]> git.ipfire.org Git - thirdparty/hostap.git/blame - src/rsn_supp/wpa.c
projects / thirdparty / hostap.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Check against integer overflow in int_array functions
[thirdparty/hostap.git] / src / rsn_supp / wpa.c
CommitLineData
6fc6879b
JM		 1/*
2 * WPA Supplicant - WPA state machine and EAPOL-Key processing
a3e18dbb 3 * Copyright (c) 2003-2018, Jouni Malinen <j@w1.fi>
73ed03f3 4 * Copyright(c) 2015 Intel Deutschland GmbH
6fc6879b 5 *
0f3d578e
JM		 6 * This software may be distributed under the terms of the BSD license.
7 * See README for more details.
6fc6879b
JM		 8 */
9
10#include "includes.h"
11
12#include "common.h"
2022f1d0 13#include "crypto/aes.h"
03da66bd
JM		 14#include "crypto/aes_wrap.h"
15#include "crypto/crypto.h"
3642c431 16#include "crypto/random.h"
2022f1d0 17#include "crypto/aes_siv.h"
0a614799 18#include "crypto/sha256.h"
ec9f4837
JM		 19#include "crypto/sha384.h"
20#include "crypto/sha512.h"
03da66bd 21#include "common/ieee802_11_defs.h"
a6609937 22#include "common/ieee802_11_common.h"
17c2559c 23#include "common/ocv.h"
fcd3d6ce 24#include "eap_common/eap_defs.h"
03da66bd 25#include "eapol_supp/eapol_supp_sm.h"
17c2559c 26#include "drivers/driver.h"
6fc6879b
JM		 27#include "wpa.h"
28#include "eloop.h"
6fc6879b
JM		 29#include "preauth.h"
30#include "pmksa_cache.h"
31#include "wpa_i.h"
32#include "wpa_ie.h"
6fc6879b
JM		 33
34
73ed03f3
MS		 35static const u8 null_rsc[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
36
37
6fc6879b
JM		 38/**
39 * wpa_eapol_key_send - Send WPA/RSN EAPOL-Key message
40 * @sm: Pointer to WPA state machine data from wpa_sm_init()
1049af7e 41 * @ptk: PTK for Key Confirmation/Encryption Key
6fc6879b
JM		 42 * @ver: Version field from Key Info
43 * @dest: Destination address for the frame
44 * @proto: Ethertype (usually ETH_P_EAPOL)
45 * @msg: EAPOL-Key message
46 * @msg_len: Length of message
47 * @key_mic: Pointer to the buffer to which the EAPOL-Key MIC is written
c93b7e18 48 * Returns: >= 0 on success, < 0 on failure
6fc6879b 49 */
1049af7e 50int wpa_eapol_key_send(struct wpa_sm *sm, struct wpa_ptk *ptk,
c93b7e18
AA		 51 int ver, const u8 *dest, u16 proto,
52 u8 *msg, size_t msg_len, u8 *key_mic)
6fc6879b 53{
c93b7e18 54 int ret = -1;
567da5bb 55 size_t mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
98cd3d1c 56
ef9627cb
JM		 57 wpa_printf(MSG_DEBUG, "WPA: Send EAPOL-Key frame to " MACSTR
58 " ver=%d mic_len=%d key_mgmt=0x%x",
59 MAC2STR(dest), ver, (int) mic_len, sm->key_mgmt);
a8e16edc 60 if (is_zero_ether_addr(dest) && is_zero_ether_addr(sm->bssid)) {
6fc6879b
JM		 61 /*
62 * Association event was not yet received; try to fetch
63 * BSSID from the driver.
64 */
65 if (wpa_sm_get_bssid(sm, sm->bssid) < 0) {
f049052b
BG		 66 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
67 "WPA: Failed to read BSSID for "
68 "EAPOL-Key destination address");
6fc6879b
JM		 69 } else {
70 dest = sm->bssid;
f049052b
BG		 71 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
72 "WPA: Use BSSID (" MACSTR
73 ") as the destination for EAPOL-Key",
74 MAC2STR(dest));
6fc6879b
JM		 75 }
76 }
2022f1d0
JM		 77
78 if (mic_len) {
79 if (key_mic && (!ptk || !ptk->kck_len))
80 goto out;
81
82 if (key_mic &&
83 wpa_eapol_key_mic(ptk->kck, ptk->kck_len, sm->key_mgmt, ver,
84 msg, msg_len, key_mic)) {
85 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
86 "WPA: Failed to generate EAPOL-Key version %d key_mgmt 0x%x MIC",
87 ver, sm->key_mgmt);
88 goto out;
89 }
28fb9bb1
JM		 90 if (ptk)
91 wpa_hexdump_key(MSG_DEBUG, "WPA: KCK",
92 ptk->kck, ptk->kck_len);
2022f1d0
JM		 93 wpa_hexdump(MSG_DEBUG, "WPA: Derived Key MIC",
94 key_mic, mic_len);
95 } else {
96#ifdef CONFIG_FILS
97 /* AEAD cipher - Key MIC field not used */
98 struct ieee802_1x_hdr *s_hdr, *hdr;
99 struct wpa_eapol_key *s_key, *key;
100 u8 *buf, *s_key_data, *key_data;
101 size_t buf_len = msg_len + AES_BLOCK_SIZE;
102 size_t key_data_len;
103 u16 eapol_len;
104 const u8 *aad[1];
105 size_t aad_len[1];
106
107 if (!ptk || !ptk->kek_len)
108 goto out;
109
110 key_data_len = msg_len - sizeof(struct ieee802_1x_hdr) -
111 sizeof(struct wpa_eapol_key) - 2;
112
113 buf = os_malloc(buf_len);
114 if (!buf)
115 goto out;
116
117 os_memcpy(buf, msg, msg_len);
118 hdr = (struct ieee802_1x_hdr *) buf;
119 key = (struct wpa_eapol_key *) (hdr + 1);
120 key_data = ((u8 *) (key + 1)) + 2;
121
122 /* Update EAPOL header to include AES-SIV overhead */
123 eapol_len = be_to_host16(hdr->length);
124 eapol_len += AES_BLOCK_SIZE;
125 hdr->length = host_to_be16(eapol_len);
126
127 /* Update Key Data Length field to include AES-SIV overhead */
128 WPA_PUT_BE16((u8 *) (key + 1), AES_BLOCK_SIZE + key_data_len);
129
130 s_hdr = (struct ieee802_1x_hdr *) msg;
131 s_key = (struct wpa_eapol_key *) (s_hdr + 1);
132 s_key_data = ((u8 *) (s_key + 1)) + 2;
133
134 wpa_hexdump_key(MSG_DEBUG, "WPA: Plaintext Key Data",
135 s_key_data, key_data_len);
136
137 wpa_hexdump_key(MSG_DEBUG, "WPA: KEK", ptk->kek, ptk->kek_len);
138 /* AES-SIV AAD from EAPOL protocol version field (inclusive) to
139 * to Key Data (exclusive). */
140 aad[0] = buf;
141 aad_len[0] = key_data - buf;
142 if (aes_siv_encrypt(ptk->kek, ptk->kek_len,
143 s_key_data, key_data_len,
144 1, aad, aad_len, key_data) < 0) {
145 os_free(buf);
146 goto out;
147 }
148
149 wpa_hexdump(MSG_DEBUG, "WPA: Encrypted Key Data from SIV",
150 key_data, AES_BLOCK_SIZE + key_data_len);
151
152 os_free(msg);
153 msg = buf;
154 msg_len = buf_len;
155#else /* CONFIG_FILS */
04b6b3ed 156 goto out;
2022f1d0 157#endif /* CONFIG_FILS */
04b6b3ed 158 }
2022f1d0 159
6fc6879b 160 wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key", msg, msg_len);
c93b7e18 161 ret = wpa_sm_ether_send(sm, dest, proto, msg, msg_len);
6fc6879b 162 eapol_sm_notify_tx_eapol_key(sm->eapol);
04b6b3ed 163out:
6fc6879b 164 os_free(msg);
c93b7e18 165 return ret;
6fc6879b
JM		 166}
167
168
169/**
170 * wpa_sm_key_request - Send EAPOL-Key Request
171 * @sm: Pointer to WPA state machine data from wpa_sm_init()
172 * @error: Indicate whether this is an Michael MIC error report
173 * @pairwise: 1 = error report for pairwise packet, 0 = for group packet
6fc6879b
JM		 174 *
175 * Send an EAPOL-Key Request to the current authenticator. This function is
176 * used to request rekeying and it is usually called when a local Michael MIC
177 * failure is detected.
178 */
179void wpa_sm_key_request(struct wpa_sm *sm, int error, int pairwise)
180{
5e3b5197 181 size_t mic_len, hdrlen, rlen;
6fc6879b
JM		 182 struct wpa_eapol_key *reply;
183 int key_info, ver;
6d014ffc 184 u8 bssid[ETH_ALEN], *rbuf, *key_mic, *mic;
6fc6879b 185
1f90a49d
AW		 186 if (pairwise && sm->wpa_deny_ptk0_rekey &&
187 wpa_sm_get_state(sm) == WPA_COMPLETED) {
188 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
189 "WPA: PTK0 rekey not allowed, reconnecting");
190 wpa_sm_reconnect(sm);
191 return;
192 }
193
4bc801ab 194 if (wpa_use_akm_defined(sm->key_mgmt))
df0f01d9
JM		 195 ver = WPA_KEY_INFO_TYPE_AKM_DEFINED;
196 else if (wpa_key_mgmt_ft(sm->key_mgmt) ||
197 wpa_key_mgmt_sha256(sm->key_mgmt))
6fc6879b 198 ver = WPA_KEY_INFO_TYPE_AES_128_CMAC;
eb7719ff 199 else if (sm->pairwise_cipher != WPA_CIPHER_TKIP)
6fc6879b
JM		 200 ver = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES;
201 else
202 ver = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4;
203
204 if (wpa_sm_get_bssid(sm, bssid) < 0) {
f049052b
BG		 205 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
206 "Failed to read BSSID for EAPOL-Key request");
6fc6879b
JM		 207 return;
208 }
209
567da5bb 210 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
6d014ffc 211 hdrlen = sizeof(*reply) + mic_len + 2;
6fc6879b 212 rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
5e3b5197 213 hdrlen, &rlen, (void *) &reply);
6fc6879b
JM		 214 if (rbuf == NULL)
215 return;
216
a14896e8
JM		 217 reply->type = (sm->proto == WPA_PROTO_RSN ||
218 sm->proto == WPA_PROTO_OSEN) ?
6fc6879b
JM		 219 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
220 key_info = WPA_KEY_INFO_REQUEST | ver;
221 if (sm->ptk_set)
4a26ccda
JM		 222 key_info |= WPA_KEY_INFO_SECURE;
223 if (sm->ptk_set && mic_len)
224 key_info |= WPA_KEY_INFO_MIC;
6fc6879b
JM		 225 if (error)
226 key_info |= WPA_KEY_INFO_ERROR;
227 if (pairwise)
228 key_info |= WPA_KEY_INFO_KEY_TYPE;
229 WPA_PUT_BE16(reply->key_info, key_info);
230 WPA_PUT_BE16(reply->key_length, 0);
231 os_memcpy(reply->replay_counter, sm->request_counter,
232 WPA_REPLAY_COUNTER_LEN);
233 inc_byte_array(sm->request_counter, WPA_REPLAY_COUNTER_LEN);
234
6d014ffc
JM		 235 mic = (u8 *) (reply + 1);
236 WPA_PUT_BE16(mic + mic_len, 0);
5e3b5197
JM		 237 if (!(key_info & WPA_KEY_INFO_MIC))
238 key_mic = NULL;
239 else
6d014ffc 240 key_mic = mic;
6fc6879b 241
f049052b
BG		 242 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
243 "WPA: Sending EAPOL-Key Request (error=%d "
244 "pairwise=%d ptk_set=%d len=%lu)",
245 error, pairwise, sm->ptk_set, (unsigned long) rlen);
1049af7e
JM		 246 wpa_eapol_key_send(sm, &sm->ptk, ver, bssid, ETH_P_EAPOL, rbuf, rlen,
247 key_mic);
6fc6879b
JM		 248}
249
250
b41f2684
CL		 251static void wpa_supplicant_key_mgmt_set_pmk(struct wpa_sm *sm)
252{
253#ifdef CONFIG_IEEE80211R
254 if (sm->key_mgmt == WPA_KEY_MGMT_FT_IEEE8021X) {
255 if (wpa_sm_key_mgmt_set_pmk(sm, sm->xxkey, sm->xxkey_len))
256 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
257 "RSN: Cannot set low order 256 bits of MSK for key management offload");
258 } else {
259#endif /* CONFIG_IEEE80211R */
260 if (wpa_sm_key_mgmt_set_pmk(sm, sm->pmk, sm->pmk_len))
261 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
262 "RSN: Cannot set PMK for key management offload");
263#ifdef CONFIG_IEEE80211R
264 }
265#endif /* CONFIG_IEEE80211R */
266}
267
268
6fc6879b
JM		 269static int wpa_supplicant_get_pmk(struct wpa_sm *sm,
270 const unsigned char *src_addr,
271 const u8 *pmkid)
272{
273 int abort_cached = 0;
274
275 if (pmkid && !sm->cur_pmksa) {
276 /* When using drivers that generate RSN IE, wpa_supplicant may
277 * not have enough time to get the association information
278 * event before receiving this 1/4 message, so try to find a
279 * matching PMKSA cache entry here. */
96efeeb6 280 sm->cur_pmksa = pmksa_cache_get(sm->pmksa, src_addr, pmkid,
852b2f27 281 NULL, 0);
6fc6879b 282 if (sm->cur_pmksa) {
f049052b
BG		 283 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
284 "RSN: found matching PMKID from PMKSA cache");
6fc6879b 285 } else {
f049052b
BG		 286 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
287 "RSN: no matching PMKID found");
6fc6879b
JM		 288 abort_cached = 1;
289 }
290 }
291
292 if (pmkid && sm->cur_pmksa &&
0d15b69f 293 os_memcmp_const(pmkid, sm->cur_pmksa->pmkid, PMKID_LEN) == 0) {
6fc6879b
JM		 294 wpa_hexdump(MSG_DEBUG, "RSN: matched PMKID", pmkid, PMKID_LEN);
295 wpa_sm_set_pmk_from_pmksa(sm);
296 wpa_hexdump_key(MSG_DEBUG, "RSN: PMK from PMKSA cache",
297 sm->pmk, sm->pmk_len);
298 eapol_sm_notify_cached(sm->eapol);
299#ifdef CONFIG_IEEE80211R
300 sm->xxkey_len = 0;
a03f9d17
JM		 301#ifdef CONFIG_SAE
302 if (sm->key_mgmt == WPA_KEY_MGMT_FT_SAE &&
303 sm->pmk_len == PMK_LEN) {
304 /* Need to allow FT key derivation to proceed with
305 * PMK from SAE being used as the XXKey in cases where
306 * the PMKID in msg 1/4 matches the PMKSA entry that was
307 * just added based on SAE authentication for the
308 * initial mobility domain association. */
309 os_memcpy(sm->xxkey, sm->pmk, sm->pmk_len);
310 sm->xxkey_len = sm->pmk_len;
311 }
312#endif /* CONFIG_SAE */
6fc6879b 313#endif /* CONFIG_IEEE80211R */
56586197 314 } else if (wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt) && sm->eapol) {
6fc6879b 315 int res, pmk_len;
16c51144
JM		 316#ifdef CONFIG_IEEE80211R
317 u8 buf[2 * PMK_LEN];
318#endif /* CONFIG_IEEE80211R */
207976f0 319
834c5d68 320 if (wpa_key_mgmt_sha384(sm->key_mgmt))
207976f0
JM		 321 pmk_len = PMK_LEN_SUITE_B_192;
322 else
323 pmk_len = PMK_LEN;
324 res = eapol_sm_get_key(sm->eapol, sm->pmk, pmk_len);
6fc6879b 325 if (res) {
207976f0
JM		 326 if (pmk_len == PMK_LEN) {
327 /*
328 * EAP-LEAP is an exception from other EAP
329 * methods: it uses only 16-byte PMK.
330 */
331 res = eapol_sm_get_key(sm->eapol, sm->pmk, 16);
332 pmk_len = 16;
333 }
16c51144 334 }
6fc6879b 335#ifdef CONFIG_IEEE80211R
16c51144
JM		 336 if (res == 0 &&
337 eapol_sm_get_key(sm->eapol, buf, 2 * PMK_LEN) == 0) {
338 if (wpa_key_mgmt_sha384(sm->key_mgmt)) {
339 os_memcpy(sm->xxkey, buf, SHA384_MAC_LEN);
340 sm->xxkey_len = SHA384_MAC_LEN;
341 } else {
342 os_memcpy(sm->xxkey, buf + PMK_LEN, PMK_LEN);
343 sm->xxkey_len = PMK_LEN;
344 }
31bc66e4 345 forced_memzero(buf, sizeof(buf));
16c51144
JM		 346 if (sm->proto == WPA_PROTO_RSN &&
347 wpa_key_mgmt_ft(sm->key_mgmt)) {
348 struct rsn_pmksa_cache_entry *sa = NULL;
349 const u8 *fils_cache_id = NULL;
350
351#ifdef CONFIG_FILS
352 if (sm->fils_cache_id_set)
353 fils_cache_id = sm->fils_cache_id;
354#endif /* CONFIG_FILS */
355 wpa_hexdump_key(MSG_DEBUG,
356 "FT: Cache XXKey/MPMK",
357 sm->xxkey, sm->xxkey_len);
358 sa = pmksa_cache_add(sm->pmksa,
359 sm->xxkey, sm->xxkey_len,
360 NULL, NULL, 0,
361 src_addr, sm->own_addr,
362 sm->network_ctx,
363 sm->key_mgmt,
364 fils_cache_id);
365 if (!sm->cur_pmksa)
366 sm->cur_pmksa = sa;
6fc6879b 367 }
6fc6879b 368 }
16c51144 369#endif /* CONFIG_IEEE80211R */
6fc6879b 370 if (res == 0) {
a7f10d65 371 struct rsn_pmksa_cache_entry *sa = NULL;
869af307
JM		 372 const u8 *fils_cache_id = NULL;
373
374#ifdef CONFIG_FILS
375 if (sm->fils_cache_id_set)
376 fils_cache_id = sm->fils_cache_id;
377#endif /* CONFIG_FILS */
378
6fc6879b
JM		 379 wpa_hexdump_key(MSG_DEBUG, "WPA: PMK from EAPOL state "
380 "machines", sm->pmk, pmk_len);
381 sm->pmk_len = pmk_len;
b41f2684 382 wpa_supplicant_key_mgmt_set_pmk(sm);
715ed737 383 if (sm->proto == WPA_PROTO_RSN &&
087a1f4e 384 !wpa_key_mgmt_suite_b(sm->key_mgmt) &&
715ed737 385 !wpa_key_mgmt_ft(sm->key_mgmt)) {
a7f10d65 386 sa = pmksa_cache_add(sm->pmksa,
70c93963 387 sm->pmk, pmk_len, NULL,
087a1f4e 388 NULL, 0,
a7f10d65
JM		 389 src_addr, sm->own_addr,
390 sm->network_ctx,
869af307
JM		 391 sm->key_mgmt,
392 fils_cache_id);
f5a51b58 393 }
6fc6879b 394 if (!sm->cur_pmksa && pmkid &&
852b2f27
JM		 395 pmksa_cache_get(sm->pmksa, src_addr, pmkid, NULL,
396 0)) {
f049052b
BG		 397 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
398 "RSN: the new PMK matches with the "
399 "PMKID");
6fc6879b 400 abort_cached = 0;
bddc51e8
JM		 401 } else if (sa && !sm->cur_pmksa && pmkid) {
402 /*
403 * It looks like the authentication server
404 * derived mismatching MSK. This should not
405 * really happen, but bugs happen.. There is not
406 * much we can do here without knowing what
407 * exactly caused the server to misbehave.
408 */
62417667 409 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
bddc51e8
JM		 410 "RSN: PMKID mismatch - authentication server may have derived different MSK?!");
411 return -1;
6fc6879b 412 }
a7f10d65
JM		 413
414 if (!sm->cur_pmksa)
415 sm->cur_pmksa = sa;
0a1a82db
JM		 416#ifdef CONFIG_IEEE80211R
417 } else if (wpa_key_mgmt_ft(sm->key_mgmt) && sm->ft_protocol) {
418 wpa_printf(MSG_DEBUG,
419 "FT: Continue 4-way handshake without PMK/PMKID for association using FT protocol");
420#endif /* CONFIG_IEEE80211R */
6fc6879b 421 } else {
0f057fb2 422 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
6fc6879b 423 "WPA: Failed to get master session key from "
f049052b
BG		 424 "EAPOL state machines - key handshake "
425 "aborted");
6fc6879b 426 if (sm->cur_pmksa) {
f049052b
BG		 427 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
428 "RSN: Cancelled PMKSA caching "
429 "attempt");
6fc6879b
JM		 430 sm->cur_pmksa = NULL;
431 abort_cached = 1;
1ac2d4a9 432 } else if (!abort_cached) {
6fc6879b
JM		 433 return -1;
434 }
435 }
436 }
437
715ed737 438 if (abort_cached && wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt) &&
087a1f4e 439 !wpa_key_mgmt_suite_b(sm->key_mgmt) &&
a14896e8
JM		 440 !wpa_key_mgmt_ft(sm->key_mgmt) && sm->key_mgmt != WPA_KEY_MGMT_OSEN)
441 {
6fc6879b
JM		 442 /* Send EAPOL-Start to trigger full EAP authentication. */
443 u8 *buf;
444 size_t buflen;
445
f049052b
BG		 446 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
447 "RSN: no PMKSA entry found - trigger "
448 "full EAP authentication");
6fc6879b
JM		 449 buf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_START,
450 NULL, 0, &buflen, NULL);
451 if (buf) {
452 wpa_sm_ether_send(sm, sm->bssid, ETH_P_EAPOL,
453 buf, buflen);
454 os_free(buf);
b4a1256d 455 return -2;
6fc6879b
JM		 456 }
457
458 return -1;
459 }
460
461 return 0;
462}
463
464
465/**
466 * wpa_supplicant_send_2_of_4 - Send message 2 of WPA/RSN 4-Way Handshake
467 * @sm: Pointer to WPA state machine data from wpa_sm_init()
468 * @dst: Destination address for the frame
469 * @key: Pointer to the EAPOL-Key frame header
470 * @ver: Version bits from EAPOL-Key Key Info
471 * @nonce: Nonce value for the EAPOL-Key frame
472 * @wpa_ie: WPA/RSN IE
473 * @wpa_ie_len: Length of the WPA/RSN IE
474 * @ptk: PTK to use for keyed hash and encryption
c93b7e18 475 * Returns: >= 0 on success, < 0 on failure
6fc6879b
JM		 476 */
477int wpa_supplicant_send_2_of_4(struct wpa_sm *sm, const unsigned char *dst,
478 const struct wpa_eapol_key *key,
479 int ver, const u8 *nonce,
480 const u8 *wpa_ie, size_t wpa_ie_len,
481 struct wpa_ptk *ptk)
482{
5e3b5197 483 size_t mic_len, hdrlen, rlen;
6fc6879b 484 struct wpa_eapol_key *reply;
5e3b5197 485 u8 *rbuf, *key_mic;
26e23750 486 u8 *rsn_ie_buf = NULL;
4a26ccda 487 u16 key_info;
6fc6879b
JM		 488
489 if (wpa_ie == NULL) {
f049052b
BG		 490 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "WPA: No wpa_ie set - "
491 "cannot generate msg 2/4");
6fc6879b
JM		 492 return -1;
493 }
494
26e23750
JM		 495#ifdef CONFIG_IEEE80211R
496 if (wpa_key_mgmt_ft(sm->key_mgmt)) {
497 int res;
498
84972999
JM		 499 wpa_hexdump(MSG_DEBUG, "WPA: WPA IE before FT processing",
500 wpa_ie, wpa_ie_len);
55046414
JM		 501 /*
502 * Add PMKR1Name into RSN IE (PMKID-List) and add MDIE and
503 * FTIE from (Re)Association Response.
504 */
505 rsn_ie_buf = os_malloc(wpa_ie_len + 2 + 2 + PMKID_LEN +
506 sm->assoc_resp_ies_len);
26e23750
JM		 507 if (rsn_ie_buf == NULL)
508 return -1;
509 os_memcpy(rsn_ie_buf, wpa_ie, wpa_ie_len);
59e78c24 510 res = wpa_insert_pmkid(rsn_ie_buf, &wpa_ie_len,
26e23750
JM		 511 sm->pmk_r1_name);
512 if (res < 0) {
513 os_free(rsn_ie_buf);
514 return -1;
515 }
84972999
JM		 516 wpa_hexdump(MSG_DEBUG,
517 "WPA: WPA IE after PMKID[PMKR1Name] addition into RSNE",
518 rsn_ie_buf, wpa_ie_len);
55046414
JM		 519
520 if (sm->assoc_resp_ies) {
84972999
JM		 521 wpa_hexdump(MSG_DEBUG, "WPA: Add assoc_resp_ies",
522 sm->assoc_resp_ies,
523 sm->assoc_resp_ies_len);
55046414
JM		 524 os_memcpy(rsn_ie_buf + wpa_ie_len, sm->assoc_resp_ies,
525 sm->assoc_resp_ies_len);
526 wpa_ie_len += sm->assoc_resp_ies_len;
527 }
26e23750
JM		 528
529 wpa_ie = rsn_ie_buf;
26e23750
JM		 530 }
531#endif /* CONFIG_IEEE80211R */
532
6fc6879b
JM		 533 wpa_hexdump(MSG_DEBUG, "WPA: WPA IE for msg 2/4", wpa_ie, wpa_ie_len);
534
567da5bb 535 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
6d014ffc 536 hdrlen = sizeof(*reply) + mic_len + 2;
6fc6879b 537 rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY,
5e3b5197 538 NULL, hdrlen + wpa_ie_len,
6fc6879b 539 &rlen, (void *) &reply);
26e23750
JM		 540 if (rbuf == NULL) {
541 os_free(rsn_ie_buf);
6fc6879b 542 return -1;
26e23750 543 }
6fc6879b 544
a14896e8
JM		 545 reply->type = (sm->proto == WPA_PROTO_RSN ||
546 sm->proto == WPA_PROTO_OSEN) ?
6fc6879b 547 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
4a26ccda
JM		 548 key_info = ver | WPA_KEY_INFO_KEY_TYPE;
549 if (mic_len)
550 key_info |= WPA_KEY_INFO_MIC;
2022f1d0
JM		 551 else
552 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
4a26ccda 553 WPA_PUT_BE16(reply->key_info, key_info);
a14896e8 554 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN)
6fc6879b
JM		 555 WPA_PUT_BE16(reply->key_length, 0);
556 else
557 os_memcpy(reply->key_length, key->key_length, 2);
558 os_memcpy(reply->replay_counter, key->replay_counter,
559 WPA_REPLAY_COUNTER_LEN);
bc8318ac
JM		 560 wpa_hexdump(MSG_DEBUG, "WPA: Replay Counter", reply->replay_counter,
561 WPA_REPLAY_COUNTER_LEN);
6fc6879b 562
6d014ffc
JM		 563 key_mic = (u8 *) (reply + 1);
564 WPA_PUT_BE16(key_mic + mic_len, wpa_ie_len); /* Key Data Length */
565 os_memcpy(key_mic + mic_len + 2, wpa_ie, wpa_ie_len); /* Key Data */
26e23750 566 os_free(rsn_ie_buf);
6fc6879b
JM		 567
568 os_memcpy(reply->key_nonce, nonce, WPA_NONCE_LEN);
569
f049052b 570 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Sending EAPOL-Key 2/4");
1049af7e
JM		 571 return wpa_eapol_key_send(sm, ptk, ver, dst, ETH_P_EAPOL, rbuf, rlen,
572 key_mic);
6fc6879b
JM		 573}
574
575
576static int wpa_derive_ptk(struct wpa_sm *sm, const unsigned char *src_addr,
98cd3d1c 577 const struct wpa_eapol_key *key, struct wpa_ptk *ptk)
6fc6879b 578{
10ec6a5f
JM		 579 const u8 *z = NULL;
580 size_t z_len = 0;
8b138d28 581 int akmp;
10ec6a5f 582
6fc6879b 583#ifdef CONFIG_IEEE80211R
56586197 584 if (wpa_key_mgmt_ft(sm->key_mgmt))
98cd3d1c 585 return wpa_derive_ptk_ft(sm, src_addr, key, ptk);
6fc6879b
JM		 586#endif /* CONFIG_IEEE80211R */
587
10ec6a5f
JM		 588#ifdef CONFIG_DPP2
589 if (sm->key_mgmt == WPA_KEY_MGMT_DPP && sm->dpp_z) {
590 z = wpabuf_head(sm->dpp_z);
591 z_len = wpabuf_len(sm->dpp_z);
592 }
593#endif /* CONFIG_DPP2 */
594
8b138d28
JM		 595 akmp = sm->key_mgmt;
596#ifdef CONFIG_OWE
597 if (sm->owe_ptk_workaround && akmp == WPA_KEY_MGMT_OWE &&
598 sm->pmk_len > 32) {
599 wpa_printf(MSG_DEBUG,
600 "OWE: Force SHA256 for PTK derivation");
0a76a0b9 601 akmp |= WPA_KEY_MGMT_PSK_SHA256;
8b138d28
JM		 602 }
603#endif /* CONFIG_OWE */
98cd3d1c
JM		 604 return wpa_pmk_to_ptk(sm->pmk, sm->pmk_len, "Pairwise key expansion",
605 sm->own_addr, sm->bssid, sm->snonce,
8b138d28 606 key->key_nonce, ptk, akmp,
10ec6a5f 607 sm->pairwise_cipher, z, z_len);
6fc6879b
JM		 608}
609
610
611static void wpa_supplicant_process_1_of_4(struct wpa_sm *sm,
612 const unsigned char *src_addr,
613 const struct wpa_eapol_key *key,
e6270129
JM		 614 u16 ver, const u8 *key_data,
615 size_t key_data_len)
6fc6879b
JM		 616{
617 struct wpa_eapol_ie_parse ie;
618 struct wpa_ptk *ptk;
b4a1256d 619 int res;
25ef8529
JM		 620 u8 *kde, *kde_buf = NULL;
621 size_t kde_len;
6fc6879b
JM		 622
623 if (wpa_sm_get_network_ctx(sm) == NULL) {
f049052b
BG		 624 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "WPA: No SSID info "
625 "found (msg 1 of 4)");
6fc6879b
JM		 626 return;
627 }
628
1f90a49d
AW		 629 if (sm->wpa_deny_ptk0_rekey && wpa_sm_get_state(sm) == WPA_COMPLETED) {
630 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
631 "WPA: PTK0 rekey not allowed, reconnecting");
632 wpa_sm_reconnect(sm);
633 return;
634 }
635
6fc6879b 636 wpa_sm_set_state(sm, WPA_4WAY_HANDSHAKE);
f049052b
BG		 637 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: RX message 1 of 4-Way "
638 "Handshake from " MACSTR " (ver=%d)", MAC2STR(src_addr), ver);
6fc6879b
JM		 639
640 os_memset(&ie, 0, sizeof(ie));
641
a14896e8 642 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) {
6fc6879b 643 /* RSN: msg 1/4 should contain PMKID for the selected PMK */
e6270129
JM		 644 wpa_hexdump(MSG_DEBUG, "RSN: msg 1/4 key data",
645 key_data, key_data_len);
646 if (wpa_supplicant_parse_ies(key_data, key_data_len, &ie) < 0)
d627a939 647 goto failed;
6fc6879b
JM		 648 if (ie.pmkid) {
649 wpa_hexdump(MSG_DEBUG, "RSN: PMKID from "
650 "Authenticator", ie.pmkid, PMKID_LEN);
651 }
652 }
6fc6879b 653
b4a1256d
JM		 654 res = wpa_supplicant_get_pmk(sm, src_addr, ie.pmkid);
655 if (res == -2) {
f049052b
BG		 656 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "RSN: Do not reply to "
657 "msg 1/4 - requesting full EAP authentication");
b4a1256d
JM		 658 return;
659 }
660 if (res)
83935317 661 goto failed;
6fc6879b
JM		 662
663 if (sm->renew_snonce) {
3642c431 664 if (random_get_bytes(sm->snonce, WPA_NONCE_LEN)) {
0f057fb2 665 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
6fc6879b 666 "WPA: Failed to get random data for SNonce");
83935317 667 goto failed;
6fc6879b
JM		 668 }
669 sm->renew_snonce = 0;
670 wpa_hexdump(MSG_DEBUG, "WPA: Renewed SNonce",
671 sm->snonce, WPA_NONCE_LEN);
672 }
673
674 /* Calculate PTK which will be stored as a temporary PTK until it has
675 * been verified when processing message 3/4. */
676 ptk = &sm->tptk;
b488a129
JM		 677 if (wpa_derive_ptk(sm, src_addr, key, ptk) < 0)
678 goto failed;
3b9c5176 679 if (sm->pairwise_cipher == WPA_CIPHER_TKIP) {
d2c33b91 680 u8 buf[8];
3b9c5176 681 /* Supplicant: swap tx/rx Mic keys */
98cd3d1c
JM		 682 os_memcpy(buf, &ptk->tk[16], 8);
683 os_memcpy(&ptk->tk[16], &ptk->tk[24], 8);
684 os_memcpy(&ptk->tk[24], buf, 8);
31bc66e4 685 forced_memzero(buf, sizeof(buf));
3b9c5176 686 }
6fc6879b
JM		 687 sm->tptk_set = 1;
688
25ef8529
JM		 689 kde = sm->assoc_wpa_ie;
690 kde_len = sm->assoc_wpa_ie_len;
6d6c8877
JM		 691 kde_buf = os_malloc(kde_len +
692 2 + RSN_SELECTOR_LEN + 3 +
693 sm->assoc_rsnxe_len +
694 2 + RSN_SELECTOR_LEN + 1);
695 if (!kde_buf)
696 goto failed;
697 os_memcpy(kde_buf, kde, kde_len);
698 kde = kde_buf;
25ef8529 699
17c2559c
MV		 700#ifdef CONFIG_OCV
701 if (wpa_sm_ocv_enabled(sm)) {
702 struct wpa_channel_info ci;
703 u8 *pos;
704
6d6c8877 705 pos = kde + kde_len;
17c2559c
MV		 706 if (wpa_sm_channel_info(sm, &ci) != 0) {
707 wpa_printf(MSG_WARNING,
708 "Failed to get channel info for OCI element in EAPOL-Key 2/4");
709 goto failed;
710 }
711
17c2559c
MV		 712 if (ocv_insert_oci_kde(&ci, &pos) < 0)
713 goto failed;
714 kde_len = pos - kde;
715 }
716#endif /* CONFIG_OCV */
717
6d6c8877
JM		 718 if (sm->assoc_rsnxe && sm->assoc_rsnxe_len) {
719 os_memcpy(kde + kde_len, sm->assoc_rsnxe, sm->assoc_rsnxe_len);
720 kde_len += sm->assoc_rsnxe_len;
721 }
722
25ef8529
JM		 723#ifdef CONFIG_P2P
724 if (sm->p2p) {
6d6c8877
JM		 725 u8 *pos;
726
727 wpa_printf(MSG_DEBUG,
728 "P2P: Add IP Address Request KDE into EAPOL-Key 2/4");
729 pos = kde + kde_len;
730 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
731 *pos++ = RSN_SELECTOR_LEN + 1;
732 RSN_SELECTOR_PUT(pos, WFA_KEY_DATA_IP_ADDR_REQ);
733 pos += RSN_SELECTOR_LEN;
734 *pos++ = 0x01;
735 kde_len = pos - kde;
25ef8529
JM		 736 }
737#endif /* CONFIG_P2P */
738
6fc6879b 739 if (wpa_supplicant_send_2_of_4(sm, sm->bssid, key, ver, sm->snonce,
c93b7e18 740 kde, kde_len, ptk) < 0)
83935317 741 goto failed;
6fc6879b 742
25ef8529 743 os_free(kde_buf);
6fc6879b 744 os_memcpy(sm->anonce, key->key_nonce, WPA_NONCE_LEN);
83935317
JM		 745 return;
746
747failed:
25ef8529 748 os_free(kde_buf);
83935317 749 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
6fc6879b
JM		 750}
751
752
753static void wpa_sm_start_preauth(void *eloop_ctx, void *timeout_ctx)
754{
755 struct wpa_sm *sm = eloop_ctx;
756 rsn_preauth_candidate_process(sm);
757}
758
759
760static void wpa_supplicant_key_neg_complete(struct wpa_sm *sm,
761 const u8 *addr, int secure)
762{
0f057fb2
JM		 763 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
764 "WPA: Key negotiation completed with "
6fc6879b
JM		 765 MACSTR " [PTK=%s GTK=%s]", MAC2STR(addr),
766 wpa_cipher_txt(sm->pairwise_cipher),
767 wpa_cipher_txt(sm->group_cipher));
6fc6879b
JM		 768 wpa_sm_cancel_auth_timeout(sm);
769 wpa_sm_set_state(sm, WPA_COMPLETED);
770
771 if (secure) {
772 wpa_sm_mlme_setprotection(
773 sm, addr, MLME_SETPROTECTION_PROTECT_TYPE_RX_TX,
774 MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
775 eapol_sm_notify_portValid(sm->eapol, TRUE);
a1ea1b45 776 if (wpa_key_mgmt_wpa_psk(sm->key_mgmt) ||
567da5bb 777 sm->key_mgmt == WPA_KEY_MGMT_DPP ||
a1ea1b45 778 sm->key_mgmt == WPA_KEY_MGMT_OWE)
6fc6879b
JM		 779 eapol_sm_notify_eap_success(sm->eapol, TRUE);
780 /*
781 * Start preauthentication after a short wait to avoid a
782 * possible race condition between the data receive and key
783 * configuration after the 4-Way Handshake. This increases the
ffbf1eaa 784 * likelihood of the first preauth EAPOL-Start frame getting to
6fc6879b
JM		 785 * the target AP.
786 */
02a0a239
JM		 787 if (!dl_list_empty(&sm->pmksa_candidates))
788 eloop_register_timeout(1, 0, wpa_sm_start_preauth,
789 sm, NULL);
6fc6879b
JM		 790 }
791
792 if (sm->cur_pmksa && sm->cur_pmksa->opportunistic) {
f049052b
BG		 793 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
794 "RSN: Authenticator accepted "
795 "opportunistic PMKSA entry - marking it valid");
6fc6879b
JM		 796 sm->cur_pmksa->opportunistic = 0;
797 }
798
799#ifdef CONFIG_IEEE80211R
56586197 800 if (wpa_key_mgmt_ft(sm->key_mgmt)) {
6fc6879b 801 /* Prepare for the next transition */
76b7981d 802 wpa_ft_prepare_auth_request(sm, NULL);
6fc6879b
JM		 803 }
804#endif /* CONFIG_IEEE80211R */
805}
806
807
581a8cde
JM		 808static void wpa_sm_rekey_ptk(void *eloop_ctx, void *timeout_ctx)
809{
810 struct wpa_sm *sm = eloop_ctx;
f049052b 811 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Request PTK rekeying");
581a8cde
JM		 812 wpa_sm_key_request(sm, 0, 1);
813}
814
815
6fc6879b 816static int wpa_supplicant_install_ptk(struct wpa_sm *sm,
a919a260
AW		 817 const struct wpa_eapol_key *key,
818 enum key_flag key_flag)
6fc6879b
JM		 819{
820 int keylen, rsclen;
71934751 821 enum wpa_alg alg;
6fc6879b 822 const u8 *key_rsc;
6fc6879b 823
53bb18cc 824 if (sm->ptk.installed) {
ad00d64e
JM		 825 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
826 "WPA: Do not re-install same PTK to the driver");
827 return 0;
828 }
829
f049052b
BG		 830 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
831 "WPA: Installing PTK to the driver");
6fc6879b 832
c3550295 833 if (sm->pairwise_cipher == WPA_CIPHER_NONE) {
f049052b
BG		 834 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Pairwise Cipher "
835 "Suite: NONE - do not use pairwise keys");
6fc6879b 836 return 0;
c3550295
JM		 837 }
838
839 if (!wpa_cipher_valid_pairwise(sm->pairwise_cipher)) {
f049052b
BG		 840 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
841 "WPA: Unsupported pairwise cipher %d",
842 sm->pairwise_cipher);
6fc6879b
JM		 843 return -1;
844 }
845
c3550295
JM		 846 alg = wpa_cipher_to_alg(sm->pairwise_cipher);
847 keylen = wpa_cipher_key_len(sm->pairwise_cipher);
a6ea6653
JM		 848 if (keylen <= 0 || (unsigned int) keylen != sm->ptk.tk_len) {
849 wpa_printf(MSG_DEBUG, "WPA: TK length mismatch: %d != %lu",
850 keylen, (long unsigned int) sm->ptk.tk_len);
851 return -1;
852 }
c3550295
JM		 853 rsclen = wpa_cipher_rsc_len(sm->pairwise_cipher);
854
a14896e8 855 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) {
6fc6879b
JM		 856 key_rsc = null_rsc;
857 } else {
858 key_rsc = key->key_rsc;
859 wpa_hexdump(MSG_DEBUG, "WPA: RSC", key_rsc, rsclen);
860 }
861
862 if (wpa_sm_set_key(sm, alg, sm->bssid, 0, 1, key_rsc, rsclen,
a919a260
AW		 863 sm->ptk.tk, keylen,
864 KEY_FLAG_PAIRWISE | key_flag) < 0) {
f049052b
BG		 865 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
866 "WPA: Failed to set PTK to the "
867 "driver (alg=%d keylen=%d bssid=" MACSTR ")",
868 alg, keylen, MAC2STR(sm->bssid));
6fc6879b
JM		 869 return -1;
870 }
581a8cde 871
7d711541 872 /* TK is not needed anymore in supplicant */
98cd3d1c 873 os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
a6ea6653 874 sm->ptk.tk_len = 0;
53bb18cc 875 sm->ptk.installed = 1;
7d711541 876
581a8cde
JM		 877 if (sm->wpa_ptk_rekey) {
878 eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
879 eloop_register_timeout(sm->wpa_ptk_rekey, 0, wpa_sm_rekey_ptk,
880 sm, NULL);
881 }
882
6fc6879b
JM		 883 return 0;
884}
885
886
f049052b
BG		 887static int wpa_supplicant_check_group_cipher(struct wpa_sm *sm,
888 int group_cipher,
6fc6879b 889 int keylen, int maxkeylen,
71934751
JM		 890 int *key_rsc_len,
891 enum wpa_alg *alg)
6fc6879b 892{
c3550295 893 int klen;
6fc6879b 894
c3550295
JM		 895 *alg = wpa_cipher_to_alg(group_cipher);
896 if (*alg == WPA_ALG_NONE) {
f049052b
BG		 897 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
898 "WPA: Unsupported Group Cipher %d",
899 group_cipher);
6fc6879b
JM		 900 return -1;
901 }
c3550295 902 *key_rsc_len = wpa_cipher_rsc_len(group_cipher);
6fc6879b 903
c3550295
JM		 904 klen = wpa_cipher_key_len(group_cipher);
905 if (keylen != klen || maxkeylen < klen) {
f049052b
BG		 906 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
907 "WPA: Unsupported %s Group Cipher key length %d (%d)",
908 wpa_cipher_txt(group_cipher), keylen, maxkeylen);
c3550295 909 return -1;
6fc6879b 910 }
c3550295 911 return 0;
6fc6879b
JM		 912}
913
914
915struct wpa_gtk_data {
71934751 916 enum wpa_alg alg;
6fc6879b
JM		 917 int tx, key_rsc_len, keyidx;
918 u8 gtk[32];
919 int gtk_len;
920};
921
922
923static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
924 const struct wpa_gtk_data *gd,
87e2db16 925 const u8 *key_rsc, int wnm_sleep)
6fc6879b
JM		 926{
927 const u8 *_gtk = gd->gtk;
928 u8 gtk_buf[32];
929
cb5132bb 930 /* Detect possible key reinstallation */
87e2db16
JM		 931 if ((sm->gtk.gtk_len == (size_t) gd->gtk_len &&
932 os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) ||
933 (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len &&
934 os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk,
935 sm->gtk_wnm_sleep.gtk_len) == 0)) {
cb5132bb
MV		 936 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
937 "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)",
938 gd->keyidx, gd->tx, gd->gtk_len);
939 return 0;
940 }
941
6fc6879b 942 wpa_hexdump_key(MSG_DEBUG, "WPA: Group Key", gd->gtk, gd->gtk_len);
f049052b
BG		 943 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
944 "WPA: Installing GTK to the driver (keyidx=%d tx=%d len=%d)",
945 gd->keyidx, gd->tx, gd->gtk_len);
6fc6879b
JM		 946 wpa_hexdump(MSG_DEBUG, "WPA: RSC", key_rsc, gd->key_rsc_len);
947 if (sm->group_cipher == WPA_CIPHER_TKIP) {
948 /* Swap Tx/Rx keys for Michael MIC */
949 os_memcpy(gtk_buf, gd->gtk, 16);
950 os_memcpy(gtk_buf + 16, gd->gtk + 24, 8);
951 os_memcpy(gtk_buf + 24, gd->gtk + 16, 8);
952 _gtk = gtk_buf;
953 }
954 if (sm->pairwise_cipher == WPA_CIPHER_NONE) {
0382097e 955 if (wpa_sm_set_key(sm, gd->alg, NULL,
6fc6879b 956 gd->keyidx, 1, key_rsc, gd->key_rsc_len,
a919a260
AW		 957 _gtk, gd->gtk_len,
958 KEY_FLAG_GROUP_RX_TX_DEFAULT) < 0) {
f049052b
BG		 959 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
960 "WPA: Failed to set GTK to the driver "
961 "(Group only)");
31bc66e4 962 forced_memzero(gtk_buf, sizeof(gtk_buf));
6fc6879b
JM		 963 return -1;
964 }
0382097e 965 } else if (wpa_sm_set_key(sm, gd->alg, broadcast_ether_addr,
6fc6879b 966 gd->keyidx, gd->tx, key_rsc, gd->key_rsc_len,
a919a260 967 _gtk, gd->gtk_len, KEY_FLAG_GROUP_RX) < 0) {
f049052b
BG		 968 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
969 "WPA: Failed to set GTK to "
970 "the driver (alg=%d keylen=%d keyidx=%d)",
971 gd->alg, gd->gtk_len, gd->keyidx);
31bc66e4 972 forced_memzero(gtk_buf, sizeof(gtk_buf));
6fc6879b
JM		 973 return -1;
974 }
31bc66e4 975 forced_memzero(gtk_buf, sizeof(gtk_buf));
6fc6879b 976
87e2db16
JM		 977 if (wnm_sleep) {
978 sm->gtk_wnm_sleep.gtk_len = gd->gtk_len;
979 os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk,
980 sm->gtk_wnm_sleep.gtk_len);
981 } else {
982 sm->gtk.gtk_len = gd->gtk_len;
983 os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
984 }
cb5132bb 985
6fc6879b
JM		 986 return 0;
987}
988
989
990static int wpa_supplicant_gtk_tx_bit_workaround(const struct wpa_sm *sm,
991 int tx)
992{
993 if (tx && sm->pairwise_cipher != WPA_CIPHER_NONE) {
994 /* Ignore Tx bit for GTK if a pairwise key is used. One AP
995 * seemed to set this bit (incorrectly, since Tx is only when
996 * doing Group Key only APs) and without this workaround, the
997 * data connection does not work because wpa_supplicant
998 * configured non-zero keyidx to be used for unicast. */
f049052b
BG		 999 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1000 "WPA: Tx bit set for GTK, but pairwise "
1001 "keys are used - ignore Tx bit");
6fc6879b
JM		 1002 return 0;
1003 }
1004 return tx;
1005}
1006
1007
73ed03f3
MS		 1008static int wpa_supplicant_rsc_relaxation(const struct wpa_sm *sm,
1009 const u8 *rsc)
1010{
1011 int rsclen;
1012
1013 if (!sm->wpa_rsc_relaxation)
1014 return 0;
1015
1016 rsclen = wpa_cipher_rsc_len(sm->group_cipher);
1017
1018 /*
1019 * Try to detect RSC (endian) corruption issue where the AP sends
1020 * the RSC bytes in EAPOL-Key message in the wrong order, both if
1021 * it's actually a 6-byte field (as it should be) and if it treats
1022 * it as an 8-byte field.
1023 * An AP model known to have this bug is the Sapido RB-1632.
1024 */
1025 if (rsclen == 6 && ((rsc[5] && !rsc[0]) || rsc[6] || rsc[7])) {
1026 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1027 "RSC %02x%02x%02x%02x%02x%02x%02x%02x is likely bogus, using 0",
1028 rsc[0], rsc[1], rsc[2], rsc[3],
1029 rsc[4], rsc[5], rsc[6], rsc[7]);
1030
1031 return 1;
1032 }
1033
1034 return 0;
1035}
1036
1037
6fc6879b
JM		 1038static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm,
1039 const struct wpa_eapol_key *key,
1040 const u8 *gtk, size_t gtk_len,
1041 int key_info)
1042{
6fc6879b 1043 struct wpa_gtk_data gd;
73ed03f3 1044 const u8 *key_rsc;
6fc6879b
JM		 1045
1046 /*
1047 * IEEE Std 802.11i-2004 - 8.5.2 EAPOL-Key frames - Figure 43x
1048 * GTK KDE format:
1049 * KeyID[bits 0-1], Tx [bit 2], Reserved [bits 3-7]
1050 * Reserved [bits 0-7]
1051 * GTK
1052 */
1053
1054 os_memset(&gd, 0, sizeof(gd));
1055 wpa_hexdump_key(MSG_DEBUG, "RSN: received GTK in pairwise handshake",
1056 gtk, gtk_len);
1057
1058 if (gtk_len < 2 || gtk_len - 2 > sizeof(gd.gtk))
1059 return -1;
1060
1061 gd.keyidx = gtk[0] & 0x3;
1062 gd.tx = wpa_supplicant_gtk_tx_bit_workaround(sm,
1063 !!(gtk[0] & BIT(2)));
1064 gtk += 2;
1065 gtk_len -= 2;
1066
1067 os_memcpy(gd.gtk, gtk, gtk_len);
1068 gd.gtk_len = gtk_len;
1069
73ed03f3
MS		 1070 key_rsc = key->key_rsc;
1071 if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
1072 key_rsc = null_rsc;
1073
dff1e285
JM		 1074 if (sm->group_cipher != WPA_CIPHER_GTK_NOT_USED &&
1075 (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
1076 gtk_len, gtk_len,
1077 &gd.key_rsc_len, &gd.alg) ||
87e2db16 1078 wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) {
f049052b
BG		 1079 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1080 "RSN: Failed to install GTK");
31bc66e4 1081 forced_memzero(&gd, sizeof(gd));
6fc6879b
JM		 1082 return -1;
1083 }
31bc66e4 1084 forced_memzero(&gd, sizeof(gd));
6fc6879b 1085
6fc6879b 1086 return 0;
6fc6879b
JM		 1087}
1088
1089
cb5132bb 1090static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
87e2db16
JM		 1091 const struct wpa_igtk_kde *igtk,
1092 int wnm_sleep)
cb5132bb
MV		 1093{
1094 size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1095 u16 keyidx = WPA_GET_LE16(igtk->keyid);
1096
1097 /* Detect possible key reinstallation */
87e2db16
JM		 1098 if ((sm->igtk.igtk_len == len &&
1099 os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) ||
1100 (sm->igtk_wnm_sleep.igtk_len == len &&
1101 os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk,
1102 sm->igtk_wnm_sleep.igtk_len) == 0)) {
cb5132bb
MV		 1103 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1104 "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)",
1105 keyidx);
1106 return 0;
1107 }
1108
1109 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
94919da2 1110 "WPA: IGTK keyid %d pn " COMPACT_MACSTR,
cb5132bb
MV		 1111 keyidx, MAC2STR(igtk->pn));
1112 wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", igtk->igtk, len);
1113 if (keyidx > 4095) {
1114 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1115 "WPA: Invalid IGTK KeyID %d", keyidx);
1116 return -1;
1117 }
1118 if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
1119 broadcast_ether_addr,
1120 keyidx, 0, igtk->pn, sizeof(igtk->pn),
a919a260 1121 igtk->igtk, len, KEY_FLAG_GROUP_RX) < 0) {
824cb5a5
JM		 1122 if (keyidx == 0x0400 || keyidx == 0x0500) {
1123 /* Assume the AP has broken PMF implementation since it
1124 * seems to have swapped the KeyID bytes. The AP cannot
1125 * be trusted to implement BIP correctly or provide a
1126 * valid IGTK, so do not try to configure this key with
1127 * swapped KeyID bytes. Instead, continue without
1128 * configuring the IGTK so that the driver can drop any
1129 * received group-addressed robust management frames due
1130 * to missing keys.
1131 *
1132 * Normally, this error behavior would result in us
1133 * disconnecting, but there are number of deployed APs
1134 * with this broken behavior, so as an interoperability
1135 * workaround, allow the connection to proceed. */
1136 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1137 "WPA: Ignore IGTK configuration error due to invalid IGTK KeyID byte order");
1138 } else {
1139 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1140 "WPA: Failed to configure IGTK to the driver");
1141 return -1;
1142 }
cb5132bb
MV		 1143 }
1144
87e2db16
JM		 1145 if (wnm_sleep) {
1146 sm->igtk_wnm_sleep.igtk_len = len;
1147 os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk,
1148 sm->igtk_wnm_sleep.igtk_len);
1149 } else {
1150 sm->igtk.igtk_len = len;
1151 os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
1152 }
cb5132bb
MV		 1153
1154 return 0;
1155}
cb5132bb
MV		 1156
1157
2d4c78ae
JM		 1158static int wpa_supplicant_install_bigtk(struct wpa_sm *sm,
1159 const struct wpa_bigtk_kde *bigtk,
1160 int wnm_sleep)
1161{
1162 size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1163 u16 keyidx = WPA_GET_LE16(bigtk->keyid);
1164
1165 /* Detect possible key reinstallation */
1166 if ((sm->bigtk.bigtk_len == len &&
1167 os_memcmp(sm->bigtk.bigtk, bigtk->bigtk,
1168 sm->bigtk.bigtk_len) == 0) ||
1169 (sm->bigtk_wnm_sleep.bigtk_len == len &&
1170 os_memcmp(sm->bigtk_wnm_sleep.bigtk, bigtk->bigtk,
1171 sm->bigtk_wnm_sleep.bigtk_len) == 0)) {
1172 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1173 "WPA: Not reinstalling already in-use BIGTK to the driver (keyidx=%d)",
1174 keyidx);
1175 return 0;
1176 }
1177
1178 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1179 "WPA: BIGTK keyid %d pn " COMPACT_MACSTR,
1180 keyidx, MAC2STR(bigtk->pn));
1181 wpa_hexdump_key(MSG_DEBUG, "WPA: BIGTK", bigtk->bigtk, len);
1182 if (keyidx < 6 || keyidx > 7) {
1183 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1184 "WPA: Invalid BIGTK KeyID %d", keyidx);
1185 return -1;
1186 }
1187 if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
1188 broadcast_ether_addr,
1189 keyidx, 0, bigtk->pn, sizeof(bigtk->pn),
1190 bigtk->bigtk, len, KEY_FLAG_GROUP_RX) < 0) {
1191 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1192 "WPA: Failed to configure BIGTK to the driver");
1193 return -1;
1194 }
1195
1196 if (wnm_sleep) {
1197 sm->bigtk_wnm_sleep.bigtk_len = len;
1198 os_memcpy(sm->bigtk_wnm_sleep.bigtk, bigtk->bigtk,
1199 sm->bigtk_wnm_sleep.bigtk_len);
1200 } else {
1201 sm->bigtk.bigtk_len = len;
1202 os_memcpy(sm->bigtk.bigtk, bigtk->bigtk, sm->bigtk.bigtk_len);
1203 }
1204
1205 return 0;
1206}
1207
1208
6fc6879b
JM		 1209static int ieee80211w_set_keys(struct wpa_sm *sm,
1210 struct wpa_eapol_ie_parse *ie)
1211{
2d4c78ae
JM		 1212 size_t len;
1213
8dd9f9cd 1214 if (!wpa_cipher_valid_mgmt_group(sm->mgmt_group_cipher))
6fc6879b
JM		 1215 return 0;
1216
1217 if (ie->igtk) {
1218 const struct wpa_igtk_kde *igtk;
cb5132bb 1219
8dd9f9cd
JM		 1220 len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1221 if (ie->igtk_len != WPA_IGTK_KDE_PREFIX_LEN + len)
6fc6879b 1222 return -1;
cb5132bb 1223
6fc6879b 1224 igtk = (const struct wpa_igtk_kde *) ie->igtk;
87e2db16 1225 if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0)
6fc6879b 1226 return -1;
6fc6879b
JM		 1227 }
1228
2d4c78ae
JM		 1229 if (ie->bigtk && sm->beacon_prot) {
1230 const struct wpa_bigtk_kde *bigtk;
1231
1232 len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1233 if (ie->bigtk_len != WPA_BIGTK_KDE_PREFIX_LEN + len)
1234 return -1;
1235
1236 bigtk = (const struct wpa_bigtk_kde *) ie->bigtk;
1237 if (wpa_supplicant_install_bigtk(sm, bigtk, 0) < 0)
1238 return -1;
1239 }
1240
6fc6879b 1241 return 0;
6fc6879b
JM		 1242}
1243
1244
1245static void wpa_report_ie_mismatch(struct wpa_sm *sm,
1246 const char *reason, const u8 *src_addr,
1247 const u8 *wpa_ie, size_t wpa_ie_len,
1248 const u8 *rsn_ie, size_t rsn_ie_len)
1249{
0f057fb2 1250 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "WPA: %s (src=" MACSTR ")",
6fc6879b
JM		 1251 reason, MAC2STR(src_addr));
1252
1253 if (sm->ap_wpa_ie) {
1254 wpa_hexdump(MSG_INFO, "WPA: WPA IE in Beacon/ProbeResp",
1255 sm->ap_wpa_ie, sm->ap_wpa_ie_len);
1256 }
1257 if (wpa_ie) {
1258 if (!sm->ap_wpa_ie) {
f049052b
BG		 1259 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1260 "WPA: No WPA IE in Beacon/ProbeResp");
6fc6879b
JM		 1261 }
1262 wpa_hexdump(MSG_INFO, "WPA: WPA IE in 3/4 msg",
1263 wpa_ie, wpa_ie_len);
1264 }
1265
1266 if (sm->ap_rsn_ie) {
1267 wpa_hexdump(MSG_INFO, "WPA: RSN IE in Beacon/ProbeResp",
1268 sm->ap_rsn_ie, sm->ap_rsn_ie_len);
1269 }
1270 if (rsn_ie) {
1271 if (!sm->ap_rsn_ie) {
f049052b
BG		 1272 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1273 "WPA: No RSN IE in Beacon/ProbeResp");
6fc6879b
JM		 1274 }
1275 wpa_hexdump(MSG_INFO, "WPA: RSN IE in 3/4 msg",
1276 rsn_ie, rsn_ie_len);
1277 }
1278
3da372fa 1279 wpa_sm_deauthenticate(sm, WLAN_REASON_IE_IN_4WAY_DIFFERS);
6fc6879b
JM		 1280}
1281
1282
5af8187e
JM		 1283#ifdef CONFIG_IEEE80211R
1284
1285static int ft_validate_mdie(struct wpa_sm *sm,
1286 const unsigned char *src_addr,
3b4f6dac
JM		 1287 struct wpa_eapol_ie_parse *ie,
1288 const u8 *assoc_resp_mdie)
5af8187e
JM		 1289{
1290 struct rsn_mdie *mdie;
1291
5af8187e
JM		 1292 mdie = (struct rsn_mdie *) (ie->mdie + 2);
1293 if (ie->mdie == NULL || ie->mdie_len < 2 + sizeof(*mdie) ||
1294 os_memcmp(mdie->mobility_domain, sm->mobility_domain,
1295 MOBILITY_DOMAIN_ID_LEN) != 0) {
f049052b
BG		 1296 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: MDIE in msg 3/4 did "
1297 "not match with the current mobility domain");
5af8187e
JM		 1298 return -1;
1299 }
1300
3b4f6dac
JM		 1301 if (assoc_resp_mdie &&
1302 (assoc_resp_mdie[1] != ie->mdie[1] ||
1303 os_memcmp(assoc_resp_mdie, ie->mdie, 2 + ie->mdie[1]) != 0)) {
f049052b 1304 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: MDIE mismatch");
3b4f6dac
JM		 1305 wpa_hexdump(MSG_DEBUG, "FT: MDIE in EAPOL-Key msg 3/4",
1306 ie->mdie, 2 + ie->mdie[1]);
1307 wpa_hexdump(MSG_DEBUG, "FT: MDIE in (Re)Association Response",
1308 assoc_resp_mdie, 2 + assoc_resp_mdie[1]);
1309 return -1;
1310 }
1311
1312 return 0;
1313}
1314
1315
1316static int ft_validate_ftie(struct wpa_sm *sm,
1317 const unsigned char *src_addr,
1318 struct wpa_eapol_ie_parse *ie,
1319 const u8 *assoc_resp_ftie)
1320{
1321 if (ie->ftie == NULL) {
f049052b
BG		 1322 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1323 "FT: No FTIE in EAPOL-Key msg 3/4");
3b4f6dac
JM		 1324 return -1;
1325 }
1326
1327 if (assoc_resp_ftie == NULL)
1328 return 0;
1329
1330 if (assoc_resp_ftie[1] != ie->ftie[1] ||
1331 os_memcmp(assoc_resp_ftie, ie->ftie, 2 + ie->ftie[1]) != 0) {
f049052b 1332 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: FTIE mismatch");
3b4f6dac
JM		 1333 wpa_hexdump(MSG_DEBUG, "FT: FTIE in EAPOL-Key msg 3/4",
1334 ie->ftie, 2 + ie->ftie[1]);
1335 wpa_hexdump(MSG_DEBUG, "FT: FTIE in (Re)Association Response",
1336 assoc_resp_ftie, 2 + assoc_resp_ftie[1]);
1337 return -1;
1338 }
1339
5af8187e
JM		 1340 return 0;
1341}
1342
1343
1344static int ft_validate_rsnie(struct wpa_sm *sm,
1345 const unsigned char *src_addr,
1346 struct wpa_eapol_ie_parse *ie)
1347{
1348 struct wpa_ie_data rsn;
1349
1350 if (!ie->rsn_ie)
1351 return 0;
1352
1353 /*
1354 * Verify that PMKR1Name from EAPOL-Key message 3/4
1355 * matches with the value we derived.
1356 */
1357 if (wpa_parse_wpa_ie_rsn(ie->rsn_ie, ie->rsn_ie_len, &rsn) < 0 ||
1358 rsn.num_pmkid != 1 || rsn.pmkid == NULL) {
f049052b
BG		 1359 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: No PMKR1Name in "
1360 "FT 4-way handshake message 3/4");
5af8187e
JM		 1361 return -1;
1362 }
1363
0d15b69f
JM		 1364 if (os_memcmp_const(rsn.pmkid, sm->pmk_r1_name, WPA_PMK_NAME_LEN) != 0)
1365 {
f049052b
BG		 1366 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1367 "FT: PMKR1Name mismatch in "
1368 "FT 4-way handshake message 3/4");
5af8187e
JM		 1369 wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name from Authenticator",
1370 rsn.pmkid, WPA_PMK_NAME_LEN);
1371 wpa_hexdump(MSG_DEBUG, "FT: Derived PMKR1Name",
1372 sm->pmk_r1_name, WPA_PMK_NAME_LEN);
1373 return -1;
1374 }
1375
1376 return 0;
1377}
1378
1379
1380static int wpa_supplicant_validate_ie_ft(struct wpa_sm *sm,
1381 const unsigned char *src_addr,
1382 struct wpa_eapol_ie_parse *ie)
1383{
3b4f6dac
JM		 1384 const u8 *pos, *end, *mdie = NULL, *ftie = NULL;
1385
1386 if (sm->assoc_resp_ies) {
1387 pos = sm->assoc_resp_ies;
1388 end = pos + sm->assoc_resp_ies_len;
2461724c
JM		 1389 while (end - pos > 2) {
1390 if (2 + pos[1] > end - pos)
3b4f6dac
JM		 1391 break;
1392 switch (*pos) {
1393 case WLAN_EID_MOBILITY_DOMAIN:
1394 mdie = pos;
1395 break;
1396 case WLAN_EID_FAST_BSS_TRANSITION:
1397 ftie = pos;
1398 break;
1399 }
1400 pos += 2 + pos[1];
1401 }
1402 }
1403
1404 if (ft_validate_mdie(sm, src_addr, ie, mdie) < 0 ||
1405 ft_validate_ftie(sm, src_addr, ie, ftie) < 0 ||
5af8187e
JM		 1406 ft_validate_rsnie(sm, src_addr, ie) < 0)
1407 return -1;
1408
1409 return 0;
1410}
1411
1412#endif /* CONFIG_IEEE80211R */
1413
1414
6fc6879b
JM		 1415static int wpa_supplicant_validate_ie(struct wpa_sm *sm,
1416 const unsigned char *src_addr,
1417 struct wpa_eapol_ie_parse *ie)
1418{
1419 if (sm->ap_wpa_ie == NULL && sm->ap_rsn_ie == NULL) {
f049052b
BG		 1420 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1421 "WPA: No WPA/RSN IE for this AP known. "
1422 "Trying to get from scan results");
6fc6879b 1423 if (wpa_sm_get_beacon_ie(sm) < 0) {
f049052b
BG		 1424 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1425 "WPA: Could not find AP from "
1426 "the scan results");
c7d29302 1427 return -1;
6fc6879b 1428 }
c7d29302
JM		 1429 wpa_msg(sm->ctx->msg_ctx, MSG_DEBUG,
1430 "WPA: Found the current AP from updated scan results");
6fc6879b
JM		 1431 }
1432
1433 if (ie->wpa_ie == NULL && ie->rsn_ie == NULL &&
1434 (sm->ap_wpa_ie || sm->ap_rsn_ie)) {
1435 wpa_report_ie_mismatch(sm, "IE in 3/4 msg does not match "
1436 "with IE in Beacon/ProbeResp (no IE?)",
1437 src_addr, ie->wpa_ie, ie->wpa_ie_len,
1438 ie->rsn_ie, ie->rsn_ie_len);
1439 return -1;
1440 }
1441
1442 if ((ie->wpa_ie && sm->ap_wpa_ie &&
1443 (ie->wpa_ie_len != sm->ap_wpa_ie_len ||
1444 os_memcmp(ie->wpa_ie, sm->ap_wpa_ie, ie->wpa_ie_len) != 0)) ||
1445 (ie->rsn_ie && sm->ap_rsn_ie &&
26e23750
JM		 1446 wpa_compare_rsn_ie(wpa_key_mgmt_ft(sm->key_mgmt),
1447 sm->ap_rsn_ie, sm->ap_rsn_ie_len,
1448 ie->rsn_ie, ie->rsn_ie_len))) {
6fc6879b
JM		 1449 wpa_report_ie_mismatch(sm, "IE in 3/4 msg does not match "
1450 "with IE in Beacon/ProbeResp",
1451 src_addr, ie->wpa_ie, ie->wpa_ie_len,
1452 ie->rsn_ie, ie->rsn_ie_len);
1453 return -1;
1454 }
1455
1456 if (sm->proto == WPA_PROTO_WPA &&
1457 ie->rsn_ie && sm->ap_rsn_ie == NULL && sm->rsn_enabled) {
1458 wpa_report_ie_mismatch(sm, "Possible downgrade attack "
1459 "detected - RSN was enabled and RSN IE "
1460 "was in msg 3/4, but not in "
1461 "Beacon/ProbeResp",
1462 src_addr, ie->wpa_ie, ie->wpa_ie_len,
1463 ie->rsn_ie, ie->rsn_ie_len);
1464 return -1;
1465 }
1466
146889e3
JM		 1467 if ((sm->ap_rsnxe && !ie->rsnxe) ||
1468 (!sm->ap_rsnxe && ie->rsnxe) ||
1469 (sm->ap_rsnxe && ie->rsnxe &&
1470 (sm->ap_rsnxe_len != ie->rsnxe_len ||
1471 os_memcmp(sm->ap_rsnxe, ie->rsnxe, sm->ap_rsnxe_len) != 0))) {
1472 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1473 "WPA: RSNXE mismatch between Beacon/ProbeResp and EAPOL-Key msg 3/4");
fad04494
JM		 1474 wpa_hexdump(MSG_INFO, "RSNXE in Beacon/ProbeResp",
1475 sm->ap_rsnxe, sm->ap_rsnxe_len);
1476 wpa_hexdump(MSG_INFO, "RSNXE in EAPOL-Key msg 3/4",
1477 ie->rsnxe, ie->rsnxe_len);
1478 wpa_sm_deauthenticate(sm, WLAN_REASON_IE_IN_4WAY_DIFFERS);
146889e3
JM		 1479 return -1;
1480 }
1481
6fc6879b 1482#ifdef CONFIG_IEEE80211R
5af8187e
JM		 1483 if (wpa_key_mgmt_ft(sm->key_mgmt) &&
1484 wpa_supplicant_validate_ie_ft(sm, src_addr, ie) < 0)
1485 return -1;
6fc6879b
JM		 1486#endif /* CONFIG_IEEE80211R */
1487
1488 return 0;
1489}
1490
1491
1492/**
1493 * wpa_supplicant_send_4_of_4 - Send message 4 of WPA/RSN 4-Way Handshake
1494 * @sm: Pointer to WPA state machine data from wpa_sm_init()
1495 * @dst: Destination address for the frame
1496 * @key: Pointer to the EAPOL-Key frame header
1497 * @ver: Version bits from EAPOL-Key Key Info
1498 * @key_info: Key Info
6fc6879b 1499 * @ptk: PTK to use for keyed hash and encryption
c93b7e18 1500 * Returns: >= 0 on success, < 0 on failure
6fc6879b
JM		 1501 */
1502int wpa_supplicant_send_4_of_4(struct wpa_sm *sm, const unsigned char *dst,
1503 const struct wpa_eapol_key *key,
1504 u16 ver, u16 key_info,
6fc6879b
JM		 1505 struct wpa_ptk *ptk)
1506{
5e3b5197 1507 size_t mic_len, hdrlen, rlen;
6fc6879b 1508 struct wpa_eapol_key *reply;
5e3b5197 1509 u8 *rbuf, *key_mic;
6fc6879b 1510
567da5bb 1511 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
6d014ffc 1512 hdrlen = sizeof(*reply) + mic_len + 2;
6fc6879b 1513 rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
5e3b5197 1514 hdrlen, &rlen, (void *) &reply);
6fc6879b
JM		 1515 if (rbuf == NULL)
1516 return -1;
1517
a14896e8
JM		 1518 reply->type = (sm->proto == WPA_PROTO_RSN ||
1519 sm->proto == WPA_PROTO_OSEN) ?
6fc6879b
JM		 1520 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
1521 key_info &= WPA_KEY_INFO_SECURE;
4a26ccda
JM		 1522 key_info |= ver | WPA_KEY_INFO_KEY_TYPE;
1523 if (mic_len)
1524 key_info |= WPA_KEY_INFO_MIC;
2022f1d0
JM		 1525 else
1526 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
6fc6879b 1527 WPA_PUT_BE16(reply->key_info, key_info);
a14896e8 1528 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN)
6fc6879b
JM		 1529 WPA_PUT_BE16(reply->key_length, 0);
1530 else
1531 os_memcpy(reply->key_length, key->key_length, 2);
1532 os_memcpy(reply->replay_counter, key->replay_counter,
1533 WPA_REPLAY_COUNTER_LEN);
1534
6d014ffc
JM		 1535 key_mic = (u8 *) (reply + 1);
1536 WPA_PUT_BE16(key_mic + mic_len, 0);
6fc6879b 1537
f049052b 1538 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Sending EAPOL-Key 4/4");
1049af7e
JM		 1539 return wpa_eapol_key_send(sm, ptk, ver, dst, ETH_P_EAPOL, rbuf, rlen,
1540 key_mic);
6fc6879b
JM		 1541}
1542
1543
1544static void wpa_supplicant_process_3_of_4(struct wpa_sm *sm,
1545 const struct wpa_eapol_key *key,
e6270129
JM		 1546 u16 ver, const u8 *key_data,
1547 size_t key_data_len)
6fc6879b 1548{
e6270129 1549 u16 key_info, keylen;
6fc6879b
JM		 1550 struct wpa_eapol_ie_parse ie;
1551
1552 wpa_sm_set_state(sm, WPA_4WAY_HANDSHAKE);
f049052b
BG		 1553 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: RX message 3 of 4-Way "
1554 "Handshake from " MACSTR " (ver=%d)", MAC2STR(sm->bssid), ver);
6fc6879b
JM		 1555
1556 key_info = WPA_GET_BE16(key->key_info);
1557
e6270129
JM		 1558 wpa_hexdump(MSG_DEBUG, "WPA: IE KeyData", key_data, key_data_len);
1559 if (wpa_supplicant_parse_ies(key_data, key_data_len, &ie) < 0)
d627a939 1560 goto failed;
6fc6879b 1561 if (ie.gtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
f049052b
BG		 1562 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1563 "WPA: GTK IE in unencrypted key data");
83935317 1564 goto failed;
6fc6879b 1565 }
6fc6879b 1566 if (ie.igtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
f049052b
BG		 1567 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1568 "WPA: IGTK KDE in unencrypted key data");
83935317 1569 goto failed;
6fc6879b
JM		 1570 }
1571
8dd9f9cd
JM		 1572 if (ie.igtk &&
1573 wpa_cipher_valid_mgmt_group(sm->mgmt_group_cipher) &&
1574 ie.igtk_len != WPA_IGTK_KDE_PREFIX_LEN +
1575 (unsigned int) wpa_cipher_key_len(sm->mgmt_group_cipher)) {
f049052b
BG		 1576 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1577 "WPA: Invalid IGTK KDE length %lu",
1578 (unsigned long) ie.igtk_len);
83935317 1579 goto failed;
6fc6879b 1580 }
6fc6879b
JM		 1581
1582 if (wpa_supplicant_validate_ie(sm, sm->bssid, &ie) < 0)
83935317 1583 goto failed;
6fc6879b
JM		 1584
1585 if (os_memcmp(sm->anonce, key->key_nonce, WPA_NONCE_LEN) != 0) {
f049052b
BG		 1586 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1587 "WPA: ANonce from message 1 of 4-Way Handshake "
1588 "differs from 3 of 4-Way Handshake - drop packet (src="
1589 MACSTR ")", MAC2STR(sm->bssid));
83935317 1590 goto failed;
6fc6879b
JM		 1591 }
1592
1593 keylen = WPA_GET_BE16(key->key_length);
c3550295
JM		 1594 if (keylen != wpa_cipher_key_len(sm->pairwise_cipher)) {
1595 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1596 "WPA: Invalid %s key length %d (src=" MACSTR
1597 ")", wpa_cipher_txt(sm->pairwise_cipher), keylen,
1598 MAC2STR(sm->bssid));
1599 goto failed;
6fc6879b
JM		 1600 }
1601
25ef8529
JM		 1602#ifdef CONFIG_P2P
1603 if (ie.ip_addr_alloc) {
1604 os_memcpy(sm->p2p_ip_addr, ie.ip_addr_alloc, 3 * 4);
1605 wpa_hexdump(MSG_DEBUG, "P2P: IP address info",
1606 sm->p2p_ip_addr, sizeof(sm->p2p_ip_addr));
1607 }
1608#endif /* CONFIG_P2P */
1609
aed61c4e
MV		 1610#ifdef CONFIG_OCV
1611 if (wpa_sm_ocv_enabled(sm)) {
1612 struct wpa_channel_info ci;
1613
1614 if (wpa_sm_channel_info(sm, &ci) != 0) {
1615 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1616 "Failed to get channel info to validate received OCI in EAPOL-Key 3/4");
1617 return;
1618 }
1619
1620 if (ocv_verify_tx_params(ie.oci, ie.oci_len, &ci,
1621 channel_width_to_int(ci.chanwidth),
1622 ci.seg1_idx) != 0) {
1623 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "%s",
1624 ocv_errorstr);
1625 return;
1626 }
1627 }
1628#endif /* CONFIG_OCV */
1629
6fc6879b 1630 if (wpa_supplicant_send_4_of_4(sm, sm->bssid, key, ver, key_info,
c93b7e18 1631 &sm->ptk) < 0) {
83935317
JM		 1632 goto failed;
1633 }
6fc6879b
JM		 1634
1635 /* SNonce was successfully used in msg 3/4, so mark it to be renewed
1636 * for the next 4-Way Handshake. If msg 3 is received again, the old
1637 * SNonce will still be used to avoid changing PTK. */
1638 sm->renew_snonce = 1;
1639
1640 if (key_info & WPA_KEY_INFO_INSTALL) {
a919a260 1641 if (wpa_supplicant_install_ptk(sm, key, KEY_FLAG_RX_TX))
83935317 1642 goto failed;
6fc6879b
JM		 1643 }
1644
1645 if (key_info & WPA_KEY_INFO_SECURE) {
1646 wpa_sm_mlme_setprotection(
1647 sm, sm->bssid, MLME_SETPROTECTION_PROTECT_TYPE_RX,
1648 MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
1649 eapol_sm_notify_portValid(sm->eapol, TRUE);
1650 }
1651 wpa_sm_set_state(sm, WPA_GROUP_HANDSHAKE);
1652
dff1e285 1653 if (sm->group_cipher == WPA_CIPHER_GTK_NOT_USED) {
dfdabd91
JM		 1654 /* No GTK to be set to the driver */
1655 } else if (!ie.gtk && sm->proto == WPA_PROTO_RSN) {
1656 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1657 "RSN: No GTK KDE included in EAPOL-Key msg 3/4");
1658 goto failed;
dff1e285 1659 } else if (ie.gtk &&
6fc6879b
JM		 1660 wpa_supplicant_pairwise_gtk(sm, key,
1661 ie.gtk, ie.gtk_len, key_info) < 0) {
f049052b
BG		 1662 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1663 "RSN: Failed to configure GTK");
83935317 1664 goto failed;
6fc6879b
JM		 1665 }
1666
83935317 1667 if (ieee80211w_set_keys(sm, &ie) < 0) {
f049052b
BG		 1668 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1669 "RSN: Failed to configure IGTK");
83935317
JM		 1670 goto failed;
1671 }
1672
dfdabd91
JM		 1673 if (sm->group_cipher == WPA_CIPHER_GTK_NOT_USED || ie.gtk)
1674 wpa_supplicant_key_neg_complete(sm, sm->bssid,
1675 key_info & WPA_KEY_INFO_SECURE);
1676
392e68e8
SD		 1677 if (ie.gtk)
1678 wpa_sm_set_rekey_offload(sm);
b14a210c 1679
17d4b774
JM		 1680 /* Add PMKSA cache entry for Suite B AKMs here since PMKID can be
1681 * calculated only after KCK has been derived. Though, do not replace an
1682 * existing PMKSA entry after each 4-way handshake (i.e., new KCK/PMKID)
1683 * to avoid unnecessary changes of PMKID while continuing to use the
1684 * same PMK. */
1685 if (sm->proto == WPA_PROTO_RSN && wpa_key_mgmt_suite_b(sm->key_mgmt) &&
1686 !sm->cur_pmksa) {
087a1f4e
JM		 1687 struct rsn_pmksa_cache_entry *sa;
1688
70c93963 1689 sa = pmksa_cache_add(sm->pmksa, sm->pmk, sm->pmk_len, NULL,
98cd3d1c 1690 sm->ptk.kck, sm->ptk.kck_len,
087a1f4e 1691 sm->bssid, sm->own_addr,
869af307 1692 sm->network_ctx, sm->key_mgmt, NULL);
087a1f4e
JM		 1693 if (!sm->cur_pmksa)
1694 sm->cur_pmksa = sa;
1695 }
1696
761396e4 1697 sm->msg_3_of_4_ok = 1;
83935317
JM		 1698 return;
1699
1700failed:
1701 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
6fc6879b
JM		 1702}
1703
1704
1705static int wpa_supplicant_process_1_of_2_rsn(struct wpa_sm *sm,
1706 const u8 *keydata,
1707 size_t keydatalen,
1708 u16 key_info,
1709 struct wpa_gtk_data *gd)
1710{
1711 int maxkeylen;
1712 struct wpa_eapol_ie_parse ie;
1713
ecbdc1a1
JM		 1714 wpa_hexdump_key(MSG_DEBUG, "RSN: msg 1/2 key data",
1715 keydata, keydatalen);
d627a939
JM		 1716 if (wpa_supplicant_parse_ies(keydata, keydatalen, &ie) < 0)
1717 return -1;
6fc6879b 1718 if (ie.gtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
f049052b
BG		 1719 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1720 "WPA: GTK IE in unencrypted key data");
6fc6879b
JM		 1721 return -1;
1722 }
1723 if (ie.gtk == NULL) {
f049052b
BG		 1724 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1725 "WPA: No GTK IE in Group Key msg 1/2");
6fc6879b
JM		 1726 return -1;
1727 }
1728 maxkeylen = gd->gtk_len = ie.gtk_len - 2;
1729
aed61c4e
MV		 1730#ifdef CONFIG_OCV
1731 if (wpa_sm_ocv_enabled(sm)) {
1732 struct wpa_channel_info ci;
1733
1734 if (wpa_sm_channel_info(sm, &ci) != 0) {
1735 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1736 "Failed to get channel info to validate received OCI in EAPOL-Key group msg 1/2");
1737 return -1;
1738 }
1739
1740 if (ocv_verify_tx_params(ie.oci, ie.oci_len, &ci,
1741 channel_width_to_int(ci.chanwidth),
1742 ci.seg1_idx) != 0) {
1743 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "%s",
1744 ocv_errorstr);
1745 return -1;
1746 }
1747 }
1748#endif /* CONFIG_OCV */
1749
f049052b 1750 if (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
6fc6879b
JM		 1751 gd->gtk_len, maxkeylen,
1752 &gd->key_rsc_len, &gd->alg))
1753 return -1;
1754
7cb9bb4d
JM		 1755 wpa_hexdump_key(MSG_DEBUG, "RSN: received GTK in group key handshake",
1756 ie.gtk, ie.gtk_len);
6fc6879b
JM		 1757 gd->keyidx = ie.gtk[0] & 0x3;
1758 gd->tx = wpa_supplicant_gtk_tx_bit_workaround(sm,
1759 !!(ie.gtk[0] & BIT(2)));
1760 if (ie.gtk_len - 2 > sizeof(gd->gtk)) {
f049052b
BG		 1761 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1762 "RSN: Too long GTK in GTK IE (len=%lu)",
1763 (unsigned long) ie.gtk_len - 2);
6fc6879b
JM		 1764 return -1;
1765 }
1766 os_memcpy(gd->gtk, ie.gtk + 2, ie.gtk_len - 2);
1767
1768 if (ieee80211w_set_keys(sm, &ie) < 0)
f049052b
BG		 1769 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1770 "RSN: Failed to configure IGTK");
6fc6879b
JM		 1771
1772 return 0;
1773}
1774
1775
1776static int wpa_supplicant_process_1_of_2_wpa(struct wpa_sm *sm,
1777 const struct wpa_eapol_key *key,
e6270129
JM		 1778 const u8 *key_data,
1779 size_t key_data_len, u16 key_info,
1780 u16 ver, struct wpa_gtk_data *gd)
6fc6879b
JM		 1781{
1782 size_t maxkeylen;
c397eff8 1783 u16 gtk_len;
6fc6879b 1784
c397eff8 1785 gtk_len = WPA_GET_BE16(key->key_length);
e6270129 1786 maxkeylen = key_data_len;
6fc6879b
JM		 1787 if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
1788 if (maxkeylen < 8) {
f049052b
BG		 1789 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1790 "WPA: Too short maxkeylen (%lu)",
1791 (unsigned long) maxkeylen);
6fc6879b
JM		 1792 return -1;
1793 }
1794 maxkeylen -= 8;
1795 }
1796
c397eff8
JM		 1797 if (gtk_len > maxkeylen ||
1798 wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
1799 gtk_len, maxkeylen,
6fc6879b
JM		 1800 &gd->key_rsc_len, &gd->alg))
1801 return -1;
1802
c397eff8 1803 gd->gtk_len = gtk_len;
6fc6879b
JM		 1804 gd->keyidx = (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >>
1805 WPA_KEY_INFO_KEY_INDEX_SHIFT;
98cd3d1c 1806 if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 && sm->ptk.kek_len == 16) {
7cb53ded
JM		 1807#ifdef CONFIG_NO_RC4
1808 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1809 "WPA: RC4 not supported in the build");
1810 return -1;
1811#else /* CONFIG_NO_RC4 */
d2c33b91 1812 u8 ek[32];
e6270129 1813 if (key_data_len > sizeof(gd->gtk)) {
f049052b
BG		 1814 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1815 "WPA: RC4 key data too long (%lu)",
e6270129 1816 (unsigned long) key_data_len);
6fc6879b
JM		 1817 return -1;
1818 }
d2c33b91 1819 os_memcpy(ek, key->key_iv, 16);
98cd3d1c 1820 os_memcpy(ek + 16, sm->ptk.kek, sm->ptk.kek_len);
e6270129
JM		 1821 os_memcpy(gd->gtk, key_data, key_data_len);
1822 if (rc4_skip(ek, 32, 256, gd->gtk, key_data_len)) {
31bc66e4 1823 forced_memzero(ek, sizeof(ek));
f049052b
BG		 1824 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
1825 "WPA: RC4 failed");
7a215dfc
JM		 1826 return -1;
1827 }
31bc66e4 1828 forced_memzero(ek, sizeof(ek));
7cb53ded 1829#endif /* CONFIG_NO_RC4 */
6fc6879b 1830 } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
e6270129 1831 if (maxkeylen % 8) {
f049052b
BG		 1832 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1833 "WPA: Unsupported AES-WRAP len %lu",
e6270129 1834 (unsigned long) maxkeylen);
6fc6879b
JM		 1835 return -1;
1836 }
1837 if (maxkeylen > sizeof(gd->gtk)) {
f049052b
BG		 1838 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1839 "WPA: AES-WRAP key data "
1840 "too long (keydatalen=%lu maxkeylen=%lu)",
e6270129 1841 (unsigned long) key_data_len,
f049052b 1842 (unsigned long) maxkeylen);
6fc6879b
JM		 1843 return -1;
1844 }
98cd3d1c
JM		 1845 if (aes_unwrap(sm->ptk.kek, sm->ptk.kek_len, maxkeylen / 8,
1846 key_data, gd->gtk)) {
f049052b
BG		 1847 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1848 "WPA: AES unwrap failed - could not decrypt "
1849 "GTK");
6fc6879b
JM		 1850 return -1;
1851 }
1852 } else {
f049052b
BG		 1853 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1854 "WPA: Unsupported key_info type %d", ver);
6fc6879b
JM		 1855 return -1;
1856 }
1857 gd->tx = wpa_supplicant_gtk_tx_bit_workaround(
1858 sm, !!(key_info & WPA_KEY_INFO_TXRX));
1859 return 0;
1860}
1861
1862
1863static int wpa_supplicant_send_2_of_2(struct wpa_sm *sm,
1864 const struct wpa_eapol_key *key,
1865 int ver, u16 key_info)
1866{
5e3b5197 1867 size_t mic_len, hdrlen, rlen;
6fc6879b 1868 struct wpa_eapol_key *reply;
5e3b5197 1869 u8 *rbuf, *key_mic;
17c2559c
MV		 1870 size_t kde_len = 0;
1871
1872#ifdef CONFIG_OCV
1873 if (wpa_sm_ocv_enabled(sm))
1874 kde_len = OCV_OCI_KDE_LEN;
1875#endif /* CONFIG_OCV */
6fc6879b 1876
567da5bb 1877 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
6d014ffc 1878 hdrlen = sizeof(*reply) + mic_len + 2;
6fc6879b 1879 rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
17c2559c 1880 hdrlen + kde_len, &rlen, (void *) &reply);
6fc6879b
JM		 1881 if (rbuf == NULL)
1882 return -1;
1883
a14896e8
JM		 1884 reply->type = (sm->proto == WPA_PROTO_RSN ||
1885 sm->proto == WPA_PROTO_OSEN) ?
6fc6879b
JM		 1886 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
1887 key_info &= WPA_KEY_INFO_KEY_INDEX_MASK;
4a26ccda
JM		 1888 key_info |= ver | WPA_KEY_INFO_SECURE;
1889 if (mic_len)
1890 key_info |= WPA_KEY_INFO_MIC;
b44d1efd
VK		 1891 else
1892 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
6fc6879b 1893 WPA_PUT_BE16(reply->key_info, key_info);
a14896e8 1894 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN)
6fc6879b
JM		 1895 WPA_PUT_BE16(reply->key_length, 0);
1896 else
1897 os_memcpy(reply->key_length, key->key_length, 2);
1898 os_memcpy(reply->replay_counter, key->replay_counter,
1899 WPA_REPLAY_COUNTER_LEN);
1900
6d014ffc 1901 key_mic = (u8 *) (reply + 1);
17c2559c
MV		 1902 WPA_PUT_BE16(key_mic + mic_len, kde_len); /* Key Data Length */
1903
1904#ifdef CONFIG_OCV
1905 if (wpa_sm_ocv_enabled(sm)) {
1906 struct wpa_channel_info ci;
1907 u8 *pos;
1908
1909 if (wpa_sm_channel_info(sm, &ci) != 0) {
1910 wpa_printf(MSG_WARNING,
1911 "Failed to get channel info for OCI element in EAPOL-Key 2/2");
1912 os_free(rbuf);
1913 return -1;
1914 }
1915
1916 pos = key_mic + mic_len + 2; /* Key Data */
1917 if (ocv_insert_oci_kde(&ci, &pos) < 0) {
1918 os_free(rbuf);
1919 return -1;
1920 }
1921 }
1922#endif /* CONFIG_OCV */
6fc6879b 1923
f049052b 1924 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Sending EAPOL-Key 2/2");
1049af7e
JM		 1925 return wpa_eapol_key_send(sm, &sm->ptk, ver, sm->bssid, ETH_P_EAPOL,
1926 rbuf, rlen, key_mic);
6fc6879b
JM		 1927}
1928
1929
1930static void wpa_supplicant_process_1_of_2(struct wpa_sm *sm,
1931 const unsigned char *src_addr,
1932 const struct wpa_eapol_key *key,
e6270129
JM		 1933 const u8 *key_data,
1934 size_t key_data_len, u16 ver)
6fc6879b 1935{
e6270129 1936 u16 key_info;
6fc6879b
JM		 1937 int rekey, ret;
1938 struct wpa_gtk_data gd;
73ed03f3 1939 const u8 *key_rsc;
6fc6879b 1940
04243740 1941 if (!sm->msg_3_of_4_ok && !wpa_fils_is_completed(sm)) {
761396e4
JM		 1942 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1943 "WPA: Group Key Handshake started prior to completion of 4-way handshake");
1944 goto failed;
1945 }
1946
6fc6879b
JM		 1947 os_memset(&gd, 0, sizeof(gd));
1948
1949 rekey = wpa_sm_get_state(sm) == WPA_COMPLETED;
f049052b
BG		 1950 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: RX message 1 of Group Key "
1951 "Handshake from " MACSTR " (ver=%d)", MAC2STR(src_addr), ver);
6fc6879b
JM		 1952
1953 key_info = WPA_GET_BE16(key->key_info);
6fc6879b 1954
a14896e8 1955 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) {
e6270129
JM		 1956 ret = wpa_supplicant_process_1_of_2_rsn(sm, key_data,
1957 key_data_len, key_info,
6fc6879b
JM		 1958 &gd);
1959 } else {
e6270129
JM		 1960 ret = wpa_supplicant_process_1_of_2_wpa(sm, key, key_data,
1961 key_data_len,
1962 key_info, ver, &gd);
6fc6879b
JM		 1963 }
1964
1965 wpa_sm_set_state(sm, WPA_GROUP_HANDSHAKE);
1966
1967 if (ret)
83935317 1968 goto failed;
6fc6879b 1969
73ed03f3
MS		 1970 key_rsc = key->key_rsc;
1971 if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
1972 key_rsc = null_rsc;
1973
87e2db16 1974 if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) ||
c93b7e18 1975 wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0)
83935317 1976 goto failed;
31bc66e4 1977 forced_memzero(&gd, sizeof(gd));
6fc6879b
JM		 1978
1979 if (rekey) {
0f057fb2 1980 wpa_msg(sm->ctx->msg_ctx, MSG_INFO, "WPA: Group rekeying "
6fc6879b
JM		 1981 "completed with " MACSTR " [GTK=%s]",
1982 MAC2STR(sm->bssid), wpa_cipher_txt(sm->group_cipher));
1983 wpa_sm_cancel_auth_timeout(sm);
1984 wpa_sm_set_state(sm, WPA_COMPLETED);
1985 } else {
1986 wpa_supplicant_key_neg_complete(sm, sm->bssid,
1987 key_info &
1988 WPA_KEY_INFO_SECURE);
1989 }
392e68e8
SD		 1990
1991 wpa_sm_set_rekey_offload(sm);
1992
83935317
JM		 1993 return;
1994
1995failed:
31bc66e4 1996 forced_memzero(&gd, sizeof(gd));
83935317 1997 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
6fc6879b
JM		 1998}
1999
2000
2001static int wpa_supplicant_verify_eapol_key_mic(struct wpa_sm *sm,
6d014ffc 2002 struct wpa_eapol_key *key,
6fc6879b
JM		 2003 u16 ver,
2004 const u8 *buf, size_t len)
2005{
98cd3d1c 2006 u8 mic[WPA_EAPOL_KEY_MIC_MAX_LEN];
6fc6879b 2007 int ok = 0;
567da5bb 2008 size_t mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
6fc6879b 2009
6d014ffc 2010 os_memcpy(mic, key + 1, mic_len);
6fc6879b 2011 if (sm->tptk_set) {
6d014ffc 2012 os_memset(key + 1, 0, mic_len);
a6ea6653
JM		 2013 if (wpa_eapol_key_mic(sm->tptk.kck, sm->tptk.kck_len,
2014 sm->key_mgmt,
2015 ver, buf, len, (u8 *) (key + 1)) < 0 ||
2016 os_memcmp_const(mic, key + 1, mic_len) != 0) {
f049052b
BG		 2017 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2018 "WPA: Invalid EAPOL-Key MIC "
2019 "when using TPTK - ignoring TPTK");
525923b1
JM		 2020#ifdef TEST_FUZZ
2021 wpa_printf(MSG_INFO,
2022 "TEST: Ignore Key MIC failure for fuzz testing");
2023 goto continue_fuzz;
2024#endif /* TEST_FUZZ */
6fc6879b 2025 } else {
525923b1
JM		 2026#ifdef TEST_FUZZ
2027 continue_fuzz:
2028#endif /* TEST_FUZZ */
6fc6879b
JM		 2029 ok = 1;
2030 sm->tptk_set = 0;
2031 sm->ptk_set = 1;
2032 os_memcpy(&sm->ptk, &sm->tptk, sizeof(sm->ptk));
d2c33b91 2033 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
a00e946c
MV		 2034 /*
2035 * This assures the same TPTK in sm->tptk can never be
a68e0d86 2036 * copied twice to sm->ptk as the new PTK. In
a00e946c
MV		 2037 * combination with the installed flag in the wpa_ptk
2038 * struct, this assures the same PTK is only installed
2039 * once.
2040 */
2041 sm->renew_snonce = 1;
6fc6879b
JM		 2042 }
2043 }
2044
2045 if (!ok && sm->ptk_set) {
6d014ffc 2046 os_memset(key + 1, 0, mic_len);
a6ea6653
JM		 2047 if (wpa_eapol_key_mic(sm->ptk.kck, sm->ptk.kck_len,
2048 sm->key_mgmt,
2049 ver, buf, len, (u8 *) (key + 1)) < 0 ||
2050 os_memcmp_const(mic, key + 1, mic_len) != 0) {
f049052b
BG		 2051 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2052 "WPA: Invalid EAPOL-Key MIC - "
2053 "dropping packet");
525923b1
JM		 2054#ifdef TEST_FUZZ
2055 wpa_printf(MSG_INFO,
2056 "TEST: Ignore Key MIC failure for fuzz testing");
2057 goto continue_fuzz2;
2058#endif /* TEST_FUZZ */
6fc6879b
JM		 2059 return -1;
2060 }
525923b1
JM		 2061#ifdef TEST_FUZZ
2062 continue_fuzz2:
2063#endif /* TEST_FUZZ */
6fc6879b
JM		 2064 ok = 1;
2065 }
2066
2067 if (!ok) {
f049052b
BG		 2068 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2069 "WPA: Could not verify EAPOL-Key MIC - "
2070 "dropping packet");
6fc6879b
JM		 2071 return -1;
2072 }
2073
2074 os_memcpy(sm->rx_replay_counter, key->replay_counter,
2075 WPA_REPLAY_COUNTER_LEN);
2076 sm->rx_replay_counter_set = 1;
2077 return 0;
2078}
2079
2080
2081/* Decrypt RSN EAPOL-Key key data (RC4 or AES-WRAP) */
2082static int wpa_supplicant_decrypt_key_data(struct wpa_sm *sm,
6d014ffc
JM		 2083 struct wpa_eapol_key *key,
2084 size_t mic_len, u16 ver,
e6270129 2085 u8 *key_data, size_t *key_data_len)
6fc6879b 2086{
6fc6879b 2087 wpa_hexdump(MSG_DEBUG, "RSN: encrypted key data",
e6270129 2088 key_data, *key_data_len);
6fc6879b 2089 if (!sm->ptk_set) {
f049052b
BG		 2090 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2091 "WPA: PTK not available, cannot decrypt EAPOL-Key Key "
2092 "Data");
6fc6879b
JM		 2093 return -1;
2094 }
2095
2096 /* Decrypt key data here so that this operation does not need
2097 * to be implemented separately for each message type. */
98cd3d1c 2098 if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 && sm->ptk.kek_len == 16) {
7cb53ded
JM		 2099#ifdef CONFIG_NO_RC4
2100 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2101 "WPA: RC4 not supported in the build");
2102 return -1;
2103#else /* CONFIG_NO_RC4 */
6fc6879b 2104 u8 ek[32];
ef9627cb
JM		 2105
2106 wpa_printf(MSG_DEBUG, "WPA: Decrypt Key Data using RC4");
6fc6879b 2107 os_memcpy(ek, key->key_iv, 16);
98cd3d1c 2108 os_memcpy(ek + 16, sm->ptk.kek, sm->ptk.kek_len);
e6270129 2109 if (rc4_skip(ek, 32, 256, key_data, *key_data_len)) {
31bc66e4 2110 forced_memzero(ek, sizeof(ek));
f049052b
BG		 2111 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
2112 "WPA: RC4 failed");
7a215dfc
JM		 2113 return -1;
2114 }
31bc66e4 2115 forced_memzero(ek, sizeof(ek));
7cb53ded 2116#endif /* CONFIG_NO_RC4 */
6fc6879b 2117 } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES ||
df0f01d9 2118 ver == WPA_KEY_INFO_TYPE_AES_128_CMAC ||
4bc801ab 2119 wpa_use_aes_key_wrap(sm->key_mgmt)) {
6fc6879b 2120 u8 *buf;
ef9627cb
JM		 2121
2122 wpa_printf(MSG_DEBUG,
2123 "WPA: Decrypt Key Data using AES-UNWRAP (KEK length %u)",
2124 (unsigned int) sm->ptk.kek_len);
e6270129 2125 if (*key_data_len < 8 || *key_data_len % 8) {
f049052b 2126 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
e6270129
JM		 2127 "WPA: Unsupported AES-WRAP len %u",
2128 (unsigned int) *key_data_len);
6fc6879b
JM		 2129 return -1;
2130 }
e6270129
JM		 2131 *key_data_len -= 8; /* AES-WRAP adds 8 bytes */
2132 buf = os_malloc(*key_data_len);
6fc6879b 2133 if (buf == NULL) {
f049052b
BG		 2134 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2135 "WPA: No memory for AES-UNWRAP buffer");
6fc6879b
JM		 2136 return -1;
2137 }
525923b1
JM		 2138#ifdef TEST_FUZZ
2139 os_memset(buf, 0x11, *key_data_len);
2140#endif /* TEST_FUZZ */
98cd3d1c 2141 if (aes_unwrap(sm->ptk.kek, sm->ptk.kek_len, *key_data_len / 8,
e6270129 2142 key_data, buf)) {
525923b1
JM		 2143#ifdef TEST_FUZZ
2144 wpa_printf(MSG_INFO,
2145 "TEST: Ignore AES unwrap failure for fuzz testing");
2146 goto continue_fuzz;
2147#endif /* TEST_FUZZ */
cd5895e8 2148 bin_clear_free(buf, *key_data_len);
f049052b
BG		 2149 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2150 "WPA: AES unwrap failed - "
2151 "could not decrypt EAPOL-Key key data");
6fc6879b
JM		 2152 return -1;
2153 }
525923b1
JM		 2154#ifdef TEST_FUZZ
2155 continue_fuzz:
2156#endif /* TEST_FUZZ */
e6270129 2157 os_memcpy(key_data, buf, *key_data_len);
cd5895e8 2158 bin_clear_free(buf, *key_data_len);
6d014ffc 2159 WPA_PUT_BE16(((u8 *) (key + 1)) + mic_len, *key_data_len);
6fc6879b 2160 } else {
f049052b
BG		 2161 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2162 "WPA: Unsupported key_info type %d", ver);
6fc6879b
JM		 2163 return -1;
2164 }
2165 wpa_hexdump_key(MSG_DEBUG, "WPA: decrypted EAPOL-Key key data",
e6270129 2166 key_data, *key_data_len);
6fc6879b
JM		 2167 return 0;
2168}
2169
2170
2171/**
2172 * wpa_sm_aborted_cached - Notify WPA that PMKSA caching was aborted
2173 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2174 */
2175void wpa_sm_aborted_cached(struct wpa_sm *sm)
2176{
2177 if (sm && sm->cur_pmksa) {
f049052b
BG		 2178 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2179 "RSN: Cancelling PMKSA caching attempt");
6fc6879b
JM		 2180 sm->cur_pmksa = NULL;
2181 }
2182}
2183
2184
f049052b 2185static void wpa_eapol_key_dump(struct wpa_sm *sm,
5e3b5197
JM		 2186 const struct wpa_eapol_key *key,
2187 unsigned int key_data_len,
2188 const u8 *mic, unsigned int mic_len)
6fc6879b
JM		 2189{
2190#ifndef CONFIG_NO_STDOUT_DEBUG
2191 u16 key_info = WPA_GET_BE16(key->key_info);
2192
f049052b
BG		 2193 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, " EAPOL-Key type=%d", key->type);
2194 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2195 " key_info 0x%x (ver=%d keyidx=%d rsvd=%d %s%s%s%s%s%s%s%s)",
2196 key_info, key_info & WPA_KEY_INFO_TYPE_MASK,
2197 (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >>
2198 WPA_KEY_INFO_KEY_INDEX_SHIFT,
2199 (key_info & (BIT(13) | BIT(14) | BIT(15))) >> 13,
2200 key_info & WPA_KEY_INFO_KEY_TYPE ? "Pairwise" : "Group",
2201 key_info & WPA_KEY_INFO_INSTALL ? " Install" : "",
2202 key_info & WPA_KEY_INFO_ACK ? " Ack" : "",
2203 key_info & WPA_KEY_INFO_MIC ? " MIC" : "",
2204 key_info & WPA_KEY_INFO_SECURE ? " Secure" : "",
2205 key_info & WPA_KEY_INFO_ERROR ? " Error" : "",
2206 key_info & WPA_KEY_INFO_REQUEST ? " Request" : "",
2207 key_info & WPA_KEY_INFO_ENCR_KEY_DATA ? " Encr" : "");
2208 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2209 " key_length=%u key_data_length=%u",
5e3b5197 2210 WPA_GET_BE16(key->key_length), key_data_len);
6fc6879b
JM		 2211 wpa_hexdump(MSG_DEBUG, " replay_counter",
2212 key->replay_counter, WPA_REPLAY_COUNTER_LEN);
2213 wpa_hexdump(MSG_DEBUG, " key_nonce", key->key_nonce, WPA_NONCE_LEN);
2214 wpa_hexdump(MSG_DEBUG, " key_iv", key->key_iv, 16);
2215 wpa_hexdump(MSG_DEBUG, " key_rsc", key->key_rsc, 8);
2216 wpa_hexdump(MSG_DEBUG, " key_id (reserved)", key->key_id, 8);
5e3b5197 2217 wpa_hexdump(MSG_DEBUG, " key_mic", mic, mic_len);
6fc6879b
JM		 2218#endif /* CONFIG_NO_STDOUT_DEBUG */
2219}
2220
2221
0ab1dd01
JM		 2222#ifdef CONFIG_FILS
2223static int wpa_supp_aead_decrypt(struct wpa_sm *sm, u8 *buf, size_t buf_len,
2224 size_t *key_data_len)
2225{
2226 struct wpa_ptk *ptk;
2227 struct ieee802_1x_hdr *hdr;
2228 struct wpa_eapol_key *key;
2229 u8 *pos, *tmp;
2230 const u8 *aad[1];
2231 size_t aad_len[1];
2232
2233 if (*key_data_len < AES_BLOCK_SIZE) {
2234 wpa_printf(MSG_INFO, "No room for AES-SIV data in the frame");
2235 return -1;
2236 }
2237
2238 if (sm->tptk_set)
2239 ptk = &sm->tptk;
2240 else if (sm->ptk_set)
2241 ptk = &sm->ptk;
2242 else
2243 return -1;
2244
2245 hdr = (struct ieee802_1x_hdr *) buf;
2246 key = (struct wpa_eapol_key *) (hdr + 1);
2247 pos = (u8 *) (key + 1);
2248 pos += 2; /* Pointing at the Encrypted Key Data field */
2249
2250 tmp = os_malloc(*key_data_len);
2251 if (!tmp)
2252 return -1;
2253
2254 /* AES-SIV AAD from EAPOL protocol version field (inclusive) to
2255 * to Key Data (exclusive). */
2256 aad[0] = buf;
2257 aad_len[0] = pos - buf;
2258 if (aes_siv_decrypt(ptk->kek, ptk->kek_len, pos, *key_data_len,
2259 1, aad, aad_len, tmp) < 0) {
2260 wpa_printf(MSG_INFO, "Invalid AES-SIV data in the frame");
2261 bin_clear_free(tmp, *key_data_len);
2262 return -1;
2263 }
2264
2265 /* AEAD decryption and validation completed successfully */
2266 (*key_data_len) -= AES_BLOCK_SIZE;
2267 wpa_hexdump_key(MSG_DEBUG, "WPA: Decrypted Key Data",
2268 tmp, *key_data_len);
2269
2270 /* Replace Key Data field with the decrypted version */
2271 os_memcpy(pos, tmp, *key_data_len);
2272 pos -= 2; /* Key Data Length field */
2273 WPA_PUT_BE16(pos, *key_data_len);
2274 bin_clear_free(tmp, *key_data_len);
2275
2276 if (sm->tptk_set) {
2277 sm->tptk_set = 0;
2278 sm->ptk_set = 1;
2279 os_memcpy(&sm->ptk, &sm->tptk, sizeof(sm->ptk));
2280 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
2281 }
2282
2283 os_memcpy(sm->rx_replay_counter, key->replay_counter,
2284 WPA_REPLAY_COUNTER_LEN);
2285 sm->rx_replay_counter_set = 1;
2286
2287 return 0;
2288}
2289#endif /* CONFIG_FILS */
2290
2291
6fc6879b
JM		 2292/**
2293 * wpa_sm_rx_eapol - Process received WPA EAPOL frames
2294 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2295 * @src_addr: Source MAC address of the EAPOL packet
2296 * @buf: Pointer to the beginning of the EAPOL data (EAPOL header)
2297 * @len: Length of the EAPOL frame
2298 * Returns: 1 = WPA EAPOL-Key processed, 0 = not a WPA EAPOL-Key, -1 failure
2299 *
2300 * This function is called for each received EAPOL frame. Other than EAPOL-Key
2301 * frames can be skipped if filtering is done elsewhere. wpa_sm_rx_eapol() is
2302 * only processing WPA and WPA2 EAPOL-Key frames.
2303 *
2304 * The received EAPOL-Key packets are validated and valid packets are replied
2305 * to. In addition, key material (PTK, GTK) is configured at the end of a
2306 * successful key handshake.
2307 */
2308int wpa_sm_rx_eapol(struct wpa_sm *sm, const u8 *src_addr,
2309 const u8 *buf, size_t len)
2310{
e6270129 2311 size_t plen, data_len, key_data_len;
d56d7e56 2312 const struct ieee802_1x_hdr *hdr;
6fc6879b
JM		 2313 struct wpa_eapol_key *key;
2314 u16 key_info, ver;
d56d7e56 2315 u8 *tmp = NULL;
6fc6879b 2316 int ret = -1;
6d014ffc 2317 u8 *mic, *key_data;
5e3b5197 2318 size_t mic_len, keyhdrlen;
6fc6879b
JM		 2319
2320#ifdef CONFIG_IEEE80211R
2321 sm->ft_completed = 0;
2322#endif /* CONFIG_IEEE80211R */
2323
567da5bb 2324 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
6d014ffc 2325 keyhdrlen = sizeof(*key) + mic_len + 2;
5e3b5197
JM		 2326
2327 if (len < sizeof(*hdr) + keyhdrlen) {
f049052b
BG		 2328 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2329 "WPA: EAPOL frame too short to be a WPA "
2330 "EAPOL-Key (len %lu, expecting at least %lu)",
2331 (unsigned long) len,
5e3b5197 2332 (unsigned long) sizeof(*hdr) + keyhdrlen);
6fc6879b
JM		 2333 return 0;
2334 }
2335
d56d7e56 2336 hdr = (const struct ieee802_1x_hdr *) buf;
6fc6879b
JM		 2337 plen = be_to_host16(hdr->length);
2338 data_len = plen + sizeof(*hdr);
f049052b
BG		 2339 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2340 "IEEE 802.1X RX: version=%d type=%d length=%lu",
2341 hdr->version, hdr->type, (unsigned long) plen);
6fc6879b
JM		 2342
2343 if (hdr->version < EAPOL_VERSION) {
2344 /* TODO: backwards compatibility */
2345 }
2346 if (hdr->type != IEEE802_1X_TYPE_EAPOL_KEY) {
f049052b
BG		 2347 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2348 "WPA: EAPOL frame (type %u) discarded, "
6fc6879b
JM		 2349 "not a Key frame", hdr->type);
2350 ret = 0;
2351 goto out;
2352 }
d56d7e56 2353 wpa_hexdump(MSG_MSGDUMP, "WPA: RX EAPOL-Key", buf, len);
5e3b5197 2354 if (plen > len - sizeof(*hdr) || plen < keyhdrlen) {
f049052b
BG		 2355 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2356 "WPA: EAPOL frame payload size %lu "
2357 "invalid (frame size %lu)",
2358 (unsigned long) plen, (unsigned long) len);
6fc6879b
JM		 2359 ret = 0;
2360 goto out;
2361 }
d56d7e56
JM		 2362 if (data_len < len) {
2363 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2364 "WPA: ignoring %lu bytes after the IEEE 802.1X data",
2365 (unsigned long) len - data_len);
2366 }
2367
2368 /*
2369 * Make a copy of the frame since we need to modify the buffer during
2370 * MAC validation and Key Data decryption.
2371 */
a1f11e34 2372 tmp = os_memdup(buf, data_len);
d56d7e56
JM		 2373 if (tmp == NULL)
2374 goto out;
d56d7e56 2375 key = (struct wpa_eapol_key *) (tmp + sizeof(struct ieee802_1x_hdr));
6d014ffc
JM		 2376 mic = (u8 *) (key + 1);
2377 key_data = mic + mic_len + 2;
6fc6879b
JM		 2378
2379 if (key->type != EAPOL_KEY_TYPE_WPA && key->type != EAPOL_KEY_TYPE_RSN)
2380 {
f049052b
BG		 2381 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2382 "WPA: EAPOL-Key type (%d) unknown, discarded",
2383 key->type);
6fc6879b
JM		 2384 ret = 0;
2385 goto out;
2386 }
6fc6879b 2387
6d014ffc
JM		 2388 key_data_len = WPA_GET_BE16(mic + mic_len);
2389 wpa_eapol_key_dump(sm, key, key_data_len, mic, mic_len);
5e3b5197
JM		 2390
2391 if (key_data_len > plen - keyhdrlen) {
d56d7e56
JM		 2392 wpa_msg(sm->ctx->msg_ctx, MSG_INFO, "WPA: Invalid EAPOL-Key "
2393 "frame - key_data overflow (%u > %u)",
e6270129 2394 (unsigned int) key_data_len,
5e3b5197 2395 (unsigned int) (plen - keyhdrlen));
d56d7e56 2396 goto out;
6fc6879b 2397 }
d56d7e56
JM		 2398
2399 eapol_sm_notify_lower_layer_success(sm->eapol, 0);
6fc6879b
JM		 2400 key_info = WPA_GET_BE16(key->key_info);
2401 ver = key_info & WPA_KEY_INFO_TYPE_MASK;
2402 if (ver != WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 &&
6fc6879b 2403 ver != WPA_KEY_INFO_TYPE_AES_128_CMAC &&
df0f01d9 2404 ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES &&
4bc801ab 2405 !wpa_use_akm_defined(sm->key_mgmt)) {
f049052b
BG		 2406 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2407 "WPA: Unsupported EAPOL-Key descriptor version %d",
2408 ver);
6fc6879b
JM		 2409 goto out;
2410 }
2411
4bc801ab 2412 if (wpa_use_akm_defined(sm->key_mgmt) &&
929a2ea5
JM		 2413 ver != WPA_KEY_INFO_TYPE_AKM_DEFINED) {
2414 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2415 "RSN: Unsupported EAPOL-Key descriptor version %d (expected AKM defined = 0)",
2416 ver);
2417 goto out;
2418 }
2419
6fc6879b 2420#ifdef CONFIG_IEEE80211R
56586197 2421 if (wpa_key_mgmt_ft(sm->key_mgmt)) {
6fc6879b 2422 /* IEEE 802.11r uses a new key_info type (AES-128-CMAC). */
4bc801ab
JM		 2423 if (ver != WPA_KEY_INFO_TYPE_AES_128_CMAC &&
2424 !wpa_use_akm_defined(sm->key_mgmt)) {
f049052b
BG		 2425 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2426 "FT: AP did not use AES-128-CMAC");
6fc6879b
JM		 2427 goto out;
2428 }
2429 } else
2430#endif /* CONFIG_IEEE80211R */
56586197 2431 if (wpa_key_mgmt_sha256(sm->key_mgmt)) {
df0f01d9 2432 if (ver != WPA_KEY_INFO_TYPE_AES_128_CMAC &&
4bc801ab 2433 !wpa_use_akm_defined(sm->key_mgmt)) {
f049052b
BG		 2434 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2435 "WPA: AP did not use the "
2436 "negotiated AES-128-CMAC");
56586197
JM		 2437 goto out;
2438 }
7d2ed8ba
JM		 2439 } else if (sm->pairwise_cipher == WPA_CIPHER_CCMP &&
2440 !wpa_use_akm_defined(sm->key_mgmt) &&
2441 ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
f049052b
BG		 2442 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2443 "WPA: CCMP is used, but EAPOL-Key "
2444 "descriptor version (%d) is not 2", ver);
6fc6879b
JM		 2445 if (sm->group_cipher != WPA_CIPHER_CCMP &&
2446 !(key_info & WPA_KEY_INFO_KEY_TYPE)) {
2447 /* Earlier versions of IEEE 802.11i did not explicitly
2448 * require version 2 descriptor for all EAPOL-Key
2449 * packets, so allow group keys to use version 1 if
2450 * CCMP is not used for them. */
f049052b
BG		 2451 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2452 "WPA: Backwards compatibility: allow invalid "
2453 "version for non-CCMP group keys");
9f6a7cdd
JM		 2454 } else if (ver == WPA_KEY_INFO_TYPE_AES_128_CMAC) {
2455 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2456 "WPA: Interoperability workaround: allow incorrect (should have been HMAC-SHA1), but stronger (is AES-128-CMAC), descriptor version to be used");
6fc6879b
JM		 2457 } else
2458 goto out;
801e1173 2459 } else if (sm->pairwise_cipher == WPA_CIPHER_GCMP &&
4bc801ab 2460 !wpa_use_akm_defined(sm->key_mgmt) &&
801e1173 2461 ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
eb7719ff
JM		 2462 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2463 "WPA: GCMP is used, but EAPOL-Key "
2464 "descriptor version (%d) is not 2", ver);
2465 goto out;
2466 }
6fc6879b 2467
a0bf1b68 2468 if (sm->rx_replay_counter_set &&
6fc6879b
JM		 2469 os_memcmp(key->replay_counter, sm->rx_replay_counter,
2470 WPA_REPLAY_COUNTER_LEN) <= 0) {
f049052b
BG		 2471 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2472 "WPA: EAPOL-Key Replay Counter did not increase - "
2473 "dropping packet");
6fc6879b
JM		 2474 goto out;
2475 }
2476
a0bf1b68
JM		 2477 if (key_info & WPA_KEY_INFO_SMK_MESSAGE) {
2478 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2479 "WPA: Unsupported SMK bit in key_info");
2480 goto out;
2481 }
2482
2483 if (!(key_info & WPA_KEY_INFO_ACK)) {
f049052b
BG		 2484 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2485 "WPA: No Ack bit in key_info");
6fc6879b
JM		 2486 goto out;
2487 }
2488
2489 if (key_info & WPA_KEY_INFO_REQUEST) {
f049052b
BG		 2490 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2491 "WPA: EAPOL-Key with Request bit - dropped");
6fc6879b
JM		 2492 goto out;
2493 }
2494
a0bf1b68 2495 if ((key_info & WPA_KEY_INFO_MIC) &&
6d014ffc 2496 wpa_supplicant_verify_eapol_key_mic(sm, key, ver, tmp, data_len))
6fc6879b
JM		 2497 goto out;
2498
0ab1dd01
JM		 2499#ifdef CONFIG_FILS
2500 if (!mic_len && (key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
2501 if (wpa_supp_aead_decrypt(sm, tmp, data_len, &key_data_len))
2502 goto out;
2503 }
2504#endif /* CONFIG_FILS */
2505
a14896e8 2506 if ((sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) &&
0ab1dd01 2507 (key_info & WPA_KEY_INFO_ENCR_KEY_DATA) && mic_len) {
3e34cfdf
MV		 2508 /*
2509 * Only decrypt the Key Data field if the frame's authenticity
2510 * was verified. When using AES-SIV (FILS), the MIC flag is not
2511 * set, so this check should only be performed if mic_len != 0
2512 * which is the case in this code branch.
2513 */
2514 if (!(key_info & WPA_KEY_INFO_MIC)) {
2515 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2516 "WPA: Ignore EAPOL-Key with encrypted but unauthenticated data");
2517 goto out;
2518 }
6d014ffc
JM		 2519 if (wpa_supplicant_decrypt_key_data(sm, key, mic_len,
2520 ver, key_data,
e6270129 2521 &key_data_len))
d56d7e56 2522 goto out;
6fc6879b
JM		 2523 }
2524
2525 if (key_info & WPA_KEY_INFO_KEY_TYPE) {
2526 if (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) {
f049052b
BG		 2527 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2528 "WPA: Ignored EAPOL-Key (Pairwise) with "
2529 "non-zero key index");
6fc6879b
JM		 2530 goto out;
2531 }
a0bf1b68
JM		 2532 if (key_info & (WPA_KEY_INFO_MIC |
2533 WPA_KEY_INFO_ENCR_KEY_DATA)) {
6fc6879b 2534 /* 3/4 4-Way Handshake */
e6270129
JM		 2535 wpa_supplicant_process_3_of_4(sm, key, ver, key_data,
2536 key_data_len);
6fc6879b
JM		 2537 } else {
2538 /* 1/4 4-Way Handshake */
2539 wpa_supplicant_process_1_of_4(sm, src_addr, key,
e6270129
JM		 2540 ver, key_data,
2541 key_data_len);
6fc6879b 2542 }
6fc6879b 2543 } else {
16eb4858
JM		 2544 if ((mic_len && (key_info & WPA_KEY_INFO_MIC)) ||
2545 (!mic_len && (key_info & WPA_KEY_INFO_ENCR_KEY_DATA))) {
6fc6879b
JM		 2546 /* 1/2 Group Key Handshake */
2547 wpa_supplicant_process_1_of_2(sm, src_addr, key,
e6270129
JM		 2548 key_data, key_data_len,
2549 ver);
6fc6879b 2550 } else {
f049052b 2551 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
16eb4858 2552 "WPA: EAPOL-Key (Group) without Mic/Encr bit - "
f049052b 2553 "dropped");
6fc6879b
JM		 2554 }
2555 }
2556
2557 ret = 1;
2558
2559out:
fbfc974c 2560 bin_clear_free(tmp, data_len);
6fc6879b
JM		 2561 return ret;
2562}
2563
2564
2565#ifdef CONFIG_CTRL_IFACE
6fc6879b
JM		 2566static u32 wpa_key_mgmt_suite(struct wpa_sm *sm)
2567{
2568 switch (sm->key_mgmt) {
2569 case WPA_KEY_MGMT_IEEE8021X:
a14896e8
JM		 2570 return ((sm->proto == WPA_PROTO_RSN ||
2571 sm->proto == WPA_PROTO_OSEN) ?
6fc6879b
JM		 2572 RSN_AUTH_KEY_MGMT_UNSPEC_802_1X :
2573 WPA_AUTH_KEY_MGMT_UNSPEC_802_1X);
2574 case WPA_KEY_MGMT_PSK:
2575 return (sm->proto == WPA_PROTO_RSN ?
2576 RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X :
2577 WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X);
2578#ifdef CONFIG_IEEE80211R
2579 case WPA_KEY_MGMT_FT_IEEE8021X:
2580 return RSN_AUTH_KEY_MGMT_FT_802_1X;
2581 case WPA_KEY_MGMT_FT_PSK:
2582 return RSN_AUTH_KEY_MGMT_FT_PSK;
2583#endif /* CONFIG_IEEE80211R */
56586197
JM		 2584 case WPA_KEY_MGMT_IEEE8021X_SHA256:
2585 return RSN_AUTH_KEY_MGMT_802_1X_SHA256;
2586 case WPA_KEY_MGMT_PSK_SHA256:
2587 return RSN_AUTH_KEY_MGMT_PSK_SHA256;
369c8d7b
JM		 2588 case WPA_KEY_MGMT_CCKM:
2589 return (sm->proto == WPA_PROTO_RSN ?
2590 RSN_AUTH_KEY_MGMT_CCKM:
2591 WPA_AUTH_KEY_MGMT_CCKM);
6fc6879b
JM		 2592 case WPA_KEY_MGMT_WPA_NONE:
2593 return WPA_AUTH_KEY_MGMT_NONE;
666497c8
JM		 2594 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
2595 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B;
5e3b5197
JM		 2596 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
2597 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192;
6fc6879b
JM		 2598 default:
2599 return 0;
2600 }
2601}
2602
2603
6fc6879b
JM		 2604#define RSN_SUITE "%02x-%02x-%02x-%d"
2605#define RSN_SUITE_ARG(s) \
2606((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff
2607
2608/**
2609 * wpa_sm_get_mib - Dump text list of MIB entries
2610 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2611 * @buf: Buffer for the list
2612 * @buflen: Length of the buffer
2613 * Returns: Number of bytes written to buffer
2614 *
2615 * This function is used fetch dot11 MIB variables.
2616 */
2617int wpa_sm_get_mib(struct wpa_sm *sm, char *buf, size_t buflen)
2618{
2619 char pmkid_txt[PMKID_LEN * 2 + 1];
2620 int rsna, ret;
2621 size_t len;
2622
2623 if (sm->cur_pmksa) {
2624 wpa_snprintf_hex(pmkid_txt, sizeof(pmkid_txt),
2625 sm->cur_pmksa->pmkid, PMKID_LEN);
2626 } else
2627 pmkid_txt[0] = '\0';
2628
56586197
JM		 2629 if ((wpa_key_mgmt_wpa_psk(sm->key_mgmt) ||
2630 wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt)) &&
6fc6879b
JM		 2631 sm->proto == WPA_PROTO_RSN)
2632 rsna = 1;
2633 else
2634 rsna = 0;
2635
2636 ret = os_snprintf(buf, buflen,
2637 "dot11RSNAOptionImplemented=TRUE\n"
2638 "dot11RSNAPreauthenticationImplemented=TRUE\n"
2639 "dot11RSNAEnabled=%s\n"
2640 "dot11RSNAPreauthenticationEnabled=%s\n"
2641 "dot11RSNAConfigVersion=%d\n"
2642 "dot11RSNAConfigPairwiseKeysSupported=5\n"
2643 "dot11RSNAConfigGroupCipherSize=%d\n"
2644 "dot11RSNAConfigPMKLifetime=%d\n"
2645 "dot11RSNAConfigPMKReauthThreshold=%d\n"
2646 "dot11RSNAConfigNumberOfPTKSAReplayCounters=1\n"
2647 "dot11RSNAConfigSATimeout=%d\n",
2648 rsna ? "TRUE" : "FALSE",
2649 rsna ? "TRUE" : "FALSE",
2650 RSN_VERSION,
c3550295 2651 wpa_cipher_key_len(sm->group_cipher) * 8,
6fc6879b
JM		 2652 sm->dot11RSNAConfigPMKLifetime,
2653 sm->dot11RSNAConfigPMKReauthThreshold,
2654 sm->dot11RSNAConfigSATimeout);
d85e1fc8 2655 if (os_snprintf_error(buflen, ret))
6fc6879b
JM		 2656 return 0;
2657 len = ret;
2658
2659 ret = os_snprintf(
2660 buf + len, buflen - len,
2661 "dot11RSNAAuthenticationSuiteSelected=" RSN_SUITE "\n"
2662 "dot11RSNAPairwiseCipherSelected=" RSN_SUITE "\n"
2663 "dot11RSNAGroupCipherSelected=" RSN_SUITE "\n"
2664 "dot11RSNAPMKIDUsed=%s\n"
2665 "dot11RSNAAuthenticationSuiteRequested=" RSN_SUITE "\n"
2666 "dot11RSNAPairwiseCipherRequested=" RSN_SUITE "\n"
2667 "dot11RSNAGroupCipherRequested=" RSN_SUITE "\n"
2668 "dot11RSNAConfigNumberOfGTKSAReplayCounters=0\n"
2669 "dot11RSNA4WayHandshakeFailures=%u\n",
2670 RSN_SUITE_ARG(wpa_key_mgmt_suite(sm)),
c3550295
JM		 2671 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
2672 sm->pairwise_cipher)),
2673 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
2674 sm->group_cipher)),
6fc6879b
JM		 2675 pmkid_txt,
2676 RSN_SUITE_ARG(wpa_key_mgmt_suite(sm)),
c3550295
JM		 2677 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
2678 sm->pairwise_cipher)),
2679 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
2680 sm->group_cipher)),
6fc6879b 2681 sm->dot11RSNA4WayHandshakeFailures);
1f102d3b 2682 if (!os_snprintf_error(buflen - len, ret))
6fc6879b
JM		 2683 len += ret;
2684
2685 return (int) len;
2686}
2687#endif /* CONFIG_CTRL_IFACE */
2688
2689
2690static void wpa_sm_pmksa_free_cb(struct rsn_pmksa_cache_entry *entry,
6aaac006 2691 void *ctx, enum pmksa_free_reason reason)
6fc6879b
JM		 2692{
2693 struct wpa_sm *sm = ctx;
6aaac006 2694 int deauth = 0;
6fc6879b 2695
6aaac006
DW		 2696 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "RSN: PMKSA cache entry free_cb: "
2697 MACSTR " reason=%d", MAC2STR(entry->aa), reason);
2698
2699 if (sm->cur_pmksa == entry) {
2700 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2701 "RSN: %s current PMKSA entry",
2702 reason == PMKSA_REPLACE ? "replaced" : "removed");
2703 pmksa_cache_clear_current(sm);
2704
2705 /*
2706 * If an entry is simply being replaced, there's no need to
2707 * deauthenticate because it will be immediately re-added.
2708 * This happens when EAP authentication is completed again
2709 * (reauth or failed PMKSA caching attempt).
2710 */
2711 if (reason != PMKSA_REPLACE)
2712 deauth = 1;
2713 }
2714
2715 if (reason == PMKSA_EXPIRE &&
6fc6879b
JM		 2716 (sm->pmk_len == entry->pmk_len &&
2717 os_memcmp(sm->pmk, entry->pmk, sm->pmk_len) == 0)) {
f049052b 2718 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
6aaac006
DW		 2719 "RSN: deauthenticating due to expired PMK");
2720 pmksa_cache_clear_current(sm);
2721 deauth = 1;
2722 }
6fc6879b 2723
6aaac006 2724 if (deauth) {
1bd13110 2725 sm->pmk_len = 0;
6fc6879b
JM		 2726 os_memset(sm->pmk, 0, sizeof(sm->pmk));
2727 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
6fc6879b
JM		 2728 }
2729}
2730
2731
2732/**
2733 * wpa_sm_init - Initialize WPA state machine
2734 * @ctx: Context pointer for callbacks; this needs to be an allocated buffer
2735 * Returns: Pointer to the allocated WPA state machine data
2736 *
2737 * This function is used to allocate a new WPA state machine and the returned
2738 * value is passed to all WPA state machine calls.
2739 */
2740struct wpa_sm * wpa_sm_init(struct wpa_sm_ctx *ctx)
2741{
2742 struct wpa_sm *sm;
2743
2744 sm = os_zalloc(sizeof(*sm));
2745 if (sm == NULL)
2746 return NULL;
c5b26e33 2747 dl_list_init(&sm->pmksa_candidates);
6fc6879b
JM		 2748 sm->renew_snonce = 1;
2749 sm->ctx = ctx;
2750
2751 sm->dot11RSNAConfigPMKLifetime = 43200;
2752 sm->dot11RSNAConfigPMKReauthThreshold = 70;
2753 sm->dot11RSNAConfigSATimeout = 60;
2754
2755 sm->pmksa = pmksa_cache_init(wpa_sm_pmksa_free_cb, sm, sm);
2756 if (sm->pmksa == NULL) {
f049052b
BG		 2757 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
2758 "RSN: PMKSA cache initialization failed");
6fc6879b
JM		 2759 os_free(sm);
2760 return NULL;
2761 }
2762
2763 return sm;
2764}
2765
2766
2767/**
2768 * wpa_sm_deinit - Deinitialize WPA state machine
2769 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2770 */
2771void wpa_sm_deinit(struct wpa_sm *sm)
2772{
2773 if (sm == NULL)
2774 return;
2775 pmksa_cache_deinit(sm->pmksa);
2776 eloop_cancel_timeout(wpa_sm_start_preauth, sm, NULL);
581a8cde 2777 eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
6fc6879b 2778 os_free(sm->assoc_wpa_ie);
6d6c8877 2779 os_free(sm->assoc_rsnxe);
6fc6879b
JM		 2780 os_free(sm->ap_wpa_ie);
2781 os_free(sm->ap_rsn_ie);
146889e3 2782 os_free(sm->ap_rsnxe);
71932544 2783 wpa_sm_drop_sa(sm);
6fc6879b 2784 os_free(sm->ctx);
55046414
JM		 2785#ifdef CONFIG_IEEE80211R
2786 os_free(sm->assoc_resp_ies);
2787#endif /* CONFIG_IEEE80211R */
651c6a84
JM		 2788#ifdef CONFIG_TESTING_OPTIONS
2789 wpabuf_free(sm->test_assoc_ie);
2790#endif /* CONFIG_TESTING_OPTIONS */
0119d442 2791#ifdef CONFIG_FILS_SK_PFS
76e20f4f 2792 crypto_ecdh_deinit(sm->fils_ecdh);
0119d442 2793#endif /* CONFIG_FILS_SK_PFS */
7d440a3b
JM		 2794#ifdef CONFIG_FILS
2795 wpabuf_free(sm->fils_ft_ies);
2796#endif /* CONFIG_FILS */
0a614799
JM		 2797#ifdef CONFIG_OWE
2798 crypto_ecdh_deinit(sm->owe_ecdh);
2799#endif /* CONFIG_OWE */
10ec6a5f
JM		 2800#ifdef CONFIG_DPP2
2801 wpabuf_clear_free(sm->dpp_z);
2802#endif /* CONFIG_DPP2 */
6fc6879b
JM		 2803 os_free(sm);
2804}
2805
2806
2807/**
2808 * wpa_sm_notify_assoc - Notify WPA state machine about association
2809 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2810 * @bssid: The BSSID of the new association
2811 *
2812 * This function is called to let WPA state machine know that the connection
2813 * was established.
2814 */
2815void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
2816{
cb5132bb 2817 int clear_keys = 1;
58a98fb0 2818
6fc6879b
JM		 2819 if (sm == NULL)
2820 return;
2821
f049052b
BG		 2822 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2823 "WPA: Association event - clear replay counter");
6fc6879b
JM		 2824 os_memcpy(sm->bssid, bssid, ETH_ALEN);
2825 os_memset(sm->rx_replay_counter, 0, WPA_REPLAY_COUNTER_LEN);
2826 sm->rx_replay_counter_set = 0;
2827 sm->renew_snonce = 1;
2828 if (os_memcmp(sm->preauth_bssid, bssid, ETH_ALEN) == 0)
2829 rsn_preauth_deinit(sm);
2830
2831#ifdef CONFIG_IEEE80211R
58a98fb0 2832 if (wpa_ft_is_completed(sm)) {
5d5a9f00
JM		 2833 /*
2834 * Clear portValid to kick EAPOL state machine to re-enter
2835 * AUTHENTICATED state to get the EAPOL port Authorized.
2836 */
2837 eapol_sm_notify_portValid(sm->eapol, FALSE);
6fc6879b
JM		 2838 wpa_supplicant_key_neg_complete(sm, sm->bssid, 1);
2839
2840 /* Prepare for the next transition */
76b7981d 2841 wpa_ft_prepare_auth_request(sm, NULL);
58a98fb0 2842
cb5132bb 2843 clear_keys = 0;
0a1a82db
JM		 2844 sm->ft_protocol = 1;
2845 } else {
2846 sm->ft_protocol = 0;
6fc6879b
JM		 2847 }
2848#endif /* CONFIG_IEEE80211R */
706df429
JM		 2849#ifdef CONFIG_FILS
2850 if (sm->fils_completed) {
2851 /*
2852 * Clear portValid to kick EAPOL state machine to re-enter
2853 * AUTHENTICATED state to get the EAPOL port Authorized.
2854 */
2855 wpa_supplicant_key_neg_complete(sm, sm->bssid, 1);
cb5132bb 2856 clear_keys = 0;
706df429
JM		 2857 }
2858#endif /* CONFIG_FILS */
58a98fb0 2859
cb5132bb 2860 if (clear_keys) {
58a98fb0
JM		 2861 /*
2862 * IEEE 802.11, 8.4.10: Delete PTK SA on (re)association if
2863 * this is not part of a Fast BSS Transition.
2864 */
f049052b 2865 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Clear old PTK");
58a98fb0 2866 sm->ptk_set = 0;
d2c33b91 2867 os_memset(&sm->ptk, 0, sizeof(sm->ptk));
58a98fb0 2868 sm->tptk_set = 0;
d2c33b91 2869 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
cb5132bb 2870 os_memset(&sm->gtk, 0, sizeof(sm->gtk));
87e2db16 2871 os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
cb5132bb 2872 os_memset(&sm->igtk, 0, sizeof(sm->igtk));
87e2db16 2873 os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
58a98fb0 2874 }
40cf22e6
JM		 2875
2876#ifdef CONFIG_TDLS
2877 wpa_tdls_assoc(sm);
2878#endif /* CONFIG_TDLS */
25ef8529
JM		 2879
2880#ifdef CONFIG_P2P
2881 os_memset(sm->p2p_ip_addr, 0, sizeof(sm->p2p_ip_addr));
2882#endif /* CONFIG_P2P */
6fc6879b
JM		 2883}
2884
2885
2886/**
2887 * wpa_sm_notify_disassoc - Notify WPA state machine about disassociation
2888 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2889 *
2890 * This function is called to let WPA state machine know that the connection
2891 * was lost. This will abort any existing pre-authentication session.
2892 */
2893void wpa_sm_notify_disassoc(struct wpa_sm *sm)
2894{
ac8e074e
JM		 2895 eloop_cancel_timeout(wpa_sm_start_preauth, sm, NULL);
2896 eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
6fc6879b 2897 rsn_preauth_deinit(sm);
0639970d 2898 pmksa_cache_clear_current(sm);
6fc6879b
JM		 2899 if (wpa_sm_get_state(sm) == WPA_4WAY_HANDSHAKE)
2900 sm->dot11RSNA4WayHandshakeFailures++;
40cf22e6
JM		 2901#ifdef CONFIG_TDLS
2902 wpa_tdls_disassoc(sm);
2903#endif /* CONFIG_TDLS */
706df429
JM		 2904#ifdef CONFIG_FILS
2905 sm->fils_completed = 0;
2906#endif /* CONFIG_FILS */
2a9c5217
JM		 2907#ifdef CONFIG_IEEE80211R
2908 sm->ft_reassoc_completed = 0;
0a1a82db 2909 sm->ft_protocol = 0;
2a9c5217 2910#endif /* CONFIG_IEEE80211R */
71932544
JM		 2911
2912 /* Keys are not needed in the WPA state machine anymore */
2913 wpa_sm_drop_sa(sm);
761396e4
JM		 2914
2915 sm->msg_3_of_4_ok = 0;
c0fe5f12 2916 os_memset(sm->bssid, 0, ETH_ALEN);
6fc6879b
JM		 2917}
2918
2919
2920/**
2921 * wpa_sm_set_pmk - Set PMK
2922 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2923 * @pmk: The new PMK
2924 * @pmk_len: The length of the new PMK in bytes
70c93963 2925 * @pmkid: Calculated PMKID
bc26ac50 2926 * @bssid: AA to add into PMKSA cache or %NULL to not cache the PMK
6fc6879b
JM		 2927 *
2928 * Configure the PMK for WPA state machine.
2929 */
bc26ac50 2930void wpa_sm_set_pmk(struct wpa_sm *sm, const u8 *pmk, size_t pmk_len,
70c93963 2931 const u8 *pmkid, const u8 *bssid)
6fc6879b
JM		 2932{
2933 if (sm == NULL)
2934 return;
2935
00583ef1
JM		 2936 wpa_hexdump_key(MSG_DEBUG, "WPA: Set PMK based on external data",
2937 pmk, pmk_len);
6fc6879b
JM		 2938 sm->pmk_len = pmk_len;
2939 os_memcpy(sm->pmk, pmk, pmk_len);
2940
2941#ifdef CONFIG_IEEE80211R
2942 /* Set XXKey to be PSK for FT key derivation */
2943 sm->xxkey_len = pmk_len;
2944 os_memcpy(sm->xxkey, pmk, pmk_len);
2945#endif /* CONFIG_IEEE80211R */
bc26ac50
JM		 2946
2947 if (bssid) {
70c93963 2948 pmksa_cache_add(sm->pmksa, pmk, pmk_len, pmkid, NULL, 0,
087a1f4e 2949 bssid, sm->own_addr,
869af307 2950 sm->network_ctx, sm->key_mgmt, NULL);
bc26ac50 2951 }
6fc6879b
JM		 2952}
2953
2954
2955/**
2956 * wpa_sm_set_pmk_from_pmksa - Set PMK based on the current PMKSA
2957 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2958 *
2959 * Take the PMK from the current PMKSA into use. If no PMKSA is active, the PMK
2960 * will be cleared.
2961 */
2962void wpa_sm_set_pmk_from_pmksa(struct wpa_sm *sm)
2963{
2964 if (sm == NULL)
2965 return;
2966
2967 if (sm->cur_pmksa) {
00583ef1
JM		 2968 wpa_hexdump_key(MSG_DEBUG,
2969 "WPA: Set PMK based on current PMKSA",
2970 sm->cur_pmksa->pmk, sm->cur_pmksa->pmk_len);
6fc6879b
JM		 2971 sm->pmk_len = sm->cur_pmksa->pmk_len;
2972 os_memcpy(sm->pmk, sm->cur_pmksa->pmk, sm->pmk_len);
2973 } else {
00583ef1 2974 wpa_printf(MSG_DEBUG, "WPA: No current PMKSA - clear PMK");
b488a129
JM		 2975 sm->pmk_len = 0;
2976 os_memset(sm->pmk, 0, PMK_LEN_MAX);
6fc6879b
JM		 2977 }
2978}
2979
2980
2981/**
2982 * wpa_sm_set_fast_reauth - Set fast reauthentication (EAP) enabled/disabled
2983 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2984 * @fast_reauth: Whether fast reauthentication (EAP) is allowed
2985 */
2986void wpa_sm_set_fast_reauth(struct wpa_sm *sm, int fast_reauth)
2987{
2988 if (sm)
2989 sm->fast_reauth = fast_reauth;
2990}
2991
2992
2993/**
2994 * wpa_sm_set_scard_ctx - Set context pointer for smartcard callbacks
2995 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2996 * @scard_ctx: Context pointer for smartcard related callback functions
2997 */
2998void wpa_sm_set_scard_ctx(struct wpa_sm *sm, void *scard_ctx)
2999{
3000 if (sm == NULL)
3001 return;
3002 sm->scard_ctx = scard_ctx;
3003 if (sm->preauth_eapol)
3004 eapol_sm_register_scard_ctx(sm->preauth_eapol, scard_ctx);
3005}
3006
3007
3008/**
0d445cd3 3009 * wpa_sm_set_config - Notification of current configuration change
6fc6879b
JM		 3010 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3011 * @config: Pointer to current network configuration
3012 *
3013 * Notify WPA state machine that configuration has changed. config will be
3014 * stored as a backpointer to network configuration. This can be %NULL to clear
3015 * the stored pointed.
3016 */
3017void wpa_sm_set_config(struct wpa_sm *sm, struct rsn_supp_config *config)
3018{
3019 if (!sm)
3020 return;
3021
6fc6879b 3022 if (config) {
886a807f 3023 sm->network_ctx = config->network_ctx;
6fc6879b
JM		 3024 sm->allowed_pairwise_cipher = config->allowed_pairwise_cipher;
3025 sm->proactive_key_caching = config->proactive_key_caching;
3026 sm->eap_workaround = config->eap_workaround;
3027 sm->eap_conf_ctx = config->eap_conf_ctx;
3028 if (config->ssid) {
3029 os_memcpy(sm->ssid, config->ssid, config->ssid_len);
3030 sm->ssid_len = config->ssid_len;
3031 } else
3032 sm->ssid_len = 0;
581a8cde 3033 sm->wpa_ptk_rekey = config->wpa_ptk_rekey;
25ef8529 3034 sm->p2p = config->p2p;
73ed03f3 3035 sm->wpa_rsc_relaxation = config->wpa_rsc_relaxation;
8b138d28 3036 sm->owe_ptk_workaround = config->owe_ptk_workaround;
869af307
JM		 3037#ifdef CONFIG_FILS
3038 if (config->fils_cache_id) {
3039 sm->fils_cache_id_set = 1;
3040 os_memcpy(sm->fils_cache_id, config->fils_cache_id,
3041 FILS_CACHE_ID_LEN);
3042 } else {
3043 sm->fils_cache_id_set = 0;
3044 }
ecbf59e6 3045 sm->beacon_prot = config->beacon_prot;
869af307 3046#endif /* CONFIG_FILS */
6fc6879b 3047 } else {
886a807f 3048 sm->network_ctx = NULL;
6fc6879b
JM		 3049 sm->allowed_pairwise_cipher = 0;
3050 sm->proactive_key_caching = 0;
3051 sm->eap_workaround = 0;
3052 sm->eap_conf_ctx = NULL;
3053 sm->ssid_len = 0;
581a8cde 3054 sm->wpa_ptk_rekey = 0;
25ef8529 3055 sm->p2p = 0;
73ed03f3 3056 sm->wpa_rsc_relaxation = 0;
8b138d28 3057 sm->owe_ptk_workaround = 0;
ecbf59e6 3058 sm->beacon_prot = 0;
6fc6879b 3059 }
6fc6879b
JM		 3060}
3061
3062
3063/**
3064 * wpa_sm_set_own_addr - Set own MAC address
3065 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3066 * @addr: Own MAC address
3067 */
3068void wpa_sm_set_own_addr(struct wpa_sm *sm, const u8 *addr)
3069{
3070 if (sm)
3071 os_memcpy(sm->own_addr, addr, ETH_ALEN);
3072}
3073
3074
3075/**
3076 * wpa_sm_set_ifname - Set network interface name
3077 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3078 * @ifname: Interface name
3079 * @bridge_ifname: Optional bridge interface name (for pre-auth)
3080 */
3081void wpa_sm_set_ifname(struct wpa_sm *sm, const char *ifname,
3082 const char *bridge_ifname)
3083{
3084 if (sm) {
3085 sm->ifname = ifname;
3086 sm->bridge_ifname = bridge_ifname;
3087 }
3088}
3089
3090
3091/**
3092 * wpa_sm_set_eapol - Set EAPOL state machine pointer
3093 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3094 * @eapol: Pointer to EAPOL state machine allocated with eapol_sm_init()
3095 */
3096void wpa_sm_set_eapol(struct wpa_sm *sm, struct eapol_sm *eapol)
3097{
3098 if (sm)
3099 sm->eapol = eapol;
3100}
3101
3102
3103/**
3104 * wpa_sm_set_param - Set WPA state machine parameters
3105 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3106 * @param: Parameter field
3107 * @value: Parameter value
3108 * Returns: 0 on success, -1 on failure
3109 */
3110int wpa_sm_set_param(struct wpa_sm *sm, enum wpa_sm_conf_params param,
3111 unsigned int value)
3112{
3113 int ret = 0;
3114
3115 if (sm == NULL)
3116 return -1;
3117
3118 switch (param) {
3119 case RSNA_PMK_LIFETIME:
3120 if (value > 0)
3121 sm->dot11RSNAConfigPMKLifetime = value;
3122 else
3123 ret = -1;
3124 break;
3125 case RSNA_PMK_REAUTH_THRESHOLD:
3126 if (value > 0 && value <= 100)
3127 sm->dot11RSNAConfigPMKReauthThreshold = value;
3128 else
3129 ret = -1;
3130 break;
3131 case RSNA_SA_TIMEOUT:
3132 if (value > 0)
3133 sm->dot11RSNAConfigSATimeout = value;
3134 else
3135 ret = -1;
3136 break;
3137 case WPA_PARAM_PROTO:
3138 sm->proto = value;
3139 break;
3140 case WPA_PARAM_PAIRWISE:
3141 sm->pairwise_cipher = value;
3142 break;
3143 case WPA_PARAM_GROUP:
3144 sm->group_cipher = value;
3145 break;
3146 case WPA_PARAM_KEY_MGMT:
3147 sm->key_mgmt = value;
3148 break;
6fc6879b
JM		 3149 case WPA_PARAM_MGMT_GROUP:
3150 sm->mgmt_group_cipher = value;
3151 break;
6fc6879b
JM		 3152 case WPA_PARAM_RSN_ENABLED:
3153 sm->rsn_enabled = value;
3154 break;
e820cf95
JM		 3155 case WPA_PARAM_MFP:
3156 sm->mfp = value;
3157 break;
55c12f5d
MV		 3158 case WPA_PARAM_OCV:
3159 sm->ocv = value;
3160 break;
6d6c8877
JM		 3161 case WPA_PARAM_SAE_PWE:
3162 sm->sae_pwe = value;
3163 break;
1f90a49d
AW		 3164 case WPA_PARAM_DENY_PTK0_REKEY:
3165 sm->wpa_deny_ptk0_rekey = value;
3166 break;
6fc6879b
JM		 3167 default:
3168 break;
3169 }
3170
3171 return ret;
3172}
3173
3174
6fc6879b
JM		 3175/**
3176 * wpa_sm_get_status - Get WPA state machine
3177 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3178 * @buf: Buffer for status information
3179 * @buflen: Maximum buffer length
3180 * @verbose: Whether to include verbose status information
3181 * Returns: Number of bytes written to buf.
3182 *
3183 * Query WPA state machine for status information. This function fills in
3184 * a text area with current status information. If the buffer (buf) is not
3185 * large enough, status information will be truncated to fit the buffer.
3186 */
3187int wpa_sm_get_status(struct wpa_sm *sm, char *buf, size_t buflen,
3188 int verbose)
3189{
3190 char *pos = buf, *end = buf + buflen;
3191 int ret;
3192
3193 ret = os_snprintf(pos, end - pos,
3194 "pairwise_cipher=%s\n"
3195 "group_cipher=%s\n"
3196 "key_mgmt=%s\n",
3197 wpa_cipher_txt(sm->pairwise_cipher),
3198 wpa_cipher_txt(sm->group_cipher),
3199 wpa_key_mgmt_txt(sm->key_mgmt, sm->proto));
d85e1fc8 3200 if (os_snprintf_error(end - pos, ret))
6fc6879b
JM		 3201 return pos - buf;
3202 pos += ret;
13e1d2e2
JM		 3203
3204 if (sm->mfp != NO_MGMT_FRAME_PROTECTION && sm->ap_rsn_ie) {
3205 struct wpa_ie_data rsn;
3206 if (wpa_parse_wpa_ie_rsn(sm->ap_rsn_ie, sm->ap_rsn_ie_len, &rsn)
3207 >= 0 &&
3208 rsn.capabilities & (WPA_CAPABILITY_MFPR |
3209 WPA_CAPABILITY_MFPC)) {
3a5954ef
JM		 3210 ret = os_snprintf(pos, end - pos, "pmf=%d\n"
3211 "mgmt_group_cipher=%s\n",
13e1d2e2 3212 (rsn.capabilities &
3a5954ef
JM		 3213 WPA_CAPABILITY_MFPR) ? 2 : 1,
3214 wpa_cipher_txt(
3215 sm->mgmt_group_cipher));
d85e1fc8 3216 if (os_snprintf_error(end - pos, ret))
13e1d2e2
JM		 3217 return pos - buf;
3218 pos += ret;
3219 }
3220 }
3221
6fc6879b
JM		 3222 return pos - buf;
3223}
3224
3225
ae8535b6
JM		 3226int wpa_sm_pmf_enabled(struct wpa_sm *sm)
3227{
3228 struct wpa_ie_data rsn;
3229
3230 if (sm->mfp == NO_MGMT_FRAME_PROTECTION || !sm->ap_rsn_ie)
3231 return 0;
3232
3233 if (wpa_parse_wpa_ie_rsn(sm->ap_rsn_ie, sm->ap_rsn_ie_len, &rsn) >= 0 &&
3234 rsn.capabilities & (WPA_CAPABILITY_MFPR | WPA_CAPABILITY_MFPC))
3235 return 1;
3236
3237 return 0;
3238}
3239
3240
17c2559c
MV		 3241int wpa_sm_ocv_enabled(struct wpa_sm *sm)
3242{
3243 struct wpa_ie_data rsn;
3244
3245 if (!sm->ocv || !sm->ap_rsn_ie)
3246 return 0;
3247
3248 return wpa_parse_wpa_ie_rsn(sm->ap_rsn_ie, sm->ap_rsn_ie_len,
3249 &rsn) >= 0 &&
3250 (rsn.capabilities & WPA_CAPABILITY_OCVC);
3251}
3252
3253
6fc6879b
JM		 3254/**
3255 * wpa_sm_set_assoc_wpa_ie_default - Generate own WPA/RSN IE from configuration
3256 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3257 * @wpa_ie: Pointer to buffer for WPA/RSN IE
3258 * @wpa_ie_len: Pointer to the length of the wpa_ie buffer
3259 * Returns: 0 on success, -1 on failure
3260 */
3261int wpa_sm_set_assoc_wpa_ie_default(struct wpa_sm *sm, u8 *wpa_ie,
3262 size_t *wpa_ie_len)
3263{
3264 int res;
3265
3266 if (sm == NULL)
3267 return -1;
3268
651c6a84
JM		 3269#ifdef CONFIG_TESTING_OPTIONS
3270 if (sm->test_assoc_ie) {
3271 wpa_printf(MSG_DEBUG,
3272 "TESTING: Replace association WPA/RSN IE");
3273 if (*wpa_ie_len < wpabuf_len(sm->test_assoc_ie))
3274 return -1;
3275 os_memcpy(wpa_ie, wpabuf_head(sm->test_assoc_ie),
3276 wpabuf_len(sm->test_assoc_ie));
3277 res = wpabuf_len(sm->test_assoc_ie);
3278 } else
3279#endif /* CONFIG_TESTING_OPTIONS */
6fc6879b
JM		 3280 res = wpa_gen_wpa_ie(sm, wpa_ie, *wpa_ie_len);
3281 if (res < 0)
3282 return -1;
3283 *wpa_ie_len = res;
3284
3285 wpa_hexdump(MSG_DEBUG, "WPA: Set own WPA IE default",
3286 wpa_ie, *wpa_ie_len);
3287
3288 if (sm->assoc_wpa_ie == NULL) {
3289 /*
3290 * Make a copy of the WPA/RSN IE so that 4-Way Handshake gets
3291 * the correct version of the IE even if PMKSA caching is
3292 * aborted (which would remove PMKID from IE generation).
3293 */
a1f11e34 3294 sm->assoc_wpa_ie = os_memdup(wpa_ie, *wpa_ie_len);
6fc6879b
JM		 3295 if (sm->assoc_wpa_ie == NULL)
3296 return -1;
3297
6fc6879b 3298 sm->assoc_wpa_ie_len = *wpa_ie_len;
0866ed00
JM		 3299 } else {
3300 wpa_hexdump(MSG_DEBUG,
3301 "WPA: Leave previously set WPA IE default",
3302 sm->assoc_wpa_ie, sm->assoc_wpa_ie_len);
6fc6879b
JM		 3303 }
3304
3305 return 0;
3306}
3307
3308
3309/**
3310 * wpa_sm_set_assoc_wpa_ie - Set own WPA/RSN IE from (Re)AssocReq
3311 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3312 * @ie: Pointer to IE data (starting from id)
3313 * @len: IE length
3314 * Returns: 0 on success, -1 on failure
3315 *
3316 * Inform WPA state machine about the WPA/RSN IE used in (Re)Association
3317 * Request frame. The IE will be used to override the default value generated
3318 * with wpa_sm_set_assoc_wpa_ie_default().
3319 */
3320int wpa_sm_set_assoc_wpa_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
3321{
3322 if (sm == NULL)
3323 return -1;
3324
3325 os_free(sm->assoc_wpa_ie);
3326 if (ie == NULL || len == 0) {
f049052b
BG		 3327 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3328 "WPA: clearing own WPA/RSN IE");
6fc6879b
JM		 3329 sm->assoc_wpa_ie = NULL;
3330 sm->assoc_wpa_ie_len = 0;
3331 } else {
3332 wpa_hexdump(MSG_DEBUG, "WPA: set own WPA/RSN IE", ie, len);
a1f11e34 3333 sm->assoc_wpa_ie = os_memdup(ie, len);
6fc6879b
JM		 3334 if (sm->assoc_wpa_ie == NULL)
3335 return -1;
3336
6fc6879b
JM		 3337 sm->assoc_wpa_ie_len = len;
3338 }
3339
3340 return 0;
3341}
3342
3343
6d6c8877
JM		 3344/**
3345 * wpa_sm_set_assoc_rsnxe_default - Generate own RSNXE from configuration
3346 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3347 * @rsnxe: Pointer to buffer for RSNXE
3348 * @rsnxe_len: Pointer to the length of the rsne buffer
3349 * Returns: 0 on success, -1 on failure
3350 */
3351int wpa_sm_set_assoc_rsnxe_default(struct wpa_sm *sm, u8 *rsnxe,
3352 size_t *rsnxe_len)
3353{
3354 int res;
3355
3356 if (!sm)
3357 return -1;
3358
3359 res = wpa_gen_rsnxe(sm, rsnxe, *rsnxe_len);
3360 if (res < 0)
3361 return -1;
3362 *rsnxe_len = res;
3363
3364 wpa_hexdump(MSG_DEBUG, "RSN: Set own RSNXE default", rsnxe, *rsnxe_len);
3365
3366 if (sm->assoc_rsnxe) {
3367 wpa_hexdump(MSG_DEBUG,
3368 "RSN: Leave previously set RSNXE default",
3369 sm->assoc_rsnxe, sm->assoc_rsnxe_len);
3370 } else if (*rsnxe_len > 0) {
3371 /*
3372 * Make a copy of the RSNXE so that 4-Way Handshake gets the
3373 * correct version of the IE even if it gets changed.
3374 */
3375 sm->assoc_rsnxe = os_memdup(rsnxe, *rsnxe_len);
3376 if (!sm->assoc_rsnxe)
3377 return -1;
3378
3379 sm->assoc_rsnxe_len = *rsnxe_len;
3380 }
3381
3382 return 0;
3383}
3384
3385
3386/**
3387 * wpa_sm_set_assoc_rsnxe - Set own RSNXE from (Re)AssocReq
3388 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3389 * @ie: Pointer to IE data (starting from id)
3390 * @len: IE length
3391 * Returns: 0 on success, -1 on failure
3392 *
3393 * Inform WPA state machine about the RSNXE used in (Re)Association Request
3394 * frame. The IE will be used to override the default value generated
3395 * with wpa_sm_set_assoc_rsnxe_default().
3396 */
3397int wpa_sm_set_assoc_rsnxe(struct wpa_sm *sm, const u8 *ie, size_t len)
3398{
3399 if (!sm)
3400 return -1;
3401
3402 os_free(sm->assoc_rsnxe);
3403 if (!ie || len == 0) {
3404 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3405 "RSN: clearing own RSNXE");
3406 sm->assoc_rsnxe = NULL;
3407 sm->assoc_rsnxe_len = 0;
3408 } else {
3409 wpa_hexdump(MSG_DEBUG, "RSN: set own RSNXE", ie, len);
3410 sm->assoc_rsnxe = os_memdup(ie, len);
3411 if (!sm->assoc_rsnxe)
3412 return -1;
3413
3414 sm->assoc_rsnxe_len = len;
3415 }
3416
3417 return 0;
3418}
3419
3420
6fc6879b
JM		 3421/**
3422 * wpa_sm_set_ap_wpa_ie - Set AP WPA IE from Beacon/ProbeResp
3423 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3424 * @ie: Pointer to IE data (starting from id)
3425 * @len: IE length
3426 * Returns: 0 on success, -1 on failure
3427 *
3428 * Inform WPA state machine about the WPA IE used in Beacon / Probe Response
3429 * frame.
3430 */
3431int wpa_sm_set_ap_wpa_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
3432{
3433 if (sm == NULL)
3434 return -1;
3435
3436 os_free(sm->ap_wpa_ie);
3437 if (ie == NULL || len == 0) {
f049052b
BG		 3438 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3439 "WPA: clearing AP WPA IE");
6fc6879b
JM		 3440 sm->ap_wpa_ie = NULL;
3441 sm->ap_wpa_ie_len = 0;
3442 } else {
3443 wpa_hexdump(MSG_DEBUG, "WPA: set AP WPA IE", ie, len);
a1f11e34 3444 sm->ap_wpa_ie = os_memdup(ie, len);
6fc6879b
JM		 3445 if (sm->ap_wpa_ie == NULL)
3446 return -1;
3447
6fc6879b
JM		 3448 sm->ap_wpa_ie_len = len;
3449 }
3450
3451 return 0;
3452}
3453
3454
3455/**
3456 * wpa_sm_set_ap_rsn_ie - Set AP RSN IE from Beacon/ProbeResp
3457 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3458 * @ie: Pointer to IE data (starting from id)
3459 * @len: IE length
3460 * Returns: 0 on success, -1 on failure
3461 *
3462 * Inform WPA state machine about the RSN IE used in Beacon / Probe Response
3463 * frame.
3464 */
3465int wpa_sm_set_ap_rsn_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
3466{
3467 if (sm == NULL)
3468 return -1;
3469
3470 os_free(sm->ap_rsn_ie);
3471 if (ie == NULL || len == 0) {
f049052b
BG		 3472 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3473 "WPA: clearing AP RSN IE");
6fc6879b
JM		 3474 sm->ap_rsn_ie = NULL;
3475 sm->ap_rsn_ie_len = 0;
3476 } else {
3477 wpa_hexdump(MSG_DEBUG, "WPA: set AP RSN IE", ie, len);
a1f11e34 3478 sm->ap_rsn_ie = os_memdup(ie, len);
6fc6879b
JM		 3479 if (sm->ap_rsn_ie == NULL)
3480 return -1;
3481
6fc6879b
JM		 3482 sm->ap_rsn_ie_len = len;
3483 }
3484
3485 return 0;
3486}
3487
3488
146889e3
JM		 3489/**
3490 * wpa_sm_set_ap_rsnxe - Set AP RSNXE from Beacon/ProbeResp
3491 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3492 * @ie: Pointer to IE data (starting from id)
3493 * @len: IE length
3494 * Returns: 0 on success, -1 on failure
3495 *
3496 * Inform WPA state machine about the RSNXE used in Beacon / Probe Response
3497 * frame.
3498 */
3499int wpa_sm_set_ap_rsnxe(struct wpa_sm *sm, const u8 *ie, size_t len)
3500{
3501 if (!sm)
3502 return -1;
3503
3504 os_free(sm->ap_rsnxe);
3505 if (!ie || len == 0) {
3506 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: clearing AP RSNXE");
3507 sm->ap_rsnxe = NULL;
3508 sm->ap_rsnxe_len = 0;
3509 } else {
3510 wpa_hexdump(MSG_DEBUG, "WPA: set AP RSNXE", ie, len);
3511 sm->ap_rsnxe = os_memdup(ie, len);
3512 if (!sm->ap_rsnxe)
3513 return -1;
3514
3515 sm->ap_rsnxe_len = len;
3516 }
3517
3518 return 0;
3519}
3520
3521
6fc6879b
JM		 3522/**
3523 * wpa_sm_parse_own_wpa_ie - Parse own WPA/RSN IE
3524 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3525 * @data: Pointer to data area for parsing results
3526 * Returns: 0 on success, -1 if IE is not known, or -2 on parsing failure
3527 *
3528 * Parse the contents of the own WPA or RSN IE from (Re)AssocReq and write the
3529 * parsed data into data.
3530 */
3531int wpa_sm_parse_own_wpa_ie(struct wpa_sm *sm, struct wpa_ie_data *data)
3532{
2a522e71
JM		 3533 if (sm == NULL)
3534 return -1;
3535
3536 if (sm->assoc_wpa_ie == NULL) {
f049052b
BG		 3537 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3538 "WPA: No WPA/RSN IE available from association info");
6fc6879b
JM		 3539 return -1;
3540 }
3541 if (wpa_parse_wpa_ie(sm->assoc_wpa_ie, sm->assoc_wpa_ie_len, data))
3542 return -2;
3543 return 0;
3544}
540264a7
JM		 3545
3546
3547int wpa_sm_pmksa_cache_list(struct wpa_sm *sm, char *buf, size_t len)
3548{
540264a7 3549 return pmksa_cache_list(sm->pmksa, buf, len);
540264a7 3550}
32d5295f
JM		 3551
3552
3459381d
JM		 3553struct rsn_pmksa_cache_entry * wpa_sm_pmksa_cache_head(struct wpa_sm *sm)
3554{
3555 return pmksa_cache_head(sm->pmksa);
3556}
3557
3558
3559struct rsn_pmksa_cache_entry *
3560wpa_sm_pmksa_cache_add_entry(struct wpa_sm *sm,
3561 struct rsn_pmksa_cache_entry * entry)
3562{
3563 return pmksa_cache_add_entry(sm->pmksa, entry);
3564}
3565
3566
f705f41b
VK		 3567void wpa_sm_pmksa_cache_add(struct wpa_sm *sm, const u8 *pmk, size_t pmk_len,
3568 const u8 *pmkid, const u8 *bssid,
3569 const u8 *fils_cache_id)
3570{
3571 sm->cur_pmksa = pmksa_cache_add(sm->pmksa, pmk, pmk_len, pmkid, NULL, 0,
3572 bssid, sm->own_addr, sm->network_ctx,
3573 sm->key_mgmt, fils_cache_id);
3574}
3575
3576
567da5bb
JM		 3577int wpa_sm_pmksa_exists(struct wpa_sm *sm, const u8 *bssid,
3578 const void *network_ctx)
3579{
852b2f27 3580 return pmksa_cache_get(sm->pmksa, bssid, NULL, network_ctx, 0) != NULL;
567da5bb
JM		 3581}
3582
3583
32d5295f
JM		 3584void wpa_sm_drop_sa(struct wpa_sm *sm)
3585{
f049052b 3586 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Clear old PMK and PTK");
32d5295f
JM		 3587 sm->ptk_set = 0;
3588 sm->tptk_set = 0;
1bd13110 3589 sm->pmk_len = 0;
32d5295f
JM		 3590 os_memset(sm->pmk, 0, sizeof(sm->pmk));
3591 os_memset(&sm->ptk, 0, sizeof(sm->ptk));
3592 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
cb5132bb 3593 os_memset(&sm->gtk, 0, sizeof(sm->gtk));
87e2db16 3594 os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
cb5132bb 3595 os_memset(&sm->igtk, 0, sizeof(sm->igtk));
87e2db16 3596 os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
71932544
JM		 3597#ifdef CONFIG_IEEE80211R
3598 os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
a3e18dbb 3599 sm->xxkey_len = 0;
71932544 3600 os_memset(sm->pmk_r0, 0, sizeof(sm->pmk_r0));
a3e18dbb 3601 sm->pmk_r0_len = 0;
71932544 3602 os_memset(sm->pmk_r1, 0, sizeof(sm->pmk_r1));
a3e18dbb 3603 sm->pmk_r1_len = 0;
71932544 3604#endif /* CONFIG_IEEE80211R */
32d5295f 3605}
0d7b4409
JM		 3606
3607
3608int wpa_sm_has_ptk(struct wpa_sm *sm)
3609{
3610 if (sm == NULL)
3611 return 0;
3612 return sm->ptk_set;
3613}
b14a210c
JB		 3614
3615
a79ed068
MT		 3616int wpa_sm_has_ptk_installed(struct wpa_sm *sm)
3617{
3618 if (!sm)
3619 return 0;
3620 return sm->ptk.installed;
3621}
3622
3623
b14a210c
JB		 3624void wpa_sm_update_replay_ctr(struct wpa_sm *sm, const u8 *replay_ctr)
3625{
3626 os_memcpy(sm->rx_replay_counter, replay_ctr, WPA_REPLAY_COUNTER_LEN);
3627}
d8a790b9
JM		 3628
3629
3630void wpa_sm_pmksa_cache_flush(struct wpa_sm *sm, void *network_ctx)
3631{
4033935d 3632 pmksa_cache_flush(sm->pmksa, network_ctx, NULL, 0);
d8a790b9 3633}
75cad1a0
XC		 3634
3635
ad3872a3 3636#ifdef CONFIG_WNM
75cad1a0
XC		 3637int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf)
3638{
75cad1a0
XC		 3639 u16 keyinfo;
3640 u8 keylen; /* plaintext key len */
75cad1a0
XC		 3641 u8 *key_rsc;
3642
75cad1a0 3643 if (subelem_id == WNM_SLEEP_SUBELEM_GTK) {
d2c33b91
JM		 3644 struct wpa_gtk_data gd;
3645
3646 os_memset(&gd, 0, sizeof(gd));
3647 keylen = wpa_cipher_key_len(sm->group_cipher);
3648 gd.key_rsc_len = wpa_cipher_rsc_len(sm->group_cipher);
3649 gd.alg = wpa_cipher_to_alg(sm->group_cipher);
3650 if (gd.alg == WPA_ALG_NONE) {
3651 wpa_printf(MSG_DEBUG, "Unsupported group cipher suite");
3652 return -1;
3653 }
3654
75cad1a0 3655 key_rsc = buf + 5;
68db9ab0 3656 keyinfo = WPA_GET_LE16(buf + 2);
75cad1a0
XC		 3657 gd.gtk_len = keylen;
3658 if (gd.gtk_len != buf[4]) {
3659 wpa_printf(MSG_DEBUG, "GTK len mismatch len %d vs %d",
3660 gd.gtk_len, buf[4]);
3661 return -1;
3662 }
3663 gd.keyidx = keyinfo & 0x03; /* B0 - B1 */
3664 gd.tx = wpa_supplicant_gtk_tx_bit_workaround(
3665 sm, !!(keyinfo & WPA_KEY_INFO_TXRX));
3666
68db9ab0 3667 os_memcpy(gd.gtk, buf + 13, gd.gtk_len);
75cad1a0
XC		 3668
3669 wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)",
3670 gd.gtk, gd.gtk_len);
87e2db16 3671 if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) {
31bc66e4 3672 forced_memzero(&gd, sizeof(gd));
75cad1a0
XC		 3673 wpa_printf(MSG_DEBUG, "Failed to install the GTK in "
3674 "WNM mode");
3675 return -1;
3676 }
31bc66e4 3677 forced_memzero(&gd, sizeof(gd));
75cad1a0 3678 } else if (subelem_id == WNM_SLEEP_SUBELEM_IGTK) {
cb5132bb
MV		 3679 const struct wpa_igtk_kde *igtk;
3680
3681 igtk = (const struct wpa_igtk_kde *) (buf + 2);
87e2db16 3682 if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0)
75cad1a0 3683 return -1;
2d4c78ae
JM		 3684 } else if (subelem_id == WNM_SLEEP_SUBELEM_BIGTK) {
3685 const struct wpa_bigtk_kde *bigtk;
3686
3687 bigtk = (const struct wpa_bigtk_kde *) (buf + 2);
3688 if (sm->beacon_prot &&
3689 wpa_supplicant_install_bigtk(sm, bigtk, 1) < 0)
3690 return -1;
75cad1a0
XC		 3691 } else {
3692 wpa_printf(MSG_DEBUG, "Unknown element id");
3693 return -1;
3694 }
3695
3696 return 0;
3697}
ad3872a3 3698#endif /* CONFIG_WNM */
db76aa64
JM		 3699
3700
25ef8529
JM		 3701#ifdef CONFIG_P2P
3702
3703int wpa_sm_get_p2p_ip_addr(struct wpa_sm *sm, u8 *buf)
3704{
3705 if (sm == NULL || WPA_GET_BE32(sm->p2p_ip_addr) == 0)
3706 return -1;
3707 os_memcpy(buf, sm->p2p_ip_addr, 3 * 4);
3708 return 0;
3709}
3710
3711#endif /* CONFIG_P2P */
b41f2684
CL		 3712
3713
3714void wpa_sm_set_rx_replay_ctr(struct wpa_sm *sm, const u8 *rx_replay_counter)
3715{
3716 if (rx_replay_counter == NULL)
3717 return;
3718
3719 os_memcpy(sm->rx_replay_counter, rx_replay_counter,
3720 WPA_REPLAY_COUNTER_LEN);
3721 sm->rx_replay_counter_set = 1;
3722 wpa_printf(MSG_DEBUG, "Updated key replay counter");
3723}
3724
3725
98cd3d1c
JM		 3726void wpa_sm_set_ptk_kck_kek(struct wpa_sm *sm,
3727 const u8 *ptk_kck, size_t ptk_kck_len,
3728 const u8 *ptk_kek, size_t ptk_kek_len)
b41f2684 3729{
98cd3d1c
JM		 3730 if (ptk_kck && ptk_kck_len <= WPA_KCK_MAX_LEN) {
3731 os_memcpy(sm->ptk.kck, ptk_kck, ptk_kck_len);
3732 sm->ptk.kck_len = ptk_kck_len;
b41f2684
CL		 3733 wpa_printf(MSG_DEBUG, "Updated PTK KCK");
3734 }
98cd3d1c
JM		 3735 if (ptk_kek && ptk_kek_len <= WPA_KEK_MAX_LEN) {
3736 os_memcpy(sm->ptk.kek, ptk_kek, ptk_kek_len);
3737 sm->ptk.kek_len = ptk_kek_len;
b41f2684
CL		 3738 wpa_printf(MSG_DEBUG, "Updated PTK KEK");
3739 }
3740 sm->ptk_set = 1;
3741}
651c6a84
JM		 3742
3743
3744#ifdef CONFIG_TESTING_OPTIONS
bb06748f 3745
651c6a84
JM		 3746void wpa_sm_set_test_assoc_ie(struct wpa_sm *sm, struct wpabuf *buf)
3747{
3748 wpabuf_free(sm->test_assoc_ie);
3749 sm->test_assoc_ie = buf;
3750}
bb06748f
JM		 3751
3752
3753const u8 * wpa_sm_get_anonce(struct wpa_sm *sm)
3754{
3755 return sm->anonce;
3756}
3757
651c6a84 3758#endif /* CONFIG_TESTING_OPTIONS */
f00b9b88
JM		 3759
3760
3dc3afe2
AM		 3761unsigned int wpa_sm_get_key_mgmt(struct wpa_sm *sm)
3762{
3763 return sm->key_mgmt;
3764}
3765
3766
f00b9b88
JM		 3767#ifdef CONFIG_FILS
3768
af3e362f 3769struct wpabuf * fils_build_auth(struct wpa_sm *sm, int dh_group, const u8 *md)
f00b9b88
JM		 3770{
3771 struct wpabuf *buf = NULL;
3772 struct wpabuf *erp_msg;
76e20f4f 3773 struct wpabuf *pub = NULL;
f00b9b88
JM		 3774
3775 erp_msg = eapol_sm_build_erp_reauth_start(sm->eapol);
3776 if (!erp_msg && !sm->cur_pmksa) {
3777 wpa_printf(MSG_DEBUG,
3778 "FILS: Neither ERP EAP-Initiate/Re-auth nor PMKSA cache entry is available - skip FILS");
3779 goto fail;
3780 }
3781
3782 wpa_printf(MSG_DEBUG, "FILS: Try to use FILS (erp=%d pmksa_cache=%d)",
3783 erp_msg != NULL, sm->cur_pmksa != NULL);
3784
706df429
JM		 3785 sm->fils_completed = 0;
3786
f00b9b88
JM		 3787 if (!sm->assoc_wpa_ie) {
3788 wpa_printf(MSG_INFO, "FILS: No own RSN IE set for FILS");
3789 goto fail;
3790 }
3791
3792 if (random_get_bytes(sm->fils_nonce, FILS_NONCE_LEN) < 0 ||
3793 random_get_bytes(sm->fils_session, FILS_SESSION_LEN) < 0)
3794 goto fail;
3795
3796 wpa_hexdump(MSG_DEBUG, "FILS: Generated FILS Nonce",
3797 sm->fils_nonce, FILS_NONCE_LEN);
3798 wpa_hexdump(MSG_DEBUG, "FILS: Generated FILS Session",
3799 sm->fils_session, FILS_SESSION_LEN);
3800
76e20f4f
JM		 3801#ifdef CONFIG_FILS_SK_PFS
3802 sm->fils_dh_group = dh_group;
3803 if (dh_group) {
3804 crypto_ecdh_deinit(sm->fils_ecdh);
3805 sm->fils_ecdh = crypto_ecdh_init(dh_group);
3806 if (!sm->fils_ecdh) {
3807 wpa_printf(MSG_INFO,
3808 "FILS: Could not initialize ECDH with group %d",
3809 dh_group);
3810 goto fail;
3811 }
3812 pub = crypto_ecdh_get_pubkey(sm->fils_ecdh, 1);
3813 if (!pub)
3814 goto fail;
3815 wpa_hexdump_buf(MSG_DEBUG, "FILS: Element (DH public key)",
3816 pub);
3817 sm->fils_dh_elem_len = wpabuf_len(pub);
3818 }
3819#endif /* CONFIG_FILS_SK_PFS */
3820
3821 buf = wpabuf_alloc(1000 + sm->assoc_wpa_ie_len +
3822 (pub ? wpabuf_len(pub) : 0));
f00b9b88
JM		 3823 if (!buf)
3824 goto fail;
3825
3826 /* Fields following the Authentication algorithm number field */
3827
3828 /* Authentication Transaction seq# */
3829 wpabuf_put_le16(buf, 1);
3830
3831 /* Status Code */
3832 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
3833
76e20f4f
JM		 3834 /* TODO: FILS PK */
3835#ifdef CONFIG_FILS_SK_PFS
3836 if (dh_group) {
3837 /* Finite Cyclic Group */
3838 wpabuf_put_le16(buf, dh_group);
3839 /* Element */
3840 wpabuf_put_buf(buf, pub);
3841 }
3842#endif /* CONFIG_FILS_SK_PFS */
f00b9b88
JM		 3843
3844 /* RSNE */
3845 wpa_hexdump(MSG_DEBUG, "FILS: RSNE in FILS Authentication frame",
3846 sm->assoc_wpa_ie, sm->assoc_wpa_ie_len);
3847 wpabuf_put_data(buf, sm->assoc_wpa_ie, sm->assoc_wpa_ie_len);
3848
af3e362f
JM		 3849 if (md) {
3850 /* MDE when using FILS for FT initial association */
3851 struct rsn_mdie *mdie;
3852
3853 wpabuf_put_u8(buf, WLAN_EID_MOBILITY_DOMAIN);
3854 wpabuf_put_u8(buf, sizeof(*mdie));
3855 mdie = wpabuf_put(buf, sizeof(*mdie));
3856 os_memcpy(mdie->mobility_domain, md, MOBILITY_DOMAIN_ID_LEN);
3857 mdie->ft_capab = 0;
3858 }
f00b9b88
JM		 3859
3860 /* FILS Nonce */
3861 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
3862 wpabuf_put_u8(buf, 1 + FILS_NONCE_LEN); /* Length */
3863 /* Element ID Extension */
3864 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_NONCE);
3865 wpabuf_put_data(buf, sm->fils_nonce, FILS_NONCE_LEN);
3866
3867 /* FILS Session */
3868 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
3869 wpabuf_put_u8(buf, 1 + FILS_SESSION_LEN); /* Length */
3870 /* Element ID Extension */
3871 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_SESSION);
3872 wpabuf_put_data(buf, sm->fils_session, FILS_SESSION_LEN);
3873
e636bc85 3874 /* Wrapped Data */
fcd3d6ce 3875 sm->fils_erp_pmkid_set = 0;
f00b9b88
JM		 3876 if (erp_msg) {
3877 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
3878 wpabuf_put_u8(buf, 1 + wpabuf_len(erp_msg)); /* Length */
3879 /* Element ID Extension */
e636bc85 3880 wpabuf_put_u8(buf, WLAN_EID_EXT_WRAPPED_DATA);
f00b9b88 3881 wpabuf_put_buf(buf, erp_msg);
fcd3d6ce
JM		 3882 /* Calculate pending PMKID here so that we do not need to
3883 * maintain a copy of the EAP-Initiate/Reauth message. */
3884 if (fils_pmkid_erp(sm->key_mgmt, wpabuf_head(erp_msg),
3885 wpabuf_len(erp_msg),
3886 sm->fils_erp_pmkid) == 0)
3887 sm->fils_erp_pmkid_set = 1;
f00b9b88
JM		 3888 }
3889
3890 wpa_hexdump_buf(MSG_DEBUG, "RSN: FILS fields for Authentication frame",
3891 buf);
3892
3893fail:
3894 wpabuf_free(erp_msg);
76e20f4f 3895 wpabuf_free(pub);
f00b9b88
JM		 3896 return buf;
3897}
3898
a6609937 3899
ba9774bd
JM		 3900int fils_process_auth(struct wpa_sm *sm, const u8 *bssid, const u8 *data,
3901 size_t len)
a6609937
JM		 3902{
3903 const u8 *pos, *end;
3904 struct ieee802_11_elems elems;
3905 struct wpa_ie_data rsn;
3906 int pmkid_match = 0;
3907 u8 ick[FILS_ICK_MAX_LEN];
3908 size_t ick_len;
3909 int res;
76e20f4f 3910 struct wpabuf *dh_ss = NULL;
e6b62313
JM		 3911 const u8 *g_sta = NULL;
3912 size_t g_sta_len = 0;
3913 const u8 *g_ap = NULL;
3914 size_t g_ap_len = 0;
3915 struct wpabuf *pub = NULL;
a6609937 3916
ba9774bd
JM		 3917 os_memcpy(sm->bssid, bssid, ETH_ALEN);
3918
a6609937
JM		 3919 wpa_hexdump(MSG_DEBUG, "FILS: Authentication frame fields",
3920 data, len);
3921 pos = data;
3922 end = data + len;
3923
76e20f4f
JM		 3924 /* TODO: FILS PK */
3925#ifdef CONFIG_FILS_SK_PFS
3926 if (sm->fils_dh_group) {
3927 u16 group;
3928
3929 /* Using FILS PFS */
3930
3931 /* Finite Cyclic Group */
3932 if (end - pos < 2) {
3933 wpa_printf(MSG_DEBUG,
3934 "FILS: No room for Finite Cyclic Group");
3935 goto fail;
3936 }
3937 group = WPA_GET_LE16(pos);
3938 pos += 2;
3939 if (group != sm->fils_dh_group) {
3940 wpa_printf(MSG_DEBUG,
3941 "FILS: Unexpected change in Finite Cyclic Group: %u (expected %u)",
3942 group, sm->fils_dh_group);
3943 goto fail;
3944 }
3945
3946 /* Element */
3947 if ((size_t) (end - pos) < sm->fils_dh_elem_len) {
3948 wpa_printf(MSG_DEBUG, "FILS: No room for Element");
3949 goto fail;
3950 }
3951
3952 if (!sm->fils_ecdh) {
3953 wpa_printf(MSG_DEBUG, "FILS: No ECDH state available");
3954 goto fail;
3955 }
3956 dh_ss = crypto_ecdh_set_peerkey(sm->fils_ecdh, 1, pos,
3957 sm->fils_dh_elem_len);
3958 if (!dh_ss) {
3959 wpa_printf(MSG_DEBUG, "FILS: ECDH operation failed");
3960 goto fail;
3961 }
3962 wpa_hexdump_buf_key(MSG_DEBUG, "FILS: DH_SS", dh_ss);
e6b62313
JM		 3963 g_ap = pos;
3964 g_ap_len = sm->fils_dh_elem_len;
76e20f4f
JM		 3965 pos += sm->fils_dh_elem_len;
3966 }
3967#endif /* CONFIG_FILS_SK_PFS */
a6609937
JM		 3968
3969 wpa_hexdump(MSG_DEBUG, "FILS: Remaining IEs", pos, end - pos);
3970 if (ieee802_11_parse_elems(pos, end - pos, &elems, 1) == ParseFailed) {
3971 wpa_printf(MSG_DEBUG, "FILS: Could not parse elements");
76e20f4f 3972 goto fail;
a6609937
JM		 3973 }
3974
3975 /* RSNE */
3976 wpa_hexdump(MSG_DEBUG, "FILS: RSN element", elems.rsn_ie,
3977 elems.rsn_ie_len);
3978 if (!elems.rsn_ie ||
3979 wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, elems.rsn_ie_len + 2,
3980 &rsn) < 0) {
3981 wpa_printf(MSG_DEBUG, "FILS: No RSN element");
76e20f4f 3982 goto fail;
a6609937
JM		 3983 }
3984
3985 if (!elems.fils_nonce) {
3986 wpa_printf(MSG_DEBUG, "FILS: No FILS Nonce field");
76e20f4f 3987 goto fail;
a6609937
JM		 3988 }
3989 os_memcpy(sm->fils_anonce, elems.fils_nonce, FILS_NONCE_LEN);
3990 wpa_hexdump(MSG_DEBUG, "FILS: ANonce", sm->fils_anonce, FILS_NONCE_LEN);
3991
d555c39c 3992#ifdef CONFIG_IEEE80211R
7d440a3b
JM		 3993 if (wpa_key_mgmt_ft(sm->key_mgmt)) {
3994 struct wpa_ft_ies parse;
3995
3996 if (!elems.mdie || !elems.ftie) {
3997 wpa_printf(MSG_DEBUG, "FILS+FT: No MDE or FTE");
3998 goto fail;
3999 }
4000
9a33737a
JM		 4001 if (wpa_ft_parse_ies(pos, end - pos, &parse,
4002 wpa_key_mgmt_sha384(sm->key_mgmt)) < 0) {
7d440a3b
JM		 4003 wpa_printf(MSG_DEBUG, "FILS+FT: Failed to parse IEs");
4004 goto fail;
4005 }
4006
4007 if (!parse.r0kh_id) {
4008 wpa_printf(MSG_DEBUG,
4009 "FILS+FT: No R0KH-ID subelem in FTE");
4010 goto fail;
4011 }
4012 os_memcpy(sm->r0kh_id, parse.r0kh_id, parse.r0kh_id_len);
4013 sm->r0kh_id_len = parse.r0kh_id_len;
4014 wpa_hexdump_ascii(MSG_DEBUG, "FILS+FT: R0KH-ID",
4015 sm->r0kh_id, sm->r0kh_id_len);
4016
4017 if (!parse.r1kh_id) {
4018 wpa_printf(MSG_DEBUG,
4019 "FILS+FT: No R1KH-ID subelem in FTE");
4020 goto fail;
4021 }
4022 os_memcpy(sm->r1kh_id, parse.r1kh_id, FT_R1KH_ID_LEN);
4023 wpa_hexdump(MSG_DEBUG, "FILS+FT: R1KH-ID",
4024 sm->r1kh_id, FT_R1KH_ID_LEN);
4025
4026 /* TODO: Check MDE and FTE payload */
4027
4028 wpabuf_free(sm->fils_ft_ies);
4029 sm->fils_ft_ies = wpabuf_alloc(2 + elems.mdie_len +
4030 2 + elems.ftie_len);
4031 if (!sm->fils_ft_ies)
4032 goto fail;
4033 wpabuf_put_data(sm->fils_ft_ies, elems.mdie - 2,
4034 2 + elems.mdie_len);
4035 wpabuf_put_data(sm->fils_ft_ies, elems.ftie - 2,
4036 2 + elems.ftie_len);
4037 } else {
4038 wpabuf_free(sm->fils_ft_ies);
4039 sm->fils_ft_ies = NULL;
4040 }
d555c39c 4041#endif /* CONFIG_IEEE80211R */
a6609937
JM		 4042
4043 /* PMKID List */
4044 if (rsn.pmkid && rsn.num_pmkid > 0) {
4045 wpa_hexdump(MSG_DEBUG, "FILS: PMKID List",
4046 rsn.pmkid, rsn.num_pmkid * PMKID_LEN);
4047
4048 if (rsn.num_pmkid != 1) {
4049 wpa_printf(MSG_DEBUG, "FILS: Invalid PMKID selection");
76e20f4f 4050 goto fail;
a6609937
JM		 4051 }
4052 wpa_hexdump(MSG_DEBUG, "FILS: PMKID", rsn.pmkid, PMKID_LEN);
4053 if (os_memcmp(sm->cur_pmksa->pmkid, rsn.pmkid, PMKID_LEN) != 0)
4054 {
4055 wpa_printf(MSG_DEBUG, "FILS: PMKID mismatch");
4056 wpa_hexdump(MSG_DEBUG, "FILS: Expected PMKID",
4057 sm->cur_pmksa->pmkid, PMKID_LEN);
76e20f4f 4058 goto fail;
a6609937
JM		 4059 }
4060 wpa_printf(MSG_DEBUG,
4061 "FILS: Matching PMKID - continue using PMKSA caching");
4062 pmkid_match = 1;
4063 }
4064 if (!pmkid_match && sm->cur_pmksa) {
4065 wpa_printf(MSG_DEBUG,
4066 "FILS: No PMKID match - cannot use cached PMKSA entry");
4067 sm->cur_pmksa = NULL;
4068 }
4069
4070 /* FILS Session */
4071 if (!elems.fils_session) {
4072 wpa_printf(MSG_DEBUG, "FILS: No FILS Session element");
76e20f4f 4073 goto fail;
a6609937
JM		 4074 }
4075 wpa_hexdump(MSG_DEBUG, "FILS: FILS Session", elems.fils_session,
4076 FILS_SESSION_LEN);
4077 if (os_memcmp(sm->fils_session, elems.fils_session, FILS_SESSION_LEN)
4078 != 0) {
4079 wpa_printf(MSG_DEBUG, "FILS: Session mismatch");
4080 wpa_hexdump(MSG_DEBUG, "FILS: Expected FILS Session",
4081 sm->fils_session, FILS_SESSION_LEN);
76e20f4f 4082 goto fail;
a6609937
JM		 4083 }
4084
e636bc85
IP		 4085 /* Wrapped Data */
4086 if (!sm->cur_pmksa && elems.wrapped_data) {
fcd3d6ce
JM		 4087 u8 rmsk[ERP_MAX_KEY_LEN];
4088 size_t rmsk_len;
4089
a6609937 4090 wpa_hexdump(MSG_DEBUG, "FILS: Wrapped Data",
e636bc85
IP		 4091 elems.wrapped_data,
4092 elems.wrapped_data_len);
4093 eapol_sm_process_erp_finish(sm->eapol, elems.wrapped_data,
4094 elems.wrapped_data_len);
a6609937 4095 if (eapol_sm_failed(sm->eapol))
76e20f4f 4096 goto fail;
a6609937 4097
fcd3d6ce
JM		 4098 rmsk_len = ERP_MAX_KEY_LEN;
4099 res = eapol_sm_get_key(sm->eapol, rmsk, rmsk_len);
4100 if (res == PMK_LEN) {
4101 rmsk_len = PMK_LEN;
4102 res = eapol_sm_get_key(sm->eapol, rmsk, rmsk_len);
4103 }
a6609937 4104 if (res)
76e20f4f 4105 goto fail;
a6609937 4106
fcd3d6ce 4107 res = fils_rmsk_to_pmk(sm->key_mgmt, rmsk, rmsk_len,
76e20f4f
JM		 4108 sm->fils_nonce, sm->fils_anonce,
4109 dh_ss ? wpabuf_head(dh_ss) : NULL,
4110 dh_ss ? wpabuf_len(dh_ss) : 0,
fcd3d6ce 4111 sm->pmk, &sm->pmk_len);
31bc66e4 4112 forced_memzero(rmsk, sizeof(rmsk));
4cada9dc
JM		 4113
4114 /* Don't use DHss in PTK derivation if PMKSA caching is not
4115 * used. */
76e20f4f
JM		 4116 wpabuf_clear_free(dh_ss);
4117 dh_ss = NULL;
4cada9dc 4118
275cc942 4119 if (res)
76e20f4f 4120 goto fail;
fcd3d6ce
JM		 4121
4122 if (!sm->fils_erp_pmkid_set) {
4123 wpa_printf(MSG_DEBUG, "FILS: PMKID not available");
76e20f4f 4124 goto fail;
fcd3d6ce
JM		 4125 }
4126 wpa_hexdump(MSG_DEBUG, "FILS: PMKID", sm->fils_erp_pmkid,
4127 PMKID_LEN);
a6609937 4128 wpa_printf(MSG_DEBUG, "FILS: ERP processing succeeded - add PMKSA cache entry for the result");
fcd3d6ce
JM		 4129 sm->cur_pmksa = pmksa_cache_add(sm->pmksa, sm->pmk, sm->pmk_len,
4130 sm->fils_erp_pmkid, NULL, 0,
4131 sm->bssid, sm->own_addr,
869af307
JM		 4132 sm->network_ctx, sm->key_mgmt,
4133 NULL);
a6609937
JM		 4134 }
4135
4136 if (!sm->cur_pmksa) {
4137 wpa_printf(MSG_DEBUG,
4138 "FILS: No remaining options to continue FILS authentication");
76e20f4f 4139 goto fail;
a6609937
JM		 4140 }
4141
4142 if (fils_pmk_to_ptk(sm->pmk, sm->pmk_len, sm->own_addr, sm->bssid,
4cada9dc
JM		 4143 sm->fils_nonce, sm->fils_anonce,
4144 dh_ss ? wpabuf_head(dh_ss) : NULL,
4145 dh_ss ? wpabuf_len(dh_ss) : 0,
4146 &sm->ptk, ick, &ick_len,
4147 sm->key_mgmt, sm->pairwise_cipher,
7d440a3b 4148 sm->fils_ft, &sm->fils_ft_len) < 0) {
a6609937 4149 wpa_printf(MSG_DEBUG, "FILS: Failed to derive PTK");
76e20f4f 4150 goto fail;
a6609937 4151 }
4cada9dc
JM		 4152
4153 wpabuf_clear_free(dh_ss);
4154 dh_ss = NULL;
4155
a6609937
JM		 4156 sm->ptk_set = 1;
4157 sm->tptk_set = 0;
4158 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
4159
e6b62313
JM		 4160#ifdef CONFIG_FILS_SK_PFS
4161 if (sm->fils_dh_group) {
4162 if (!sm->fils_ecdh) {
4163 wpa_printf(MSG_INFO, "FILS: ECDH not initialized");
4164 goto fail;
4165 }
4166 pub = crypto_ecdh_get_pubkey(sm->fils_ecdh, 1);
4167 if (!pub)
4168 goto fail;
4169 wpa_hexdump_buf(MSG_DEBUG, "FILS: gSTA", pub);
4170 g_sta = wpabuf_head(pub);
4171 g_sta_len = wpabuf_len(pub);
4172 if (!g_ap) {
4173 wpa_printf(MSG_INFO, "FILS: gAP not available");
4174 goto fail;
4175 }
4176 wpa_hexdump(MSG_DEBUG, "FILS: gAP", g_ap, g_ap_len);
4177 }
4178#endif /* CONFIG_FILS_SK_PFS */
4179
a6609937
JM		 4180 res = fils_key_auth_sk(ick, ick_len, sm->fils_nonce,
4181 sm->fils_anonce, sm->own_addr, sm->bssid,
e6b62313 4182 g_sta, g_sta_len, g_ap, g_ap_len,
a6609937
JM		 4183 sm->key_mgmt, sm->fils_key_auth_sta,
4184 sm->fils_key_auth_ap,
4185 &sm->fils_key_auth_len);
e6b62313 4186 wpabuf_free(pub);
31bc66e4 4187 forced_memzero(ick, sizeof(ick));
a6609937 4188 return res;
76e20f4f 4189fail:
e6b62313 4190 wpabuf_free(pub);
76e20f4f
JM		 4191 wpabuf_clear_free(dh_ss);
4192 return -1;
a6609937
JM		 4193}
4194
86cd6928 4195
7d440a3b
JM		 4196#ifdef CONFIG_IEEE80211R
4197static int fils_ft_build_assoc_req_rsne(struct wpa_sm *sm, struct wpabuf *buf)
4198{
4199 struct rsn_ie_hdr *rsnie;
4200 u16 capab;
4201 u8 *pos;
994eac7e 4202 int use_sha384 = wpa_key_mgmt_sha384(sm->key_mgmt);
7d440a3b
JM		 4203
4204 /* RSNIE[PMKR0Name/PMKR1Name] */
4205 rsnie = wpabuf_put(buf, sizeof(*rsnie));
4206 rsnie->elem_id = WLAN_EID_RSN;
4207 WPA_PUT_LE16(rsnie->version, RSN_VERSION);
4208
4209 /* Group Suite Selector */
4210 if (!wpa_cipher_valid_group(sm->group_cipher)) {
4211 wpa_printf(MSG_WARNING, "FT: Invalid group cipher (%d)",
4212 sm->group_cipher);
4213 return -1;
4214 }
4215 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
4216 RSN_SELECTOR_PUT(pos, wpa_cipher_to_suite(WPA_PROTO_RSN,
4217 sm->group_cipher));
4218
4219 /* Pairwise Suite Count */
4220 wpabuf_put_le16(buf, 1);
4221
4222 /* Pairwise Suite List */
4223 if (!wpa_cipher_valid_pairwise(sm->pairwise_cipher)) {
4224 wpa_printf(MSG_WARNING, "FT: Invalid pairwise cipher (%d)",
4225 sm->pairwise_cipher);
4226 return -1;
4227 }
4228 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
4229 RSN_SELECTOR_PUT(pos, wpa_cipher_to_suite(WPA_PROTO_RSN,
4230 sm->pairwise_cipher));
4231
4232 /* Authenticated Key Management Suite Count */
4233 wpabuf_put_le16(buf, 1);
4234
4235 /* Authenticated Key Management Suite List */
4236 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
4237 if (sm->key_mgmt == WPA_KEY_MGMT_FT_FILS_SHA256)
4238 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_FILS_SHA256);
4239 else if (sm->key_mgmt == WPA_KEY_MGMT_FT_FILS_SHA384)
4240 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_FILS_SHA384);
4241 else {
4242 wpa_printf(MSG_WARNING,
4243 "FILS+FT: Invalid key management type (%d)",
4244 sm->key_mgmt);
4245 return -1;
4246 }
4247
4248 /* RSN Capabilities */
4249 capab = 0;
e0d22c84 4250 if (sm->mfp)
7d440a3b 4251 capab |= WPA_CAPABILITY_MFPC;
e0d22c84
JM		 4252 if (sm->mfp == 2)
4253 capab |= WPA_CAPABILITY_MFPR;
55c12f5d
MV		 4254 if (sm->ocv)
4255 capab |= WPA_CAPABILITY_OCVC;
7d440a3b
JM		 4256 wpabuf_put_le16(buf, capab);
4257
4258 /* PMKID Count */
4259 wpabuf_put_le16(buf, 1);
4260
4261 /* PMKID List [PMKR1Name] */
4262 wpa_hexdump_key(MSG_DEBUG, "FILS+FT: XXKey (FILS-FT)",
4263 sm->fils_ft, sm->fils_ft_len);
4264 wpa_hexdump_ascii(MSG_DEBUG, "FILS+FT: SSID", sm->ssid, sm->ssid_len);
4265 wpa_hexdump(MSG_DEBUG, "FILS+FT: MDID",
4266 sm->mobility_domain, MOBILITY_DOMAIN_ID_LEN);
4267 wpa_hexdump_ascii(MSG_DEBUG, "FILS+FT: R0KH-ID",
4268 sm->r0kh_id, sm->r0kh_id_len);
4269 if (wpa_derive_pmk_r0(sm->fils_ft, sm->fils_ft_len, sm->ssid,
4270 sm->ssid_len, sm->mobility_domain,
4271 sm->r0kh_id, sm->r0kh_id_len, sm->own_addr,
994eac7e 4272 sm->pmk_r0, sm->pmk_r0_name, use_sha384) < 0) {
7d440a3b
JM		 4273 wpa_printf(MSG_WARNING, "FILS+FT: Could not derive PMK-R0");
4274 return -1;
4275 }
994eac7e
JM		 4276 sm->pmk_r0_len = use_sha384 ? SHA384_MAC_LEN : PMK_LEN;
4277 wpa_hexdump_key(MSG_DEBUG, "FILS+FT: PMK-R0",
4278 sm->pmk_r0, sm->pmk_r0_len);
7d440a3b
JM		 4279 wpa_hexdump(MSG_DEBUG, "FILS+FT: PMKR0Name",
4280 sm->pmk_r0_name, WPA_PMK_NAME_LEN);
4281 wpa_printf(MSG_DEBUG, "FILS+FT: R1KH-ID: " MACSTR,
4282 MAC2STR(sm->r1kh_id));
4283 pos = wpabuf_put(buf, WPA_PMK_NAME_LEN);
4284 if (wpa_derive_pmk_r1_name(sm->pmk_r0_name, sm->r1kh_id, sm->own_addr,
b5e57699 4285 sm->pmk_r1_name, use_sha384) < 0) {
7d440a3b
JM		 4286 wpa_printf(MSG_WARNING, "FILS+FT: Could not derive PMKR1Name");
4287 return -1;
4288 }
b5e57699
JM		 4289 wpa_hexdump(MSG_DEBUG, "FILS+FT: PMKR1Name", sm->pmk_r1_name,
4290 WPA_PMK_NAME_LEN);
4291 os_memcpy(pos, sm->pmk_r1_name, WPA_PMK_NAME_LEN);
7d440a3b 4292
7d440a3b
JM		 4293 if (sm->mgmt_group_cipher == WPA_CIPHER_AES_128_CMAC) {
4294 /* Management Group Cipher Suite */
4295 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
4296 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC);
4297 }
7d440a3b
JM		 4298
4299 rsnie->len = ((u8 *) wpabuf_put(buf, 0) - (u8 *) rsnie) - 2;
4300 return 0;
4301}
4302#endif /* CONFIG_IEEE80211R */
4303
4304
86cd6928
JM		 4305struct wpabuf * fils_build_assoc_req(struct wpa_sm *sm, const u8 **kek,
4306 size_t *kek_len, const u8 **snonce,
5732b770
JM		 4307 const u8 **anonce,
4308 const struct wpabuf **hlp,
4309 unsigned int num_hlp)
86cd6928
JM		 4310{
4311 struct wpabuf *buf;
5732b770
JM		 4312 size_t len;
4313 unsigned int i;
86cd6928 4314
5732b770 4315 len = 1000;
7d440a3b
JM		 4316#ifdef CONFIG_IEEE80211R
4317 if (sm->fils_ft_ies)
4318 len += wpabuf_len(sm->fils_ft_ies);
4319 if (wpa_key_mgmt_ft(sm->key_mgmt))
4320 len += 256;
4321#endif /* CONFIG_IEEE80211R */
5732b770
JM		 4322 for (i = 0; hlp && i < num_hlp; i++)
4323 len += 10 + wpabuf_len(hlp[i]);
4324 buf = wpabuf_alloc(len);
86cd6928
JM		 4325 if (!buf)
4326 return NULL;
4327
7d440a3b
JM		 4328#ifdef CONFIG_IEEE80211R
4329 if (wpa_key_mgmt_ft(sm->key_mgmt) && sm->fils_ft_ies) {
4330 /* MDE and FTE when using FILS+FT */
4331 wpabuf_put_buf(buf, sm->fils_ft_ies);
4332 /* RSNE with PMKR1Name in PMKID field */
4333 if (fils_ft_build_assoc_req_rsne(sm, buf) < 0) {
4334 wpabuf_free(buf);
4335 return NULL;
4336 }
4337 }
4338#endif /* CONFIG_IEEE80211R */
4339
86cd6928
JM		 4340 /* FILS Session */
4341 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
4342 wpabuf_put_u8(buf, 1 + FILS_SESSION_LEN); /* Length */
4343 /* Element ID Extension */
4344 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_SESSION);
4345 wpabuf_put_data(buf, sm->fils_session, FILS_SESSION_LEN);
4346
4347 /* Everything after FILS Session element gets encrypted in the driver
4348 * with KEK. The buffer returned from here is the plaintext version. */
4349
4350 /* TODO: FILS Public Key */
4351
4352 /* FILS Key Confirm */
4353 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
4354 wpabuf_put_u8(buf, 1 + sm->fils_key_auth_len); /* Length */
4355 /* Element ID Extension */
4356 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_KEY_CONFIRM);
4357 wpabuf_put_data(buf, sm->fils_key_auth_sta, sm->fils_key_auth_len);
4358
5732b770
JM		 4359 /* FILS HLP Container */
4360 for (i = 0; hlp && i < num_hlp; i++) {
4361 const u8 *pos = wpabuf_head(hlp[i]);
4362 size_t left = wpabuf_len(hlp[i]);
4363
4364 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
4365 if (left <= 254)
4366 len = 1 + left;
4367 else
4368 len = 255;
4369 wpabuf_put_u8(buf, len); /* Length */
4370 /* Element ID Extension */
4371 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_HLP_CONTAINER);
4372 /* Destination MAC Address, Source MAC Address, HLP Packet.
4373 * HLP Packet is in MSDU format (i.e., included the LLC/SNAP
4374 * header when LPD is used). */
4375 wpabuf_put_data(buf, pos, len - 1);
4376 pos += len - 1;
4377 left -= len - 1;
4378 while (left) {
4379 wpabuf_put_u8(buf, WLAN_EID_FRAGMENT);
4380 len = left > 255 ? 255 : left;
4381 wpabuf_put_u8(buf, len);
4382 wpabuf_put_data(buf, pos, len);
4383 pos += len;
4384 left -= len;
4385 }
4386 }
86cd6928
JM		 4387
4388 /* TODO: FILS IP Address Assignment */
4389
99621dc1
MV		 4390#ifdef CONFIG_OCV
4391 if (wpa_sm_ocv_enabled(sm)) {
4392 struct wpa_channel_info ci;
4393 u8 *pos;
4394
4395 if (wpa_sm_channel_info(sm, &ci) != 0) {
4396 wpa_printf(MSG_WARNING,
4397 "FILS: Failed to get channel info for OCI element");
4398 wpabuf_free(buf);
4399 return NULL;
4400 }
4401
4402 pos = wpabuf_put(buf, OCV_OCI_EXTENDED_LEN);
4403 if (ocv_insert_extended_oci(&ci, pos) < 0) {
4404 wpabuf_free(buf);
4405 return NULL;
4406 }
4407 }
4408#endif /* CONFIG_OCV */
4409
86cd6928
JM		 4410 wpa_hexdump_buf(MSG_DEBUG, "FILS: Association Request plaintext", buf);
4411
4412 *kek = sm->ptk.kek;
4413 *kek_len = sm->ptk.kek_len;
4414 wpa_hexdump_key(MSG_DEBUG, "FILS: KEK for AEAD", *kek, *kek_len);
4415 *snonce = sm->fils_nonce;
4416 wpa_hexdump(MSG_DEBUG, "FILS: SNonce for AEAD AAD",
4417 *snonce, FILS_NONCE_LEN);
4418 *anonce = sm->fils_anonce;
4419 wpa_hexdump(MSG_DEBUG, "FILS: ANonce for AEAD AAD",
4420 *anonce, FILS_NONCE_LEN);
4421
4422 return buf;
4423}
4424
706df429 4425
124ddfa1
JM		 4426static void fils_process_hlp_resp(struct wpa_sm *sm, const u8 *resp, size_t len)
4427{
4428 const u8 *pos, *end;
4429
4430 wpa_hexdump(MSG_MSGDUMP, "FILS: HLP response", resp, len);
4431 if (len < 2 * ETH_ALEN)
4432 return;
4433 pos = resp + 2 * ETH_ALEN;
4434 end = resp + len;
4435 if (end - pos >= 6 &&
4436 os_memcmp(pos, "\xaa\xaa\x03\x00\x00\x00", 6) == 0)
4437 pos += 6; /* Remove SNAP/LLC header */
4438 wpa_sm_fils_hlp_rx(sm, resp, resp + ETH_ALEN, pos, end - pos);
4439}
4440
4441
4442static void fils_process_hlp_container(struct wpa_sm *sm, const u8 *pos,
4443 size_t len)
4444{
4445 const u8 *end = pos + len;
4446 u8 *tmp, *tmp_pos;
4447
4448 /* Check if there are any FILS HLP Container elements */
4449 while (end - pos >= 2) {
4450 if (2 + pos[1] > end - pos)
4451 return;
4452 if (pos[0] == WLAN_EID_EXTENSION &&
4453 pos[1] >= 1 + 2 * ETH_ALEN &&
4454 pos[2] == WLAN_EID_EXT_FILS_HLP_CONTAINER)
4455 break;
4456 pos += 2 + pos[1];
4457 }
4458 if (end - pos < 2)
4459 return; /* No FILS HLP Container elements */
4460
4461 tmp = os_malloc(end - pos);
4462 if (!tmp)
4463 return;
4464
4465 while (end - pos >= 2) {
4466 if (2 + pos[1] > end - pos ||
4467 pos[0] != WLAN_EID_EXTENSION ||
4468 pos[1] < 1 + 2 * ETH_ALEN ||
4469 pos[2] != WLAN_EID_EXT_FILS_HLP_CONTAINER)
4470 break;
4471 tmp_pos = tmp;
4472 os_memcpy(tmp_pos, pos + 3, pos[1] - 1);
4473 tmp_pos += pos[1] - 1;
4474 pos += 2 + pos[1];
4475
4476 /* Add possible fragments */
4477 while (end - pos >= 2 && pos[0] == WLAN_EID_FRAGMENT &&
4478 2 + pos[1] <= end - pos) {
4479 os_memcpy(tmp_pos, pos + 2, pos[1]);
4480 tmp_pos += pos[1];
4481 pos += 2 + pos[1];
4482 }
4483
4484 fils_process_hlp_resp(sm, tmp, tmp_pos - tmp);
4485 }
4486
4487 os_free(tmp);
4488}
4489
4490
706df429
JM		 4491int fils_process_assoc_resp(struct wpa_sm *sm, const u8 *resp, size_t len)
4492{
4493 const struct ieee80211_mgmt *mgmt;
4494 const u8 *end, *ie_start;
4495 struct ieee802_11_elems elems;
4496 int keylen, rsclen;
4497 enum wpa_alg alg;
4498 struct wpa_gtk_data gd;
4499 int maxkeylen;
4500 struct wpa_eapol_ie_parse kde;
4501
4502 if (!sm || !sm->ptk_set) {
4503 wpa_printf(MSG_DEBUG, "FILS: No KEK available");
4504 return -1;
4505 }
4506
4507 if (!wpa_key_mgmt_fils(sm->key_mgmt)) {
4508 wpa_printf(MSG_DEBUG, "FILS: Not a FILS AKM");
4509 return -1;
4510 }
4511
e7608511
JM		 4512 if (sm->fils_completed) {
4513 wpa_printf(MSG_DEBUG,
4514 "FILS: Association has already been completed for this FILS authentication - ignore unexpected retransmission");
4515 return -1;
4516 }
4517
706df429
JM		 4518 wpa_hexdump(MSG_DEBUG, "FILS: (Re)Association Response frame",
4519 resp, len);
4520
4521 mgmt = (const struct ieee80211_mgmt *) resp;
4522 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.assoc_resp))
4523 return -1;
4524
4525 end = resp + len;
4526 /* Same offset for Association Response and Reassociation Response */
4527 ie_start = mgmt->u.assoc_resp.variable;
4528
4529 if (ieee802_11_parse_elems(ie_start, end - ie_start, &elems, 1) ==
4530 ParseFailed) {
4531 wpa_printf(MSG_DEBUG,
4532 "FILS: Failed to parse decrypted elements");
4533 goto fail;
4534 }
4535
4536 if (!elems.fils_session) {
4537 wpa_printf(MSG_DEBUG, "FILS: No FILS Session element");
4538 return -1;
4539 }
4540 if (os_memcmp(elems.fils_session, sm->fils_session,
4541 FILS_SESSION_LEN) != 0) {
4542 wpa_printf(MSG_DEBUG, "FILS: FILS Session mismatch");
4543 wpa_hexdump(MSG_DEBUG, "FILS: Received FILS Session",
4544 elems.fils_session, FILS_SESSION_LEN);
4545 wpa_hexdump(MSG_DEBUG, "FILS: Expected FILS Session",
4546 sm->fils_session, FILS_SESSION_LEN);
4547 }
4548
69afb6b3
JM		 4549 if (!elems.rsn_ie) {
4550 wpa_printf(MSG_DEBUG,
4551 "FILS: No RSNE in (Re)Association Response");
4552 /* As an interop workaround, allow this for now since IEEE Std
4553 * 802.11ai-2016 did not include all the needed changes to make
4554 * a FILS AP include RSNE in the frame. This workaround might
4555 * eventually be removed and replaced with rejection (goto fail)
4556 * to follow a strict interpretation of the standard. */
4557 } else if (wpa_compare_rsn_ie(wpa_key_mgmt_ft(sm->key_mgmt),
4558 sm->ap_rsn_ie, sm->ap_rsn_ie_len,
4559 elems.rsn_ie - 2, elems.rsn_ie_len + 2)) {
4560 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
4561 "FILS: RSNE mismatch between Beacon/Probe Response and (Re)Association Response");
4562 wpa_hexdump(MSG_DEBUG, "FILS: RSNE in Beacon/Probe Response",
4563 sm->ap_rsn_ie, sm->ap_rsn_ie_len);
4564 wpa_hexdump(MSG_DEBUG, "FILS: RSNE in (Re)Association Response",
4565 elems.rsn_ie, elems.rsn_ie_len);
4566 goto fail;
4567 }
4568
706df429
JM		 4569 /* TODO: FILS Public Key */
4570
4571 if (!elems.fils_key_confirm) {
4572 wpa_printf(MSG_DEBUG, "FILS: No FILS Key Confirm element");
4573 goto fail;
4574 }
4575 if (elems.fils_key_confirm_len != sm->fils_key_auth_len) {
4576 wpa_printf(MSG_DEBUG,
4577 "FILS: Unexpected Key-Auth length %d (expected %d)",
4578 elems.fils_key_confirm_len,
4579 (int) sm->fils_key_auth_len);
4580 goto fail;
4581 }
4582 if (os_memcmp(elems.fils_key_confirm, sm->fils_key_auth_ap,
4583 sm->fils_key_auth_len) != 0) {
4584 wpa_printf(MSG_DEBUG, "FILS: Key-Auth mismatch");
4585 wpa_hexdump(MSG_DEBUG, "FILS: Received Key-Auth",
4586 elems.fils_key_confirm,
4587 elems.fils_key_confirm_len);
4588 wpa_hexdump(MSG_DEBUG, "FILS: Expected Key-Auth",
4589 sm->fils_key_auth_ap, sm->fils_key_auth_len);
4590 goto fail;
4591 }
4592
99621dc1
MV		 4593#ifdef CONFIG_OCV
4594 if (wpa_sm_ocv_enabled(sm)) {
4595 struct wpa_channel_info ci;
4596
4597 if (wpa_sm_channel_info(sm, &ci) != 0) {
4598 wpa_printf(MSG_WARNING,
4599 "Failed to get channel info to validate received OCI in FILS (Re)Association Response frame");
4600 goto fail;
4601 }
4602
4603 if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
4604 channel_width_to_int(ci.chanwidth),
4605 ci.seg1_idx) != 0) {
4606 wpa_printf(MSG_WARNING, "FILS: %s", ocv_errorstr);
4607 goto fail;
4608 }
4609 }
4610#endif /* CONFIG_OCV */
4611
b5e57699
JM		 4612#ifdef CONFIG_IEEE80211R
4613 if (wpa_key_mgmt_ft(sm->key_mgmt) && sm->fils_ft_ies) {
4614 struct wpa_ie_data rsn;
4615
4616 /* Check that PMKR1Name derived by the AP matches */
4617 if (!elems.rsn_ie ||
4618 wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, elems.rsn_ie_len + 2,
4619 &rsn) < 0 ||
4620 !rsn.pmkid || rsn.num_pmkid != 1 ||
4621 os_memcmp(rsn.pmkid, sm->pmk_r1_name,
4622 WPA_PMK_NAME_LEN) != 0) {
4623 wpa_printf(MSG_DEBUG,
4624 "FILS+FT: No RSNE[PMKR1Name] match in AssocResp");
4625 goto fail;
4626 }
4627 }
4628#endif /* CONFIG_IEEE80211R */
4629
706df429
JM		 4630 /* Key Delivery */
4631 if (!elems.key_delivery) {
4632 wpa_printf(MSG_DEBUG, "FILS: No Key Delivery element");
4633 goto fail;
4634 }
4635
4636 /* Parse GTK and set the key to the driver */
4637 os_memset(&gd, 0, sizeof(gd));
4638 if (wpa_supplicant_parse_ies(elems.key_delivery + WPA_KEY_RSC_LEN,
4639 elems.key_delivery_len - WPA_KEY_RSC_LEN,
4640 &kde) < 0) {
4641 wpa_printf(MSG_DEBUG, "FILS: Failed to parse KDEs");
4642 goto fail;
4643 }
4644 if (!kde.gtk) {
4645 wpa_printf(MSG_DEBUG, "FILS: No GTK KDE");
4646 goto fail;
4647 }
4648 maxkeylen = gd.gtk_len = kde.gtk_len - 2;
4649 if (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
4650 gd.gtk_len, maxkeylen,
4651 &gd.key_rsc_len, &gd.alg))
4652 goto fail;
4653
4654 wpa_hexdump_key(MSG_DEBUG, "FILS: Received GTK", kde.gtk, kde.gtk_len);
4655 gd.keyidx = kde.gtk[0] & 0x3;
4656 gd.tx = wpa_supplicant_gtk_tx_bit_workaround(sm,
4657 !!(kde.gtk[0] & BIT(2)));
4658 if (kde.gtk_len - 2 > sizeof(gd.gtk)) {
4659 wpa_printf(MSG_DEBUG, "FILS: Too long GTK in GTK KDE (len=%lu)",
4660 (unsigned long) kde.gtk_len - 2);
4661 goto fail;
4662 }
4663 os_memcpy(gd.gtk, kde.gtk + 2, kde.gtk_len - 2);
4664
4665 wpa_printf(MSG_DEBUG, "FILS: Set GTK to driver");
87e2db16 4666 if (wpa_supplicant_install_gtk(sm, &gd, elems.key_delivery, 0) < 0) {
706df429
JM		 4667 wpa_printf(MSG_DEBUG, "FILS: Failed to set GTK");
4668 goto fail;
4669 }
4670
4671 if (ieee80211w_set_keys(sm, &kde) < 0) {
4672 wpa_printf(MSG_DEBUG, "FILS: Failed to set IGTK");
4673 goto fail;
4674 }
4675
4676 alg = wpa_cipher_to_alg(sm->pairwise_cipher);
4677 keylen = wpa_cipher_key_len(sm->pairwise_cipher);
a6ea6653
JM		 4678 if (keylen <= 0 || (unsigned int) keylen != sm->ptk.tk_len) {
4679 wpa_printf(MSG_DEBUG, "FILS: TK length mismatch: %u != %lu",
4680 keylen, (long unsigned int) sm->ptk.tk_len);
4681 goto fail;
4682 }
706df429
JM		 4683 rsclen = wpa_cipher_rsc_len(sm->pairwise_cipher);
4684 wpa_hexdump_key(MSG_DEBUG, "FILS: Set TK to driver",
4685 sm->ptk.tk, keylen);
4686 if (wpa_sm_set_key(sm, alg, sm->bssid, 0, 1, null_rsc, rsclen,
a919a260 4687 sm->ptk.tk, keylen, KEY_FLAG_PAIRWISE_RX_TX) < 0) {
706df429
JM		 4688 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
4689 "FILS: Failed to set PTK to the driver (alg=%d keylen=%d bssid="
4690 MACSTR ")",
4691 alg, keylen, MAC2STR(sm->bssid));
4692 goto fail;
4693 }
4694
4695 /* TODO: TK could be cleared after auth frame exchange now that driver
4696 * takes care of association frame encryption/decryption. */
4697 /* TK is not needed anymore in supplicant */
4698 os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
a6ea6653 4699 sm->ptk.tk_len = 0;
53bb18cc 4700 sm->ptk.installed = 1;
706df429 4701
124ddfa1
JM		 4702 /* FILS HLP Container */
4703 fils_process_hlp_container(sm, ie_start, end - ie_start);
706df429
JM		 4704
4705 /* TODO: FILS IP Address Assignment */
4706
4707 wpa_printf(MSG_DEBUG, "FILS: Auth+Assoc completed successfully");
4708 sm->fils_completed = 1;
31bc66e4 4709 forced_memzero(&gd, sizeof(gd));
706df429
JM		 4710
4711 return 0;
4712fail:
31bc66e4 4713 forced_memzero(&gd, sizeof(gd));
706df429
JM		 4714 return -1;
4715}
4716
5538fc93
VK		 4717
4718void wpa_sm_set_reset_fils_completed(struct wpa_sm *sm, int set)
4719{
4720 if (sm)
4721 sm->fils_completed = !!set;
4722}
4723
706df429
JM		 4724#endif /* CONFIG_FILS */
4725
4726
4727int wpa_fils_is_completed(struct wpa_sm *sm)
4728{
4729#ifdef CONFIG_FILS
4730 return sm && sm->fils_completed;
4731#else /* CONFIG_FILS */
4732 return 0;
f00b9b88 4733#endif /* CONFIG_FILS */
706df429 4734}
0a614799
JM		 4735
4736
4737#ifdef CONFIG_OWE
4738
ec9f4837 4739struct wpabuf * owe_build_assoc_req(struct wpa_sm *sm, u16 group)
0a614799
JM		 4740{
4741 struct wpabuf *ie = NULL, *pub = NULL;
ec9f4837
JM		 4742 size_t prime_len;
4743
4744 if (group == 19)
4745 prime_len = 32;
4746 else if (group == 20)
4747 prime_len = 48;
4748 else if (group == 21)
4749 prime_len = 66;
4750 else
4751 return NULL;
0a614799
JM		 4752
4753 crypto_ecdh_deinit(sm->owe_ecdh);
ec9f4837 4754 sm->owe_ecdh = crypto_ecdh_init(group);
0a614799
JM		 4755 if (!sm->owe_ecdh)
4756 goto fail;
ec9f4837 4757 sm->owe_group = group;
0a614799 4758 pub = crypto_ecdh_get_pubkey(sm->owe_ecdh, 0);
ec9f4837 4759 pub = wpabuf_zeropad(pub, prime_len);
0a614799
JM		 4760 if (!pub)
4761 goto fail;
4762
4763 ie = wpabuf_alloc(5 + wpabuf_len(pub));
4764 if (!ie)
4765 goto fail;
4766 wpabuf_put_u8(ie, WLAN_EID_EXTENSION);
4767 wpabuf_put_u8(ie, 1 + 2 + wpabuf_len(pub));
4768 wpabuf_put_u8(ie, WLAN_EID_EXT_OWE_DH_PARAM);
ec9f4837 4769 wpabuf_put_le16(ie, group);
0a614799
JM		 4770 wpabuf_put_buf(ie, pub);
4771 wpabuf_free(pub);
4772 wpa_hexdump_buf(MSG_DEBUG, "OWE: Diffie-Hellman Parameter element",
4773 ie);
4774
4775 return ie;
4776fail:
4777 wpabuf_free(pub);
4778 crypto_ecdh_deinit(sm->owe_ecdh);
4779 sm->owe_ecdh = NULL;
4780 return NULL;
4781}
4782
4783
5a78c361
JM		 4784int owe_process_assoc_resp(struct wpa_sm *sm, const u8 *bssid,
4785 const u8 *resp_ies, size_t resp_ies_len)
0a614799
JM		 4786{
4787 struct ieee802_11_elems elems;
4788 u16 group;
4789 struct wpabuf *secret, *pub, *hkey;
4790 int res;
ec9f4837 4791 u8 prk[SHA512_MAC_LEN], pmkid[SHA512_MAC_LEN];
0a614799
JM		 4792 const char *info = "OWE Key Generation";
4793 const u8 *addr[2];
4794 size_t len[2];
ec9f4837 4795 size_t hash_len, prime_len;
5a78c361 4796 struct wpa_ie_data data;
0a614799
JM		 4797
4798 if (!resp_ies ||
4799 ieee802_11_parse_elems(resp_ies, resp_ies_len, &elems, 1) ==
5a78c361
JM		 4800 ParseFailed) {
4801 wpa_printf(MSG_INFO,
4802 "OWE: Could not parse Association Response frame elements");
4803 return -1;
4804 }
4805
4806 if (sm->cur_pmksa && elems.rsn_ie &&
4807 wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, 2 + elems.rsn_ie_len,
4808 &data) == 0 &&
4809 data.num_pmkid == 1 && data.pmkid &&
4810 os_memcmp(sm->cur_pmksa->pmkid, data.pmkid, PMKID_LEN) == 0) {
4811 wpa_printf(MSG_DEBUG, "OWE: Use PMKSA caching");
4812 wpa_sm_set_pmk_from_pmksa(sm);
4813 return 0;
4814 }
4815
4816 if (!elems.owe_dh) {
0a614799
JM		 4817 wpa_printf(MSG_INFO,
4818 "OWE: No Diffie-Hellman Parameter element found in Association Response frame");
4819 return -1;
4820 }
4821
4822 group = WPA_GET_LE16(elems.owe_dh);
ec9f4837 4823 if (group != sm->owe_group) {
0a614799
JM		 4824 wpa_printf(MSG_INFO,
4825 "OWE: Unexpected Diffie-Hellman group in response: %u",
4826 group);
4827 return -1;
4828 }
4829
4830 if (!sm->owe_ecdh) {
4831 wpa_printf(MSG_INFO, "OWE: No ECDH state available");
4832 return -1;
4833 }
4834
ec9f4837
JM		 4835 if (group == 19)
4836 prime_len = 32;
4837 else if (group == 20)
4838 prime_len = 48;
4839 else if (group == 21)
4840 prime_len = 66;
4841 else
4842 return -1;
4843
0a614799
JM		 4844 secret = crypto_ecdh_set_peerkey(sm->owe_ecdh, 0,
4845 elems.owe_dh + 2,
4846 elems.owe_dh_len - 2);
ec9f4837 4847 secret = wpabuf_zeropad(secret, prime_len);
0a614799
JM		 4848 if (!secret) {
4849 wpa_printf(MSG_DEBUG, "OWE: Invalid peer DH public key");
4850 return -1;
4851 }
4852 wpa_hexdump_buf_key(MSG_DEBUG, "OWE: DH shared secret", secret);
4853
4854 /* prk = HKDF-extract(C | A | group, z) */
4855
4856 pub = crypto_ecdh_get_pubkey(sm->owe_ecdh, 0);
4857 if (!pub) {
4858 wpabuf_clear_free(secret);
4859 return -1;
4860 }
4861
4862 /* PMKID = Truncate-128(Hash(C | A)) */
4863 addr[0] = wpabuf_head(pub);
4864 len[0] = wpabuf_len(pub);
4865 addr[1] = elems.owe_dh + 2;
4866 len[1] = elems.owe_dh_len - 2;
ec9f4837
JM		 4867 if (group == 19) {
4868 res = sha256_vector(2, addr, len, pmkid);
4869 hash_len = SHA256_MAC_LEN;
4870 } else if (group == 20) {
4871 res = sha384_vector(2, addr, len, pmkid);
4872 hash_len = SHA384_MAC_LEN;
4873 } else if (group == 21) {
4874 res = sha512_vector(2, addr, len, pmkid);
4875 hash_len = SHA512_MAC_LEN;
4876 } else {
4877 res = -1;
4878 hash_len = 0;
4879 }
4880 pub = wpabuf_zeropad(pub, prime_len);
4881 if (res < 0 || !pub) {
0a614799
JM		 4882 wpabuf_free(pub);
4883 wpabuf_clear_free(secret);
4884 return -1;
4885 }
4886
4887 hkey = wpabuf_alloc(wpabuf_len(pub) + elems.owe_dh_len - 2 + 2);
4888 if (!hkey) {
4889 wpabuf_free(pub);
4890 wpabuf_clear_free(secret);
4891 return -1;
4892 }
4893
4894 wpabuf_put_buf(hkey, pub); /* C */
4895 wpabuf_free(pub);
4896 wpabuf_put_data(hkey, elems.owe_dh + 2, elems.owe_dh_len - 2); /* A */
ec9f4837
JM		 4897 wpabuf_put_le16(hkey, sm->owe_group); /* group */
4898 if (group == 19)
4899 res = hmac_sha256(wpabuf_head(hkey), wpabuf_len(hkey),
4900 wpabuf_head(secret), wpabuf_len(secret), prk);
4901 else if (group == 20)
4902 res = hmac_sha384(wpabuf_head(hkey), wpabuf_len(hkey),
4903 wpabuf_head(secret), wpabuf_len(secret), prk);
4904 else if (group == 21)
4905 res = hmac_sha512(wpabuf_head(hkey), wpabuf_len(hkey),
4906 wpabuf_head(secret), wpabuf_len(secret), prk);
0a614799
JM		 4907 wpabuf_clear_free(hkey);
4908 wpabuf_clear_free(secret);
4909 if (res < 0)
4910 return -1;
4911
ec9f4837 4912 wpa_hexdump_key(MSG_DEBUG, "OWE: prk", prk, hash_len);
0a614799
JM		 4913
4914 /* PMK = HKDF-expand(prk, "OWE Key Generation", n) */
4915
ec9f4837
JM		 4916 if (group == 19)
4917 res = hmac_sha256_kdf(prk, hash_len, NULL, (const u8 *) info,
4918 os_strlen(info), sm->pmk, hash_len);
4919 else if (group == 20)
4920 res = hmac_sha384_kdf(prk, hash_len, NULL, (const u8 *) info,
4921 os_strlen(info), sm->pmk, hash_len);
4922 else if (group == 21)
4923 res = hmac_sha512_kdf(prk, hash_len, NULL, (const u8 *) info,
4924 os_strlen(info), sm->pmk, hash_len);
31bc66e4 4925 forced_memzero(prk, SHA512_MAC_LEN);
1bd13110
JM		 4926 if (res < 0) {
4927 sm->pmk_len = 0;
0a614799 4928 return -1;
1bd13110 4929 }
ec9f4837 4930 sm->pmk_len = hash_len;
0a614799 4931
ec9f4837 4932 wpa_hexdump_key(MSG_DEBUG, "OWE: PMK", sm->pmk, sm->pmk_len);
0a614799 4933 wpa_hexdump(MSG_DEBUG, "OWE: PMKID", pmkid, PMKID_LEN);
5a78c361
JM		 4934 pmksa_cache_add(sm->pmksa, sm->pmk, sm->pmk_len, pmkid, NULL, 0,
4935 bssid, sm->own_addr, sm->network_ctx, sm->key_mgmt,
4936 NULL);
0a614799
JM		 4937
4938 return 0;
4939}
4940
4941#endif /* CONFIG_OWE */
bbe7969d
VK		 4942
4943
4944void wpa_sm_set_fils_cache_id(struct wpa_sm *sm, const u8 *fils_cache_id)
4945{
4946#ifdef CONFIG_FILS
4947 if (sm && fils_cache_id) {
4948 sm->fils_cache_id_set = 1;
4949 os_memcpy(sm->fils_cache_id, fils_cache_id, FILS_CACHE_ID_LEN);
4950 }
4951#endif /* CONFIG_FILS */
4952}
10ec6a5f
JM		 4953
4954
4955#ifdef CONFIG_DPP2
4956void wpa_sm_set_dpp_z(struct wpa_sm *sm, const struct wpabuf *z)
4957{
4958 if (sm) {
4959 wpabuf_clear_free(sm->dpp_z);
4960 sm->dpp_z = z ? wpabuf_dup(z) : NULL;
4961 }
4962}
4963#endif /* CONFIG_DPP2 */
Unnamed repository; edit this file 'description' to name the repository.