Add support for AKM suite 00-0F-AC:23

Add support for Authentication negotiated over IEEE Std 802.1X
with key derivation function using SHA-384.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>

diff --git a/hostapd/config_file.c b/hostapd/config_file.c
index 4f3050841fc6924788c60e6b87ad204b8d8b4a25..7cf0ccfbe038ce809407beccc00513f51905514e 100644 (file)
--- a/hostapd/config_file.c
+++ b/hostapd/config_file.c
@@ -667,6 +667,10 @@ static int hostapd_config_parse_key_mgmt(int line, const char *value)
                        val |= WPA_KEY_MGMT_FT_IEEE8021X_SHA384;
 #endif /* CONFIG_SHA384 */
 #endif /* CONFIG_IEEE80211R_AP */
+#ifdef CONFIG_SHA384
+               else if (os_strcmp(start, "WPA-EAP-SHA384") == 0)
+                       val |= WPA_KEY_MGMT_IEEE8021X_SHA384;
+#endif /* CONFIG_SHA384 */
                else if (os_strcmp(start, "WPA-PSK-SHA256") == 0)
                        val |= WPA_KEY_MGMT_PSK_SHA256;
                else if (os_strcmp(start, "WPA-EAP-SHA256") == 0)

diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
index 83efdee156e6235decf8076cfbbb26d57c108be0..f91bb1bcba5a422fd18069775092f0b4287017a3 100644 (file)
--- a/hostapd/ctrl_iface.c
+++ b/hostapd/ctrl_iface.c
@@ -956,6 +956,14 @@ static int hostapd_ctrl_iface_get_key_mgmt(struct hostapd_data *hapd,
                pos += ret;
        }
 #endif /* CONFIG_DPP */
+#ifdef CONFIG_SHA384
+       if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA384) {
+               ret = os_snprintf(pos, end - pos, "WPA-EAP-SHA384 ");
+               if (os_snprintf_error(end - pos, ret))
+                       return pos - buf;
+               pos += ret;
+       }
+#endif /* CONFIG_SHA384 */
 
        if (pos > buf && *(pos - 1) == ' ') {
                *(pos - 1) = '\0';

diff --git a/src/ap/wpa_auth_ie.c b/src/ap/wpa_auth_ie.c
index 43ccec9bed2aab04d51ff46c6bca293b6591a9d0..9b90e0749b84ac7631d4b4b5dff6bb4716407acc 100644 (file)
--- a/src/ap/wpa_auth_ie.c
+++ b/src/ap/wpa_auth_ie.c
@@ -212,6 +212,13 @@ int wpa_write_rsn_ie(struct wpa_auth_config *conf, u8 *buf, size_t len,
                num_suites++;
        }
 #endif /* CONFIG_IEEE80211R_AP */
+#ifdef CONFIG_SHA384
+       if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA384) {
+               RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SHA384);
+               pos += RSN_SELECTOR_LEN;
+               num_suites++;
+       }
+#endif /* CONFIG_SHA384 */
        if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) {
                RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SHA256);
                pos += RSN_SELECTOR_LEN;
@@ -705,6 +712,10 @@ wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth,
                else if (data.key_mgmt & WPA_KEY_MGMT_OSEN)
                        selector = RSN_AUTH_KEY_MGMT_OSEN;
 #endif /* CONFIG_HS20 */
+#ifdef CONFIG_SHA384
+               else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA384)
+                       selector = RSN_AUTH_KEY_MGMT_802_1X_SHA384;
+#endif /* CONFIG_SHA384 */
                wpa_auth->dot11RSNAAuthenticationSuiteSelected = selector;
 
                selector = wpa_cipher_to_suite(WPA_PROTO_RSN,
@@ -787,6 +798,10 @@ wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth,
        else if (key_mgmt & WPA_KEY_MGMT_FT_PSK)
                sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_PSK;
 #endif /* CONFIG_IEEE80211R_AP */
+#ifdef CONFIG_SHA384
+       else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA384)
+               sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA384;
+#endif /* CONFIG_SHA384 */
        else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256)
                sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
        else if (key_mgmt & WPA_KEY_MGMT_PSK_SHA256)

diff --git a/src/common/defs.h b/src/common/defs.h
index c0c6dbe843d96105ee2d483b69092f00d5079d1d..8cca094e8f14ae20611750afd07263df77858ae8 100644 (file)
--- a/src/common/defs.h
+++ b/src/common/defs.h
@@ -52,6 +52,7 @@
 #define WPA_KEY_MGMT_PASN BIT(25)
 #define WPA_KEY_MGMT_SAE_EXT_KEY BIT(26)
 #define WPA_KEY_MGMT_FT_SAE_EXT_KEY BIT(27)
+#define WPA_KEY_MGMT_IEEE8021X_SHA384 BIT(28)
 
 
 #define WPA_KEY_MGMT_FT (WPA_KEY_MGMT_FT_PSK | \
@@ -75,7 +76,8 @@ static inline int wpa_key_mgmt_wpa_ieee8021x(int akm)
                         WPA_KEY_MGMT_FILS_SHA256 |
                         WPA_KEY_MGMT_FILS_SHA384 |
                         WPA_KEY_MGMT_FT_FILS_SHA256 |
-                        WPA_KEY_MGMT_FT_FILS_SHA384));
+                        WPA_KEY_MGMT_FT_FILS_SHA384 |
+                        WPA_KEY_MGMT_IEEE8021X_SHA384));
 }
 
 static inline int wpa_key_mgmt_wpa_psk_no_sae(int akm)
@@ -153,7 +155,8 @@ static inline int wpa_key_mgmt_sha384(int akm)
        return !!(akm & (WPA_KEY_MGMT_IEEE8021X_SUITE_B_192 |
                         WPA_KEY_MGMT_FT_IEEE8021X_SHA384 |
                         WPA_KEY_MGMT_FILS_SHA384 |
-                        WPA_KEY_MGMT_FT_FILS_SHA384));
+                        WPA_KEY_MGMT_FT_FILS_SHA384 |
+                        WPA_KEY_MGMT_IEEE8021X_SHA384));
 }
 
 static inline int wpa_key_mgmt_suite_b(int akm)

diff --git a/src/common/wpa_common.c b/src/common/wpa_common.c
index ead724baf72266d16cfc09f0799764dd42e7ab58..d897e0eca61ccbc8b4185712deb38388ea6218f3 100644 (file)
--- a/src/common/wpa_common.c
+++ b/src/common/wpa_common.c
@@ -26,6 +26,7 @@ static unsigned int wpa_kck_len(int akmp, size_t pmk_len)
 {
        switch (akmp) {
        case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
+       case WPA_KEY_MGMT_IEEE8021X_SHA384:
        case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
                return 24;
        case WPA_KEY_MGMT_FILS_SHA256:
@@ -71,6 +72,7 @@ static unsigned int wpa_kek_len(int akmp, size_t pmk_len)
        case WPA_KEY_MGMT_FILS_SHA256:
        case WPA_KEY_MGMT_FT_FILS_SHA256:
        case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
+       case WPA_KEY_MGMT_IEEE8021X_SHA384:
                return 32;
        case WPA_KEY_MGMT_DPP:
                return pmk_len <= 32 ? 16 : 32;
@@ -105,6 +107,7 @@ unsigned int wpa_mic_len(int akmp, size_t pmk_len)
        switch (akmp) {
        case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
        case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
+       case WPA_KEY_MGMT_IEEE8021X_SHA384:
                return 24;
        case WPA_KEY_MGMT_FILS_SHA256:
        case WPA_KEY_MGMT_FILS_SHA384:
@@ -135,6 +138,7 @@ int wpa_use_akm_defined(int akmp)
                akmp == WPA_KEY_MGMT_OWE ||
                akmp == WPA_KEY_MGMT_DPP ||
                akmp == WPA_KEY_MGMT_FT_IEEE8021X_SHA384 ||
+               akmp == WPA_KEY_MGMT_IEEE8021X_SHA384 ||
                wpa_key_mgmt_sae(akmp) ||
                wpa_key_mgmt_suite_b(akmp) ||
                wpa_key_mgmt_fils(akmp);
@@ -173,6 +177,7 @@ int wpa_use_aes_key_wrap(int akmp)
        return akmp == WPA_KEY_MGMT_OSEN ||
                akmp == WPA_KEY_MGMT_OWE ||
                akmp == WPA_KEY_MGMT_DPP ||
+               akmp == WPA_KEY_MGMT_IEEE8021X_SHA384 ||
                wpa_key_mgmt_ft(akmp) ||
                wpa_key_mgmt_sha256(akmp) ||
                wpa_key_mgmt_sae(akmp) ||
@@ -331,15 +336,18 @@ int wpa_eapol_key_mic(const u8 *key, size_t key_len, int akmp, int ver,
                        os_memcpy(mic, hash, key_len);
                        break;
 #endif /* CONFIG_DPP */
-#if defined(CONFIG_IEEE80211R) && defined(CONFIG_SHA384)
+#ifdef CONFIG_SHA384
+               case WPA_KEY_MGMT_IEEE8021X_SHA384:
+#ifdef CONFIG_IEEE80211R
                case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
+#endif /* CONFIG_IEEE80211R */
                        wpa_printf(MSG_DEBUG,
-                                  "WPA: EAPOL-Key MIC using HMAC-SHA384 (AKM-defined - FT 802.1X SHA384)");
+                                  "WPA: EAPOL-Key MIC using HMAC-SHA384 (AKM-defined - 802.1X SHA384)");
                        if (hmac_sha384(key, key_len, buf, len, hash))
                                return -1;
                        os_memcpy(mic, hash, 24);
                        break;
-#endif /* CONFIG_IEEE80211R && CONFIG_SHA384 */
+#endif /* CONFIG_SHA384 */
                default:
                        wpa_printf(MSG_DEBUG,
                                   "WPA: EAPOL-Key MIC algorithm not known (AKM-defined - akmp=0x%x)",
@@ -454,14 +462,14 @@ int wpa_pmk_to_ptk(const u8 *pmk, size_t pmk_len, const char *label,
        ptk_len = ptk->kck_len + ptk->kek_len + ptk->tk_len + ptk->kdk_len;
 
        if (wpa_key_mgmt_sha384(akmp)) {
-#if defined(CONFIG_SUITEB192) || defined(CONFIG_FILS)
+#ifdef CONFIG_SHA384
                wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA384)");
                if (sha384_prf(pmk, pmk_len, label, data, data_len,
                               tmp, ptk_len) < 0)
                        return -1;
-#else /* CONFIG_SUITEB192 || CONFIG_FILS */
+#else /* CONFIG_SHA384 */
                return -1;
-#endif /* CONFIG_SUITEB192 || CONFIG_FILS */
+#endif /* CONFIG_SHA384 */
        } else if (wpa_key_mgmt_sha256(akmp)) {
                wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA256)");
                if (sha256_prf(pmk, pmk_len, label, data, data_len,
@@ -1771,6 +1779,10 @@ static int rsn_key_mgmt_to_bitfield(const u8 *s)
                return WPA_KEY_MGMT_FT_IEEE8021X_SHA384;
 #endif /* CONFIG_SHA384 */
 #endif /* CONFIG_IEEE80211R */
+#ifdef CONFIG_SHA384
+       if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_802_1X_SHA384)
+               return WPA_KEY_MGMT_IEEE8021X_SHA384;
+#endif /* CONFIG_SHA384 */
        if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_802_1X_SHA256)
                return WPA_KEY_MGMT_IEEE8021X_SHA256;
        if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_PSK_SHA256)
@@ -2787,6 +2799,8 @@ const char * wpa_key_mgmt_txt(int key_mgmt, int proto)
                return "DPP";
        case WPA_KEY_MGMT_PASN:
                return "PASN";
+       case WPA_KEY_MGMT_IEEE8021X_SHA384:
+               return "WPA2-EAP-SHA384";
        default:
                return "UNKNOWN";
        }
@@ -2801,6 +2815,8 @@ u32 wpa_akm_to_suite(int akm)
                return RSN_AUTH_KEY_MGMT_FT_802_1X;
        if (akm & WPA_KEY_MGMT_FT_PSK)
                return RSN_AUTH_KEY_MGMT_FT_PSK;
+       if (akm & WPA_KEY_MGMT_IEEE8021X_SHA384)
+               return RSN_AUTH_KEY_MGMT_802_1X_SHA384;
        if (akm & WPA_KEY_MGMT_IEEE8021X_SHA256)
                return RSN_AUTH_KEY_MGMT_802_1X_SHA256;
        if (akm & WPA_KEY_MGMT_IEEE8021X)

diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
index 25bae2805cdee1d3171090653fc1257d8a9b92cb..d686dbd45aeb10d28c683b412c2961ef7d064ec1 100644 (file)
--- a/src/drivers/driver_nl80211.c
+++ b/src/drivers/driver_nl80211.c
@@ -3284,6 +3284,7 @@ static int wpa_key_mgmt_to_suites(unsigned int key_mgmt_suites, u32 suites[],
        __AKM(OWE, OWE);
        __AKM(DPP, DPP);
        __AKM(FT_IEEE8021X_SHA384, FT_802_1X_SHA384);
+       __AKM(IEEE8021X_SHA384, 802_1X_SHA384);
 #undef __AKM
 
        return num_suites;
@@ -6503,7 +6504,8 @@ retry:
        if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
            params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
            params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
-           params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256) {
+           params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
+           params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA384) {
                wpa_printf(MSG_DEBUG, "  * control port");
                if (nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT))
                        goto fail;
@@ -6803,7 +6805,8 @@ static int nl80211_connect_common(struct wpa_driver_nl80211_data *drv,
            params->key_mgmt_suite == WPA_KEY_MGMT_FT_FILS_SHA256 ||
            params->key_mgmt_suite == WPA_KEY_MGMT_FT_FILS_SHA384 ||
            params->key_mgmt_suite == WPA_KEY_MGMT_OWE ||
-           params->key_mgmt_suite == WPA_KEY_MGMT_DPP) {
+           params->key_mgmt_suite == WPA_KEY_MGMT_DPP ||
+           params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA384) {
                u32 *mgmt;
                unsigned int akm_count = 1, i;
 
@@ -6887,6 +6890,9 @@ static int nl80211_connect_common(struct wpa_driver_nl80211_data *drv,
                case WPA_KEY_MGMT_DPP:
                        mgmt[0] = RSN_AUTH_KEY_MGMT_DPP;
                        break;
+               case WPA_KEY_MGMT_IEEE8021X_SHA384:
+                       mgmt[0] = RSN_AUTH_KEY_MGMT_802_1X_SHA384;
+                       break;
                case WPA_KEY_MGMT_PSK:
                default:
                        mgmt[0] = RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X;

diff --git a/src/rsn_supp/preauth.c b/src/rsn_supp/preauth.c
index 8f86820a768a986b7494b5190190107ba72612fe..1a288844a1ada695594c263c6f895a6cfd47a2c6 100644 (file)
--- a/src/rsn_supp/preauth.c
+++ b/src/rsn_supp/preauth.c
@@ -54,7 +54,8 @@ static int rsn_preauth_key_mgmt(int akmp)
        return !!(akmp & (WPA_KEY_MGMT_IEEE8021X |
                          WPA_KEY_MGMT_IEEE8021X_SHA256 |
                          WPA_KEY_MGMT_IEEE8021X_SUITE_B |
-                         WPA_KEY_MGMT_IEEE8021X_SUITE_B_192));
+                         WPA_KEY_MGMT_IEEE8021X_SUITE_B_192 |
+                         WPA_KEY_MGMT_IEEE8021X_SHA384));
 }
 
 

diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
index 856fe09e6fb7dd4880ec1b0742ac3e305060cad5..6d448d07167fb27ff5d014b1382d1337dcecc3a0 100644 (file)
--- a/src/rsn_supp/wpa.c
+++ b/src/rsn_supp/wpa.c
@@ -3828,6 +3828,8 @@ static u32 wpa_key_mgmt_suite(struct wpa_sm *sm)
                return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B;
        case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
                return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192;
+       case WPA_KEY_MGMT_IEEE8021X_SHA384:
+               return RSN_AUTH_KEY_MGMT_802_1X_SHA384;
        default:
                return 0;
        }

diff --git a/src/rsn_supp/wpa_ie.c b/src/rsn_supp/wpa_ie.c
index 2a6c79b2639a986410da66f9b6029e7043f69d67..d1510aad788c3fde320a69424dd70e19a0755956 100644 (file)
--- a/src/rsn_supp/wpa_ie.c
+++ b/src/rsn_supp/wpa_ie.c
@@ -230,6 +230,10 @@ static int wpa_gen_wpa_ie_rsn(u8 *rsn_ie, size_t rsn_ie_len,
        } else if (key_mgmt & WPA_KEY_MGMT_OSEN) {
                RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_OSEN);
 #endif /* CONFIG_HS20 */
+#ifdef CONFIG_SHA384
+       } else if (key_mgmt == WPA_KEY_MGMT_IEEE8021X_SHA384) {
+               RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SHA384);
+#endif /* CONFIG_SHA384 */
        } else {
                wpa_printf(MSG_WARNING, "Invalid key management type (%d).",
                           key_mgmt);

diff --git a/wlantest/bss.c b/wlantest/bss.c
index 01c9c624273958d785c864b8855d9c9ea531c046..7b669966f64db5c1a6a15f7c25325212e6b6f55c 100644 (file)
--- a/wlantest/bss.c
+++ b/wlantest/bss.c
@@ -335,7 +335,7 @@ void bss_update(struct wlantest *wt, struct wlantest_bss *bss,
                   "pairwise=%s%s%s%s%s%s%s"
                   "group=%s%s%s%s%s%s%s%s%s"
                   "mgmt_group_cipher=%s%s%s%s%s"
-                  "key_mgmt=%s%s%s%s%s%s%s%s%s%s%s%s%s%s"
+                  "key_mgmt=%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s"
                   "rsn_capab=%s%s%s%s%s%s%s%s%s%s",
                   MAC2STR(bss->bssid),
                   bss->proto == 0 ? "OPEN " : "",
@@ -387,6 +387,8 @@ void bss_update(struct wlantest *wt, struct wlantest_bss *bss,
                   "EAP-SUITE-B " : "",
                   bss->key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192 ?
                   "EAP-SUITE-B-192 " : "",
+                  bss->key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA384 ?
+                  "EAP-SHA384 " : "",
                   bss->rsn_capab & WPA_CAPABILITY_PREAUTH ? "PREAUTH " : "",
                   bss->rsn_capab & WPA_CAPABILITY_NO_PAIRWISE ?
                   "NO_PAIRWISE " : "",

diff --git a/wlantest/ctrl.c b/wlantest/ctrl.c
index 587a0d3e1dfa86d2f2a8007a6ddd0ddcef018339..68a2b410cae34ba1aaf48d8ae0f7dd469a41b160 100644 (file)
--- a/wlantest/ctrl.c
+++ b/wlantest/ctrl.c
@@ -957,6 +957,9 @@ static void info_print_key_mgmt(char *buf, size_t len, int key_mgmt)
        if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
                pos += os_snprintf(pos, end - pos, "%sEAP-SUITE-B-192",
                                   pos == buf ? "" : " ");
+       if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA384)
+               pos += os_snprintf(pos, end - pos, "%sEAP-SHA384",
+                                  pos == buf ? "" : " ");
 }
 
 

diff --git a/wlantest/sta.c b/wlantest/sta.c
index 6c6c6235af24c69175a3e889f3ce73163e253e54..dc23e545741e94b5bc6a007e05e1dd2c0986ebf6 100644 (file)
--- a/wlantest/sta.c
+++ b/wlantest/sta.c
@@ -252,7 +252,7 @@ skip_rsn_wpa:
        wpa_printf(MSG_INFO, "STA " MACSTR
                   " proto=%s%s%s%s"
                   "pairwise=%s%s%s%s%s%s%s"
-                  "key_mgmt=%s%s%s%s%s%s%s%s%s%s%s%s%s%s"
+                  "key_mgmt=%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s"
                   "rsn_capab=%s%s%s%s%s%s%s%s%s%s",
                   MAC2STR(sta->addr),
                   sta->proto == 0 ? "OPEN " : "",
@@ -286,6 +286,8 @@ skip_rsn_wpa:
                   "EAP-SUITE-B " : "",
                   sta->key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192 ?
                   "EAP-SUITE-B-192 " : "",
+                  sta->key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA384 ?
+                  "EAP-SHA384 " : "",
                   sta->rsn_capab & WPA_CAPABILITY_PREAUTH ? "PREAUTH " : "",
                   sta->rsn_capab & WPA_CAPABILITY_NO_PAIRWISE ?
                   "NO_PAIRWISE " : "",

diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c
index 15feba95d53f41483d8bba4bf97eff89da3220dc..a554b7b5cc55a6029210a9791ebab2de5b758939 100644 (file)
--- a/wpa_supplicant/config.c
+++ b/wpa_supplicant/config.c
@@ -793,6 +793,10 @@ static int wpa_config_parse_key_mgmt(const struct parse_data *data,
                        val |= WPA_KEY_MGMT_FT_IEEE8021X_SHA384;
 #endif /* CONFIG_SHA384 */
 #endif /* CONFIG_IEEE80211R */
+#ifdef CONFIG_SHA384
+               else if (os_strcmp(start, "WPA-EAP-SHA384") == 0)
+                       val |= WPA_KEY_MGMT_IEEE8021X_SHA384;
+#endif /* CONFIG_SHA384 */
                else if (os_strcmp(start, "WPA-PSK-SHA256") == 0)
                        val |= WPA_KEY_MGMT_PSK_SHA256;
                else if (os_strcmp(start, "WPA-EAP-SHA256") == 0)
@@ -965,6 +969,18 @@ static char * wpa_config_write_key_mgmt(const struct parse_data *data,
 #endif /* CONFIG_SHA384 */
 #endif /* CONFIG_IEEE80211R */
 
+#ifdef CONFIG_SHA384
+       if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA384) {
+               ret = os_snprintf(pos, end - pos, "%sWPA-EAP-SHA384",
+                                 pos == buf ? "" : " ");
+               if (os_snprintf_error(end - pos, ret)) {
+                       end[-1] = '\0';
+                       return buf;
+               }
+               pos += ret;
+       }
+#endif /* CONFIG_SHA384 */
+
        if (ssid->key_mgmt & WPA_KEY_MGMT_PSK_SHA256) {
                ret = os_snprintf(pos, end - pos, "%sWPA-PSK-SHA256",
                                  pos == buf ? "" : " ");

diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c
index 604b969d10921c1cd3fb06134dc58d6110f31a0d..a68802e4935cca5e01dd0138b19421c0de95f4a5 100644 (file)
--- a/wpa_supplicant/ctrl_iface.c
+++ b/wpa_supplicant/ctrl_iface.c
@@ -2967,6 +2967,16 @@ static char * wpa_supplicant_ie_txt(char *pos, char *end, const char *proto,
                pos += ret;
        }
 
+#ifdef CONFIG_SHA384
+       if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA384) {
+               ret = os_snprintf(pos, end - pos, "%sEAP-SHA384",
+                                 pos == start ? "" : "+");
+               if (os_snprintf_error(end - pos, ret))
+                       return pos;
+               pos += ret;
+       }
+#endif /* CONFIG_SHA384 */
+
        pos = wpa_supplicant_cipher_txt(pos, end, data.pairwise_cipher);
 
        if (data.capabilities & WPA_CAPABILITY_PREAUTH) {

diff --git a/wpa_supplicant/dbus/dbus_new_handlers.c b/wpa_supplicant/dbus/dbus_new_handlers.c
index cd1a59a11844fe11d299565846442dc933b300f6..f9c59a182fe21e4ee3daef7dffba3bfbbb9cc512 100644 (file)
--- a/wpa_supplicant/dbus/dbus_new_handlers.c
+++ b/wpa_supplicant/dbus/dbus_new_handlers.c
@@ -5303,7 +5303,7 @@ static dbus_bool_t wpas_dbus_get_bss_security_prop(
        DBusMessageIter iter_dict, variant_iter;
        const char *group;
        const char *pairwise[5]; /* max 5 pairwise ciphers is supported */
-       const char *key_mgmt[18]; /* max 18 key managements may be supported */
+       const char *key_mgmt[19]; /* max 19 key managements may be supported */
        int n;
 
        if (!dbus_message_iter_open_container(iter, DBUS_TYPE_VARIANT,
@@ -5366,6 +5366,10 @@ static dbus_bool_t wpas_dbus_get_bss_security_prop(
 #endif /* CONFIG_OWE */
        if (ie_data->key_mgmt & WPA_KEY_MGMT_NONE)
                key_mgmt[n++] = "wpa-none";
+#ifdef CONFIG_SHA384
+       if (ie_data->key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA384)
+               key_mgmt[n++] = "wpa-eap-sha384";
+#endif /* CONFIG_SHA384 */
 
        if (!wpa_dbus_dict_append_string_array(&iter_dict, "KeyMgmt",
                                               key_mgmt, n))

diff --git a/wpa_supplicant/dpp_supplicant.c b/wpa_supplicant/dpp_supplicant.c
index afadd789f73ab39c342adf5c4d7e843ea1d411c2..a436fa564d3e9083e05aa4c67f2f2bded44602c9 100644 (file)
--- a/wpa_supplicant/dpp_supplicant.c
+++ b/wpa_supplicant/dpp_supplicant.c
@@ -1362,7 +1362,7 @@ static struct wpa_ssid * wpas_dpp_add_network(struct wpa_supplicant *wpa_s,
 
                ssid->key_mgmt = WPA_KEY_MGMT_IEEE8021X |
                        WPA_KEY_MGMT_IEEE8021X_SHA256 |
-                       WPA_KEY_MGMT_IEEE8021X_SHA256;
+                       WPA_KEY_MGMT_IEEE8021X_SHA384;
                ssid->ieee80211w = MGMT_FRAME_PROTECTION_OPTIONAL;
 
                if (conf->cacert) {

diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index 4c305830c77ad35cb633c9e9fff159686cd79a85..24f41c9ba285ba238d952bfe4a0029414824b772 100644 (file)
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -1804,6 +1804,12 @@ int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
                wpa_dbg(wpa_s, MSG_DEBUG,
                        "WPA: using KEY_MGMT 802.1X with Suite B");
 #endif /* CONFIG_SUITEB */
+#ifdef CONFIG_SHA384
+       } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA384) {
+               wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA384;
+               wpa_dbg(wpa_s, MSG_DEBUG,
+                       "WPA: using KEY_MGMT 802.1X with SHA384");
+#endif /* CONFIG_SHA384 */
 #ifdef CONFIG_FILS
 #ifdef CONFIG_IEEE80211R
        } else if (sel & WPA_KEY_MGMT_FT_FILS_SHA384) {
@@ -4282,14 +4288,17 @@ static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
            (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
             params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
             params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
-            params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192))
+            params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192 ||
+            params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA384))
                params.req_handshake_offload = 1;
 
        if (wpa_s->conf->key_mgmt_offload) {
                if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
                    params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
                    params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
-                   params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
+                   params.key_mgmt_suite ==
+                   WPA_KEY_MGMT_IEEE8021X_SUITE_B_192 ||
+                   params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA384)
                        params.req_key_mgmt_offload =
                                ssid->proactive_key_caching < 0 ?
                                wpa_s->conf->okc : ssid->proactive_key_caching;

diff --git a/wpa_supplicant/wpas_glue.c b/wpa_supplicant/wpas_glue.c
index 80ac7c8209f4165bfebf5ac239e81e6538c658f7..1d9ad4ba43b7ef3ec3120a68952faef31805cdb6 100644 (file)
--- a/wpa_supplicant/wpas_glue.c
+++ b/wpa_supplicant/wpas_glue.c
@@ -1332,7 +1332,8 @@ void wpas_transition_disable(struct wpa_supplicant *wpa_s, u8 bitmap)
            wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
            (ssid->key_mgmt & (WPA_KEY_MGMT_IEEE8021X |
                               WPA_KEY_MGMT_FT_IEEE8021X |
-                              WPA_KEY_MGMT_IEEE8021X_SHA256)) &&
+                              WPA_KEY_MGMT_IEEE8021X_SHA256 |
+                              WPA_KEY_MGMT_IEEE8021X_SHA384)) &&
            (ssid->ieee80211w != MGMT_FRAME_PROTECTION_REQUIRED ||
             (ssid->group_cipher & WPA_CIPHER_TKIP))) {
                disable_wpa_wpa2(ssid);