1 /*
2 * hostapd - WPA/RSN IE and KDE definitions
3 * Copyright (c) 2004-2018, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "utils/includes.h"
10
11 #include "utils/common.h"
12 #include "common/ieee802_11_defs.h"
13 #include "eapol_auth/eapol_auth_sm.h"
14 #include "ap_config.h"
15 #include "ieee802_11.h"
16 #include "wpa_auth.h"
17 #include "pmksa_cache_auth.h"
18 #include "wpa_auth_ie.h"
19 #include "wpa_auth_i.h"
20
21
22 #ifdef CONFIG_RSN_TESTING
23 int rsn_testing = 0;
24 #endif /* CONFIG_RSN_TESTING */
25
26
wpa_write_wpa_ie(struct wpa_auth_config * conf,u8 * buf,size_t len)27 static int wpa_write_wpa_ie(struct wpa_auth_config *conf, u8 *buf, size_t len)
28 {
29 struct wpa_ie_hdr *hdr;
30 int num_suites;
31 u8 *pos, *count;
32 u32 suite;
33
34 hdr = (struct wpa_ie_hdr *) buf;
35 hdr->elem_id = WLAN_EID_VENDOR_SPECIFIC;
36 RSN_SELECTOR_PUT(hdr->oui, WPA_OUI_TYPE);
37 WPA_PUT_LE16(hdr->version, WPA_VERSION);
38 pos = (u8 *) (hdr + 1);
39
40 suite = wpa_cipher_to_suite(WPA_PROTO_WPA, conf->wpa_group);
41 if (suite == 0) {
42 wpa_printf(MSG_DEBUG, "Invalid group cipher (%d).",
43 conf->wpa_group);
44 return -1;
45 }
46 RSN_SELECTOR_PUT(pos, suite);
47 pos += WPA_SELECTOR_LEN;
48
49 count = pos;
50 pos += 2;
51
52 num_suites = wpa_cipher_put_suites(pos, conf->wpa_pairwise);
53 if (num_suites == 0) {
54 wpa_printf(MSG_DEBUG, "Invalid pairwise cipher (%d).",
55 conf->wpa_pairwise);
56 return -1;
57 }
58 pos += num_suites * WPA_SELECTOR_LEN;
59 WPA_PUT_LE16(count, num_suites);
60
61 num_suites = 0;
62 count = pos;
63 pos += 2;
64
65 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) {
66 RSN_SELECTOR_PUT(pos, WPA_AUTH_KEY_MGMT_UNSPEC_802_1X);
67 pos += WPA_SELECTOR_LEN;
68 num_suites++;
69 }
70 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) {
71 RSN_SELECTOR_PUT(pos, WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X);
72 pos += WPA_SELECTOR_LEN;
73 num_suites++;
74 }
75
76 if (num_suites == 0) {
77 wpa_printf(MSG_DEBUG, "Invalid key management type (%d).",
78 conf->wpa_key_mgmt);
79 return -1;
80 }
81 WPA_PUT_LE16(count, num_suites);
82
83 /* WPA Capabilities; use defaults, so no need to include it */
84
85 hdr->len = (pos - buf) - 2;
86
87 return pos - buf;
88 }
89
90
wpa_own_rsn_capab(struct wpa_auth_config * conf)91 static u16 wpa_own_rsn_capab(struct wpa_auth_config *conf)
92 {
93 u16 capab = 0;
94
95 if (conf->rsn_preauth)
96 capab |= WPA_CAPABILITY_PREAUTH;
97 if (conf->wmm_enabled) {
98 /* 4 PTKSA replay counters when using WMM */
99 capab |= (RSN_NUM_REPLAY_COUNTERS_16 << 2);
100 }
101 if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) {
102 capab |= WPA_CAPABILITY_MFPC;
103 if (conf->ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED)
104 capab |= WPA_CAPABILITY_MFPR;
105 }
106 #ifdef CONFIG_OCV
107 if (conf->ocv)
108 capab |= WPA_CAPABILITY_OCVC;
109 #endif /* CONFIG_OCV */
110 #ifdef CONFIG_RSN_TESTING
111 if (rsn_testing)
112 capab |= BIT(8) | BIT(15);
113 #endif /* CONFIG_RSN_TESTING */
114 if (conf->extended_key_id)
115 capab |= WPA_CAPABILITY_EXT_KEY_ID_FOR_UNICAST;
116
117 return capab;
118 }
119
120
wpa_write_rsn_ie(struct wpa_auth_config * conf,u8 * buf,size_t len,const u8 * pmkid)121 int wpa_write_rsn_ie(struct wpa_auth_config *conf, u8 *buf, size_t len,
122 const u8 *pmkid)
123 {
124 struct rsn_ie_hdr *hdr;
125 int num_suites, res;
126 u8 *pos, *count;
127 u32 suite;
128
129 hdr = (struct rsn_ie_hdr *) buf;
130 hdr->elem_id = WLAN_EID_RSN;
131 WPA_PUT_LE16(hdr->version, RSN_VERSION);
132 pos = (u8 *) (hdr + 1);
133
134 suite = wpa_cipher_to_suite(WPA_PROTO_RSN, conf->wpa_group);
135 if (suite == 0) {
136 wpa_printf(MSG_DEBUG, "Invalid group cipher (%d).",
137 conf->wpa_group);
138 return -1;
139 }
140 RSN_SELECTOR_PUT(pos, suite);
141 pos += RSN_SELECTOR_LEN;
142
143 num_suites = 0;
144 count = pos;
145 pos += 2;
146
147 #ifdef CONFIG_RSN_TESTING
148 if (rsn_testing) {
149 RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 1));
150 pos += RSN_SELECTOR_LEN;
151 num_suites++;
152 }
153 #endif /* CONFIG_RSN_TESTING */
154
155 res = rsn_cipher_put_suites(pos, conf->rsn_pairwise);
156 num_suites += res;
157 pos += res * RSN_SELECTOR_LEN;
158
159 #ifdef CONFIG_RSN_TESTING
160 if (rsn_testing) {
161 RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 2));
162 pos += RSN_SELECTOR_LEN;
163 num_suites++;
164 }
165 #endif /* CONFIG_RSN_TESTING */
166
167 if (num_suites == 0) {
168 wpa_printf(MSG_DEBUG, "Invalid pairwise cipher (%d).",
169 conf->rsn_pairwise);
170 return -1;
171 }
172 WPA_PUT_LE16(count, num_suites);
173
174 num_suites = 0;
175 count = pos;
176 pos += 2;
177
178 #ifdef CONFIG_RSN_TESTING
179 if (rsn_testing) {
180 RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 1));
181 pos += RSN_SELECTOR_LEN;
182 num_suites++;
183 }
184 #endif /* CONFIG_RSN_TESTING */
185
186 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) {
187 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_UNSPEC_802_1X);
188 pos += RSN_SELECTOR_LEN;
189 num_suites++;
190 }
191 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) {
192 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X);
193 pos += RSN_SELECTOR_LEN;
194 num_suites++;
195 }
196 #ifdef CONFIG_IEEE80211R_AP
197 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) {
198 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_802_1X);
199 pos += RSN_SELECTOR_LEN;
200 num_suites++;
201 }
202 #ifdef CONFIG_SHA384
203 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X_SHA384) {
204 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384);
205 pos += RSN_SELECTOR_LEN;
206 num_suites++;
207 }
208 #endif /* CONFIG_SHA384 */
209 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_PSK) {
210 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_PSK);
211 pos += RSN_SELECTOR_LEN;
212 num_suites++;
213 }
214 #endif /* CONFIG_IEEE80211R_AP */
215 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) {
216 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SHA256);
217 pos += RSN_SELECTOR_LEN;
218 num_suites++;
219 }
220 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK_SHA256) {
221 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PSK_SHA256);
222 pos += RSN_SELECTOR_LEN;
223 num_suites++;
224 }
225 #ifdef CONFIG_SAE
226 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_SAE) {
227 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_SAE);
228 pos += RSN_SELECTOR_LEN;
229 num_suites++;
230 }
231 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_SAE_EXT_KEY) {
232 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_SAE_EXT_KEY);
233 pos += RSN_SELECTOR_LEN;
234 num_suites++;
235 }
236 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_SAE) {
237 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_SAE);
238 pos += RSN_SELECTOR_LEN;
239 num_suites++;
240 }
241 #endif /* CONFIG_SAE */
242 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
243 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SUITE_B);
244 pos += RSN_SELECTOR_LEN;
245 num_suites++;
246 }
247 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
248 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192);
249 pos += RSN_SELECTOR_LEN;
250 num_suites++;
251 }
252 #ifdef CONFIG_FILS
253 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FILS_SHA256) {
254 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FILS_SHA256);
255 pos += RSN_SELECTOR_LEN;
256 num_suites++;
257 }
258 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FILS_SHA384) {
259 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FILS_SHA384);
260 pos += RSN_SELECTOR_LEN;
261 num_suites++;
262 }
263 #ifdef CONFIG_IEEE80211R_AP
264 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA256) {
265 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_FILS_SHA256);
266 pos += RSN_SELECTOR_LEN;
267 num_suites++;
268 }
269 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA384) {
270 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_FILS_SHA384);
271 pos += RSN_SELECTOR_LEN;
272 num_suites++;
273 }
274 #endif /* CONFIG_IEEE80211R_AP */
275 #endif /* CONFIG_FILS */
276 #ifdef CONFIG_OWE
277 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE) {
278 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_OWE);
279 pos += RSN_SELECTOR_LEN;
280 num_suites++;
281 }
282 #endif /* CONFIG_OWE */
283 #ifdef CONFIG_DPP
284 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_DPP) {
285 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_DPP);
286 pos += RSN_SELECTOR_LEN;
287 num_suites++;
288 }
289 #endif /* CONFIG_DPP */
290 #ifdef CONFIG_HS20
291 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_OSEN) {
292 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_OSEN);
293 pos += RSN_SELECTOR_LEN;
294 num_suites++;
295 }
296 #endif /* CONFIG_HS20 */
297 #ifdef CONFIG_PASN
298 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PASN) {
299 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PASN);
300 pos += RSN_SELECTOR_LEN;
301 num_suites++;
302 }
303 #endif /* CONFIG_PASN */
304
305 #ifdef CONFIG_RSN_TESTING
306 if (rsn_testing) {
307 RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 2));
308 pos += RSN_SELECTOR_LEN;
309 num_suites++;
310 }
311 #endif /* CONFIG_RSN_TESTING */
312
313 if (num_suites == 0) {
314 wpa_printf(MSG_DEBUG, "Invalid key management type (%d).",
315 conf->wpa_key_mgmt);
316 return -1;
317 }
318 WPA_PUT_LE16(count, num_suites);
319
320 /* RSN Capabilities */
321 WPA_PUT_LE16(pos, wpa_own_rsn_capab(conf));
322 pos += 2;
323
324 if (pmkid) {
325 if (2 + PMKID_LEN > buf + len - pos)
326 return -1;
327 /* PMKID Count */
328 WPA_PUT_LE16(pos, 1);
329 pos += 2;
330 os_memcpy(pos, pmkid, PMKID_LEN);
331 pos += PMKID_LEN;
332 }
333
334 if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION &&
335 conf->group_mgmt_cipher != WPA_CIPHER_AES_128_CMAC) {
336 if (2 + 4 > buf + len - pos)
337 return -1;
338 if (pmkid == NULL) {
339 /* PMKID Count */
340 WPA_PUT_LE16(pos, 0);
341 pos += 2;
342 }
343
344 /* Management Group Cipher Suite */
345 switch (conf->group_mgmt_cipher) {
346 case WPA_CIPHER_AES_128_CMAC:
347 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC);
348 break;
349 case WPA_CIPHER_BIP_GMAC_128:
350 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_BIP_GMAC_128);
351 break;
352 case WPA_CIPHER_BIP_GMAC_256:
353 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_BIP_GMAC_256);
354 break;
355 case WPA_CIPHER_BIP_CMAC_256:
356 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_BIP_CMAC_256);
357 break;
358 default:
359 wpa_printf(MSG_DEBUG,
360 "Invalid group management cipher (0x%x)",
361 conf->group_mgmt_cipher);
362 return -1;
363 }
364 pos += RSN_SELECTOR_LEN;
365 }
366
367 #ifdef CONFIG_RSN_TESTING
368 if (rsn_testing) {
369 /*
370 * Fill in any defined fields and add extra data to the end of
371 * the element.
372 */
373 int pmkid_count_set = pmkid != NULL;
374 if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION)
375 pmkid_count_set = 1;
376 /* PMKID Count */
377 WPA_PUT_LE16(pos, 0);
378 pos += 2;
379 if (conf->ieee80211w == NO_MGMT_FRAME_PROTECTION) {
380 /* Management Group Cipher Suite */
381 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC);
382 pos += RSN_SELECTOR_LEN;
383 }
384
385 os_memset(pos, 0x12, 17);
386 pos += 17;
387 }
388 #endif /* CONFIG_RSN_TESTING */
389
390 hdr->len = (pos - buf) - 2;
391
392 return pos - buf;
393 }
394
395
wpa_write_rsnxe(struct wpa_auth_config * conf,u8 * buf,size_t len)396 int wpa_write_rsnxe(struct wpa_auth_config *conf, u8 *buf, size_t len)
397 {
398 u8 *pos = buf;
399 u16 capab = 0;
400 size_t flen;
401
402 if (wpa_key_mgmt_sae(conf->wpa_key_mgmt) &&
403 (conf->sae_pwe == 1 || conf->sae_pwe == 2 || conf->sae_pk ||
404 wpa_key_mgmt_sae_ext_key(conf->wpa_key_mgmt))) {
405 capab |= BIT(WLAN_RSNX_CAPAB_SAE_H2E);
406 #ifdef CONFIG_SAE_PK
407 if (conf->sae_pk)
408 capab |= BIT(WLAN_RSNX_CAPAB_SAE_PK);
409 #endif /* CONFIG_SAE_PK */
410 }
411
412 if (conf->secure_ltf)
413 capab |= BIT(WLAN_RSNX_CAPAB_SECURE_LTF);
414 if (conf->secure_rtt)
415 capab |= BIT(WLAN_RSNX_CAPAB_SECURE_RTT);
416 if (conf->prot_range_neg)
417 capab |= BIT(WLAN_RSNX_CAPAB_PROT_RANGE_NEG);
418
419 flen = (capab & 0xff00) ? 2 : 1;
420 if (!capab)
421 return 0; /* no supported extended RSN capabilities */
422 if (len < 2 + flen)
423 return -1;
424 capab |= flen - 1; /* bit 0-3 = Field length (n - 1) */
425
426 *pos++ = WLAN_EID_RSNX;
427 *pos++ = flen;
428 *pos++ = capab & 0x00ff;
429 capab >>= 8;
430 if (capab)
431 *pos++ = capab;
432
433 return pos - buf;
434 }
435
436
wpa_write_osen(struct wpa_auth_config * conf,u8 * eid)437 static u8 * wpa_write_osen(struct wpa_auth_config *conf, u8 *eid)
438 {
439 u8 *len;
440 u16 capab;
441
442 *eid++ = WLAN_EID_VENDOR_SPECIFIC;
443 len = eid++; /* to be filled */
444 WPA_PUT_BE24(eid, OUI_WFA);
445 eid += 3;
446 *eid++ = HS20_OSEN_OUI_TYPE;
447
448 /* Group Data Cipher Suite */
449 RSN_SELECTOR_PUT(eid, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
450 eid += RSN_SELECTOR_LEN;
451
452 /* Pairwise Cipher Suite Count and List */
453 WPA_PUT_LE16(eid, 1);
454 eid += 2;
455 RSN_SELECTOR_PUT(eid, RSN_CIPHER_SUITE_CCMP);
456 eid += RSN_SELECTOR_LEN;
457
458 /* AKM Suite Count and List */
459 WPA_PUT_LE16(eid, 1);
460 eid += 2;
461 RSN_SELECTOR_PUT(eid, RSN_AUTH_KEY_MGMT_OSEN);
462 eid += RSN_SELECTOR_LEN;
463
464 /* RSN Capabilities */
465 capab = 0;
466 if (conf->wmm_enabled) {
467 /* 4 PTKSA replay counters when using WMM */
468 capab |= (RSN_NUM_REPLAY_COUNTERS_16 << 2);
469 }
470 if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) {
471 capab |= WPA_CAPABILITY_MFPC;
472 if (conf->ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED)
473 capab |= WPA_CAPABILITY_MFPR;
474 }
475 #ifdef CONFIG_OCV
476 if (conf->ocv)
477 capab |= WPA_CAPABILITY_OCVC;
478 #endif /* CONFIG_OCV */
479 WPA_PUT_LE16(eid, capab);
480 eid += 2;
481
482 *len = eid - len - 1;
483
484 return eid;
485 }
486
487
wpa_auth_gen_wpa_ie(struct wpa_authenticator * wpa_auth)488 int wpa_auth_gen_wpa_ie(struct wpa_authenticator *wpa_auth)
489 {
490 u8 *pos, buf[128];
491 int res;
492
493 #ifdef CONFIG_TESTING_OPTIONS
494 if (wpa_auth->conf.own_ie_override_len) {
495 wpa_hexdump(MSG_DEBUG, "WPA: Forced own IE(s) for testing",
496 wpa_auth->conf.own_ie_override,
497 wpa_auth->conf.own_ie_override_len);
498 os_free(wpa_auth->wpa_ie);
499 wpa_auth->wpa_ie =
500 os_malloc(wpa_auth->conf.own_ie_override_len);
501 if (wpa_auth->wpa_ie == NULL)
502 return -1;
503 os_memcpy(wpa_auth->wpa_ie, wpa_auth->conf.own_ie_override,
504 wpa_auth->conf.own_ie_override_len);
505 wpa_auth->wpa_ie_len = wpa_auth->conf.own_ie_override_len;
506 return 0;
507 }
508 #endif /* CONFIG_TESTING_OPTIONS */
509
510 pos = buf;
511
512 if (wpa_auth->conf.wpa == WPA_PROTO_OSEN) {
513 pos = wpa_write_osen(&wpa_auth->conf, pos);
514 }
515 if (wpa_auth->conf.wpa & WPA_PROTO_RSN) {
516 res = wpa_write_rsn_ie(&wpa_auth->conf,
517 pos, buf + sizeof(buf) - pos, NULL);
518 if (res < 0)
519 return res;
520 pos += res;
521 res = wpa_write_rsnxe(&wpa_auth->conf, pos,
522 buf + sizeof(buf) - pos);
523 if (res < 0)
524 return res;
525 pos += res;
526 }
527 #ifdef CONFIG_IEEE80211R_AP
528 if (wpa_key_mgmt_ft(wpa_auth->conf.wpa_key_mgmt)) {
529 res = wpa_write_mdie(&wpa_auth->conf, pos,
530 buf + sizeof(buf) - pos);
531 if (res < 0)
532 return res;
533 pos += res;
534 }
535 #endif /* CONFIG_IEEE80211R_AP */
536 if (wpa_auth->conf.wpa & WPA_PROTO_WPA) {
537 res = wpa_write_wpa_ie(&wpa_auth->conf,
538 pos, buf + sizeof(buf) - pos);
539 if (res < 0)
540 return res;
541 pos += res;
542 }
543
544 os_free(wpa_auth->wpa_ie);
545 wpa_auth->wpa_ie = os_malloc(pos - buf);
546 if (wpa_auth->wpa_ie == NULL)
547 return -1;
548 os_memcpy(wpa_auth->wpa_ie, buf, pos - buf);
549 wpa_auth->wpa_ie_len = pos - buf;
550
551 return 0;
552 }
553
554
wpa_add_kde(u8 * pos,u32 kde,const u8 * data,size_t data_len,const u8 * data2,size_t data2_len)555 u8 * wpa_add_kde(u8 *pos, u32 kde, const u8 *data, size_t data_len,
556 const u8 *data2, size_t data2_len)
557 {
558 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
559 *pos++ = RSN_SELECTOR_LEN + data_len + data2_len;
560 RSN_SELECTOR_PUT(pos, kde);
561 pos += RSN_SELECTOR_LEN;
562 os_memcpy(pos, data, data_len);
563 pos += data_len;
564 if (data2) {
565 os_memcpy(pos, data2, data2_len);
566 pos += data2_len;
567 }
568 return pos;
569 }
570
571
572 struct wpa_auth_okc_iter_data {
573 struct rsn_pmksa_cache_entry *pmksa;
574 const u8 *aa;
575 const u8 *spa;
576 const u8 *pmkid;
577 };
578
579
wpa_auth_okc_iter(struct wpa_authenticator * a,void * ctx)580 static int wpa_auth_okc_iter(struct wpa_authenticator *a, void *ctx)
581 {
582 struct wpa_auth_okc_iter_data *data = ctx;
583 data->pmksa = pmksa_cache_get_okc(a->pmksa, data->aa, data->spa,
584 data->pmkid);
585 if (data->pmksa)
586 return 1;
587 return 0;
588 }
589
590
591 enum wpa_validate_result
wpa_validate_wpa_ie(struct wpa_authenticator * wpa_auth,struct wpa_state_machine * sm,int freq,const u8 * wpa_ie,size_t wpa_ie_len,const u8 * rsnxe,size_t rsnxe_len,const u8 * mdie,size_t mdie_len,const u8 * owe_dh,size_t owe_dh_len)592 wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth,
593 struct wpa_state_machine *sm, int freq,
594 const u8 *wpa_ie, size_t wpa_ie_len,
595 const u8 *rsnxe, size_t rsnxe_len,
596 const u8 *mdie, size_t mdie_len,
597 const u8 *owe_dh, size_t owe_dh_len)
598 {
599 struct wpa_auth_config *conf = &wpa_auth->conf;
600 struct wpa_ie_data data;
601 int ciphers, key_mgmt, res, version;
602 u32 selector;
603 size_t i;
604 const u8 *pmkid = NULL;
605
606 if (wpa_auth == NULL || sm == NULL)
607 return WPA_NOT_ENABLED;
608
609 if (wpa_ie == NULL || wpa_ie_len < 1)
610 return WPA_INVALID_IE;
611
612 if (wpa_ie[0] == WLAN_EID_RSN)
613 version = WPA_PROTO_RSN;
614 else
615 version = WPA_PROTO_WPA;
616
617 if (!(wpa_auth->conf.wpa & version)) {
618 wpa_printf(MSG_DEBUG, "Invalid WPA proto (%d) from " MACSTR_SEC,
619 version, MAC2STR_SEC(sm->addr));
620 return WPA_INVALID_PROTO;
621 }
622
623 if (version == WPA_PROTO_RSN) {
624 res = wpa_parse_wpa_ie_rsn(wpa_ie, wpa_ie_len, &data);
625 if (!data.has_pairwise)
626 data.pairwise_cipher = wpa_default_rsn_cipher(freq);
627 if (!data.has_group)
628 data.group_cipher = wpa_default_rsn_cipher(freq);
629
630 if (wpa_key_mgmt_ft(data.key_mgmt) && !mdie &&
631 !wpa_key_mgmt_only_ft(data.key_mgmt)) {
632 /* Workaround for some HP and Epson printers that seem
633 * to incorrectly copy the FT-PSK + WPA-PSK AKMs from AP
634 * advertised RSNE to Association Request frame. */
635 wpa_printf(MSG_DEBUG,
636 "RSN: FT set in RSNE AKM but MDE is missing from "
637 MACSTR_SEC
638 " - ignore FT AKM(s) because there's also a non-FT AKM",
639 MAC2STR_SEC(sm->addr));
640 data.key_mgmt &= ~WPA_KEY_MGMT_FT;
641 }
642
643 selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X;
644 if (0) {
645 }
646 else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
647 selector = RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192;
648 else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B)
649 selector = RSN_AUTH_KEY_MGMT_802_1X_SUITE_B;
650 #ifdef CONFIG_FILS
651 #ifdef CONFIG_IEEE80211R_AP
652 else if (data.key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA384)
653 selector = RSN_AUTH_KEY_MGMT_FT_FILS_SHA384;
654 else if (data.key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA256)
655 selector = RSN_AUTH_KEY_MGMT_FT_FILS_SHA256;
656 #endif /* CONFIG_IEEE80211R_AP */
657 else if (data.key_mgmt & WPA_KEY_MGMT_FILS_SHA384)
658 selector = RSN_AUTH_KEY_MGMT_FILS_SHA384;
659 else if (data.key_mgmt & WPA_KEY_MGMT_FILS_SHA256)
660 selector = RSN_AUTH_KEY_MGMT_FILS_SHA256;
661 #endif /* CONFIG_FILS */
662 #ifdef CONFIG_IEEE80211R_AP
663 #ifdef CONFIG_SHA384
664 else if (data.key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X_SHA384)
665 selector = RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384;
666 #endif /* CONFIG_SHA384 */
667 else if (data.key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X)
668 selector = RSN_AUTH_KEY_MGMT_FT_802_1X;
669 else if (data.key_mgmt & WPA_KEY_MGMT_FT_PSK)
670 selector = RSN_AUTH_KEY_MGMT_FT_PSK;
671 #endif /* CONFIG_IEEE80211R_AP */
672 else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256)
673 selector = RSN_AUTH_KEY_MGMT_802_1X_SHA256;
674 else if (data.key_mgmt & WPA_KEY_MGMT_PSK_SHA256)
675 selector = RSN_AUTH_KEY_MGMT_PSK_SHA256;
676 #ifdef CONFIG_SAE
677 else if (data.key_mgmt & WPA_KEY_MGMT_SAE)
678 selector = RSN_AUTH_KEY_MGMT_SAE;
679 else if (data.key_mgmt & WPA_KEY_MGMT_SAE_EXT_KEY)
680 selector = RSN_AUTH_KEY_MGMT_SAE_EXT_KEY;
681 else if (data.key_mgmt & WPA_KEY_MGMT_FT_SAE)
682 selector = RSN_AUTH_KEY_MGMT_FT_SAE;
683 #endif /* CONFIG_SAE */
684 else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X)
685 selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X;
686 else if (data.key_mgmt & WPA_KEY_MGMT_PSK)
687 selector = RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X;
688 #ifdef CONFIG_OWE
689 else if (data.key_mgmt & WPA_KEY_MGMT_OWE)
690 selector = RSN_AUTH_KEY_MGMT_OWE;
691 #endif /* CONFIG_OWE */
692 #ifdef CONFIG_DPP
693 else if (data.key_mgmt & WPA_KEY_MGMT_DPP)
694 selector = RSN_AUTH_KEY_MGMT_DPP;
695 #endif /* CONFIG_DPP */
696 #ifdef CONFIG_HS20
697 else if (data.key_mgmt & WPA_KEY_MGMT_OSEN)
698 selector = RSN_AUTH_KEY_MGMT_OSEN;
699 #endif /* CONFIG_HS20 */
700 wpa_auth->dot11RSNAAuthenticationSuiteSelected = selector;
701
702 selector = wpa_cipher_to_suite(WPA_PROTO_RSN,
703 data.pairwise_cipher);
704 if (!selector)
705 selector = RSN_CIPHER_SUITE_CCMP;
706 wpa_auth->dot11RSNAPairwiseCipherSelected = selector;
707
708 selector = wpa_cipher_to_suite(WPA_PROTO_RSN,
709 data.group_cipher);
710 if (!selector)
711 selector = RSN_CIPHER_SUITE_CCMP;
712 wpa_auth->dot11RSNAGroupCipherSelected = selector;
713 } else {
714 res = wpa_parse_wpa_ie_wpa(wpa_ie, wpa_ie_len, &data);
715
716 selector = WPA_AUTH_KEY_MGMT_UNSPEC_802_1X;
717 if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X)
718 selector = WPA_AUTH_KEY_MGMT_UNSPEC_802_1X;
719 else if (data.key_mgmt & WPA_KEY_MGMT_PSK)
720 selector = WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X;
721 wpa_auth->dot11RSNAAuthenticationSuiteSelected = selector;
722
723 selector = wpa_cipher_to_suite(WPA_PROTO_WPA,
724 data.pairwise_cipher);
725 if (!selector)
726 selector = RSN_CIPHER_SUITE_TKIP;
727 wpa_auth->dot11RSNAPairwiseCipherSelected = selector;
728
729 selector = wpa_cipher_to_suite(WPA_PROTO_WPA,
730 data.group_cipher);
731 if (!selector)
732 selector = WPA_CIPHER_SUITE_TKIP;
733 wpa_auth->dot11RSNAGroupCipherSelected = selector;
734 }
735 if (res) {
736 wpa_printf(MSG_DEBUG, "Failed to parse WPA/RSN IE from "
737 MACSTR_SEC " (res=%d)", MAC2STR_SEC(sm->addr), res);
738 wpa_hexdump(MSG_DEBUG, "WPA/RSN IE", wpa_ie, wpa_ie_len);
739 return WPA_INVALID_IE;
740 }
741
742 if (data.group_cipher != wpa_auth->conf.wpa_group) {
743 wpa_printf(MSG_DEBUG, "Invalid WPA group cipher (0x%x) from "
744 MACSTR_SEC, data.group_cipher, MAC2STR_SEC(sm->addr));
745 return WPA_INVALID_GROUP;
746 }
747
748 key_mgmt = data.key_mgmt & wpa_auth->conf.wpa_key_mgmt;
749 if (!key_mgmt) {
750 wpa_printf(MSG_DEBUG, "Invalid WPA key mgmt (0x%x) from "
751 MACSTR_SEC, data.key_mgmt, MAC2STR_SEC(sm->addr));
752 return WPA_INVALID_AKMP;
753 }
754 if (0) {
755 }
756 else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
757 sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
758 else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B)
759 sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
760 #ifdef CONFIG_FILS
761 #ifdef CONFIG_IEEE80211R_AP
762 else if (key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA384)
763 sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_FILS_SHA384;
764 else if (data.key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA256)
765 sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_FILS_SHA256;
766 #endif /* CONFIG_IEEE80211R_AP */
767 else if (key_mgmt & WPA_KEY_MGMT_FILS_SHA384)
768 sm->wpa_key_mgmt = WPA_KEY_MGMT_FILS_SHA384;
769 else if (key_mgmt & WPA_KEY_MGMT_FILS_SHA256)
770 sm->wpa_key_mgmt = WPA_KEY_MGMT_FILS_SHA256;
771 #endif /* CONFIG_FILS */
772 #ifdef CONFIG_IEEE80211R_AP
773 #ifdef CONFIG_SHA384
774 else if (key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X_SHA384)
775 sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X_SHA384;
776 #endif /* CONFIG_SHA384 */
777 else if (key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X)
778 sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
779 else if (key_mgmt & WPA_KEY_MGMT_FT_PSK)
780 sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_PSK;
781 #endif /* CONFIG_IEEE80211R_AP */
782 else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256)
783 sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
784 else if (key_mgmt & WPA_KEY_MGMT_PSK_SHA256)
785 sm->wpa_key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
786 #ifdef CONFIG_SAE
787 else if (key_mgmt & WPA_KEY_MGMT_SAE)
788 sm->wpa_key_mgmt = WPA_KEY_MGMT_SAE;
789 else if (key_mgmt & WPA_KEY_MGMT_SAE_EXT_KEY)
790 sm->wpa_key_mgmt = WPA_KEY_MGMT_SAE_EXT_KEY;
791 else if (key_mgmt & WPA_KEY_MGMT_FT_SAE)
792 sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_SAE;
793 #endif /* CONFIG_SAE */
794 else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X)
795 sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X;
796 #ifdef CONFIG_OWE
797 else if (key_mgmt & WPA_KEY_MGMT_OWE)
798 sm->wpa_key_mgmt = WPA_KEY_MGMT_OWE;
799 #endif /* CONFIG_OWE */
800 #ifdef CONFIG_DPP
801 else if (key_mgmt & WPA_KEY_MGMT_DPP)
802 sm->wpa_key_mgmt = WPA_KEY_MGMT_DPP;
803 #endif /* CONFIG_DPP */
804 #ifdef CONFIG_HS20
805 else if (key_mgmt & WPA_KEY_MGMT_OSEN)
806 sm->wpa_key_mgmt = WPA_KEY_MGMT_OSEN;
807 #endif /* CONFIG_HS20 */
808 else
809 sm->wpa_key_mgmt = WPA_KEY_MGMT_PSK;
810
811 if (version == WPA_PROTO_RSN)
812 ciphers = data.pairwise_cipher & wpa_auth->conf.rsn_pairwise;
813 else
814 ciphers = data.pairwise_cipher & wpa_auth->conf.wpa_pairwise;
815 if (!ciphers) {
816 wpa_printf(MSG_DEBUG, "Invalid %s pairwise cipher (0x%x) "
817 "from " MACSTR_SEC,
818 version == WPA_PROTO_RSN ? "RSN" : "WPA",
819 data.pairwise_cipher, MAC2STR_SEC(sm->addr));
820 return WPA_INVALID_PAIRWISE;
821 }
822
823 if (wpa_auth->conf.ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED) {
824 if (!(data.capabilities & WPA_CAPABILITY_MFPC)) {
825 wpa_printf(MSG_DEBUG, "Management frame protection "
826 "required, but client did not enable it");
827 return WPA_MGMT_FRAME_PROTECTION_VIOLATION;
828 }
829
830 if (data.mgmt_group_cipher != wpa_auth->conf.group_mgmt_cipher)
831 {
832 wpa_printf(MSG_DEBUG, "Unsupported management group "
833 "cipher %d", data.mgmt_group_cipher);
834 return WPA_INVALID_MGMT_GROUP_CIPHER;
835 }
836 }
837
838 #ifdef CONFIG_SAE
839 if (wpa_auth->conf.ieee80211w == MGMT_FRAME_PROTECTION_OPTIONAL &&
840 wpa_auth->conf.sae_require_mfp &&
841 wpa_key_mgmt_sae(sm->wpa_key_mgmt) &&
842 !(data.capabilities & WPA_CAPABILITY_MFPC)) {
843 wpa_printf(MSG_DEBUG,
844 "Management frame protection required with SAE, but client did not enable it");
845 return WPA_MGMT_FRAME_PROTECTION_VIOLATION;
846 }
847 #endif /* CONFIG_SAE */
848
849 #ifdef CONFIG_OCV
850 if (wpa_auth->conf.ocv && (data.capabilities & WPA_CAPABILITY_OCVC) &&
851 !(data.capabilities & WPA_CAPABILITY_MFPC)) {
852 /* Some legacy MFP incapable STAs wrongly copy OCVC bit from
853 * AP RSN capabilities. To improve interoperability with such
854 * legacy STAs allow connection without enabling OCV when the
855 * workaround mode (ocv=2) is enabled.
856 */
857 if (wpa_auth->conf.ocv == 2) {
858 wpa_printf(MSG_DEBUG,
859 "Allow connecting MFP incapable and OCV capable STA without enabling OCV");
860 wpa_auth_set_ocv(sm, 0);
861 } else {
862 wpa_printf(MSG_DEBUG,
863 "Management frame protection required with OCV, but client did not enable it");
864 return WPA_MGMT_FRAME_PROTECTION_VIOLATION;
865 }
866 } else {
867 wpa_auth_set_ocv(sm, (data.capabilities & WPA_CAPABILITY_OCVC) ?
868 wpa_auth->conf.ocv : 0);
869 }
870 #endif /* CONFIG_OCV */
871
872 if (wpa_auth->conf.ieee80211w == NO_MGMT_FRAME_PROTECTION ||
873 !(data.capabilities & WPA_CAPABILITY_MFPC))
874 sm->mgmt_frame_prot = 0;
875 else
876 sm->mgmt_frame_prot = 1;
877
878 if (sm->mgmt_frame_prot && (ciphers & WPA_CIPHER_TKIP)) {
879 wpa_printf(MSG_DEBUG,
880 "Management frame protection cannot use TKIP");
881 return WPA_MGMT_FRAME_PROTECTION_VIOLATION;
882 }
883
884 #ifdef CONFIG_IEEE80211R_AP
885 if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) {
886 if (mdie == NULL || mdie_len < MOBILITY_DOMAIN_ID_LEN + 1) {
887 wpa_printf(MSG_DEBUG, "RSN: Trying to use FT, but "
888 "MDIE not included");
889 return WPA_INVALID_MDIE;
890 }
891 if (os_memcmp(mdie, wpa_auth->conf.mobility_domain,
892 MOBILITY_DOMAIN_ID_LEN) != 0) {
893 wpa_hexdump(MSG_DEBUG, "RSN: Attempted to use unknown "
894 "MDIE", mdie, MOBILITY_DOMAIN_ID_LEN);
895 return WPA_INVALID_MDIE;
896 }
897 } else if (mdie != NULL) {
898 wpa_printf(MSG_DEBUG,
899 "RSN: Trying to use non-FT AKM suite, but MDIE included");
900 return WPA_INVALID_AKMP;
901 }
902 #endif /* CONFIG_IEEE80211R_AP */
903
904 #ifdef CONFIG_OWE
905 if (sm->wpa_key_mgmt == WPA_KEY_MGMT_OWE && !owe_dh) {
906 wpa_printf(MSG_DEBUG,
907 "OWE: No Diffie-Hellman Parameter element");
908 return WPA_INVALID_AKMP;
909 }
910 #endif /* CONFIG_OWE */
911
912 #ifdef CONFIG_DPP2
913 if (sm->wpa_key_mgmt == WPA_KEY_MGMT_DPP &&
914 ((conf->dpp_pfs == 1 && !owe_dh) ||
915 (conf->dpp_pfs == 2 && owe_dh))) {
916 wpa_printf(MSG_DEBUG, "DPP: PFS %s",
917 conf->dpp_pfs == 1 ? "required" : "not allowed");
918 return WPA_DENIED_OTHER_REASON;
919 }
920 #endif /* CONFIG_DPP2 */
921
922 sm->pairwise = wpa_pick_pairwise_cipher(ciphers, 0);
923 if (sm->pairwise < 0)
924 return WPA_INVALID_PAIRWISE;
925
926 /* TODO: clear WPA/WPA2 state if STA changes from one to another */
927 if (wpa_ie[0] == WLAN_EID_RSN)
928 sm->wpa = WPA_VERSION_WPA2;
929 else
930 sm->wpa = WPA_VERSION_WPA;
931
932 #if defined(CONFIG_IEEE80211R_AP) && defined(CONFIG_FILS)
933 if ((sm->wpa_key_mgmt == WPA_KEY_MGMT_FT_FILS_SHA256 ||
934 sm->wpa_key_mgmt == WPA_KEY_MGMT_FT_FILS_SHA384) &&
935 (sm->auth_alg == WLAN_AUTH_FILS_SK ||
936 sm->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
937 sm->auth_alg == WLAN_AUTH_FILS_PK) &&
938 (data.num_pmkid != 1 || !data.pmkid || !sm->pmk_r1_name_valid ||
939 os_memcmp_const(data.pmkid, sm->pmk_r1_name,
940 WPA_PMK_NAME_LEN) != 0)) {
941 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
942 "No PMKR1Name match for FILS+FT");
943 return WPA_INVALID_PMKID;
944 }
945 #endif /* CONFIG_IEEE80211R_AP && CONFIG_FILS */
946
947 sm->pmksa = NULL;
948 for (i = 0; i < data.num_pmkid; i++) {
949 wpa_hexdump(MSG_DEBUG, "RSN IE: STA PMKID",
950 &data.pmkid[i * PMKID_LEN], PMKID_LEN);
951 sm->pmksa = pmksa_cache_auth_get(wpa_auth->pmksa, sm->addr,
952 &data.pmkid[i * PMKID_LEN]);
953 if (sm->pmksa) {
954 pmkid = sm->pmksa->pmkid;
955 break;
956 }
957 }
958 for (i = 0; sm->pmksa == NULL && wpa_auth->conf.okc &&
959 i < data.num_pmkid; i++) {
960 struct wpa_auth_okc_iter_data idata;
961 idata.pmksa = NULL;
962 idata.aa = wpa_auth->addr;
963 idata.spa = sm->addr;
964 idata.pmkid = &data.pmkid[i * PMKID_LEN];
965 wpa_auth_for_each_auth(wpa_auth, wpa_auth_okc_iter, &idata);
966 if (idata.pmksa) {
967 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
968 "OKC match for PMKID");
969 sm->pmksa = pmksa_cache_add_okc(wpa_auth->pmksa,
970 idata.pmksa,
971 wpa_auth->addr,
972 idata.pmkid);
973 pmkid = idata.pmkid;
974 break;
975 }
976 }
977 if (sm->pmksa && pmkid) {
978 struct vlan_description *vlan;
979
980 vlan = sm->pmksa->vlan_desc;
981 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
982 "PMKID found from PMKSA cache eap_type=%d vlan=%d%s",
983 sm->pmksa->eap_type_authsrv,
984 vlan ? vlan->untagged : 0,
985 (vlan && vlan->tagged[0]) ? "+" : "");
986 os_memcpy(wpa_auth->dot11RSNAPMKIDUsed, pmkid, PMKID_LEN);
987 }
988
989 #ifdef CONFIG_SAE
990 if (sm->wpa_key_mgmt == WPA_KEY_MGMT_SAE && data.num_pmkid &&
991 !sm->pmksa) {
992 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
993 "No PMKSA cache entry found for SAE");
994 return WPA_INVALID_PMKID;
995 }
996 #endif /* CONFIG_SAE */
997
998 #ifdef CONFIG_DPP
999 if (sm->wpa_key_mgmt == WPA_KEY_MGMT_DPP && !sm->pmksa) {
1000 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
1001 "No PMKSA cache entry found for DPP");
1002 return WPA_INVALID_PMKID;
1003 }
1004 #endif /* CONFIG_DPP */
1005
1006 if (conf->extended_key_id && sm->wpa == WPA_VERSION_WPA2 &&
1007 sm->pairwise != WPA_CIPHER_TKIP &&
1008 (data.capabilities & WPA_CAPABILITY_EXT_KEY_ID_FOR_UNICAST)) {
1009 sm->use_ext_key_id = true;
1010 if (conf->extended_key_id == 2 &&
1011 !wpa_key_mgmt_ft(sm->wpa_key_mgmt) &&
1012 !wpa_key_mgmt_fils(sm->wpa_key_mgmt))
1013 sm->keyidx_active = 1;
1014 else
1015 sm->keyidx_active = 0;
1016 wpa_printf(MSG_DEBUG,
1017 "RSN: Extended Key ID supported (start with %d)",
1018 sm->keyidx_active);
1019 } else {
1020 sm->use_ext_key_id = false;
1021 }
1022
1023 if (sm->wpa_ie == NULL || sm->wpa_ie_len < wpa_ie_len) {
1024 os_free(sm->wpa_ie);
1025 sm->wpa_ie = os_malloc(wpa_ie_len);
1026 if (sm->wpa_ie == NULL)
1027 return WPA_ALLOC_FAIL;
1028 }
1029 os_memcpy(sm->wpa_ie, wpa_ie, wpa_ie_len);
1030 sm->wpa_ie_len = wpa_ie_len;
1031
1032 if (rsnxe && rsnxe_len) {
1033 if (!sm->rsnxe || sm->rsnxe_len < rsnxe_len) {
1034 os_free(sm->rsnxe);
1035 sm->rsnxe = os_malloc(rsnxe_len);
1036 if (!sm->rsnxe)
1037 return WPA_ALLOC_FAIL;
1038 }
1039 os_memcpy(sm->rsnxe, rsnxe, rsnxe_len);
1040 sm->rsnxe_len = rsnxe_len;
1041 } else {
1042 os_free(sm->rsnxe);
1043 sm->rsnxe = NULL;
1044 sm->rsnxe_len = 0;
1045 }
1046
1047 return WPA_IE_OK;
1048 }
1049
1050
1051 #ifdef CONFIG_HS20
wpa_validate_osen(struct wpa_authenticator * wpa_auth,struct wpa_state_machine * sm,const u8 * osen_ie,size_t osen_ie_len)1052 int wpa_validate_osen(struct wpa_authenticator *wpa_auth,
1053 struct wpa_state_machine *sm,
1054 const u8 *osen_ie, size_t osen_ie_len)
1055 {
1056 if (wpa_auth == NULL || sm == NULL)
1057 return -1;
1058
1059 /* TODO: parse OSEN element */
1060 sm->wpa_key_mgmt = WPA_KEY_MGMT_OSEN;
1061 sm->mgmt_frame_prot = 1;
1062 sm->pairwise = WPA_CIPHER_CCMP;
1063 sm->wpa = WPA_VERSION_WPA2;
1064
1065 if (sm->wpa_ie == NULL || sm->wpa_ie_len < osen_ie_len) {
1066 os_free(sm->wpa_ie);
1067 sm->wpa_ie = os_malloc(osen_ie_len);
1068 if (sm->wpa_ie == NULL)
1069 return -1;
1070 }
1071
1072 os_memcpy(sm->wpa_ie, osen_ie, osen_ie_len);
1073 sm->wpa_ie_len = osen_ie_len;
1074
1075 return 0;
1076 }
1077
1078 #endif /* CONFIG_HS20 */
1079
1080
wpa_auth_uses_mfp(struct wpa_state_machine * sm)1081 int wpa_auth_uses_mfp(struct wpa_state_machine *sm)
1082 {
1083 return sm ? sm->mgmt_frame_prot : 0;
1084 }
1085
1086
1087 #ifdef CONFIG_OCV
1088
wpa_auth_set_ocv(struct wpa_state_machine * sm,int ocv)1089 void wpa_auth_set_ocv(struct wpa_state_machine *sm, int ocv)
1090 {
1091 if (sm)
1092 sm->ocv_enabled = ocv;
1093 }
1094
1095
wpa_auth_uses_ocv(struct wpa_state_machine * sm)1096 int wpa_auth_uses_ocv(struct wpa_state_machine *sm)
1097 {
1098 return sm ? sm->ocv_enabled : 0;
1099 }
1100
1101 #endif /* CONFIG_OCV */
1102
1103
1104 #ifdef CONFIG_OWE
wpa_auth_write_assoc_resp_owe(struct wpa_state_machine * sm,u8 * pos,size_t max_len,const u8 * req_ies,size_t req_ies_len)1105 u8 * wpa_auth_write_assoc_resp_owe(struct wpa_state_machine *sm,
1106 u8 *pos, size_t max_len,
1107 const u8 *req_ies, size_t req_ies_len)
1108 {
1109 int res;
1110 struct wpa_auth_config *conf;
1111
1112 if (!sm)
1113 return pos;
1114 conf = &sm->wpa_auth->conf;
1115
1116 #ifdef CONFIG_TESTING_OPTIONS
1117 if (conf->own_ie_override_len) {
1118 if (max_len < conf->own_ie_override_len)
1119 return NULL;
1120 wpa_hexdump(MSG_DEBUG, "WPA: Forced own IE(s) for testing",
1121 conf->own_ie_override, conf->own_ie_override_len);
1122 os_memcpy(pos, conf->own_ie_override,
1123 conf->own_ie_override_len);
1124 return pos + conf->own_ie_override_len;
1125 }
1126 #endif /* CONFIG_TESTING_OPTIONS */
1127
1128 res = wpa_write_rsn_ie(conf, pos, max_len,
1129 sm->pmksa ? sm->pmksa->pmkid : NULL);
1130 if (res < 0)
1131 return pos;
1132 return pos + res;
1133 }
1134 #endif /* CONFIG_OWE */
1135
1136
1137 #ifdef CONFIG_FILS
1138
wpa_auth_write_assoc_resp_fils(struct wpa_state_machine * sm,u8 * pos,size_t max_len,const u8 * req_ies,size_t req_ies_len)1139 u8 * wpa_auth_write_assoc_resp_fils(struct wpa_state_machine *sm,
1140 u8 *pos, size_t max_len,
1141 const u8 *req_ies, size_t req_ies_len)
1142 {
1143 int res;
1144
1145 if (!sm ||
1146 sm->wpa_key_mgmt & (WPA_KEY_MGMT_FT_FILS_SHA256 |
1147 WPA_KEY_MGMT_FT_FILS_SHA384))
1148 return pos;
1149
1150 res = wpa_write_rsn_ie(&sm->wpa_auth->conf, pos, max_len, NULL);
1151 if (res < 0)
1152 return pos;
1153 return pos + res;
1154 }
1155
1156
wpa_auth_write_fd_rsn_info(struct wpa_authenticator * wpa_auth,u8 * fd_rsn_info)1157 bool wpa_auth_write_fd_rsn_info(struct wpa_authenticator *wpa_auth,
1158 u8 *fd_rsn_info)
1159 {
1160 struct wpa_auth_config *conf;
1161 u32 selectors = 0;
1162 u8 *pos = fd_rsn_info;
1163 int i, res;
1164 u32 cipher, suite, selector, mask;
1165 u8 tmp[10 * RSN_SELECTOR_LEN];
1166
1167 if (!wpa_auth)
1168 return false;
1169 conf = &wpa_auth->conf;
1170
1171 if (!(conf->wpa & WPA_PROTO_RSN))
1172 return false;
1173
1174 /* RSN Capability (B0..B15) */
1175 WPA_PUT_LE16(pos, wpa_own_rsn_capab(conf));
1176 pos += 2;
1177
1178 /* Group Data Cipher Suite Selector (B16..B21) */
1179 suite = wpa_cipher_to_suite(WPA_PROTO_RSN, conf->wpa_group);
1180 if (suite == RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED)
1181 cipher = 63; /* No cipher suite selected */
1182 else if ((suite >> 8) == 0x000fac && ((suite & 0xff) <= 13))
1183 cipher = suite & 0xff;
1184 else
1185 cipher = 62; /* vendor specific */
1186 selectors |= cipher;
1187
1188 /* Group Management Cipher Suite Selector (B22..B27) */
1189 cipher = 63; /* Default to no cipher suite selected */
1190 if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) {
1191 switch (conf->group_mgmt_cipher) {
1192 case WPA_CIPHER_AES_128_CMAC:
1193 cipher = RSN_CIPHER_SUITE_AES_128_CMAC & 0xff;
1194 break;
1195 case WPA_CIPHER_BIP_GMAC_128:
1196 cipher = RSN_CIPHER_SUITE_BIP_GMAC_128 & 0xff;
1197 break;
1198 case WPA_CIPHER_BIP_GMAC_256:
1199 cipher = RSN_CIPHER_SUITE_BIP_GMAC_256 & 0xff;
1200 break;
1201 case WPA_CIPHER_BIP_CMAC_256:
1202 cipher = RSN_CIPHER_SUITE_BIP_CMAC_256 & 0xff;
1203 break;
1204 }
1205 }
1206 selectors |= cipher << 6;
1207
1208 /* Pairwise Cipher Suite Selector (B28..B33) */
1209 cipher = 63; /* Default to no cipher suite selected */
1210 res = rsn_cipher_put_suites(tmp, conf->rsn_pairwise);
1211 if (res == 1 && tmp[0] == 0x00 && tmp[1] == 0x0f && tmp[2] == 0xac &&
1212 tmp[3] <= 13)
1213 cipher = tmp[3];
1214 selectors |= cipher << 12;
1215
1216 /* AKM Suite Selector (B34..B39) */
1217 selector = 0; /* default to AKM from RSNE in Beacon/Probe Response */
1218 mask = WPA_KEY_MGMT_FILS_SHA256 | WPA_KEY_MGMT_FILS_SHA384 |
1219 WPA_KEY_MGMT_FT_FILS_SHA384;
1220 if ((conf->wpa_key_mgmt & mask) && (conf->wpa_key_mgmt & ~mask) == 0) {
1221 suite = conf->wpa_key_mgmt & mask;
1222 if (suite == WPA_KEY_MGMT_FILS_SHA256)
1223 selector = 1; /* 00-0f-ac:14 */
1224 else if (suite == WPA_KEY_MGMT_FILS_SHA384)
1225 selector = 2; /* 00-0f-ac:15 */
1226 else if (suite == (WPA_KEY_MGMT_FILS_SHA256 |
1227 WPA_KEY_MGMT_FILS_SHA384))
1228 selector = 3; /* 00-0f-ac:14 or 00-0f-ac:15 */
1229 else if (suite == WPA_KEY_MGMT_FT_FILS_SHA384)
1230 selector = 4; /* 00-0f-ac:17 */
1231 }
1232 selectors |= selector << 18;
1233
1234 for (i = 0; i < 3; i++) {
1235 *pos++ = selectors & 0xff;
1236 selectors >>= 8;
1237 }
1238
1239 return true;
1240 }
1241
1242 #endif /* CONFIG_FILS */
1243