src/ap/wpa_auth_ie.c

   1 /*
   2  * hostapd - WPA/RSN IE and KDE definitions
   3  * Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #include "utils/common.h"
  12 #include "common/ieee802_11_defs.h"
  13 #include "eapol_auth/eapol_auth_sm.h"
  14 #include "ap_config.h"
  15 #include "ieee802_11.h"
  16 #include "wpa_auth.h"
  17 #include "pmksa_cache_auth.h"
  18 #include "wpa_auth_ie.h"
  19 #include "wpa_auth_i.h"
  20
  21
  22 #ifdef CONFIG_RSN_TESTING
  23 int rsn_testing = 0;
  24 #endif /* CONFIG_RSN_TESTING */
  25
  26
  27 static int wpa_write_wpa_ie(struct wpa_auth_config *conf, u8 *buf, size_t len)
  28 {
  29         struct wpa_ie_hdr *hdr;
  30         int num_suites;
  31         u8 *pos, *count;
  32         u32 suite;
  33
  34         hdr = (struct wpa_ie_hdr *) buf;
  35         hdr->elem_id = WLAN_EID_VENDOR_SPECIFIC;
  36         RSN_SELECTOR_PUT(hdr->oui, WPA_OUI_TYPE);
  37         WPA_PUT_LE16(hdr->version, WPA_VERSION);
  38         pos = (u8 *) (hdr + 1);
  39
  40         suite = wpa_cipher_to_suite(WPA_PROTO_WPA, conf->wpa_group);
  41         if (suite == 0) {
  42                 wpa_printf(MSG_DEBUG, "Invalid group cipher (%d).",
  43                            conf->wpa_group);
  44                 return -1;
  45         }
  46         RSN_SELECTOR_PUT(pos, suite);
  47         pos += WPA_SELECTOR_LEN;
  48
  49         count = pos;
  50         pos += 2;
  51
  52         num_suites = wpa_cipher_put_suites(pos, conf->wpa_pairwise);
  53         if (num_suites == 0) {
  54                 wpa_printf(MSG_DEBUG, "Invalid pairwise cipher (%d).",
  55                            conf->wpa_pairwise);
  56                 return -1;
  57         }
  58         pos += num_suites * WPA_SELECTOR_LEN;
  59         WPA_PUT_LE16(count, num_suites);
  60
  61         num_suites = 0;
  62         count = pos;
  63         pos += 2;
  64
  65         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) {
  66                 RSN_SELECTOR_PUT(pos, WPA_AUTH_KEY_MGMT_UNSPEC_802_1X);
  67                 pos += WPA_SELECTOR_LEN;
  68                 num_suites++;
  69         }
  70         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) {
  71                 RSN_SELECTOR_PUT(pos, WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X);
  72                 pos += WPA_SELECTOR_LEN;
  73                 num_suites++;
  74         }
  75
  76         if (num_suites == 0) {
  77                 wpa_printf(MSG_DEBUG, "Invalid key management type (%d).",
  78                            conf->wpa_key_mgmt);
  79                 return -1;
  80         }
  81         WPA_PUT_LE16(count, num_suites);
  82
  83         /* WPA Capabilities; use defaults, so no need to include it */
  84
  85         hdr->len = (pos - buf) - 2;
  86
  87         return pos - buf;
  88 }
  89
  90
  91 int wpa_write_rsn_ie(struct wpa_auth_config *conf, u8 *buf, size_t len,
  92                      const u8 *pmkid)
  93 {
  94         struct rsn_ie_hdr *hdr;
  95         int num_suites, res;
  96         u8 *pos, *count;
  97         u16 capab;
  98         u32 suite;
  99
 100         hdr = (struct rsn_ie_hdr *) buf;
 101         hdr->elem_id = WLAN_EID_RSN;
 102         WPA_PUT_LE16(hdr->version, RSN_VERSION);
 103         pos = (u8 *) (hdr + 1);
 104
 105         suite = wpa_cipher_to_suite(WPA_PROTO_RSN, conf->wpa_group);
 106         if (suite == 0) {
 107                 wpa_printf(MSG_DEBUG, "Invalid group cipher (%d).",
 108                            conf->wpa_group);
 109                 return -1;
 110         }
 111         RSN_SELECTOR_PUT(pos, suite);
 112         pos += RSN_SELECTOR_LEN;
 113
 114         num_suites = 0;
 115         count = pos;
 116         pos += 2;
 117
 118 #ifdef CONFIG_RSN_TESTING
 119         if (rsn_testing) {
 120                 RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 1));
 121                 pos += RSN_SELECTOR_LEN;
 122                 num_suites++;
 123         }
 124 #endif /* CONFIG_RSN_TESTING */
 125
 126         res = rsn_cipher_put_suites(pos, conf->rsn_pairwise);
 127         num_suites += res;
 128         pos += res * RSN_SELECTOR_LEN;
 129
 130 #ifdef CONFIG_RSN_TESTING
 131         if (rsn_testing) {
 132                 RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 2));
 133                 pos += RSN_SELECTOR_LEN;
 134                 num_suites++;
 135         }
 136 #endif /* CONFIG_RSN_TESTING */
 137
 138         if (num_suites == 0) {
 139                 wpa_printf(MSG_DEBUG, "Invalid pairwise cipher (%d).",
 140                            conf->rsn_pairwise);
 141                 return -1;
 142         }
 143         WPA_PUT_LE16(count, num_suites);
 144
 145         num_suites = 0;
 146         count = pos;
 147         pos += 2;
 148
 149 #ifdef CONFIG_RSN_TESTING
 150         if (rsn_testing) {
 151                 RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 1));
 152                 pos += RSN_SELECTOR_LEN;
 153                 num_suites++;
 154         }
 155 #endif /* CONFIG_RSN_TESTING */
 156
 157         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) {
 158                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_UNSPEC_802_1X);
 159                 pos += RSN_SELECTOR_LEN;
 160                 num_suites++;
 161         }
 162         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) {
 163                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X);
 164                 pos += RSN_SELECTOR_LEN;
 165                 num_suites++;
 166         }
 167 #ifdef CONFIG_IEEE80211R
 168         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) {
 169                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_802_1X);
 170                 pos += RSN_SELECTOR_LEN;
 171                 num_suites++;
 172         }
 173         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_PSK) {
 174                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_PSK);
 175                 pos += RSN_SELECTOR_LEN;
 176                 num_suites++;
 177         }
 178 #endif /* CONFIG_IEEE80211R */
 179 #ifdef CONFIG_IEEE80211W
 180         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) {
 181                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SHA256);
 182                 pos += RSN_SELECTOR_LEN;
 183                 num_suites++;
 184         }
 185         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK_SHA256) {
 186                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PSK_SHA256);
 187                 pos += RSN_SELECTOR_LEN;
 188                 num_suites++;
 189         }
 190 #endif /* CONFIG_IEEE80211W */
 191 #ifdef CONFIG_SAE
 192         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_SAE) {
 193                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_SAE);
 194                 pos += RSN_SELECTOR_LEN;
 195                 num_suites++;
 196         }
 197         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_SAE) {
 198                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_SAE);
 199                 pos += RSN_SELECTOR_LEN;
 200                 num_suites++;
 201         }
 202 #endif /* CONFIG_SAE */
 203         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
 204                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SUITE_B);
 205                 pos += RSN_SELECTOR_LEN;
 206                 num_suites++;
 207         }
 208         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
 209                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192);
 210                 pos += RSN_SELECTOR_LEN;
 211                 num_suites++;
 212         }
 213
 214 #ifdef CONFIG_RSN_TESTING
 215         if (rsn_testing) {
 216                 RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 2));
 217                 pos += RSN_SELECTOR_LEN;
 218                 num_suites++;
 219         }
 220 #endif /* CONFIG_RSN_TESTING */
 221
 222         if (num_suites == 0) {
 223                 wpa_printf(MSG_DEBUG, "Invalid key management type (%d).",
 224                            conf->wpa_key_mgmt);
 225                 return -1;
 226         }
 227         WPA_PUT_LE16(count, num_suites);
 228
 229         /* RSN Capabilities */
 230         capab = 0;
 231         if (conf->rsn_preauth)
 232                 capab |= WPA_CAPABILITY_PREAUTH;
 233         if (conf->peerkey)
 234                 capab |= WPA_CAPABILITY_PEERKEY_ENABLED;
 235         if (conf->wmm_enabled) {
 236                 /* 4 PTKSA replay counters when using WMM */
 237                 capab |= (RSN_NUM_REPLAY_COUNTERS_16 << 2);
 238         }
 239 #ifdef CONFIG_IEEE80211W
 240         if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) {
 241                 capab |= WPA_CAPABILITY_MFPC;
 242                 if (conf->ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED)
 243                         capab |= WPA_CAPABILITY_MFPR;
 244         }
 245 #endif /* CONFIG_IEEE80211W */
 246 #ifdef CONFIG_RSN_TESTING
 247         if (rsn_testing)
 248                 capab |= BIT(8) | BIT(14) | BIT(15);
 249 #endif /* CONFIG_RSN_TESTING */
 250         WPA_PUT_LE16(pos, capab);
 251         pos += 2;
 252
 253         if (pmkid) {
 254                 if (pos + 2 + PMKID_LEN > buf + len)
 255                         return -1;
 256                 /* PMKID Count */
 257                 WPA_PUT_LE16(pos, 1);
 258                 pos += 2;
 259                 os_memcpy(pos, pmkid, PMKID_LEN);
 260                 pos += PMKID_LEN;
 261         }
 262
 263 #ifdef CONFIG_IEEE80211W
 264         if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) {
 265                 if (pos + 2 + 4 > buf + len)
 266                         return -1;
 267                 if (pmkid == NULL) {
 268                         /* PMKID Count */
 269                         WPA_PUT_LE16(pos, 0);
 270                         pos += 2;
 271                 }
 272
 273                 /* Management Group Cipher Suite */
 274                 switch (conf->group_mgmt_cipher) {
 275                 case WPA_CIPHER_AES_128_CMAC:
 276                         RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC);
 277                         break;
 278                 case WPA_CIPHER_BIP_GMAC_128:
 279                         RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_BIP_GMAC_128);
 280                         break;
 281                 case WPA_CIPHER_BIP_GMAC_256:
 282                         RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_BIP_GMAC_256);
 283                         break;
 284                 case WPA_CIPHER_BIP_CMAC_256:
 285                         RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_BIP_CMAC_256);
 286                         break;
 287                 default:
 288                         wpa_printf(MSG_DEBUG,
 289                                    "Invalid group management cipher (0x%x)",
 290                                    conf->group_mgmt_cipher);
 291                         return -1;
 292                 }
 293                 pos += RSN_SELECTOR_LEN;
 294         }
 295 #endif /* CONFIG_IEEE80211W */
 296
 297 #ifdef CONFIG_RSN_TESTING
 298         if (rsn_testing) {
 299                 /*
 300                  * Fill in any defined fields and add extra data to the end of
 301                  * the element.
 302                  */
 303                 int pmkid_count_set = pmkid != NULL;
 304                 if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION)
 305                         pmkid_count_set = 1;
 306                 /* PMKID Count */
 307                 WPA_PUT_LE16(pos, 0);
 308                 pos += 2;
 309                 if (conf->ieee80211w == NO_MGMT_FRAME_PROTECTION) {
 310                         /* Management Group Cipher Suite */
 311                         RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC);
 312                         pos += RSN_SELECTOR_LEN;
 313                 }
 314
 315                 os_memset(pos, 0x12, 17);
 316                 pos += 17;
 317         }
 318 #endif /* CONFIG_RSN_TESTING */
 319
 320         hdr->len = (pos - buf) - 2;
 321
 322         return pos - buf;
 323 }
 324
 325
 326 static u8 * wpa_write_osen(struct wpa_auth_config *conf, u8 *eid)
 327 {
 328         u8 *len;
 329         u16 capab;
 330
 331         *eid++ = WLAN_EID_VENDOR_SPECIFIC;
 332         len = eid++; /* to be filled */
 333         WPA_PUT_BE24(eid, OUI_WFA);
 334         eid += 3;
 335         *eid++ = HS20_OSEN_OUI_TYPE;
 336
 337         /* Group Data Cipher Suite */
 338         RSN_SELECTOR_PUT(eid, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
 339         eid += RSN_SELECTOR_LEN;
 340
 341         /* Pairwise Cipher Suite Count and List */
 342         WPA_PUT_LE16(eid, 1);
 343         eid += 2;
 344         RSN_SELECTOR_PUT(eid, RSN_CIPHER_SUITE_CCMP);
 345         eid += RSN_SELECTOR_LEN;
 346
 347         /* AKM Suite Count and List */
 348         WPA_PUT_LE16(eid, 1);
 349         eid += 2;
 350         RSN_SELECTOR_PUT(eid, RSN_AUTH_KEY_MGMT_OSEN);
 351         eid += RSN_SELECTOR_LEN;
 352
 353         /* RSN Capabilities */
 354         capab = 0;
 355         if (conf->wmm_enabled) {
 356                 /* 4 PTKSA replay counters when using WMM */
 357                 capab |= (RSN_NUM_REPLAY_COUNTERS_16 << 2);
 358         }
 359 #ifdef CONFIG_IEEE80211W
 360         if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) {
 361                 capab |= WPA_CAPABILITY_MFPC;
 362                 if (conf->ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED)
 363                         capab |= WPA_CAPABILITY_MFPR;
 364         }
 365 #endif /* CONFIG_IEEE80211W */
 366         WPA_PUT_LE16(eid, capab);
 367         eid += 2;
 368
 369         *len = eid - len - 1;
 370
 371         return eid;
 372 }
 373
 374
 375 int wpa_auth_gen_wpa_ie(struct wpa_authenticator *wpa_auth)
 376 {
 377         u8 *pos, buf[128];
 378         int res;
 379
 380         pos = buf;
 381
 382         if (wpa_auth->conf.wpa == WPA_PROTO_OSEN) {
 383                 pos = wpa_write_osen(&wpa_auth->conf, pos);
 384         }
 385         if (wpa_auth->conf.wpa & WPA_PROTO_RSN) {
 386                 res = wpa_write_rsn_ie(&wpa_auth->conf,
 387                                        pos, buf + sizeof(buf) - pos, NULL);
 388                 if (res < 0)
 389                         return res;
 390                 pos += res;
 391         }
 392 #ifdef CONFIG_IEEE80211R
 393         if (wpa_key_mgmt_ft(wpa_auth->conf.wpa_key_mgmt)) {
 394                 res = wpa_write_mdie(&wpa_auth->conf, pos,
 395                                      buf + sizeof(buf) - pos);
 396                 if (res < 0)
 397                         return res;
 398                 pos += res;
 399         }
 400 #endif /* CONFIG_IEEE80211R */
 401         if (wpa_auth->conf.wpa & WPA_PROTO_WPA) {
 402                 res = wpa_write_wpa_ie(&wpa_auth->conf,
 403                                        pos, buf + sizeof(buf) - pos);
 404                 if (res < 0)
 405                         return res;
 406                 pos += res;
 407         }
 408
 409         os_free(wpa_auth->wpa_ie);
 410         wpa_auth->wpa_ie = os_malloc(pos - buf);
 411         if (wpa_auth->wpa_ie == NULL)
 412                 return -1;
 413         os_memcpy(wpa_auth->wpa_ie, buf, pos - buf);
 414         wpa_auth->wpa_ie_len = pos - buf;
 415
 416         return 0;
 417 }
 418
 419
 420 u8 * wpa_add_kde(u8 *pos, u32 kde, const u8 *data, size_t data_len,
 421                  const u8 *data2, size_t data2_len)
 422 {
 423         *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 424         *pos++ = RSN_SELECTOR_LEN + data_len + data2_len;
 425         RSN_SELECTOR_PUT(pos, kde);
 426         pos += RSN_SELECTOR_LEN;
 427         os_memcpy(pos, data, data_len);
 428         pos += data_len;
 429         if (data2) {
 430                 os_memcpy(pos, data2, data2_len);
 431                 pos += data2_len;
 432         }
 433         return pos;
 434 }
 435
 436
 437 struct wpa_auth_okc_iter_data {
 438         struct rsn_pmksa_cache_entry *pmksa;
 439         const u8 *aa;
 440         const u8 *spa;
 441         const u8 *pmkid;
 442 };
 443
 444
 445 static int wpa_auth_okc_iter(struct wpa_authenticator *a, void *ctx)
 446 {
 447         struct wpa_auth_okc_iter_data *data = ctx;
 448         data->pmksa = pmksa_cache_get_okc(a->pmksa, data->aa, data->spa,
 449                                           data->pmkid);
 450         if (data->pmksa)
 451                 return 1;
 452         return 0;
 453 }
 454
 455
 456 int wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth,
 457                         struct wpa_state_machine *sm,
 458                         const u8 *wpa_ie, size_t wpa_ie_len,
 459                         const u8 *mdie, size_t mdie_len)
 460 {
 461         struct wpa_ie_data data;
 462         int ciphers, key_mgmt, res, version;
 463         u32 selector;
 464         size_t i;
 465         const u8 *pmkid = NULL;
 466
 467         if (wpa_auth == NULL || sm == NULL)
 468                 return WPA_NOT_ENABLED;
 469
 470         if (wpa_ie == NULL || wpa_ie_len < 1)
 471                 return WPA_INVALID_IE;
 472
 473         if (wpa_ie[0] == WLAN_EID_RSN)
 474                 version = WPA_PROTO_RSN;
 475         else
 476                 version = WPA_PROTO_WPA;
 477
 478         if (!(wpa_auth->conf.wpa & version)) {
 479                 wpa_printf(MSG_DEBUG, "Invalid WPA proto (%d) from " MACSTR,
 480                            version, MAC2STR(sm->addr));
 481                 return WPA_INVALID_PROTO;
 482         }
 483
 484         if (version == WPA_PROTO_RSN) {
 485                 res = wpa_parse_wpa_ie_rsn(wpa_ie, wpa_ie_len, &data);
 486
 487                 selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X;
 488                 if (0) {
 489                 }
 490                 else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
 491                         selector = RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192;
 492                 else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B)
 493                         selector = RSN_AUTH_KEY_MGMT_802_1X_SUITE_B;
 494 #ifdef CONFIG_IEEE80211R
 495                 else if (data.key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X)
 496                         selector = RSN_AUTH_KEY_MGMT_FT_802_1X;
 497                 else if (data.key_mgmt & WPA_KEY_MGMT_FT_PSK)
 498                         selector = RSN_AUTH_KEY_MGMT_FT_PSK;
 499 #endif /* CONFIG_IEEE80211R */
 500 #ifdef CONFIG_IEEE80211W
 501                 else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256)
 502                         selector = RSN_AUTH_KEY_MGMT_802_1X_SHA256;
 503                 else if (data.key_mgmt & WPA_KEY_MGMT_PSK_SHA256)
 504                         selector = RSN_AUTH_KEY_MGMT_PSK_SHA256;
 505 #endif /* CONFIG_IEEE80211W */
 506 #ifdef CONFIG_SAE
 507                 else if (data.key_mgmt & WPA_KEY_MGMT_SAE)
 508                         selector = RSN_AUTH_KEY_MGMT_SAE;
 509                 else if (data.key_mgmt & WPA_KEY_MGMT_FT_SAE)
 510                         selector = RSN_AUTH_KEY_MGMT_FT_SAE;
 511 #endif /* CONFIG_SAE */
 512                 else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X)
 513                         selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X;
 514                 else if (data.key_mgmt & WPA_KEY_MGMT_PSK)
 515                         selector = RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X;
 516                 wpa_auth->dot11RSNAAuthenticationSuiteSelected = selector;
 517
 518                 selector = wpa_cipher_to_suite(WPA_PROTO_RSN,
 519                                                data.pairwise_cipher);
 520                 if (!selector)
 521                         selector = RSN_CIPHER_SUITE_CCMP;
 522                 wpa_auth->dot11RSNAPairwiseCipherSelected = selector;
 523
 524                 selector = wpa_cipher_to_suite(WPA_PROTO_RSN,
 525                                                data.group_cipher);
 526                 if (!selector)
 527                         selector = RSN_CIPHER_SUITE_CCMP;
 528                 wpa_auth->dot11RSNAGroupCipherSelected = selector;
 529         } else {
 530                 res = wpa_parse_wpa_ie_wpa(wpa_ie, wpa_ie_len, &data);
 531
 532                 selector = WPA_AUTH_KEY_MGMT_UNSPEC_802_1X;
 533                 if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X)
 534                         selector = WPA_AUTH_KEY_MGMT_UNSPEC_802_1X;
 535                 else if (data.key_mgmt & WPA_KEY_MGMT_PSK)
 536                         selector = WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X;
 537                 wpa_auth->dot11RSNAAuthenticationSuiteSelected = selector;
 538
 539                 selector = wpa_cipher_to_suite(WPA_PROTO_WPA,
 540                                                data.pairwise_cipher);
 541                 if (!selector)
 542                         selector = RSN_CIPHER_SUITE_TKIP;
 543                 wpa_auth->dot11RSNAPairwiseCipherSelected = selector;
 544
 545                 selector = wpa_cipher_to_suite(WPA_PROTO_WPA,
 546                                                data.group_cipher);
 547                 if (!selector)
 548                         selector = WPA_CIPHER_SUITE_TKIP;
 549                 wpa_auth->dot11RSNAGroupCipherSelected = selector;
 550         }
 551         if (res) {
 552                 wpa_printf(MSG_DEBUG, "Failed to parse WPA/RSN IE from "
 553                            MACSTR " (res=%d)", MAC2STR(sm->addr), res);
 554                 wpa_hexdump(MSG_DEBUG, "WPA/RSN IE", wpa_ie, wpa_ie_len);
 555                 return WPA_INVALID_IE;
 556         }
 557
 558         if (data.group_cipher != wpa_auth->conf.wpa_group) {
 559                 wpa_printf(MSG_DEBUG, "Invalid WPA group cipher (0x%x) from "
 560                            MACSTR, data.group_cipher, MAC2STR(sm->addr));
 561                 return WPA_INVALID_GROUP;
 562         }
 563
 564         key_mgmt = data.key_mgmt & wpa_auth->conf.wpa_key_mgmt;
 565         if (!key_mgmt) {
 566                 wpa_printf(MSG_DEBUG, "Invalid WPA key mgmt (0x%x) from "
 567                            MACSTR, data.key_mgmt, MAC2STR(sm->addr));
 568                 return WPA_INVALID_AKMP;
 569         }
 570         if (0) {
 571         }
 572         else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
 573                 sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
 574         else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B)
 575                 sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
 576 #ifdef CONFIG_IEEE80211R
 577         else if (key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X)
 578                 sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
 579         else if (key_mgmt & WPA_KEY_MGMT_FT_PSK)
 580                 sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_PSK;
 581 #endif /* CONFIG_IEEE80211R */
 582 #ifdef CONFIG_IEEE80211W
 583         else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256)
 584                 sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
 585         else if (key_mgmt & WPA_KEY_MGMT_PSK_SHA256)
 586                 sm->wpa_key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
 587 #endif /* CONFIG_IEEE80211W */
 588 #ifdef CONFIG_SAE
 589         else if (key_mgmt & WPA_KEY_MGMT_SAE)
 590                 sm->wpa_key_mgmt = WPA_KEY_MGMT_SAE;
 591         else if (key_mgmt & WPA_KEY_MGMT_FT_SAE)
 592                 sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_SAE;
 593 #endif /* CONFIG_SAE */
 594         else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X)
 595                 sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X;
 596         else
 597                 sm->wpa_key_mgmt = WPA_KEY_MGMT_PSK;
 598
 599         if (version == WPA_PROTO_RSN)
 600                 ciphers = data.pairwise_cipher & wpa_auth->conf.rsn_pairwise;
 601         else
 602                 ciphers = data.pairwise_cipher & wpa_auth->conf.wpa_pairwise;
 603         if (!ciphers) {
 604                 wpa_printf(MSG_DEBUG, "Invalid %s pairwise cipher (0x%x) "
 605                            "from " MACSTR,
 606                            version == WPA_PROTO_RSN ? "RSN" : "WPA",
 607                            data.pairwise_cipher, MAC2STR(sm->addr));
 608                 return WPA_INVALID_PAIRWISE;
 609         }
 610
 611 #ifdef CONFIG_IEEE80211W
 612         if (wpa_auth->conf.ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED) {
 613                 if (!(data.capabilities & WPA_CAPABILITY_MFPC)) {
 614                         wpa_printf(MSG_DEBUG, "Management frame protection "
 615                                    "required, but client did not enable it");
 616                         return WPA_MGMT_FRAME_PROTECTION_VIOLATION;
 617                 }
 618
 619                 if (ciphers & WPA_CIPHER_TKIP) {
 620                         wpa_printf(MSG_DEBUG, "Management frame protection "
 621                                    "cannot use TKIP");
 622                         return WPA_MGMT_FRAME_PROTECTION_VIOLATION;
 623                 }
 624
 625                 if (data.mgmt_group_cipher != wpa_auth->conf.group_mgmt_cipher)
 626                 {
 627                         wpa_printf(MSG_DEBUG, "Unsupported management group "
 628                                    "cipher %d", data.mgmt_group_cipher);
 629                         return WPA_INVALID_MGMT_GROUP_CIPHER;
 630                 }
 631         }
 632
 633         if (wpa_auth->conf.ieee80211w == NO_MGMT_FRAME_PROTECTION ||
 634             !(data.capabilities & WPA_CAPABILITY_MFPC))
 635                 sm->mgmt_frame_prot = 0;
 636         else
 637                 sm->mgmt_frame_prot = 1;
 638 #endif /* CONFIG_IEEE80211W */
 639
 640 #ifdef CONFIG_IEEE80211R
 641         if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) {
 642                 if (mdie == NULL || mdie_len < MOBILITY_DOMAIN_ID_LEN + 1) {
 643                         wpa_printf(MSG_DEBUG, "RSN: Trying to use FT, but "
 644                                    "MDIE not included");
 645                         return WPA_INVALID_MDIE;
 646                 }
 647                 if (os_memcmp(mdie, wpa_auth->conf.mobility_domain,
 648                               MOBILITY_DOMAIN_ID_LEN) != 0) {
 649                         wpa_hexdump(MSG_DEBUG, "RSN: Attempted to use unknown "
 650                                     "MDIE", mdie, MOBILITY_DOMAIN_ID_LEN);
 651                         return WPA_INVALID_MDIE;
 652                 }
 653         }
 654 #endif /* CONFIG_IEEE80211R */
 655
 656         sm->pairwise = wpa_pick_pairwise_cipher(ciphers, 0);
 657         if (sm->pairwise < 0)
 658                 return WPA_INVALID_PAIRWISE;
 659
 660         /* TODO: clear WPA/WPA2 state if STA changes from one to another */
 661         if (wpa_ie[0] == WLAN_EID_RSN)
 662                 sm->wpa = WPA_VERSION_WPA2;
 663         else
 664                 sm->wpa = WPA_VERSION_WPA;
 665
 666         sm->pmksa = NULL;
 667         for (i = 0; i < data.num_pmkid; i++) {
 668                 wpa_hexdump(MSG_DEBUG, "RSN IE: STA PMKID",
 669                             &data.pmkid[i * PMKID_LEN], PMKID_LEN);
 670                 sm->pmksa = pmksa_cache_auth_get(wpa_auth->pmksa, sm->addr,
 671                                                  &data.pmkid[i * PMKID_LEN]);
 672                 if (sm->pmksa) {
 673                         pmkid = sm->pmksa->pmkid;
 674                         break;
 675                 }
 676         }
 677         for (i = 0; sm->pmksa == NULL && wpa_auth->conf.okc &&
 678                      i < data.num_pmkid; i++) {
 679                 struct wpa_auth_okc_iter_data idata;
 680                 idata.pmksa = NULL;
 681                 idata.aa = wpa_auth->addr;
 682                 idata.spa = sm->addr;
 683                 idata.pmkid = &data.pmkid[i * PMKID_LEN];
 684                 wpa_auth_for_each_auth(wpa_auth, wpa_auth_okc_iter, &idata);
 685                 if (idata.pmksa) {
 686                         wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
 687                                          "OKC match for PMKID");
 688                         sm->pmksa = pmksa_cache_add_okc(wpa_auth->pmksa,
 689                                                         idata.pmksa,
 690                                                         wpa_auth->addr,
 691                                                         idata.pmkid);
 692                         pmkid = idata.pmkid;
 693                         break;
 694                 }
 695         }
 696         if (sm->pmksa && pmkid) {
 697                 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
 698                                  "PMKID found from PMKSA cache "
 699                                  "eap_type=%d vlan_id=%d",
 700                                  sm->pmksa->eap_type_authsrv,
 701                                  sm->pmksa->vlan_id);
 702                 os_memcpy(wpa_auth->dot11RSNAPMKIDUsed, pmkid, PMKID_LEN);
 703         }
 704
 705         if (sm->wpa_ie == NULL || sm->wpa_ie_len < wpa_ie_len) {
 706                 os_free(sm->wpa_ie);
 707                 sm->wpa_ie = os_malloc(wpa_ie_len);
 708                 if (sm->wpa_ie == NULL)
 709                         return WPA_ALLOC_FAIL;
 710         }
 711         os_memcpy(sm->wpa_ie, wpa_ie, wpa_ie_len);
 712         sm->wpa_ie_len = wpa_ie_len;
 713
 714         return WPA_IE_OK;
 715 }
 716
 717
 718 #ifdef CONFIG_HS20
 719 int wpa_validate_osen(struct wpa_authenticator *wpa_auth,
 720                       struct wpa_state_machine *sm,
 721                       const u8 *osen_ie, size_t osen_ie_len)
 722 {
 723         if (wpa_auth == NULL || sm == NULL)
 724                 return -1;
 725
 726         /* TODO: parse OSEN element */
 727         sm->wpa_key_mgmt = WPA_KEY_MGMT_OSEN;
 728         sm->mgmt_frame_prot = 1;
 729         sm->pairwise = WPA_CIPHER_CCMP;
 730         sm->wpa = WPA_VERSION_WPA2;
 731
 732         if (sm->wpa_ie == NULL || sm->wpa_ie_len < osen_ie_len) {
 733                 os_free(sm->wpa_ie);
 734                 sm->wpa_ie = os_malloc(osen_ie_len);
 735                 if (sm->wpa_ie == NULL)
 736                         return -1;
 737         }
 738
 739         os_memcpy(sm->wpa_ie, osen_ie, osen_ie_len);
 740         sm->wpa_ie_len = osen_ie_len;
 741
 742         return 0;
 743 }
 744
 745 #endif /* CONFIG_HS20 */
 746
 747
 748 /**
 749  * wpa_parse_generic - Parse EAPOL-Key Key Data Generic IEs
 750  * @pos: Pointer to the IE header
 751  * @end: Pointer to the end of the Key Data buffer
 752  * @ie: Pointer to parsed IE data
 753  * Returns: 0 on success, 1 if end mark is found, -1 on failure
 754  */
 755 static int wpa_parse_generic(const u8 *pos, const u8 *end,
 756                              struct wpa_eapol_ie_parse *ie)
 757 {
 758         if (pos[1] == 0)
 759                 return 1;
 760
 761         if (pos[1] >= 6 &&
 762             RSN_SELECTOR_GET(pos + 2) == WPA_OUI_TYPE &&
 763             pos[2 + WPA_SELECTOR_LEN] == 1 &&
 764             pos[2 + WPA_SELECTOR_LEN + 1] == 0) {
 765                 ie->wpa_ie = pos;
 766                 ie->wpa_ie_len = pos[1] + 2;
 767                 return 0;
 768         }
 769
 770         if (pos[1] >= 4 && WPA_GET_BE32(pos + 2) == OSEN_IE_VENDOR_TYPE) {
 771                 ie->osen = pos;
 772                 ie->osen_len = pos[1] + 2;
 773                 return 0;
 774         }
 775
 776         if (pos + 1 + RSN_SELECTOR_LEN < end &&
 777             pos[1] >= RSN_SELECTOR_LEN + PMKID_LEN &&
 778             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_PMKID) {
 779                 ie->pmkid = pos + 2 + RSN_SELECTOR_LEN;
 780                 return 0;
 781         }
 782
 783         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 784             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_GROUPKEY) {
 785                 ie->gtk = pos + 2 + RSN_SELECTOR_LEN;
 786                 ie->gtk_len = pos[1] - RSN_SELECTOR_LEN;
 787                 return 0;
 788         }
 789
 790         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 791             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_MAC_ADDR) {
 792                 ie->mac_addr = pos + 2 + RSN_SELECTOR_LEN;
 793                 ie->mac_addr_len = pos[1] - RSN_SELECTOR_LEN;
 794                 return 0;
 795         }
 796
 797 #ifdef CONFIG_PEERKEY
 798         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 799             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_SMK) {
 800                 ie->smk = pos + 2 + RSN_SELECTOR_LEN;
 801                 ie->smk_len = pos[1] - RSN_SELECTOR_LEN;
 802                 return 0;
 803         }
 804
 805         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 806             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_NONCE) {
 807                 ie->nonce = pos + 2 + RSN_SELECTOR_LEN;
 808                 ie->nonce_len = pos[1] - RSN_SELECTOR_LEN;
 809                 return 0;
 810         }
 811
 812         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 813             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_LIFETIME) {
 814                 ie->lifetime = pos + 2 + RSN_SELECTOR_LEN;
 815                 ie->lifetime_len = pos[1] - RSN_SELECTOR_LEN;
 816                 return 0;
 817         }
 818
 819         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 820             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_ERROR) {
 821                 ie->error = pos + 2 + RSN_SELECTOR_LEN;
 822                 ie->error_len = pos[1] - RSN_SELECTOR_LEN;
 823                 return 0;
 824         }
 825 #endif /* CONFIG_PEERKEY */
 826
 827 #ifdef CONFIG_IEEE80211W
 828         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 829             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_IGTK) {
 830                 ie->igtk = pos + 2 + RSN_SELECTOR_LEN;
 831                 ie->igtk_len = pos[1] - RSN_SELECTOR_LEN;
 832                 return 0;
 833         }
 834 #endif /* CONFIG_IEEE80211W */
 835
 836 #ifdef CONFIG_P2P
 837         if (pos[1] >= RSN_SELECTOR_LEN + 1 &&
 838             RSN_SELECTOR_GET(pos + 2) == WFA_KEY_DATA_IP_ADDR_REQ) {
 839                 ie->ip_addr_req = pos + 2 + RSN_SELECTOR_LEN;
 840                 wpa_hexdump(MSG_DEBUG, "WPA: IP Address Request in EAPOL-Key",
 841                             ie->ip_addr_req, pos[1] - RSN_SELECTOR_LEN);
 842                 return 0;
 843         }
 844
 845         if (pos[1] >= RSN_SELECTOR_LEN + 3 * 4 &&
 846             RSN_SELECTOR_GET(pos + 2) == WFA_KEY_DATA_IP_ADDR_ALLOC) {
 847                 ie->ip_addr_alloc = pos + 2 + RSN_SELECTOR_LEN;
 848                 wpa_hexdump(MSG_DEBUG,
 849                             "WPA: IP Address Allocation in EAPOL-Key",
 850                             ie->ip_addr_alloc, pos[1] - RSN_SELECTOR_LEN);
 851                 return 0;
 852         }
 853 #endif /* CONFIG_P2P */
 854
 855         return 0;
 856 }
 857
 858
 859 /**
 860  * wpa_parse_kde_ies - Parse EAPOL-Key Key Data IEs
 861  * @buf: Pointer to the Key Data buffer
 862  * @len: Key Data Length
 863  * @ie: Pointer to parsed IE data
 864  * Returns: 0 on success, -1 on failure
 865  */
 866 int wpa_parse_kde_ies(const u8 *buf, size_t len, struct wpa_eapol_ie_parse *ie)
 867 {
 868         const u8 *pos, *end;
 869         int ret = 0;
 870
 871         os_memset(ie, 0, sizeof(*ie));
 872         for (pos = buf, end = pos + len; pos + 1 < end; pos += 2 + pos[1]) {
 873                 if (pos[0] == 0xdd &&
 874                     ((pos == buf + len - 1) || pos[1] == 0)) {
 875                         /* Ignore padding */
 876                         break;
 877                 }
 878                 if (pos + 2 + pos[1] > end) {
 879                         wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key Key Data "
 880                                    "underflow (ie=%d len=%d pos=%d)",
 881                                    pos[0], pos[1], (int) (pos - buf));
 882                         wpa_hexdump_key(MSG_DEBUG, "WPA: Key Data",
 883                                         buf, len);
 884                         ret = -1;
 885                         break;
 886                 }
 887                 if (*pos == WLAN_EID_RSN) {
 888                         ie->rsn_ie = pos;
 889                         ie->rsn_ie_len = pos[1] + 2;
 890 #ifdef CONFIG_IEEE80211R
 891                 } else if (*pos == WLAN_EID_MOBILITY_DOMAIN) {
 892                         ie->mdie = pos;
 893                         ie->mdie_len = pos[1] + 2;
 894                 } else if (*pos == WLAN_EID_FAST_BSS_TRANSITION) {
 895                         ie->ftie = pos;
 896                         ie->ftie_len = pos[1] + 2;
 897 #endif /* CONFIG_IEEE80211R */
 898                 } else if (*pos == WLAN_EID_VENDOR_SPECIFIC) {
 899                         ret = wpa_parse_generic(pos, end, ie);
 900                         if (ret < 0)
 901                                 break;
 902                         if (ret > 0) {
 903                                 ret = 0;
 904                                 break;
 905                         }
 906                 } else {
 907                         wpa_hexdump(MSG_DEBUG, "WPA: Unrecognized EAPOL-Key "
 908                                     "Key Data IE", pos, 2 + pos[1]);
 909                 }
 910         }
 911
 912         return ret;
 913 }
 914
 915
 916 int wpa_auth_uses_mfp(struct wpa_state_machine *sm)
 917 {
 918         return sm ? sm->mgmt_frame_prot : 0;
 919 }