src/ap/wpa_auth_ie.c

   1 /*
   2  * hostapd - WPA/RSN IE and KDE definitions
   3  * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "utils/includes.h"
  16
  17 #include "utils/common.h"
  18 #include "common/ieee802_11_defs.h"
  19 #include "eapol_auth/eapol_auth_sm.h"
  20 #include "ap_config.h"
  21 #include "ieee802_11.h"
  22 #include "wpa_auth.h"
  23 #include "pmksa_cache_auth.h"
  24 #include "wpa_auth_ie.h"
  25 #include "wpa_auth_i.h"
  26
  27
  28 static int wpa_write_wpa_ie(struct wpa_auth_config *conf, u8 *buf, size_t len)
  29 {
  30         struct wpa_ie_hdr *hdr;
  31         int num_suites;
  32         u8 *pos, *count;
  33
  34         hdr = (struct wpa_ie_hdr *) buf;
  35         hdr->elem_id = WLAN_EID_VENDOR_SPECIFIC;
  36         RSN_SELECTOR_PUT(hdr->oui, WPA_OUI_TYPE);
  37         WPA_PUT_LE16(hdr->version, WPA_VERSION);
  38         pos = (u8 *) (hdr + 1);
  39
  40         if (conf->wpa_group == WPA_CIPHER_CCMP) {
  41                 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_CCMP);
  42         } else if (conf->wpa_group == WPA_CIPHER_TKIP) {
  43                 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_TKIP);
  44         } else if (conf->wpa_group == WPA_CIPHER_WEP104) {
  45                 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_WEP104);
  46         } else if (conf->wpa_group == WPA_CIPHER_WEP40) {
  47                 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_WEP40);
  48         } else {
  49                 wpa_printf(MSG_DEBUG, "Invalid group cipher (%d).",
  50                            conf->wpa_group);
  51                 return -1;
  52         }
  53         pos += WPA_SELECTOR_LEN;
  54
  55         num_suites = 0;
  56         count = pos;
  57         pos += 2;
  58
  59         if (conf->wpa_pairwise & WPA_CIPHER_CCMP) {
  60                 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_CCMP);
  61                 pos += WPA_SELECTOR_LEN;
  62                 num_suites++;
  63         }
  64         if (conf->wpa_pairwise & WPA_CIPHER_TKIP) {
  65                 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_TKIP);
  66                 pos += WPA_SELECTOR_LEN;
  67                 num_suites++;
  68         }
  69         if (conf->wpa_pairwise & WPA_CIPHER_NONE) {
  70                 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_NONE);
  71                 pos += WPA_SELECTOR_LEN;
  72                 num_suites++;
  73         }
  74
  75         if (num_suites == 0) {
  76                 wpa_printf(MSG_DEBUG, "Invalid pairwise cipher (%d).",
  77                            conf->wpa_pairwise);
  78                 return -1;
  79         }
  80         WPA_PUT_LE16(count, num_suites);
  81
  82         num_suites = 0;
  83         count = pos;
  84         pos += 2;
  85
  86         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) {
  87                 RSN_SELECTOR_PUT(pos, WPA_AUTH_KEY_MGMT_UNSPEC_802_1X);
  88                 pos += WPA_SELECTOR_LEN;
  89                 num_suites++;
  90         }
  91         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) {
  92                 RSN_SELECTOR_PUT(pos, WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X);
  93                 pos += WPA_SELECTOR_LEN;
  94                 num_suites++;
  95         }
  96
  97         if (num_suites == 0) {
  98                 wpa_printf(MSG_DEBUG, "Invalid key management type (%d).",
  99                            conf->wpa_key_mgmt);
 100                 return -1;
 101         }
 102         WPA_PUT_LE16(count, num_suites);
 103
 104         /* WPA Capabilities; use defaults, so no need to include it */
 105
 106         hdr->len = (pos - buf) - 2;
 107
 108         return pos - buf;
 109 }
 110
 111
 112 int wpa_write_rsn_ie(struct wpa_auth_config *conf, u8 *buf, size_t len,
 113                      const u8 *pmkid)
 114 {
 115         struct rsn_ie_hdr *hdr;
 116         int num_suites;
 117         u8 *pos, *count;
 118         u16 capab;
 119
 120         hdr = (struct rsn_ie_hdr *) buf;
 121         hdr->elem_id = WLAN_EID_RSN;
 122         WPA_PUT_LE16(hdr->version, RSN_VERSION);
 123         pos = (u8 *) (hdr + 1);
 124
 125         if (conf->wpa_group == WPA_CIPHER_CCMP) {
 126                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
 127         } else if (conf->wpa_group == WPA_CIPHER_TKIP) {
 128                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_TKIP);
 129         } else if (conf->wpa_group == WPA_CIPHER_WEP104) {
 130                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_WEP104);
 131         } else if (conf->wpa_group == WPA_CIPHER_WEP40) {
 132                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_WEP40);
 133         } else {
 134                 wpa_printf(MSG_DEBUG, "Invalid group cipher (%d).",
 135                            conf->wpa_group);
 136                 return -1;
 137         }
 138         pos += RSN_SELECTOR_LEN;
 139
 140         num_suites = 0;
 141         count = pos;
 142         pos += 2;
 143
 144         if (conf->rsn_pairwise & WPA_CIPHER_CCMP) {
 145                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
 146                 pos += RSN_SELECTOR_LEN;
 147                 num_suites++;
 148         }
 149         if (conf->rsn_pairwise & WPA_CIPHER_TKIP) {
 150                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_TKIP);
 151                 pos += RSN_SELECTOR_LEN;
 152                 num_suites++;
 153         }
 154         if (conf->rsn_pairwise & WPA_CIPHER_NONE) {
 155                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NONE);
 156                 pos += RSN_SELECTOR_LEN;
 157                 num_suites++;
 158         }
 159
 160         if (num_suites == 0) {
 161                 wpa_printf(MSG_DEBUG, "Invalid pairwise cipher (%d).",
 162                            conf->rsn_pairwise);
 163                 return -1;
 164         }
 165         WPA_PUT_LE16(count, num_suites);
 166
 167         num_suites = 0;
 168         count = pos;
 169         pos += 2;
 170
 171         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) {
 172                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_UNSPEC_802_1X);
 173                 pos += RSN_SELECTOR_LEN;
 174                 num_suites++;
 175         }
 176         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) {
 177                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X);
 178                 pos += RSN_SELECTOR_LEN;
 179                 num_suites++;
 180         }
 181 #ifdef CONFIG_IEEE80211R
 182         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) {
 183                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_802_1X);
 184                 pos += RSN_SELECTOR_LEN;
 185                 num_suites++;
 186         }
 187         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_PSK) {
 188                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_PSK);
 189                 pos += RSN_SELECTOR_LEN;
 190                 num_suites++;
 191         }
 192 #endif /* CONFIG_IEEE80211R */
 193 #ifdef CONFIG_IEEE80211W
 194         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) {
 195                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SHA256);
 196                 pos += RSN_SELECTOR_LEN;
 197                 num_suites++;
 198         }
 199         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK_SHA256) {
 200                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PSK_SHA256);
 201                 pos += RSN_SELECTOR_LEN;
 202                 num_suites++;
 203         }
 204 #endif /* CONFIG_IEEE80211W */
 205
 206         if (num_suites == 0) {
 207                 wpa_printf(MSG_DEBUG, "Invalid key management type (%d).",
 208                            conf->wpa_key_mgmt);
 209                 return -1;
 210         }
 211         WPA_PUT_LE16(count, num_suites);
 212
 213         /* RSN Capabilities */
 214         capab = 0;
 215         if (conf->rsn_preauth)
 216                 capab |= WPA_CAPABILITY_PREAUTH;
 217         if (conf->peerkey)
 218                 capab |= WPA_CAPABILITY_PEERKEY_ENABLED;
 219         if (conf->wmm_enabled) {
 220                 /* 4 PTKSA replay counters when using WMM */
 221                 capab |= (RSN_NUM_REPLAY_COUNTERS_16 << 2);
 222         }
 223 #ifdef CONFIG_IEEE80211W
 224         if (conf->ieee80211w != WPA_NO_IEEE80211W) {
 225                 capab |= WPA_CAPABILITY_MFPC;
 226                 if (conf->ieee80211w == IEEE80211W_REQUIRED)
 227                         capab |= WPA_CAPABILITY_MFPR;
 228         }
 229 #endif /* CONFIG_IEEE80211W */
 230         WPA_PUT_LE16(pos, capab);
 231         pos += 2;
 232
 233         if (pmkid) {
 234                 if (pos + 2 + PMKID_LEN > buf + len)
 235                         return -1;
 236                 /* PMKID Count */
 237                 WPA_PUT_LE16(pos, 1);
 238                 pos += 2;
 239                 os_memcpy(pos, pmkid, PMKID_LEN);
 240                 pos += PMKID_LEN;
 241         }
 242
 243 #ifdef CONFIG_IEEE80211W
 244         if (conf->ieee80211w != WPA_NO_IEEE80211W) {
 245                 if (pos + 2 + 4 > buf + len)
 246                         return -1;
 247                 if (pmkid == NULL) {
 248                         /* PMKID Count */
 249                         WPA_PUT_LE16(pos, 0);
 250                         pos += 2;
 251                 }
 252
 253                 /* Management Group Cipher Suite */
 254                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC);
 255                 pos += RSN_SELECTOR_LEN;
 256         }
 257 #endif /* CONFIG_IEEE80211W */
 258
 259         hdr->len = (pos - buf) - 2;
 260
 261         return pos - buf;
 262 }
 263
 264
 265 int wpa_auth_gen_wpa_ie(struct wpa_authenticator *wpa_auth)
 266 {
 267         u8 *pos, buf[128];
 268         int res;
 269
 270         pos = buf;
 271
 272         if (wpa_auth->conf.wpa & WPA_PROTO_RSN) {
 273                 res = wpa_write_rsn_ie(&wpa_auth->conf,
 274                                        pos, buf + sizeof(buf) - pos, NULL);
 275                 if (res < 0)
 276                         return res;
 277                 pos += res;
 278         }
 279 #ifdef CONFIG_IEEE80211R
 280         if (wpa_auth->conf.wpa_key_mgmt &
 281             (WPA_KEY_MGMT_FT_IEEE8021X | WPA_KEY_MGMT_FT_PSK)) {
 282                 res = wpa_write_mdie(&wpa_auth->conf, pos,
 283                                      buf + sizeof(buf) - pos);
 284                 if (res < 0)
 285                         return res;
 286                 pos += res;
 287         }
 288 #endif /* CONFIG_IEEE80211R */
 289         if (wpa_auth->conf.wpa & WPA_PROTO_WPA) {
 290                 res = wpa_write_wpa_ie(&wpa_auth->conf,
 291                                        pos, buf + sizeof(buf) - pos);
 292                 if (res < 0)
 293                         return res;
 294                 pos += res;
 295         }
 296
 297         os_free(wpa_auth->wpa_ie);
 298         wpa_auth->wpa_ie = os_malloc(pos - buf);
 299         if (wpa_auth->wpa_ie == NULL)
 300                 return -1;
 301         os_memcpy(wpa_auth->wpa_ie, buf, pos - buf);
 302         wpa_auth->wpa_ie_len = pos - buf;
 303
 304         return 0;
 305 }
 306
 307
 308 u8 * wpa_add_kde(u8 *pos, u32 kde, const u8 *data, size_t data_len,
 309                  const u8 *data2, size_t data2_len)
 310 {
 311         *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 312         *pos++ = RSN_SELECTOR_LEN + data_len + data2_len;
 313         RSN_SELECTOR_PUT(pos, kde);
 314         pos += RSN_SELECTOR_LEN;
 315         os_memcpy(pos, data, data_len);
 316         pos += data_len;
 317         if (data2) {
 318                 os_memcpy(pos, data2, data2_len);
 319                 pos += data2_len;
 320         }
 321         return pos;
 322 }
 323
 324
 325 static int wpa_selector_to_bitfield(const u8 *s)
 326 {
 327         if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_NONE)
 328                 return WPA_CIPHER_NONE;
 329         if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_WEP40)
 330                 return WPA_CIPHER_WEP40;
 331         if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_TKIP)
 332                 return WPA_CIPHER_TKIP;
 333         if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_CCMP)
 334                 return WPA_CIPHER_CCMP;
 335         if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_WEP104)
 336                 return WPA_CIPHER_WEP104;
 337         return 0;
 338 }
 339
 340
 341 static int wpa_key_mgmt_to_bitfield(const u8 *s)
 342 {
 343         if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_UNSPEC_802_1X)
 344                 return WPA_KEY_MGMT_IEEE8021X;
 345         if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X)
 346                 return WPA_KEY_MGMT_PSK;
 347         if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_NONE)
 348                 return WPA_KEY_MGMT_WPA_NONE;
 349         return 0;
 350 }
 351
 352
 353 static int wpa_parse_wpa_ie_wpa(const u8 *wpa_ie, size_t wpa_ie_len,
 354                                 struct wpa_ie_data *data)
 355 {
 356         const struct wpa_ie_hdr *hdr;
 357         const u8 *pos;
 358         int left;
 359         int i, count;
 360
 361         os_memset(data, 0, sizeof(*data));
 362         data->pairwise_cipher = WPA_CIPHER_TKIP;
 363         data->group_cipher = WPA_CIPHER_TKIP;
 364         data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
 365         data->mgmt_group_cipher = 0;
 366
 367         if (wpa_ie_len < sizeof(struct wpa_ie_hdr))
 368                 return -1;
 369
 370         hdr = (const struct wpa_ie_hdr *) wpa_ie;
 371
 372         if (hdr->elem_id != WLAN_EID_VENDOR_SPECIFIC ||
 373             hdr->len != wpa_ie_len - 2 ||
 374             RSN_SELECTOR_GET(hdr->oui) != WPA_OUI_TYPE ||
 375             WPA_GET_LE16(hdr->version) != WPA_VERSION) {
 376                 return -2;
 377         }
 378
 379         pos = (const u8 *) (hdr + 1);
 380         left = wpa_ie_len - sizeof(*hdr);
 381
 382         if (left >= WPA_SELECTOR_LEN) {
 383                 data->group_cipher = wpa_selector_to_bitfield(pos);
 384                 pos += WPA_SELECTOR_LEN;
 385                 left -= WPA_SELECTOR_LEN;
 386         } else if (left > 0)
 387                   return -3;
 388
 389         if (left >= 2) {
 390                 data->pairwise_cipher = 0;
 391                 count = WPA_GET_LE16(pos);
 392                 pos += 2;
 393                 left -= 2;
 394                 if (count == 0 || left < count * WPA_SELECTOR_LEN)
 395                         return -4;
 396                 for (i = 0; i < count; i++) {
 397                         data->pairwise_cipher |= wpa_selector_to_bitfield(pos);
 398                         pos += WPA_SELECTOR_LEN;
 399                         left -= WPA_SELECTOR_LEN;
 400                 }
 401         } else if (left == 1)
 402                 return -5;
 403
 404         if (left >= 2) {
 405                 data->key_mgmt = 0;
 406                 count = WPA_GET_LE16(pos);
 407                 pos += 2;
 408                 left -= 2;
 409                 if (count == 0 || left < count * WPA_SELECTOR_LEN)
 410                         return -6;
 411                 for (i = 0; i < count; i++) {
 412                         data->key_mgmt |= wpa_key_mgmt_to_bitfield(pos);
 413                         pos += WPA_SELECTOR_LEN;
 414                         left -= WPA_SELECTOR_LEN;
 415                 }
 416         } else if (left == 1)
 417                 return -7;
 418
 419         if (left >= 2) {
 420                 data->capabilities = WPA_GET_LE16(pos);
 421                 pos += 2;
 422                 left -= 2;
 423         }
 424
 425         if (left > 0) {
 426                 return -8;
 427         }
 428
 429         return 0;
 430 }
 431
 432
 433 struct wpa_auth_okc_iter_data {
 434         struct rsn_pmksa_cache_entry *pmksa;
 435         const u8 *aa;
 436         const u8 *spa;
 437         const u8 *pmkid;
 438 };
 439
 440
 441 static int wpa_auth_okc_iter(struct wpa_authenticator *a, void *ctx)
 442 {
 443         struct wpa_auth_okc_iter_data *data = ctx;
 444         data->pmksa = pmksa_cache_get_okc(a->pmksa, data->aa, data->spa,
 445                                           data->pmkid);
 446         if (data->pmksa)
 447                 return 1;
 448         return 0;
 449 }
 450
 451
 452 int wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth,
 453                         struct wpa_state_machine *sm,
 454                         const u8 *wpa_ie, size_t wpa_ie_len,
 455                         const u8 *mdie, size_t mdie_len)
 456 {
 457         struct wpa_ie_data data;
 458         int ciphers, key_mgmt, res, version;
 459         u32 selector;
 460         size_t i;
 461         const u8 *pmkid = NULL;
 462
 463         if (wpa_auth == NULL || sm == NULL)
 464                 return WPA_NOT_ENABLED;
 465
 466         if (wpa_ie == NULL || wpa_ie_len < 1)
 467                 return WPA_INVALID_IE;
 468
 469         if (wpa_ie[0] == WLAN_EID_RSN)
 470                 version = WPA_PROTO_RSN;
 471         else
 472                 version = WPA_PROTO_WPA;
 473
 474         if (!(wpa_auth->conf.wpa & version)) {
 475                 wpa_printf(MSG_DEBUG, "Invalid WPA proto (%d) from " MACSTR,
 476                            version, MAC2STR(sm->addr));
 477                 return WPA_INVALID_PROTO;
 478         }
 479
 480         if (version == WPA_PROTO_RSN) {
 481                 res = wpa_parse_wpa_ie_rsn(wpa_ie, wpa_ie_len, &data);
 482
 483                 selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X;
 484                 if (0) {
 485                 }
 486 #ifdef CONFIG_IEEE80211R
 487                 else if (data.key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X)
 488                         selector = RSN_AUTH_KEY_MGMT_FT_802_1X;
 489                 else if (data.key_mgmt & WPA_KEY_MGMT_FT_PSK)
 490                         selector = RSN_AUTH_KEY_MGMT_FT_PSK;
 491 #endif /* CONFIG_IEEE80211R */
 492 #ifdef CONFIG_IEEE80211W
 493                 else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256)
 494                         selector = RSN_AUTH_KEY_MGMT_802_1X_SHA256;
 495                 else if (data.key_mgmt & WPA_KEY_MGMT_PSK_SHA256)
 496                         selector = RSN_AUTH_KEY_MGMT_PSK_SHA256;
 497 #endif /* CONFIG_IEEE80211W */
 498                 else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X)
 499                         selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X;
 500                 else if (data.key_mgmt & WPA_KEY_MGMT_PSK)
 501                         selector = RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X;
 502                 wpa_auth->dot11RSNAAuthenticationSuiteSelected = selector;
 503
 504                 selector = RSN_CIPHER_SUITE_CCMP;
 505                 if (data.pairwise_cipher & WPA_CIPHER_CCMP)
 506                         selector = RSN_CIPHER_SUITE_CCMP;
 507                 else if (data.pairwise_cipher & WPA_CIPHER_TKIP)
 508                         selector = RSN_CIPHER_SUITE_TKIP;
 509                 else if (data.pairwise_cipher & WPA_CIPHER_WEP104)
 510                         selector = RSN_CIPHER_SUITE_WEP104;
 511                 else if (data.pairwise_cipher & WPA_CIPHER_WEP40)
 512                         selector = RSN_CIPHER_SUITE_WEP40;
 513                 else if (data.pairwise_cipher & WPA_CIPHER_NONE)
 514                         selector = RSN_CIPHER_SUITE_NONE;
 515                 wpa_auth->dot11RSNAPairwiseCipherSelected = selector;
 516
 517                 selector = RSN_CIPHER_SUITE_CCMP;
 518                 if (data.group_cipher & WPA_CIPHER_CCMP)
 519                         selector = RSN_CIPHER_SUITE_CCMP;
 520                 else if (data.group_cipher & WPA_CIPHER_TKIP)
 521                         selector = RSN_CIPHER_SUITE_TKIP;
 522                 else if (data.group_cipher & WPA_CIPHER_WEP104)
 523                         selector = RSN_CIPHER_SUITE_WEP104;
 524                 else if (data.group_cipher & WPA_CIPHER_WEP40)
 525                         selector = RSN_CIPHER_SUITE_WEP40;
 526                 else if (data.group_cipher & WPA_CIPHER_NONE)
 527                         selector = RSN_CIPHER_SUITE_NONE;
 528                 wpa_auth->dot11RSNAGroupCipherSelected = selector;
 529         } else {
 530                 res = wpa_parse_wpa_ie_wpa(wpa_ie, wpa_ie_len, &data);
 531
 532                 selector = WPA_AUTH_KEY_MGMT_UNSPEC_802_1X;
 533                 if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X)
 534                         selector = WPA_AUTH_KEY_MGMT_UNSPEC_802_1X;
 535                 else if (data.key_mgmt & WPA_KEY_MGMT_PSK)
 536                         selector = WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X;
 537                 wpa_auth->dot11RSNAAuthenticationSuiteSelected = selector;
 538
 539                 selector = WPA_CIPHER_SUITE_TKIP;
 540                 if (data.pairwise_cipher & WPA_CIPHER_CCMP)
 541                         selector = WPA_CIPHER_SUITE_CCMP;
 542                 else if (data.pairwise_cipher & WPA_CIPHER_TKIP)
 543                         selector = WPA_CIPHER_SUITE_TKIP;
 544                 else if (data.pairwise_cipher & WPA_CIPHER_WEP104)
 545                         selector = WPA_CIPHER_SUITE_WEP104;
 546                 else if (data.pairwise_cipher & WPA_CIPHER_WEP40)
 547                         selector = WPA_CIPHER_SUITE_WEP40;
 548                 else if (data.pairwise_cipher & WPA_CIPHER_NONE)
 549                         selector = WPA_CIPHER_SUITE_NONE;
 550                 wpa_auth->dot11RSNAPairwiseCipherSelected = selector;
 551
 552                 selector = WPA_CIPHER_SUITE_TKIP;
 553                 if (data.group_cipher & WPA_CIPHER_CCMP)
 554                         selector = WPA_CIPHER_SUITE_CCMP;
 555                 else if (data.group_cipher & WPA_CIPHER_TKIP)
 556                         selector = WPA_CIPHER_SUITE_TKIP;
 557                 else if (data.group_cipher & WPA_CIPHER_WEP104)
 558                         selector = WPA_CIPHER_SUITE_WEP104;
 559                 else if (data.group_cipher & WPA_CIPHER_WEP40)
 560                         selector = WPA_CIPHER_SUITE_WEP40;
 561                 else if (data.group_cipher & WPA_CIPHER_NONE)
 562                         selector = WPA_CIPHER_SUITE_NONE;
 563                 wpa_auth->dot11RSNAGroupCipherSelected = selector;
 564         }
 565         if (res) {
 566                 wpa_printf(MSG_DEBUG, "Failed to parse WPA/RSN IE from "
 567                            MACSTR " (res=%d)", MAC2STR(sm->addr), res);
 568                 wpa_hexdump(MSG_DEBUG, "WPA/RSN IE", wpa_ie, wpa_ie_len);
 569                 return WPA_INVALID_IE;
 570         }
 571
 572         if (data.group_cipher != wpa_auth->conf.wpa_group) {
 573                 wpa_printf(MSG_DEBUG, "Invalid WPA group cipher (0x%x) from "
 574                            MACSTR, data.group_cipher, MAC2STR(sm->addr));
 575                 return WPA_INVALID_GROUP;
 576         }
 577
 578         key_mgmt = data.key_mgmt & wpa_auth->conf.wpa_key_mgmt;
 579         if (!key_mgmt) {
 580                 wpa_printf(MSG_DEBUG, "Invalid WPA key mgmt (0x%x) from "
 581                            MACSTR, data.key_mgmt, MAC2STR(sm->addr));
 582                 return WPA_INVALID_AKMP;
 583         }
 584         if (0) {
 585         }
 586 #ifdef CONFIG_IEEE80211R
 587         else if (key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X)
 588                 sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
 589         else if (key_mgmt & WPA_KEY_MGMT_FT_PSK)
 590                 sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_PSK;
 591 #endif /* CONFIG_IEEE80211R */
 592 #ifdef CONFIG_IEEE80211W
 593         else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256)
 594                 sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
 595         else if (key_mgmt & WPA_KEY_MGMT_PSK_SHA256)
 596                 sm->wpa_key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
 597 #endif /* CONFIG_IEEE80211W */
 598         else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X)
 599                 sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X;
 600         else
 601                 sm->wpa_key_mgmt = WPA_KEY_MGMT_PSK;
 602
 603         if (version == WPA_PROTO_RSN)
 604                 ciphers = data.pairwise_cipher & wpa_auth->conf.rsn_pairwise;
 605         else
 606                 ciphers = data.pairwise_cipher & wpa_auth->conf.wpa_pairwise;
 607         if (!ciphers) {
 608                 wpa_printf(MSG_DEBUG, "Invalid %s pairwise cipher (0x%x) "
 609                            "from " MACSTR,
 610                            version == WPA_PROTO_RSN ? "RSN" : "WPA",
 611                            data.pairwise_cipher, MAC2STR(sm->addr));
 612                 return WPA_INVALID_PAIRWISE;
 613         }
 614
 615 #ifdef CONFIG_IEEE80211W
 616         if (wpa_auth->conf.ieee80211w == WPA_IEEE80211W_REQUIRED) {
 617                 if (!(data.capabilities & WPA_CAPABILITY_MFPC)) {
 618                         wpa_printf(MSG_DEBUG, "Management frame protection "
 619                                    "required, but client did not enable it");
 620                         return WPA_MGMT_FRAME_PROTECTION_VIOLATION;
 621                 }
 622
 623                 if (ciphers & WPA_CIPHER_TKIP) {
 624                         wpa_printf(MSG_DEBUG, "Management frame protection "
 625                                    "cannot use TKIP");
 626                         return WPA_MGMT_FRAME_PROTECTION_VIOLATION;
 627                 }
 628
 629                 if (data.mgmt_group_cipher != WPA_CIPHER_AES_128_CMAC) {
 630                         wpa_printf(MSG_DEBUG, "Unsupported management group "
 631                                    "cipher %d", data.mgmt_group_cipher);
 632                         return WPA_INVALID_MGMT_GROUP_CIPHER;
 633                 }
 634         }
 635
 636         if (wpa_auth->conf.ieee80211w == WPA_NO_IEEE80211W ||
 637             !(data.capabilities & WPA_CAPABILITY_MFPC))
 638                 sm->mgmt_frame_prot = 0;
 639         else
 640                 sm->mgmt_frame_prot = 1;
 641 #endif /* CONFIG_IEEE80211W */
 642
 643 #ifdef CONFIG_IEEE80211R
 644         if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) {
 645                 if (mdie == NULL || mdie_len < MOBILITY_DOMAIN_ID_LEN + 1) {
 646                         wpa_printf(MSG_DEBUG, "RSN: Trying to use FT, but "
 647                                    "MDIE not included");
 648                         return WPA_INVALID_MDIE;
 649                 }
 650                 if (os_memcmp(mdie, wpa_auth->conf.mobility_domain,
 651                               MOBILITY_DOMAIN_ID_LEN) != 0) {
 652                         wpa_hexdump(MSG_DEBUG, "RSN: Attempted to use unknown "
 653                                     "MDIE", mdie, MOBILITY_DOMAIN_ID_LEN);
 654                         return WPA_INVALID_MDIE;
 655                 }
 656         }
 657 #endif /* CONFIG_IEEE80211R */
 658
 659         if (ciphers & WPA_CIPHER_CCMP)
 660                 sm->pairwise = WPA_CIPHER_CCMP;
 661         else
 662                 sm->pairwise = WPA_CIPHER_TKIP;
 663
 664         /* TODO: clear WPA/WPA2 state if STA changes from one to another */
 665         if (wpa_ie[0] == WLAN_EID_RSN)
 666                 sm->wpa = WPA_VERSION_WPA2;
 667         else
 668                 sm->wpa = WPA_VERSION_WPA;
 669
 670         sm->pmksa = NULL;
 671         for (i = 0; i < data.num_pmkid; i++) {
 672                 wpa_hexdump(MSG_DEBUG, "RSN IE: STA PMKID",
 673                             &data.pmkid[i * PMKID_LEN], PMKID_LEN);
 674                 sm->pmksa = pmksa_cache_auth_get(wpa_auth->pmksa, sm->addr,
 675                                                  &data.pmkid[i * PMKID_LEN]);
 676                 if (sm->pmksa) {
 677                         pmkid = sm->pmksa->pmkid;
 678                         break;
 679                 }
 680         }
 681         for (i = 0; sm->pmksa == NULL && wpa_auth->conf.okc &&
 682                      i < data.num_pmkid; i++) {
 683                 struct wpa_auth_okc_iter_data idata;
 684                 idata.pmksa = NULL;
 685                 idata.aa = wpa_auth->addr;
 686                 idata.spa = sm->addr;
 687                 idata.pmkid = &data.pmkid[i * PMKID_LEN];
 688                 wpa_auth_for_each_auth(wpa_auth, wpa_auth_okc_iter, &idata);
 689                 if (idata.pmksa) {
 690                         wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
 691                                          "OKC match for PMKID");
 692                         sm->pmksa = pmksa_cache_add_okc(wpa_auth->pmksa,
 693                                                         idata.pmksa,
 694                                                         wpa_auth->addr,
 695                                                         idata.pmkid);
 696                         pmkid = idata.pmkid;
 697                         break;
 698                 }
 699         }
 700         if (sm->pmksa) {
 701                 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
 702                                  "PMKID found from PMKSA cache "
 703                                  "eap_type=%d vlan_id=%d",
 704                                  sm->pmksa->eap_type_authsrv,
 705                                  sm->pmksa->vlan_id);
 706                 os_memcpy(wpa_auth->dot11RSNAPMKIDUsed, pmkid, PMKID_LEN);
 707         }
 708
 709         if (sm->wpa_ie == NULL || sm->wpa_ie_len < wpa_ie_len) {
 710                 os_free(sm->wpa_ie);
 711                 sm->wpa_ie = os_malloc(wpa_ie_len);
 712                 if (sm->wpa_ie == NULL)
 713                         return WPA_ALLOC_FAIL;
 714         }
 715         os_memcpy(sm->wpa_ie, wpa_ie, wpa_ie_len);
 716         sm->wpa_ie_len = wpa_ie_len;
 717
 718         return WPA_IE_OK;
 719 }
 720
 721
 722 /**
 723  * wpa_parse_generic - Parse EAPOL-Key Key Data Generic IEs
 724  * @pos: Pointer to the IE header
 725  * @end: Pointer to the end of the Key Data buffer
 726  * @ie: Pointer to parsed IE data
 727  * Returns: 0 on success, 1 if end mark is found, -1 on failure
 728  */
 729 static int wpa_parse_generic(const u8 *pos, const u8 *end,
 730                              struct wpa_eapol_ie_parse *ie)
 731 {
 732         if (pos[1] == 0)
 733                 return 1;
 734
 735         if (pos[1] >= 6 &&
 736             RSN_SELECTOR_GET(pos + 2) == WPA_OUI_TYPE &&
 737             pos[2 + WPA_SELECTOR_LEN] == 1 &&
 738             pos[2 + WPA_SELECTOR_LEN + 1] == 0) {
 739                 ie->wpa_ie = pos;
 740                 ie->wpa_ie_len = pos[1] + 2;
 741                 return 0;
 742         }
 743
 744         if (pos + 1 + RSN_SELECTOR_LEN < end &&
 745             pos[1] >= RSN_SELECTOR_LEN + PMKID_LEN &&
 746             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_PMKID) {
 747                 ie->pmkid = pos + 2 + RSN_SELECTOR_LEN;
 748                 return 0;
 749         }
 750
 751         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 752             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_GROUPKEY) {
 753                 ie->gtk = pos + 2 + RSN_SELECTOR_LEN;
 754                 ie->gtk_len = pos[1] - RSN_SELECTOR_LEN;
 755                 return 0;
 756         }
 757
 758         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 759             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_MAC_ADDR) {
 760                 ie->mac_addr = pos + 2 + RSN_SELECTOR_LEN;
 761                 ie->mac_addr_len = pos[1] - RSN_SELECTOR_LEN;
 762                 return 0;
 763         }
 764
 765 #ifdef CONFIG_PEERKEY
 766         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 767             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_SMK) {
 768                 ie->smk = pos + 2 + RSN_SELECTOR_LEN;
 769                 ie->smk_len = pos[1] - RSN_SELECTOR_LEN;
 770                 return 0;
 771         }
 772
 773         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 774             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_NONCE) {
 775                 ie->nonce = pos + 2 + RSN_SELECTOR_LEN;
 776                 ie->nonce_len = pos[1] - RSN_SELECTOR_LEN;
 777                 return 0;
 778         }
 779
 780         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 781             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_LIFETIME) {
 782                 ie->lifetime = pos + 2 + RSN_SELECTOR_LEN;
 783                 ie->lifetime_len = pos[1] - RSN_SELECTOR_LEN;
 784                 return 0;
 785         }
 786
 787         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 788             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_ERROR) {
 789                 ie->error = pos + 2 + RSN_SELECTOR_LEN;
 790                 ie->error_len = pos[1] - RSN_SELECTOR_LEN;
 791                 return 0;
 792         }
 793 #endif /* CONFIG_PEERKEY */
 794
 795 #ifdef CONFIG_IEEE80211W
 796         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 797             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_IGTK) {
 798                 ie->igtk = pos + 2 + RSN_SELECTOR_LEN;
 799                 ie->igtk_len = pos[1] - RSN_SELECTOR_LEN;
 800                 return 0;
 801         }
 802 #endif /* CONFIG_IEEE80211W */
 803
 804         return 0;
 805 }
 806
 807
 808 /**
 809  * wpa_parse_kde_ies - Parse EAPOL-Key Key Data IEs
 810  * @buf: Pointer to the Key Data buffer
 811  * @len: Key Data Length
 812  * @ie: Pointer to parsed IE data
 813  * Returns: 0 on success, -1 on failure
 814  */
 815 int wpa_parse_kde_ies(const u8 *buf, size_t len, struct wpa_eapol_ie_parse *ie)
 816 {
 817         const u8 *pos, *end;
 818         int ret = 0;
 819
 820         os_memset(ie, 0, sizeof(*ie));
 821         for (pos = buf, end = pos + len; pos + 1 < end; pos += 2 + pos[1]) {
 822                 if (pos[0] == 0xdd &&
 823                     ((pos == buf + len - 1) || pos[1] == 0)) {
 824                         /* Ignore padding */
 825                         break;
 826                 }
 827                 if (pos + 2 + pos[1] > end) {
 828                         wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key Key Data "
 829                                    "underflow (ie=%d len=%d pos=%d)",
 830                                    pos[0], pos[1], (int) (pos - buf));
 831                         wpa_hexdump_key(MSG_DEBUG, "WPA: Key Data",
 832                                         buf, len);
 833                         ret = -1;
 834                         break;
 835                 }
 836                 if (*pos == WLAN_EID_RSN) {
 837                         ie->rsn_ie = pos;
 838                         ie->rsn_ie_len = pos[1] + 2;
 839 #ifdef CONFIG_IEEE80211R
 840                 } else if (*pos == WLAN_EID_MOBILITY_DOMAIN) {
 841                         ie->mdie = pos;
 842                         ie->mdie_len = pos[1] + 2;
 843 #endif /* CONFIG_IEEE80211R */
 844                 } else if (*pos == WLAN_EID_VENDOR_SPECIFIC) {
 845                         ret = wpa_parse_generic(pos, end, ie);
 846                         if (ret < 0)
 847                                 break;
 848                         if (ret > 0) {
 849                                 ret = 0;
 850                                 break;
 851                         }
 852                 } else {
 853                         wpa_hexdump(MSG_DEBUG, "WPA: Unrecognized EAPOL-Key "
 854                                     "Key Data IE", pos, 2 + pos[1]);
 855                 }
 856         }
 857
 858         return ret;
 859 }
 860
 861
 862 int wpa_auth_uses_mfp(struct wpa_state_machine *sm)
 863 {
 864         return sm ? sm->mgmt_frame_prot : 0;
 865 }