_key(sm, gd->alg, NULL,
6fc6879b
JM		 921 gd->keyidx, 1, key_rsc, gd->key_rsc_len,
922 _gtk, gd->gtk_len) < 0) {
f049052b
BG		 923 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
924 "WPA: Failed to set GTK to the driver "
925 "(Group only)");
31bc66e4 926 forced_memzero(gtk_buf, sizeof(gtk_buf));
6fc6879b
JM		 927 return -1;
928 }
0382097e 929 } else if (wpa_sm_set_key(sm, gd->alg, broadcast_ether_addr,
6fc6879b
JM		 930 gd->keyidx, gd->tx, key_rsc, gd->key_rsc_len,
931 _gtk, gd->gtk_len) < 0) {
f049052b
BG		 932 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
933 "WPA: Failed to set GTK to "
934 "the driver (alg=%d keylen=%d keyidx=%d)",
935 gd->alg, gd->gtk_len, gd->keyidx);
31bc66e4 936 forced_memzero(gtk_buf, sizeof(gtk_buf));
6fc6879b
JM		 937 return -1;
938 }
31bc66e4 939 forced_memzero(gtk_buf, sizeof(gtk_buf));
6fc6879b 940
87e2db16
JM		 941 if (wnm_sleep) {
942 sm->gtk_wnm_sleep.gtk_len = gd->gtk_len;
943 os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk,
944 sm->gtk_wnm_sleep.gtk_len);
945 } else {
946 sm->gtk.gtk_len = gd->gtk_len;
947 os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
948 }
cb5132bb 949
6fc6879b
JM		 950 return 0;
951}
952
953
954static int wpa_supplicant_gtk_tx_bit_workaround(const struct wpa_sm *sm,
955 int tx)
956{
957 if (tx && sm->pairwise_cipher != WPA_CIPHER_NONE) {
958 /* Ignore Tx bit for GTK if a pairwise key is used. One AP
959 * seemed to set this bit (incorrectly, since Tx is only when
960 * doing Group Key only APs) and without this workaround, the
961 * data connection does not work because wpa_supplicant
962 * configured non-zero keyidx to be used for unicast. */
f049052b
BG		 963 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
964 "WPA: Tx bit set for GTK, but pairwise "
965 "keys are used - ignore Tx bit");
6fc6879b
JM		 966 return 0;
967 }
968 return tx;
969}
970
971
73ed03f3
MS		 972static int wpa_supplicant_rsc_relaxation(const struct wpa_sm *sm,
973 const u8 *rsc)
974{
975 int rsclen;
976
977 if (!sm->wpa_rsc_relaxation)
978 return 0;
979
980 rsclen = wpa_cipher_rsc_len(sm->group_cipher);
981
982 /*
983 * Try to detect RSC (endian) corruption issue where the AP sends
984 * the RSC bytes in EAPOL-Key message in the wrong order, both if
985 * it's actually a 6-byte field (as it should be) and if it treats
986 * it as an 8-byte field.
987 * An AP model known to have this bug is the Sapido RB-1632.
988 */
989 if (rsclen == 6 && ((rsc[5] && !rsc[0]) || rsc[6] || rsc[7])) {
990 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
991 "RSC %02x%02x%02x%02x%02x%02x%02x%02x is likely bogus, using 0",
992 rsc[0], rsc[1], rsc[2], rsc[3],
993 rsc[4], rsc[5], rsc[6], rsc[7]);
994
995 return 1;
996 }
997
998 return 0;
999}
1000
1001
6fc6879b
JM		 1002static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm,
1003 const struct wpa_eapol_key *key,
1004 const u8 *gtk, size_t gtk_len,
1005 int key_info)
1006{
6fc6879b 1007 struct wpa_gtk_data gd;
73ed03f3 1008 const u8 *key_rsc;
6fc6879b
JM		 1009
1010 /*
1011 * IEEE Std 802.11i-2004 - 8.5.2 EAPOL-Key frames - Figure 43x
1012 * GTK KDE format:
1013 * KeyID[bits 0-1], Tx [bit 2], Reserved [bits 3-7]
1014 * Reserved [bits 0-7]
1015 * GTK
1016 */
1017
1018 os_memset(&gd, 0, sizeof(gd));
1019 wpa_hexdump_key(MSG_DEBUG, "RSN: received GTK in pairwise handshake",
1020 gtk, gtk_len);
1021
1022 if (gtk_len < 2 || gtk_len - 2 > sizeof(gd.gtk))
1023 return -1;
1024
1025 gd.keyidx = gtk[0] & 0x3;
1026 gd.tx = wpa_supplicant_gtk_tx_bit_workaround(sm,
1027 !!(gtk[0] & BIT(2)));
1028 gtk += 2;
1029 gtk_len -= 2;
1030
1031 os_memcpy(gd.gtk, gtk, gtk_len);
1032 gd.gtk_len = gtk_len;
1033
73ed03f3
MS		 1034 key_rsc = key->key_rsc;
1035 if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
1036 key_rsc = null_rsc;
1037
dff1e285
JM		 1038 if (sm->group_cipher != WPA_CIPHER_GTK_NOT_USED &&
1039 (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
1040 gtk_len, gtk_len,
1041 &gd.key_rsc_len, &gd.alg) ||
87e2db16 1042 wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) {
f049052b
BG		 1043 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1044 "RSN: Failed to install GTK");
31bc66e4 1045 forced_memzero(&gd, sizeof(gd));
6fc6879b
JM		 1046 return -1;
1047 }
31bc66e4 1048 forced_memzero(&gd, sizeof(gd));
6fc6879b 1049
6fc6879b 1050 return 0;
6fc6879b
JM		 1051}
1052
1053
cb5132bb 1054static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
87e2db16
JM		 1055 const struct wpa_igtk_kde *igtk,
1056 int wnm_sleep)
cb5132bb
MV		 1057{
1058 size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1059 u16 keyidx = WPA_GET_LE16(igtk->keyid);
1060
1061 /* Detect possible key reinstallation */
87e2db16
JM		 1062 if ((sm->igtk.igtk_len == len &&
1063 os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) ||
1064 (sm->igtk_wnm_sleep.igtk_len == len &&
1065 os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk,
1066 sm->igtk_wnm_sleep.igtk_len) == 0)) {
cb5132bb
MV		 1067 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1068 "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)",
1069 keyidx);
1070 return 0;
1071 }
1072
1073 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
94919da2 1074 "WPA: IGTK keyid %d pn " COMPACT_MACSTR,
cb5132bb
MV		 1075 keyidx, MAC2STR(igtk->pn));
1076 wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", igtk->igtk, len);
1077 if (keyidx > 4095) {
1078 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1079 "WPA: Invalid IGTK KeyID %d", keyidx);
1080 return -1;
1081 }
1082 if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
1083 broadcast_ether_addr,
1084 keyidx, 0, igtk->pn, sizeof(igtk->pn),
1085 igtk->igtk, len) < 0) {
824cb5a5
JM		 1086 if (keyidx == 0x0400 || keyidx == 0x0500) {
1087 /* Assume the AP has broken PMF implementation since it
1088 * seems to have swapped the KeyID bytes. The AP cannot
1089 * be trusted to implement BIP correctly or provide a
1090 * valid IGTK, so do not try to configure this key with
1091 * swapped KeyID bytes. Instead, continue without
1092 * configuring the IGTK so that the driver can drop any
1093 * received group-addressed robust management frames due
1094 * to missing keys.
1095 *
1096 * Normally, this error behavior would result in us
1097 * disconnecting, but there are number of deployed APs
1098 * with this broken behavior, so as an interoperability
1099 * workaround, allow the connection to proceed. */
1100 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1101 "WPA: Ignore IGTK configuration error due to invalid IGTK KeyID byte order");
1102 } else {
1103 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1104 "WPA: Failed to configure IGTK to the driver");
1105 return -1;
1106 }
cb5132bb
MV		 1107 }
1108
87e2db16
JM		 1109 if (wnm_sleep) {
1110 sm->igtk_wnm_sleep.igtk_len = len;
1111 os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk,
1112 sm->igtk_wnm_sleep.igtk_len);
1113 } else {
1114 sm->igtk.igtk_len = len;
1115 os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
1116 }
cb5132bb
MV		 1117
1118 return 0;
1119}
cb5132bb
MV		 1120
1121
6fc6879b
JM		 1122static int ieee80211w_set_keys(struct wpa_sm *sm,
1123 struct wpa_eapol_ie_parse *ie)
1124{
8dd9f9cd 1125 if (!wpa_cipher_valid_mgmt_group(sm->mgmt_group_cipher))
6fc6879b
JM		 1126 return 0;
1127
1128 if (ie->igtk) {
8dd9f9cd 1129 size_t len;
6fc6879b 1130 const struct wpa_igtk_kde *igtk;
cb5132bb 1131
8dd9f9cd
JM		 1132 len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1133 if (ie->igtk_len != WPA_IGTK_KDE_PREFIX_LEN + len)
6fc6879b 1134 return -1;
cb5132bb 1135
6fc6879b 1136 igtk = (const struct wpa_igtk_kde *) ie->igtk;
87e2db16 1137 if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0)
6fc6879b 1138 return -1;
6fc6879b
JM		 1139 }
1140
1141 return 0;
6fc6879b
JM		 1142}
1143
1144
1145static void wpa_report_ie_mismatch(struct wpa_sm *sm,
1146 const char *reason, const u8 *src_addr,
1147 const u8 *wpa_ie, size_t wpa_ie_len,
1148 const u8 *rsn_ie, size_t rsn_ie_len)
1149{
0f057fb2 1150 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "WPA: %s (src=" MACSTR ")",
6fc6879b
JM		 1151 reason, MAC2STR(src_addr));
1152
1153 if (sm->ap_wpa_ie) {
1154 wpa_hexdump(MSG_INFO, "WPA: WPA IE in Beacon/ProbeResp",
1155 sm->ap_wpa_ie, sm->ap_wpa_ie_len);
1156 }
1157 if (wpa_ie) {
1158 if (!sm->ap_wpa_ie) {
f049052b
BG		 1159 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1160 "WPA: No WPA IE in Beacon/ProbeResp");
6fc6879b
JM		 1161 }
1162 wpa_hexdump(MSG_INFO, "WPA: WPA IE in 3/4 msg",
1163 wpa_ie, wpa_ie_len);
1164 }
1165
1166 if (sm->ap_rsn_ie) {
1167 wpa_hexdump(MSG_INFO, "WPA: RSN IE in Beacon/ProbeResp",
1168 sm->ap_rsn_ie, sm->ap_rsn_ie_len);
1169 }
1170 if (rsn_ie) {
1171 if (!sm->ap_rsn_ie) {
f049052b
BG		 1172 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1173 "WPA: No RSN IE in Beacon/ProbeResp");
6fc6879b
JM		 1174 }
1175 wpa_hexdump(MSG_INFO, "WPA: RSN IE in 3/4 msg",
1176 rsn_ie, rsn_ie_len);
1177 }
1178
3da372fa 1179 wpa_sm_deauthenticate(sm, WLAN_REASON_IE_IN_4WAY_DIFFERS);
6fc6879b
JM		 1180}
1181
1182
5af8187e
JM		 1183#ifdef CONFIG_IEEE80211R
1184
1185static int ft_validate_mdie(struct wpa_sm *sm,
1186 const unsigned char *src_addr,
3b4f6dac
JM		 1187 struct wpa_eapol_ie_parse *ie,
1188 const u8 *assoc_resp_mdie)
5af8187e
JM		 1189{
1190 struct rsn_mdie *mdie;
1191
5af8187e
JM		 1192 mdie = (struct rsn_mdie *) (ie->mdie + 2);
1193 if (ie->mdie == NULL || ie->mdie_len < 2 + sizeof(*mdie) ||
1194 os_memcmp(mdie->mobility_domain, sm->mobility_domain,
1195 MOBILITY_DOMAIN_ID_LEN) != 0) {
f049052b
BG		 1196 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: MDIE in msg 3/4 did "
1197 "not match with the current mobility domain");
5af8187e
JM		 1198 return -1;
1199 }
1200
3b4f6dac
JM		 1201 if (assoc_resp_mdie &&
1202 (assoc_resp_mdie[1] != ie->mdie[1] ||
1203 os_memcmp(assoc_resp_mdie, ie->mdie, 2 + ie->mdie[1]) != 0)) {
f049052b 1204 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: MDIE mismatch");
3b4f6dac
JM		 1205 wpa_hexdump(MSG_DEBUG, "FT: MDIE in EAPOL-Key msg 3/4",
1206 ie->mdie, 2 + ie->mdie[1]);
1207 wpa_hexdump(MSG_DEBUG, "FT: MDIE in (Re)Association Response",
1208 assoc_resp_mdie, 2 + assoc_resp_mdie[1]);
1209 return -1;
1210 }
1211
1212 return 0;
1213}
1214
1215
1216static int ft_validate_ftie(struct wpa_sm *sm,
1217 const unsigned char *src_addr,
1218 struct wpa_eapol_ie_parse *ie,
1219 const u8 *assoc_resp_ftie)
1220{
1221 if (ie->ftie == NULL) {
f049052b
BG		 1222 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1223 "FT: No FTIE in EAPOL-Key msg 3/4");
3b4f6dac
JM		 1224 return -1;
1225 }
1226
1227 if (assoc_resp_ftie == NULL)
1228 return 0;
1229
1230 if (assoc_resp_ftie[1] != ie->ftie[1] ||
1231 os_memcmp(assoc_resp_ftie, ie->ftie, 2 + ie->ftie[1]) != 0) {
f049052b 1232 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: FTIE mismatch");
3b4f6dac
JM		 1233 wpa_hexdump(MSG_DEBUG, "FT: FTIE in EAPOL-Key msg 3/4",
1234 ie->ftie, 2 + ie->ftie[1]);
1235 wpa_hexdump(MSG_DEBUG, "FT: FTIE in (Re)Association Response",
1236 assoc_resp_ftie, 2 + assoc_resp_ftie[1]);
1237 return -1;
1238 }
1239
5af8187e
JM		 1240 return 0;
1241}
1242
1243
1244static int ft_validate_rsnie(struct wpa_sm *sm,
1245 const unsigned char *src_addr,
1246 struct wpa_eapol_ie_parse *ie)
1247{
1248 struct wpa_ie_data rsn;
1249
1250 if (!ie->rsn_ie)
1251 return 0;
1252
1253 /*
1254 * Verify that PMKR1Name from EAPOL-Key message 3/4
1255 * matches with the value we derived.
1256 */
1257 if (wpa_parse_wpa_ie_rsn(ie->rsn_ie, ie->rsn_ie_len, &rsn) < 0 ||
1258 rsn.num_pmkid != 1 || rsn.pmkid == NULL) {
f049052b
BG		 1259 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: No PMKR1Name in "
1260 "FT 4-way handshake message 3/4");
5af8187e
JM		 1261 return -1;
1262 }
1263
0d15b69f
JM		 1264 if (os_memcmp_const(rsn.pmkid, sm->pmk_r1_name, WPA_PMK_NAME_LEN) != 0)
1265 {
f049052b
BG		 1266 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1267 "FT: PMKR1Name mismatch in "
1268 "FT 4-way handshake message 3/4");
5af8187e
JM		 1269 wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name from Authenticator",
1270 rsn.pmkid, WPA_PMK_NAME_LEN);
1271 wpa_hexdump(MSG_DEBUG, "FT: Derived PMKR1Name",
1272 sm->pmk_r1_name, WPA_PMK_NAME_LEN);
1273 return -1;
1274 }
1275
1276 return 0;
1277}
1278
1279
1280static int wpa_supplicant_validate_ie_ft(struct wpa_sm *sm,
1281 const unsigned char *src_addr,
1282 struct wpa_eapol_ie_parse *ie)
1283{
3b4f6dac
JM		 1284 const u8 *pos, *end, *mdie = NULL, *ftie = NULL;
1285
1286 if (sm->assoc_resp_ies) {
1287 pos = sm->assoc_resp_ies;
1288 end = pos + sm->assoc_resp_ies_len;
2461724c
JM		 1289 while (end - pos > 2) {
1290 if (2 + pos[1] > end - pos)
3b4f6dac
JM		 1291 break;
1292 switch (*pos) {
1293 case WLAN_EID_MOBILITY_DOMAIN:
1294 mdie = pos;
1295 break;
1296 case WLAN_EID_FAST_BSS_TRANSITION:
1297 ftie = pos;
1298 break;
1299 }
1300 pos += 2 + pos[1];
1301 }
1302 }
1303
1304 if (ft_validate_mdie(sm, src_addr, ie, mdie) < 0 ||
1305 ft_validate_ftie(sm, src_addr, ie, ftie) < 0 ||
5af8187e
JM		 1306 ft_validate_rsnie(sm, src_addr, ie) < 0)
1307 return -1;
1308
1309 return 0;
1310}
1311
1312#endif /* CONFIG_IEEE80211R */
1313
1314
6fc6879b
JM		 1315static int wpa_supplicant_validate_ie(struct wpa_sm *sm,
1316 const unsigned char *src_addr,
1317 struct wpa_eapol_ie_parse *ie)
1318{
1319 if (sm->ap_wpa_ie == NULL && sm->ap_rsn_ie == NULL) {
f049052b
BG		 1320 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1321 "WPA: No WPA/RSN IE for this AP known. "
1322 "Trying to get from scan results");
6fc6879b 1323 if (wpa_sm_get_beacon_ie(sm) < 0) {
f049052b
BG		 1324 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1325 "WPA: Could not find AP from "
1326 "the scan results");
6fc6879b 1327 } else {
f049052b
BG		 1328 wpa_msg(sm->ctx->msg_ctx, MSG_DEBUG,
1329 "WPA: Found the current AP from "
1330 "updated scan results");
6fc6879b
JM		 1331 }
1332 }
1333
1334 if (ie->wpa_ie == NULL && ie->rsn_ie == NULL &&
1335 (sm->ap_wpa_ie || sm->ap_rsn_ie)) {
1336 wpa_report_ie_mismatch(sm, "IE in 3/4 msg does not match "
1337 "with IE in Beacon/ProbeResp (no IE?)",
1338 src_addr, ie->wpa_ie, ie->wpa_ie_len,
1339 ie->rsn_ie, ie->rsn_ie_len);
1340 return -1;
1341 }
1342
1343 if ((ie->wpa_ie && sm->ap_wpa_ie &&
1344 (ie->wpa_ie_len != sm->ap_wpa_ie_len ||
1345 os_memcmp(ie->wpa_ie, sm->ap_wpa_ie, ie->wpa_ie_len) != 0)) ||
1346 (ie->rsn_ie && sm->ap_rsn_ie &&
26e23750
JM		 1347 wpa_compare_rsn_ie(wpa_key_mgmt_ft(sm->key_mgmt),
1348 sm->ap_rsn_ie, sm->ap_rsn_ie_len,
1349 ie->rsn_ie, ie->rsn_ie_len))) {
6fc6879b
JM		 1350 wpa_report_ie_mismatch(sm, "IE in 3/4 msg does not match "
1351 "with IE in Beacon/ProbeResp",
1352 src_addr, ie->wpa_ie, ie->wpa_ie_len,
1353 ie->rsn_ie, ie->rsn_ie_len);
1354 return -1;
1355 }
1356
1357 if (sm->proto == WPA_PROTO_WPA &&
1358 ie->rsn_ie && sm->ap_rsn_ie == NULL && sm->rsn_enabled) {
1359 wpa_report_ie_mismatch(sm, "Possible downgrade attack "
1360 "detected - RSN was enabled and RSN IE "
1361 "was in msg 3/4, but not in "
1362 "Beacon/ProbeResp",
1363 src_addr, ie->wpa_ie, ie->wpa_ie_len,
1364 ie->rsn_ie, ie->rsn_ie_len);
1365 return -1;
1366 }
1367
1368#ifdef CONFIG_IEEE80211R
5af8187e
JM		 1369 if (wpa_key_mgmt_ft(sm->key_mgmt) &&
1370 wpa_supplicant_validate_ie_ft(sm, src_addr, ie) < 0)
1371 return -1;
6fc6879b
JM		 1372#endif /* CONFIG_IEEE80211R */
1373
1374 return 0;
1375}
1376
1377
1378/**
1379 * wpa_supplicant_send_4_of_4 - Send message 4 of WPA/RSN 4-Way Handshake
1380 * @sm: Pointer to WPA state machine data from wpa_sm_init()
1381 * @dst: Destination address for the frame
1382 * @key: Pointer to the EAPOL-Key frame header
1383 * @ver: Version bits from EAPOL-Key Key Info
1384 * @key_info: Key Info
6fc6879b 1385 * @ptk: PTK to use for keyed hash and encryption
c93b7e18 1386 * Returns: >= 0 on success, < 0 on failure
6fc6879b
JM		 1387 */
1388int wpa_supplicant_send_4_of_4(struct wpa_sm *sm, const unsigned char *dst,
1389 const struct wpa_eapol_key *key,
1390 u16 ver, u16 key_info,
6fc6879b
JM		 1391 struct wpa_ptk *ptk)
1392{
5e3b5197 1393 size_t mic_len, hdrlen, rlen;
6fc6879b 1394 struct wpa_eapol_key *reply;
5e3b5197 1395 u8 *rbuf, *key_mic;
6fc6879b 1396
567da5bb 1397 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
6d014ffc 1398 hdrlen = sizeof(*reply) + mic_len + 2;
6fc6879b 1399 rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
5e3b5197 1400 hdrlen, &rlen, (void *) &reply);
6fc6879b
JM		 1401 if (rbuf == NULL)
1402 return -1;
1403
a14896e8
JM		 1404 reply->type = (sm->proto == WPA_PROTO_RSN ||
1405 sm->proto == WPA_PROTO_OSEN) ?
6fc6879b
JM		 1406 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
1407 key_info &= WPA_KEY_INFO_SECURE;
4a26ccda
JM		 1408 key_info |= ver | WPA_KEY_INFO_KEY_TYPE;
1409 if (mic_len)
1410 key_info |= WPA_KEY_INFO_MIC;
2022f1d0
JM		 1411 else
1412 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
6fc6879b 1413 WPA_PUT_BE16(reply->key_info, key_info);
a14896e8 1414 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN)
6fc6879b
JM		 1415 WPA_PUT_BE16(reply->key_length, 0);
1416 else
1417 os_memcpy(reply->key_length, key->key_length, 2);
1418 os_memcpy(reply->replay_counter, key->replay_counter,
1419 WPA_REPLAY_COUNTER_LEN);
1420
6d014ffc
JM		 1421 key_mic = (u8 *) (reply + 1);
1422 WPA_PUT_BE16(key_mic + mic_len, 0);
6fc6879b 1423
f049052b 1424 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Sending EAPOL-Key 4/4");
1049af7e
JM		 1425 return wpa_eapol_key_send(sm, ptk, ver, dst, ETH_P_EAPOL, rbuf, rlen,
1426 key_mic);
6fc6879b
JM		 1427}
1428
1429
1430static void wpa_supplicant_process_3_of_4(struct wpa_sm *sm,
1431 const struct wpa_eapol_key *key,
e6270129
JM		 1432 u16 ver, const u8 *key_data,
1433 size_t key_data_len)
6fc6879b 1434{
e6270129 1435 u16 key_info, keylen;
6fc6879b
JM		 1436 struct wpa_eapol_ie_parse ie;
1437
1438 wpa_sm_set_state(sm, WPA_4WAY_HANDSHAKE);
f049052b
BG		 1439 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: RX message 3 of 4-Way "
1440 "Handshake from " MACSTR " (ver=%d)", MAC2STR(sm->bssid), ver);
6fc6879b
JM		 1441
1442 key_info = WPA_GET_BE16(key->key_info);
1443
e6270129
JM		 1444 wpa_hexdump(MSG_DEBUG, "WPA: IE KeyData", key_data, key_data_len);
1445 if (wpa_supplicant_parse_ies(key_data, key_data_len, &ie) < 0)
d627a939 1446 goto failed;
6fc6879b 1447 if (ie.gtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
f049052b
BG		 1448 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1449 "WPA: GTK IE in unencrypted key data");
83935317 1450 goto failed;
6fc6879b 1451 }
6fc6879b 1452 if (ie.igtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
f049052b
BG		 1453 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1454 "WPA: IGTK KDE in unencrypted key data");
83935317 1455 goto failed;
6fc6879b
JM		 1456 }
1457
8dd9f9cd
JM		 1458 if (ie.igtk &&
1459 wpa_cipher_valid_mgmt_group(sm->mgmt_group_cipher) &&
1460 ie.igtk_len != WPA_IGTK_KDE_PREFIX_LEN +
1461 (unsigned int) wpa_cipher_key_len(sm->mgmt_group_cipher)) {
f049052b
BG		 1462 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1463 "WPA: Invalid IGTK KDE length %lu",
1464 (unsigned long) ie.igtk_len);
83935317 1465 goto failed;
6fc6879b 1466 }
6fc6879b
JM		 1467
1468 if (wpa_supplicant_validate_ie(sm, sm->bssid, &ie) < 0)
83935317 1469 goto failed;
6fc6879b
JM		 1470
1471 if (os_memcmp(sm->anonce, key->key_nonce, WPA_NONCE_LEN) != 0) {
f049052b
BG		 1472 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1473 "WPA: ANonce from message 1 of 4-Way Handshake "
1474 "differs from 3 of 4-Way Handshake - drop packet (src="
1475 MACSTR ")", MAC2STR(sm->bssid));
83935317 1476 goto failed;
6fc6879b
JM		 1477 }
1478
1479 keylen = WPA_GET_BE16(key->key_length);
c3550295
JM		 1480 if (keylen != wpa_cipher_key_len(sm->pairwise_cipher)) {
1481 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1482 "WPA: Invalid %s key length %d (src=" MACSTR
1483 ")", wpa_cipher_txt(sm->pairwise_cipher), keylen,
1484 MAC2STR(sm->bssid));
1485 goto failed;
6fc6879b
JM		 1486 }
1487
25ef8529
JM		 1488#ifdef CONFIG_P2P
1489 if (ie.ip_addr_alloc) {
1490 os_memcpy(sm->p2p_ip_addr, ie.ip_addr_alloc, 3 * 4);
1491 wpa_hexdump(MSG_DEBUG, "P2P: IP address info",
1492 sm->p2p_ip_addr, sizeof(sm->p2p_ip_addr));
1493 }
1494#endif /* CONFIG_P2P */
1495
aed61c4e
MV		 1496#ifdef CONFIG_OCV
1497 if (wpa_sm_ocv_enabled(sm)) {
1498 struct wpa_channel_info ci;
1499
1500 if (wpa_sm_channel_info(sm, &ci) != 0) {
1501 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1502 "Failed to get channel info to validate received OCI in EAPOL-Key 3/4");
1503 return;
1504 }
1505
1506 if (ocv_verify_tx_params(ie.oci, ie.oci_len, &ci,
1507 channel_width_to_int(ci.chanwidth),
1508 ci.seg1_idx) != 0) {
1509 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "%s",
1510 ocv_errorstr);
1511 return;
1512 }
1513 }
1514#endif /* CONFIG_OCV */
1515
6fc6879b 1516 if (wpa_supplicant_send_4_of_4(sm, sm->bssid, key, ver, key_info,
c93b7e18 1517 &sm->ptk) < 0) {
83935317
JM		 1518 goto failed;
1519 }
6fc6879b
JM		 1520
1521 /* SNonce was successfully used in msg 3/4, so mark it to be renewed
1522 * for the next 4-Way Handshake. If msg 3 is received again, the old
1523 * SNonce will still be used to avoid changing PTK. */
1524 sm->renew_snonce = 1;
1525
1526 if (key_info & WPA_KEY_INFO_INSTALL) {
83935317
JM		 1527 if (wpa_supplicant_install_ptk(sm, key))
1528 goto failed;
6fc6879b
JM		 1529 }
1530
1531 if (key_info & WPA_KEY_INFO_SECURE) {
1532 wpa_sm_mlme_setprotection(
1533 sm, sm->bssid, MLME_SETPROTECTION_PROTECT_TYPE_RX,
1534 MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
1535 eapol_sm_notify_portValid(sm->eapol, TRUE);
1536 }
1537 wpa_sm_set_state(sm, WPA_GROUP_HANDSHAKE);
1538
dff1e285 1539 if (sm->group_cipher == WPA_CIPHER_GTK_NOT_USED) {
dfdabd91
JM		 1540 /* No GTK to be set to the driver */
1541 } else if (!ie.gtk && sm->proto == WPA_PROTO_RSN) {
1542 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1543 "RSN: No GTK KDE included in EAPOL-Key msg 3/4");
1544 goto failed;
dff1e285 1545 } else if (ie.gtk &&
6fc6879b
JM		 1546 wpa_supplicant_pairwise_gtk(sm, key,
1547 ie.gtk, ie.gtk_len, key_info) < 0) {
f049052b
BG		 1548 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1549 "RSN: Failed to configure GTK");
83935317 1550 goto failed;
6fc6879b
JM		 1551 }
1552
83935317 1553 if (ieee80211w_set_keys(sm, &ie) < 0) {
f049052b
BG		 1554 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1555 "RSN: Failed to configure IGTK");
83935317
JM		 1556 goto failed;
1557 }
1558
dfdabd91
JM		 1559 if (sm->group_cipher == WPA_CIPHER_GTK_NOT_USED || ie.gtk)
1560 wpa_supplicant_key_neg_complete(sm, sm->bssid,
1561 key_info & WPA_KEY_INFO_SECURE);
1562
392e68e8
SD		 1563 if (ie.gtk)
1564 wpa_sm_set_rekey_offload(sm);
b14a210c 1565
17d4b774
JM		 1566 /* Add PMKSA cache entry for Suite B AKMs here since PMKID can be
1567 * calculated only after KCK has been derived. Though, do not replace an
1568 * existing PMKSA entry after each 4-way handshake (i.e., new KCK/PMKID)
1569 * to avoid unnecessary changes of PMKID while continuing to use the
1570 * same PMK. */
1571 if (sm->proto == WPA_PROTO_RSN && wpa_key_mgmt_suite_b(sm->key_mgmt) &&
1572 !sm->cur_pmksa) {
087a1f4e
JM		 1573 struct rsn_pmksa_cache_entry *sa;
1574
70c93963 1575 sa = pmksa_cache_add(sm->pmksa, sm->pmk, sm->pmk_len, NULL,
98cd3d1c 1576 sm->ptk.kck, sm->ptk.kck_len,
087a1f4e 1577 sm->bssid, sm->own_addr,
869af307 1578 sm->network_ctx, sm->key_mgmt, NULL);
087a1f4e
JM		 1579 if (!sm->cur_pmksa)
1580 sm->cur_pmksa = sa;
1581 }
1582
761396e4 1583 sm->msg_3_of_4_ok = 1;
83935317
JM		 1584 return;
1585
1586failed:
1587 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
6fc6879b
JM		 1588}
1589
1590
1591static int wpa_supplicant_process_1_of_2_rsn(struct wpa_sm *sm,
1592 const u8 *keydata,
1593 size_t keydatalen,
1594 u16 key_info,
1595 struct wpa_gtk_data *gd)
1596{
1597 int maxkeylen;
1598 struct wpa_eapol_ie_parse ie;
1599
ecbdc1a1
JM		 1600 wpa_hexdump_key(MSG_DEBUG, "RSN: msg 1/2 key data",
1601 keydata, keydatalen);
d627a939
JM		 1602 if (wpa_supplicant_parse_ies(keydata, keydatalen, &ie) < 0)
1603 return -1;
6fc6879b 1604 if (ie.gtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
f049052b
BG		 1605 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1606 "WPA: GTK IE in unencrypted key data");
6fc6879b
JM		 1607 return -1;
1608 }
1609 if (ie.gtk == NULL) {
f049052b
BG		 1610 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1611 "WPA: No GTK IE in Group Key msg 1/2");
6fc6879b
JM		 1612 return -1;
1613 }
1614 maxkeylen = gd->gtk_len = ie.gtk_len - 2;
1615
aed61c4e
MV		 1616#ifdef CONFIG_OCV
1617 if (wpa_sm_ocv_enabled(sm)) {
1618 struct wpa_channel_info ci;
1619
1620 if (wpa_sm_channel_info(sm, &ci) != 0) {
1621 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1622 "Failed to get channel info to validate received OCI in EAPOL-Key group msg 1/2");
1623 return -1;
1624 }
1625
1626 if (ocv_verify_tx_params(ie.oci, ie.oci_len, &ci,
1627 channel_width_to_int(ci.chanwidth),
1628 ci.seg1_idx) != 0) {
1629 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "%s",
1630 ocv_errorstr);
1631 return -1;
1632 }
1633 }
1634#endif /* CONFIG_OCV */
1635
f049052b 1636 if (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
6fc6879b
JM		 1637 gd->gtk_len, maxkeylen,
1638 &gd->key_rsc_len, &gd->alg))
1639 return -1;
1640
7cb9bb4d
JM		 1641 wpa_hexdump_key(MSG_DEBUG, "RSN: received GTK in group key handshake",
1642 ie.gtk, ie.gtk_len);
6fc6879b
JM		 1643 gd->keyidx = ie.gtk[0] & 0x3;
1644 gd->tx = wpa_supplicant_gtk_tx_bit_workaround(sm,
1645 !!(ie.gtk[0] & BIT(2)));
1646 if (ie.gtk_len - 2 > sizeof(gd->gtk)) {
f049052b
BG		 1647 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1648 "RSN: Too long GTK in GTK IE (len=%lu)",
1649 (unsigned long) ie.gtk_len - 2);
6fc6879b
JM		 1650 return -1;
1651 }
1652 os_memcpy(gd->gtk, ie.gtk + 2, ie.gtk_len - 2);
1653
1654 if (ieee80211w_set_keys(sm, &ie) < 0)
f049052b
BG		 1655 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1656 "RSN: Failed to configure IGTK");
6fc6879b
JM		 1657
1658 return 0;
1659}
1660
1661
1662static int wpa_supplicant_process_1_of_2_wpa(struct wpa_sm *sm,
1663 const struct wpa_eapol_key *key,
e6270129
JM		 1664 const u8 *key_data,
1665 size_t key_data_len, u16 key_info,
1666 u16 ver, struct wpa_gtk_data *gd)
6fc6879b
JM		 1667{
1668 size_t maxkeylen;
c397eff8 1669 u16 gtk_len;
6fc6879b 1670
c397eff8 1671 gtk_len = WPA_GET_BE16(key->key_length);
e6270129 1672 maxkeylen = key_data_len;
6fc6879b
JM		 1673 if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
1674 if (maxkeylen < 8) {
f049052b
BG		 1675 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1676 "WPA: Too short maxkeylen (%lu)",
1677 (unsigned long) maxkeylen);
6fc6879b
JM		 1678 return -1;
1679 }
1680 maxkeylen -= 8;
1681 }
1682
c397eff8
JM		 1683 if (gtk_len > maxkeylen ||
1684 wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
1685 gtk_len, maxkeylen,
6fc6879b
JM		 1686 &gd->key_rsc_len, &gd->alg))
1687 return -1;
1688
c397eff8 1689 gd->gtk_len = gtk_len;
6fc6879b
JM		 1690 gd->keyidx = (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >>
1691 WPA_KEY_INFO_KEY_INDEX_SHIFT;
98cd3d1c 1692 if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 && sm->ptk.kek_len == 16) {
7cb53ded
JM		 1693#ifdef CONFIG_NO_RC4
1694 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1695 "WPA: RC4 not supported in the build");
1696 return -1;
1697#else /* CONFIG_NO_RC4 */
d2c33b91 1698 u8 ek[32];
e6270129 1699 if (key_data_len > sizeof(gd->gtk)) {
f049052b
BG		 1700 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1701 "WPA: RC4 key data too long (%lu)",
e6270129 1702 (unsigned long) key_data_len);
6fc6879b
JM		 1703 return -1;
1704 }
d2c33b91 1705 os_memcpy(ek, key->key_iv, 16);
98cd3d1c 1706 os_memcpy(ek + 16, sm->ptk.kek, sm->ptk.kek_len);
e6270129
JM		 1707 os_memcpy(gd->gtk, key_data, key_data_len);
1708 if (rc4_skip(ek, 32, 256, gd->gtk, key_data_len)) {
31bc66e4 1709 forced_memzero(ek, sizeof(ek));
f049052b
BG		 1710 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
1711 "WPA: RC4 failed");
7a215dfc
JM		 1712 return -1;
1713 }
31bc66e4 1714 forced_memzero(ek, sizeof(ek));
7cb53ded 1715#endif /* CONFIG_NO_RC4 */
6fc6879b 1716 } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
e6270129 1717 if (maxkeylen % 8) {
f049052b
BG		 1718 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1719 "WPA: Unsupported AES-WRAP len %lu",
e6270129 1720 (unsigned long) maxkeylen);
6fc6879b
JM		 1721 return -1;
1722 }
1723 if (maxkeylen > sizeof(gd->gtk)) {
f049052b
BG		 1724 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1725 "WPA: AES-WRAP key data "
1726 "too long (keydatalen=%lu maxkeylen=%lu)",
e6270129 1727 (unsigned long) key_data_len,
f049052b 1728 (unsigned long) maxkeylen);
6fc6879b
JM		 1729 return -1;
1730 }
98cd3d1c
JM		 1731 if (aes_unwrap(sm->ptk.kek, sm->ptk.kek_len, maxkeylen / 8,
1732 key_data, gd->gtk)) {
f049052b
BG		 1733 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1734 "WPA: AES unwrap failed - could not decrypt "
1735 "GTK");
6fc6879b
JM		 1736 return -1;
1737 }
1738 } else {
f049052b
BG		 1739 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1740 "WPA: Unsupported key_info type %d", ver);
6fc6879b
JM		 1741 return -1;
1742 }
1743 gd->tx = wpa_supplicant_gtk_tx_bit_workaround(
1744 sm, !!(key_info & WPA_KEY_INFO_TXRX));
1745 return 0;
1746}
1747
1748
1749static int wpa_supplicant_send_2_of_2(struct wpa_sm *sm,
1750 const struct wpa_eapol_key *key,
1751 int ver, u16 key_info)
1752{
5e3b5197 1753 size_t mic_len, hdrlen, rlen;
6fc6879b 1754 struct wpa_eapol_key *reply;
5e3b5197 1755 u8 *rbuf, *key_mic;
17c2559c
MV		 1756 size_t kde_len = 0;
1757
1758#ifdef CONFIG_OCV
1759 if (wpa_sm_ocv_enabled(sm))
1760 kde_len = OCV_OCI_KDE_LEN;
1761#endif /* CONFIG_OCV */
6fc6879b 1762
567da5bb 1763 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
6d014ffc 1764 hdrlen = sizeof(*reply) + mic_len + 2;
6fc6879b 1765 rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
17c2559c 1766 hdrlen + kde_len, &rlen, (void *) &reply);
6fc6879b
JM		 1767 if (rbuf == NULL)
1768 return -1;
1769
a14896e8
JM		 1770 reply->type = (sm->proto == WPA_PROTO_RSN ||
1771 sm->proto == WPA_PROTO_OSEN) ?
6fc6879b
JM		 1772 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
1773 key_info &= WPA_KEY_INFO_KEY_INDEX_MASK;
4a26ccda
JM		 1774 key_info |= ver | WPA_KEY_INFO_SECURE;
1775 if (mic_len)
1776 key_info |= WPA_KEY_INFO_MIC;
b44d1efd
VK		 1777 else
1778 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
6fc6879b 1779 WPA_PUT_BE16(reply->key_info, key_info);
a14896e8 1780 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN)
6fc6879b
JM		 1781 WPA_PUT_BE16(reply->key_length, 0);
1782 else
1783 os_memcpy(reply->key_length, key->key_length, 2);
1784 os_memcpy(reply->replay_counter, key->replay_counter,
1785 WPA_REPLAY_COUNTER_LEN);
1786
6d014ffc 1787 key_mic = (u8 *) (reply + 1);
17c2559c
MV		 1788 WPA_PUT_BE16(key_mic + mic_len, kde_len); /* Key Data Length */
1789
1790#ifdef CONFIG_OCV
1791 if (wpa_sm_ocv_enabled(sm)) {
1792 struct wpa_channel_info ci;
1793 u8 *pos;
1794
1795 if (wpa_sm_channel_info(sm, &ci) != 0) {
1796 wpa_printf(MSG_WARNING,
1797 "Failed to get channel info for OCI element in EAPOL-Key 2/2");
1798 os_free(rbuf);
1799 return -1;
1800 }
1801
1802 pos = key_mic + mic_len + 2; /* Key Data */
1803 if (ocv_insert_oci_kde(&ci, &pos) < 0) {
1804 os_free(rbuf);
1805 return -1;
1806 }
1807 }
1808#endif /* CONFIG_OCV */
6fc6879b 1809
f049052b 1810 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Sending EAPOL-Key 2/2");
1049af7e
JM		 1811 return wpa_eapol_key_send(sm, &sm->ptk, ver, sm->bssid, ETH_P_EAPOL,
1812 rbuf, rlen, key_mic);
6fc6879b
JM		 1813}
1814
1815
1816static void wpa_supplicant_process_1_of_2(struct wpa_sm *sm,
1817 const unsigned char *src_addr,
1818 const struct wpa_eapol_key *key,
e6270129
JM		 1819 const u8 *key_data,
1820 size_t key_data_len, u16 ver)
6fc6879b 1821{
e6270129 1822 u16 key_info;
6fc6879b
JM		 1823 int rekey, ret;
1824 struct wpa_gtk_data gd;
73ed03f3 1825 const u8 *key_rsc;
6fc6879b 1826
04243740 1827 if (!sm->msg_3_of_4_ok && !wpa_fils_is_completed(sm)) {
761396e4
JM		 1828 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1829 "WPA: Group Key Handshake started prior to completion of 4-way handshake");
1830 goto failed;
1831 }
1832
6fc6879b
JM		 1833 os_memset(&gd, 0, sizeof(gd));
1834
1835 rekey = wpa_sm_get_state(sm) == WPA_COMPLETED;
f049052b
BG		 1836 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: RX message 1 of Group Key "
1837 "Handshake from " MACSTR " (ver=%d)", MAC2STR(src_addr), ver);
6fc6879b
JM		 1838
1839 key_info = WPA_GET_BE16(key->key_info);
6fc6879b 1840
a14896e8 1841 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) {
e6270129
JM		 1842 ret = wpa_supplicant_process_1_of_2_rsn(sm, key_data,
1843 key_data_len, key_info,
6fc6879b
JM		 1844 &gd);
1845 } else {
e6270129
JM		 1846 ret = wpa_supplicant_process_1_of_2_wpa(sm, key, key_data,
1847 key_data_len,
1848 key_info, ver, &gd);
6fc6879b
JM		 1849 }
1850
1851 wpa_sm_set_state(sm, WPA_GROUP_HANDSHAKE);
1852
1853 if (ret)
83935317 1854 goto failed;
6fc6879b 1855
73ed03f3
MS		 1856 key_rsc = key->key_rsc;
1857 if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
1858 key_rsc = null_rsc;
1859
87e2db16 1860 if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) ||
c93b7e18 1861 wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0)
83935317 1862 goto failed;
31bc66e4 1863 forced_memzero(&gd, sizeof(gd));
6fc6879b
JM		 1864
1865 if (rekey) {
0f057fb2 1866 wpa_msg(sm->ctx->msg_ctx, MSG_INFO, "WPA: Group rekeying "
6fc6879b
JM		 1867 "completed with " MACSTR " [GTK=%s]",
1868 MAC2STR(sm->bssid), wpa_cipher_txt(sm->group_cipher));
1869 wpa_sm_cancel_auth_timeout(sm);
1870 wpa_sm_set_state(sm, WPA_COMPLETED);
1871 } else {
1872 wpa_supplicant_key_neg_complete(sm, sm->bssid,
1873 key_info &
1874 WPA_KEY_INFO_SECURE);
1875 }
392e68e8
SD		 1876
1877 wpa_sm_set_rekey_offload(sm);
1878
83935317
JM		 1879 return;
1880
1881failed:
31bc66e4 1882 forced_memzero(&gd, sizeof(gd));
83935317 1883 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
6fc6879b
JM		 1884}
1885
1886
1887static int wpa_supplicant_verify_eapol_key_mic(struct wpa_sm *sm,
6d014ffc 1888 struct wpa_eapol_key *key,
6fc6879b
JM		 1889 u16 ver,
1890 const u8 *buf, size_t len)
1891{
98cd3d1c 1892 u8 mic[WPA_EAPOL_KEY_MIC_MAX_LEN];
6fc6879b 1893 int ok = 0;
567da5bb 1894 size_t mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
6fc6879b 1895
6d014ffc 1896 os_memcpy(mic, key + 1, mic_len);
6fc6879b 1897 if (sm->tptk_set) {
6d014ffc 1898 os_memset(key + 1, 0, mic_len);
a6ea6653
JM		 1899 if (wpa_eapol_key_mic(sm->tptk.kck, sm->tptk.kck_len,
1900 sm->key_mgmt,
1901 ver, buf, len, (u8 *) (key + 1)) < 0 ||
1902 os_memcmp_const(mic, key + 1, mic_len) != 0) {
f049052b
BG		 1903 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1904 "WPA: Invalid EAPOL-Key MIC "
1905 "when using TPTK - ignoring TPTK");
525923b1
JM		 1906#ifdef TEST_FUZZ
1907 wpa_printf(MSG_INFO,
1908 "TEST: Ignore Key MIC failure for fuzz testing");
1909 goto continue_fuzz;
1910#endif /* TEST_FUZZ */
6fc6879b 1911 } else {
525923b1
JM		 1912#ifdef TEST_FUZZ
1913 continue_fuzz:
1914#endif /* TEST_FUZZ */
6fc6879b
JM		 1915 ok = 1;
1916 sm->tptk_set = 0;
1917 sm->ptk_set = 1;
1918 os_memcpy(&sm->ptk, &sm->tptk, sizeof(sm->ptk));
d2c33b91 1919 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
a00e946c
MV		 1920 /*
1921 * This assures the same TPTK in sm->tptk can never be
a68e0d86 1922 * copied twice to sm->ptk as the new PTK. In
a00e946c
MV		 1923 * combination with the installed flag in the wpa_ptk
1924 * struct, this assures the same PTK is only installed
1925 * once.
1926 */
1927 sm->renew_snonce = 1;
6fc6879b
JM		 1928 }
1929 }
1930
1931 if (!ok && sm->ptk_set) {
6d014ffc 1932 os_memset(key + 1, 0, mic_len);
a6ea6653
JM		 1933 if (wpa_eapol_key_mic(sm->ptk.kck, sm->ptk.kck_len,
1934 sm->key_mgmt,
1935 ver, buf, len, (u8 *) (key + 1)) < 0 ||
1936 os_memcmp_const(mic, key + 1, mic_len) != 0) {
f049052b
BG		 1937 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1938 "WPA: Invalid EAPOL-Key MIC - "
1939 "dropping packet");
525923b1
JM		 1940#ifdef TEST_FUZZ
1941 wpa_printf(MSG_INFO,
1942 "TEST: Ignore Key MIC failure for fuzz testing");
1943 goto continue_fuzz2;
1944#endif /* TEST_FUZZ */
6fc6879b
JM		 1945 return -1;
1946 }
525923b1
JM		 1947#ifdef TEST_FUZZ
1948 continue_fuzz2:
1949#endif /* TEST_FUZZ */
6fc6879b
JM		 1950 ok = 1;
1951 }
1952
1953 if (!ok) {
f049052b
BG		 1954 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1955 "WPA: Could not verify EAPOL-Key MIC - "
1956 "dropping packet");
6fc6879b
JM		 1957 return -1;
1958 }
1959
1960 os_memcpy(sm->rx_replay_counter, key->replay_counter,
1961 WPA_REPLAY_COUNTER_LEN);
1962 sm->rx_replay_counter_set = 1;
1963 return 0;
1964}
1965
1966
1967/* Decrypt RSN EAPOL-Key key data (RC4 or AES-WRAP) */
1968static int wpa_supplicant_decrypt_key_data(struct wpa_sm *sm,
6d014ffc
JM		 1969 struct wpa_eapol_key *key,
1970 size_t mic_len, u16 ver,
e6270129 1971 u8 *key_data, size_t *key_data_len)
6fc6879b 1972{
6fc6879b 1973 wpa_hexdump(MSG_DEBUG, "RSN: encrypted key data",
e6270129 1974 key_data, *key_data_len);
6fc6879b 1975 if (!sm->ptk_set) {
f049052b
BG		 1976 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1977 "WPA: PTK not available, cannot decrypt EAPOL-Key Key "
1978 "Data");
6fc6879b
JM		 1979 return -1;
1980 }
1981
1982 /* Decrypt key data here so that this operation does not need
1983 * to be implemented separately for each message type. */
98cd3d1c 1984 if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 && sm->ptk.kek_len == 16) {
7cb53ded
JM		 1985#ifdef CONFIG_NO_RC4
1986 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1987 "WPA: RC4 not supported in the build");
1988 return -1;
1989#else /* CONFIG_NO_RC4 */
6fc6879b 1990 u8 ek[32];
ef9627cb
JM		 1991
1992 wpa_printf(MSG_DEBUG, "WPA: Decrypt Key Data using RC4");
6fc6879b 1993 os_memcpy(ek, key->key_iv, 16);
98cd3d1c 1994 os_memcpy(ek + 16, sm->ptk.kek, sm->ptk.kek_len);
e6270129 1995 if (rc4_skip(ek, 32, 256, key_data, *key_data_len)) {
31bc66e4 1996 forced_memzero(ek, sizeof(ek));
f049052b
BG		 1997 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
1998 "WPA: RC4 failed");
7a215dfc
JM		 1999 return -1;
2000 }
31bc66e4 2001 forced_memzero(ek, sizeof(ek));
7cb53ded 2002#endif /* CONFIG_NO_RC4 */
6fc6879b 2003 } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES ||
df0f01d9 2004 ver == WPA_KEY_INFO_TYPE_AES_128_CMAC ||
4bc801ab 2005 wpa_use_aes_key_wrap(sm->key_mgmt)) {
6fc6879b 2006 u8 *buf;
ef9627cb
JM		 2007
2008 wpa_printf(MSG_DEBUG,
2009 "WPA: Decrypt Key Data using AES-UNWRAP (KEK length %u)",
2010 (unsigned int) sm->ptk.kek_len);
e6270129 2011 if (*key_data_len < 8 || *key_data_len % 8) {
f049052b 2012 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
e6270129
JM		 2013 "WPA: Unsupported AES-WRAP len %u",
2014 (unsigned int) *key_data_len);
6fc6879b
JM		 2015 return -1;
2016 }
e6270129
JM		 2017 *key_data_len -= 8; /* AES-WRAP adds 8 bytes */
2018 buf = os_malloc(*key_data_len);
6fc6879b 2019 if (buf == NULL) {
f049052b
BG		 2020 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2021 "WPA: No memory for AES-UNWRAP buffer");
6fc6879b
JM		 2022 return -1;
2023 }
525923b1
JM		 2024#ifdef TEST_FUZZ
2025 os_memset(buf, 0x11, *key_data_len);
2026#endif /* TEST_FUZZ */
98cd3d1c 2027 if (aes_unwrap(sm->ptk.kek, sm->ptk.kek_len, *key_data_len / 8,
e6270129 2028 key_data, buf)) {
525923b1
JM		 2029#ifdef TEST_FUZZ
2030 wpa_printf(MSG_INFO,
2031 "TEST: Ignore AES unwrap failure for fuzz testing");
2032 goto continue_fuzz;
2033#endif /* TEST_FUZZ */
cd5895e8 2034 bin_clear_free(buf, *key_data_len);
f049052b
BG		 2035 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2036 "WPA: AES unwrap failed - "
2037 "could not decrypt EAPOL-Key key data");
6fc6879b
JM		 2038 return -1;
2039 }
525923b1
JM		 2040#ifdef TEST_FUZZ
2041 continue_fuzz:
2042#endif /* TEST_FUZZ */
e6270129 2043 os_memcpy(key_data, buf, *key_data_len);
cd5895e8 2044 bin_clear_free(buf, *key_data_len);
6d014ffc 2045 WPA_PUT_BE16(((u8 *) (key + 1)) + mic_len, *key_data_len);
6fc6879b 2046 } else {
f049052b
BG		 2047 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2048 "WPA: Unsupported key_info type %d", ver);
6fc6879b
JM		 2049 return -1;
2050 }
2051 wpa_hexdump_key(MSG_DEBUG, "WPA: decrypted EAPOL-Key key data",
e6270129 2052 key_data, *key_data_len);
6fc6879b
JM		 2053 return 0;
2054}
2055
2056
2057/**
2058 * wpa_sm_aborted_cached - Notify WPA that PMKSA caching was aborted
2059 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2060 */
2061void wpa_sm_aborted_cached(struct wpa_sm *sm)
2062{
2063 if (sm && sm->cur_pmksa) {
f049052b
BG		 2064 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2065 "RSN: Cancelling PMKSA caching attempt");
6fc6879b
JM		 2066 sm->cur_pmksa = NULL;
2067 }
2068}
2069
2070
f049052b 2071static void wpa_eapol_key_dump(struct wpa_sm *sm,
5e3b5197
JM		 2072 const struct wpa_eapol_key *key,
2073 unsigned int key_data_len,
2074 const u8 *mic, unsigned int mic_len)
6fc6879b
JM		 2075{
2076#ifndef CONFIG_NO_STDOUT_DEBUG
2077 u16 key_info = WPA_GET_BE16(key->key_info);
2078
f049052b
BG		 2079 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, " EAPOL-Key type=%d", key->type);
2080 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2081 " key_info 0x%x (ver=%d keyidx=%d rsvd=%d %s%s%s%s%s%s%s%s)",
2082 key_info, key_info & WPA_KEY_INFO_TYPE_MASK,
2083 (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >>
2084 WPA_KEY_INFO_KEY_INDEX_SHIFT,
2085 (key_info & (BIT(13) | BIT(14) | BIT(15))) >> 13,
2086 key_info & WPA_KEY_INFO_KEY_TYPE ? "Pairwise" : "Group",
2087 key_info & WPA_KEY_INFO_INSTALL ? " Install" : "",
2088 key_info & WPA_KEY_INFO_ACK ? " Ack" : "",
2089 key_info & WPA_KEY_INFO_MIC ? " MIC" : "",
2090 key_info & WPA_KEY_INFO_SECURE ? " Secure" : "",
2091 key_info & WPA_KEY_INFO_ERROR ? " Error" : "",
2092 key_info & WPA_KEY_INFO_REQUEST ? " Request" : "",
2093 key_info & WPA_KEY_INFO_ENCR_KEY_DATA ? " Encr" : "");
2094 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2095 " key_length=%u key_data_length=%u",
5e3b5197 2096 WPA_GET_BE16(key->key_length), key_data_len);
6fc6879b
JM		 2097 wpa_hexdump(MSG_DEBUG, " replay_counter",
2098 key->replay_counter, WPA_REPLAY_COUNTER_LEN);
2099 wpa_hexdump(MSG_DEBUG, " key_nonce", key->key_nonce, WPA_NONCE_LEN);
2100 wpa_hexdump(MSG_DEBUG, " key_iv", key->key_iv, 16);
2101 wpa_hexdump(MSG_DEBUG, " key_rsc", key->key_rsc, 8);
2102 wpa_hexdump(MSG_DEBUG, " key_id (reserved)", key->key_id, 8);
5e3b5197 2103 wpa_hexdump(MSG_DEBUG, " key_mic", mic, mic_len);
6fc6879b
JM		 2104#endif /* CONFIG_NO_STDOUT_DEBUG */
2105}
2106
2107
0ab1dd01
JM		 2108#ifdef CONFIG_FILS
2109static int wpa_supp_aead_decrypt(struct wpa_sm *sm, u8 *buf, size_t buf_len,
2110 size_t *key_data_len)
2111{
2112 struct wpa_ptk *ptk;
2113 struct ieee802_1x_hdr *hdr;
2114 struct wpa_eapol_key *key;
2115 u8 *pos, *tmp;
2116 const u8 *aad[1];
2117 size_t aad_len[1];
2118
2119 if (*key_data_len < AES_BLOCK_SIZE) {
2120 wpa_printf(MSG_INFO, "No room for AES-SIV data in the frame");
2121 return -1;
2122 }
2123
2124 if (sm->tptk_set)
2125 ptk = &sm->tptk;
2126 else if (sm->ptk_set)
2127 ptk = &sm->ptk;
2128 else
2129 return -1;
2130
2131 hdr = (struct ieee802_1x_hdr *) buf;
2132 key = (struct wpa_eapol_key *) (hdr + 1);
2133 pos = (u8 *) (key + 1);
2134 pos += 2; /* Pointing at the Encrypted Key Data field */
2135
2136 tmp = os_malloc(*key_data_len);
2137 if (!tmp)
2138 return -1;
2139
2140 /* AES-SIV AAD from EAPOL protocol version field (inclusive) to
2141 * to Key Data (exclusive). */
2142 aad[0] = buf;
2143 aad_len[0] = pos - buf;
2144 if (aes_siv_decrypt(ptk->kek, ptk->kek_len, pos, *key_data_len,
2145 1, aad, aad_len, tmp) < 0) {
2146 wpa_printf(MSG_INFO, "Invalid AES-SIV data in the frame");
2147 bin_clear_free(tmp, *key_data_len);
2148 return -1;
2149 }
2150
2151 /* AEAD decryption and validation completed successfully */
2152 (*key_data_len) -= AES_BLOCK_SIZE;
2153 wpa_hexdump_key(MSG_DEBUG, "WPA: Decrypted Key Data",
2154 tmp, *key_data_len);
2155
2156 /* Replace Key Data field with the decrypted version */
2157 os_memcpy(pos, tmp, *key_data_len);
2158 pos -= 2; /* Key Data Length field */
2159 WPA_PUT_BE16(pos, *key_data_len);
2160 bin_clear_free(tmp, *key_data_len);
2161
2162 if (sm->tptk_set) {
2163 sm->tptk_set = 0;
2164 sm->ptk_set = 1;
2165 os_memcpy(&sm->ptk, &sm->tptk, sizeof(sm->ptk));
2166 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
2167 }
2168
2169 os_memcpy(sm->rx_replay_counter, key->replay_counter,
2170 WPA_REPLAY_COUNTER_LEN);
2171 sm->rx_replay_counter_set = 1;
2172
2173 return 0;
2174}
2175#endif /* CONFIG_FILS */
2176
2177
6fc6879b
JM		 2178/**
2179 * wpa_sm_rx_eapol - Process received WPA EAPOL frames
2180 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2181 * @src_addr: Source MAC address of the EAPOL packet
2182 * @buf: Pointer to the beginning of the EAPOL data (EAPOL header)
2183 * @len: Length of the EAPOL frame
2184 * Returns: 1 = WPA EAPOL-Key processed, 0 = not a WPA EAPOL-Key, -1 failure
2185 *
2186 * This function is called for each received EAPOL frame. Other than EAPOL-Key
2187 * frames can be skipped if filtering is done elsewhere. wpa_sm_rx_eapol() is
2188 * only processing WPA and WPA2 EAPOL-Key frames.
2189 *
2190 * The received EAPOL-Key packets are validated and valid packets are replied
2191 * to. In addition, key material (PTK, GTK) is configured at the end of a
2192 * successful key handshake.
2193 */
2194int wpa_sm_rx_eapol(struct wpa_sm *sm, const u8 *src_addr,
2195 const u8 *buf, size_t len)
2196{
e6270129 2197 size_t plen, data_len, key_data_len;
d56d7e56 2198 const struct ieee802_1x_hdr *hdr;
6fc6879b
JM		 2199 struct wpa_eapol_key *key;
2200 u16 key_info, ver;
d56d7e56 2201 u8 *tmp = NULL;
6fc6879b 2202 int ret = -1;
6d014ffc 2203 u8 *mic, *key_data;
5e3b5197 2204 size_t mic_len, keyhdrlen;
6fc6879b
JM		 2205
2206#ifdef CONFIG_IEEE80211R
2207 sm->ft_completed = 0;
2208#endif /* CONFIG_IEEE80211R */
2209
567da5bb 2210 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
6d014ffc 2211 keyhdrlen = sizeof(*key) + mic_len + 2;
5e3b5197
JM		 2212
2213 if (len < sizeof(*hdr) + keyhdrlen) {
f049052b
BG		 2214 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2215 "WPA: EAPOL frame too short to be a WPA "
2216 "EAPOL-Key (len %lu, expecting at least %lu)",
2217 (unsigned long) len,
5e3b5197 2218 (unsigned long) sizeof(*hdr) + keyhdrlen);
6fc6879b
JM		 2219 return 0;
2220 }
2221
d56d7e56 2222 hdr = (const struct ieee802_1x_hdr *) buf;
6fc6879b
JM		 2223 plen = be_to_host16(hdr->length);
2224 data_len = plen + sizeof(*hdr);
f049052b
BG		 2225 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2226 "IEEE 802.1X RX: version=%d type=%d length=%lu",
2227 hdr->version, hdr->type, (unsigned long) plen);
6fc6879b
JM		 2228
2229 if (hdr->version < EAPOL_VERSION) {
2230 /* TODO: backwards compatibility */
2231 }
2232 if (hdr->type != IEEE802_1X_TYPE_EAPOL_KEY) {
f049052b
BG		 2233 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2234 "WPA: EAPOL frame (type %u) discarded, "
6fc6879b
JM		 2235 "not a Key frame", hdr->type);
2236 ret = 0;
2237 goto out;
2238 }
d56d7e56 2239 wpa_hexdump(MSG_MSGDUMP, "WPA: RX EAPOL-Key", buf, len);
5e3b5197 2240 if (plen > len - sizeof(*hdr) || plen < keyhdrlen) {
f049052b
BG		 2241 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2242 "WPA: EAPOL frame payload size %lu "
2243 "invalid (frame size %lu)",
2244 (unsigned long) plen, (unsigned long) len);
6fc6879b
JM		 2245 ret = 0;
2246 goto out;
2247 }
d56d7e56
JM		 2248 if (data_len < len) {
2249 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2250 "WPA: ignoring %lu bytes after the IEEE 802.1X data",
2251 (unsigned long) len - data_len);
2252 }
2253
2254 /*
2255 * Make a copy of the frame since we need to modify the buffer during
2256 * MAC validation and Key Data decryption.
2257 */
a1f11e34 2258 tmp = os_memdup(buf, data_len);
d56d7e56
JM		 2259 if (tmp == NULL)
2260 goto out;
d56d7e56 2261 key = (struct wpa_eapol_key *) (tmp + sizeof(struct ieee802_1x_hdr));
6d014ffc
JM		 2262 mic = (u8 *) (key + 1);
2263 key_data = mic + mic_len + 2;
6fc6879b
JM		 2264
2265 if (key->type != EAPOL_KEY_TYPE_WPA && key->type != EAPOL_KEY_TYPE_RSN)
2266 {
f049052b
BG		 2267 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2268 "WPA: EAPOL-Key type (%d) unknown, discarded",
2269 key->type);
6fc6879b
JM		 2270 ret = 0;
2271 goto out;
2272 }
6fc6879b 2273
6d014ffc
JM		 2274 key_data_len = WPA_GET_BE16(mic + mic_len);
2275 wpa_eapol_key_dump(sm, key, key_data_len, mic, mic_len);
5e3b5197
JM		 2276
2277 if (key_data_len > plen - keyhdrlen) {
d56d7e56
JM		 2278 wpa_msg(sm->ctx->msg_ctx, MSG_INFO, "WPA: Invalid EAPOL-Key "
2279 "frame - key_data overflow (%u > %u)",
e6270129 2280 (unsigned int) key_data_len,
5e3b5197 2281 (unsigned int) (plen - keyhdrlen));
d56d7e56 2282 goto out;
6fc6879b 2283 }
d56d7e56
JM		 2284
2285 eapol_sm_notify_lower_layer_success(sm->eapol, 0);
6fc6879b
JM		 2286 key_info = WPA_GET_BE16(key->key_info);
2287 ver = key_info & WPA_KEY_INFO_TYPE_MASK;
2288 if (ver != WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 &&
6fc6879b 2289 ver != WPA_KEY_INFO_TYPE_AES_128_CMAC &&
df0f01d9 2290 ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES &&
4bc801ab 2291 !wpa_use_akm_defined(sm->key_mgmt)) {
f049052b
BG		 2292 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2293 "WPA: Unsupported EAPOL-Key descriptor version %d",
2294 ver);
6fc6879b
JM		 2295 goto out;
2296 }
2297
4bc801ab 2298 if (wpa_use_akm_defined(sm->key_mgmt) &&
929a2ea5
JM		 2299 ver != WPA_KEY_INFO_TYPE_AKM_DEFINED) {
2300 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2301 "RSN: Unsupported EAPOL-Key descriptor version %d (expected AKM defined = 0)",
2302 ver);
2303 goto out;
2304 }
2305
6fc6879b 2306#ifdef CONFIG_IEEE80211R
56586197 2307 if (wpa_key_mgmt_ft(sm->key_mgmt)) {
6fc6879b 2308 /* IEEE 802.11r uses a new key_info type (AES-128-CMAC). */
4bc801ab
JM		 2309 if (ver != WPA_KEY_INFO_TYPE_AES_128_CMAC &&
2310 !wpa_use_akm_defined(sm->key_mgmt)) {
f049052b
BG		 2311 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2312 "FT: AP did not use AES-128-CMAC");
6fc6879b
JM		 2313 goto out;
2314 }
2315 } else
2316#endif /* CONFIG_IEEE80211R */
56586197 2317 if (wpa_key_mgmt_sha256(sm->key_mgmt)) {
df0f01d9 2318 if (ver != WPA_KEY_INFO_TYPE_AES_128_CMAC &&
4bc801ab 2319 !wpa_use_akm_defined(sm->key_mgmt)) {
f049052b
BG		 2320 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2321 "WPA: AP did not use the "
2322 "negotiated AES-128-CMAC");
56586197
JM		 2323 goto out;
2324 }
7d2ed8ba
JM		 2325 } else if (sm->pairwise_cipher == WPA_CIPHER_CCMP &&
2326 !wpa_use_akm_defined(sm->key_mgmt) &&
2327 ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
f049052b
BG		 2328 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2329 "WPA: CCMP is used, but EAPOL-Key "
2330 "descriptor version (%d) is not 2", ver);
6fc6879b
JM		 2331 if (sm->group_cipher != WPA_CIPHER_CCMP &&
2332 !(key_info & WPA_KEY_INFO_KEY_TYPE)) {
2333 /* Earlier versions of IEEE 802.11i did not explicitly
2334 * require version 2 descriptor for all EAPOL-Key
2335 * packets, so allow group keys to use version 1 if
2336 * CCMP is not used for them. */
f049052b
BG		 2337 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2338 "WPA: Backwards compatibility: allow invalid "
2339 "version for non-CCMP group keys");
9f6a7cdd
JM		 2340 } else if (ver == WPA_KEY_INFO_TYPE_AES_128_CMAC) {
2341 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2342 "WPA: Interoperability workaround: allow incorrect (should have been HMAC-SHA1), but stronger (is AES-128-CMAC), descriptor version to be used");
6fc6879b
JM		 2343 } else
2344 goto out;
801e1173 2345 } else if (sm->pairwise_cipher == WPA_CIPHER_GCMP &&
4bc801ab 2346 !wpa_use_akm_defined(sm->key_mgmt) &&
801e1173 2347 ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
eb7719ff
JM		 2348 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2349 "WPA: GCMP is used, but EAPOL-Key "
2350 "descriptor version (%d) is not 2", ver);
2351 goto out;
2352 }
6fc6879b 2353
a0bf1b68 2354 if (sm->rx_replay_counter_set &&
6fc6879b
JM		 2355 os_memcmp(key->replay_counter, sm->rx_replay_counter,
2356 WPA_REPLAY_COUNTER_LEN) <= 0) {
f049052b
BG		 2357 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2358 "WPA: EAPOL-Key Replay Counter did not increase - "
2359 "dropping packet");
6fc6879b
JM		 2360 goto out;
2361 }
2362
a0bf1b68
JM		 2363 if (key_info & WPA_KEY_INFO_SMK_MESSAGE) {
2364 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2365 "WPA: Unsupported SMK bit in key_info");
2366 goto out;
2367 }
2368
2369 if (!(key_info & WPA_KEY_INFO_ACK)) {
f049052b
BG		 2370 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2371 "WPA: No Ack bit in key_info");
6fc6879b
JM		 2372 goto out;
2373 }
2374
2375 if (key_info & WPA_KEY_INFO_REQUEST) {
f049052b
BG		 2376 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2377 "WPA: EAPOL-Key with Request bit - dropped");
6fc6879b
JM		 2378 goto out;
2379 }
2380
a0bf1b68 2381 if ((key_info & WPA_KEY_INFO_MIC) &&
6d014ffc 2382 wpa_supplicant_verify_eapol_key_mic(sm, key, ver, tmp, data_len))
6fc6879b
JM		 2383 goto out;
2384
0ab1dd01
JM		 2385#ifdef CONFIG_FILS
2386 if (!mic_len && (key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
2387 if (wpa_supp_aead_decrypt(sm, tmp, data_len, &key_data_len))
2388 goto out;
2389 }
2390#endif /* CONFIG_FILS */
2391
a14896e8 2392 if ((sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) &&
0ab1dd01 2393 (key_info & WPA_KEY_INFO_ENCR_KEY_DATA) && mic_len) {
3e34cfdf
MV		 2394 /*
2395 * Only decrypt the Key Data field if the frame's authenticity
2396 * was verified. When using AES-SIV (FILS), the MIC flag is not
2397 * set, so this check should only be performed if mic_len != 0
2398 * which is the case in this code branch.
2399 */
2400 if (!(key_info & WPA_KEY_INFO_MIC)) {
2401 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2402 "WPA: Ignore EAPOL-Key with encrypted but unauthenticated data");
2403 goto out;
2404 }
6d014ffc
JM		 2405 if (wpa_supplicant_decrypt_key_data(sm, key, mic_len,
2406 ver, key_data,
e6270129 2407 &key_data_len))
d56d7e56 2408 goto out;
6fc6879b
JM		 2409 }
2410
2411 if (key_info & WPA_KEY_INFO_KEY_TYPE) {
2412 if (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) {
f049052b
BG		 2413 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2414 "WPA: Ignored EAPOL-Key (Pairwise) with "
2415 "non-zero key index");
6fc6879b
JM		 2416 goto out;
2417 }
a0bf1b68
JM		 2418 if (key_info & (WPA_KEY_INFO_MIC |
2419 WPA_KEY_INFO_ENCR_KEY_DATA)) {
6fc6879b 2420 /* 3/4 4-Way Handshake */
e6270129
JM		 2421 wpa_supplicant_process_3_of_4(sm, key, ver, key_data,
2422 key_data_len);
6fc6879b
JM		 2423 } else {
2424 /* 1/4 4-Way Handshake */
2425 wpa_supplicant_process_1_of_4(sm, src_addr, key,
e6270129
JM		 2426 ver, key_data,
2427 key_data_len);
6fc6879b 2428 }
6fc6879b 2429 } else {
16eb4858
JM		 2430 if ((mic_len && (key_info & WPA_KEY_INFO_MIC)) ||
2431 (!mic_len && (key_info & WPA_KEY_INFO_ENCR_KEY_DATA))) {
6fc6879b
JM		 2432 /* 1/2 Group Key Handshake */
2433 wpa_supplicant_process_1_of_2(sm, src_addr, key,
e6270129
JM		 2434 key_data, key_data_len,
2435 ver);
6fc6879b 2436 } else {
f049052b 2437 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
16eb4858 2438 "WPA: EAPOL-Key (Group) without Mic/Encr bit - "
f049052b 2439 "dropped");
6fc6879b
JM		 2440 }
2441 }
2442
2443 ret = 1;
2444
2445out:
fbfc974c 2446 bin_clear_free(tmp, data_len);
6fc6879b
JM		 2447 return ret;
2448}
2449
2450
2451#ifdef CONFIG_CTRL_IFACE
6fc6879b
JM		 2452static u32 wpa_key_mgmt_suite(struct wpa_sm *sm)
2453{
2454 switch (sm->key_mgmt) {
2455 case WPA_KEY_MGMT_IEEE8021X:
a14896e8
JM		 2456 return ((sm->proto == WPA_PROTO_RSN ||
2457 sm->proto == WPA_PROTO_OSEN) ?
6fc6879b
JM		 2458 RSN_AUTH_KEY_MGMT_UNSPEC_802_1X :
2459 WPA_AUTH_KEY_MGMT_UNSPEC_802_1X);
2460 case WPA_KEY_MGMT_PSK:
2461 return (sm->proto == WPA_PROTO_RSN ?
2462 RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X :
2463 WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X);
2464#ifdef CONFIG_IEEE80211R
2465 case WPA_KEY_MGMT_FT_IEEE8021X:
2466 return RSN_AUTH_KEY_MGMT_FT_802_1X;
2467 case WPA_KEY_MGMT_FT_PSK:
2468 return RSN_AUTH_KEY_MGMT_FT_PSK;
2469#endif /* CONFIG_IEEE80211R */
56586197
JM		 2470 case WPA_KEY_MGMT_IEEE8021X_SHA256:
2471 return RSN_AUTH_KEY_MGMT_802_1X_SHA256;
2472 case WPA_KEY_MGMT_PSK_SHA256:
2473 return RSN_AUTH_KEY_MGMT_PSK_SHA256;
369c8d7b
JM		 2474 case WPA_KEY_MGMT_CCKM:
2475 return (sm->proto == WPA_PROTO_RSN ?
2476 RSN_AUTH_KEY_MGMT_CCKM:
2477 WPA_AUTH_KEY_MGMT_CCKM);
6fc6879b
JM		 2478 case WPA_KEY_MGMT_WPA_NONE:
2479 return WPA_AUTH_KEY_MGMT_NONE;
666497c8
JM		 2480 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
2481 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B;
5e3b5197
JM		 2482 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
2483 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192;
6fc6879b
JM		 2484 default:
2485 return 0;
2486 }
2487}
2488
2489
6fc6879b
JM		 2490#define RSN_SUITE "%02x-%02x-%02x-%d"
2491#define RSN_SUITE_ARG(s) \
2492((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff
2493
2494/**
2495 * wpa_sm_get_mib - Dump text list of MIB entries
2496 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2497 * @buf: Buffer for the list
2498 * @buflen: Length of the buffer
2499 * Returns: Number of bytes written to buffer
2500 *
2501 * This function is used fetch dot11 MIB variables.
2502 */
2503int wpa_sm_get_mib(struct wpa_sm *sm, char *buf, size_t buflen)
2504{
2505 char pmkid_txt[PMKID_LEN * 2 + 1];
2506 int rsna, ret;
2507 size_t len;
2508
2509 if (sm->cur_pmksa) {
2510 wpa_snprintf_hex(pmkid_txt, sizeof(pmkid_txt),
2511 sm->cur_pmksa->pmkid, PMKID_LEN);
2512 } else
2513 pmkid_txt[0] = '\0';
2514
56586197
JM		 2515 if ((wpa_key_mgmt_wpa_psk(sm->key_mgmt) ||
2516 wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt)) &&
6fc6879b
JM		 2517 sm->proto == WPA_PROTO_RSN)
2518 rsna = 1;
2519 else
2520 rsna = 0;
2521
2522 ret = os_snprintf(buf, buflen,
2523 "dot11RSNAOptionImplemented=TRUE\n"
2524 "dot11RSNAPreauthenticationImplemented=TRUE\n"
2525 "dot11RSNAEnabled=%s\n"
2526 "dot11RSNAPreauthenticationEnabled=%s\n"
2527 "dot11RSNAConfigVersion=%d\n"
2528 "dot11RSNAConfigPairwiseKeysSupported=5\n"
2529 "dot11RSNAConfigGroupCipherSize=%d\n"
2530 "dot11RSNAConfigPMKLifetime=%d\n"
2531 "dot11RSNAConfigPMKReauthThreshold=%d\n"
2532 "dot11RSNAConfigNumberOfPTKSAReplayCounters=1\n"
2533 "dot11RSNAConfigSATimeout=%d\n",
2534 rsna ? "TRUE" : "FALSE",
2535 rsna ? "TRUE" : "FALSE",
2536 RSN_VERSION,
c3550295 2537 wpa_cipher_key_len(sm->group_cipher) * 8,
6fc6879b
JM		 2538 sm->dot11RSNAConfigPMKLifetime,
2539 sm->dot11RSNAConfigPMKReauthThreshold,
2540 sm->dot11RSNAConfigSATimeout);
d85e1fc8 2541 if (os_snprintf_error(buflen, ret))
6fc6879b
JM		 2542 return 0;
2543 len = ret;
2544
2545 ret = os_snprintf(
2546 buf + len, buflen - len,
2547 "dot11RSNAAuthenticationSuiteSelected=" RSN_SUITE "\n"
2548 "dot11RSNAPairwiseCipherSelected=" RSN_SUITE "\n"
2549 "dot11RSNAGroupCipherSelected=" RSN_SUITE "\n"
2550 "dot11RSNAPMKIDUsed=%s\n"
2551 "dot11RSNAAuthenticationSuiteRequested=" RSN_SUITE "\n"
2552 "dot11RSNAPairwiseCipherRequested=" RSN_SUITE "\n"
2553 "dot11RSNAGroupCipherRequested=" RSN_SUITE "\n"
2554 "dot11RSNAConfigNumberOfGTKSAReplayCounters=0\n"
2555 "dot11RSNA4WayHandshakeFailures=%u\n",
2556 RSN_SUITE_ARG(wpa_key_mgmt_suite(sm)),
c3550295
JM		 2557 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
2558 sm->pairwise_cipher)),
2559 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
2560 sm->group_cipher)),
6fc6879b
JM		 2561 pmkid_txt,
2562 RSN_SUITE_ARG(wpa_key_mgmt_suite(sm)),
c3550295
JM		 2563 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
2564 sm->pairwise_cipher)),
2565 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
2566 sm->group_cipher)),
6fc6879b 2567 sm->dot11RSNA4WayHandshakeFailures);
1f102d3b 2568 if (!os_snprintf_error(buflen - len, ret))
6fc6879b
JM		 2569 len += ret;
2570
2571 return (int) len;
2572}
2573#endif /* CONFIG_CTRL_IFACE */
2574
2575
2576static void wpa_sm_pmksa_free_cb(struct rsn_pmksa_cache_entry *entry,
6aaac006 2577 void *ctx, enum pmksa_free_reason reason)
6fc6879b
JM		 2578{
2579 struct wpa_sm *sm = ctx;
6aaac006 2580 int deauth = 0;
6fc6879b 2581
6aaac006
DW		 2582 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "RSN: PMKSA cache entry free_cb: "
2583 MACSTR " reason=%d", MAC2STR(entry->aa), reason);
2584
2585 if (sm->cur_pmksa == entry) {
2586 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2587 "RSN: %s current PMKSA entry",
2588 reason == PMKSA_REPLACE ? "replaced" : "removed");
2589 pmksa_cache_clear_current(sm);
2590
2591 /*
2592 * If an entry is simply being replaced, there's no need to
2593 * deauthenticate because it will be immediately re-added.
2594 * This happens when EAP authentication is completed again
2595 * (reauth or failed PMKSA caching attempt).
2596 */
2597 if (reason != PMKSA_REPLACE)
2598 deauth = 1;
2599 }
2600
2601 if (reason == PMKSA_EXPIRE &&
6fc6879b
JM		 2602 (sm->pmk_len == entry->pmk_len &&
2603 os_memcmp(sm->pmk, entry->pmk, sm->pmk_len) == 0)) {
f049052b 2604 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
6aaac006
DW		 2605 "RSN: deauthenticating due to expired PMK");
2606 pmksa_cache_clear_current(sm);
2607 deauth = 1;
2608 }
6fc6879b 2609
6aaac006 2610 if (deauth) {
1bd13110 2611 sm->pmk_len = 0;
6fc6879b
JM		 2612 os_memset(sm->pmk, 0, sizeof(sm->pmk));
2613 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
6fc6879b
JM		 2614 }
2615}
2616
2617
2618/**
2619 * wpa_sm_init - Initialize WPA state machine
2620 * @ctx: Context pointer for callbacks; this needs to be an allocated buffer
2621 * Returns: Pointer to the allocated WPA state machine data
2622 *
2623 * This function is used to allocate a new WPA state machine and the returned
2624 * value is passed to all WPA state machine calls.
2625 */
2626struct wpa_sm * wpa_sm_init(struct wpa_sm_ctx *ctx)
2627{
2628 struct wpa_sm *sm;
2629
2630 sm = os_zalloc(sizeof(*sm));
2631 if (sm == NULL)
2632 return NULL;
c5b26e33 2633 dl_list_init(&sm->pmksa_candidates);
6fc6879b
JM		 2634 sm->renew_snonce = 1;
2635 sm->ctx = ctx;
2636
2637 sm->dot11RSNAConfigPMKLifetime = 43200;
2638 sm->dot11RSNAConfigPMKReauthThreshold = 70;
2639 sm->dot11RSNAConfigSATimeout = 60;
2640
2641 sm->pmksa = pmksa_cache_init(wpa_sm_pmksa_free_cb, sm, sm);
2642 if (sm->pmksa == NULL) {
f049052b
BG		 2643 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
2644 "RSN: PMKSA cache initialization failed");
6fc6879b
JM		 2645 os_free(sm);
2646 return NULL;
2647 }
2648
2649 return sm;
2650}
2651
2652
2653/**
2654 * wpa_sm_deinit - Deinitialize WPA state machine
2655 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2656 */
2657void wpa_sm_deinit(struct wpa_sm *sm)
2658{
2659 if (sm == NULL)
2660 return;
2661 pmksa_cache_deinit(sm->pmksa);
2662 eloop_cancel_timeout(wpa_sm_start_preauth, sm, NULL);
581a8cde 2663 eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
6fc6879b
JM		 2664 os_free(sm->assoc_wpa_ie);
2665 os_free(sm->ap_wpa_ie);
2666 os_free(sm->ap_rsn_ie);
71932544 2667 wpa_sm_drop_sa(sm);
6fc6879b 2668 os_free(sm->ctx);
55046414
JM		 2669#ifdef CONFIG_IEEE80211R
2670 os_free(sm->assoc_resp_ies);
2671#endif /* CONFIG_IEEE80211R */
651c6a84
JM		 2672#ifdef CONFIG_TESTING_OPTIONS
2673 wpabuf_free(sm->test_assoc_ie);
2674#endif /* CONFIG_TESTING_OPTIONS */
0119d442 2675#ifdef CONFIG_FILS_SK_PFS
76e20f4f 2676 crypto_ecdh_deinit(sm->fils_ecdh);
0119d442 2677#endif /* CONFIG_FILS_SK_PFS */
7d440a3b
JM		 2678#ifdef CONFIG_FILS
2679 wpabuf_free(sm->fils_ft_ies);
2680#endif /* CONFIG_FILS */
0a614799
JM		 2681#ifdef CONFIG_OWE
2682 crypto_ecdh_deinit(sm->owe_ecdh);
2683#endif /* CONFIG_OWE */
10ec6a5f
JM		 2684#ifdef CONFIG_DPP2
2685 wpabuf_clear_free(sm->dpp_z);
2686#endif /* CONFIG_DPP2 */
6fc6879b
JM		 2687 os_free(sm);
2688}
2689
2690
2691/**
2692 * wpa_sm_notify_assoc - Notify WPA state machine about association
2693 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2694 * @bssid: The BSSID of the new association
2695 *
2696 * This function is called to let WPA state machine know that the connection
2697 * was established.
2698 */
2699void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
2700{
cb5132bb 2701 int clear_keys = 1;
58a98fb0 2702
6fc6879b
JM		 2703 if (sm == NULL)
2704 return;
2705
f049052b
BG		 2706 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2707 "WPA: Association event - clear replay counter");
6fc6879b
JM		 2708 os_memcpy(sm->bssid, bssid, ETH_ALEN);
2709 os_memset(sm->rx_replay_counter, 0, WPA_REPLAY_COUNTER_LEN);
2710 sm->rx_replay_counter_set = 0;
2711 sm->renew_snonce = 1;
2712 if (os_memcmp(sm->preauth_bssid, bssid, ETH_ALEN) == 0)
2713 rsn_preauth_deinit(sm);
2714
2715#ifdef CONFIG_IEEE80211R
58a98fb0 2716 if (wpa_ft_is_completed(sm)) {
5d5a9f00
JM		 2717 /*
2718 * Clear portValid to kick EAPOL state machine to re-enter
2719 * AUTHENTICATED state to get the EAPOL port Authorized.
2720 */
2721 eapol_sm_notify_portValid(sm->eapol, FALSE);
6fc6879b
JM		 2722 wpa_supplicant_key_neg_complete(sm, sm->bssid, 1);
2723
2724 /* Prepare for the next transition */
76b7981d 2725 wpa_ft_prepare_auth_request(sm, NULL);
58a98fb0 2726
cb5132bb 2727 clear_keys = 0;
0a1a82db
JM		 2728 sm->ft_protocol = 1;
2729 } else {
2730 sm->ft_protocol = 0;
6fc6879b
JM		 2731 }
2732#endif /* CONFIG_IEEE80211R */
706df429
JM		 2733#ifdef CONFIG_FILS
2734 if (sm->fils_completed) {
2735 /*
2736 * Clear portValid to kick EAPOL state machine to re-enter
2737 * AUTHENTICATED state to get the EAPOL port Authorized.
2738 */
2739 wpa_supplicant_key_neg_complete(sm, sm->bssid, 1);
cb5132bb 2740 clear_keys = 0;
706df429
JM		 2741 }
2742#endif /* CONFIG_FILS */
58a98fb0 2743
cb5132bb 2744 if (clear_keys) {
58a98fb0
JM		 2745 /*
2746 * IEEE 802.11, 8.4.10: Delete PTK SA on (re)association if
2747 * this is not part of a Fast BSS Transition.
2748 */
f049052b 2749 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Clear old PTK");
58a98fb0 2750 sm->ptk_set = 0;
d2c33b91 2751 os_memset(&sm->ptk, 0, sizeof(sm->ptk));
58a98fb0 2752 sm->tptk_set = 0;
d2c33b91 2753 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
cb5132bb 2754 os_memset(&sm->gtk, 0, sizeof(sm->gtk));
87e2db16 2755 os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
cb5132bb 2756 os_memset(&sm->igtk, 0, sizeof(sm->igtk));
87e2db16 2757 os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
58a98fb0 2758 }
40cf22e6
JM		 2759
2760#ifdef CONFIG_TDLS
2761 wpa_tdls_assoc(sm);
2762#endif /* CONFIG_TDLS */
25ef8529
JM		 2763
2764#ifdef CONFIG_P2P
2765 os_memset(sm->p2p_ip_addr, 0, sizeof(sm->p2p_ip_addr));
2766#endif /* CONFIG_P2P */
6fc6879b
JM		 2767}
2768
2769
2770/**
2771 * wpa_sm_notify_disassoc - Notify WPA state machine about disassociation
2772 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2773 *
2774 * This function is called to let WPA state machine know that the connection
2775 * was lost. This will abort any existing pre-authentication session.
2776 */
2777void wpa_sm_notify_disassoc(struct wpa_sm *sm)
2778{
ac8e074e
JM		 2779 eloop_cancel_timeout(wpa_sm_start_preauth, sm, NULL);
2780 eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
6fc6879b 2781 rsn_preauth_deinit(sm);
0639970d 2782 pmksa_cache_clear_current(sm);
6fc6879b
JM		 2783 if (wpa_sm_get_state(sm) == WPA_4WAY_HANDSHAKE)
2784 sm->dot11RSNA4WayHandshakeFailures++;
40cf22e6
JM		 2785#ifdef CONFIG_TDLS
2786 wpa_tdls_disassoc(sm);
2787#endif /* CONFIG_TDLS */
706df429
JM		 2788#ifdef CONFIG_FILS
2789 sm->fils_completed = 0;
2790#endif /* CONFIG_FILS */
2a9c5217
JM		 2791#ifdef CONFIG_IEEE80211R
2792 sm->ft_reassoc_completed = 0;
0a1a82db 2793 sm->ft_protocol = 0;
2a9c5217 2794#endif /* CONFIG_IEEE80211R */
71932544
JM		 2795
2796 /* Keys are not needed in the WPA state machine anymore */
2797 wpa_sm_drop_sa(sm);
761396e4
JM		 2798
2799 sm->msg_3_of_4_ok = 0;
c0fe5f12 2800 os_memset(sm->bssid, 0, ETH_ALEN);
6fc6879b
JM		 2801}
2802
2803
2804/**
2805 * wpa_sm_set_pmk - Set PMK
2806 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2807 * @pmk: The new PMK
2808 * @pmk_len: The length of the new PMK in bytes
70c93963 2809 * @pmkid: Calculated PMKID
bc26ac50 2810 * @bssid: AA to add into PMKSA cache or %NULL to not cache the PMK
6fc6879b
JM		 2811 *
2812 * Configure the PMK for WPA state machine.
2813 */
bc26ac50 2814void wpa_sm_set_pmk(struct wpa_sm *sm, const u8 *pmk, size_t pmk_len,
70c93963 2815 const u8 *pmkid, const u8 *bssid)
6fc6879b
JM		 2816{
2817 if (sm == NULL)
2818 return;
2819
00583ef1
JM		 2820 wpa_hexdump_key(MSG_DEBUG, "WPA: Set PMK based on external data",
2821 pmk, pmk_len);
6fc6879b
JM		 2822 sm->pmk_len = pmk_len;
2823 os_memcpy(sm->pmk, pmk, pmk_len);
2824
2825#ifdef CONFIG_IEEE80211R
2826 /* Set XXKey to be PSK for FT key derivation */
2827 sm->xxkey_len = pmk_len;
2828 os_memcpy(sm->xxkey, pmk, pmk_len);
2829#endif /* CONFIG_IEEE80211R */
bc26ac50
JM		 2830
2831 if (bssid) {
70c93963 2832 pmksa_cache_add(sm->pmksa, pmk, pmk_len, pmkid, NULL, 0,
087a1f4e 2833 bssid, sm->own_addr,
869af307 2834 sm->network_ctx, sm->key_mgmt, NULL);
bc26ac50 2835 }
6fc6879b
JM		 2836}
2837
2838
2839/**
2840 * wpa_sm_set_pmk_from_pmksa - Set PMK based on the current PMKSA
2841 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2842 *
2843 * Take the PMK from the current PMKSA into use. If no PMKSA is active, the PMK
2844 * will be cleared.
2845 */
2846void wpa_sm_set_pmk_from_pmksa(struct wpa_sm *sm)
2847{
2848 if (sm == NULL)
2849 return;
2850
2851 if (sm->cur_pmksa) {
00583ef1
JM		 2852 wpa_hexdump_key(MSG_DEBUG,
2853 "WPA: Set PMK based on current PMKSA",
2854 sm->cur_pmksa->pmk, sm->cur_pmksa->pmk_len);
6fc6879b
JM		 2855 sm->pmk_len = sm->cur_pmksa->pmk_len;
2856 os_memcpy(sm->pmk, sm->cur_pmksa->pmk, sm->pmk_len);
2857 } else {
00583ef1 2858 wpa_printf(MSG_DEBUG, "WPA: No current PMKSA - clear PMK");
b488a129
JM		 2859 sm->pmk_len = 0;
2860 os_memset(sm->pmk, 0, PMK_LEN_MAX);
6fc6879b
JM		 2861 }
2862}
2863
2864
2865/**
2866 * wpa_sm_set_fast_reauth - Set fast reauthentication (EAP) enabled/disabled
2867 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2868 * @fast_reauth: Whether fast reauthentication (EAP) is allowed
2869 */
2870void wpa_sm_set_fast_reauth(struct wpa_sm *sm, int fast_reauth)
2871{
2872 if (sm)
2873 sm->fast_reauth = fast_reauth;
2874}
2875
2876
2877/**
2878 * wpa_sm_set_scard_ctx - Set context pointer for smartcard callbacks
2879 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2880 * @scard_ctx: Context pointer for smartcard related callback functions
2881 */
2882void wpa_sm_set_scard_ctx(struct wpa_sm *sm, void *scard_ctx)
2883{
2884 if (sm == NULL)
2885 return;
2886 sm->scard_ctx = scard_ctx;
2887 if (sm->preauth_eapol)
2888 eapol_sm_register_scard_ctx(sm->preauth_eapol, scard_ctx);
2889}
2890
2891
2892/**
2893 * wpa_sm_set_config - Notification of current configration change
2894 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2895 * @config: Pointer to current network configuration
2896 *
2897 * Notify WPA state machine that configuration has changed. config will be
2898 * stored as a backpointer to network configuration. This can be %NULL to clear
2899 * the stored pointed.
2900 */
2901void wpa_sm_set_config(struct wpa_sm *sm, struct rsn_supp_config *config)
2902{
2903 if (!sm)
2904 return;
2905
6fc6879b 2906 if (config) {
886a807f 2907 sm->network_ctx = config->network_ctx;
6fc6879b
JM		 2908 sm->allowed_pairwise_cipher = config->allowed_pairwise_cipher;
2909 sm->proactive_key_caching = config->proactive_key_caching;
2910 sm->eap_workaround = config->eap_workaround;
2911 sm->eap_conf_ctx = config->eap_conf_ctx;
2912 if (config->ssid) {
2913 os_memcpy(sm->ssid, config->ssid, config->ssid_len);
2914 sm->ssid_len = config->ssid_len;
2915 } else
2916 sm->ssid_len = 0;
581a8cde 2917 sm->wpa_ptk_rekey = config->wpa_ptk_rekey;
25ef8529 2918 sm->p2p = config->p2p;
73ed03f3 2919 sm->wpa_rsc_relaxation = config->wpa_rsc_relaxation;
869af307
JM		 2920#ifdef CONFIG_FILS
2921 if (config->fils_cache_id) {
2922 sm->fils_cache_id_set = 1;
2923 os_memcpy(sm->fils_cache_id, config->fils_cache_id,
2924 FILS_CACHE_ID_LEN);
2925 } else {
2926 sm->fils_cache_id_set = 0;
2927 }
2928#endif /* CONFIG_FILS */
6fc6879b 2929 } else {
886a807f 2930 sm->network_ctx = NULL;
6fc6879b
JM		 2931 sm->allowed_pairwise_cipher = 0;
2932 sm->proactive_key_caching = 0;
2933 sm->eap_workaround = 0;
2934 sm->eap_conf_ctx = NULL;
2935 sm->ssid_len = 0;
581a8cde 2936 sm->wpa_ptk_rekey = 0;
25ef8529 2937 sm->p2p = 0;
73ed03f3 2938 sm->wpa_rsc_relaxation = 0;
6fc6879b 2939 }
6fc6879b
JM		 2940}
2941
2942
2943/**
2944 * wpa_sm_set_own_addr - Set own MAC address
2945 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2946 * @addr: Own MAC address
2947 */
2948void wpa_sm_set_own_addr(struct wpa_sm *sm, const u8 *addr)
2949{
2950 if (sm)
2951 os_memcpy(sm->own_addr, addr, ETH_ALEN);
2952}
2953
2954
2955/**
2956 * wpa_sm_set_ifname - Set network interface name
2957 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2958 * @ifname: Interface name
2959 * @bridge_ifname: Optional bridge interface name (for pre-auth)
2960 */
2961void wpa_sm_set_ifname(struct wpa_sm *sm, const char *ifname,
2962 const char *bridge_ifname)
2963{
2964 if (sm) {
2965 sm->ifname = ifname;
2966 sm->bridge_ifname = bridge_ifname;
2967 }
2968}
2969
2970
2971/**
2972 * wpa_sm_set_eapol - Set EAPOL state machine pointer
2973 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2974 * @eapol: Pointer to EAPOL state machine allocated with eapol_sm_init()
2975 */
2976void wpa_sm_set_eapol(struct wpa_sm *sm, struct eapol_sm *eapol)
2977{
2978 if (sm)
2979 sm->eapol = eapol;
2980}
2981
2982
2983/**
2984 * wpa_sm_set_param - Set WPA state machine parameters
2985 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2986 * @param: Parameter field
2987 * @value: Parameter value
2988 * Returns: 0 on success, -1 on failure
2989 */
2990int wpa_sm_set_param(struct wpa_sm *sm, enum wpa_sm_conf_params param,
2991 unsigned int value)
2992{
2993 int ret = 0;
2994
2995 if (sm == NULL)
2996 return -1;
2997
2998 switch (param) {
2999 case RSNA_PMK_LIFETIME:
3000 if (value > 0)
3001 sm->dot11RSNAConfigPMKLifetime = value;
3002 else
3003 ret = -1;
3004 break;
3005 case RSNA_PMK_REAUTH_THRESHOLD:
3006 if (value > 0 && value <= 100)
3007 sm->dot11RSNAConfigPMKReauthThreshold = value;
3008 else
3009 ret = -1;
3010 break;
3011 case RSNA_SA_TIMEOUT:
3012 if (value > 0)
3013 sm->dot11RSNAConfigSATimeout = value;
3014 else
3015 ret = -1;
3016 break;
3017 case WPA_PARAM_PROTO:
3018 sm->proto = value;
3019 break;
3020 case WPA_PARAM_PAIRWISE:
3021 sm->pairwise_cipher = value;
3022 break;
3023 case WPA_PARAM_GROUP:
3024 sm->group_cipher = value;
3025 break;
3026 case WPA_PARAM_KEY_MGMT:
3027 sm->key_mgmt = value;
3028 break;
6fc6879b
JM		 3029 case WPA_PARAM_MGMT_GROUP:
3030 sm->mgmt_group_cipher = value;
3031 break;
6fc6879b
JM		 3032 case WPA_PARAM_RSN_ENABLED:
3033 sm->rsn_enabled = value;
3034 break;
e820cf95
JM		 3035 case WPA_PARAM_MFP:
3036 sm->mfp = value;
3037 break;
55c12f5d
MV		 3038 case WPA_PARAM_OCV:
3039 sm->ocv = value;
3040 break;
6fc6879b
JM		 3041 default:
3042 break;
3043 }
3044
3045 return ret;
3046}
3047
3048
6fc6879b
JM		 3049/**
3050 * wpa_sm_get_status - Get WPA state machine
3051 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3052 * @buf: Buffer for status information
3053 * @buflen: Maximum buffer length
3054 * @verbose: Whether to include verbose status information
3055 * Returns: Number of bytes written to buf.
3056 *
3057 * Query WPA state machine for status information. This function fills in
3058 * a text area with current status information. If the buffer (buf) is not
3059 * large enough, status information will be truncated to fit the buffer.
3060 */
3061int wpa_sm_get_status(struct wpa_sm *sm, char *buf, size_t buflen,
3062 int verbose)
3063{
3064 char *pos = buf, *end = buf + buflen;
3065 int ret;
3066
3067 ret = os_snprintf(pos, end - pos,
3068 "pairwise_cipher=%s\n"
3069 "group_cipher=%s\n"
3070 "key_mgmt=%s\n",
3071 wpa_cipher_txt(sm->pairwise_cipher),
3072 wpa_cipher_txt(sm->group_cipher),
3073 wpa_key_mgmt_txt(sm->key_mgmt, sm->proto));
d85e1fc8 3074 if (os_snprintf_error(end - pos, ret))
6fc6879b
JM		 3075 return pos - buf;
3076 pos += ret;
13e1d2e2
JM		 3077
3078 if (sm->mfp != NO_MGMT_FRAME_PROTECTION && sm->ap_rsn_ie) {
3079 struct wpa_ie_data rsn;
3080 if (wpa_parse_wpa_ie_rsn(sm->ap_rsn_ie, sm->ap_rsn_ie_len, &rsn)
3081 >= 0 &&
3082 rsn.capabilities & (WPA_CAPABILITY_MFPR |
3083 WPA_CAPABILITY_MFPC)) {
3a5954ef
JM		 3084 ret = os_snprintf(pos, end - pos, "pmf=%d\n"
3085 "mgmt_group_cipher=%s\n",
13e1d2e2 3086 (rsn.capabilities &
3a5954ef
JM		 3087 WPA_CAPABILITY_MFPR) ? 2 : 1,
3088 wpa_cipher_txt(
3089 sm->mgmt_group_cipher));
d85e1fc8 3090 if (os_snprintf_error(end - pos, ret))
13e1d2e2
JM		 3091 return pos - buf;
3092 pos += ret;
3093 }
3094 }
3095
6fc6879b
JM		 3096 return pos - buf;
3097}
3098
3099
ae8535b6
JM		 3100int wpa_sm_pmf_enabled(struct wpa_sm *sm)
3101{
3102 struct wpa_ie_data rsn;
3103
3104 if (sm->mfp == NO_MGMT_FRAME_PROTECTION || !sm->ap_rsn_ie)
3105 return 0;
3106
3107 if (wpa_parse_wpa_ie_rsn(sm->ap_rsn_ie, sm->ap_rsn_ie_len, &rsn) >= 0 &&
3108 rsn.capabilities & (WPA_CAPABILITY_MFPR | WPA_CAPABILITY_MFPC))
3109 return 1;
3110
3111 return 0;
3112}
3113
3114
17c2559c
MV		 3115int wpa_sm_ocv_enabled(struct wpa_sm *sm)
3116{
3117 struct wpa_ie_data rsn;
3118
3119 if (!sm->ocv || !sm->ap_rsn_ie)
3120 return 0;
3121
3122 return wpa_parse_wpa_ie_rsn(sm->ap_rsn_ie, sm->ap_rsn_ie_len,
3123 &rsn) >= 0 &&
3124 (rsn.capabilities & WPA_CAPABILITY_OCVC);
3125}
3126
3127
6fc6879b
JM		 3128/**
3129 * wpa_sm_set_assoc_wpa_ie_default - Generate own WPA/RSN IE from configuration
3130 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3131 * @wpa_ie: Pointer to buffer for WPA/RSN IE
3132 * @wpa_ie_len: Pointer to the length of the wpa_ie buffer
3133 * Returns: 0 on success, -1 on failure
3134 */
3135int wpa_sm_set_assoc_wpa_ie_default(struct wpa_sm *sm, u8 *wpa_ie,
3136 size_t *wpa_ie_len)
3137{
3138 int res;
3139
3140 if (sm == NULL)
3141 return -1;
3142
651c6a84
JM		 3143#ifdef CONFIG_TESTING_OPTIONS
3144 if (sm->test_assoc_ie) {
3145 wpa_printf(MSG_DEBUG,
3146 "TESTING: Replace association WPA/RSN IE");
3147 if (*wpa_ie_len < wpabuf_len(sm->test_assoc_ie))
3148 return -1;
3149 os_memcpy(wpa_ie, wpabuf_head(sm->test_assoc_ie),
3150 wpabuf_len(sm->test_assoc_ie));
3151 res = wpabuf_len(sm->test_assoc_ie);
3152 } else
3153#endif /* CONFIG_TESTING_OPTIONS */
6fc6879b
JM		 3154 res = wpa_gen_wpa_ie(sm, wpa_ie, *wpa_ie_len);
3155 if (res < 0)
3156 return -1;
3157 *wpa_ie_len = res;
3158
3159 wpa_hexdump(MSG_DEBUG, "WPA: Set own WPA IE default",
3160 wpa_ie, *wpa_ie_len);
3161
3162 if (sm->assoc_wpa_ie == NULL) {
3163 /*
3164 * Make a copy of the WPA/RSN IE so that 4-Way Handshake gets
3165 * the correct version of the IE even if PMKSA caching is
3166 * aborted (which would remove PMKID from IE generation).
3167 */
a1f11e34 3168 sm->assoc_wpa_ie = os_memdup(wpa_ie, *wpa_ie_len);
6fc6879b
JM		 3169 if (sm->assoc_wpa_ie == NULL)
3170 return -1;
3171
6fc6879b 3172 sm->assoc_wpa_ie_len = *wpa_ie_len;
0866ed00
JM		 3173 } else {
3174 wpa_hexdump(MSG_DEBUG,
3175 "WPA: Leave previously set WPA IE default",
3176 sm->assoc_wpa_ie, sm->assoc_wpa_ie_len);
6fc6879b
JM		 3177 }
3178
3179 return 0;
3180}
3181
3182
3183/**
3184 * wpa_sm_set_assoc_wpa_ie - Set own WPA/RSN IE from (Re)AssocReq
3185 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3186 * @ie: Pointer to IE data (starting from id)
3187 * @len: IE length
3188 * Returns: 0 on success, -1 on failure
3189 *
3190 * Inform WPA state machine about the WPA/RSN IE used in (Re)Association
3191 * Request frame. The IE will be used to override the default value generated
3192 * with wpa_sm_set_assoc_wpa_ie_default().
3193 */
3194int wpa_sm_set_assoc_wpa_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
3195{
3196 if (sm == NULL)
3197 return -1;
3198
3199 os_free(sm->assoc_wpa_ie);
3200 if (ie == NULL || len == 0) {
f049052b
BG		 3201 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3202 "WPA: clearing own WPA/RSN IE");
6fc6879b
JM		 3203 sm->assoc_wpa_ie = NULL;
3204 sm->assoc_wpa_ie_len = 0;
3205 } else {
3206 wpa_hexdump(MSG_DEBUG, "WPA: set own WPA/RSN IE", ie, len);
a1f11e34 3207 sm->assoc_wpa_ie = os_memdup(ie, len);
6fc6879b
JM		 3208 if (sm->assoc_wpa_ie == NULL)
3209 return -1;
3210
6fc6879b
JM		 3211 sm->assoc_wpa_ie_len = len;
3212 }
3213
3214 return 0;
3215}
3216
3217
3218/**
3219 * wpa_sm_set_ap_wpa_ie - Set AP WPA IE from Beacon/ProbeResp
3220 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3221 * @ie: Pointer to IE data (starting from id)
3222 * @len: IE length
3223 * Returns: 0 on success, -1 on failure
3224 *
3225 * Inform WPA state machine about the WPA IE used in Beacon / Probe Response
3226 * frame.
3227 */
3228int wpa_sm_set_ap_wpa_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
3229{
3230 if (sm == NULL)
3231 return -1;
3232
3233 os_free(sm->ap_wpa_ie);
3234 if (ie == NULL || len == 0) {
f049052b
BG		 3235 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3236 "WPA: clearing AP WPA IE");
6fc6879b
JM		 3237 sm->ap_wpa_ie = NULL;
3238 sm->ap_wpa_ie_len = 0;
3239 } else {
3240 wpa_hexdump(MSG_DEBUG, "WPA: set AP WPA IE", ie, len);
a1f11e34 3241 sm->ap_wpa_ie = os_memdup(ie, len);
6fc6879b
JM		 3242 if (sm->ap_wpa_ie == NULL)
3243 return -1;
3244
6fc6879b
JM		 3245 sm->ap_wpa_ie_len = len;
3246 }
3247
3248 return 0;
3249}
3250
3251
3252/**
3253 * wpa_sm_set_ap_rsn_ie - Set AP RSN IE from Beacon/ProbeResp
3254 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3255 * @ie: Pointer to IE data (starting from id)
3256 * @len: IE length
3257 * Returns: 0 on success, -1 on failure
3258 *
3259 * Inform WPA state machine about the RSN IE used in Beacon / Probe Response
3260 * frame.
3261 */
3262int wpa_sm_set_ap_rsn_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
3263{
3264 if (sm == NULL)
3265 return -1;
3266
3267 os_free(sm->ap_rsn_ie);
3268 if (ie == NULL || len == 0) {
f049052b
BG		 3269 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3270 "WPA: clearing AP RSN IE");
6fc6879b
JM		 3271 sm->ap_rsn_ie = NULL;
3272 sm->ap_rsn_ie_len = 0;
3273 } else {
3274 wpa_hexdump(MSG_DEBUG, "WPA: set AP RSN IE", ie, len);
a1f11e34 3275 sm->ap_rsn_ie = os_memdup(ie, len);
6fc6879b
JM		 3276 if (sm->ap_rsn_ie == NULL)
3277 return -1;
3278
6fc6879b
JM		 3279 sm->ap_rsn_ie_len = len;
3280 }
3281
3282 return 0;
3283}
3284
3285
3286/**
3287 * wpa_sm_parse_own_wpa_ie - Parse own WPA/RSN IE
3288 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3289 * @data: Pointer to data area for parsing results
3290 * Returns: 0 on success, -1 if IE is not known, or -2 on parsing failure
3291 *
3292 * Parse the contents of the own WPA or RSN IE from (Re)AssocReq and write the
3293 * parsed data into data.
3294 */
3295int wpa_sm_parse_own_wpa_ie(struct wpa_sm *sm, struct wpa_ie_data *data)
3296{
2a522e71
JM		 3297 if (sm == NULL)
3298 return -1;
3299
3300 if (sm->assoc_wpa_ie == NULL) {
f049052b
BG		 3301 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3302 "WPA: No WPA/RSN IE available from association info");
6fc6879b
JM		 3303 return -1;
3304 }
3305 if (wpa_parse_wpa_ie(sm->assoc_wpa_ie, sm->assoc_wpa_ie_len, data))
3306 return -2;
3307 return 0;
3308}
540264a7
JM		 3309
3310
3311int wpa_sm_pmksa_cache_list(struct wpa_sm *sm, char *buf, size_t len)
3312{
540264a7 3313 return pmksa_cache_list(sm->pmksa, buf, len);
540264a7 3314}
32d5295f
JM		 3315
3316
3459381d
JM		 3317struct rsn_pmksa_cache_entry * wpa_sm_pmksa_cache_head(struct wpa_sm *sm)
3318{
3319 return pmksa_cache_head(sm->pmksa);
3320}
3321
3322
3323struct rsn_pmksa_cache_entry *
3324wpa_sm_pmksa_cache_add_entry(struct wpa_sm *sm,
3325 struct rsn_pmksa_cache_entry * entry)
3326{
3327 return pmksa_cache_add_entry(sm->pmksa, entry);
3328}
3329
3330
f705f41b
VK		 3331void wpa_sm_pmksa_cache_add(struct wpa_sm *sm, const u8 *pmk, size_t pmk_len,
3332 const u8 *pmkid, const u8 *bssid,
3333 const u8 *fils_cache_id)
3334{
3335 sm->cur_pmksa = pmksa_cache_add(sm->pmksa, pmk, pmk_len, pmkid, NULL, 0,
3336 bssid, sm->own_addr, sm->network_ctx,
3337 sm->key_mgmt, fils_cache_id);
3338}
3339
3340
567da5bb
JM		 3341int wpa_sm_pmksa_exists(struct wpa_sm *sm, const u8 *bssid,
3342 const void *network_ctx)
3343{
852b2f27 3344 return pmksa_cache_get(sm->pmksa, bssid, NULL, network_ctx, 0) != NULL;
567da5bb
JM		 3345}
3346
3347
32d5295f
JM		 3348void wpa_sm_drop_sa(struct wpa_sm *sm)
3349{
f049052b 3350 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Clear old PMK and PTK");
32d5295f
JM		 3351 sm->ptk_set = 0;
3352 sm->tptk_set = 0;
1bd13110 3353 sm->pmk_len = 0;
32d5295f
JM		 3354 os_memset(sm->pmk, 0, sizeof(sm->pmk));
3355 os_memset(&sm->ptk, 0, sizeof(sm->ptk));
3356 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
cb5132bb 3357 os_memset(&sm->gtk, 0, sizeof(sm->gtk));
87e2db16 3358 os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
cb5132bb 3359 os_memset(&sm->igtk, 0, sizeof(sm->igtk));
87e2db16 3360 os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
71932544
JM		 3361#ifdef CONFIG_IEEE80211R
3362 os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
a3e18dbb 3363 sm->xxkey_len = 0;
71932544 3364 os_memset(sm->pmk_r0, 0, sizeof(sm->pmk_r0));
a3e18dbb 3365 sm->pmk_r0_len = 0;
71932544 3366 os_memset(sm->pmk_r1, 0, sizeof(sm->pmk_r1));
a3e18dbb 3367 sm->pmk_r1_len = 0;
71932544 3368#endif /* CONFIG_IEEE80211R */
32d5295f 3369}
0d7b4409
JM		 3370
3371
3372int wpa_sm_has_ptk(struct wpa_sm *sm)
3373{
3374 if (sm == NULL)
3375 return 0;
3376 return sm->ptk_set;
3377}
b14a210c
JB		 3378
3379
3380void wpa_sm_update_replay_ctr(struct wpa_sm *sm, const u8 *replay_ctr)
3381{
3382 os_memcpy(sm->rx_replay_counter, replay_ctr, WPA_REPLAY_COUNTER_LEN);
3383}
d8a790b9
JM		 3384
3385
3386void wpa_sm_pmksa_cache_flush(struct wpa_sm *sm, void *network_ctx)
3387{
4033935d 3388 pmksa_cache_flush(sm->pmksa, network_ctx, NULL, 0);
d8a790b9 3389}
75cad1a0
XC		 3390
3391
ad3872a3 3392#ifdef CONFIG_WNM
75cad1a0
XC		 3393int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf)
3394{
75cad1a0
XC		 3395 u16 keyinfo;
3396 u8 keylen; /* plaintext key len */
75cad1a0
XC		 3397 u8 *key_rsc;
3398
75cad1a0 3399 if (subelem_id == WNM_SLEEP_SUBELEM_GTK) {
d2c33b91
JM		 3400 struct wpa_gtk_data gd;
3401
3402 os_memset(&gd, 0, sizeof(gd));
3403 keylen = wpa_cipher_key_len(sm->group_cipher);
3404 gd.key_rsc_len = wpa_cipher_rsc_len(sm->group_cipher);
3405 gd.alg = wpa_cipher_to_alg(sm->group_cipher);
3406 if (gd.alg == WPA_ALG_NONE) {
3407 wpa_printf(MSG_DEBUG, "Unsupported group cipher suite");
3408 return -1;
3409 }
3410
75cad1a0 3411 key_rsc = buf + 5;
68db9ab0 3412 keyinfo = WPA_GET_LE16(buf + 2);
75cad1a0
XC		 3413 gd.gtk_len = keylen;
3414 if (gd.gtk_len != buf[4]) {
3415 wpa_printf(MSG_DEBUG, "GTK len mismatch len %d vs %d",
3416 gd.gtk_len, buf[4]);
3417 return -1;
3418 }
3419 gd.keyidx = keyinfo & 0x03; /* B0 - B1 */
3420 gd.tx = wpa_supplicant_gtk_tx_bit_workaround(
3421 sm, !!(keyinfo & WPA_KEY_INFO_TXRX));
3422
68db9ab0 3423 os_memcpy(gd.gtk, buf + 13, gd.gtk_len);
75cad1a0
XC		 3424
3425 wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)",
3426 gd.gtk, gd.gtk_len);
87e2db16 3427 if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) {
31bc66e4 3428 forced_memzero(&gd, sizeof(gd));
75cad1a0
XC		 3429 wpa_printf(MSG_DEBUG, "Failed to install the GTK in "
3430 "WNM mode");
3431 return -1;
3432 }
31bc66e4 3433 forced_memzero(&gd, sizeof(gd));
75cad1a0 3434 } else if (subelem_id == WNM_SLEEP_SUBELEM_IGTK) {
cb5132bb
MV		 3435 const struct wpa_igtk_kde *igtk;
3436
3437 igtk = (const struct wpa_igtk_kde *) (buf + 2);
87e2db16 3438 if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0)
75cad1a0 3439 return -1;
75cad1a0
XC		 3440 } else {
3441 wpa_printf(MSG_DEBUG, "Unknown element id");
3442 return -1;
3443 }
3444
3445 return 0;
3446}
ad3872a3 3447#endif /* CONFIG_WNM */
db76aa64
JM		 3448
3449
25ef8529
JM		 3450#ifdef CONFIG_P2P
3451
3452int wpa_sm_get_p2p_ip_addr(struct wpa_sm *sm, u8 *buf)
3453{
3454 if (sm == NULL || WPA_GET_BE32(sm->p2p_ip_addr) == 0)
3455 return -1;
3456 os_memcpy(buf, sm->p2p_ip_addr, 3 * 4);
3457 return 0;
3458}
3459
3460#endif /* CONFIG_P2P */
b41f2684
CL		 3461
3462
3463void wpa_sm_set_rx_replay_ctr(struct wpa_sm *sm, const u8 *rx_replay_counter)
3464{
3465 if (rx_replay_counter == NULL)
3466 return;
3467
3468 os_memcpy(sm->rx_replay_counter, rx_replay_counter,
3469 WPA_REPLAY_COUNTER_LEN);
3470 sm->rx_replay_counter_set = 1;
3471 wpa_printf(MSG_DEBUG, "Updated key replay counter");
3472}
3473
3474
98cd3d1c
JM		 3475void wpa_sm_set_ptk_kck_kek(struct wpa_sm *sm,
3476 const u8 *ptk_kck, size_t ptk_kck_len,
3477 const u8 *ptk_kek, size_t ptk_kek_len)
b41f2684 3478{
98cd3d1c
JM		 3479 if (ptk_kck && ptk_kck_len <= WPA_KCK_MAX_LEN) {
3480 os_memcpy(sm->ptk.kck, ptk_kck, ptk_kck_len);
3481 sm->ptk.kck_len = ptk_kck_len;
b41f2684
CL		 3482 wpa_printf(MSG_DEBUG, "Updated PTK KCK");
3483 }
98cd3d1c
JM		 3484 if (ptk_kek && ptk_kek_len <= WPA_KEK_MAX_LEN) {
3485 os_memcpy(sm->ptk.kek, ptk_kek, ptk_kek_len);
3486 sm->ptk.kek_len = ptk_kek_len;
b41f2684
CL		 3487 wpa_printf(MSG_DEBUG, "Updated PTK KEK");
3488 }
3489 sm->ptk_set = 1;
3490}
651c6a84
JM		 3491
3492
3493#ifdef CONFIG_TESTING_OPTIONS
bb06748f 3494
651c6a84
JM		 3495void wpa_sm_set_test_assoc_ie(struct wpa_sm *sm, struct wpabuf *buf)
3496{
3497 wpabuf_free(sm->test_assoc_ie);
3498 sm->test_assoc_ie = buf;
3499}
bb06748f
JM		 3500
3501
3502const u8 * wpa_sm_get_anonce(struct wpa_sm *sm)
3503{
3504 return sm->anonce;
3505}
3506
651c6a84 3507#endif /* CONFIG_TESTING_OPTIONS */
f00b9b88
JM		 3508
3509
3dc3afe2
AM		 3510unsigned int wpa_sm_get_key_mgmt(struct wpa_sm *sm)
3511{
3512 return sm->key_mgmt;
3513}
3514
3515
f00b9b88
JM		 3516#ifdef CONFIG_FILS
3517
af3e362f 3518struct wpabuf * fils_build_auth(struct wpa_sm *sm, int dh_group, const u8 *md)
f00b9b88
JM		 3519{
3520 struct wpabuf *buf = NULL;
3521 struct wpabuf *erp_msg;
76e20f4f 3522 struct wpabuf *pub = NULL;
f00b9b88
JM		 3523
3524 erp_msg = eapol_sm_build_erp_reauth_start(sm->eapol);
3525 if (!erp_msg && !sm->cur_pmksa) {
3526 wpa_printf(MSG_DEBUG,
3527 "FILS: Neither ERP EAP-Initiate/Re-auth nor PMKSA cache entry is available - skip FILS");
3528 goto fail;
3529 }
3530
3531 wpa_printf(MSG_DEBUG, "FILS: Try to use FILS (erp=%d pmksa_cache=%d)",
3532 erp_msg != NULL, sm->cur_pmksa != NULL);
3533
706df429
JM		 3534 sm->fils_completed = 0;
3535
f00b9b88
JM		 3536 if (!sm->assoc_wpa_ie) {
3537 wpa_printf(MSG_INFO, "FILS: No own RSN IE set for FILS");
3538 goto fail;
3539 }
3540
3541 if (random_get_bytes(sm->fils_nonce, FILS_NONCE_LEN) < 0 ||
3542 random_get_bytes(sm->fils_session, FILS_SESSION_LEN) < 0)
3543 goto fail;
3544
3545 wpa_hexdump(MSG_DEBUG, "FILS: Generated FILS Nonce",
3546 sm->fils_nonce, FILS_NONCE_LEN);
3547 wpa_hexdump(MSG_DEBUG, "FILS: Generated FILS Session",
3548 sm->fils_session, FILS_SESSION_LEN);
3549
76e20f4f
JM		 3550#ifdef CONFIG_FILS_SK_PFS
3551 sm->fils_dh_group = dh_group;
3552 if (dh_group) {
3553 crypto_ecdh_deinit(sm->fils_ecdh);
3554 sm->fils_ecdh = crypto_ecdh_init(dh_group);
3555 if (!sm->fils_ecdh) {
3556 wpa_printf(MSG_INFO,
3557 "FILS: Could not initialize ECDH with group %d",
3558 dh_group);
3559 goto fail;
3560 }
3561 pub = crypto_ecdh_get_pubkey(sm->fils_ecdh, 1);
3562 if (!pub)
3563 goto fail;
3564 wpa_hexdump_buf(MSG_DEBUG, "FILS: Element (DH public key)",
3565 pub);
3566 sm->fils_dh_elem_len = wpabuf_len(pub);
3567 }
3568#endif /* CONFIG_FILS_SK_PFS */
3569
3570 buf = wpabuf_alloc(1000 + sm->assoc_wpa_ie_len +
3571 (pub ? wpabuf_len(pub) : 0));
f00b9b88
JM		 3572 if (!buf)
3573 goto fail;
3574
3575 /* Fields following the Authentication algorithm number field */
3576
3577 /* Authentication Transaction seq# */
3578 wpabuf_put_le16(buf, 1);
3579
3580 /* Status Code */
3581 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
3582
76e20f4f
JM		 3583 /* TODO: FILS PK */
3584#ifdef CONFIG_FILS_SK_PFS
3585 if (dh_group) {
3586 /* Finite Cyclic Group */
3587 wpabuf_put_le16(buf, dh_group);
3588 /* Element */
3589 wpabuf_put_buf(buf, pub);
3590 }
3591#endif /* CONFIG_FILS_SK_PFS */
f00b9b88
JM		 3592
3593 /* RSNE */
3594 wpa_hexdump(MSG_DEBUG, "FILS: RSNE in FILS Authentication frame",
3595 sm->assoc_wpa_ie, sm->assoc_wpa_ie_len);
3596 wpabuf_put_data(buf, sm->assoc_wpa_ie, sm->assoc_wpa_ie_len);
3597
af3e362f
JM		 3598 if (md) {
3599 /* MDE when using FILS for FT initial association */
3600 struct rsn_mdie *mdie;
3601
3602 wpabuf_put_u8(buf, WLAN_EID_MOBILITY_DOMAIN);
3603 wpabuf_put_u8(buf, sizeof(*mdie));
3604 mdie = wpabuf_put(buf, sizeof(*mdie));
3605 os_memcpy(mdie->mobility_domain, md, MOBILITY_DOMAIN_ID_LEN);
3606 mdie->ft_capab = 0;
3607 }
f00b9b88
JM		 3608
3609 /* FILS Nonce */
3610 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
3611 wpabuf_put_u8(buf, 1 + FILS_NONCE_LEN); /* Length */
3612 /* Element ID Extension */
3613 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_NONCE);
3614 wpabuf_put_data(buf, sm->fils_nonce, FILS_NONCE_LEN);
3615
3616 /* FILS Session */
3617 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
3618 wpabuf_put_u8(buf, 1 + FILS_SESSION_LEN); /* Length */
3619 /* Element ID Extension */
3620 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_SESSION);
3621 wpabuf_put_data(buf, sm->fils_session, FILS_SESSION_LEN);
3622
3623 /* FILS Wrapped Data */
fcd3d6ce 3624 sm->fils_erp_pmkid_set = 0;
f00b9b88
JM		 3625 if (erp_msg) {
3626 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
3627 wpabuf_put_u8(buf, 1 + wpabuf_len(erp_msg)); /* Length */
3628 /* Element ID Extension */
3629 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_WRAPPED_DATA);
3630 wpabuf_put_buf(buf, erp_msg);
fcd3d6ce
JM		 3631 /* Calculate pending PMKID here so that we do not need to
3632 * maintain a copy of the EAP-Initiate/Reauth message. */
3633 if (fils_pmkid_erp(sm->key_mgmt, wpabuf_head(erp_msg),
3634 wpabuf_len(erp_msg),
3635 sm->fils_erp_pmkid) == 0)
3636 sm->fils_erp_pmkid_set = 1;
f00b9b88
JM		 3637 }
3638
3639 wpa_hexdump_buf(MSG_DEBUG, "RSN: FILS fields for Authentication frame",
3640 buf);
3641
3642fail:
3643 wpabuf_free(erp_msg);
76e20f4f 3644 wpabuf_free(pub);
f00b9b88
JM		 3645 return buf;
3646}
3647
a6609937 3648
ba9774bd
JM		 3649int fils_process_auth(struct wpa_sm *sm, const u8 *bssid, const u8 *data,
3650 size_t len)
a6609937
JM		 3651{
3652 const u8 *pos, *end;
3653 struct ieee802_11_elems elems;
3654 struct wpa_ie_data rsn;
3655 int pmkid_match = 0;
3656 u8 ick[FILS_ICK_MAX_LEN];
3657 size_t ick_len;
3658 int res;
76e20f4f 3659 struct wpabuf *dh_ss = NULL;
e6b62313
JM		 3660 const u8 *g_sta = NULL;
3661 size_t g_sta_len = 0;
3662 const u8 *g_ap = NULL;
3663 size_t g_ap_len = 0;
3664 struct wpabuf *pub = NULL;
a6609937 3665
ba9774bd
JM		 3666 os_memcpy(sm->bssid, bssid, ETH_ALEN);
3667
a6609937
JM		 3668 wpa_hexdump(MSG_DEBUG, "FILS: Authentication frame fields",
3669 data, len);
3670 pos = data;
3671 end = data + len;
3672
76e20f4f
JM		 3673 /* TODO: FILS PK */
3674#ifdef CONFIG_FILS_SK_PFS
3675 if (sm->fils_dh_group) {
3676 u16 group;
3677
3678 /* Using FILS PFS */
3679
3680 /* Finite Cyclic Group */
3681 if (end - pos < 2) {
3682 wpa_printf(MSG_DEBUG,
3683 "FILS: No room for Finite Cyclic Group");
3684 goto fail;
3685 }
3686 group = WPA_GET_LE16(pos);
3687 pos += 2;
3688 if (group != sm->fils_dh_group) {
3689 wpa_printf(MSG_DEBUG,
3690 "FILS: Unexpected change in Finite Cyclic Group: %u (expected %u)",
3691 group, sm->fils_dh_group);
3692 goto fail;
3693 }
3694
3695 /* Element */
3696 if ((size_t) (end - pos) < sm->fils_dh_elem_len) {
3697 wpa_printf(MSG_DEBUG, "FILS: No room for Element");
3698 goto fail;
3699 }
3700
3701 if (!sm->fils_ecdh) {
3702 wpa_printf(MSG_DEBUG, "FILS: No ECDH state available");
3703 goto fail;
3704 }
3705 dh_ss = crypto_ecdh_set_peerkey(sm->fils_ecdh, 1, pos,
3706 sm->fils_dh_elem_len);
3707 if (!dh_ss) {
3708 wpa_printf(MSG_DEBUG, "FILS: ECDH operation failed");
3709 goto fail;
3710 }
3711 wpa_hexdump_buf_key(MSG_DEBUG, "FILS: DH_SS", dh_ss);
e6b62313
JM		 3712 g_ap = pos;
3713 g_ap_len = sm->fils_dh_elem_len;
76e20f4f
JM		 3714 pos += sm->fils_dh_elem_len;
3715 }
3716#endif /* CONFIG_FILS_SK_PFS */
a6609937
JM		 3717
3718 wpa_hexdump(MSG_DEBUG, "FILS: Remaining IEs", pos, end - pos);
3719 if (ieee802_11_parse_elems(pos, end - pos, &elems, 1) == ParseFailed) {
3720 wpa_printf(MSG_DEBUG, "FILS: Could not parse elements");
76e20f4f 3721 goto fail;
a6609937
JM		 3722 }
3723
3724 /* RSNE */
3725 wpa_hexdump(MSG_DEBUG, "FILS: RSN element", elems.rsn_ie,
3726 elems.rsn_ie_len);
3727 if (!elems.rsn_ie ||
3728 wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, elems.rsn_ie_len + 2,
3729 &rsn) < 0) {
3730 wpa_printf(MSG_DEBUG, "FILS: No RSN element");
76e20f4f 3731 goto fail;
a6609937
JM		 3732 }
3733
3734 if (!elems.fils_nonce) {
3735 wpa_printf(MSG_DEBUG, "FILS: No FILS Nonce field");
76e20f4f 3736 goto fail;
a6609937
JM		 3737 }
3738 os_memcpy(sm->fils_anonce, elems.fils_nonce, FILS_NONCE_LEN);
3739 wpa_hexdump(MSG_DEBUG, "FILS: ANonce", sm->fils_anonce, FILS_NONCE_LEN);
3740
d555c39c 3741#ifdef CONFIG_IEEE80211R
7d440a3b
JM		 3742 if (wpa_key_mgmt_ft(sm->key_mgmt)) {
3743 struct wpa_ft_ies parse;
3744
3745 if (!elems.mdie || !elems.ftie) {
3746 wpa_printf(MSG_DEBUG, "FILS+FT: No MDE or FTE");
3747 goto fail;
3748 }
3749
9a33737a
JM		 3750 if (wpa_ft_parse_ies(pos, end - pos, &parse,
3751 wpa_key_mgmt_sha384(sm->key_mgmt)) < 0) {
7d440a3b
JM		 3752 wpa_printf(MSG_DEBUG, "FILS+FT: Failed to parse IEs");
3753 goto fail;
3754 }
3755
3756 if (!parse.r0kh_id) {
3757 wpa_printf(MSG_DEBUG,
3758 "FILS+FT: No R0KH-ID subelem in FTE");
3759 goto fail;
3760 }
3761 os_memcpy(sm->r0kh_id, parse.r0kh_id, parse.r0kh_id_len);
3762 sm->r0kh_id_len = parse.r0kh_id_len;
3763 wpa_hexdump_ascii(MSG_DEBUG, "FILS+FT: R0KH-ID",
3764 sm->r0kh_id, sm->r0kh_id_len);
3765
3766 if (!parse.r1kh_id) {
3767 wpa_printf(MSG_DEBUG,
3768 "FILS+FT: No R1KH-ID subelem in FTE");
3769 goto fail;
3770 }
3771 os_memcpy(sm->r1kh_id, parse.r1kh_id, FT_R1KH_ID_LEN);
3772 wpa_hexdump(MSG_DEBUG, "FILS+FT: R1KH-ID",
3773 sm->r1kh_id, FT_R1KH_ID_LEN);
3774
3775 /* TODO: Check MDE and FTE payload */
3776
3777 wpabuf_free(sm->fils_ft_ies);
3778 sm->fils_ft_ies = wpabuf_alloc(2 + elems.mdie_len +
3779 2 + elems.ftie_len);
3780 if (!sm->fils_ft_ies)
3781 goto fail;
3782 wpabuf_put_data(sm->fils_ft_ies, elems.mdie - 2,
3783 2 + elems.mdie_len);
3784 wpabuf_put_data(sm->fils_ft_ies, elems.ftie - 2,
3785 2 + elems.ftie_len);
3786 } else {
3787 wpabuf_free(sm->fils_ft_ies);
3788 sm->fils_ft_ies = NULL;
3789 }
d555c39c 3790#endif /* CONFIG_IEEE80211R */
a6609937
JM		 3791
3792 /* PMKID List */
3793 if (rsn.pmkid && rsn.num_pmkid > 0) {
3794 wpa_hexdump(MSG_DEBUG, "FILS: PMKID List",
3795 rsn.pmkid, rsn.num_pmkid * PMKID_LEN);
3796
3797 if (rsn.num_pmkid != 1) {
3798 wpa_printf(MSG_DEBUG, "FILS: Invalid PMKID selection");
76e20f4f 3799 goto fail;
a6609937
JM		 3800 }
3801 wpa_hexdump(MSG_DEBUG, "FILS: PMKID", rsn.pmkid, PMKID_LEN);
3802 if (os_memcmp(sm->cur_pmksa->pmkid, rsn.pmkid, PMKID_LEN) != 0)
3803 {
3804 wpa_printf(MSG_DEBUG, "FILS: PMKID mismatch");
3805 wpa_hexdump(MSG_DEBUG, "FILS: Expected PMKID",
3806 sm->cur_pmksa->pmkid, PMKID_LEN);
76e20f4f 3807 goto fail;
a6609937
JM		 3808 }
3809 wpa_printf(MSG_DEBUG,
3810 "FILS: Matching PMKID - continue using PMKSA caching");
3811 pmkid_match = 1;
3812 }
3813 if (!pmkid_match && sm->cur_pmksa) {
3814 wpa_printf(MSG_DEBUG,
3815 "FILS: No PMKID match - cannot use cached PMKSA entry");
3816 sm->cur_pmksa = NULL;
3817 }
3818
3819 /* FILS Session */
3820 if (!elems.fils_session) {
3821 wpa_printf(MSG_DEBUG, "FILS: No FILS Session element");
76e20f4f 3822 goto fail;
a6609937
JM		 3823 }
3824 wpa_hexdump(MSG_DEBUG, "FILS: FILS Session", elems.fils_session,
3825 FILS_SESSION_LEN);
3826 if (os_memcmp(sm->fils_session, elems.fils_session, FILS_SESSION_LEN)
3827 != 0) {
3828 wpa_printf(MSG_DEBUG, "FILS: Session mismatch");
3829 wpa_hexdump(MSG_DEBUG, "FILS: Expected FILS Session",
3830 sm->fils_session, FILS_SESSION_LEN);
76e20f4f 3831 goto fail;
a6609937
JM		 3832 }
3833
3834 /* FILS Wrapped Data */
3835 if (!sm->cur_pmksa && elems.fils_wrapped_data) {
fcd3d6ce
JM		 3836 u8 rmsk[ERP_MAX_KEY_LEN];
3837 size_t rmsk_len;
3838
a6609937
JM		 3839 wpa_hexdump(MSG_DEBUG, "FILS: Wrapped Data",
3840 elems.fils_wrapped_data,
3841 elems.fils_wrapped_data_len);
3842 eapol_sm_process_erp_finish(sm->eapol, elems.fils_wrapped_data,
3843 elems.fils_wrapped_data_len);
3844 if (eapol_sm_failed(sm->eapol))
76e20f4f 3845 goto fail;
a6609937 3846
fcd3d6ce
JM		 3847 rmsk_len = ERP_MAX_KEY_LEN;
3848 res = eapol_sm_get_key(sm->eapol, rmsk, rmsk_len);
3849 if (res == PMK_LEN) {
3850 rmsk_len = PMK_LEN;
3851 res = eapol_sm_get_key(sm->eapol, rmsk, rmsk_len);
3852 }
a6609937 3853 if (res)
76e20f4f 3854 goto fail;
a6609937 3855
fcd3d6ce 3856 res = fils_rmsk_to_pmk(sm->key_mgmt, rmsk, rmsk_len,
76e20f4f
JM		 3857 sm->fils_nonce, sm->fils_anonce,
3858 dh_ss ? wpabuf_head(dh_ss) : NULL,
3859 dh_ss ? wpabuf_len(dh_ss) : 0,
fcd3d6ce 3860 sm->pmk, &sm->pmk_len);
31bc66e4 3861 forced_memzero(rmsk, sizeof(rmsk));
4cada9dc
JM		 3862
3863 /* Don't use DHss in PTK derivation if PMKSA caching is not
3864 * used. */
76e20f4f
JM		 3865 wpabuf_clear_free(dh_ss);
3866 dh_ss = NULL;
4cada9dc 3867
275cc942 3868 if (res)
76e20f4f 3869 goto fail;
fcd3d6ce
JM		 3870
3871 if (!sm->fils_erp_pmkid_set) {
3872 wpa_printf(MSG_DEBUG, "FILS: PMKID not available");
76e20f4f 3873 goto fail;
fcd3d6ce
JM		 3874 }
3875 wpa_hexdump(MSG_DEBUG, "FILS: PMKID", sm->fils_erp_pmkid,
3876 PMKID_LEN);
a6609937 3877 wpa_printf(MSG_DEBUG, "FILS: ERP processing succeeded - add PMKSA cache entry for the result");
fcd3d6ce
JM		 3878 sm->cur_pmksa = pmksa_cache_add(sm->pmksa, sm->pmk, sm->pmk_len,
3879 sm->fils_erp_pmkid, NULL, 0,
3880 sm->bssid, sm->own_addr,
869af307
JM		 3881 sm->network_ctx, sm->key_mgmt,
3882 NULL);
a6609937
JM		 3883 }
3884
3885 if (!sm->cur_pmksa) {
3886 wpa_printf(MSG_DEBUG,
3887 "FILS: No remaining options to continue FILS authentication");
76e20f4f 3888 goto fail;
a6609937
JM		 3889 }
3890
3891 if (fils_pmk_to_ptk(sm->pmk, sm->pmk_len, sm->own_addr, sm->bssid,
4cada9dc
JM		 3892 sm->fils_nonce, sm->fils_anonce,
3893 dh_ss ? wpabuf_head(dh_ss) : NULL,
3894 dh_ss ? wpabuf_len(dh_ss) : 0,
3895 &sm->ptk, ick, &ick_len,
3896 sm->key_mgmt, sm->pairwise_cipher,
7d440a3b 3897 sm->fils_ft, &sm->fils_ft_len) < 0) {
a6609937 3898 wpa_printf(MSG_DEBUG, "FILS: Failed to derive PTK");
76e20f4f 3899 goto fail;
a6609937 3900 }
4cada9dc
JM		 3901
3902 wpabuf_clear_free(dh_ss);
3903 dh_ss = NULL;
3904
a6609937
JM		 3905 sm->ptk_set = 1;
3906 sm->tptk_set = 0;
3907 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
3908
e6b62313
JM		 3909#ifdef CONFIG_FILS_SK_PFS
3910 if (sm->fils_dh_group) {
3911 if (!sm->fils_ecdh) {
3912 wpa_printf(MSG_INFO, "FILS: ECDH not initialized");
3913 goto fail;
3914 }
3915 pub = crypto_ecdh_get_pubkey(sm->fils_ecdh, 1);
3916 if (!pub)
3917 goto fail;
3918 wpa_hexdump_buf(MSG_DEBUG, "FILS: gSTA", pub);
3919 g_sta = wpabuf_head(pub);
3920 g_sta_len = wpabuf_len(pub);
3921 if (!g_ap) {
3922 wpa_printf(MSG_INFO, "FILS: gAP not available");
3923 goto fail;
3924 }
3925 wpa_hexdump(MSG_DEBUG, "FILS: gAP", g_ap, g_ap_len);
3926 }
3927#endif /* CONFIG_FILS_SK_PFS */
3928
a6609937
JM		 3929 res = fils_key_auth_sk(ick, ick_len, sm->fils_nonce,
3930 sm->fils_anonce, sm->own_addr, sm->bssid,
e6b62313 3931 g_sta, g_sta_len, g_ap, g_ap_len,
a6609937
JM		 3932 sm->key_mgmt, sm->fils_key_auth_sta,
3933 sm->fils_key_auth_ap,
3934 &sm->fils_key_auth_len);
e6b62313 3935 wpabuf_free(pub);
31bc66e4 3936 forced_memzero(ick, sizeof(ick));
a6609937 3937 return res;
76e20f4f 3938fail:
e6b62313 3939 wpabuf_free(pub);
76e20f4f
JM		 3940 wpabuf_clear_free(dh_ss);
3941 return -1;
a6609937
JM		 3942}
3943
86cd6928 3944
7d440a3b
JM		 3945#ifdef CONFIG_IEEE80211R
3946static int fils_ft_build_assoc_req_rsne(struct wpa_sm *sm, struct wpabuf *buf)
3947{
3948 struct rsn_ie_hdr *rsnie;
3949 u16 capab;
3950 u8 *pos;
994eac7e 3951 int use_sha384 = wpa_key_mgmt_sha384(sm->key_mgmt);
7d440a3b
JM		 3952
3953 /* RSNIE[PMKR0Name/PMKR1Name] */
3954 rsnie = wpabuf_put(buf, sizeof(*rsnie));
3955 rsnie->elem_id = WLAN_EID_RSN;
3956 WPA_PUT_LE16(rsnie->version, RSN_VERSION);
3957
3958 /* Group Suite Selector */
3959 if (!wpa_cipher_valid_group(sm->group_cipher)) {
3960 wpa_printf(MSG_WARNING, "FT: Invalid group cipher (%d)",
3961 sm->group_cipher);
3962 return -1;
3963 }
3964 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
3965 RSN_SELECTOR_PUT(pos, wpa_cipher_to_suite(WPA_PROTO_RSN,
3966 sm->group_cipher));
3967
3968 /* Pairwise Suite Count */
3969 wpabuf_put_le16(buf, 1);
3970
3971 /* Pairwise Suite List */
3972 if (!wpa_cipher_valid_pairwise(sm->pairwise_cipher)) {
3973 wpa_printf(MSG_WARNING, "FT: Invalid pairwise cipher (%d)",
3974 sm->pairwise_cipher);
3975 return -1;
3976 }
3977 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
3978 RSN_SELECTOR_PUT(pos, wpa_cipher_to_suite(WPA_PROTO_RSN,
3979 sm->pairwise_cipher));
3980
3981 /* Authenticated Key Management Suite Count */
3982 wpabuf_put_le16(buf, 1);
3983
3984 /* Authenticated Key Management Suite List */
3985 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
3986 if (sm->key_mgmt == WPA_KEY_MGMT_FT_FILS_SHA256)
3987 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_FILS_SHA256);
3988 else if (sm->key_mgmt == WPA_KEY_MGMT_FT_FILS_SHA384)
3989 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_FILS_SHA384);
3990 else {
3991 wpa_printf(MSG_WARNING,
3992 "FILS+FT: Invalid key management type (%d)",
3993 sm->key_mgmt);
3994 return -1;
3995 }
3996
3997 /* RSN Capabilities */
3998 capab = 0;
7d440a3b
JM		 3999 if (sm->mgmt_group_cipher == WPA_CIPHER_AES_128_CMAC)
4000 capab |= WPA_CAPABILITY_MFPC;
55c12f5d
MV		 4001 if (sm->ocv)
4002 capab |= WPA_CAPABILITY_OCVC;
7d440a3b
JM		 4003 wpabuf_put_le16(buf, capab);
4004
4005 /* PMKID Count */
4006 wpabuf_put_le16(buf, 1);
4007
4008 /* PMKID List [PMKR1Name] */
4009 wpa_hexdump_key(MSG_DEBUG, "FILS+FT: XXKey (FILS-FT)",
4010 sm->fils_ft, sm->fils_ft_len);
4011 wpa_hexdump_ascii(MSG_DEBUG, "FILS+FT: SSID", sm->ssid, sm->ssid_len);
4012 wpa_hexdump(MSG_DEBUG, "FILS+FT: MDID",
4013 sm->mobility_domain, MOBILITY_DOMAIN_ID_LEN);
4014 wpa_hexdump_ascii(MSG_DEBUG, "FILS+FT: R0KH-ID",
4015 sm->r0kh_id, sm->r0kh_id_len);
4016 if (wpa_derive_pmk_r0(sm->fils_ft, sm->fils_ft_len, sm->ssid,
4017 sm->ssid_len, sm->mobility_domain,
4018 sm->r0kh_id, sm->r0kh_id_len, sm->own_addr,
994eac7e 4019 sm->pmk_r0, sm->pmk_r0_name, use_sha384) < 0) {
7d440a3b
JM		 4020 wpa_printf(MSG_WARNING, "FILS+FT: Could not derive PMK-R0");
4021 return -1;
4022 }
994eac7e
JM		 4023 sm->pmk_r0_len = use_sha384 ? SHA384_MAC_LEN : PMK_LEN;
4024 wpa_hexdump_key(MSG_DEBUG, "FILS+FT: PMK-R0",
4025 sm->pmk_r0, sm->pmk_r0_len);
7d440a3b
JM		 4026 wpa_hexdump(MSG_DEBUG, "FILS+FT: PMKR0Name",
4027 sm->pmk_r0_name, WPA_PMK_NAME_LEN);
4028 wpa_printf(MSG_DEBUG, "FILS+FT: R1KH-ID: " MACSTR,
4029 MAC2STR(sm->r1kh_id));
4030 pos = wpabuf_put(buf, WPA_PMK_NAME_LEN);
4031 if (wpa_derive_pmk_r1_name(sm->pmk_r0_name, sm->r1kh_id, sm->own_addr,
b5e57699 4032 sm->pmk_r1_name, use_sha384) < 0) {
7d440a3b
JM		 4033 wpa_printf(MSG_WARNING, "FILS+FT: Could not derive PMKR1Name");
4034 return -1;
4035 }
b5e57699
JM		 4036 wpa_hexdump(MSG_DEBUG, "FILS+FT: PMKR1Name", sm->pmk_r1_name,
4037 WPA_PMK_NAME_LEN);
4038 os_memcpy(pos, sm->pmk_r1_name, WPA_PMK_NAME_LEN);
7d440a3b 4039
7d440a3b
JM		 4040 if (sm->mgmt_group_cipher == WPA_CIPHER_AES_128_CMAC) {
4041 /* Management Group Cipher Suite */
4042 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
4043 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC);
4044 }
7d440a3b
JM		 4045
4046 rsnie->len = ((u8 *) wpabuf_put(buf, 0) - (u8 *) rsnie) - 2;
4047 return 0;
4048}
4049#endif /* CONFIG_IEEE80211R */
4050
4051
86cd6928
JM		 4052struct wpabuf * fils_build_assoc_req(struct wpa_sm *sm, const u8 **kek,
4053 size_t *kek_len, const u8 **snonce,
5732b770
JM		 4054 const u8 **anonce,
4055 const struct wpabuf **hlp,
4056 unsigned int num_hlp)
86cd6928
JM		 4057{
4058 struct wpabuf *buf;
5732b770
JM		 4059 size_t len;
4060 unsigned int i;
86cd6928 4061
5732b770 4062 len = 1000;
7d440a3b
JM		 4063#ifdef CONFIG_IEEE80211R
4064 if (sm->fils_ft_ies)
4065 len += wpabuf_len(sm->fils_ft_ies);
4066 if (wpa_key_mgmt_ft(sm->key_mgmt))
4067 len += 256;
4068#endif /* CONFIG_IEEE80211R */
5732b770
JM		 4069 for (i = 0; hlp && i < num_hlp; i++)
4070 len += 10 + wpabuf_len(hlp[i]);
4071 buf = wpabuf_alloc(len);
86cd6928
JM		 4072 if (!buf)
4073 return NULL;
4074
7d440a3b
JM		 4075#ifdef CONFIG_IEEE80211R
4076 if (wpa_key_mgmt_ft(sm->key_mgmt) && sm->fils_ft_ies) {
4077 /* MDE and FTE when using FILS+FT */
4078 wpabuf_put_buf(buf, sm->fils_ft_ies);
4079 /* RSNE with PMKR1Name in PMKID field */
4080 if (fils_ft_build_assoc_req_rsne(sm, buf) < 0) {
4081 wpabuf_free(buf);
4082 return NULL;
4083 }
4084 }
4085#endif /* CONFIG_IEEE80211R */
4086
86cd6928
JM		 4087 /* FILS Session */
4088 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
4089 wpabuf_put_u8(buf, 1 + FILS_SESSION_LEN); /* Length */
4090 /* Element ID Extension */
4091 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_SESSION);
4092 wpabuf_put_data(buf, sm->fils_session, FILS_SESSION_LEN);
4093
4094 /* Everything after FILS Session element gets encrypted in the driver
4095 * with KEK. The buffer returned from here is the plaintext version. */
4096
4097 /* TODO: FILS Public Key */
4098
4099 /* FILS Key Confirm */
4100 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
4101 wpabuf_put_u8(buf, 1 + sm->fils_key_auth_len); /* Length */
4102 /* Element ID Extension */
4103 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_KEY_CONFIRM);
4104 wpabuf_put_data(buf, sm->fils_key_auth_sta, sm->fils_key_auth_len);
4105
5732b770
JM		 4106 /* FILS HLP Container */
4107 for (i = 0; hlp && i < num_hlp; i++) {
4108 const u8 *pos = wpabuf_head(hlp[i]);
4109 size_t left = wpabuf_len(hlp[i]);
4110
4111 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
4112 if (left <= 254)
4113 len = 1 + left;
4114 else
4115 len = 255;
4116 wpabuf_put_u8(buf, len); /* Length */
4117 /* Element ID Extension */
4118 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_HLP_CONTAINER);
4119 /* Destination MAC Address, Source MAC Address, HLP Packet.
4120 * HLP Packet is in MSDU format (i.e., included the LLC/SNAP
4121 * header when LPD is used). */
4122 wpabuf_put_data(buf, pos, len - 1);
4123 pos += len - 1;
4124 left -= len - 1;
4125 while (left) {
4126 wpabuf_put_u8(buf, WLAN_EID_FRAGMENT);
4127 len = left > 255 ? 255 : left;
4128 wpabuf_put_u8(buf, len);
4129 wpabuf_put_data(buf, pos, len);
4130 pos += len;
4131 left -= len;
4132 }
4133 }
86cd6928
JM		 4134
4135 /* TODO: FILS IP Address Assignment */
4136
99621dc1
MV		 4137#ifdef CONFIG_OCV
4138 if (wpa_sm_ocv_enabled(sm)) {
4139 struct wpa_channel_info ci;
4140 u8 *pos;
4141
4142 if (wpa_sm_channel_info(sm, &ci) != 0) {
4143 wpa_printf(MSG_WARNING,
4144 "FILS: Failed to get channel info for OCI element");
4145 wpabuf_free(buf);
4146 return NULL;
4147 }
4148
4149 pos = wpabuf_put(buf, OCV_OCI_EXTENDED_LEN);
4150 if (ocv_insert_extended_oci(&ci, pos) < 0) {
4151 wpabuf_free(buf);
4152 return NULL;
4153 }
4154 }
4155#endif /* CONFIG_OCV */
4156
86cd6928
JM		 4157 wpa_hexdump_buf(MSG_DEBUG, "FILS: Association Request plaintext", buf);
4158
4159 *kek = sm->ptk.kek;
4160 *kek_len = sm->ptk.kek_len;
4161 wpa_hexdump_key(MSG_DEBUG, "FILS: KEK for AEAD", *kek, *kek_len);
4162 *snonce = sm->fils_nonce;
4163 wpa_hexdump(MSG_DEBUG, "FILS: SNonce for AEAD AAD",
4164 *snonce, FILS_NONCE_LEN);
4165 *anonce = sm->fils_anonce;
4166 wpa_hexdump(MSG_DEBUG, "FILS: ANonce for AEAD AAD",
4167 *anonce, FILS_NONCE_LEN);
4168
4169 return buf;
4170}
4171
706df429 4172
124ddfa1
JM		 4173static void fils_process_hlp_resp(struct wpa_sm *sm, const u8 *resp, size_t len)
4174{
4175 const u8 *pos, *end;
4176
4177 wpa_hexdump(MSG_MSGDUMP, "FILS: HLP response", resp, len);
4178 if (len < 2 * ETH_ALEN)
4179 return;
4180 pos = resp + 2 * ETH_ALEN;
4181 end = resp + len;
4182 if (end - pos >= 6 &&
4183 os_memcmp(pos, "\xaa\xaa\x03\x00\x00\x00", 6) == 0)
4184 pos += 6; /* Remove SNAP/LLC header */
4185 wpa_sm_fils_hlp_rx(sm, resp, resp + ETH_ALEN, pos, end - pos);
4186}
4187
4188
4189static void fils_process_hlp_container(struct wpa_sm *sm, const u8 *pos,
4190 size_t len)
4191{
4192 const u8 *end = pos + len;
4193 u8 *tmp, *tmp_pos;
4194
4195 /* Check if there are any FILS HLP Container elements */
4196 while (end - pos >= 2) {
4197 if (2 + pos[1] > end - pos)
4198 return;
4199 if (pos[0] == WLAN_EID_EXTENSION &&
4200 pos[1] >= 1 + 2 * ETH_ALEN &&
4201 pos[2] == WLAN_EID_EXT_FILS_HLP_CONTAINER)
4202 break;
4203 pos += 2 + pos[1];
4204 }
4205 if (end - pos < 2)
4206 return; /* No FILS HLP Container elements */
4207
4208 tmp = os_malloc(end - pos);
4209 if (!tmp)
4210 return;
4211
4212 while (end - pos >= 2) {
4213 if (2 + pos[1] > end - pos ||
4214 pos[0] != WLAN_EID_EXTENSION ||
4215 pos[1] < 1 + 2 * ETH_ALEN ||
4216 pos[2] != WLAN_EID_EXT_FILS_HLP_CONTAINER)
4217 break;
4218 tmp_pos = tmp;
4219 os_memcpy(tmp_pos, pos + 3, pos[1] - 1);
4220 tmp_pos += pos[1] - 1;
4221 pos += 2 + pos[1];
4222
4223 /* Add possible fragments */
4224 while (end - pos >= 2 && pos[0] == WLAN_EID_FRAGMENT &&
4225 2 + pos[1] <= end - pos) {
4226 os_memcpy(tmp_pos, pos + 2, pos[1]);
4227 tmp_pos += pos[1];
4228 pos += 2 + pos[1];
4229 }
4230
4231 fils_process_hlp_resp(sm, tmp, tmp_pos - tmp);
4232 }
4233
4234 os_free(tmp);
4235}
4236
4237
706df429
JM		 4238int fils_process_assoc_resp(struct wpa_sm *sm, const u8 *resp, size_t len)
4239{
4240 const struct ieee80211_mgmt *mgmt;
4241 const u8 *end, *ie_start;
4242 struct ieee802_11_elems elems;
4243 int keylen, rsclen;
4244 enum wpa_alg alg;
4245 struct wpa_gtk_data gd;
4246 int maxkeylen;
4247 struct wpa_eapol_ie_parse kde;
4248
4249 if (!sm || !sm->ptk_set) {
4250 wpa_printf(MSG_DEBUG, "FILS: No KEK available");
4251 return -1;
4252 }
4253
4254 if (!wpa_key_mgmt_fils(sm->key_mgmt)) {
4255 wpa_printf(MSG_DEBUG, "FILS: Not a FILS AKM");
4256 return -1;
4257 }
4258
e7608511
JM		 4259 if (sm->fils_completed) {
4260 wpa_printf(MSG_DEBUG,
4261 "FILS: Association has already been completed for this FILS authentication - ignore unexpected retransmission");
4262 return -1;
4263 }
4264
706df429
JM		 4265 wpa_hexdump(MSG_DEBUG, "FILS: (Re)Association Response frame",
4266 resp, len);
4267
4268 mgmt = (const struct ieee80211_mgmt *) resp;
4269 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.assoc_resp))
4270 return -1;
4271
4272 end = resp + len;
4273 /* Same offset for Association Response and Reassociation Response */
4274 ie_start = mgmt->u.assoc_resp.variable;
4275
4276 if (ieee802_11_parse_elems(ie_start, end - ie_start, &elems, 1) ==
4277 ParseFailed) {
4278 wpa_printf(MSG_DEBUG,
4279 "FILS: Failed to parse decrypted elements");
4280 goto fail;
4281 }
4282
4283 if (!elems.fils_session) {
4284 wpa_printf(MSG_DEBUG, "FILS: No FILS Session element");
4285 return -1;
4286 }
4287 if (os_memcmp(elems.fils_session, sm->fils_session,
4288 FILS_SESSION_LEN) != 0) {
4289 wpa_printf(MSG_DEBUG, "FILS: FILS Session mismatch");
4290 wpa_hexdump(MSG_DEBUG, "FILS: Received FILS Session",
4291 elems.fils_session, FILS_SESSION_LEN);
4292 wpa_hexdump(MSG_DEBUG, "FILS: Expected FILS Session",
4293 sm->fils_session, FILS_SESSION_LEN);
4294 }
4295
69afb6b3
JM		 4296 if (!elems.rsn_ie) {
4297 wpa_printf(MSG_DEBUG,
4298 "FILS: No RSNE in (Re)Association Response");
4299 /* As an interop workaround, allow this for now since IEEE Std
4300 * 802.11ai-2016 did not include all the needed changes to make
4301 * a FILS AP include RSNE in the frame. This workaround might
4302 * eventually be removed and replaced with rejection (goto fail)
4303 * to follow a strict interpretation of the standard. */
4304 } else if (wpa_compare_rsn_ie(wpa_key_mgmt_ft(sm->key_mgmt),
4305 sm->ap_rsn_ie, sm->ap_rsn_ie_len,
4306 elems.rsn_ie - 2, elems.rsn_ie_len + 2)) {
4307 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
4308 "FILS: RSNE mismatch between Beacon/Probe Response and (Re)Association Response");
4309 wpa_hexdump(MSG_DEBUG, "FILS: RSNE in Beacon/Probe Response",
4310 sm->ap_rsn_ie, sm->ap_rsn_ie_len);
4311 wpa_hexdump(MSG_DEBUG, "FILS: RSNE in (Re)Association Response",
4312 elems.rsn_ie, elems.rsn_ie_len);
4313 goto fail;
4314 }
4315
706df429
JM		 4316 /* TODO: FILS Public Key */
4317
4318 if (!elems.fils_key_confirm) {
4319 wpa_printf(MSG_DEBUG, "FILS: No FILS Key Confirm element");
4320 goto fail;
4321 }
4322 if (elems.fils_key_confirm_len != sm->fils_key_auth_len) {
4323 wpa_printf(MSG_DEBUG,
4324 "FILS: Unexpected Key-Auth length %d (expected %d)",
4325 elems.fils_key_confirm_len,
4326 (int) sm->fils_key_auth_len);
4327 goto fail;
4328 }
4329 if (os_memcmp(elems.fils_key_confirm, sm->fils_key_auth_ap,
4330 sm->fils_key_auth_len) != 0) {
4331 wpa_printf(MSG_DEBUG, "FILS: Key-Auth mismatch");
4332 wpa_hexdump(MSG_DEBUG, "FILS: Received Key-Auth",
4333 elems.fils_key_confirm,
4334 elems.fils_key_confirm_len);
4335 wpa_hexdump(MSG_DEBUG, "FILS: Expected Key-Auth",
4336 sm->fils_key_auth_ap, sm->fils_key_auth_len);
4337 goto fail;
4338 }
4339
99621dc1
MV		 4340#ifdef CONFIG_OCV
4341 if (wpa_sm_ocv_enabled(sm)) {
4342 struct wpa_channel_info ci;
4343
4344 if (wpa_sm_channel_info(sm, &ci) != 0) {
4345 wpa_printf(MSG_WARNING,
4346 "Failed to get channel info to validate received OCI in FILS (Re)Association Response frame");
4347 goto fail;
4348 }
4349
4350 if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
4351 channel_width_to_int(ci.chanwidth),
4352 ci.seg1_idx) != 0) {
4353 wpa_printf(MSG_WARNING, "FILS: %s", ocv_errorstr);
4354 goto fail;
4355 }
4356 }
4357#endif /* CONFIG_OCV */
4358
b5e57699
JM		 4359#ifdef CONFIG_IEEE80211R
4360 if (wpa_key_mgmt_ft(sm->key_mgmt) && sm->fils_ft_ies) {
4361 struct wpa_ie_data rsn;
4362
4363 /* Check that PMKR1Name derived by the AP matches */
4364 if (!elems.rsn_ie ||
4365 wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, elems.rsn_ie_len + 2,
4366 &rsn) < 0 ||
4367 !rsn.pmkid || rsn.num_pmkid != 1 ||
4368 os_memcmp(rsn.pmkid, sm->pmk_r1_name,
4369 WPA_PMK_NAME_LEN) != 0) {
4370 wpa_printf(MSG_DEBUG,
4371 "FILS+FT: No RSNE[PMKR1Name] match in AssocResp");
4372 goto fail;
4373 }
4374 }
4375#endif /* CONFIG_IEEE80211R */
4376
706df429
JM		 4377 /* Key Delivery */
4378 if (!elems.key_delivery) {
4379 wpa_printf(MSG_DEBUG, "FILS: No Key Delivery element");
4380 goto fail;
4381 }
4382
4383 /* Parse GTK and set the key to the driver */
4384 os_memset(&gd, 0, sizeof(gd));
4385 if (wpa_supplicant_parse_ies(elems.key_delivery + WPA_KEY_RSC_LEN,
4386 elems.key_delivery_len - WPA_KEY_RSC_LEN,
4387 &kde) < 0) {
4388 wpa_printf(MSG_DEBUG, "FILS: Failed to parse KDEs");
4389 goto fail;
4390 }
4391 if (!kde.gtk) {
4392 wpa_printf(MSG_DEBUG, "FILS: No GTK KDE");
4393 goto fail;
4394 }
4395 maxkeylen = gd.gtk_len = kde.gtk_len - 2;
4396 if (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
4397 gd.gtk_len, maxkeylen,
4398 &gd.key_rsc_len, &gd.alg))
4399 goto fail;
4400
4401 wpa_hexdump_key(MSG_DEBUG, "FILS: Received GTK", kde.gtk, kde.gtk_len);
4402 gd.keyidx = kde.gtk[0] & 0x3;
4403 gd.tx = wpa_supplicant_gtk_tx_bit_workaround(sm,
4404 !!(kde.gtk[0] & BIT(2)));
4405 if (kde.gtk_len - 2 > sizeof(gd.gtk)) {
4406 wpa_printf(MSG_DEBUG, "FILS: Too long GTK in GTK KDE (len=%lu)",
4407 (unsigned long) kde.gtk_len - 2);
4408 goto fail;
4409 }
4410 os_memcpy(gd.gtk, kde.gtk + 2, kde.gtk_len - 2);
4411
4412 wpa_printf(MSG_DEBUG, "FILS: Set GTK to driver");
87e2db16 4413 if (wpa_supplicant_install_gtk(sm, &gd, elems.key_delivery, 0) < 0) {
706df429
JM		 4414 wpa_printf(MSG_DEBUG, "FILS: Failed to set GTK");
4415 goto fail;
4416 }
4417
4418 if (ieee80211w_set_keys(sm, &kde) < 0) {
4419 wpa_printf(MSG_DEBUG, "FILS: Failed to set IGTK");
4420 goto fail;
4421 }
4422
4423 alg = wpa_cipher_to_alg(sm->pairwise_cipher);
4424 keylen = wpa_cipher_key_len(sm->pairwise_cipher);
a6ea6653
JM		 4425 if (keylen <= 0 || (unsigned int) keylen != sm->ptk.tk_len) {
4426 wpa_printf(MSG_DEBUG, "FILS: TK length mismatch: %u != %lu",
4427 keylen, (long unsigned int) sm->ptk.tk_len);
4428 goto fail;
4429 }
706df429
JM		 4430 rsclen = wpa_cipher_rsc_len(sm->pairwise_cipher);
4431 wpa_hexdump_key(MSG_DEBUG, "FILS: Set TK to driver",
4432 sm->ptk.tk, keylen);
4433 if (wpa_sm_set_key(sm, alg, sm->bssid, 0, 1, null_rsc, rsclen,
4434 sm->ptk.tk, keylen) < 0) {
4435 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
4436 "FILS: Failed to set PTK to the driver (alg=%d keylen=%d bssid="
4437 MACSTR ")",
4438 alg, keylen, MAC2STR(sm->bssid));
4439 goto fail;
4440 }
4441
4442 /* TODO: TK could be cleared after auth frame exchange now that driver
4443 * takes care of association frame encryption/decryption. */
4444 /* TK is not needed anymore in supplicant */
4445 os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
a6ea6653 4446 sm->ptk.tk_len = 0;
53bb18cc 4447 sm->ptk.installed = 1;
706df429 4448
124ddfa1
JM		 4449 /* FILS HLP Container */
4450 fils_process_hlp_container(sm, ie_start, end - ie_start);
706df429
JM		 4451
4452 /* TODO: FILS IP Address Assignment */
4453
4454 wpa_printf(MSG_DEBUG, "FILS: Auth+Assoc completed successfully");
4455 sm->fils_completed = 1;
31bc66e4 4456 forced_memzero(&gd, sizeof(gd));
706df429
JM		 4457
4458 return 0;
4459fail:
31bc66e4 4460 forced_memzero(&gd, sizeof(gd));
706df429
JM		 4461 return -1;
4462}
4463
5538fc93
VK		 4464
4465void wpa_sm_set_reset_fils_completed(struct wpa_sm *sm, int set)
4466{
4467 if (sm)
4468 sm->fils_completed = !!set;
4469}
4470
706df429
JM		 4471#endif /* CONFIG_FILS */
4472
4473
4474int wpa_fils_is_completed(struct wpa_sm *sm)
4475{
4476#ifdef CONFIG_FILS
4477 return sm && sm->fils_completed;
4478#else /* CONFIG_FILS */
4479 return 0;
f00b9b88 4480#endif /* CONFIG_FILS */
706df429 4481}
0a614799
JM		 4482
4483
4484#ifdef CONFIG_OWE
4485
ec9f4837 4486struct wpabuf * owe_build_assoc_req(struct wpa_sm *sm, u16 group)
0a614799
JM		 4487{
4488 struct wpabuf *ie = NULL, *pub = NULL;
ec9f4837
JM		 4489 size_t prime_len;
4490
4491 if (group == 19)
4492 prime_len = 32;
4493 else if (group == 20)
4494 prime_len = 48;
4495 else if (group == 21)
4496 prime_len = 66;
4497 else
4498 return NULL;
0a614799
JM		 4499
4500 crypto_ecdh_deinit(sm->owe_ecdh);
ec9f4837 4501 sm->owe_ecdh = crypto_ecdh_init(group);
0a614799
JM		 4502 if (!sm->owe_ecdh)
4503 goto fail;
ec9f4837 4504 sm->owe_group = group;
0a614799 4505 pub = crypto_ecdh_get_pubkey(sm->owe_ecdh, 0);
ec9f4837 4506 pub = wpabuf_zeropad(pub, prime_len);
0a614799
JM		 4507 if (!pub)
4508 goto fail;
4509
4510 ie = wpabuf_alloc(5 + wpabuf_len(pub));
4511 if (!ie)
4512 goto fail;
4513 wpabuf_put_u8(ie, WLAN_EID_EXTENSION);
4514 wpabuf_put_u8(ie, 1 + 2 + wpabuf_len(pub));
4515 wpabuf_put_u8(ie, WLAN_EID_EXT_OWE_DH_PARAM);
ec9f4837 4516 wpabuf_put_le16(ie, group);
0a614799
JM		 4517 wpabuf_put_buf(ie, pub);
4518 wpabuf_free(pub);
4519 wpa_hexdump_buf(MSG_DEBUG, "OWE: Diffie-Hellman Parameter element",
4520 ie);
4521
4522 return ie;
4523fail:
4524 wpabuf_free(pub);
4525 crypto_ecdh_deinit(sm->owe_ecdh);
4526 sm->owe_ecdh = NULL;
4527 return NULL;
4528}
4529
4530
5a78c361
JM		 4531int owe_process_assoc_resp(struct wpa_sm *sm, const u8 *bssid,
4532 const u8 *resp_ies, size_t resp_ies_len)
0a614799
JM		 4533{
4534 struct ieee802_11_elems elems;
4535 u16 group;
4536 struct wpabuf *secret, *pub, *hkey;
4537 int res;
ec9f4837 4538 u8 prk[SHA512_MAC_LEN], pmkid[SHA512_MAC_LEN];
0a614799
JM		 4539 const char *info = "OWE Key Generation";
4540 const u8 *addr[2];
4541 size_t len[2];
ec9f4837 4542 size_t hash_len, prime_len;
5a78c361 4543 struct wpa_ie_data data;
0a614799
JM		 4544
4545 if (!resp_ies ||
4546 ieee802_11_parse_elems(resp_ies, resp_ies_len, &elems, 1) ==
5a78c361
JM		 4547 ParseFailed) {
4548 wpa_printf(MSG_INFO,
4549 "OWE: Could not parse Association Response frame elements");
4550 return -1;
4551 }
4552
4553 if (sm->cur_pmksa && elems.rsn_ie &&
4554 wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, 2 + elems.rsn_ie_len,
4555 &data) == 0 &&
4556 data.num_pmkid == 1 && data.pmkid &&
4557 os_memcmp(sm->cur_pmksa->pmkid, data.pmkid, PMKID_LEN) == 0) {
4558 wpa_printf(MSG_DEBUG, "OWE: Use PMKSA caching");
4559 wpa_sm_set_pmk_from_pmksa(sm);
4560 return 0;
4561 }
4562
4563 if (!elems.owe_dh) {
0a614799
JM		 4564 wpa_printf(MSG_INFO,
4565 "OWE: No Diffie-Hellman Parameter element found in Association Response frame");
4566 return -1;
4567 }
4568
4569 group = WPA_GET_LE16(elems.owe_dh);
ec9f4837 4570 if (group != sm->owe_group) {
0a614799
JM		 4571 wpa_printf(MSG_INFO,
4572 "OWE: Unexpected Diffie-Hellman group in response: %u",
4573 group);
4574 return -1;
4575 }
4576
4577 if (!sm->owe_ecdh) {
4578 wpa_printf(MSG_INFO, "OWE: No ECDH state available");
4579 return -1;
4580 }
4581
ec9f4837
JM		 4582 if (group == 19)
4583 prime_len = 32;
4584 else if (group == 20)
4585 prime_len = 48;
4586 else if (group == 21)
4587 prime_len = 66;
4588 else
4589 return -1;
4590
0a614799
JM		 4591 secret = crypto_ecdh_set_peerkey(sm->owe_ecdh, 0,
4592 elems.owe_dh + 2,
4593 elems.owe_dh_len - 2);
ec9f4837 4594 secret = wpabuf_zeropad(secret, prime_len);
0a614799
JM		 4595 if (!secret) {
4596 wpa_printf(MSG_DEBUG, "OWE: Invalid peer DH public key");
4597 return -1;
4598 }
4599 wpa_hexdump_buf_key(MSG_DEBUG, "OWE: DH shared secret", secret);
4600
4601 /* prk = HKDF-extract(C | A | group, z) */
4602
4603 pub = crypto_ecdh_get_pubkey(sm->owe_ecdh, 0);
4604 if (!pub) {
4605 wpabuf_clear_free(secret);
4606 return -1;
4607 }
4608
4609 /* PMKID = Truncate-128(Hash(C | A)) */
4610 addr[0] = wpabuf_head(pub);
4611 len[0] = wpabuf_len(pub);
4612 addr[1] = elems.owe_dh + 2;
4613 len[1] = elems.owe_dh_len - 2;
ec9f4837
JM		 4614 if (group == 19) {
4615 res = sha256_vector(2, addr, len, pmkid);
4616 hash_len = SHA256_MAC_LEN;
4617 } else if (group == 20) {
4618 res = sha384_vector(2, addr, len, pmkid);
4619 hash_len = SHA384_MAC_LEN;
4620 } else if (group == 21) {
4621 res = sha512_vector(2, addr, len, pmkid);
4622 hash_len = SHA512_MAC_LEN;
4623 } else {
4624 res = -1;
4625 hash_len = 0;
4626 }
4627 pub = wpabuf_zeropad(pub, prime_len);
4628 if (res < 0 || !pub) {
0a614799
JM		 4629 wpabuf_free(pub);
4630 wpabuf_clear_free(secret);
4631 return -1;
4632 }
4633
4634 hkey = wpabuf_alloc(wpabuf_len(pub) + elems.owe_dh_len - 2 + 2);
4635 if (!hkey) {
4636 wpabuf_free(pub);
4637 wpabuf_clear_free(secret);
4638 return -1;
4639 }
4640
4641 wpabuf_put_buf(hkey, pub); /* C */
4642 wpabuf_free(pub);
4643 wpabuf_put_data(hkey, elems.owe_dh + 2, elems.owe_dh_len - 2); /* A */
ec9f4837
JM		 4644 wpabuf_put_le16(hkey, sm->owe_group); /* group */
4645 if (group == 19)
4646 res = hmac_sha256(wpabuf_head(hkey), wpabuf_len(hkey),
4647 wpabuf_head(secret), wpabuf_len(secret), prk);
4648 else if (group == 20)
4649 res = hmac_sha384(wpabuf_head(hkey), wpabuf_len(hkey),
4650 wpabuf_head(secret), wpabuf_len(secret), prk);
4651 else if (group == 21)
4652 res = hmac_sha512(wpabuf_head(hkey), wpabuf_len(hkey),
4653 wpabuf_head(secret), wpabuf_len(secret), prk);
0a614799
JM		 4654 wpabuf_clear_free(hkey);
4655 wpabuf_clear_free(secret);
4656 if (res < 0)
4657 return -1;
4658
ec9f4837 4659 wpa_hexdump_key(MSG_DEBUG, "OWE: prk", prk, hash_len);
0a614799
JM		 4660
4661 /* PMK = HKDF-expand(prk, "OWE Key Generation", n) */
4662
ec9f4837
JM		 4663 if (group == 19)
4664 res = hmac_sha256_kdf(prk, hash_len, NULL, (const u8 *) info,
4665 os_strlen(info), sm->pmk, hash_len);
4666 else if (group == 20)
4667 res = hmac_sha384_kdf(prk, hash_len, NULL, (const u8 *) info,
4668 os_strlen(info), sm->pmk, hash_len);
4669 else if (group == 21)
4670 res = hmac_sha512_kdf(prk, hash_len, NULL, (const u8 *) info,
4671 os_strlen(info), sm->pmk, hash_len);
31bc66e4 4672 forced_memzero(prk, SHA512_MAC_LEN);
1bd13110
JM		 4673 if (res < 0) {
4674 sm->pmk_len = 0;
0a614799 4675 return -1;
1bd13110 4676 }
ec9f4837 4677 sm->pmk_len = hash_len;
0a614799 4678
ec9f4837 4679 wpa_hexdump_key(MSG_DEBUG, "OWE: PMK", sm->pmk, sm->pmk_len);
0a614799 4680 wpa_hexdump(MSG_DEBUG, "OWE: PMKID", pmkid, PMKID_LEN);
5a78c361
JM		 4681 pmksa_cache_add(sm->pmksa, sm->pmk, sm->pmk_len, pmkid, NULL, 0,
4682 bssid, sm->own_addr, sm->network_ctx, sm->key_mgmt,
4683 NULL);
0a614799
JM		 4684
4685 return 0;
4686}
4687
4688#endif /* CONFIG_OWE */
bbe7969d
VK		 4689
4690
4691void wpa_sm_set_fils_cache_id(struct wpa_sm *sm, const u8 *fils_cache_id)
4692{
4693#ifdef CONFIG_FILS
4694 if (sm && fils_cache_id) {
4695 sm->fils_cache_id_set = 1;
4696 os_memcpy(sm->fils_cache_id, fils_cache_id, FILS_CACHE_ID_LEN);
4697 }
4698#endif /* CONFIG_FILS */
4699}
10ec6a5f
JM		 4700
4701
4702#ifdef CONFIG_DPP2
4703void wpa_sm_set_dpp_z(struct wpa_sm *sm, const struct wpabuf *z)
4704{
4705 if (sm) {
4706 wpabuf_clear_free(sm->dpp_z);
4707 sm->dpp_z = z ? wpabuf_dup(z) : NULL;
4708 }
4709}
4710#endif /* CONFIG_DPP2 */
Unnamed repository; edit this file 'description' to name the repository.