1 /*
2 * WPA Supplicant - WPA state machine and EAPOL-Key processing
3 * Copyright (c) 2003-2018, Jouni Malinen <j@w1.fi>
4 * Copyright(c) 2015 Intel Deutschland GmbH
5 *
6 * This software may be distributed under the terms of the BSD license.
7 * See README for more details.
8 */
9
10 #include "includes.h"
11
12 #include "common.h"
13 #include "crypto/aes.h"
14 #include "crypto/aes_wrap.h"
15 #include "crypto/crypto.h"
16 #include "crypto/random.h"
17 #include "crypto/aes_siv.h"
18 #include "crypto/sha256.h"
19 #include "crypto/sha384.h"
20 #include "crypto/sha512.h"
21 #include "common/ieee802_11_defs.h"
22 #include "common/ieee802_11_common.h"
23 #include "common/ocv.h"
24 #include "common/dpp.h"
25 #include "eap_common/eap_defs.h"
26 #include "eapol_supp/eapol_supp_sm.h"
27 #include "drivers/driver.h"
28 #include "wpa.h"
29 #include "eloop.h"
30 #include "preauth.h"
31 #include "pmksa_cache.h"
32 #include "wpa_i.h"
33 #include "wpa_ie.h"
34
35
36 static const u8 null_rsc[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
37
38
39 /**
40 * wpa_eapol_key_send - Send WPA/RSN EAPOL-Key message
41 * @sm: Pointer to WPA state machine data from wpa_sm_init()
42 * @ptk: PTK for Key Confirmation/Encryption Key
43 * @ver: Version field from Key Info
44 * @dest: Destination address for the frame
45 * @proto: Ethertype (usually ETH_P_EAPOL)
46 * @msg: EAPOL-Key message
47 * @msg_len: Length of message
48 * @key_mic: Pointer to the buffer to which the EAPOL-Key MIC is written
49 * Returns: >= 0 on success, < 0 on failure
50 */
wpa_eapol_key_send(struct wpa_sm * sm,struct wpa_ptk * ptk,int ver,const u8 * dest,u16 proto,u8 * msg,size_t msg_len,u8 * key_mic)51 int wpa_eapol_key_send(struct wpa_sm *sm, struct wpa_ptk *ptk,
52 int ver, const u8 *dest, u16 proto,
53 u8 *msg, size_t msg_len, u8 *key_mic)
54 {
55 int ret = -1;
56 size_t mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
57
58 wpa_printf(MSG_DEBUG, "WPA: Send EAPOL-Key frame to " MACSTR
59 " ver=%d mic_len=%d key_mgmt=0x%x",
60 MAC2STR(dest), ver, (int) mic_len, sm->key_mgmt);
61 if (is_zero_ether_addr(dest) && is_zero_ether_addr(sm->bssid)) {
62 /*
63 * Association event was not yet received; try to fetch
64 * BSSID from the driver.
65 */
66 if (wpa_sm_get_bssid(sm, sm->bssid) < 0) {
67 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
68 "WPA: Failed to read BSSID for "
69 "EAPOL-Key destination address");
70 } else {
71 dest = sm->bssid;
72 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
73 "WPA: Use BSSID (" MACSTR
74 ") as the destination for EAPOL-Key",
75 MAC2STR(dest));
76 }
77 }
78
79 if (mic_len) {
80 if (key_mic && (!ptk || !ptk->kck_len))
81 goto out;
82
83 if (key_mic &&
84 wpa_eapol_key_mic(ptk->kck, ptk->kck_len, sm->key_mgmt, ver,
85 msg, msg_len, key_mic)) {
86 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
87 "WPA: Failed to generate EAPOL-Key version %d key_mgmt 0x%x MIC",
88 ver, sm->key_mgmt);
89 goto out;
90 }
91 if (ptk)
92 wpa_hexdump_key(MSG_DEBUG, "WPA: KCK",
93 ptk->kck, ptk->kck_len);
94 wpa_hexdump(MSG_DEBUG, "WPA: Derived Key MIC",
95 key_mic, mic_len);
96 } else {
97 #ifdef CONFIG_FILS
98 /* AEAD cipher - Key MIC field not used */
99 struct ieee802_1x_hdr *s_hdr, *hdr;
100 struct wpa_eapol_key *s_key, *key;
101 u8 *buf, *s_key_data, *key_data;
102 size_t buf_len = msg_len + AES_BLOCK_SIZE;
103 size_t key_data_len;
104 u16 eapol_len;
105 const u8 *aad[1];
106 size_t aad_len[1];
107
108 if (!ptk || !ptk->kek_len)
109 goto out;
110
111 key_data_len = msg_len - sizeof(struct ieee802_1x_hdr) -
112 sizeof(struct wpa_eapol_key) - 2;
113
114 buf = os_malloc(buf_len);
115 if (!buf)
116 goto out;
117
118 os_memcpy(buf, msg, msg_len);
119 hdr = (struct ieee802_1x_hdr *) buf;
120 key = (struct wpa_eapol_key *) (hdr + 1);
121 key_data = ((u8 *) (key + 1)) + 2;
122
123 /* Update EAPOL header to include AES-SIV overhead */
124 eapol_len = be_to_host16(hdr->length);
125 eapol_len += AES_BLOCK_SIZE;
126 hdr->length = host_to_be16(eapol_len);
127
128 /* Update Key Data Length field to include AES-SIV overhead */
129 WPA_PUT_BE16((u8 *) (key + 1), AES_BLOCK_SIZE + key_data_len);
130
131 s_hdr = (struct ieee802_1x_hdr *) msg;
132 s_key = (struct wpa_eapol_key *) (s_hdr + 1);
133 s_key_data = ((u8 *) (s_key + 1)) + 2;
134
135 wpa_hexdump_key(MSG_DEBUG, "WPA: Plaintext Key Data",
136 s_key_data, key_data_len);
137
138 wpa_hexdump_key(MSG_DEBUG, "WPA: KEK", ptk->kek, ptk->kek_len);
139 /* AES-SIV AAD from EAPOL protocol version field (inclusive) to
140 * to Key Data (exclusive). */
141 aad[0] = buf;
142 aad_len[0] = key_data - buf;
143 if (aes_siv_encrypt(ptk->kek, ptk->kek_len,
144 s_key_data, key_data_len,
145 1, aad, aad_len, key_data) < 0) {
146 os_free(buf);
147 goto out;
148 }
149
150 wpa_hexdump(MSG_DEBUG, "WPA: Encrypted Key Data from SIV",
151 key_data, AES_BLOCK_SIZE + key_data_len);
152
153 os_free(msg);
154 msg = buf;
155 msg_len = buf_len;
156 #else /* CONFIG_FILS */
157 goto out;
158 #endif /* CONFIG_FILS */
159 }
160
161 wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key", msg, msg_len);
162 ret = wpa_sm_ether_send(sm, dest, proto, msg, msg_len);
163 eapol_sm_notify_tx_eapol_key(sm->eapol);
164 out:
165 os_free(msg);
166 return ret;
167 }
168
169
170 /**
171 * wpa_sm_key_request - Send EAPOL-Key Request
172 * @sm: Pointer to WPA state machine data from wpa_sm_init()
173 * @error: Indicate whether this is an Michael MIC error report
174 * @pairwise: 1 = error report for pairwise packet, 0 = for group packet
175 *
176 * Send an EAPOL-Key Request to the current authenticator. This function is
177 * used to request rekeying and it is usually called when a local Michael MIC
178 * failure is detected.
179 */
wpa_sm_key_request(struct wpa_sm * sm,int error,int pairwise)180 void wpa_sm_key_request(struct wpa_sm *sm, int error, int pairwise)
181 {
182 size_t mic_len, hdrlen, rlen;
183 struct wpa_eapol_key *reply;
184 int key_info, ver;
185 u8 bssid[ETH_ALEN], *rbuf, *key_mic, *mic;
186
187 if (pairwise && sm->wpa_deny_ptk0_rekey && !sm->use_ext_key_id &&
188 wpa_sm_get_state(sm) == WPA_COMPLETED) {
189 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
190 "WPA: PTK0 rekey not allowed, reconnecting");
191 wpa_sm_reconnect(sm);
192 return;
193 }
194
195 if (wpa_use_akm_defined(sm->key_mgmt))
196 ver = WPA_KEY_INFO_TYPE_AKM_DEFINED;
197 else if (wpa_key_mgmt_ft(sm->key_mgmt) ||
198 wpa_key_mgmt_sha256(sm->key_mgmt))
199 ver = WPA_KEY_INFO_TYPE_AES_128_CMAC;
200 else if (sm->pairwise_cipher != WPA_CIPHER_TKIP)
201 ver = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES;
202 else
203 ver = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4;
204
205 if (wpa_sm_get_bssid(sm, bssid) < 0) {
206 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
207 "Failed to read BSSID for EAPOL-Key request");
208 return;
209 }
210
211 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
212 hdrlen = sizeof(*reply) + mic_len + 2;
213 rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
214 hdrlen, &rlen, (void *) &reply);
215 if (rbuf == NULL)
216 return;
217
218 reply->type = (sm->proto == WPA_PROTO_RSN ||
219 sm->proto == WPA_PROTO_OSEN) ?
220 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
221 key_info = WPA_KEY_INFO_REQUEST | ver;
222 if (sm->ptk_set)
223 key_info |= WPA_KEY_INFO_SECURE;
224 if (sm->ptk_set && mic_len)
225 key_info |= WPA_KEY_INFO_MIC;
226 if (error)
227 key_info |= WPA_KEY_INFO_ERROR;
228 if (pairwise)
229 key_info |= WPA_KEY_INFO_KEY_TYPE;
230 WPA_PUT_BE16(reply->key_info, key_info);
231 WPA_PUT_BE16(reply->key_length, 0);
232 os_memcpy(reply->replay_counter, sm->request_counter,
233 WPA_REPLAY_COUNTER_LEN);
234 inc_byte_array(sm->request_counter, WPA_REPLAY_COUNTER_LEN);
235
236 mic = (u8 *) (reply + 1);
237 WPA_PUT_BE16(mic + mic_len, 0);
238 if (!(key_info & WPA_KEY_INFO_MIC))
239 key_mic = NULL;
240 else
241 key_mic = mic;
242
243 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
244 "WPA: Sending EAPOL-Key Request (error=%d "
245 "pairwise=%d ptk_set=%d len=%lu)",
246 error, pairwise, sm->ptk_set, (unsigned long) rlen);
247 wpa_eapol_key_send(sm, &sm->ptk, ver, bssid, ETH_P_EAPOL, rbuf, rlen,
248 key_mic);
249 }
250
251
wpa_supplicant_key_mgmt_set_pmk(struct wpa_sm * sm)252 static void wpa_supplicant_key_mgmt_set_pmk(struct wpa_sm *sm)
253 {
254 #ifdef CONFIG_IEEE80211R
255 if (sm->key_mgmt == WPA_KEY_MGMT_FT_IEEE8021X) {
256 if (wpa_sm_key_mgmt_set_pmk(sm, sm->xxkey, sm->xxkey_len))
257 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
258 "RSN: Cannot set low order 256 bits of MSK for key management offload");
259 } else {
260 #endif /* CONFIG_IEEE80211R */
261 if (wpa_sm_key_mgmt_set_pmk(sm, sm->pmk, sm->pmk_len))
262 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
263 "RSN: Cannot set PMK for key management offload");
264 #ifdef CONFIG_IEEE80211R
265 }
266 #endif /* CONFIG_IEEE80211R */
267 }
268
269
wpa_supplicant_get_pmk(struct wpa_sm * sm,const unsigned char * src_addr,const u8 * pmkid)270 static int wpa_supplicant_get_pmk(struct wpa_sm *sm,
271 const unsigned char *src_addr,
272 const u8 *pmkid)
273 {
274 int abort_cached = 0;
275
276 if (pmkid && !sm->cur_pmksa) {
277 /* When using drivers that generate RSN IE, wpa_supplicant may
278 * not have enough time to get the association information
279 * event before receiving this 1/4 message, so try to find a
280 * matching PMKSA cache entry here. */
281 sm->cur_pmksa = pmksa_cache_get(sm->pmksa, src_addr, pmkid,
282 NULL, 0);
283 if (sm->cur_pmksa) {
284 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
285 "RSN: found matching PMKID from PMKSA cache");
286 } else {
287 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
288 "RSN: no matching PMKID found");
289 abort_cached = 1;
290 }
291 }
292
293 if (pmkid && sm->cur_pmksa &&
294 os_memcmp_const(pmkid, sm->cur_pmksa->pmkid, PMKID_LEN) == 0) {
295 wpa_hexdump(MSG_DEBUG, "RSN: matched PMKID", pmkid, PMKID_LEN);
296 wpa_sm_set_pmk_from_pmksa(sm);
297 wpa_hexdump_key(MSG_DEBUG, "RSN: PMK from PMKSA cache",
298 sm->pmk, sm->pmk_len);
299 eapol_sm_notify_cached(sm->eapol);
300 #ifdef CONFIG_IEEE80211R
301 sm->xxkey_len = 0;
302 #ifdef CONFIG_SAE
303 if (sm->key_mgmt == WPA_KEY_MGMT_FT_SAE &&
304 sm->pmk_len == PMK_LEN) {
305 /* Need to allow FT key derivation to proceed with
306 * PMK from SAE being used as the XXKey in cases where
307 * the PMKID in msg 1/4 matches the PMKSA entry that was
308 * just added based on SAE authentication for the
309 * initial mobility domain association. */
310 os_memcpy(sm->xxkey, sm->pmk, sm->pmk_len);
311 sm->xxkey_len = sm->pmk_len;
312 }
313 #endif /* CONFIG_SAE */
314 #endif /* CONFIG_IEEE80211R */
315 } else if (wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt) && sm->eapol) {
316 int res, pmk_len;
317 #ifdef CONFIG_IEEE80211R
318 u8 buf[2 * PMK_LEN];
319 #endif /* CONFIG_IEEE80211R */
320
321 if (wpa_key_mgmt_sha384(sm->key_mgmt))
322 pmk_len = PMK_LEN_SUITE_B_192;
323 else
324 pmk_len = PMK_LEN;
325 res = eapol_sm_get_key(sm->eapol, sm->pmk, pmk_len);
326 if (res) {
327 if (pmk_len == PMK_LEN) {
328 /*
329 * EAP-LEAP is an exception from other EAP
330 * methods: it uses only 16-byte PMK.
331 */
332 res = eapol_sm_get_key(sm->eapol, sm->pmk, 16);
333 pmk_len = 16;
334 }
335 }
336 #ifdef CONFIG_IEEE80211R
337 if (res == 0 &&
338 eapol_sm_get_key(sm->eapol, buf, 2 * PMK_LEN) == 0) {
339 if (wpa_key_mgmt_sha384(sm->key_mgmt)) {
340 os_memcpy(sm->xxkey, buf, SHA384_MAC_LEN);
341 sm->xxkey_len = SHA384_MAC_LEN;
342 } else {
343 os_memcpy(sm->xxkey, buf + PMK_LEN, PMK_LEN);
344 sm->xxkey_len = PMK_LEN;
345 }
346 forced_memzero(buf, sizeof(buf));
347 if (sm->proto == WPA_PROTO_RSN &&
348 wpa_key_mgmt_ft(sm->key_mgmt)) {
349 struct rsn_pmksa_cache_entry *sa = NULL;
350 const u8 *fils_cache_id = NULL;
351
352 #ifdef CONFIG_FILS
353 if (sm->fils_cache_id_set)
354 fils_cache_id = sm->fils_cache_id;
355 #endif /* CONFIG_FILS */
356 wpa_hexdump_key(MSG_DEBUG,
357 "FT: Cache XXKey/MPMK",
358 sm->xxkey, sm->xxkey_len);
359 sa = pmksa_cache_add(sm->pmksa,
360 sm->xxkey, sm->xxkey_len,
361 NULL, NULL, 0,
362 src_addr, sm->own_addr,
363 sm->network_ctx,
364 sm->key_mgmt,
365 fils_cache_id);
366 if (!sm->cur_pmksa)
367 sm->cur_pmksa = sa;
368 }
369 }
370 #endif /* CONFIG_IEEE80211R */
371 if (res == 0) {
372 struct rsn_pmksa_cache_entry *sa = NULL;
373 const u8 *fils_cache_id = NULL;
374
375 #ifdef CONFIG_FILS
376 if (sm->fils_cache_id_set)
377 fils_cache_id = sm->fils_cache_id;
378 #endif /* CONFIG_FILS */
379
380 wpa_hexdump_key(MSG_DEBUG, "WPA: PMK from EAPOL state "
381 "machines", sm->pmk, pmk_len);
382 sm->pmk_len = pmk_len;
383 wpa_supplicant_key_mgmt_set_pmk(sm);
384 if (sm->proto == WPA_PROTO_RSN &&
385 !wpa_key_mgmt_suite_b(sm->key_mgmt) &&
386 !wpa_key_mgmt_ft(sm->key_mgmt)) {
387 sa = pmksa_cache_add(sm->pmksa,
388 sm->pmk, pmk_len, NULL,
389 NULL, 0,
390 src_addr, sm->own_addr,
391 sm->network_ctx,
392 sm->key_mgmt,
393 fils_cache_id);
394 }
395 if (!sm->cur_pmksa && pmkid &&
396 pmksa_cache_get(sm->pmksa, src_addr, pmkid, NULL,
397 0)) {
398 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
399 "RSN: the new PMK matches with the "
400 "PMKID");
401 abort_cached = 0;
402 } else if (sa && !sm->cur_pmksa && pmkid) {
403 /*
404 * It looks like the authentication server
405 * derived mismatching MSK. This should not
406 * really happen, but bugs happen.. There is not
407 * much we can do here without knowing what
408 * exactly caused the server to misbehave.
409 */
410 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
411 "RSN: PMKID mismatch - authentication server may have derived different MSK?!");
412 return -1;
413 }
414
415 if (!sm->cur_pmksa)
416 sm->cur_pmksa = sa;
417 #ifdef CONFIG_IEEE80211R
418 } else if (wpa_key_mgmt_ft(sm->key_mgmt) && sm->ft_protocol) {
419 wpa_printf(MSG_DEBUG,
420 "FT: Continue 4-way handshake without PMK/PMKID for association using FT protocol");
421 #endif /* CONFIG_IEEE80211R */
422 } else {
423 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
424 "WPA: Failed to get master session key from "
425 "EAPOL state machines - key handshake "
426 "aborted");
427 if (sm->cur_pmksa) {
428 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
429 "RSN: Cancelled PMKSA caching "
430 "attempt");
431 sm->cur_pmksa = NULL;
432 abort_cached = 1;
433 } else if (!abort_cached) {
434 return -1;
435 }
436 }
437 }
438
439 if (abort_cached && wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt) &&
440 !wpa_key_mgmt_suite_b(sm->key_mgmt) &&
441 !wpa_key_mgmt_ft(sm->key_mgmt) && sm->key_mgmt != WPA_KEY_MGMT_OSEN)
442 {
443 /* Send EAPOL-Start to trigger full EAP authentication. */
444 u8 *buf;
445 size_t buflen;
446
447 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
448 "RSN: no PMKSA entry found - trigger "
449 "full EAP authentication");
450 buf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_START,
451 NULL, 0, &buflen, NULL);
452 if (buf) {
453 wpa_sm_ether_send(sm, sm->bssid, ETH_P_EAPOL,
454 buf, buflen);
455 os_free(buf);
456 return -2;
457 }
458
459 return -1;
460 }
461
462 return 0;
463 }
464
465
466 /**
467 * wpa_supplicant_send_2_of_4 - Send message 2 of WPA/RSN 4-Way Handshake
468 * @sm: Pointer to WPA state machine data from wpa_sm_init()
469 * @dst: Destination address for the frame
470 * @key: Pointer to the EAPOL-Key frame header
471 * @ver: Version bits from EAPOL-Key Key Info
472 * @nonce: Nonce value for the EAPOL-Key frame
473 * @wpa_ie: WPA/RSN IE
474 * @wpa_ie_len: Length of the WPA/RSN IE
475 * @ptk: PTK to use for keyed hash and encryption
476 * Returns: >= 0 on success, < 0 on failure
477 */
wpa_supplicant_send_2_of_4(struct wpa_sm * sm,const unsigned char * dst,const struct wpa_eapol_key * key,int ver,const u8 * nonce,const u8 * wpa_ie,size_t wpa_ie_len,struct wpa_ptk * ptk)478 int wpa_supplicant_send_2_of_4(struct wpa_sm *sm, const unsigned char *dst,
479 const struct wpa_eapol_key *key,
480 int ver, const u8 *nonce,
481 const u8 *wpa_ie, size_t wpa_ie_len,
482 struct wpa_ptk *ptk)
483 {
484 size_t mic_len, hdrlen, rlen;
485 struct wpa_eapol_key *reply;
486 u8 *rbuf, *key_mic;
487 u8 *rsn_ie_buf = NULL;
488 u16 key_info;
489
490 if (wpa_ie == NULL) {
491 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "WPA: No wpa_ie set - "
492 "cannot generate msg 2/4");
493 return -1;
494 }
495
496 #ifdef CONFIG_IEEE80211R
497 if (wpa_key_mgmt_ft(sm->key_mgmt)) {
498 int res;
499
500 wpa_hexdump(MSG_DEBUG, "WPA: WPA IE before FT processing",
501 wpa_ie, wpa_ie_len);
502 /*
503 * Add PMKR1Name into RSN IE (PMKID-List) and add MDIE and
504 * FTIE from (Re)Association Response.
505 */
506 rsn_ie_buf = os_malloc(wpa_ie_len + 2 + 2 + PMKID_LEN +
507 sm->assoc_resp_ies_len);
508 if (rsn_ie_buf == NULL)
509 return -1;
510 os_memcpy(rsn_ie_buf, wpa_ie, wpa_ie_len);
511 res = wpa_insert_pmkid(rsn_ie_buf, &wpa_ie_len,
512 sm->pmk_r1_name);
513 if (res < 0) {
514 os_free(rsn_ie_buf);
515 return -1;
516 }
517 wpa_hexdump(MSG_DEBUG,
518 "WPA: WPA IE after PMKID[PMKR1Name] addition into RSNE",
519 rsn_ie_buf, wpa_ie_len);
520
521 if (sm->assoc_resp_ies) {
522 wpa_hexdump(MSG_DEBUG, "WPA: Add assoc_resp_ies",
523 sm->assoc_resp_ies,
524 sm->assoc_resp_ies_len);
525 os_memcpy(rsn_ie_buf + wpa_ie_len, sm->assoc_resp_ies,
526 sm->assoc_resp_ies_len);
527 wpa_ie_len += sm->assoc_resp_ies_len;
528 }
529
530 wpa_ie = rsn_ie_buf;
531 }
532 #endif /* CONFIG_IEEE80211R */
533
534 wpa_hexdump(MSG_DEBUG, "WPA: WPA IE for msg 2/4", wpa_ie, wpa_ie_len);
535
536 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
537 hdrlen = sizeof(*reply) + mic_len + 2;
538 rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY,
539 NULL, hdrlen + wpa_ie_len,
540 &rlen, (void *) &reply);
541 if (rbuf == NULL) {
542 os_free(rsn_ie_buf);
543 return -1;
544 }
545
546 reply->type = (sm->proto == WPA_PROTO_RSN ||
547 sm->proto == WPA_PROTO_OSEN) ?
548 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
549 key_info = ver | WPA_KEY_INFO_KEY_TYPE;
550 if (mic_len)
551 key_info |= WPA_KEY_INFO_MIC;
552 else
553 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
554 WPA_PUT_BE16(reply->key_info, key_info);
555 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN)
556 WPA_PUT_BE16(reply->key_length, 0);
557 else
558 os_memcpy(reply->key_length, key->key_length, 2);
559 os_memcpy(reply->replay_counter, key->replay_counter,
560 WPA_REPLAY_COUNTER_LEN);
561 wpa_hexdump(MSG_DEBUG, "WPA: Replay Counter", reply->replay_counter,
562 WPA_REPLAY_COUNTER_LEN);
563
564 key_mic = (u8 *) (reply + 1);
565 WPA_PUT_BE16(key_mic + mic_len, wpa_ie_len); /* Key Data Length */
566 os_memcpy(key_mic + mic_len + 2, wpa_ie, wpa_ie_len); /* Key Data */
567 os_free(rsn_ie_buf);
568
569 os_memcpy(reply->key_nonce, nonce, WPA_NONCE_LEN);
570
571 wpa_dbg(sm->ctx->msg_ctx, MSG_INFO, "WPA: Sending EAPOL-Key 2/4");
572 return wpa_eapol_key_send(sm, ptk, ver, dst, ETH_P_EAPOL, rbuf, rlen,
573 key_mic);
574 }
575
576
wpa_derive_ptk(struct wpa_sm * sm,const unsigned char * src_addr,const struct wpa_eapol_key * key,struct wpa_ptk * ptk)577 static int wpa_derive_ptk(struct wpa_sm *sm, const unsigned char *src_addr,
578 const struct wpa_eapol_key *key, struct wpa_ptk *ptk)
579 {
580 const u8 *z = NULL;
581 size_t z_len = 0;
582 int akmp;
583
584 #ifdef CONFIG_IEEE80211R
585 if (wpa_key_mgmt_ft(sm->key_mgmt))
586 return wpa_derive_ptk_ft(sm, src_addr, key, ptk);
587 #endif /* CONFIG_IEEE80211R */
588
589 #ifdef CONFIG_DPP2
590 if (sm->key_mgmt == WPA_KEY_MGMT_DPP && sm->dpp_z) {
591 z = wpabuf_head(sm->dpp_z);
592 z_len = wpabuf_len(sm->dpp_z);
593 }
594 #endif /* CONFIG_DPP2 */
595
596 akmp = sm->key_mgmt;
597 #ifdef CONFIG_OWE
598 if (sm->owe_ptk_workaround && akmp == WPA_KEY_MGMT_OWE &&
599 sm->pmk_len > 32) {
600 wpa_printf(MSG_DEBUG,
601 "OWE: Force SHA256 for PTK derivation");
602 akmp |= WPA_KEY_MGMT_PSK_SHA256;
603 }
604 #endif /* CONFIG_OWE */
605 return wpa_pmk_to_ptk(sm->pmk, sm->pmk_len, "Pairwise key expansion",
606 sm->own_addr, sm->bssid, sm->snonce,
607 key->key_nonce, ptk, akmp,
608 sm->pairwise_cipher, z, z_len);
609 }
610
611
wpa_handle_ext_key_id(struct wpa_sm * sm,struct wpa_eapol_ie_parse * kde)612 static int wpa_handle_ext_key_id(struct wpa_sm *sm,
613 struct wpa_eapol_ie_parse *kde)
614 {
615 if (sm->ext_key_id) {
616 u16 key_id;
617
618 if (!kde->key_id) {
619 wpa_msg(sm->ctx->msg_ctx,
620 sm->use_ext_key_id ? MSG_INFO : MSG_DEBUG,
621 "RSN: No Key ID in Extended Key ID handshake");
622 sm->keyidx_active = 0;
623 return sm->use_ext_key_id ? -1 : 0;
624 }
625
626 key_id = kde->key_id[0] & 0x03;
627 if (key_id > 1) {
628 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
629 "RSN: Invalid Extended Key ID: %d", key_id);
630 return -1;
631 }
632 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
633 "RSN: Using Extended Key ID %d", key_id);
634 sm->keyidx_active = key_id;
635 sm->use_ext_key_id = 1;
636 } else {
637 if (kde->key_id && (kde->key_id[0] & 0x03)) {
638 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
639 "RSN: Non-zero Extended Key ID Key ID in PTK0 handshake");
640 return -1;
641 }
642
643 if (kde->key_id) {
644 /* This is not supposed to be included here, but ignore
645 * the case of matching Key ID 0 just in case. */
646 wpa_msg(sm->ctx->msg_ctx, MSG_DEBUG,
647 "RSN: Extended Key ID Key ID 0 in PTK0 handshake");
648 }
649 sm->keyidx_active = 0;
650 sm->use_ext_key_id = 0;
651 }
652
653 return 0;
654 }
655
656
wpa_supplicant_process_1_of_4(struct wpa_sm * sm,const unsigned char * src_addr,const struct wpa_eapol_key * key,u16 ver,const u8 * key_data,size_t key_data_len)657 static void wpa_supplicant_process_1_of_4(struct wpa_sm *sm,
658 const unsigned char *src_addr,
659 const struct wpa_eapol_key *key,
660 u16 ver, const u8 *key_data,
661 size_t key_data_len)
662 {
663 struct wpa_eapol_ie_parse ie;
664 struct wpa_ptk *ptk;
665 int res;
666 u8 *kde, *kde_buf = NULL;
667 size_t kde_len;
668
669 if (wpa_sm_get_network_ctx(sm) == NULL) {
670 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "WPA: No SSID info "
671 "found (msg 1 of 4)");
672 return;
673 }
674
675 if (sm->wpa_deny_ptk0_rekey && !sm->use_ext_key_id &&
676 wpa_sm_get_state(sm) == WPA_COMPLETED) {
677 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
678 "WPA: PTK0 rekey not allowed, reconnecting");
679 wpa_sm_reconnect(sm);
680 return;
681 }
682
683 wpa_sm_set_state(sm, WPA_4WAY_HANDSHAKE);
684 wpa_dbg(sm->ctx->msg_ctx, MSG_INFO, "WPA: RX message 1 of 4-Way "
685 "Handshake from " MACSTR " (ver=%d)", MAC2STR(src_addr), ver);
686
687 os_memset(&ie, 0, sizeof(ie));
688
689 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) {
690 /* RSN: msg 1/4 should contain PMKID for the selected PMK */
691 wpa_hexdump(MSG_DEBUG, "RSN: msg 1/4 key data",
692 key_data, key_data_len);
693 if (wpa_supplicant_parse_ies(key_data, key_data_len, &ie) < 0)
694 goto failed;
695 if (ie.pmkid) {
696 wpa_hexdump(MSG_DEBUG, "RSN: PMKID from "
697 "Authenticator", ie.pmkid, PMKID_LEN);
698 }
699 }
700
701 res = wpa_supplicant_get_pmk(sm, src_addr, ie.pmkid);
702 if (res == -2) {
703 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "RSN: Do not reply to "
704 "msg 1/4 - requesting full EAP authentication");
705 return;
706 }
707 if (res)
708 goto failed;
709
710 if (sm->renew_snonce) {
711 if (random_get_bytes(sm->snonce, WPA_NONCE_LEN)) {
712 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
713 "WPA: Failed to get random data for SNonce");
714 goto failed;
715 }
716 sm->renew_snonce = 0;
717 wpa_hexdump(MSG_DEBUG, "WPA: Renewed SNonce",
718 sm->snonce, WPA_NONCE_LEN);
719 }
720
721 /* Calculate PTK which will be stored as a temporary PTK until it has
722 * been verified when processing message 3/4. */
723 ptk = &sm->tptk;
724 if (wpa_derive_ptk(sm, src_addr, key, ptk) < 0)
725 goto failed;
726 if (sm->pairwise_cipher == WPA_CIPHER_TKIP) {
727 u8 buf[8];
728 /* Supplicant: swap tx/rx Mic keys */
729 os_memcpy(buf, &ptk->tk[16], 8);
730 os_memcpy(&ptk->tk[16], &ptk->tk[24], 8);
731 os_memcpy(&ptk->tk[24], buf, 8);
732 forced_memzero(buf, sizeof(buf));
733 }
734 sm->tptk_set = 1;
735
736 kde = sm->assoc_wpa_ie;
737 kde_len = sm->assoc_wpa_ie_len;
738 kde_buf = os_malloc(kde_len +
739 2 + RSN_SELECTOR_LEN + 3 +
740 sm->assoc_rsnxe_len +
741 2 + RSN_SELECTOR_LEN + 1 +
742 2 + RSN_SELECTOR_LEN + 2);
743 if (!kde_buf)
744 goto failed;
745 os_memcpy(kde_buf, kde, kde_len);
746 kde = kde_buf;
747
748 #ifdef CONFIG_OCV
749 if (wpa_sm_ocv_enabled(sm)) {
750 struct wpa_channel_info ci;
751 u8 *pos;
752
753 pos = kde + kde_len;
754 if (wpa_sm_channel_info(sm, &ci) != 0) {
755 wpa_printf(MSG_WARNING,
756 "Failed to get channel info for OCI element in EAPOL-Key 2/4");
757 goto failed;
758 }
759
760 if (ocv_insert_oci_kde(&ci, &pos) < 0)
761 goto failed;
762 kde_len = pos - kde;
763 }
764 #endif /* CONFIG_OCV */
765
766 if (sm->assoc_rsnxe && sm->assoc_rsnxe_len) {
767 os_memcpy(kde + kde_len, sm->assoc_rsnxe, sm->assoc_rsnxe_len);
768 kde_len += sm->assoc_rsnxe_len;
769 }
770
771 #ifdef CONFIG_P2P
772 if (sm->p2p) {
773 u8 *pos;
774
775 wpa_printf(MSG_DEBUG,
776 "P2P: Add IP Address Request KDE into EAPOL-Key 2/4");
777 pos = kde + kde_len;
778 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
779 *pos++ = RSN_SELECTOR_LEN + 1;
780 RSN_SELECTOR_PUT(pos, WFA_KEY_DATA_IP_ADDR_REQ);
781 pos += RSN_SELECTOR_LEN;
782 *pos++ = 0x01;
783 kde_len = pos - kde;
784 }
785 #endif /* CONFIG_P2P */
786
787 #ifdef CONFIG_DPP2
788 if (DPP_VERSION > 1 && sm->key_mgmt == WPA_KEY_MGMT_DPP) {
789 u8 *pos;
790
791 wpa_printf(MSG_DEBUG, "DPP: Add DPP KDE into EAPOL-Key 2/4");
792 pos = kde + kde_len;
793 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
794 *pos++ = RSN_SELECTOR_LEN + 2;
795 RSN_SELECTOR_PUT(pos, WFA_KEY_DATA_DPP);
796 pos += RSN_SELECTOR_LEN;
797 *pos++ = DPP_VERSION; /* Protocol Version */
798 *pos = 0; /* Flags */
799 if (sm->dpp_pfs == 0)
800 *pos |= DPP_KDE_PFS_ALLOWED;
801 else if (sm->dpp_pfs == 1)
802 *pos |= DPP_KDE_PFS_ALLOWED | DPP_KDE_PFS_REQUIRED;
803 pos++;
804 kde_len = pos - kde;
805 }
806 #endif /* CONFIG_DPP2 */
807
808 if (wpa_supplicant_send_2_of_4(sm, sm->bssid, key, ver, sm->snonce,
809 kde, kde_len, ptk) < 0)
810 goto failed;
811
812 os_free(kde_buf);
813 os_memcpy(sm->anonce, key->key_nonce, WPA_NONCE_LEN);
814 return;
815
816 failed:
817 os_free(kde_buf);
818 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
819 }
820
821
wpa_sm_start_preauth(void * eloop_ctx,void * timeout_ctx)822 static void wpa_sm_start_preauth(void *eloop_ctx, void *timeout_ctx)
823 {
824 struct wpa_sm *sm = eloop_ctx;
825 rsn_preauth_candidate_process(sm);
826 }
827
828
wpa_supplicant_key_neg_complete(struct wpa_sm * sm,const u8 * addr,int secure)829 static void wpa_supplicant_key_neg_complete(struct wpa_sm *sm,
830 const u8 *addr, int secure)
831 {
832 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
833 "WPA: Key negotiation completed with "
834 MACSTR " [PTK=%s GTK=%s]", MAC2STR(addr),
835 wpa_cipher_txt(sm->pairwise_cipher),
836 wpa_cipher_txt(sm->group_cipher));
837 wpa_sm_cancel_auth_timeout(sm);
838 wpa_sm_set_state(sm, WPA_COMPLETED);
839
840 if (secure) {
841 wpa_sm_mlme_setprotection(
842 sm, addr, MLME_SETPROTECTION_PROTECT_TYPE_RX_TX,
843 MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
844 eapol_sm_notify_portValid(sm->eapol, true);
845 if (wpa_key_mgmt_wpa_psk(sm->key_mgmt) ||
846 sm->key_mgmt == WPA_KEY_MGMT_DPP ||
847 sm->key_mgmt == WPA_KEY_MGMT_OWE)
848 eapol_sm_notify_eap_success(sm->eapol, true);
849 /*
850 * Start preauthentication after a short wait to avoid a
851 * possible race condition between the data receive and key
852 * configuration after the 4-Way Handshake. This increases the
853 * likelihood of the first preauth EAPOL-Start frame getting to
854 * the target AP.
855 */
856 if (!dl_list_empty(&sm->pmksa_candidates))
857 eloop_register_timeout(1, 0, wpa_sm_start_preauth,
858 sm, NULL);
859 }
860
861 if (sm->cur_pmksa && sm->cur_pmksa->opportunistic) {
862 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
863 "RSN: Authenticator accepted "
864 "opportunistic PMKSA entry - marking it valid");
865 sm->cur_pmksa->opportunistic = 0;
866 }
867
868 #ifdef CONFIG_IEEE80211R
869 if (wpa_key_mgmt_ft(sm->key_mgmt)) {
870 /* Prepare for the next transition */
871 wpa_ft_prepare_auth_request(sm, NULL);
872 }
873 #endif /* CONFIG_IEEE80211R */
874 }
875
876
wpa_sm_rekey_ptk(void * eloop_ctx,void * timeout_ctx)877 static void wpa_sm_rekey_ptk(void *eloop_ctx, void *timeout_ctx)
878 {
879 struct wpa_sm *sm = eloop_ctx;
880 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Request PTK rekeying");
881 wpa_sm_key_request(sm, 0, 1);
882 }
883
884
wpa_supplicant_install_ptk(struct wpa_sm * sm,const struct wpa_eapol_key * key,enum key_flag key_flag)885 static int wpa_supplicant_install_ptk(struct wpa_sm *sm,
886 const struct wpa_eapol_key *key,
887 enum key_flag key_flag)
888 {
889 int keylen, rsclen;
890 enum wpa_alg alg;
891 const u8 *key_rsc;
892
893 if (sm->ptk.installed) {
894 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
895 "WPA: Do not re-install same PTK to the driver");
896 return 0;
897 }
898
899 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
900 "WPA: Installing PTK to the driver");
901
902 if (sm->pairwise_cipher == WPA_CIPHER_NONE) {
903 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Pairwise Cipher "
904 "Suite: NONE - do not use pairwise keys");
905 return 0;
906 }
907
908 if (!wpa_cipher_valid_pairwise(sm->pairwise_cipher)) {
909 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
910 "WPA: Unsupported pairwise cipher %d",
911 sm->pairwise_cipher);
912 return -1;
913 }
914
915 alg = wpa_cipher_to_alg(sm->pairwise_cipher);
916 keylen = wpa_cipher_key_len(sm->pairwise_cipher);
917 if (keylen <= 0 || (unsigned int) keylen != sm->ptk.tk_len) {
918 wpa_printf(MSG_DEBUG, "WPA: TK length mismatch: %d != %lu",
919 keylen, (long unsigned int) sm->ptk.tk_len);
920 return -1;
921 }
922 rsclen = wpa_cipher_rsc_len(sm->pairwise_cipher);
923
924 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) {
925 key_rsc = null_rsc;
926 } else {
927 key_rsc = key->key_rsc;
928 wpa_hexdump(MSG_DEBUG, "WPA: RSC", key_rsc, rsclen);
929 }
930
931 if (wpa_sm_set_key(sm, alg, sm->bssid, sm->keyidx_active, 1, key_rsc,
932 rsclen, sm->ptk.tk, keylen,
933 KEY_FLAG_PAIRWISE | key_flag) < 0) {
934 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
935 "WPA: Failed to set PTK to the driver (alg=%d keylen=%d bssid="
936 MACSTR " idx=%d key_flag=0x%x)",
937 alg, keylen, MAC2STR(sm->bssid),
938 sm->keyidx_active, key_flag);
939 return -1;
940 }
941
942 /* TK is not needed anymore in supplicant */
943 os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
944 sm->ptk.tk_len = 0;
945 sm->ptk.installed = 1;
946
947 if (sm->wpa_ptk_rekey) {
948 eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
949 eloop_register_timeout(sm->wpa_ptk_rekey, 0, wpa_sm_rekey_ptk,
950 sm, NULL);
951 }
952 return 0;
953 }
954
955
wpa_supplicant_activate_ptk(struct wpa_sm * sm)956 static int wpa_supplicant_activate_ptk(struct wpa_sm *sm)
957 {
958 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
959 "WPA: Activate PTK (idx=%d bssid=" MACSTR ")",
960 sm->keyidx_active, MAC2STR(sm->bssid));
961
962 if (wpa_sm_set_key(sm, 0, sm->bssid, sm->keyidx_active, 0, NULL, 0,
963 NULL, 0, KEY_FLAG_PAIRWISE_RX_TX_MODIFY) < 0) {
964 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
965 "WPA: Failed to activate PTK for TX (idx=%d bssid="
966 MACSTR ")", sm->keyidx_active, MAC2STR(sm->bssid));
967 return -1;
968 }
969 return 0;
970 }
971
972
wpa_supplicant_check_group_cipher(struct wpa_sm * sm,int group_cipher,int keylen,int maxkeylen,int * key_rsc_len,enum wpa_alg * alg)973 static int wpa_supplicant_check_group_cipher(struct wpa_sm *sm,
974 int group_cipher,
975 int keylen, int maxkeylen,
976 int *key_rsc_len,
977 enum wpa_alg *alg)
978 {
979 int klen;
980
981 *alg = wpa_cipher_to_alg(group_cipher);
982 if (*alg == WPA_ALG_NONE) {
983 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
984 "WPA: Unsupported Group Cipher %d",
985 group_cipher);
986 return -1;
987 }
988 *key_rsc_len = wpa_cipher_rsc_len(group_cipher);
989
990 klen = wpa_cipher_key_len(group_cipher);
991 if (keylen != klen || maxkeylen < klen) {
992 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
993 "WPA: Unsupported %s Group Cipher key length %d (%d)",
994 wpa_cipher_txt(group_cipher), keylen, maxkeylen);
995 return -1;
996 }
997 return 0;
998 }
999
1000
1001 struct wpa_gtk_data {
1002 enum wpa_alg alg;
1003 int tx, key_rsc_len, keyidx;
1004 u8 gtk[32];
1005 int gtk_len;
1006 };
1007
1008
wpa_supplicant_install_gtk(struct wpa_sm * sm,const struct wpa_gtk_data * gd,const u8 * key_rsc,int wnm_sleep)1009 static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
1010 const struct wpa_gtk_data *gd,
1011 const u8 *key_rsc, int wnm_sleep)
1012 {
1013 const u8 *_gtk = gd->gtk;
1014 u8 gtk_buf[32];
1015
1016 /* Detect possible key reinstallation */
1017 if ((sm->gtk.gtk_len == (size_t) gd->gtk_len &&
1018 os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) ||
1019 (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len &&
1020 os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk,
1021 sm->gtk_wnm_sleep.gtk_len) == 0)) {
1022 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1023 "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)",
1024 gd->keyidx, gd->tx, gd->gtk_len);
1025 return 0;
1026 }
1027
1028 wpa_hexdump_key(MSG_DEBUG, "WPA: Group Key", gd->gtk, gd->gtk_len);
1029 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1030 "WPA: Installing GTK to the driver (keyidx=%d tx=%d len=%d)",
1031 gd->keyidx, gd->tx, gd->gtk_len);
1032 wpa_hexdump(MSG_DEBUG, "WPA: RSC", key_rsc, gd->key_rsc_len);
1033 if (sm->group_cipher == WPA_CIPHER_TKIP) {
1034 /* Swap Tx/Rx keys for Michael MIC */
1035 os_memcpy(gtk_buf, gd->gtk, 16);
1036 os_memcpy(gtk_buf + 16, gd->gtk + 24, 8);
1037 os_memcpy(gtk_buf + 24, gd->gtk + 16, 8);
1038 _gtk = gtk_buf;
1039 }
1040 if (sm->pairwise_cipher == WPA_CIPHER_NONE) {
1041 if (wpa_sm_set_key(sm, gd->alg, NULL,
1042 gd->keyidx, 1, key_rsc, gd->key_rsc_len,
1043 _gtk, gd->gtk_len,
1044 KEY_FLAG_GROUP_RX_TX_DEFAULT) < 0) {
1045 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1046 "WPA: Failed to set GTK to the driver "
1047 "(Group only)");
1048 forced_memzero(gtk_buf, sizeof(gtk_buf));
1049 return -1;
1050 }
1051 } else if (wpa_sm_set_key(sm, gd->alg, broadcast_ether_addr,
1052 gd->keyidx, gd->tx, key_rsc, gd->key_rsc_len,
1053 _gtk, gd->gtk_len, KEY_FLAG_GROUP_RX) < 0) {
1054 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1055 "WPA: Failed to set GTK to "
1056 "the driver (alg=%d keylen=%d keyidx=%d)",
1057 gd->alg, gd->gtk_len, gd->keyidx);
1058 forced_memzero(gtk_buf, sizeof(gtk_buf));
1059 return -1;
1060 }
1061 forced_memzero(gtk_buf, sizeof(gtk_buf));
1062
1063 if (wnm_sleep) {
1064 sm->gtk_wnm_sleep.gtk_len = gd->gtk_len;
1065 os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk,
1066 sm->gtk_wnm_sleep.gtk_len);
1067 } else {
1068 sm->gtk.gtk_len = gd->gtk_len;
1069 os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
1070 }
1071
1072 return 0;
1073 }
1074
1075
wpa_supplicant_gtk_tx_bit_workaround(const struct wpa_sm * sm,int tx)1076 static int wpa_supplicant_gtk_tx_bit_workaround(const struct wpa_sm *sm,
1077 int tx)
1078 {
1079 if (tx && sm->pairwise_cipher != WPA_CIPHER_NONE) {
1080 /* Ignore Tx bit for GTK if a pairwise key is used. One AP
1081 * seemed to set this bit (incorrectly, since Tx is only when
1082 * doing Group Key only APs) and without this workaround, the
1083 * data connection does not work because wpa_supplicant
1084 * configured non-zero keyidx to be used for unicast. */
1085 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1086 "WPA: Tx bit set for GTK, but pairwise "
1087 "keys are used - ignore Tx bit");
1088 return 0;
1089 }
1090 return tx;
1091 }
1092
1093
wpa_supplicant_rsc_relaxation(const struct wpa_sm * sm,const u8 * rsc)1094 static int wpa_supplicant_rsc_relaxation(const struct wpa_sm *sm,
1095 const u8 *rsc)
1096 {
1097 int rsclen;
1098
1099 if (!sm->wpa_rsc_relaxation)
1100 return 0;
1101
1102 rsclen = wpa_cipher_rsc_len(sm->group_cipher);
1103
1104 /*
1105 * Try to detect RSC (endian) corruption issue where the AP sends
1106 * the RSC bytes in EAPOL-Key message in the wrong order, both if
1107 * it's actually a 6-byte field (as it should be) and if it treats
1108 * it as an 8-byte field.
1109 * An AP model known to have this bug is the Sapido RB-1632.
1110 */
1111 if (rsclen == 6 && ((rsc[5] && !rsc[0]) || rsc[6] || rsc[7])) {
1112 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1113 "RSC %02x%02x%02x%02x%02x%02x%02x%02x is likely bogus, using 0",
1114 rsc[0], rsc[1], rsc[2], rsc[3],
1115 rsc[4], rsc[5], rsc[6], rsc[7]);
1116
1117 return 1;
1118 }
1119
1120 return 0;
1121 }
1122
1123
wpa_supplicant_pairwise_gtk(struct wpa_sm * sm,const struct wpa_eapol_key * key,const u8 * gtk,size_t gtk_len,int key_info)1124 static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm,
1125 const struct wpa_eapol_key *key,
1126 const u8 *gtk, size_t gtk_len,
1127 int key_info)
1128 {
1129 struct wpa_gtk_data gd;
1130 const u8 *key_rsc;
1131
1132 /*
1133 * IEEE Std 802.11i-2004 - 8.5.2 EAPOL-Key frames - Figure 43x
1134 * GTK KDE format:
1135 * KeyID[bits 0-1], Tx [bit 2], Reserved [bits 3-7]
1136 * Reserved [bits 0-7]
1137 * GTK
1138 */
1139
1140 os_memset(&gd, 0, sizeof(gd));
1141 wpa_hexdump_key(MSG_DEBUG, "RSN: received GTK in pairwise handshake",
1142 gtk, gtk_len);
1143
1144 if (gtk_len < 2 || gtk_len - 2 > sizeof(gd.gtk))
1145 return -1;
1146
1147 gd.keyidx = gtk[0] & 0x3;
1148 gd.tx = wpa_supplicant_gtk_tx_bit_workaround(sm,
1149 !!(gtk[0] & BIT(2)));
1150 gtk += 2;
1151 gtk_len -= 2;
1152
1153 os_memcpy(gd.gtk, gtk, gtk_len);
1154 gd.gtk_len = gtk_len;
1155
1156 key_rsc = key->key_rsc;
1157 if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
1158 key_rsc = null_rsc;
1159
1160 if (sm->group_cipher != WPA_CIPHER_GTK_NOT_USED &&
1161 (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
1162 gtk_len, gtk_len,
1163 &gd.key_rsc_len, &gd.alg) ||
1164 wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) {
1165 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1166 "RSN: Failed to install GTK");
1167 forced_memzero(&gd, sizeof(gd));
1168 return -1;
1169 }
1170 forced_memzero(&gd, sizeof(gd));
1171
1172 return 0;
1173 }
1174
1175
wpa_supplicant_install_igtk(struct wpa_sm * sm,const struct wpa_igtk_kde * igtk,int wnm_sleep)1176 static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
1177 const struct wpa_igtk_kde *igtk,
1178 int wnm_sleep)
1179 {
1180 size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1181 u16 keyidx = WPA_GET_LE16(igtk->keyid);
1182
1183 /* Detect possible key reinstallation */
1184 if ((sm->igtk.igtk_len == len &&
1185 os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) ||
1186 (sm->igtk_wnm_sleep.igtk_len == len &&
1187 os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk,
1188 sm->igtk_wnm_sleep.igtk_len) == 0)) {
1189 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1190 "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)",
1191 keyidx);
1192 return 0;
1193 }
1194
1195 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1196 "WPA: IGTK keyid %d pn " COMPACT_MACSTR,
1197 keyidx, MAC2STR(igtk->pn));
1198 wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", igtk->igtk, len);
1199 if (keyidx > 4095) {
1200 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1201 "WPA: Invalid IGTK KeyID %d", keyidx);
1202 return -1;
1203 }
1204 if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
1205 broadcast_ether_addr,
1206 keyidx, 0, igtk->pn, sizeof(igtk->pn),
1207 igtk->igtk, len, KEY_FLAG_GROUP_RX) < 0) {
1208 if (keyidx == 0x0400 || keyidx == 0x0500) {
1209 /* Assume the AP has broken PMF implementation since it
1210 * seems to have swapped the KeyID bytes. The AP cannot
1211 * be trusted to implement BIP correctly or provide a
1212 * valid IGTK, so do not try to configure this key with
1213 * swapped KeyID bytes. Instead, continue without
1214 * configuring the IGTK so that the driver can drop any
1215 * received group-addressed robust management frames due
1216 * to missing keys.
1217 *
1218 * Normally, this error behavior would result in us
1219 * disconnecting, but there are number of deployed APs
1220 * with this broken behavior, so as an interoperability
1221 * workaround, allow the connection to proceed. */
1222 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1223 "WPA: Ignore IGTK configuration error due to invalid IGTK KeyID byte order");
1224 } else {
1225 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1226 "WPA: Failed to configure IGTK to the driver");
1227 return -1;
1228 }
1229 }
1230
1231 if (wnm_sleep) {
1232 sm->igtk_wnm_sleep.igtk_len = len;
1233 os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk,
1234 sm->igtk_wnm_sleep.igtk_len);
1235 } else {
1236 sm->igtk.igtk_len = len;
1237 os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
1238 }
1239
1240 return 0;
1241 }
1242
1243
wpa_supplicant_install_bigtk(struct wpa_sm * sm,const struct wpa_bigtk_kde * bigtk,int wnm_sleep)1244 static int wpa_supplicant_install_bigtk(struct wpa_sm *sm,
1245 const struct wpa_bigtk_kde *bigtk,
1246 int wnm_sleep)
1247 {
1248 size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1249 u16 keyidx = WPA_GET_LE16(bigtk->keyid);
1250
1251 /* Detect possible key reinstallation */
1252 if ((sm->bigtk.bigtk_len == len &&
1253 os_memcmp(sm->bigtk.bigtk, bigtk->bigtk,
1254 sm->bigtk.bigtk_len) == 0) ||
1255 (sm->bigtk_wnm_sleep.bigtk_len == len &&
1256 os_memcmp(sm->bigtk_wnm_sleep.bigtk, bigtk->bigtk,
1257 sm->bigtk_wnm_sleep.bigtk_len) == 0)) {
1258 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1259 "WPA: Not reinstalling already in-use BIGTK to the driver (keyidx=%d)",
1260 keyidx);
1261 return 0;
1262 }
1263
1264 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1265 "WPA: BIGTK keyid %d pn " COMPACT_MACSTR,
1266 keyidx, MAC2STR(bigtk->pn));
1267 wpa_hexdump_key(MSG_DEBUG, "WPA: BIGTK", bigtk->bigtk, len);
1268 if (keyidx < 6 || keyidx > 7) {
1269 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1270 "WPA: Invalid BIGTK KeyID %d", keyidx);
1271 return -1;
1272 }
1273 if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
1274 broadcast_ether_addr,
1275 keyidx, 0, bigtk->pn, sizeof(bigtk->pn),
1276 bigtk->bigtk, len, KEY_FLAG_GROUP_RX) < 0) {
1277 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1278 "WPA: Failed to configure BIGTK to the driver");
1279 return -1;
1280 }
1281
1282 if (wnm_sleep) {
1283 sm->bigtk_wnm_sleep.bigtk_len = len;
1284 os_memcpy(sm->bigtk_wnm_sleep.bigtk, bigtk->bigtk,
1285 sm->bigtk_wnm_sleep.bigtk_len);
1286 } else {
1287 sm->bigtk.bigtk_len = len;
1288 os_memcpy(sm->bigtk.bigtk, bigtk->bigtk, sm->bigtk.bigtk_len);
1289 }
1290
1291 return 0;
1292 }
1293
1294
ieee80211w_set_keys(struct wpa_sm * sm,struct wpa_eapol_ie_parse * ie)1295 static int ieee80211w_set_keys(struct wpa_sm *sm,
1296 struct wpa_eapol_ie_parse *ie)
1297 {
1298 size_t len;
1299
1300 if (!wpa_cipher_valid_mgmt_group(sm->mgmt_group_cipher))
1301 return 0;
1302
1303 if (ie->igtk) {
1304 const struct wpa_igtk_kde *igtk;
1305
1306 len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1307 if (ie->igtk_len != WPA_IGTK_KDE_PREFIX_LEN + len)
1308 return -1;
1309
1310 igtk = (const struct wpa_igtk_kde *) ie->igtk;
1311 if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0)
1312 return -1;
1313 }
1314
1315 if (ie->bigtk && sm->beacon_prot) {
1316 const struct wpa_bigtk_kde *bigtk;
1317
1318 len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1319 if (ie->bigtk_len != WPA_BIGTK_KDE_PREFIX_LEN + len)
1320 return -1;
1321
1322 bigtk = (const struct wpa_bigtk_kde *) ie->bigtk;
1323 if (wpa_supplicant_install_bigtk(sm, bigtk, 0) < 0)
1324 return -1;
1325 }
1326
1327 return 0;
1328 }
1329
1330
wpa_report_ie_mismatch(struct wpa_sm * sm,const char * reason,const u8 * src_addr,const u8 * wpa_ie,size_t wpa_ie_len,const u8 * rsn_ie,size_t rsn_ie_len)1331 static void wpa_report_ie_mismatch(struct wpa_sm *sm,
1332 const char *reason, const u8 *src_addr,
1333 const u8 *wpa_ie, size_t wpa_ie_len,
1334 const u8 *rsn_ie, size_t rsn_ie_len)
1335 {
1336 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "WPA: %s (src=" MACSTR ")",
1337 reason, MAC2STR(src_addr));
1338
1339 if (sm->ap_wpa_ie) {
1340 wpa_hexdump(MSG_INFO, "WPA: WPA IE in Beacon/ProbeResp",
1341 sm->ap_wpa_ie, sm->ap_wpa_ie_len);
1342 }
1343 if (wpa_ie) {
1344 if (!sm->ap_wpa_ie) {
1345 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1346 "WPA: No WPA IE in Beacon/ProbeResp");
1347 }
1348 wpa_hexdump(MSG_INFO, "WPA: WPA IE in 3/4 msg",
1349 wpa_ie, wpa_ie_len);
1350 }
1351
1352 if (sm->ap_rsn_ie) {
1353 wpa_hexdump(MSG_INFO, "WPA: RSN IE in Beacon/ProbeResp",
1354 sm->ap_rsn_ie, sm->ap_rsn_ie_len);
1355 }
1356 if (rsn_ie) {
1357 if (!sm->ap_rsn_ie) {
1358 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1359 "WPA: No RSN IE in Beacon/ProbeResp");
1360 }
1361 wpa_hexdump(MSG_INFO, "WPA: RSN IE in 3/4 msg",
1362 rsn_ie, rsn_ie_len);
1363 }
1364
1365 wpa_sm_deauthenticate(sm, WLAN_REASON_IE_IN_4WAY_DIFFERS);
1366 }
1367
1368
1369 #ifdef CONFIG_IEEE80211R
1370
ft_validate_mdie(struct wpa_sm * sm,const unsigned char * src_addr,struct wpa_eapol_ie_parse * ie,const u8 * assoc_resp_mdie)1371 static int ft_validate_mdie(struct wpa_sm *sm,
1372 const unsigned char *src_addr,
1373 struct wpa_eapol_ie_parse *ie,
1374 const u8 *assoc_resp_mdie)
1375 {
1376 struct rsn_mdie *mdie;
1377
1378 mdie = (struct rsn_mdie *) (ie->mdie + 2);
1379 if (ie->mdie == NULL || ie->mdie_len < 2 + sizeof(*mdie) ||
1380 os_memcmp(mdie->mobility_domain, sm->mobility_domain,
1381 MOBILITY_DOMAIN_ID_LEN) != 0) {
1382 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: MDIE in msg 3/4 did "
1383 "not match with the current mobility domain");
1384 return -1;
1385 }
1386
1387 if (assoc_resp_mdie &&
1388 (assoc_resp_mdie[1] != ie->mdie[1] ||
1389 os_memcmp(assoc_resp_mdie, ie->mdie, 2 + ie->mdie[1]) != 0)) {
1390 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: MDIE mismatch");
1391 wpa_hexdump(MSG_DEBUG, "FT: MDIE in EAPOL-Key msg 3/4",
1392 ie->mdie, 2 + ie->mdie[1]);
1393 wpa_hexdump(MSG_DEBUG, "FT: MDIE in (Re)Association Response",
1394 assoc_resp_mdie, 2 + assoc_resp_mdie[1]);
1395 return -1;
1396 }
1397
1398 return 0;
1399 }
1400
1401
ft_validate_ftie(struct wpa_sm * sm,const unsigned char * src_addr,struct wpa_eapol_ie_parse * ie,const u8 * assoc_resp_ftie)1402 static int ft_validate_ftie(struct wpa_sm *sm,
1403 const unsigned char *src_addr,
1404 struct wpa_eapol_ie_parse *ie,
1405 const u8 *assoc_resp_ftie)
1406 {
1407 if (ie->ftie == NULL) {
1408 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1409 "FT: No FTIE in EAPOL-Key msg 3/4");
1410 return -1;
1411 }
1412
1413 if (assoc_resp_ftie == NULL)
1414 return 0;
1415
1416 if (assoc_resp_ftie[1] != ie->ftie[1] ||
1417 os_memcmp(assoc_resp_ftie, ie->ftie, 2 + ie->ftie[1]) != 0) {
1418 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: FTIE mismatch");
1419 wpa_hexdump(MSG_DEBUG, "FT: FTIE in EAPOL-Key msg 3/4",
1420 ie->ftie, 2 + ie->ftie[1]);
1421 wpa_hexdump(MSG_DEBUG, "FT: FTIE in (Re)Association Response",
1422 assoc_resp_ftie, 2 + assoc_resp_ftie[1]);
1423 return -1;
1424 }
1425
1426 return 0;
1427 }
1428
1429
ft_validate_rsnie(struct wpa_sm * sm,const unsigned char * src_addr,struct wpa_eapol_ie_parse * ie)1430 static int ft_validate_rsnie(struct wpa_sm *sm,
1431 const unsigned char *src_addr,
1432 struct wpa_eapol_ie_parse *ie)
1433 {
1434 struct wpa_ie_data rsn;
1435
1436 if (!ie->rsn_ie)
1437 return 0;
1438
1439 /*
1440 * Verify that PMKR1Name from EAPOL-Key message 3/4
1441 * matches with the value we derived.
1442 */
1443 if (wpa_parse_wpa_ie_rsn(ie->rsn_ie, ie->rsn_ie_len, &rsn) < 0 ||
1444 rsn.num_pmkid != 1 || rsn.pmkid == NULL) {
1445 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: No PMKR1Name in "
1446 "FT 4-way handshake message 3/4");
1447 return -1;
1448 }
1449
1450 if (os_memcmp_const(rsn.pmkid, sm->pmk_r1_name, WPA_PMK_NAME_LEN) != 0)
1451 {
1452 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1453 "FT: PMKR1Name mismatch in "
1454 "FT 4-way handshake message 3/4");
1455 wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name from Authenticator",
1456 rsn.pmkid, WPA_PMK_NAME_LEN);
1457 wpa_hexdump(MSG_DEBUG, "FT: Derived PMKR1Name",
1458 sm->pmk_r1_name, WPA_PMK_NAME_LEN);
1459 return -1;
1460 }
1461
1462 return 0;
1463 }
1464
1465
wpa_supplicant_validate_ie_ft(struct wpa_sm * sm,const unsigned char * src_addr,struct wpa_eapol_ie_parse * ie)1466 static int wpa_supplicant_validate_ie_ft(struct wpa_sm *sm,
1467 const unsigned char *src_addr,
1468 struct wpa_eapol_ie_parse *ie)
1469 {
1470 const u8 *pos, *end, *mdie = NULL, *ftie = NULL;
1471
1472 if (sm->assoc_resp_ies) {
1473 pos = sm->assoc_resp_ies;
1474 end = pos + sm->assoc_resp_ies_len;
1475 while (end - pos > 2) {
1476 if (2 + pos[1] > end - pos)
1477 break;
1478 switch (*pos) {
1479 case WLAN_EID_MOBILITY_DOMAIN:
1480 mdie = pos;
1481 break;
1482 case WLAN_EID_FAST_BSS_TRANSITION:
1483 ftie = pos;
1484 break;
1485 }
1486 pos += 2 + pos[1];
1487 }
1488 }
1489
1490 if (ft_validate_mdie(sm, src_addr, ie, mdie) < 0 ||
1491 ft_validate_ftie(sm, src_addr, ie, ftie) < 0 ||
1492 ft_validate_rsnie(sm, src_addr, ie) < 0)
1493 return -1;
1494
1495 return 0;
1496 }
1497
1498 #endif /* CONFIG_IEEE80211R */
1499
1500
wpa_supplicant_validate_ie(struct wpa_sm * sm,const unsigned char * src_addr,struct wpa_eapol_ie_parse * ie)1501 static int wpa_supplicant_validate_ie(struct wpa_sm *sm,
1502 const unsigned char *src_addr,
1503 struct wpa_eapol_ie_parse *ie)
1504 {
1505 if (sm->ap_wpa_ie == NULL && sm->ap_rsn_ie == NULL) {
1506 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1507 "WPA: No WPA/RSN IE for this AP known. "
1508 "Trying to get from scan results");
1509 if (wpa_sm_get_beacon_ie(sm) < 0) {
1510 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1511 "WPA: Could not find AP from "
1512 "the scan results");
1513 return -1;
1514 }
1515 wpa_msg(sm->ctx->msg_ctx, MSG_DEBUG,
1516 "WPA: Found the current AP from updated scan results");
1517 }
1518
1519 if (ie->wpa_ie == NULL && ie->rsn_ie == NULL &&
1520 (sm->ap_wpa_ie || sm->ap_rsn_ie)) {
1521 wpa_report_ie_mismatch(sm, "IE in 3/4 msg does not match "
1522 "with IE in Beacon/ProbeResp (no IE?)",
1523 src_addr, ie->wpa_ie, ie->wpa_ie_len,
1524 ie->rsn_ie, ie->rsn_ie_len);
1525 return -1;
1526 }
1527
1528 if ((ie->wpa_ie && sm->ap_wpa_ie &&
1529 (ie->wpa_ie_len != sm->ap_wpa_ie_len ||
1530 os_memcmp(ie->wpa_ie, sm->ap_wpa_ie, ie->wpa_ie_len) != 0)) ||
1531 (ie->rsn_ie && sm->ap_rsn_ie &&
1532 wpa_compare_rsn_ie(wpa_key_mgmt_ft(sm->key_mgmt),
1533 sm->ap_rsn_ie, sm->ap_rsn_ie_len,
1534 ie->rsn_ie, ie->rsn_ie_len))) {
1535 wpa_report_ie_mismatch(sm, "IE in 3/4 msg does not match "
1536 "with IE in Beacon/ProbeResp",
1537 src_addr, ie->wpa_ie, ie->wpa_ie_len,
1538 ie->rsn_ie, ie->rsn_ie_len);
1539 return -1;
1540 }
1541
1542 if (sm->proto == WPA_PROTO_WPA &&
1543 ie->rsn_ie && sm->ap_rsn_ie == NULL && sm->rsn_enabled) {
1544 wpa_report_ie_mismatch(sm, "Possible downgrade attack "
1545 "detected - RSN was enabled and RSN IE "
1546 "was in msg 3/4, but not in "
1547 "Beacon/ProbeResp",
1548 src_addr, ie->wpa_ie, ie->wpa_ie_len,
1549 ie->rsn_ie, ie->rsn_ie_len);
1550 return -1;
1551 }
1552
1553 if ((sm->ap_rsnxe && !ie->rsnxe) ||
1554 (!sm->ap_rsnxe && ie->rsnxe) ||
1555 (sm->ap_rsnxe && ie->rsnxe &&
1556 (sm->ap_rsnxe_len != ie->rsnxe_len ||
1557 os_memcmp(sm->ap_rsnxe, ie->rsnxe, sm->ap_rsnxe_len) != 0))) {
1558 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1559 "WPA: RSNXE mismatch between Beacon/ProbeResp and EAPOL-Key msg 3/4");
1560 wpa_hexdump(MSG_INFO, "RSNXE in Beacon/ProbeResp",
1561 sm->ap_rsnxe, sm->ap_rsnxe_len);
1562 wpa_hexdump(MSG_INFO, "RSNXE in EAPOL-Key msg 3/4",
1563 ie->rsnxe, ie->rsnxe_len);
1564 wpa_sm_deauthenticate(sm, WLAN_REASON_IE_IN_4WAY_DIFFERS);
1565 return -1;
1566 }
1567
1568 #ifdef CONFIG_IEEE80211R
1569 if (wpa_key_mgmt_ft(sm->key_mgmt) &&
1570 wpa_supplicant_validate_ie_ft(sm, src_addr, ie) < 0)
1571 return -1;
1572 #endif /* CONFIG_IEEE80211R */
1573
1574 return 0;
1575 }
1576
1577
1578 /**
1579 * wpa_supplicant_send_4_of_4 - Send message 4 of WPA/RSN 4-Way Handshake
1580 * @sm: Pointer to WPA state machine data from wpa_sm_init()
1581 * @dst: Destination address for the frame
1582 * @key: Pointer to the EAPOL-Key frame header
1583 * @ver: Version bits from EAPOL-Key Key Info
1584 * @key_info: Key Info
1585 * @ptk: PTK to use for keyed hash and encryption
1586 * Returns: >= 0 on success, < 0 on failure
1587 */
wpa_supplicant_send_4_of_4(struct wpa_sm * sm,const unsigned char * dst,const struct wpa_eapol_key * key,u16 ver,u16 key_info,struct wpa_ptk * ptk)1588 int wpa_supplicant_send_4_of_4(struct wpa_sm *sm, const unsigned char *dst,
1589 const struct wpa_eapol_key *key,
1590 u16 ver, u16 key_info,
1591 struct wpa_ptk *ptk)
1592 {
1593 size_t mic_len, hdrlen, rlen;
1594 struct wpa_eapol_key *reply;
1595 u8 *rbuf, *key_mic;
1596
1597 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
1598 hdrlen = sizeof(*reply) + mic_len + 2;
1599 rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
1600 hdrlen, &rlen, (void *) &reply);
1601 if (rbuf == NULL)
1602 return -1;
1603
1604 reply->type = (sm->proto == WPA_PROTO_RSN ||
1605 sm->proto == WPA_PROTO_OSEN) ?
1606 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
1607 key_info &= WPA_KEY_INFO_SECURE;
1608 key_info |= ver | WPA_KEY_INFO_KEY_TYPE;
1609 if (mic_len)
1610 key_info |= WPA_KEY_INFO_MIC;
1611 else
1612 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
1613 WPA_PUT_BE16(reply->key_info, key_info);
1614 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN)
1615 WPA_PUT_BE16(reply->key_length, 0);
1616 else
1617 os_memcpy(reply->key_length, key->key_length, 2);
1618 os_memcpy(reply->replay_counter, key->replay_counter,
1619 WPA_REPLAY_COUNTER_LEN);
1620
1621 key_mic = (u8 *) (reply + 1);
1622 WPA_PUT_BE16(key_mic + mic_len, 0);
1623
1624 wpa_dbg(sm->ctx->msg_ctx, MSG_INFO, "WPA: Sending EAPOL-Key 4/4");
1625 return wpa_eapol_key_send(sm, ptk, ver, dst, ETH_P_EAPOL, rbuf, rlen,
1626 key_mic);
1627 }
1628
1629
wpa_supplicant_process_3_of_4(struct wpa_sm * sm,const struct wpa_eapol_key * key,u16 ver,const u8 * key_data,size_t key_data_len)1630 static void wpa_supplicant_process_3_of_4(struct wpa_sm *sm,
1631 const struct wpa_eapol_key *key,
1632 u16 ver, const u8 *key_data,
1633 size_t key_data_len)
1634 {
1635 u16 key_info, keylen;
1636 struct wpa_eapol_ie_parse ie;
1637
1638 wpa_sm_set_state(sm, WPA_4WAY_HANDSHAKE);
1639 wpa_dbg(sm->ctx->msg_ctx, MSG_INFO, "WPA: RX message 3 of 4-Way "
1640 "Handshake from " MACSTR " (ver=%d)", MAC2STR(sm->bssid), ver);
1641
1642 key_info = WPA_GET_BE16(key->key_info);
1643
1644 wpa_hexdump(MSG_DEBUG, "WPA: IE KeyData", key_data, key_data_len);
1645 if (wpa_supplicant_parse_ies(key_data, key_data_len, &ie) < 0)
1646 goto failed;
1647 if (ie.gtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
1648 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1649 "WPA: GTK IE in unencrypted key data");
1650 goto failed;
1651 }
1652 if (ie.igtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
1653 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1654 "WPA: IGTK KDE in unencrypted key data");
1655 goto failed;
1656 }
1657
1658 if (ie.igtk &&
1659 wpa_cipher_valid_mgmt_group(sm->mgmt_group_cipher) &&
1660 ie.igtk_len != WPA_IGTK_KDE_PREFIX_LEN +
1661 (unsigned int) wpa_cipher_key_len(sm->mgmt_group_cipher)) {
1662 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1663 "WPA: Invalid IGTK KDE length %lu",
1664 (unsigned long) ie.igtk_len);
1665 goto failed;
1666 }
1667
1668 if (wpa_supplicant_validate_ie(sm, sm->bssid, &ie) < 0)
1669 goto failed;
1670
1671 if (wpa_handle_ext_key_id(sm, &ie))
1672 goto failed;
1673
1674 if (os_memcmp(sm->anonce, key->key_nonce, WPA_NONCE_LEN) != 0) {
1675 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1676 "WPA: ANonce from message 1 of 4-Way Handshake "
1677 "differs from 3 of 4-Way Handshake - drop packet (src="
1678 MACSTR ")", MAC2STR(sm->bssid));
1679 goto failed;
1680 }
1681
1682 keylen = WPA_GET_BE16(key->key_length);
1683 if (keylen != wpa_cipher_key_len(sm->pairwise_cipher)) {
1684 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1685 "WPA: Invalid %s key length %d (src=" MACSTR
1686 ")", wpa_cipher_txt(sm->pairwise_cipher), keylen,
1687 MAC2STR(sm->bssid));
1688 goto failed;
1689 }
1690
1691 #ifdef CONFIG_P2P
1692 if (ie.ip_addr_alloc) {
1693 os_memcpy(sm->p2p_ip_addr, ie.ip_addr_alloc, 3 * 4);
1694 wpa_hexdump(MSG_DEBUG, "P2P: IP address info",
1695 sm->p2p_ip_addr, sizeof(sm->p2p_ip_addr));
1696 }
1697 #endif /* CONFIG_P2P */
1698
1699 #ifdef CONFIG_OCV
1700 if (wpa_sm_ocv_enabled(sm)) {
1701 struct wpa_channel_info ci;
1702
1703 if (wpa_sm_channel_info(sm, &ci) != 0) {
1704 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1705 "Failed to get channel info to validate received OCI in EAPOL-Key 3/4");
1706 return;
1707 }
1708
1709 if (ocv_verify_tx_params(ie.oci, ie.oci_len, &ci,
1710 channel_width_to_int(ci.chanwidth),
1711 ci.seg1_idx) != 0) {
1712 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "%s",
1713 ocv_errorstr);
1714 return;
1715 }
1716 }
1717 #endif /* CONFIG_OCV */
1718
1719 #ifdef CONFIG_DPP2
1720 if (DPP_VERSION > 1 && ie.dpp_kde) {
1721 wpa_printf(MSG_DEBUG,
1722 "DPP: peer Protocol Version %u Flags 0x%x",
1723 ie.dpp_kde[0], ie.dpp_kde[1]);
1724 if (sm->key_mgmt == WPA_KEY_MGMT_DPP && sm->dpp_pfs != 2 &&
1725 (ie.dpp_kde[1] & DPP_KDE_PFS_ALLOWED) && !sm->dpp_z) {
1726 wpa_printf(MSG_INFO,
1727 "DPP: Peer indicated it supports PFS and local configuration allows this, but PFS was not negotiated for the association");
1728 goto failed;
1729 }
1730 }
1731 #endif /* CONFIG_DPP2 */
1732
1733 if (sm->use_ext_key_id &&
1734 wpa_supplicant_install_ptk(sm, key, KEY_FLAG_RX))
1735 goto failed;
1736
1737 if (wpa_supplicant_send_4_of_4(sm, sm->bssid, key, ver, key_info,
1738 &sm->ptk) < 0) {
1739 goto failed;
1740 }
1741
1742 /* SNonce was successfully used in msg 3/4, so mark it to be renewed
1743 * for the next 4-Way Handshake. If msg 3 is received again, the old
1744 * SNonce will still be used to avoid changing PTK. */
1745 sm->renew_snonce = 1;
1746
1747 if (key_info & WPA_KEY_INFO_INSTALL) {
1748 int res;
1749
1750 if (sm->use_ext_key_id)
1751 res = wpa_supplicant_activate_ptk(sm);
1752 else
1753 res = wpa_supplicant_install_ptk(sm, key,
1754 KEY_FLAG_RX_TX);
1755 if (res)
1756 goto failed;
1757 }
1758
1759 if (key_info & WPA_KEY_INFO_SECURE) {
1760 wpa_sm_mlme_setprotection(
1761 sm, sm->bssid, MLME_SETPROTECTION_PROTECT_TYPE_RX,
1762 MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
1763 eapol_sm_notify_portValid(sm->eapol, true);
1764 }
1765 wpa_sm_set_state(sm, WPA_GROUP_HANDSHAKE);
1766
1767 if (sm->group_cipher == WPA_CIPHER_GTK_NOT_USED) {
1768 /* No GTK to be set to the driver */
1769 } else if (!ie.gtk && sm->proto == WPA_PROTO_RSN) {
1770 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1771 "RSN: No GTK KDE included in EAPOL-Key msg 3/4");
1772 goto failed;
1773 } else if (ie.gtk &&
1774 wpa_supplicant_pairwise_gtk(sm, key,
1775 ie.gtk, ie.gtk_len, key_info) < 0) {
1776 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1777 "RSN: Failed to configure GTK");
1778 goto failed;
1779 }
1780
1781 if (ieee80211w_set_keys(sm, &ie) < 0) {
1782 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1783 "RSN: Failed to configure IGTK");
1784 goto failed;
1785 }
1786
1787 if (sm->group_cipher == WPA_CIPHER_GTK_NOT_USED || ie.gtk)
1788 wpa_supplicant_key_neg_complete(sm, sm->bssid,
1789 key_info & WPA_KEY_INFO_SECURE);
1790
1791 if (ie.gtk)
1792 wpa_sm_set_rekey_offload(sm);
1793
1794 /* Add PMKSA cache entry for Suite B AKMs here since PMKID can be
1795 * calculated only after KCK has been derived. Though, do not replace an
1796 * existing PMKSA entry after each 4-way handshake (i.e., new KCK/PMKID)
1797 * to avoid unnecessary changes of PMKID while continuing to use the
1798 * same PMK. */
1799 if (sm->proto == WPA_PROTO_RSN && wpa_key_mgmt_suite_b(sm->key_mgmt) &&
1800 !sm->cur_pmksa) {
1801 struct rsn_pmksa_cache_entry *sa;
1802
1803 sa = pmksa_cache_add(sm->pmksa, sm->pmk, sm->pmk_len, NULL,
1804 sm->ptk.kck, sm->ptk.kck_len,
1805 sm->bssid, sm->own_addr,
1806 sm->network_ctx, sm->key_mgmt, NULL);
1807 if (!sm->cur_pmksa)
1808 sm->cur_pmksa = sa;
1809 }
1810
1811 if (ie.transition_disable)
1812 wpa_sm_transition_disable(sm, ie.transition_disable[0]);
1813 sm->msg_3_of_4_ok = 1;
1814 return;
1815
1816 failed:
1817 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
1818 }
1819
1820
wpa_supplicant_process_1_of_2_rsn(struct wpa_sm * sm,const u8 * keydata,size_t keydatalen,u16 key_info,struct wpa_gtk_data * gd)1821 static int wpa_supplicant_process_1_of_2_rsn(struct wpa_sm *sm,
1822 const u8 *keydata,
1823 size_t keydatalen,
1824 u16 key_info,
1825 struct wpa_gtk_data *gd)
1826 {
1827 int maxkeylen;
1828 struct wpa_eapol_ie_parse ie;
1829
1830 wpa_hexdump_key(MSG_DEBUG, "RSN: msg 1/2 key data",
1831 keydata, keydatalen);
1832 if (wpa_supplicant_parse_ies(keydata, keydatalen, &ie) < 0)
1833 return -1;
1834 if (ie.gtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
1835 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1836 "WPA: GTK IE in unencrypted key data");
1837 return -1;
1838 }
1839 if (ie.gtk == NULL) {
1840 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1841 "WPA: No GTK IE in Group Key msg 1/2");
1842 return -1;
1843 }
1844 maxkeylen = gd->gtk_len = ie.gtk_len - 2;
1845
1846 #ifdef CONFIG_OCV
1847 if (wpa_sm_ocv_enabled(sm)) {
1848 struct wpa_channel_info ci;
1849
1850 if (wpa_sm_channel_info(sm, &ci) != 0) {
1851 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1852 "Failed to get channel info to validate received OCI in EAPOL-Key group msg 1/2");
1853 return -1;
1854 }
1855
1856 if (ocv_verify_tx_params(ie.oci, ie.oci_len, &ci,
1857 channel_width_to_int(ci.chanwidth),
1858 ci.seg1_idx) != 0) {
1859 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "%s",
1860 ocv_errorstr);
1861 return -1;
1862 }
1863 }
1864 #endif /* CONFIG_OCV */
1865
1866 if (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
1867 gd->gtk_len, maxkeylen,
1868 &gd->key_rsc_len, &gd->alg))
1869 return -1;
1870
1871 wpa_hexdump_key(MSG_DEBUG, "RSN: received GTK in group key handshake",
1872 ie.gtk, ie.gtk_len);
1873 gd->keyidx = ie.gtk[0] & 0x3;
1874 gd->tx = wpa_supplicant_gtk_tx_bit_workaround(sm,
1875 !!(ie.gtk[0] & BIT(2)));
1876 if (ie.gtk_len - 2 > sizeof(gd->gtk)) {
1877 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1878 "RSN: Too long GTK in GTK IE (len=%lu)",
1879 (unsigned long) ie.gtk_len - 2);
1880 return -1;
1881 }
1882 os_memcpy(gd->gtk, ie.gtk + 2, ie.gtk_len - 2);
1883
1884 if (ieee80211w_set_keys(sm, &ie) < 0)
1885 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1886 "RSN: Failed to configure IGTK");
1887
1888 return 0;
1889 }
1890
1891
wpa_supplicant_process_1_of_2_wpa(struct wpa_sm * sm,const struct wpa_eapol_key * key,const u8 * key_data,size_t key_data_len,u16 key_info,u16 ver,struct wpa_gtk_data * gd)1892 static int wpa_supplicant_process_1_of_2_wpa(struct wpa_sm *sm,
1893 const struct wpa_eapol_key *key,
1894 const u8 *key_data,
1895 size_t key_data_len, u16 key_info,
1896 u16 ver, struct wpa_gtk_data *gd)
1897 {
1898 size_t maxkeylen;
1899 u16 gtk_len;
1900
1901 gtk_len = WPA_GET_BE16(key->key_length);
1902 maxkeylen = key_data_len;
1903 if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
1904 if (maxkeylen < 8) {
1905 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1906 "WPA: Too short maxkeylen (%lu)",
1907 (unsigned long) maxkeylen);
1908 return -1;
1909 }
1910 maxkeylen -= 8;
1911 }
1912
1913 if (gtk_len > maxkeylen ||
1914 wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
1915 gtk_len, maxkeylen,
1916 &gd->key_rsc_len, &gd->alg))
1917 return -1;
1918
1919 gd->gtk_len = gtk_len;
1920 gd->keyidx = (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >>
1921 WPA_KEY_INFO_KEY_INDEX_SHIFT;
1922 if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 && sm->ptk.kek_len == 16) {
1923 #ifdef CONFIG_NO_RC4
1924 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1925 "WPA: RC4 not supported in the build");
1926 return -1;
1927 #else /* CONFIG_NO_RC4 */
1928 u8 ek[32];
1929 if (key_data_len > sizeof(gd->gtk)) {
1930 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1931 "WPA: RC4 key data too long (%lu)",
1932 (unsigned long) key_data_len);
1933 return -1;
1934 }
1935 os_memcpy(ek, key->key_iv, 16);
1936 os_memcpy(ek + 16, sm->ptk.kek, sm->ptk.kek_len);
1937 os_memcpy(gd->gtk, key_data, key_data_len);
1938 if (rc4_skip(ek, 32, 256, gd->gtk, key_data_len)) {
1939 forced_memzero(ek, sizeof(ek));
1940 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
1941 "WPA: RC4 failed");
1942 return -1;
1943 }
1944 forced_memzero(ek, sizeof(ek));
1945 #endif /* CONFIG_NO_RC4 */
1946 } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
1947 if (maxkeylen % 8) {
1948 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1949 "WPA: Unsupported AES-WRAP len %lu",
1950 (unsigned long) maxkeylen);
1951 return -1;
1952 }
1953 if (maxkeylen > sizeof(gd->gtk)) {
1954 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1955 "WPA: AES-WRAP key data "
1956 "too long (keydatalen=%lu maxkeylen=%lu)",
1957 (unsigned long) key_data_len,
1958 (unsigned long) maxkeylen);
1959 return -1;
1960 }
1961 if (aes_unwrap(sm->ptk.kek, sm->ptk.kek_len, maxkeylen / 8,
1962 key_data, gd->gtk)) {
1963 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1964 "WPA: AES unwrap failed - could not decrypt "
1965 "GTK");
1966 return -1;
1967 }
1968 } else {
1969 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1970 "WPA: Unsupported key_info type %d", ver);
1971 return -1;
1972 }
1973 gd->tx = wpa_supplicant_gtk_tx_bit_workaround(
1974 sm, !!(key_info & WPA_KEY_INFO_TXRX));
1975 return 0;
1976 }
1977
1978
wpa_supplicant_send_2_of_2(struct wpa_sm * sm,const struct wpa_eapol_key * key,int ver,u16 key_info)1979 static int wpa_supplicant_send_2_of_2(struct wpa_sm *sm,
1980 const struct wpa_eapol_key *key,
1981 int ver, u16 key_info)
1982 {
1983 size_t mic_len, hdrlen, rlen;
1984 struct wpa_eapol_key *reply;
1985 u8 *rbuf, *key_mic;
1986 size_t kde_len = 0;
1987
1988 #ifdef CONFIG_OCV
1989 if (wpa_sm_ocv_enabled(sm))
1990 kde_len = OCV_OCI_KDE_LEN;
1991 #endif /* CONFIG_OCV */
1992
1993 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
1994 hdrlen = sizeof(*reply) + mic_len + 2;
1995 rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
1996 hdrlen + kde_len, &rlen, (void *) &reply);
1997 if (rbuf == NULL)
1998 return -1;
1999
2000 reply->type = (sm->proto == WPA_PROTO_RSN ||
2001 sm->proto == WPA_PROTO_OSEN) ?
2002 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
2003 key_info &= WPA_KEY_INFO_KEY_INDEX_MASK;
2004 key_info |= ver | WPA_KEY_INFO_SECURE;
2005 if (mic_len)
2006 key_info |= WPA_KEY_INFO_MIC;
2007 else
2008 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
2009 WPA_PUT_BE16(reply->key_info, key_info);
2010 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN)
2011 WPA_PUT_BE16(reply->key_length, 0);
2012 else
2013 os_memcpy(reply->key_length, key->key_length, 2);
2014 os_memcpy(reply->replay_counter, key->replay_counter,
2015 WPA_REPLAY_COUNTER_LEN);
2016
2017 key_mic = (u8 *) (reply + 1);
2018 WPA_PUT_BE16(key_mic + mic_len, kde_len); /* Key Data Length */
2019
2020 #ifdef CONFIG_OCV
2021 if (wpa_sm_ocv_enabled(sm)) {
2022 struct wpa_channel_info ci;
2023 u8 *pos;
2024
2025 if (wpa_sm_channel_info(sm, &ci) != 0) {
2026 wpa_printf(MSG_WARNING,
2027 "Failed to get channel info for OCI element in EAPOL-Key 2/2");
2028 os_free(rbuf);
2029 return -1;
2030 }
2031
2032 pos = key_mic + mic_len + 2; /* Key Data */
2033 if (ocv_insert_oci_kde(&ci, &pos) < 0) {
2034 os_free(rbuf);
2035 return -1;
2036 }
2037 }
2038 #endif /* CONFIG_OCV */
2039
2040 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Sending EAPOL-Key 2/2");
2041 return wpa_eapol_key_send(sm, &sm->ptk, ver, sm->bssid, ETH_P_EAPOL,
2042 rbuf, rlen, key_mic);
2043 }
2044
2045
wpa_supplicant_process_1_of_2(struct wpa_sm * sm,const unsigned char * src_addr,const struct wpa_eapol_key * key,const u8 * key_data,size_t key_data_len,u16 ver)2046 static void wpa_supplicant_process_1_of_2(struct wpa_sm *sm,
2047 const unsigned char *src_addr,
2048 const struct wpa_eapol_key *key,
2049 const u8 *key_data,
2050 size_t key_data_len, u16 ver)
2051 {
2052 u16 key_info;
2053 int rekey, ret;
2054 struct wpa_gtk_data gd;
2055 const u8 *key_rsc;
2056
2057 if (!sm->msg_3_of_4_ok && !wpa_fils_is_completed(sm)) {
2058 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2059 "WPA: Group Key Handshake started prior to completion of 4-way handshake");
2060 goto failed;
2061 }
2062
2063 os_memset(&gd, 0, sizeof(gd));
2064
2065 rekey = wpa_sm_get_state(sm) == WPA_COMPLETED;
2066 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: RX message 1 of Group Key "
2067 "Handshake from " MACSTR " (ver=%d)", MAC2STR(src_addr), ver);
2068
2069 key_info = WPA_GET_BE16(key->key_info);
2070
2071 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) {
2072 ret = wpa_supplicant_process_1_of_2_rsn(sm, key_data,
2073 key_data_len, key_info,
2074 &gd);
2075 } else {
2076 ret = wpa_supplicant_process_1_of_2_wpa(sm, key, key_data,
2077 key_data_len,
2078 key_info, ver, &gd);
2079 }
2080
2081 wpa_sm_set_state(sm, WPA_GROUP_HANDSHAKE);
2082
2083 if (ret)
2084 goto failed;
2085
2086 key_rsc = key->key_rsc;
2087 if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
2088 key_rsc = null_rsc;
2089
2090 if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) ||
2091 wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0)
2092 goto failed;
2093 forced_memzero(&gd, sizeof(gd));
2094
2095 if (rekey) {
2096 wpa_msg(sm->ctx->msg_ctx, MSG_INFO, "WPA: Group rekeying "
2097 "completed with " MACSTR " [GTK=%s]",
2098 MAC2STR(sm->bssid), wpa_cipher_txt(sm->group_cipher));
2099 wpa_sm_cancel_auth_timeout(sm);
2100 wpa_sm_set_state(sm, WPA_COMPLETED);
2101 } else {
2102 wpa_supplicant_key_neg_complete(sm, sm->bssid,
2103 key_info &
2104 WPA_KEY_INFO_SECURE);
2105 }
2106
2107 wpa_sm_set_rekey_offload(sm);
2108
2109 return;
2110
2111 failed:
2112 forced_memzero(&gd, sizeof(gd));
2113 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
2114 }
2115
2116
wpa_supplicant_verify_eapol_key_mic(struct wpa_sm * sm,struct wpa_eapol_key * key,u16 ver,const u8 * buf,size_t len)2117 static int wpa_supplicant_verify_eapol_key_mic(struct wpa_sm *sm,
2118 struct wpa_eapol_key *key,
2119 u16 ver,
2120 const u8 *buf, size_t len)
2121 {
2122 u8 mic[WPA_EAPOL_KEY_MIC_MAX_LEN];
2123 int ok = 0;
2124 size_t mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
2125
2126 os_memcpy(mic, key + 1, mic_len);
2127 if (sm->tptk_set) {
2128 os_memset(key + 1, 0, mic_len);
2129 if (wpa_eapol_key_mic(sm->tptk.kck, sm->tptk.kck_len,
2130 sm->key_mgmt,
2131 ver, buf, len, (u8 *) (key + 1)) < 0 ||
2132 os_memcmp_const(mic, key + 1, mic_len) != 0) {
2133 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2134 "WPA: Invalid EAPOL-Key MIC "
2135 "when using TPTK - ignoring TPTK");
2136 #ifdef TEST_FUZZ
2137 wpa_printf(MSG_INFO,
2138 "TEST: Ignore Key MIC failure for fuzz testing");
2139 goto continue_fuzz;
2140 #endif /* TEST_FUZZ */
2141 } else {
2142 #ifdef TEST_FUZZ
2143 continue_fuzz:
2144 #endif /* TEST_FUZZ */
2145 ok = 1;
2146 sm->tptk_set = 0;
2147 sm->ptk_set = 1;
2148 os_memcpy(&sm->ptk, &sm->tptk, sizeof(sm->ptk));
2149 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
2150 /*
2151 * This assures the same TPTK in sm->tptk can never be
2152 * copied twice to sm->ptk as the new PTK. In
2153 * combination with the installed flag in the wpa_ptk
2154 * struct, this assures the same PTK is only installed
2155 * once.
2156 */
2157 sm->renew_snonce = 1;
2158 }
2159 }
2160
2161 if (!ok && sm->ptk_set) {
2162 os_memset(key + 1, 0, mic_len);
2163 if (wpa_eapol_key_mic(sm->ptk.kck, sm->ptk.kck_len,
2164 sm->key_mgmt,
2165 ver, buf, len, (u8 *) (key + 1)) < 0 ||
2166 os_memcmp_const(mic, key + 1, mic_len) != 0) {
2167 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2168 "WPA: Invalid EAPOL-Key MIC - "
2169 "dropping packet");
2170 #ifdef TEST_FUZZ
2171 wpa_printf(MSG_INFO,
2172 "TEST: Ignore Key MIC failure for fuzz testing");
2173 goto continue_fuzz2;
2174 #endif /* TEST_FUZZ */
2175 return -1;
2176 }
2177 #ifdef TEST_FUZZ
2178 continue_fuzz2:
2179 #endif /* TEST_FUZZ */
2180 ok = 1;
2181 }
2182
2183 if (!ok) {
2184 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2185 "WPA: Could not verify EAPOL-Key MIC - "
2186 "dropping packet");
2187 return -1;
2188 }
2189
2190 os_memcpy(sm->rx_replay_counter, key->replay_counter,
2191 WPA_REPLAY_COUNTER_LEN);
2192 sm->rx_replay_counter_set = 1;
2193 return 0;
2194 }
2195
2196
2197 /* Decrypt RSN EAPOL-Key key data (RC4 or AES-WRAP) */
wpa_supplicant_decrypt_key_data(struct wpa_sm * sm,struct wpa_eapol_key * key,size_t mic_len,u16 ver,u8 * key_data,size_t * key_data_len)2198 static int wpa_supplicant_decrypt_key_data(struct wpa_sm *sm,
2199 struct wpa_eapol_key *key,
2200 size_t mic_len, u16 ver,
2201 u8 *key_data, size_t *key_data_len)
2202 {
2203 wpa_hexdump(MSG_DEBUG, "RSN: encrypted key data",
2204 key_data, *key_data_len);
2205 if (!sm->ptk_set) {
2206 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2207 "WPA: PTK not available, cannot decrypt EAPOL-Key Key "
2208 "Data");
2209 return -1;
2210 }
2211
2212 /* Decrypt key data here so that this operation does not need
2213 * to be implemented separately for each message type. */
2214 if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 && sm->ptk.kek_len == 16) {
2215 #ifdef CONFIG_NO_RC4
2216 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2217 "WPA: RC4 not supported in the build");
2218 return -1;
2219 #else /* CONFIG_NO_RC4 */
2220 u8 ek[32];
2221
2222 wpa_printf(MSG_DEBUG, "WPA: Decrypt Key Data using RC4");
2223 os_memcpy(ek, key->key_iv, 16);
2224 os_memcpy(ek + 16, sm->ptk.kek, sm->ptk.kek_len);
2225 if (rc4_skip(ek, 32, 256, key_data, *key_data_len)) {
2226 forced_memzero(ek, sizeof(ek));
2227 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
2228 "WPA: RC4 failed");
2229 return -1;
2230 }
2231 forced_memzero(ek, sizeof(ek));
2232 #endif /* CONFIG_NO_RC4 */
2233 } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES ||
2234 ver == WPA_KEY_INFO_TYPE_AES_128_CMAC ||
2235 wpa_use_aes_key_wrap(sm->key_mgmt)) {
2236 u8 *buf;
2237
2238 wpa_printf(MSG_DEBUG,
2239 "WPA: Decrypt Key Data using AES-UNWRAP (KEK length %u)",
2240 (unsigned int) sm->ptk.kek_len);
2241 if (*key_data_len < 8 || *key_data_len % 8) {
2242 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2243 "WPA: Unsupported AES-WRAP len %u",
2244 (unsigned int) *key_data_len);
2245 return -1;
2246 }
2247 *key_data_len -= 8; /* AES-WRAP adds 8 bytes */
2248 buf = os_malloc(*key_data_len);
2249 if (buf == NULL) {
2250 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2251 "WPA: No memory for AES-UNWRAP buffer");
2252 return -1;
2253 }
2254 #ifdef TEST_FUZZ
2255 os_memset(buf, 0x11, *key_data_len);
2256 #endif /* TEST_FUZZ */
2257 if (aes_unwrap(sm->ptk.kek, sm->ptk.kek_len, *key_data_len / 8,
2258 key_data, buf)) {
2259 #ifdef TEST_FUZZ
2260 wpa_printf(MSG_INFO,
2261 "TEST: Ignore AES unwrap failure for fuzz testing");
2262 goto continue_fuzz;
2263 #endif /* TEST_FUZZ */
2264 bin_clear_free(buf, *key_data_len);
2265 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2266 "WPA: AES unwrap failed - "
2267 "could not decrypt EAPOL-Key key data");
2268 return -1;
2269 }
2270 #ifdef TEST_FUZZ
2271 continue_fuzz:
2272 #endif /* TEST_FUZZ */
2273 os_memcpy(key_data, buf, *key_data_len);
2274 bin_clear_free(buf, *key_data_len);
2275 WPA_PUT_BE16(((u8 *) (key + 1)) + mic_len, *key_data_len);
2276 } else {
2277 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2278 "WPA: Unsupported key_info type %d", ver);
2279 return -1;
2280 }
2281 wpa_hexdump_key(MSG_DEBUG, "WPA: decrypted EAPOL-Key key data",
2282 key_data, *key_data_len);
2283 return 0;
2284 }
2285
2286
2287 /**
2288 * wpa_sm_aborted_cached - Notify WPA that PMKSA caching was aborted
2289 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2290 */
wpa_sm_aborted_cached(struct wpa_sm * sm)2291 void wpa_sm_aborted_cached(struct wpa_sm *sm)
2292 {
2293 if (sm && sm->cur_pmksa) {
2294 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2295 "RSN: Cancelling PMKSA caching attempt");
2296 sm->cur_pmksa = NULL;
2297 }
2298 }
2299
2300
wpa_eapol_key_dump(struct wpa_sm * sm,const struct wpa_eapol_key * key,unsigned int key_data_len,const u8 * mic,unsigned int mic_len)2301 static void wpa_eapol_key_dump(struct wpa_sm *sm,
2302 const struct wpa_eapol_key *key,
2303 unsigned int key_data_len,
2304 const u8 *mic, unsigned int mic_len)
2305 {
2306 #ifndef CONFIG_NO_STDOUT_DEBUG
2307 u16 key_info = WPA_GET_BE16(key->key_info);
2308
2309 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, " EAPOL-Key type=%d", key->type);
2310 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2311 " key_info 0x%x (ver=%d keyidx=%d rsvd=%d %s%s%s%s%s%s%s%s)",
2312 key_info, key_info & WPA_KEY_INFO_TYPE_MASK,
2313 (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >>
2314 WPA_KEY_INFO_KEY_INDEX_SHIFT,
2315 (key_info & (BIT(13) | BIT(14) | BIT(15))) >> 13,
2316 key_info & WPA_KEY_INFO_KEY_TYPE ? "Pairwise" : "Group",
2317 key_info & WPA_KEY_INFO_INSTALL ? " Install" : "",
2318 key_info & WPA_KEY_INFO_ACK ? " Ack" : "",
2319 key_info & WPA_KEY_INFO_MIC ? " MIC" : "",
2320 key_info & WPA_KEY_INFO_SECURE ? " Secure" : "",
2321 key_info & WPA_KEY_INFO_ERROR ? " Error" : "",
2322 key_info & WPA_KEY_INFO_REQUEST ? " Request" : "",
2323 key_info & WPA_KEY_INFO_ENCR_KEY_DATA ? " Encr" : "");
2324 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2325 " key_length=%u key_data_length=%u",
2326 WPA_GET_BE16(key->key_length), key_data_len);
2327 wpa_hexdump(MSG_DEBUG, " replay_counter",
2328 key->replay_counter, WPA_REPLAY_COUNTER_LEN);
2329 wpa_hexdump(MSG_DEBUG, " key_nonce", key->key_nonce, WPA_NONCE_LEN);
2330 wpa_hexdump(MSG_DEBUG, " key_iv", key->key_iv, 16);
2331 wpa_hexdump(MSG_DEBUG, " key_rsc", key->key_rsc, 8);
2332 wpa_hexdump(MSG_DEBUG, " key_id (reserved)", key->key_id, 8);
2333 wpa_hexdump(MSG_DEBUG, " key_mic", mic, mic_len);
2334 #endif /* CONFIG_NO_STDOUT_DEBUG */
2335 }
2336
2337
2338 #ifdef CONFIG_FILS
wpa_supp_aead_decrypt(struct wpa_sm * sm,u8 * buf,size_t buf_len,size_t * key_data_len)2339 static int wpa_supp_aead_decrypt(struct wpa_sm *sm, u8 *buf, size_t buf_len,
2340 size_t *key_data_len)
2341 {
2342 struct wpa_ptk *ptk;
2343 struct ieee802_1x_hdr *hdr;
2344 struct wpa_eapol_key *key;
2345 u8 *pos, *tmp;
2346 const u8 *aad[1];
2347 size_t aad_len[1];
2348
2349 if (*key_data_len < AES_BLOCK_SIZE) {
2350 wpa_printf(MSG_INFO, "No room for AES-SIV data in the frame");
2351 return -1;
2352 }
2353
2354 if (sm->tptk_set)
2355 ptk = &sm->tptk;
2356 else if (sm->ptk_set)
2357 ptk = &sm->ptk;
2358 else
2359 return -1;
2360
2361 hdr = (struct ieee802_1x_hdr *) buf;
2362 key = (struct wpa_eapol_key *) (hdr + 1);
2363 pos = (u8 *) (key + 1);
2364 pos += 2; /* Pointing at the Encrypted Key Data field */
2365
2366 tmp = os_malloc(*key_data_len);
2367 if (!tmp)
2368 return -1;
2369
2370 /* AES-SIV AAD from EAPOL protocol version field (inclusive) to
2371 * to Key Data (exclusive). */
2372 aad[0] = buf;
2373 aad_len[0] = pos - buf;
2374 if (aes_siv_decrypt(ptk->kek, ptk->kek_len, pos, *key_data_len,
2375 1, aad, aad_len, tmp) < 0) {
2376 wpa_printf(MSG_INFO, "Invalid AES-SIV data in the frame");
2377 bin_clear_free(tmp, *key_data_len);
2378 return -1;
2379 }
2380
2381 /* AEAD decryption and validation completed successfully */
2382 (*key_data_len) -= AES_BLOCK_SIZE;
2383 wpa_hexdump_key(MSG_DEBUG, "WPA: Decrypted Key Data",
2384 tmp, *key_data_len);
2385
2386 /* Replace Key Data field with the decrypted version */
2387 os_memcpy(pos, tmp, *key_data_len);
2388 pos -= 2; /* Key Data Length field */
2389 WPA_PUT_BE16(pos, *key_data_len);
2390 bin_clear_free(tmp, *key_data_len);
2391
2392 if (sm->tptk_set) {
2393 sm->tptk_set = 0;
2394 sm->ptk_set = 1;
2395 os_memcpy(&sm->ptk, &sm->tptk, sizeof(sm->ptk));
2396 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
2397 }
2398
2399 os_memcpy(sm->rx_replay_counter, key->replay_counter,
2400 WPA_REPLAY_COUNTER_LEN);
2401 sm->rx_replay_counter_set = 1;
2402
2403 return 0;
2404 }
2405 #endif /* CONFIG_FILS */
2406
2407
2408 /**
2409 * wpa_sm_rx_eapol - Process received WPA EAPOL frames
2410 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2411 * @src_addr: Source MAC address of the EAPOL packet
2412 * @buf: Pointer to the beginning of the EAPOL data (EAPOL header)
2413 * @len: Length of the EAPOL frame
2414 * Returns: 1 = WPA EAPOL-Key processed, 0 = not a WPA EAPOL-Key, -1 failure
2415 *
2416 * This function is called for each received EAPOL frame. Other than EAPOL-Key
2417 * frames can be skipped if filtering is done elsewhere. wpa_sm_rx_eapol() is
2418 * only processing WPA and WPA2 EAPOL-Key frames.
2419 *
2420 * The received EAPOL-Key packets are validated and valid packets are replied
2421 * to. In addition, key material (PTK, GTK) is configured at the end of a
2422 * successful key handshake.
2423 */
wpa_sm_rx_eapol(struct wpa_sm * sm,const u8 * src_addr,const u8 * buf,size_t len)2424 int wpa_sm_rx_eapol(struct wpa_sm *sm, const u8 *src_addr,
2425 const u8 *buf, size_t len)
2426 {
2427 size_t plen, data_len, key_data_len;
2428 const struct ieee802_1x_hdr *hdr;
2429 struct wpa_eapol_key *key;
2430 u16 key_info, ver;
2431 u8 *tmp = NULL;
2432 int ret = -1;
2433 u8 *mic, *key_data;
2434 size_t mic_len, keyhdrlen;
2435
2436 #ifdef CONFIG_IEEE80211R
2437 sm->ft_completed = 0;
2438 #endif /* CONFIG_IEEE80211R */
2439
2440 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
2441 keyhdrlen = sizeof(*key) + mic_len + 2;
2442
2443 if (len < sizeof(*hdr) + keyhdrlen) {
2444 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2445 "WPA: EAPOL frame too short to be a WPA "
2446 "EAPOL-Key (len %lu, expecting at least %lu)",
2447 (unsigned long) len,
2448 (unsigned long) sizeof(*hdr) + keyhdrlen);
2449 return 0;
2450 }
2451
2452 hdr = (const struct ieee802_1x_hdr *) buf;
2453 plen = be_to_host16(hdr->length);
2454 data_len = plen + sizeof(*hdr);
2455 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2456 "IEEE 802.1X RX: version=%d type=%d length=%lu",
2457 hdr->version, hdr->type, (unsigned long) plen);
2458
2459 if (hdr->version < EAPOL_VERSION) {
2460 /* TODO: backwards compatibility */
2461 }
2462 if (hdr->type != IEEE802_1X_TYPE_EAPOL_KEY) {
2463 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2464 "WPA: EAPOL frame (type %u) discarded, "
2465 "not a Key frame", hdr->type);
2466 ret = 0;
2467 goto out;
2468 }
2469 wpa_hexdump(MSG_MSGDUMP, "WPA: RX EAPOL-Key", buf, len);
2470 if (plen > len - sizeof(*hdr) || plen < keyhdrlen) {
2471 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2472 "WPA: EAPOL frame payload size %lu "
2473 "invalid (frame size %lu)",
2474 (unsigned long) plen, (unsigned long) len);
2475 ret = 0;
2476 goto out;
2477 }
2478 if (data_len < len) {
2479 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2480 "WPA: ignoring %lu bytes after the IEEE 802.1X data",
2481 (unsigned long) len - data_len);
2482 }
2483
2484 /*
2485 * Make a copy of the frame since we need to modify the buffer during
2486 * MAC validation and Key Data decryption.
2487 */
2488 tmp = os_memdup(buf, data_len);
2489 if (tmp == NULL)
2490 goto out;
2491 key = (struct wpa_eapol_key *) (tmp + sizeof(struct ieee802_1x_hdr));
2492 mic = (u8 *) (key + 1);
2493 key_data = mic + mic_len + 2;
2494
2495 if (key->type != EAPOL_KEY_TYPE_WPA && key->type != EAPOL_KEY_TYPE_RSN)
2496 {
2497 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2498 "WPA: EAPOL-Key type (%d) unknown, discarded",
2499 key->type);
2500 ret = 0;
2501 goto out;
2502 }
2503
2504 key_data_len = WPA_GET_BE16(mic + mic_len);
2505 wpa_eapol_key_dump(sm, key, key_data_len, mic, mic_len);
2506
2507 if (key_data_len > plen - keyhdrlen) {
2508 wpa_msg(sm->ctx->msg_ctx, MSG_INFO, "WPA: Invalid EAPOL-Key "
2509 "frame - key_data overflow (%u > %u)",
2510 (unsigned int) key_data_len,
2511 (unsigned int) (plen - keyhdrlen));
2512 goto out;
2513 }
2514
2515 eapol_sm_notify_lower_layer_success(sm->eapol, 0);
2516 key_info = WPA_GET_BE16(key->key_info);
2517 ver = key_info & WPA_KEY_INFO_TYPE_MASK;
2518 if (ver != WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 &&
2519 ver != WPA_KEY_INFO_TYPE_AES_128_CMAC &&
2520 ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES &&
2521 !wpa_use_akm_defined(sm->key_mgmt)) {
2522 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2523 "WPA: Unsupported EAPOL-Key descriptor version %d",
2524 ver);
2525 goto out;
2526 }
2527
2528 if (wpa_use_akm_defined(sm->key_mgmt) &&
2529 ver != WPA_KEY_INFO_TYPE_AKM_DEFINED) {
2530 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2531 "RSN: Unsupported EAPOL-Key descriptor version %d (expected AKM defined = 0)",
2532 ver);
2533 goto out;
2534 }
2535
2536 #ifdef CONFIG_IEEE80211R
2537 if (wpa_key_mgmt_ft(sm->key_mgmt)) {
2538 /* IEEE 802.11r uses a new key_info type (AES-128-CMAC). */
2539 if (ver != WPA_KEY_INFO_TYPE_AES_128_CMAC &&
2540 !wpa_use_akm_defined(sm->key_mgmt)) {
2541 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2542 "FT: AP did not use AES-128-CMAC");
2543 goto out;
2544 }
2545 } else
2546 #endif /* CONFIG_IEEE80211R */
2547 if (wpa_key_mgmt_sha256(sm->key_mgmt)) {
2548 if (ver != WPA_KEY_INFO_TYPE_AES_128_CMAC &&
2549 !wpa_use_akm_defined(sm->key_mgmt)) {
2550 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2551 "WPA: AP did not use the "
2552 "negotiated AES-128-CMAC");
2553 goto out;
2554 }
2555 } else if (sm->pairwise_cipher == WPA_CIPHER_CCMP &&
2556 !wpa_use_akm_defined(sm->key_mgmt) &&
2557 ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
2558 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2559 "WPA: CCMP is used, but EAPOL-Key "
2560 "descriptor version (%d) is not 2", ver);
2561 if (sm->group_cipher != WPA_CIPHER_CCMP &&
2562 !(key_info & WPA_KEY_INFO_KEY_TYPE)) {
2563 /* Earlier versions of IEEE 802.11i did not explicitly
2564 * require version 2 descriptor for all EAPOL-Key
2565 * packets, so allow group keys to use version 1 if
2566 * CCMP is not used for them. */
2567 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2568 "WPA: Backwards compatibility: allow invalid "
2569 "version for non-CCMP group keys");
2570 } else if (ver == WPA_KEY_INFO_TYPE_AES_128_CMAC) {
2571 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2572 "WPA: Interoperability workaround: allow incorrect (should have been HMAC-SHA1), but stronger (is AES-128-CMAC), descriptor version to be used");
2573 } else
2574 goto out;
2575 } else if (sm->pairwise_cipher == WPA_CIPHER_GCMP &&
2576 !wpa_use_akm_defined(sm->key_mgmt) &&
2577 ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
2578 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2579 "WPA: GCMP is used, but EAPOL-Key "
2580 "descriptor version (%d) is not 2", ver);
2581 goto out;
2582 }
2583
2584 if (sm->rx_replay_counter_set &&
2585 os_memcmp(key->replay_counter, sm->rx_replay_counter,
2586 WPA_REPLAY_COUNTER_LEN) <= 0) {
2587 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2588 "WPA: EAPOL-Key Replay Counter did not increase - "
2589 "dropping packet");
2590 goto out;
2591 }
2592
2593 if (key_info & WPA_KEY_INFO_SMK_MESSAGE) {
2594 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2595 "WPA: Unsupported SMK bit in key_info");
2596 goto out;
2597 }
2598
2599 if (!(key_info & WPA_KEY_INFO_ACK)) {
2600 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2601 "WPA: No Ack bit in key_info");
2602 goto out;
2603 }
2604
2605 if (key_info & WPA_KEY_INFO_REQUEST) {
2606 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2607 "WPA: EAPOL-Key with Request bit - dropped");
2608 goto out;
2609 }
2610
2611 if ((key_info & WPA_KEY_INFO_MIC) &&
2612 wpa_supplicant_verify_eapol_key_mic(sm, key, ver, tmp, data_len))
2613 goto out;
2614
2615 #ifdef CONFIG_FILS
2616 if (!mic_len && (key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
2617 if (wpa_supp_aead_decrypt(sm, tmp, data_len, &key_data_len))
2618 goto out;
2619 }
2620 #endif /* CONFIG_FILS */
2621
2622 if ((sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) &&
2623 (key_info & WPA_KEY_INFO_ENCR_KEY_DATA) && mic_len) {
2624 /*
2625 * Only decrypt the Key Data field if the frame's authenticity
2626 * was verified. When using AES-SIV (FILS), the MIC flag is not
2627 * set, so this check should only be performed if mic_len != 0
2628 * which is the case in this code branch.
2629 */
2630 if (!(key_info & WPA_KEY_INFO_MIC)) {
2631 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2632 "WPA: Ignore EAPOL-Key with encrypted but unauthenticated data");
2633 goto out;
2634 }
2635 if (wpa_supplicant_decrypt_key_data(sm, key, mic_len,
2636 ver, key_data,
2637 &key_data_len))
2638 goto out;
2639 }
2640
2641 if (key_info & WPA_KEY_INFO_KEY_TYPE) {
2642 if (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) {
2643 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2644 "WPA: Ignored EAPOL-Key (Pairwise) with "
2645 "non-zero key index");
2646 goto out;
2647 }
2648 if (key_info & (WPA_KEY_INFO_MIC |
2649 WPA_KEY_INFO_ENCR_KEY_DATA)) {
2650 /* 3/4 4-Way Handshake */
2651 wpa_supplicant_process_3_of_4(sm, key, ver, key_data,
2652 key_data_len);
2653 } else {
2654 /* 1/4 4-Way Handshake */
2655 wpa_supplicant_process_1_of_4(sm, src_addr, key,
2656 ver, key_data,
2657 key_data_len);
2658 }
2659 } else {
2660 if ((mic_len && (key_info & WPA_KEY_INFO_MIC)) ||
2661 (!mic_len && (key_info & WPA_KEY_INFO_ENCR_KEY_DATA))) {
2662 /* 1/2 Group Key Handshake */
2663 wpa_supplicant_process_1_of_2(sm, src_addr, key,
2664 key_data, key_data_len,
2665 ver);
2666 } else {
2667 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2668 "WPA: EAPOL-Key (Group) without Mic/Encr bit - "
2669 "dropped");
2670 }
2671 }
2672
2673 ret = 1;
2674
2675 out:
2676 bin_clear_free(tmp, data_len);
2677 return ret;
2678 }
2679
2680
2681 #ifdef CONFIG_CTRL_IFACE
wpa_key_mgmt_suite(struct wpa_sm * sm)2682 static u32 wpa_key_mgmt_suite(struct wpa_sm *sm)
2683 {
2684 switch (sm->key_mgmt) {
2685 case WPA_KEY_MGMT_IEEE8021X:
2686 return ((sm->proto == WPA_PROTO_RSN ||
2687 sm->proto == WPA_PROTO_OSEN) ?
2688 RSN_AUTH_KEY_MGMT_UNSPEC_802_1X :
2689 WPA_AUTH_KEY_MGMT_UNSPEC_802_1X);
2690 case WPA_KEY_MGMT_PSK:
2691 return (sm->proto == WPA_PROTO_RSN ?
2692 RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X :
2693 WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X);
2694 #ifdef CONFIG_IEEE80211R
2695 case WPA_KEY_MGMT_FT_IEEE8021X:
2696 return RSN_AUTH_KEY_MGMT_FT_802_1X;
2697 case WPA_KEY_MGMT_FT_PSK:
2698 return RSN_AUTH_KEY_MGMT_FT_PSK;
2699 #endif /* CONFIG_IEEE80211R */
2700 case WPA_KEY_MGMT_IEEE8021X_SHA256:
2701 return RSN_AUTH_KEY_MGMT_802_1X_SHA256;
2702 case WPA_KEY_MGMT_PSK_SHA256:
2703 return RSN_AUTH_KEY_MGMT_PSK_SHA256;
2704 case WPA_KEY_MGMT_CCKM:
2705 return (sm->proto == WPA_PROTO_RSN ?
2706 RSN_AUTH_KEY_MGMT_CCKM:
2707 WPA_AUTH_KEY_MGMT_CCKM);
2708 case WPA_KEY_MGMT_WPA_NONE:
2709 return WPA_AUTH_KEY_MGMT_NONE;
2710 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
2711 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B;
2712 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
2713 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192;
2714 default:
2715 return 0;
2716 }
2717 }
2718
2719
2720 #define RSN_SUITE "%02x-%02x-%02x-%d"
2721 #define RSN_SUITE_ARG(s) \
2722 ((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff
2723
2724 /**
2725 * wpa_sm_get_mib - Dump text list of MIB entries
2726 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2727 * @buf: Buffer for the list
2728 * @buflen: Length of the buffer
2729 * Returns: Number of bytes written to buffer
2730 *
2731 * This function is used fetch dot11 MIB variables.
2732 */
wpa_sm_get_mib(struct wpa_sm * sm,char * buf,size_t buflen)2733 int wpa_sm_get_mib(struct wpa_sm *sm, char *buf, size_t buflen)
2734 {
2735 char pmkid_txt[PMKID_LEN * 2 + 1];
2736 bool rsna;
2737 int ret;
2738 size_t len;
2739
2740 if (sm->cur_pmksa) {
2741 wpa_snprintf_hex(pmkid_txt, sizeof(pmkid_txt),
2742 sm->cur_pmksa->pmkid, PMKID_LEN);
2743 } else
2744 pmkid_txt[0] = '\0';
2745
2746 rsna = (wpa_key_mgmt_wpa_psk(sm->key_mgmt) ||
2747 wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt)) &&
2748 sm->proto == WPA_PROTO_RSN;
2749
2750 ret = os_snprintf(buf, buflen,
2751 "dot11RSNAOptionImplemented=TRUE\n"
2752 "dot11RSNAPreauthenticationImplemented=TRUE\n"
2753 "dot11RSNAEnabled=%s\n"
2754 "dot11RSNAPreauthenticationEnabled=%s\n"
2755 "dot11RSNAConfigVersion=%d\n"
2756 "dot11RSNAConfigPairwiseKeysSupported=5\n"
2757 "dot11RSNAConfigGroupCipherSize=%d\n"
2758 "dot11RSNAConfigPMKLifetime=%d\n"
2759 "dot11RSNAConfigPMKReauthThreshold=%d\n"
2760 "dot11RSNAConfigNumberOfPTKSAReplayCounters=1\n"
2761 "dot11RSNAConfigSATimeout=%d\n",
2762 rsna ? "TRUE" : "FALSE",
2763 rsna ? "TRUE" : "FALSE",
2764 RSN_VERSION,
2765 wpa_cipher_key_len(sm->group_cipher) * 8,
2766 sm->dot11RSNAConfigPMKLifetime,
2767 sm->dot11RSNAConfigPMKReauthThreshold,
2768 sm->dot11RSNAConfigSATimeout);
2769 if (os_snprintf_error(buflen, ret))
2770 return 0;
2771 len = ret;
2772
2773 ret = os_snprintf(
2774 buf + len, buflen - len,
2775 "dot11RSNAAuthenticationSuiteSelected=" RSN_SUITE "\n"
2776 "dot11RSNAPairwiseCipherSelected=" RSN_SUITE "\n"
2777 "dot11RSNAGroupCipherSelected=" RSN_SUITE "\n"
2778 "dot11RSNAPMKIDUsed=%s\n"
2779 "dot11RSNAAuthenticationSuiteRequested=" RSN_SUITE "\n"
2780 "dot11RSNAPairwiseCipherRequested=" RSN_SUITE "\n"
2781 "dot11RSNAGroupCipherRequested=" RSN_SUITE "\n"
2782 "dot11RSNAConfigNumberOfGTKSAReplayCounters=0\n"
2783 "dot11RSNA4WayHandshakeFailures=%u\n",
2784 RSN_SUITE_ARG(wpa_key_mgmt_suite(sm)),
2785 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
2786 sm->pairwise_cipher)),
2787 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
2788 sm->group_cipher)),
2789 pmkid_txt,
2790 RSN_SUITE_ARG(wpa_key_mgmt_suite(sm)),
2791 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
2792 sm->pairwise_cipher)),
2793 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
2794 sm->group_cipher)),
2795 sm->dot11RSNA4WayHandshakeFailures);
2796 if (!os_snprintf_error(buflen - len, ret))
2797 len += ret;
2798
2799 return (int) len;
2800 }
2801 #endif /* CONFIG_CTRL_IFACE */
2802
2803
wpa_sm_pmksa_free_cb(struct rsn_pmksa_cache_entry * entry,void * ctx,enum pmksa_free_reason reason)2804 static void wpa_sm_pmksa_free_cb(struct rsn_pmksa_cache_entry *entry,
2805 void *ctx, enum pmksa_free_reason reason)
2806 {
2807 struct wpa_sm *sm = ctx;
2808 int deauth = 0;
2809
2810 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "RSN: PMKSA cache entry free_cb: "
2811 MACSTR " reason=%d", MAC2STR(entry->aa), reason);
2812
2813 if (sm->cur_pmksa == entry) {
2814 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2815 "RSN: %s current PMKSA entry",
2816 reason == PMKSA_REPLACE ? "replaced" : "removed");
2817 pmksa_cache_clear_current(sm);
2818
2819 /*
2820 * If an entry is simply being replaced, there's no need to
2821 * deauthenticate because it will be immediately re-added.
2822 * This happens when EAP authentication is completed again
2823 * (reauth or failed PMKSA caching attempt).
2824 */
2825 if (reason != PMKSA_REPLACE)
2826 deauth = 1;
2827 }
2828
2829 if (reason == PMKSA_EXPIRE &&
2830 (sm->pmk_len == entry->pmk_len &&
2831 os_memcmp(sm->pmk, entry->pmk, sm->pmk_len) == 0)) {
2832 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2833 "RSN: deauthenticating due to expired PMK");
2834 pmksa_cache_clear_current(sm);
2835 deauth = 1;
2836 }
2837
2838 if (deauth) {
2839 sm->pmk_len = 0;
2840 os_memset(sm->pmk, 0, sizeof(sm->pmk));
2841 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
2842 }
2843 }
2844
2845
2846 /**
2847 * wpa_sm_init - Initialize WPA state machine
2848 * @ctx: Context pointer for callbacks; this needs to be an allocated buffer
2849 * Returns: Pointer to the allocated WPA state machine data
2850 *
2851 * This function is used to allocate a new WPA state machine and the returned
2852 * value is passed to all WPA state machine calls.
2853 */
wpa_sm_init(struct wpa_sm_ctx * ctx)2854 struct wpa_sm * wpa_sm_init(struct wpa_sm_ctx *ctx)
2855 {
2856 struct wpa_sm *sm;
2857
2858 sm = os_zalloc(sizeof(*sm));
2859 if (sm == NULL)
2860 return NULL;
2861 dl_list_init(&sm->pmksa_candidates);
2862 sm->renew_snonce = 1;
2863 sm->ctx = ctx;
2864
2865 sm->dot11RSNAConfigPMKLifetime = 43200;
2866 sm->dot11RSNAConfigPMKReauthThreshold = 70;
2867 sm->dot11RSNAConfigSATimeout = 60;
2868
2869 sm->pmksa = pmksa_cache_init(wpa_sm_pmksa_free_cb, sm, sm);
2870 if (sm->pmksa == NULL) {
2871 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
2872 "RSN: PMKSA cache initialization failed");
2873 os_free(sm);
2874 return NULL;
2875 }
2876
2877 return sm;
2878 }
2879
2880
2881 /**
2882 * wpa_sm_deinit - Deinitialize WPA state machine
2883 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2884 */
wpa_sm_deinit(struct wpa_sm * sm)2885 void wpa_sm_deinit(struct wpa_sm *sm)
2886 {
2887 if (sm == NULL)
2888 return;
2889 pmksa_cache_deinit(sm->pmksa);
2890 eloop_cancel_timeout(wpa_sm_start_preauth, sm, NULL);
2891 eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
2892 os_free(sm->assoc_wpa_ie);
2893 os_free(sm->assoc_rsnxe);
2894 os_free(sm->ap_wpa_ie);
2895 os_free(sm->ap_rsn_ie);
2896 os_free(sm->ap_rsnxe);
2897 wpa_sm_drop_sa(sm);
2898 os_free(sm->ctx);
2899 #ifdef CONFIG_IEEE80211R
2900 os_free(sm->assoc_resp_ies);
2901 #endif /* CONFIG_IEEE80211R */
2902 #ifdef CONFIG_TESTING_OPTIONS
2903 wpabuf_free(sm->test_assoc_ie);
2904 #endif /* CONFIG_TESTING_OPTIONS */
2905 #ifdef CONFIG_FILS_SK_PFS
2906 crypto_ecdh_deinit(sm->fils_ecdh);
2907 #endif /* CONFIG_FILS_SK_PFS */
2908 #ifdef CONFIG_FILS
2909 wpabuf_free(sm->fils_ft_ies);
2910 #endif /* CONFIG_FILS */
2911 #ifdef CONFIG_OWE
2912 crypto_ecdh_deinit(sm->owe_ecdh);
2913 #endif /* CONFIG_OWE */
2914 #ifdef CONFIG_DPP2
2915 wpabuf_clear_free(sm->dpp_z);
2916 #endif /* CONFIG_DPP2 */
2917 os_free(sm);
2918 }
2919
2920
2921 /**
2922 * wpa_sm_notify_assoc - Notify WPA state machine about association
2923 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2924 * @bssid: The BSSID of the new association
2925 *
2926 * This function is called to let WPA state machine know that the connection
2927 * was established.
2928 */
wpa_sm_notify_assoc(struct wpa_sm * sm,const u8 * bssid)2929 void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
2930 {
2931 int clear_keys = 1;
2932
2933 if (sm == NULL)
2934 return;
2935
2936 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2937 "WPA: Association event - clear replay counter");
2938 os_memcpy(sm->bssid, bssid, ETH_ALEN);
2939 os_memset(sm->rx_replay_counter, 0, WPA_REPLAY_COUNTER_LEN);
2940 sm->rx_replay_counter_set = 0;
2941 sm->renew_snonce = 1;
2942 if (os_memcmp(sm->preauth_bssid, bssid, ETH_ALEN) == 0)
2943 rsn_preauth_deinit(sm);
2944
2945 #ifdef CONFIG_IEEE80211R
2946 if (wpa_ft_is_completed(sm)) {
2947 /*
2948 * Clear portValid to kick EAPOL state machine to re-enter
2949 * AUTHENTICATED state to get the EAPOL port Authorized.
2950 */
2951 eapol_sm_notify_portValid(sm->eapol, false);
2952 wpa_supplicant_key_neg_complete(sm, sm->bssid, 1);
2953
2954 /* Prepare for the next transition */
2955 wpa_ft_prepare_auth_request(sm, NULL);
2956
2957 clear_keys = 0;
2958 sm->ft_protocol = 1;
2959 } else {
2960 sm->ft_protocol = 0;
2961 }
2962 #endif /* CONFIG_IEEE80211R */
2963 #ifdef CONFIG_FILS
2964 if (sm->fils_completed) {
2965 /*
2966 * Clear portValid to kick EAPOL state machine to re-enter
2967 * AUTHENTICATED state to get the EAPOL port Authorized.
2968 */
2969 wpa_supplicant_key_neg_complete(sm, sm->bssid, 1);
2970 clear_keys = 0;
2971 }
2972 #endif /* CONFIG_FILS */
2973
2974 if (clear_keys) {
2975 /*
2976 * IEEE 802.11, 8.4.10: Delete PTK SA on (re)association if
2977 * this is not part of a Fast BSS Transition.
2978 */
2979 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Clear old PTK");
2980 sm->ptk_set = 0;
2981 os_memset(&sm->ptk, 0, sizeof(sm->ptk));
2982 sm->tptk_set = 0;
2983 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
2984 os_memset(&sm->gtk, 0, sizeof(sm->gtk));
2985 os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
2986 os_memset(&sm->igtk, 0, sizeof(sm->igtk));
2987 os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
2988 }
2989
2990 #ifdef CONFIG_TDLS
2991 wpa_tdls_assoc(sm);
2992 #endif /* CONFIG_TDLS */
2993
2994 #ifdef CONFIG_P2P
2995 os_memset(sm->p2p_ip_addr, 0, sizeof(sm->p2p_ip_addr));
2996 #endif /* CONFIG_P2P */
2997
2998 sm->keyidx_active = 0;
2999 }
3000
3001
3002 /**
3003 * wpa_sm_notify_disassoc - Notify WPA state machine about disassociation
3004 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3005 *
3006 * This function is called to let WPA state machine know that the connection
3007 * was lost. This will abort any existing pre-authentication session.
3008 */
wpa_sm_notify_disassoc(struct wpa_sm * sm)3009 void wpa_sm_notify_disassoc(struct wpa_sm *sm)
3010 {
3011 eloop_cancel_timeout(wpa_sm_start_preauth, sm, NULL);
3012 eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
3013 rsn_preauth_deinit(sm);
3014 pmksa_cache_clear_current(sm);
3015 if (wpa_sm_get_state(sm) == WPA_4WAY_HANDSHAKE)
3016 sm->dot11RSNA4WayHandshakeFailures++;
3017 #ifdef CONFIG_TDLS
3018 wpa_tdls_disassoc(sm);
3019 #endif /* CONFIG_TDLS */
3020 #ifdef CONFIG_FILS
3021 sm->fils_completed = 0;
3022 #endif /* CONFIG_FILS */
3023 #ifdef CONFIG_IEEE80211R
3024 sm->ft_reassoc_completed = 0;
3025 sm->ft_protocol = 0;
3026 #endif /* CONFIG_IEEE80211R */
3027
3028 /* Keys are not needed in the WPA state machine anymore */
3029 wpa_sm_drop_sa(sm);
3030 sm->keyidx_active = 0;
3031
3032 sm->msg_3_of_4_ok = 0;
3033 os_memset(sm->bssid, 0, ETH_ALEN);
3034 }
3035
3036
3037 /**
3038 * wpa_sm_set_pmk - Set PMK
3039 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3040 * @pmk: The new PMK
3041 * @pmk_len: The length of the new PMK in bytes
3042 * @pmkid: Calculated PMKID
3043 * @bssid: AA to add into PMKSA cache or %NULL to not cache the PMK
3044 *
3045 * Configure the PMK for WPA state machine.
3046 */
wpa_sm_set_pmk(struct wpa_sm * sm,const u8 * pmk,size_t pmk_len,const u8 * pmkid,const u8 * bssid)3047 void wpa_sm_set_pmk(struct wpa_sm *sm, const u8 *pmk, size_t pmk_len,
3048 const u8 *pmkid, const u8 *bssid)
3049 {
3050 if (sm == NULL)
3051 return;
3052
3053 wpa_hexdump_key(MSG_DEBUG, "WPA: Set PMK based on external data",
3054 pmk, pmk_len);
3055 sm->pmk_len = pmk_len;
3056 os_memcpy(sm->pmk, pmk, pmk_len);
3057
3058 #ifdef CONFIG_IEEE80211R
3059 /* Set XXKey to be PSK for FT key derivation */
3060 sm->xxkey_len = pmk_len;
3061 os_memcpy(sm->xxkey, pmk, pmk_len);
3062 #endif /* CONFIG_IEEE80211R */
3063
3064 if (bssid) {
3065 pmksa_cache_add(sm->pmksa, pmk, pmk_len, pmkid, NULL, 0,
3066 bssid, sm->own_addr,
3067 sm->network_ctx, sm->key_mgmt, NULL);
3068 }
3069 }
3070
3071
3072 /**
3073 * wpa_sm_set_pmk_from_pmksa - Set PMK based on the current PMKSA
3074 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3075 *
3076 * Take the PMK from the current PMKSA into use. If no PMKSA is active, the PMK
3077 * will be cleared.
3078 */
wpa_sm_set_pmk_from_pmksa(struct wpa_sm * sm)3079 void wpa_sm_set_pmk_from_pmksa(struct wpa_sm *sm)
3080 {
3081 if (sm == NULL)
3082 return;
3083
3084 if (sm->cur_pmksa) {
3085 wpa_hexdump_key(MSG_DEBUG,
3086 "WPA: Set PMK based on current PMKSA",
3087 sm->cur_pmksa->pmk, sm->cur_pmksa->pmk_len);
3088 sm->pmk_len = sm->cur_pmksa->pmk_len;
3089 os_memcpy(sm->pmk, sm->cur_pmksa->pmk, sm->pmk_len);
3090 } else {
3091 wpa_printf(MSG_DEBUG, "WPA: No current PMKSA - clear PMK");
3092 sm->pmk_len = 0;
3093 os_memset(sm->pmk, 0, PMK_LEN_MAX);
3094 }
3095 }
3096
3097
3098 /**
3099 * wpa_sm_set_fast_reauth - Set fast reauthentication (EAP) enabled/disabled
3100 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3101 * @fast_reauth: Whether fast reauthentication (EAP) is allowed
3102 */
wpa_sm_set_fast_reauth(struct wpa_sm * sm,int fast_reauth)3103 void wpa_sm_set_fast_reauth(struct wpa_sm *sm, int fast_reauth)
3104 {
3105 if (sm)
3106 sm->fast_reauth = fast_reauth;
3107 }
3108
3109
3110 /**
3111 * wpa_sm_set_scard_ctx - Set context pointer for smartcard callbacks
3112 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3113 * @scard_ctx: Context pointer for smartcard related callback functions
3114 */
wpa_sm_set_scard_ctx(struct wpa_sm * sm,void * scard_ctx)3115 void wpa_sm_set_scard_ctx(struct wpa_sm *sm, void *scard_ctx)
3116 {
3117 if (sm == NULL)
3118 return;
3119 sm->scard_ctx = scard_ctx;
3120 if (sm->preauth_eapol)
3121 eapol_sm_register_scard_ctx(sm->preauth_eapol, scard_ctx);
3122 }
3123
3124
3125 /**
3126 * wpa_sm_set_config - Notification of current configuration change
3127 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3128 * @config: Pointer to current network configuration
3129 *
3130 * Notify WPA state machine that configuration has changed. config will be
3131 * stored as a backpointer to network configuration. This can be %NULL to clear
3132 * the stored pointed.
3133 */
wpa_sm_set_config(struct wpa_sm * sm,struct rsn_supp_config * config)3134 void wpa_sm_set_config(struct wpa_sm *sm, struct rsn_supp_config *config)
3135 {
3136 if (!sm)
3137 return;
3138
3139 if (config) {
3140 sm->network_ctx = config->network_ctx;
3141 sm->allowed_pairwise_cipher = config->allowed_pairwise_cipher;
3142 sm->proactive_key_caching = config->proactive_key_caching;
3143 sm->eap_workaround = config->eap_workaround;
3144 sm->eap_conf_ctx = config->eap_conf_ctx;
3145 if (config->ssid) {
3146 os_memcpy(sm->ssid, config->ssid, config->ssid_len);
3147 sm->ssid_len = config->ssid_len;
3148 } else
3149 sm->ssid_len = 0;
3150 sm->wpa_ptk_rekey = config->wpa_ptk_rekey;
3151 sm->p2p = config->p2p;
3152 sm->wpa_rsc_relaxation = config->wpa_rsc_relaxation;
3153 sm->owe_ptk_workaround = config->owe_ptk_workaround;
3154 #ifdef CONFIG_FILS
3155 if (config->fils_cache_id) {
3156 sm->fils_cache_id_set = 1;
3157 os_memcpy(sm->fils_cache_id, config->fils_cache_id,
3158 FILS_CACHE_ID_LEN);
3159 } else {
3160 sm->fils_cache_id_set = 0;
3161 }
3162 #endif /* CONFIG_FILS */
3163 sm->beacon_prot = config->beacon_prot;
3164 } else {
3165 sm->network_ctx = NULL;
3166 sm->allowed_pairwise_cipher = 0;
3167 sm->proactive_key_caching = 0;
3168 sm->eap_workaround = 0;
3169 sm->eap_conf_ctx = NULL;
3170 sm->ssid_len = 0;
3171 sm->wpa_ptk_rekey = 0;
3172 sm->p2p = 0;
3173 sm->wpa_rsc_relaxation = 0;
3174 sm->owe_ptk_workaround = 0;
3175 sm->beacon_prot = 0;
3176 }
3177 }
3178
3179
3180 /**
3181 * wpa_sm_set_own_addr - Set own MAC address
3182 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3183 * @addr: Own MAC address
3184 */
wpa_sm_set_own_addr(struct wpa_sm * sm,const u8 * addr)3185 void wpa_sm_set_own_addr(struct wpa_sm *sm, const u8 *addr)
3186 {
3187 if (sm)
3188 os_memcpy(sm->own_addr, addr, ETH_ALEN);
3189 }
3190
3191
3192 /**
3193 * wpa_sm_set_ifname - Set network interface name
3194 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3195 * @ifname: Interface name
3196 * @bridge_ifname: Optional bridge interface name (for pre-auth)
3197 */
wpa_sm_set_ifname(struct wpa_sm * sm,const char * ifname,const char * bridge_ifname)3198 void wpa_sm_set_ifname(struct wpa_sm *sm, const char *ifname,
3199 const char *bridge_ifname)
3200 {
3201 if (sm) {
3202 sm->ifname = ifname;
3203 sm->bridge_ifname = bridge_ifname;
3204 }
3205 }
3206
3207
3208 /**
3209 * wpa_sm_set_eapol - Set EAPOL state machine pointer
3210 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3211 * @eapol: Pointer to EAPOL state machine allocated with eapol_sm_init()
3212 */
wpa_sm_set_eapol(struct wpa_sm * sm,struct eapol_sm * eapol)3213 void wpa_sm_set_eapol(struct wpa_sm *sm, struct eapol_sm *eapol)
3214 {
3215 if (sm)
3216 sm->eapol = eapol;
3217 }
3218
3219
3220 /**
3221 * wpa_sm_set_param - Set WPA state machine parameters
3222 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3223 * @param: Parameter field
3224 * @value: Parameter value
3225 * Returns: 0 on success, -1 on failure
3226 */
wpa_sm_set_param(struct wpa_sm * sm,enum wpa_sm_conf_params param,unsigned int value)3227 int wpa_sm_set_param(struct wpa_sm *sm, enum wpa_sm_conf_params param,
3228 unsigned int value)
3229 {
3230 int ret = 0;
3231
3232 if (sm == NULL)
3233 return -1;
3234
3235 switch (param) {
3236 case RSNA_PMK_LIFETIME:
3237 if (value > 0)
3238 sm->dot11RSNAConfigPMKLifetime = value;
3239 else
3240 ret = -1;
3241 break;
3242 case RSNA_PMK_REAUTH_THRESHOLD:
3243 if (value > 0 && value <= 100)
3244 sm->dot11RSNAConfigPMKReauthThreshold = value;
3245 else
3246 ret = -1;
3247 break;
3248 case RSNA_SA_TIMEOUT:
3249 if (value > 0)
3250 sm->dot11RSNAConfigSATimeout = value;
3251 else
3252 ret = -1;
3253 break;
3254 case WPA_PARAM_PROTO:
3255 sm->proto = value;
3256 break;
3257 case WPA_PARAM_PAIRWISE:
3258 sm->pairwise_cipher = value;
3259 break;
3260 case WPA_PARAM_GROUP:
3261 sm->group_cipher = value;
3262 break;
3263 case WPA_PARAM_KEY_MGMT:
3264 sm->key_mgmt = value;
3265 break;
3266 case WPA_PARAM_MGMT_GROUP:
3267 sm->mgmt_group_cipher = value;
3268 break;
3269 case WPA_PARAM_RSN_ENABLED:
3270 sm->rsn_enabled = value;
3271 break;
3272 case WPA_PARAM_MFP:
3273 sm->mfp = value;
3274 break;
3275 case WPA_PARAM_OCV:
3276 sm->ocv = value;
3277 break;
3278 case WPA_PARAM_SAE_PWE:
3279 sm->sae_pwe = value;
3280 break;
3281 case WPA_PARAM_DENY_PTK0_REKEY:
3282 sm->wpa_deny_ptk0_rekey = value;
3283 break;
3284 case WPA_PARAM_EXT_KEY_ID:
3285 sm->ext_key_id = value;
3286 break;
3287 case WPA_PARAM_USE_EXT_KEY_ID:
3288 sm->use_ext_key_id = value;
3289 break;
3290 #ifdef CONFIG_TESTING_OPTIONS
3291 case WPA_PARAM_FT_RSNXE_USED:
3292 sm->ft_rsnxe_used = value;
3293 break;
3294 #endif /* CONFIG_TESTING_OPTIONS */
3295 #ifdef CONFIG_DPP2
3296 case WPA_PARAM_DPP_PFS:
3297 sm->dpp_pfs = value;
3298 break;
3299 #endif /* CONFIG_DPP2 */
3300 default:
3301 break;
3302 }
3303
3304 return ret;
3305 }
3306
3307
3308 /**
3309 * wpa_sm_get_status - Get WPA state machine
3310 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3311 * @buf: Buffer for status information
3312 * @buflen: Maximum buffer length
3313 * @verbose: Whether to include verbose status information
3314 * Returns: Number of bytes written to buf.
3315 *
3316 * Query WPA state machine for status information. This function fills in
3317 * a text area with current status information. If the buffer (buf) is not
3318 * large enough, status information will be truncated to fit the buffer.
3319 */
wpa_sm_get_status(struct wpa_sm * sm,char * buf,size_t buflen,int verbose)3320 int wpa_sm_get_status(struct wpa_sm *sm, char *buf, size_t buflen,
3321 int verbose)
3322 {
3323 char *pos = buf, *end = buf + buflen;
3324 int ret;
3325
3326 ret = os_snprintf(pos, end - pos,
3327 "pairwise_cipher=%s\n"
3328 "group_cipher=%s\n"
3329 "key_mgmt=%s\n",
3330 wpa_cipher_txt(sm->pairwise_cipher),
3331 wpa_cipher_txt(sm->group_cipher),
3332 wpa_key_mgmt_txt(sm->key_mgmt, sm->proto));
3333 if (os_snprintf_error(end - pos, ret))
3334 return pos - buf;
3335 pos += ret;
3336
3337 #ifdef CONFIG_DPP2
3338 if (sm->key_mgmt == WPA_KEY_MGMT_DPP && sm->dpp_z) {
3339 ret = os_snprintf(pos, end - pos, "dpp_pfs=1\n");
3340 if (os_snprintf_error(end - pos, ret))
3341 return pos - buf;
3342 pos += ret;
3343 }
3344 #endif /* CONFIG_DPP2 */
3345
3346 if (sm->mfp != NO_MGMT_FRAME_PROTECTION && sm->ap_rsn_ie) {
3347 struct wpa_ie_data rsn;
3348 if (wpa_parse_wpa_ie_rsn(sm->ap_rsn_ie, sm->ap_rsn_ie_len, &rsn)
3349 >= 0 &&
3350 rsn.capabilities & (WPA_CAPABILITY_MFPR |
3351 WPA_CAPABILITY_MFPC)) {
3352 ret = os_snprintf(pos, end - pos, "pmf=%d\n"
3353 "mgmt_group_cipher=%s\n",
3354 (rsn.capabilities &
3355 WPA_CAPABILITY_MFPR) ? 2 : 1,
3356 wpa_cipher_txt(
3357 sm->mgmt_group_cipher));
3358 if (os_snprintf_error(end - pos, ret))
3359 return pos - buf;
3360 pos += ret;
3361 }
3362 }
3363
3364 return pos - buf;
3365 }
3366
3367
wpa_sm_pmf_enabled(struct wpa_sm * sm)3368 int wpa_sm_pmf_enabled(struct wpa_sm *sm)
3369 {
3370 struct wpa_ie_data rsn;
3371
3372 if (sm->mfp == NO_MGMT_FRAME_PROTECTION || !sm->ap_rsn_ie)
3373 return 0;
3374
3375 if (wpa_parse_wpa_ie_rsn(sm->ap_rsn_ie, sm->ap_rsn_ie_len, &rsn) >= 0 &&
3376 rsn.capabilities & (WPA_CAPABILITY_MFPR | WPA_CAPABILITY_MFPC))
3377 return 1;
3378
3379 return 0;
3380 }
3381
3382
wpa_sm_ext_key_id(struct wpa_sm * sm)3383 int wpa_sm_ext_key_id(struct wpa_sm *sm)
3384 {
3385 return sm ? sm->ext_key_id : 0;
3386 }
3387
3388
wpa_sm_ext_key_id_active(struct wpa_sm * sm)3389 int wpa_sm_ext_key_id_active(struct wpa_sm *sm)
3390 {
3391 return sm ? sm->use_ext_key_id : 0;
3392 }
3393
3394
wpa_sm_ocv_enabled(struct wpa_sm * sm)3395 int wpa_sm_ocv_enabled(struct wpa_sm *sm)
3396 {
3397 struct wpa_ie_data rsn;
3398
3399 if (!sm->ocv || !sm->ap_rsn_ie)
3400 return 0;
3401
3402 return wpa_parse_wpa_ie_rsn(sm->ap_rsn_ie, sm->ap_rsn_ie_len,
3403 &rsn) >= 0 &&
3404 (rsn.capabilities & WPA_CAPABILITY_OCVC);
3405 }
3406
3407
3408 /**
3409 * wpa_sm_set_assoc_wpa_ie_default - Generate own WPA/RSN IE from configuration
3410 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3411 * @wpa_ie: Pointer to buffer for WPA/RSN IE
3412 * @wpa_ie_len: Pointer to the length of the wpa_ie buffer
3413 * Returns: 0 on success, -1 on failure
3414 */
wpa_sm_set_assoc_wpa_ie_default(struct wpa_sm * sm,u8 * wpa_ie,size_t * wpa_ie_len)3415 int wpa_sm_set_assoc_wpa_ie_default(struct wpa_sm *sm, u8 *wpa_ie,
3416 size_t *wpa_ie_len)
3417 {
3418 int res;
3419
3420 if (sm == NULL)
3421 return -1;
3422
3423 #ifdef CONFIG_TESTING_OPTIONS
3424 if (sm->test_assoc_ie) {
3425 wpa_printf(MSG_DEBUG,
3426 "TESTING: Replace association WPA/RSN IE");
3427 if (*wpa_ie_len < wpabuf_len(sm->test_assoc_ie))
3428 return -1;
3429 os_memcpy(wpa_ie, wpabuf_head(sm->test_assoc_ie),
3430 wpabuf_len(sm->test_assoc_ie));
3431 res = wpabuf_len(sm->test_assoc_ie);
3432 } else
3433 #endif /* CONFIG_TESTING_OPTIONS */
3434 res = wpa_gen_wpa_ie(sm, wpa_ie, *wpa_ie_len);
3435 if (res < 0)
3436 return -1;
3437 *wpa_ie_len = res;
3438
3439 wpa_hexdump(MSG_DEBUG, "WPA: Set own WPA IE default",
3440 wpa_ie, *wpa_ie_len);
3441
3442 if (sm->assoc_wpa_ie == NULL) {
3443 /*
3444 * Make a copy of the WPA/RSN IE so that 4-Way Handshake gets
3445 * the correct version of the IE even if PMKSA caching is
3446 * aborted (which would remove PMKID from IE generation).
3447 */
3448 sm->assoc_wpa_ie = os_memdup(wpa_ie, *wpa_ie_len);
3449 if (sm->assoc_wpa_ie == NULL)
3450 return -1;
3451
3452 sm->assoc_wpa_ie_len = *wpa_ie_len;
3453 } else {
3454 wpa_hexdump(MSG_DEBUG,
3455 "WPA: Leave previously set WPA IE default",
3456 sm->assoc_wpa_ie, sm->assoc_wpa_ie_len);
3457 }
3458
3459 return 0;
3460 }
3461
3462
3463 /**
3464 * wpa_sm_set_assoc_wpa_ie - Set own WPA/RSN IE from (Re)AssocReq
3465 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3466 * @ie: Pointer to IE data (starting from id)
3467 * @len: IE length
3468 * Returns: 0 on success, -1 on failure
3469 *
3470 * Inform WPA state machine about the WPA/RSN IE used in (Re)Association
3471 * Request frame. The IE will be used to override the default value generated
3472 * with wpa_sm_set_assoc_wpa_ie_default().
3473 */
wpa_sm_set_assoc_wpa_ie(struct wpa_sm * sm,const u8 * ie,size_t len)3474 int wpa_sm_set_assoc_wpa_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
3475 {
3476 if (sm == NULL)
3477 return -1;
3478
3479 os_free(sm->assoc_wpa_ie);
3480 if (ie == NULL || len == 0) {
3481 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3482 "WPA: clearing own WPA/RSN IE");
3483 sm->assoc_wpa_ie = NULL;
3484 sm->assoc_wpa_ie_len = 0;
3485 } else {
3486 wpa_hexdump(MSG_DEBUG, "WPA: set own WPA/RSN IE", ie, len);
3487 sm->assoc_wpa_ie = os_memdup(ie, len);
3488 if (sm->assoc_wpa_ie == NULL)
3489 return -1;
3490
3491 sm->assoc_wpa_ie_len = len;
3492 }
3493
3494 return 0;
3495 }
3496
3497
3498 /**
3499 * wpa_sm_set_assoc_rsnxe_default - Generate own RSNXE from configuration
3500 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3501 * @rsnxe: Pointer to buffer for RSNXE
3502 * @rsnxe_len: Pointer to the length of the rsne buffer
3503 * Returns: 0 on success, -1 on failure
3504 */
wpa_sm_set_assoc_rsnxe_default(struct wpa_sm * sm,u8 * rsnxe,size_t * rsnxe_len)3505 int wpa_sm_set_assoc_rsnxe_default(struct wpa_sm *sm, u8 *rsnxe,
3506 size_t *rsnxe_len)
3507 {
3508 int res;
3509
3510 if (!sm)
3511 return -1;
3512
3513 res = wpa_gen_rsnxe(sm, rsnxe, *rsnxe_len);
3514 if (res < 0)
3515 return -1;
3516 *rsnxe_len = res;
3517
3518 wpa_hexdump(MSG_DEBUG, "RSN: Set own RSNXE default", rsnxe, *rsnxe_len);
3519
3520 if (sm->assoc_rsnxe) {
3521 wpa_hexdump(MSG_DEBUG,
3522 "RSN: Leave previously set RSNXE default",
3523 sm->assoc_rsnxe, sm->assoc_rsnxe_len);
3524 } else if (*rsnxe_len > 0) {
3525 /*
3526 * Make a copy of the RSNXE so that 4-Way Handshake gets the
3527 * correct version of the IE even if it gets changed.
3528 */
3529 sm->assoc_rsnxe = os_memdup(rsnxe, *rsnxe_len);
3530 if (!sm->assoc_rsnxe)
3531 return -1;
3532
3533 sm->assoc_rsnxe_len = *rsnxe_len;
3534 }
3535
3536 return 0;
3537 }
3538
3539
3540 /**
3541 * wpa_sm_set_assoc_rsnxe - Set own RSNXE from (Re)AssocReq
3542 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3543 * @ie: Pointer to IE data (starting from id)
3544 * @len: IE length
3545 * Returns: 0 on success, -1 on failure
3546 *
3547 * Inform WPA state machine about the RSNXE used in (Re)Association Request
3548 * frame. The IE will be used to override the default value generated
3549 * with wpa_sm_set_assoc_rsnxe_default().
3550 */
wpa_sm_set_assoc_rsnxe(struct wpa_sm * sm,const u8 * ie,size_t len)3551 int wpa_sm_set_assoc_rsnxe(struct wpa_sm *sm, const u8 *ie, size_t len)
3552 {
3553 if (!sm)
3554 return -1;
3555
3556 os_free(sm->assoc_rsnxe);
3557 if (!ie || len == 0) {
3558 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3559 "RSN: clearing own RSNXE");
3560 sm->assoc_rsnxe = NULL;
3561 sm->assoc_rsnxe_len = 0;
3562 } else {
3563 wpa_hexdump(MSG_DEBUG, "RSN: set own RSNXE", ie, len);
3564 sm->assoc_rsnxe = os_memdup(ie, len);
3565 if (!sm->assoc_rsnxe)
3566 return -1;
3567
3568 sm->assoc_rsnxe_len = len;
3569 }
3570
3571 return 0;
3572 }
3573
3574
3575 /**
3576 * wpa_sm_set_ap_wpa_ie - Set AP WPA IE from Beacon/ProbeResp
3577 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3578 * @ie: Pointer to IE data (starting from id)
3579 * @len: IE length
3580 * Returns: 0 on success, -1 on failure
3581 *
3582 * Inform WPA state machine about the WPA IE used in Beacon / Probe Response
3583 * frame.
3584 */
wpa_sm_set_ap_wpa_ie(struct wpa_sm * sm,const u8 * ie,size_t len)3585 int wpa_sm_set_ap_wpa_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
3586 {
3587 if (sm == NULL)
3588 return -1;
3589
3590 os_free(sm->ap_wpa_ie);
3591 if (ie == NULL || len == 0) {
3592 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3593 "WPA: clearing AP WPA IE");
3594 sm->ap_wpa_ie = NULL;
3595 sm->ap_wpa_ie_len = 0;
3596 } else {
3597 wpa_hexdump(MSG_DEBUG, "WPA: set AP WPA IE", ie, len);
3598 sm->ap_wpa_ie = os_memdup(ie, len);
3599 if (sm->ap_wpa_ie == NULL)
3600 return -1;
3601
3602 sm->ap_wpa_ie_len = len;
3603 }
3604
3605 return 0;
3606 }
3607
3608
3609 /**
3610 * wpa_sm_set_ap_rsn_ie - Set AP RSN IE from Beacon/ProbeResp
3611 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3612 * @ie: Pointer to IE data (starting from id)
3613 * @len: IE length
3614 * Returns: 0 on success, -1 on failure
3615 *
3616 * Inform WPA state machine about the RSN IE used in Beacon / Probe Response
3617 * frame.
3618 */
wpa_sm_set_ap_rsn_ie(struct wpa_sm * sm,const u8 * ie,size_t len)3619 int wpa_sm_set_ap_rsn_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
3620 {
3621 if (sm == NULL)
3622 return -1;
3623
3624 os_free(sm->ap_rsn_ie);
3625 if (ie == NULL || len == 0) {
3626 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3627 "WPA: clearing AP RSN IE");
3628 sm->ap_rsn_ie = NULL;
3629 sm->ap_rsn_ie_len = 0;
3630 } else {
3631 wpa_hexdump(MSG_DEBUG, "WPA: set AP RSN IE", ie, len);
3632 sm->ap_rsn_ie = os_memdup(ie, len);
3633 if (sm->ap_rsn_ie == NULL)
3634 return -1;
3635
3636 sm->ap_rsn_ie_len = len;
3637 }
3638
3639 return 0;
3640 }
3641
3642
3643 /**
3644 * wpa_sm_set_ap_rsnxe - Set AP RSNXE from Beacon/ProbeResp
3645 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3646 * @ie: Pointer to IE data (starting from id)
3647 * @len: IE length
3648 * Returns: 0 on success, -1 on failure
3649 *
3650 * Inform WPA state machine about the RSNXE used in Beacon / Probe Response
3651 * frame.
3652 */
wpa_sm_set_ap_rsnxe(struct wpa_sm * sm,const u8 * ie,size_t len)3653 int wpa_sm_set_ap_rsnxe(struct wpa_sm *sm, const u8 *ie, size_t len)
3654 {
3655 if (!sm)
3656 return -1;
3657
3658 os_free(sm->ap_rsnxe);
3659 if (!ie || len == 0) {
3660 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: clearing AP RSNXE");
3661 sm->ap_rsnxe = NULL;
3662 sm->ap_rsnxe_len = 0;
3663 } else {
3664 wpa_hexdump(MSG_DEBUG, "WPA: set AP RSNXE", ie, len);
3665 sm->ap_rsnxe = os_memdup(ie, len);
3666 if (!sm->ap_rsnxe)
3667 return -1;
3668
3669 sm->ap_rsnxe_len = len;
3670 }
3671
3672 return 0;
3673 }
3674
3675
3676 /**
3677 * wpa_sm_parse_own_wpa_ie - Parse own WPA/RSN IE
3678 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3679 * @data: Pointer to data area for parsing results
3680 * Returns: 0 on success, -1 if IE is not known, or -2 on parsing failure
3681 *
3682 * Parse the contents of the own WPA or RSN IE from (Re)AssocReq and write the
3683 * parsed data into data.
3684 */
wpa_sm_parse_own_wpa_ie(struct wpa_sm * sm,struct wpa_ie_data * data)3685 int wpa_sm_parse_own_wpa_ie(struct wpa_sm *sm, struct wpa_ie_data *data)
3686 {
3687 if (sm == NULL)
3688 return -1;
3689
3690 if (sm->assoc_wpa_ie == NULL) {
3691 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3692 "WPA: No WPA/RSN IE available from association info");
3693 return -1;
3694 }
3695 if (wpa_parse_wpa_ie(sm->assoc_wpa_ie, sm->assoc_wpa_ie_len, data))
3696 return -2;
3697 return 0;
3698 }
3699
3700
wpa_sm_pmksa_cache_list(struct wpa_sm * sm,char * buf,size_t len)3701 int wpa_sm_pmksa_cache_list(struct wpa_sm *sm, char *buf, size_t len)
3702 {
3703 return pmksa_cache_list(sm->pmksa, buf, len);
3704 }
3705
3706
wpa_sm_pmksa_cache_head(struct wpa_sm * sm)3707 struct rsn_pmksa_cache_entry * wpa_sm_pmksa_cache_head(struct wpa_sm *sm)
3708 {
3709 return pmksa_cache_head(sm->pmksa);
3710 }
3711
3712
3713 struct rsn_pmksa_cache_entry *
wpa_sm_pmksa_cache_add_entry(struct wpa_sm * sm,struct rsn_pmksa_cache_entry * entry)3714 wpa_sm_pmksa_cache_add_entry(struct wpa_sm *sm,
3715 struct rsn_pmksa_cache_entry * entry)
3716 {
3717 return pmksa_cache_add_entry(sm->pmksa, entry);
3718 }
3719
3720
wpa_sm_pmksa_cache_add(struct wpa_sm * sm,const u8 * pmk,size_t pmk_len,const u8 * pmkid,const u8 * bssid,const u8 * fils_cache_id)3721 void wpa_sm_pmksa_cache_add(struct wpa_sm *sm, const u8 *pmk, size_t pmk_len,
3722 const u8 *pmkid, const u8 *bssid,
3723 const u8 *fils_cache_id)
3724 {
3725 sm->cur_pmksa = pmksa_cache_add(sm->pmksa, pmk, pmk_len, pmkid, NULL, 0,
3726 bssid, sm->own_addr, sm->network_ctx,
3727 sm->key_mgmt, fils_cache_id);
3728 }
3729
3730
wpa_sm_pmksa_exists(struct wpa_sm * sm,const u8 * bssid,const void * network_ctx)3731 int wpa_sm_pmksa_exists(struct wpa_sm *sm, const u8 *bssid,
3732 const void *network_ctx)
3733 {
3734 return pmksa_cache_get(sm->pmksa, bssid, NULL, network_ctx, 0) != NULL;
3735 }
3736
3737
wpa_sm_drop_sa(struct wpa_sm * sm)3738 void wpa_sm_drop_sa(struct wpa_sm *sm)
3739 {
3740 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Clear old PMK and PTK");
3741 sm->ptk_set = 0;
3742 sm->tptk_set = 0;
3743 sm->pmk_len = 0;
3744 os_memset(sm->pmk, 0, sizeof(sm->pmk));
3745 os_memset(&sm->ptk, 0, sizeof(sm->ptk));
3746 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
3747 os_memset(&sm->gtk, 0, sizeof(sm->gtk));
3748 os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
3749 os_memset(&sm->igtk, 0, sizeof(sm->igtk));
3750 os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
3751 #ifdef CONFIG_IEEE80211R
3752 os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
3753 sm->xxkey_len = 0;
3754 os_memset(sm->pmk_r0, 0, sizeof(sm->pmk_r0));
3755 sm->pmk_r0_len = 0;
3756 os_memset(sm->pmk_r1, 0, sizeof(sm->pmk_r1));
3757 sm->pmk_r1_len = 0;
3758 #endif /* CONFIG_IEEE80211R */
3759 }
3760
3761
wpa_sm_has_ptk(struct wpa_sm * sm)3762 int wpa_sm_has_ptk(struct wpa_sm *sm)
3763 {
3764 if (sm == NULL)
3765 return 0;
3766 return sm->ptk_set;
3767 }
3768
3769
wpa_sm_has_ptk_installed(struct wpa_sm * sm)3770 int wpa_sm_has_ptk_installed(struct wpa_sm *sm)
3771 {
3772 if (!sm)
3773 return 0;
3774 return sm->ptk.installed;
3775 }
3776
3777
wpa_sm_update_replay_ctr(struct wpa_sm * sm,const u8 * replay_ctr)3778 void wpa_sm_update_replay_ctr(struct wpa_sm *sm, const u8 *replay_ctr)
3779 {
3780 os_memcpy(sm->rx_replay_counter, replay_ctr, WPA_REPLAY_COUNTER_LEN);
3781 }
3782
3783
wpa_sm_pmksa_cache_flush(struct wpa_sm * sm,void * network_ctx)3784 void wpa_sm_pmksa_cache_flush(struct wpa_sm *sm, void *network_ctx)
3785 {
3786 pmksa_cache_flush(sm->pmksa, network_ctx, NULL, 0);
3787 }
3788
3789
3790 #ifdef CONFIG_WNM
wpa_wnmsleep_install_key(struct wpa_sm * sm,u8 subelem_id,u8 * buf)3791 int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf)
3792 {
3793 u16 keyinfo;
3794 u8 keylen; /* plaintext key len */
3795 u8 *key_rsc;
3796
3797 if (subelem_id == WNM_SLEEP_SUBELEM_GTK) {
3798 struct wpa_gtk_data gd;
3799
3800 os_memset(&gd, 0, sizeof(gd));
3801 keylen = wpa_cipher_key_len(sm->group_cipher);
3802 gd.key_rsc_len = wpa_cipher_rsc_len(sm->group_cipher);
3803 gd.alg = wpa_cipher_to_alg(sm->group_cipher);
3804 if (gd.alg == WPA_ALG_NONE) {
3805 wpa_printf(MSG_DEBUG, "Unsupported group cipher suite");
3806 return -1;
3807 }
3808
3809 key_rsc = buf + 5;
3810 keyinfo = WPA_GET_LE16(buf + 2);
3811 gd.gtk_len = keylen;
3812 if (gd.gtk_len != buf[4]) {
3813 wpa_printf(MSG_DEBUG, "GTK len mismatch len %d vs %d",
3814 gd.gtk_len, buf[4]);
3815 return -1;
3816 }
3817 gd.keyidx = keyinfo & 0x03; /* B0 - B1 */
3818 gd.tx = wpa_supplicant_gtk_tx_bit_workaround(
3819 sm, !!(keyinfo & WPA_KEY_INFO_TXRX));
3820
3821 os_memcpy(gd.gtk, buf + 13, gd.gtk_len);
3822
3823 wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)",
3824 gd.gtk, gd.gtk_len);
3825 if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) {
3826 forced_memzero(&gd, sizeof(gd));
3827 wpa_printf(MSG_DEBUG, "Failed to install the GTK in "
3828 "WNM mode");
3829 return -1;
3830 }
3831 forced_memzero(&gd, sizeof(gd));
3832 } else if (subelem_id == WNM_SLEEP_SUBELEM_IGTK) {
3833 const struct wpa_igtk_kde *igtk;
3834
3835 igtk = (const struct wpa_igtk_kde *) (buf + 2);
3836 if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0)
3837 return -1;
3838 } else if (subelem_id == WNM_SLEEP_SUBELEM_BIGTK) {
3839 const struct wpa_bigtk_kde *bigtk;
3840
3841 bigtk = (const struct wpa_bigtk_kde *) (buf + 2);
3842 if (sm->beacon_prot &&
3843 wpa_supplicant_install_bigtk(sm, bigtk, 1) < 0)
3844 return -1;
3845 } else {
3846 wpa_printf(MSG_DEBUG, "Unknown element id");
3847 return -1;
3848 }
3849
3850 return 0;
3851 }
3852 #endif /* CONFIG_WNM */
3853
3854
3855 #ifdef CONFIG_P2P
3856
wpa_sm_get_p2p_ip_addr(struct wpa_sm * sm,u8 * buf)3857 int wpa_sm_get_p2p_ip_addr(struct wpa_sm *sm, u8 *buf)
3858 {
3859 if (sm == NULL || WPA_GET_BE32(sm->p2p_ip_addr) == 0)
3860 return -1;
3861 os_memcpy(buf, sm->p2p_ip_addr, 3 * 4);
3862 return 0;
3863 }
3864
3865 #endif /* CONFIG_P2P */
3866
3867
wpa_sm_set_rx_replay_ctr(struct wpa_sm * sm,const u8 * rx_replay_counter)3868 void wpa_sm_set_rx_replay_ctr(struct wpa_sm *sm, const u8 *rx_replay_counter)
3869 {
3870 if (rx_replay_counter == NULL)
3871 return;
3872
3873 os_memcpy(sm->rx_replay_counter, rx_replay_counter,
3874 WPA_REPLAY_COUNTER_LEN);
3875 sm->rx_replay_counter_set = 1;
3876 wpa_printf(MSG_DEBUG, "Updated key replay counter");
3877 }
3878
3879
wpa_sm_set_ptk_kck_kek(struct wpa_sm * sm,const u8 * ptk_kck,size_t ptk_kck_len,const u8 * ptk_kek,size_t ptk_kek_len)3880 void wpa_sm_set_ptk_kck_kek(struct wpa_sm *sm,
3881 const u8 *ptk_kck, size_t ptk_kck_len,
3882 const u8 *ptk_kek, size_t ptk_kek_len)
3883 {
3884 if (ptk_kck && ptk_kck_len <= WPA_KCK_MAX_LEN) {
3885 os_memcpy(sm->ptk.kck, ptk_kck, ptk_kck_len);
3886 sm->ptk.kck_len = ptk_kck_len;
3887 wpa_printf(MSG_DEBUG, "Updated PTK KCK");
3888 }
3889 if (ptk_kek && ptk_kek_len <= WPA_KEK_MAX_LEN) {
3890 os_memcpy(sm->ptk.kek, ptk_kek, ptk_kek_len);
3891 sm->ptk.kek_len = ptk_kek_len;
3892 wpa_printf(MSG_DEBUG, "Updated PTK KEK");
3893 }
3894 sm->ptk_set = 1;
3895 }
3896
3897
3898 #ifdef CONFIG_TESTING_OPTIONS
3899
wpa_sm_set_test_assoc_ie(struct wpa_sm * sm,struct wpabuf * buf)3900 void wpa_sm_set_test_assoc_ie(struct wpa_sm *sm, struct wpabuf *buf)
3901 {
3902 wpabuf_free(sm->test_assoc_ie);
3903 sm->test_assoc_ie = buf;
3904 }
3905
3906
wpa_sm_get_anonce(struct wpa_sm * sm)3907 const u8 * wpa_sm_get_anonce(struct wpa_sm *sm)
3908 {
3909 return sm->anonce;
3910 }
3911
3912 #endif /* CONFIG_TESTING_OPTIONS */
3913
3914
wpa_sm_get_key_mgmt(struct wpa_sm * sm)3915 unsigned int wpa_sm_get_key_mgmt(struct wpa_sm *sm)
3916 {
3917 return sm->key_mgmt;
3918 }
3919
3920
3921 #ifdef CONFIG_FILS
3922
fils_build_auth(struct wpa_sm * sm,int dh_group,const u8 * md)3923 struct wpabuf * fils_build_auth(struct wpa_sm *sm, int dh_group, const u8 *md)
3924 {
3925 struct wpabuf *buf = NULL;
3926 struct wpabuf *erp_msg;
3927 struct wpabuf *pub = NULL;
3928
3929 erp_msg = eapol_sm_build_erp_reauth_start(sm->eapol);
3930 if (!erp_msg && !sm->cur_pmksa) {
3931 wpa_printf(MSG_DEBUG,
3932 "FILS: Neither ERP EAP-Initiate/Re-auth nor PMKSA cache entry is available - skip FILS");
3933 goto fail;
3934 }
3935
3936 wpa_printf(MSG_DEBUG, "FILS: Try to use FILS (erp=%d pmksa_cache=%d)",
3937 erp_msg != NULL, sm->cur_pmksa != NULL);
3938
3939 sm->fils_completed = 0;
3940
3941 if (!sm->assoc_wpa_ie) {
3942 wpa_printf(MSG_INFO, "FILS: No own RSN IE set for FILS");
3943 goto fail;
3944 }
3945
3946 if (random_get_bytes(sm->fils_nonce, FILS_NONCE_LEN) < 0 ||
3947 random_get_bytes(sm->fils_session, FILS_SESSION_LEN) < 0)
3948 goto fail;
3949
3950 wpa_hexdump(MSG_DEBUG, "FILS: Generated FILS Nonce",
3951 sm->fils_nonce, FILS_NONCE_LEN);
3952 wpa_hexdump(MSG_DEBUG, "FILS: Generated FILS Session",
3953 sm->fils_session, FILS_SESSION_LEN);
3954
3955 #ifdef CONFIG_FILS_SK_PFS
3956 sm->fils_dh_group = dh_group;
3957 if (dh_group) {
3958 crypto_ecdh_deinit(sm->fils_ecdh);
3959 sm->fils_ecdh = crypto_ecdh_init(dh_group);
3960 if (!sm->fils_ecdh) {
3961 wpa_printf(MSG_INFO,
3962 "FILS: Could not initialize ECDH with group %d",
3963 dh_group);
3964 goto fail;
3965 }
3966 pub = crypto_ecdh_get_pubkey(sm->fils_ecdh, 1);
3967 if (!pub)
3968 goto fail;
3969 wpa_hexdump_buf(MSG_DEBUG, "FILS: Element (DH public key)",
3970 pub);
3971 sm->fils_dh_elem_len = wpabuf_len(pub);
3972 }
3973 #endif /* CONFIG_FILS_SK_PFS */
3974
3975 buf = wpabuf_alloc(1000 + sm->assoc_wpa_ie_len +
3976 (pub ? wpabuf_len(pub) : 0));
3977 if (!buf)
3978 goto fail;
3979
3980 /* Fields following the Authentication algorithm number field */
3981
3982 /* Authentication Transaction seq# */
3983 wpabuf_put_le16(buf, 1);
3984
3985 /* Status Code */
3986 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
3987
3988 /* TODO: FILS PK */
3989 #ifdef CONFIG_FILS_SK_PFS
3990 if (dh_group) {
3991 /* Finite Cyclic Group */
3992 wpabuf_put_le16(buf, dh_group);
3993 /* Element */
3994 wpabuf_put_buf(buf, pub);
3995 }
3996 #endif /* CONFIG_FILS_SK_PFS */
3997
3998 /* RSNE */
3999 wpa_hexdump(MSG_DEBUG, "FILS: RSNE in FILS Authentication frame",
4000 sm->assoc_wpa_ie, sm->assoc_wpa_ie_len);
4001 wpabuf_put_data(buf, sm->assoc_wpa_ie, sm->assoc_wpa_ie_len);
4002
4003 if (md) {
4004 /* MDE when using FILS for FT initial association */
4005 struct rsn_mdie *mdie;
4006
4007 wpabuf_put_u8(buf, WLAN_EID_MOBILITY_DOMAIN);
4008 wpabuf_put_u8(buf, sizeof(*mdie));
4009 mdie = wpabuf_put(buf, sizeof(*mdie));
4010 os_memcpy(mdie->mobility_domain, md, MOBILITY_DOMAIN_ID_LEN);
4011 mdie->ft_capab = 0;
4012 }
4013
4014 /* FILS Nonce */
4015 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
4016 wpabuf_put_u8(buf, 1 + FILS_NONCE_LEN); /* Length */
4017 /* Element ID Extension */
4018 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_NONCE);
4019 wpabuf_put_data(buf, sm->fils_nonce, FILS_NONCE_LEN);
4020
4021 /* FILS Session */
4022 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
4023 wpabuf_put_u8(buf, 1 + FILS_SESSION_LEN); /* Length */
4024 /* Element ID Extension */
4025 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_SESSION);
4026 wpabuf_put_data(buf, sm->fils_session, FILS_SESSION_LEN);
4027
4028 /* Wrapped Data */
4029 sm->fils_erp_pmkid_set = 0;
4030 if (erp_msg) {
4031 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
4032 wpabuf_put_u8(buf, 1 + wpabuf_len(erp_msg)); /* Length */
4033 /* Element ID Extension */
4034 wpabuf_put_u8(buf, WLAN_EID_EXT_WRAPPED_DATA);
4035 wpabuf_put_buf(buf, erp_msg);
4036 /* Calculate pending PMKID here so that we do not need to
4037 * maintain a copy of the EAP-Initiate/Reauth message. */
4038 if (fils_pmkid_erp(sm->key_mgmt, wpabuf_head(erp_msg),
4039 wpabuf_len(erp_msg),
4040 sm->fils_erp_pmkid) == 0)
4041 sm->fils_erp_pmkid_set = 1;
4042 }
4043
4044 wpa_hexdump_buf(MSG_DEBUG, "RSN: FILS fields for Authentication frame",
4045 buf);
4046
4047 fail:
4048 wpabuf_free(erp_msg);
4049 wpabuf_free(pub);
4050 return buf;
4051 }
4052
4053
fils_process_auth(struct wpa_sm * sm,const u8 * bssid,const u8 * data,size_t len)4054 int fils_process_auth(struct wpa_sm *sm, const u8 *bssid, const u8 *data,
4055 size_t len)
4056 {
4057 const u8 *pos, *end;
4058 struct ieee802_11_elems elems;
4059 struct wpa_ie_data rsn;
4060 int pmkid_match = 0;
4061 u8 ick[FILS_ICK_MAX_LEN];
4062 size_t ick_len;
4063 int res;
4064 struct wpabuf *dh_ss = NULL;
4065 const u8 *g_sta = NULL;
4066 size_t g_sta_len = 0;
4067 const u8 *g_ap = NULL;
4068 size_t g_ap_len = 0;
4069 struct wpabuf *pub = NULL;
4070
4071 os_memcpy(sm->bssid, bssid, ETH_ALEN);
4072
4073 wpa_hexdump(MSG_DEBUG, "FILS: Authentication frame fields",
4074 data, len);
4075 pos = data;
4076 end = data + len;
4077
4078 /* TODO: FILS PK */
4079 #ifdef CONFIG_FILS_SK_PFS
4080 if (sm->fils_dh_group) {
4081 u16 group;
4082
4083 /* Using FILS PFS */
4084
4085 /* Finite Cyclic Group */
4086 if (end - pos < 2) {
4087 wpa_printf(MSG_DEBUG,
4088 "FILS: No room for Finite Cyclic Group");
4089 goto fail;
4090 }
4091 group = WPA_GET_LE16(pos);
4092 pos += 2;
4093 if (group != sm->fils_dh_group) {
4094 wpa_printf(MSG_DEBUG,
4095 "FILS: Unexpected change in Finite Cyclic Group: %u (expected %u)",
4096 group, sm->fils_dh_group);
4097 goto fail;
4098 }
4099
4100 /* Element */
4101 if ((size_t) (end - pos) < sm->fils_dh_elem_len) {
4102 wpa_printf(MSG_DEBUG, "FILS: No room for Element");
4103 goto fail;
4104 }
4105
4106 if (!sm->fils_ecdh) {
4107 wpa_printf(MSG_DEBUG, "FILS: No ECDH state available");
4108 goto fail;
4109 }
4110 dh_ss = crypto_ecdh_set_peerkey(sm->fils_ecdh, 1, pos,
4111 sm->fils_dh_elem_len);
4112 if (!dh_ss) {
4113 wpa_printf(MSG_DEBUG, "FILS: ECDH operation failed");
4114 goto fail;
4115 }
4116 wpa_hexdump_buf_key(MSG_DEBUG, "FILS: DH_SS", dh_ss);
4117 g_ap = pos;
4118 g_ap_len = sm->fils_dh_elem_len;
4119 pos += sm->fils_dh_elem_len;
4120 }
4121 #endif /* CONFIG_FILS_SK_PFS */
4122
4123 wpa_hexdump(MSG_DEBUG, "FILS: Remaining IEs", pos, end - pos);
4124 if (ieee802_11_parse_elems(pos, end - pos, &elems, 1) == ParseFailed) {
4125 wpa_printf(MSG_DEBUG, "FILS: Could not parse elements");
4126 goto fail;
4127 }
4128
4129 /* RSNE */
4130 wpa_hexdump(MSG_DEBUG, "FILS: RSN element", elems.rsn_ie,
4131 elems.rsn_ie_len);
4132 if (!elems.rsn_ie ||
4133 wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, elems.rsn_ie_len + 2,
4134 &rsn) < 0) {
4135 wpa_printf(MSG_DEBUG, "FILS: No RSN element");
4136 goto fail;
4137 }
4138
4139 if (!elems.fils_nonce) {
4140 wpa_printf(MSG_DEBUG, "FILS: No FILS Nonce field");
4141 goto fail;
4142 }
4143 os_memcpy(sm->fils_anonce, elems.fils_nonce, FILS_NONCE_LEN);
4144 wpa_hexdump(MSG_DEBUG, "FILS: ANonce", sm->fils_anonce, FILS_NONCE_LEN);
4145
4146 #ifdef CONFIG_IEEE80211R
4147 if (wpa_key_mgmt_ft(sm->key_mgmt)) {
4148 struct wpa_ft_ies parse;
4149
4150 if (!elems.mdie || !elems.ftie) {
4151 wpa_printf(MSG_DEBUG, "FILS+FT: No MDE or FTE");
4152 goto fail;
4153 }
4154
4155 if (wpa_ft_parse_ies(pos, end - pos, &parse,
4156 wpa_key_mgmt_sha384(sm->key_mgmt)) < 0) {
4157 wpa_printf(MSG_DEBUG, "FILS+FT: Failed to parse IEs");
4158 goto fail;
4159 }
4160
4161 if (!parse.r0kh_id) {
4162 wpa_printf(MSG_DEBUG,
4163 "FILS+FT: No R0KH-ID subelem in FTE");
4164 goto fail;
4165 }
4166 os_memcpy(sm->r0kh_id, parse.r0kh_id, parse.r0kh_id_len);
4167 sm->r0kh_id_len = parse.r0kh_id_len;
4168 wpa_hexdump_ascii(MSG_DEBUG, "FILS+FT: R0KH-ID",
4169 sm->r0kh_id, sm->r0kh_id_len);
4170
4171 if (!parse.r1kh_id) {
4172 wpa_printf(MSG_DEBUG,
4173 "FILS+FT: No R1KH-ID subelem in FTE");
4174 goto fail;
4175 }
4176 os_memcpy(sm->r1kh_id, parse.r1kh_id, FT_R1KH_ID_LEN);
4177 wpa_hexdump(MSG_DEBUG, "FILS+FT: R1KH-ID",
4178 sm->r1kh_id, FT_R1KH_ID_LEN);
4179
4180 /* TODO: Check MDE and FTE payload */
4181
4182 wpabuf_free(sm->fils_ft_ies);
4183 sm->fils_ft_ies = wpabuf_alloc(2 + elems.mdie_len +
4184 2 + elems.ftie_len);
4185 if (!sm->fils_ft_ies)
4186 goto fail;
4187 wpabuf_put_data(sm->fils_ft_ies, elems.mdie - 2,
4188 2 + elems.mdie_len);
4189 wpabuf_put_data(sm->fils_ft_ies, elems.ftie - 2,
4190 2 + elems.ftie_len);
4191 } else {
4192 wpabuf_free(sm->fils_ft_ies);
4193 sm->fils_ft_ies = NULL;
4194 }
4195 #endif /* CONFIG_IEEE80211R */
4196
4197 /* PMKID List */
4198 if (rsn.pmkid && rsn.num_pmkid > 0) {
4199 wpa_hexdump(MSG_DEBUG, "FILS: PMKID List",
4200 rsn.pmkid, rsn.num_pmkid * PMKID_LEN);
4201
4202 if (rsn.num_pmkid != 1) {
4203 wpa_printf(MSG_DEBUG, "FILS: Invalid PMKID selection");
4204 goto fail;
4205 }
4206 wpa_hexdump(MSG_DEBUG, "FILS: PMKID", rsn.pmkid, PMKID_LEN);
4207 if (os_memcmp(sm->cur_pmksa->pmkid, rsn.pmkid, PMKID_LEN) != 0)
4208 {
4209 wpa_printf(MSG_DEBUG, "FILS: PMKID mismatch");
4210 wpa_hexdump(MSG_DEBUG, "FILS: Expected PMKID",
4211 sm->cur_pmksa->pmkid, PMKID_LEN);
4212 goto fail;
4213 }
4214 wpa_printf(MSG_DEBUG,
4215 "FILS: Matching PMKID - continue using PMKSA caching");
4216 pmkid_match = 1;
4217 }
4218 if (!pmkid_match && sm->cur_pmksa) {
4219 wpa_printf(MSG_DEBUG,
4220 "FILS: No PMKID match - cannot use cached PMKSA entry");
4221 sm->cur_pmksa = NULL;
4222 }
4223
4224 /* FILS Session */
4225 if (!elems.fils_session) {
4226 wpa_printf(MSG_DEBUG, "FILS: No FILS Session element");
4227 goto fail;
4228 }
4229 wpa_hexdump(MSG_DEBUG, "FILS: FILS Session", elems.fils_session,
4230 FILS_SESSION_LEN);
4231 if (os_memcmp(sm->fils_session, elems.fils_session, FILS_SESSION_LEN)
4232 != 0) {
4233 wpa_printf(MSG_DEBUG, "FILS: Session mismatch");
4234 wpa_hexdump(MSG_DEBUG, "FILS: Expected FILS Session",
4235 sm->fils_session, FILS_SESSION_LEN);
4236 goto fail;
4237 }
4238
4239 /* Wrapped Data */
4240 if (!sm->cur_pmksa && elems.wrapped_data) {
4241 u8 rmsk[ERP_MAX_KEY_LEN];
4242 size_t rmsk_len;
4243
4244 wpa_hexdump(MSG_DEBUG, "FILS: Wrapped Data",
4245 elems.wrapped_data,
4246 elems.wrapped_data_len);
4247 eapol_sm_process_erp_finish(sm->eapol, elems.wrapped_data,
4248 elems.wrapped_data_len);
4249 if (eapol_sm_failed(sm->eapol))
4250 goto fail;
4251
4252 rmsk_len = ERP_MAX_KEY_LEN;
4253 res = eapol_sm_get_key(sm->eapol, rmsk, rmsk_len);
4254 if (res == PMK_LEN) {
4255 rmsk_len = PMK_LEN;
4256 res = eapol_sm_get_key(sm->eapol, rmsk, rmsk_len);
4257 }
4258 if (res)
4259 goto fail;
4260
4261 res = fils_rmsk_to_pmk(sm->key_mgmt, rmsk, rmsk_len,
4262 sm->fils_nonce, sm->fils_anonce,
4263 dh_ss ? wpabuf_head(dh_ss) : NULL,
4264 dh_ss ? wpabuf_len(dh_ss) : 0,
4265 sm->pmk, &sm->pmk_len);
4266 forced_memzero(rmsk, sizeof(rmsk));
4267
4268 /* Don't use DHss in PTK derivation if PMKSA caching is not
4269 * used. */
4270 wpabuf_clear_free(dh_ss);
4271 dh_ss = NULL;
4272
4273 if (res)
4274 goto fail;
4275
4276 if (!sm->fils_erp_pmkid_set) {
4277 wpa_printf(MSG_DEBUG, "FILS: PMKID not available");
4278 goto fail;
4279 }
4280 wpa_hexdump(MSG_DEBUG, "FILS: PMKID", sm->fils_erp_pmkid,
4281 PMKID_LEN);
4282 wpa_printf(MSG_DEBUG, "FILS: ERP processing succeeded - add PMKSA cache entry for the result");
4283 sm->cur_pmksa = pmksa_cache_add(sm->pmksa, sm->pmk, sm->pmk_len,
4284 sm->fils_erp_pmkid, NULL, 0,
4285 sm->bssid, sm->own_addr,
4286 sm->network_ctx, sm->key_mgmt,
4287 NULL);
4288 }
4289
4290 if (!sm->cur_pmksa) {
4291 wpa_printf(MSG_DEBUG,
4292 "FILS: No remaining options to continue FILS authentication");
4293 goto fail;
4294 }
4295
4296 if (fils_pmk_to_ptk(sm->pmk, sm->pmk_len, sm->own_addr, sm->bssid,
4297 sm->fils_nonce, sm->fils_anonce,
4298 dh_ss ? wpabuf_head(dh_ss) : NULL,
4299 dh_ss ? wpabuf_len(dh_ss) : 0,
4300 &sm->ptk, ick, &ick_len,
4301 sm->key_mgmt, sm->pairwise_cipher,
4302 sm->fils_ft, &sm->fils_ft_len) < 0) {
4303 wpa_printf(MSG_DEBUG, "FILS: Failed to derive PTK");
4304 goto fail;
4305 }
4306
4307 wpabuf_clear_free(dh_ss);
4308 dh_ss = NULL;
4309
4310 sm->ptk_set = 1;
4311 sm->tptk_set = 0;
4312 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
4313
4314 #ifdef CONFIG_FILS_SK_PFS
4315 if (sm->fils_dh_group) {
4316 if (!sm->fils_ecdh) {
4317 wpa_printf(MSG_INFO, "FILS: ECDH not initialized");
4318 goto fail;
4319 }
4320 pub = crypto_ecdh_get_pubkey(sm->fils_ecdh, 1);
4321 if (!pub)
4322 goto fail;
4323 wpa_hexdump_buf(MSG_DEBUG, "FILS: gSTA", pub);
4324 g_sta = wpabuf_head(pub);
4325 g_sta_len = wpabuf_len(pub);
4326 if (!g_ap) {
4327 wpa_printf(MSG_INFO, "FILS: gAP not available");
4328 goto fail;
4329 }
4330 wpa_hexdump(MSG_DEBUG, "FILS: gAP", g_ap, g_ap_len);
4331 }
4332 #endif /* CONFIG_FILS_SK_PFS */
4333
4334 res = fils_key_auth_sk(ick, ick_len, sm->fils_nonce,
4335 sm->fils_anonce, sm->own_addr, sm->bssid,
4336 g_sta, g_sta_len, g_ap, g_ap_len,
4337 sm->key_mgmt, sm->fils_key_auth_sta,
4338 sm->fils_key_auth_ap,
4339 &sm->fils_key_auth_len);
4340 wpabuf_free(pub);
4341 forced_memzero(ick, sizeof(ick));
4342 return res;
4343 fail:
4344 wpabuf_free(pub);
4345 wpabuf_clear_free(dh_ss);
4346 return -1;
4347 }
4348
4349
4350 #ifdef CONFIG_IEEE80211R
fils_ft_build_assoc_req_rsne(struct wpa_sm * sm,struct wpabuf * buf)4351 static int fils_ft_build_assoc_req_rsne(struct wpa_sm *sm, struct wpabuf *buf)
4352 {
4353 struct rsn_ie_hdr *rsnie;
4354 u16 capab;
4355 u8 *pos;
4356 int use_sha384 = wpa_key_mgmt_sha384(sm->key_mgmt);
4357
4358 /* RSNIE[PMKR0Name/PMKR1Name] */
4359 rsnie = wpabuf_put(buf, sizeof(*rsnie));
4360 rsnie->elem_id = WLAN_EID_RSN;
4361 WPA_PUT_LE16(rsnie->version, RSN_VERSION);
4362
4363 /* Group Suite Selector */
4364 if (!wpa_cipher_valid_group(sm->group_cipher)) {
4365 wpa_printf(MSG_WARNING, "FT: Invalid group cipher (%d)",
4366 sm->group_cipher);
4367 return -1;
4368 }
4369 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
4370 RSN_SELECTOR_PUT(pos, wpa_cipher_to_suite(WPA_PROTO_RSN,
4371 sm->group_cipher));
4372
4373 /* Pairwise Suite Count */
4374 wpabuf_put_le16(buf, 1);
4375
4376 /* Pairwise Suite List */
4377 if (!wpa_cipher_valid_pairwise(sm->pairwise_cipher)) {
4378 wpa_printf(MSG_WARNING, "FT: Invalid pairwise cipher (%d)",
4379 sm->pairwise_cipher);
4380 return -1;
4381 }
4382 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
4383 RSN_SELECTOR_PUT(pos, wpa_cipher_to_suite(WPA_PROTO_RSN,
4384 sm->pairwise_cipher));
4385
4386 /* Authenticated Key Management Suite Count */
4387 wpabuf_put_le16(buf, 1);
4388
4389 /* Authenticated Key Management Suite List */
4390 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
4391 if (sm->key_mgmt == WPA_KEY_MGMT_FT_FILS_SHA256)
4392 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_FILS_SHA256);
4393 else if (sm->key_mgmt == WPA_KEY_MGMT_FT_FILS_SHA384)
4394 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_FILS_SHA384);
4395 else {
4396 wpa_printf(MSG_WARNING,
4397 "FILS+FT: Invalid key management type (%d)",
4398 sm->key_mgmt);
4399 return -1;
4400 }
4401
4402 /* RSN Capabilities */
4403 capab = 0;
4404 if (sm->mfp)
4405 capab |= WPA_CAPABILITY_MFPC;
4406 if (sm->mfp == 2)
4407 capab |= WPA_CAPABILITY_MFPR;
4408 if (sm->ocv)
4409 capab |= WPA_CAPABILITY_OCVC;
4410 if (sm->ext_key_id)
4411 capab |= WPA_CAPABILITY_EXT_KEY_ID_FOR_UNICAST;
4412 wpabuf_put_le16(buf, capab);
4413
4414 /* PMKID Count */
4415 wpabuf_put_le16(buf, 1);
4416
4417 /* PMKID List [PMKR1Name] */
4418 wpa_hexdump_key(MSG_DEBUG, "FILS+FT: XXKey (FILS-FT)",
4419 sm->fils_ft, sm->fils_ft_len);
4420 wpa_hexdump_ascii(MSG_DEBUG, "FILS+FT: SSID", sm->ssid, sm->ssid_len);
4421 wpa_hexdump(MSG_DEBUG, "FILS+FT: MDID",
4422 sm->mobility_domain, MOBILITY_DOMAIN_ID_LEN);
4423 wpa_hexdump_ascii(MSG_DEBUG, "FILS+FT: R0KH-ID",
4424 sm->r0kh_id, sm->r0kh_id_len);
4425 if (wpa_derive_pmk_r0(sm->fils_ft, sm->fils_ft_len, sm->ssid,
4426 sm->ssid_len, sm->mobility_domain,
4427 sm->r0kh_id, sm->r0kh_id_len, sm->own_addr,
4428 sm->pmk_r0, sm->pmk_r0_name, use_sha384) < 0) {
4429 wpa_printf(MSG_WARNING, "FILS+FT: Could not derive PMK-R0");
4430 return -1;
4431 }
4432 sm->pmk_r0_len = use_sha384 ? SHA384_MAC_LEN : PMK_LEN;
4433 wpa_hexdump_key(MSG_DEBUG, "FILS+FT: PMK-R0",
4434 sm->pmk_r0, sm->pmk_r0_len);
4435 wpa_hexdump(MSG_DEBUG, "FILS+FT: PMKR0Name",
4436 sm->pmk_r0_name, WPA_PMK_NAME_LEN);
4437 wpa_printf(MSG_DEBUG, "FILS+FT: R1KH-ID: " MACSTR,
4438 MAC2STR(sm->r1kh_id));
4439 pos = wpabuf_put(buf, WPA_PMK_NAME_LEN);
4440 if (wpa_derive_pmk_r1_name(sm->pmk_r0_name, sm->r1kh_id, sm->own_addr,
4441 sm->pmk_r1_name, use_sha384) < 0) {
4442 wpa_printf(MSG_WARNING, "FILS+FT: Could not derive PMKR1Name");
4443 return -1;
4444 }
4445 wpa_hexdump(MSG_DEBUG, "FILS+FT: PMKR1Name", sm->pmk_r1_name,
4446 WPA_PMK_NAME_LEN);
4447 os_memcpy(pos, sm->pmk_r1_name, WPA_PMK_NAME_LEN);
4448
4449 if (sm->mgmt_group_cipher == WPA_CIPHER_AES_128_CMAC) {
4450 /* Management Group Cipher Suite */
4451 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
4452 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC);
4453 }
4454
4455 rsnie->len = ((u8 *) wpabuf_put(buf, 0) - (u8 *) rsnie) - 2;
4456 return 0;
4457 }
4458 #endif /* CONFIG_IEEE80211R */
4459
4460
fils_build_assoc_req(struct wpa_sm * sm,const u8 ** kek,size_t * kek_len,const u8 ** snonce,const u8 ** anonce,const struct wpabuf ** hlp,unsigned int num_hlp)4461 struct wpabuf * fils_build_assoc_req(struct wpa_sm *sm, const u8 **kek,
4462 size_t *kek_len, const u8 **snonce,
4463 const u8 **anonce,
4464 const struct wpabuf **hlp,
4465 unsigned int num_hlp)
4466 {
4467 struct wpabuf *buf;
4468 size_t len;
4469 unsigned int i;
4470
4471 len = 1000;
4472 #ifdef CONFIG_IEEE80211R
4473 if (sm->fils_ft_ies)
4474 len += wpabuf_len(sm->fils_ft_ies);
4475 if (wpa_key_mgmt_ft(sm->key_mgmt))
4476 len += 256;
4477 #endif /* CONFIG_IEEE80211R */
4478 for (i = 0; hlp && i < num_hlp; i++)
4479 len += 10 + wpabuf_len(hlp[i]);
4480 buf = wpabuf_alloc(len);
4481 if (!buf)
4482 return NULL;
4483
4484 #ifdef CONFIG_IEEE80211R
4485 if (wpa_key_mgmt_ft(sm->key_mgmt) && sm->fils_ft_ies) {
4486 /* MDE and FTE when using FILS+FT */
4487 wpabuf_put_buf(buf, sm->fils_ft_ies);
4488 /* RSNE with PMKR1Name in PMKID field */
4489 if (fils_ft_build_assoc_req_rsne(sm, buf) < 0) {
4490 wpabuf_free(buf);
4491 return NULL;
4492 }
4493 }
4494 #endif /* CONFIG_IEEE80211R */
4495
4496 /* FILS Session */
4497 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
4498 wpabuf_put_u8(buf, 1 + FILS_SESSION_LEN); /* Length */
4499 /* Element ID Extension */
4500 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_SESSION);
4501 wpabuf_put_data(buf, sm->fils_session, FILS_SESSION_LEN);
4502
4503 /* Everything after FILS Session element gets encrypted in the driver
4504 * with KEK. The buffer returned from here is the plaintext version. */
4505
4506 /* TODO: FILS Public Key */
4507
4508 /* FILS Key Confirm */
4509 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
4510 wpabuf_put_u8(buf, 1 + sm->fils_key_auth_len); /* Length */
4511 /* Element ID Extension */
4512 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_KEY_CONFIRM);
4513 wpabuf_put_data(buf, sm->fils_key_auth_sta, sm->fils_key_auth_len);
4514
4515 /* FILS HLP Container */
4516 for (i = 0; hlp && i < num_hlp; i++) {
4517 const u8 *pos = wpabuf_head(hlp[i]);
4518 size_t left = wpabuf_len(hlp[i]);
4519
4520 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
4521 if (left <= 254)
4522 len = 1 + left;
4523 else
4524 len = 255;
4525 wpabuf_put_u8(buf, len); /* Length */
4526 /* Element ID Extension */
4527 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_HLP_CONTAINER);
4528 /* Destination MAC Address, Source MAC Address, HLP Packet.
4529 * HLP Packet is in MSDU format (i.e., included the LLC/SNAP
4530 * header when LPD is used). */
4531 wpabuf_put_data(buf, pos, len - 1);
4532 pos += len - 1;
4533 left -= len - 1;
4534 while (left) {
4535 wpabuf_put_u8(buf, WLAN_EID_FRAGMENT);
4536 len = left > 255 ? 255 : left;
4537 wpabuf_put_u8(buf, len);
4538 wpabuf_put_data(buf, pos, len);
4539 pos += len;
4540 left -= len;
4541 }
4542 }
4543
4544 /* TODO: FILS IP Address Assignment */
4545
4546 #ifdef CONFIG_OCV
4547 if (wpa_sm_ocv_enabled(sm)) {
4548 struct wpa_channel_info ci;
4549 u8 *pos;
4550
4551 if (wpa_sm_channel_info(sm, &ci) != 0) {
4552 wpa_printf(MSG_WARNING,
4553 "FILS: Failed to get channel info for OCI element");
4554 wpabuf_free(buf);
4555 return NULL;
4556 }
4557
4558 pos = wpabuf_put(buf, OCV_OCI_EXTENDED_LEN);
4559 if (ocv_insert_extended_oci(&ci, pos) < 0) {
4560 wpabuf_free(buf);
4561 return NULL;
4562 }
4563 }
4564 #endif /* CONFIG_OCV */
4565
4566 wpa_hexdump_buf(MSG_DEBUG, "FILS: Association Request plaintext", buf);
4567
4568 *kek = sm->ptk.kek;
4569 *kek_len = sm->ptk.kek_len;
4570 wpa_hexdump_key(MSG_DEBUG, "FILS: KEK for AEAD", *kek, *kek_len);
4571 *snonce = sm->fils_nonce;
4572 wpa_hexdump(MSG_DEBUG, "FILS: SNonce for AEAD AAD",
4573 *snonce, FILS_NONCE_LEN);
4574 *anonce = sm->fils_anonce;
4575 wpa_hexdump(MSG_DEBUG, "FILS: ANonce for AEAD AAD",
4576 *anonce, FILS_NONCE_LEN);
4577
4578 return buf;
4579 }
4580
4581
fils_process_hlp_resp(struct wpa_sm * sm,const u8 * resp,size_t len)4582 static void fils_process_hlp_resp(struct wpa_sm *sm, const u8 *resp, size_t len)
4583 {
4584 const u8 *pos, *end;
4585
4586 wpa_hexdump(MSG_MSGDUMP, "FILS: HLP response", resp, len);
4587 if (len < 2 * ETH_ALEN)
4588 return;
4589 pos = resp + 2 * ETH_ALEN;
4590 end = resp + len;
4591 if (end - pos >= 6 &&
4592 os_memcmp(pos, "\xaa\xaa\x03\x00\x00\x00", 6) == 0)
4593 pos += 6; /* Remove SNAP/LLC header */
4594 wpa_sm_fils_hlp_rx(sm, resp, resp + ETH_ALEN, pos, end - pos);
4595 }
4596
4597
fils_process_hlp_container(struct wpa_sm * sm,const u8 * pos,size_t len)4598 static void fils_process_hlp_container(struct wpa_sm *sm, const u8 *pos,
4599 size_t len)
4600 {
4601 const u8 *end = pos + len;
4602 u8 *tmp, *tmp_pos;
4603
4604 /* Check if there are any FILS HLP Container elements */
4605 while (end - pos >= 2) {
4606 if (2 + pos[1] > end - pos)
4607 return;
4608 if (pos[0] == WLAN_EID_EXTENSION &&
4609 pos[1] >= 1 + 2 * ETH_ALEN &&
4610 pos[2] == WLAN_EID_EXT_FILS_HLP_CONTAINER)
4611 break;
4612 pos += 2 + pos[1];
4613 }
4614 if (end - pos < 2)
4615 return; /* No FILS HLP Container elements */
4616
4617 tmp = os_malloc(end - pos);
4618 if (!tmp)
4619 return;
4620
4621 while (end - pos >= 2) {
4622 if (2 + pos[1] > end - pos ||
4623 pos[0] != WLAN_EID_EXTENSION ||
4624 pos[1] < 1 + 2 * ETH_ALEN ||
4625 pos[2] != WLAN_EID_EXT_FILS_HLP_CONTAINER)
4626 break;
4627 tmp_pos = tmp;
4628 os_memcpy(tmp_pos, pos + 3, pos[1] - 1);
4629 tmp_pos += pos[1] - 1;
4630 pos += 2 + pos[1];
4631
4632 /* Add possible fragments */
4633 while (end - pos >= 2 && pos[0] == WLAN_EID_FRAGMENT &&
4634 2 + pos[1] <= end - pos) {
4635 os_memcpy(tmp_pos, pos + 2, pos[1]);
4636 tmp_pos += pos[1];
4637 pos += 2 + pos[1];
4638 }
4639
4640 fils_process_hlp_resp(sm, tmp, tmp_pos - tmp);
4641 }
4642
4643 os_free(tmp);
4644 }
4645
4646
fils_process_assoc_resp(struct wpa_sm * sm,const u8 * resp,size_t len)4647 int fils_process_assoc_resp(struct wpa_sm *sm, const u8 *resp, size_t len)
4648 {
4649 const struct ieee80211_mgmt *mgmt;
4650 const u8 *end, *ie_start;
4651 struct ieee802_11_elems elems;
4652 int keylen, rsclen;
4653 enum wpa_alg alg;
4654 struct wpa_gtk_data gd;
4655 int maxkeylen;
4656 struct wpa_eapol_ie_parse kde;
4657
4658 if (!sm || !sm->ptk_set) {
4659 wpa_printf(MSG_DEBUG, "FILS: No KEK available");
4660 return -1;
4661 }
4662
4663 if (!wpa_key_mgmt_fils(sm->key_mgmt)) {
4664 wpa_printf(MSG_DEBUG, "FILS: Not a FILS AKM");
4665 return -1;
4666 }
4667
4668 if (sm->fils_completed) {
4669 wpa_printf(MSG_DEBUG,
4670 "FILS: Association has already been completed for this FILS authentication - ignore unexpected retransmission");
4671 return -1;
4672 }
4673
4674 wpa_hexdump(MSG_DEBUG, "FILS: (Re)Association Response frame",
4675 resp, len);
4676
4677 mgmt = (const struct ieee80211_mgmt *) resp;
4678 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.assoc_resp))
4679 return -1;
4680
4681 end = resp + len;
4682 /* Same offset for Association Response and Reassociation Response */
4683 ie_start = mgmt->u.assoc_resp.variable;
4684
4685 if (ieee802_11_parse_elems(ie_start, end - ie_start, &elems, 1) ==
4686 ParseFailed) {
4687 wpa_printf(MSG_DEBUG,
4688 "FILS: Failed to parse decrypted elements");
4689 goto fail;
4690 }
4691
4692 if (!elems.fils_session) {
4693 wpa_printf(MSG_DEBUG, "FILS: No FILS Session element");
4694 return -1;
4695 }
4696 if (os_memcmp(elems.fils_session, sm->fils_session,
4697 FILS_SESSION_LEN) != 0) {
4698 wpa_printf(MSG_DEBUG, "FILS: FILS Session mismatch");
4699 wpa_hexdump(MSG_DEBUG, "FILS: Received FILS Session",
4700 elems.fils_session, FILS_SESSION_LEN);
4701 wpa_hexdump(MSG_DEBUG, "FILS: Expected FILS Session",
4702 sm->fils_session, FILS_SESSION_LEN);
4703 }
4704
4705 if (!elems.rsn_ie) {
4706 wpa_printf(MSG_DEBUG,
4707 "FILS: No RSNE in (Re)Association Response");
4708 /* As an interop workaround, allow this for now since IEEE Std
4709 * 802.11ai-2016 did not include all the needed changes to make
4710 * a FILS AP include RSNE in the frame. This workaround might
4711 * eventually be removed and replaced with rejection (goto fail)
4712 * to follow a strict interpretation of the standard. */
4713 } else if (wpa_compare_rsn_ie(wpa_key_mgmt_ft(sm->key_mgmt),
4714 sm->ap_rsn_ie, sm->ap_rsn_ie_len,
4715 elems.rsn_ie - 2, elems.rsn_ie_len + 2)) {
4716 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
4717 "FILS: RSNE mismatch between Beacon/Probe Response and (Re)Association Response");
4718 wpa_hexdump(MSG_DEBUG, "FILS: RSNE in Beacon/Probe Response",
4719 sm->ap_rsn_ie, sm->ap_rsn_ie_len);
4720 wpa_hexdump(MSG_DEBUG, "FILS: RSNE in (Re)Association Response",
4721 elems.rsn_ie, elems.rsn_ie_len);
4722 goto fail;
4723 }
4724
4725 /* TODO: FILS Public Key */
4726
4727 if (!elems.fils_key_confirm) {
4728 wpa_printf(MSG_DEBUG, "FILS: No FILS Key Confirm element");
4729 goto fail;
4730 }
4731 if (elems.fils_key_confirm_len != sm->fils_key_auth_len) {
4732 wpa_printf(MSG_DEBUG,
4733 "FILS: Unexpected Key-Auth length %d (expected %d)",
4734 elems.fils_key_confirm_len,
4735 (int) sm->fils_key_auth_len);
4736 goto fail;
4737 }
4738 if (os_memcmp(elems.fils_key_confirm, sm->fils_key_auth_ap,
4739 sm->fils_key_auth_len) != 0) {
4740 wpa_printf(MSG_DEBUG, "FILS: Key-Auth mismatch");
4741 wpa_hexdump(MSG_DEBUG, "FILS: Received Key-Auth",
4742 elems.fils_key_confirm,
4743 elems.fils_key_confirm_len);
4744 wpa_hexdump(MSG_DEBUG, "FILS: Expected Key-Auth",
4745 sm->fils_key_auth_ap, sm->fils_key_auth_len);
4746 goto fail;
4747 }
4748
4749 #ifdef CONFIG_OCV
4750 if (wpa_sm_ocv_enabled(sm)) {
4751 struct wpa_channel_info ci;
4752
4753 if (wpa_sm_channel_info(sm, &ci) != 0) {
4754 wpa_printf(MSG_WARNING,
4755 "Failed to get channel info to validate received OCI in FILS (Re)Association Response frame");
4756 goto fail;
4757 }
4758
4759 if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
4760 channel_width_to_int(ci.chanwidth),
4761 ci.seg1_idx) != 0) {
4762 wpa_printf(MSG_WARNING, "FILS: %s", ocv_errorstr);
4763 goto fail;
4764 }
4765 }
4766 #endif /* CONFIG_OCV */
4767
4768 #ifdef CONFIG_IEEE80211R
4769 if (wpa_key_mgmt_ft(sm->key_mgmt) && sm->fils_ft_ies) {
4770 struct wpa_ie_data rsn;
4771
4772 /* Check that PMKR1Name derived by the AP matches */
4773 if (!elems.rsn_ie ||
4774 wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, elems.rsn_ie_len + 2,
4775 &rsn) < 0 ||
4776 !rsn.pmkid || rsn.num_pmkid != 1 ||
4777 os_memcmp(rsn.pmkid, sm->pmk_r1_name,
4778 WPA_PMK_NAME_LEN) != 0) {
4779 wpa_printf(MSG_DEBUG,
4780 "FILS+FT: No RSNE[PMKR1Name] match in AssocResp");
4781 goto fail;
4782 }
4783 }
4784 #endif /* CONFIG_IEEE80211R */
4785
4786 /* Key Delivery */
4787 if (!elems.key_delivery) {
4788 wpa_printf(MSG_DEBUG, "FILS: No Key Delivery element");
4789 goto fail;
4790 }
4791
4792 /* Parse GTK and set the key to the driver */
4793 os_memset(&gd, 0, sizeof(gd));
4794 if (wpa_supplicant_parse_ies(elems.key_delivery + WPA_KEY_RSC_LEN,
4795 elems.key_delivery_len - WPA_KEY_RSC_LEN,
4796 &kde) < 0) {
4797 wpa_printf(MSG_DEBUG, "FILS: Failed to parse KDEs");
4798 goto fail;
4799 }
4800 if (!kde.gtk) {
4801 wpa_printf(MSG_DEBUG, "FILS: No GTK KDE");
4802 goto fail;
4803 }
4804 maxkeylen = gd.gtk_len = kde.gtk_len - 2;
4805 if (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
4806 gd.gtk_len, maxkeylen,
4807 &gd.key_rsc_len, &gd.alg))
4808 goto fail;
4809
4810 wpa_hexdump_key(MSG_DEBUG, "FILS: Received GTK", kde.gtk, kde.gtk_len);
4811 gd.keyidx = kde.gtk[0] & 0x3;
4812 gd.tx = wpa_supplicant_gtk_tx_bit_workaround(sm,
4813 !!(kde.gtk[0] & BIT(2)));
4814 if (kde.gtk_len - 2 > sizeof(gd.gtk)) {
4815 wpa_printf(MSG_DEBUG, "FILS: Too long GTK in GTK KDE (len=%lu)",
4816 (unsigned long) kde.gtk_len - 2);
4817 goto fail;
4818 }
4819 os_memcpy(gd.gtk, kde.gtk + 2, kde.gtk_len - 2);
4820
4821 wpa_printf(MSG_DEBUG, "FILS: Set GTK to driver");
4822 if (wpa_supplicant_install_gtk(sm, &gd, elems.key_delivery, 0) < 0) {
4823 wpa_printf(MSG_DEBUG, "FILS: Failed to set GTK");
4824 goto fail;
4825 }
4826
4827 if (ieee80211w_set_keys(sm, &kde) < 0) {
4828 wpa_printf(MSG_DEBUG, "FILS: Failed to set IGTK");
4829 goto fail;
4830 }
4831
4832 alg = wpa_cipher_to_alg(sm->pairwise_cipher);
4833 keylen = wpa_cipher_key_len(sm->pairwise_cipher);
4834 if (keylen <= 0 || (unsigned int) keylen != sm->ptk.tk_len) {
4835 wpa_printf(MSG_DEBUG, "FILS: TK length mismatch: %u != %lu",
4836 keylen, (long unsigned int) sm->ptk.tk_len);
4837 goto fail;
4838 }
4839
4840 rsclen = wpa_cipher_rsc_len(sm->pairwise_cipher);
4841 wpa_hexdump_key(MSG_DEBUG, "FILS: Set TK to driver",
4842 sm->ptk.tk, keylen);
4843 if (wpa_sm_set_key(sm, alg, sm->bssid, 0, 1, null_rsc, rsclen,
4844 sm->ptk.tk, keylen, KEY_FLAG_PAIRWISE_RX_TX) < 0) {
4845 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
4846 "FILS: Failed to set PTK to the driver (alg=%d keylen=%d bssid="
4847 MACSTR ")",
4848 alg, keylen, MAC2STR(sm->bssid));
4849 goto fail;
4850 }
4851
4852 /* TODO: TK could be cleared after auth frame exchange now that driver
4853 * takes care of association frame encryption/decryption. */
4854 /* TK is not needed anymore in supplicant */
4855 os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
4856 sm->ptk.tk_len = 0;
4857 sm->ptk.installed = 1;
4858
4859 /* FILS HLP Container */
4860 fils_process_hlp_container(sm, ie_start, end - ie_start);
4861
4862 /* TODO: FILS IP Address Assignment */
4863
4864 wpa_printf(MSG_DEBUG, "FILS: Auth+Assoc completed successfully");
4865 sm->fils_completed = 1;
4866 forced_memzero(&gd, sizeof(gd));
4867
4868 if (kde.transition_disable)
4869 wpa_sm_transition_disable(sm, kde.transition_disable[0]);
4870
4871 return 0;
4872 fail:
4873 forced_memzero(&gd, sizeof(gd));
4874 return -1;
4875 }
4876
4877
wpa_sm_set_reset_fils_completed(struct wpa_sm * sm,int set)4878 void wpa_sm_set_reset_fils_completed(struct wpa_sm *sm, int set)
4879 {
4880 if (sm)
4881 sm->fils_completed = !!set;
4882 }
4883
4884 #endif /* CONFIG_FILS */
4885
4886
wpa_fils_is_completed(struct wpa_sm * sm)4887 int wpa_fils_is_completed(struct wpa_sm *sm)
4888 {
4889 #ifdef CONFIG_FILS
4890 return sm && sm->fils_completed;
4891 #else /* CONFIG_FILS */
4892 return 0;
4893 #endif /* CONFIG_FILS */
4894 }
4895
4896
4897 #ifdef CONFIG_OWE
4898
owe_build_assoc_req(struct wpa_sm * sm,u16 group)4899 struct wpabuf * owe_build_assoc_req(struct wpa_sm *sm, u16 group)
4900 {
4901 struct wpabuf *ie = NULL, *pub = NULL;
4902 size_t prime_len;
4903
4904 if (group == 19)
4905 prime_len = 32;
4906 else if (group == 20)
4907 prime_len = 48;
4908 else if (group == 21)
4909 prime_len = 66;
4910 else
4911 return NULL;
4912
4913 crypto_ecdh_deinit(sm->owe_ecdh);
4914 sm->owe_ecdh = crypto_ecdh_init(group);
4915 if (!sm->owe_ecdh)
4916 goto fail;
4917 sm->owe_group = group;
4918 pub = crypto_ecdh_get_pubkey(sm->owe_ecdh, 0);
4919 pub = wpabuf_zeropad(pub, prime_len);
4920 if (!pub)
4921 goto fail;
4922
4923 ie = wpabuf_alloc(5 + wpabuf_len(pub));
4924 if (!ie)
4925 goto fail;
4926 wpabuf_put_u8(ie, WLAN_EID_EXTENSION);
4927 wpabuf_put_u8(ie, 1 + 2 + wpabuf_len(pub));
4928 wpabuf_put_u8(ie, WLAN_EID_EXT_OWE_DH_PARAM);
4929 wpabuf_put_le16(ie, group);
4930 wpabuf_put_buf(ie, pub);
4931 wpabuf_free(pub);
4932 wpa_hexdump_buf(MSG_DEBUG, "OWE: Diffie-Hellman Parameter element",
4933 ie);
4934
4935 return ie;
4936 fail:
4937 wpabuf_free(pub);
4938 crypto_ecdh_deinit(sm->owe_ecdh);
4939 sm->owe_ecdh = NULL;
4940 return NULL;
4941 }
4942
4943
owe_process_assoc_resp(struct wpa_sm * sm,const u8 * bssid,const u8 * resp_ies,size_t resp_ies_len)4944 int owe_process_assoc_resp(struct wpa_sm *sm, const u8 *bssid,
4945 const u8 *resp_ies, size_t resp_ies_len)
4946 {
4947 struct ieee802_11_elems elems;
4948 u16 group;
4949 struct wpabuf *secret, *pub, *hkey;
4950 int res;
4951 u8 prk[SHA512_MAC_LEN], pmkid[SHA512_MAC_LEN];
4952 const char *info = "OWE Key Generation";
4953 const u8 *addr[2];
4954 size_t len[2];
4955 size_t hash_len, prime_len;
4956 struct wpa_ie_data data;
4957
4958 if (!resp_ies ||
4959 ieee802_11_parse_elems(resp_ies, resp_ies_len, &elems, 1) ==
4960 ParseFailed) {
4961 wpa_printf(MSG_INFO,
4962 "OWE: Could not parse Association Response frame elements");
4963 return -1;
4964 }
4965
4966 if (sm->cur_pmksa && elems.rsn_ie &&
4967 wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, 2 + elems.rsn_ie_len,
4968 &data) == 0 &&
4969 data.num_pmkid == 1 && data.pmkid &&
4970 os_memcmp(sm->cur_pmksa->pmkid, data.pmkid, PMKID_LEN) == 0) {
4971 wpa_printf(MSG_DEBUG, "OWE: Use PMKSA caching");
4972 wpa_sm_set_pmk_from_pmksa(sm);
4973 return 0;
4974 }
4975
4976 if (!elems.owe_dh) {
4977 wpa_printf(MSG_INFO,
4978 "OWE: No Diffie-Hellman Parameter element found in Association Response frame");
4979 return -1;
4980 }
4981
4982 group = WPA_GET_LE16(elems.owe_dh);
4983 if (group != sm->owe_group) {
4984 wpa_printf(MSG_INFO,
4985 "OWE: Unexpected Diffie-Hellman group in response: %u",
4986 group);
4987 return -1;
4988 }
4989
4990 if (!sm->owe_ecdh) {
4991 wpa_printf(MSG_INFO, "OWE: No ECDH state available");
4992 return -1;
4993 }
4994
4995 if (group == 19)
4996 prime_len = 32;
4997 else if (group == 20)
4998 prime_len = 48;
4999 else if (group == 21)
5000 prime_len = 66;
5001 else
5002 return -1;
5003
5004 secret = crypto_ecdh_set_peerkey(sm->owe_ecdh, 0,
5005 elems.owe_dh + 2,
5006 elems.owe_dh_len - 2);
5007 secret = wpabuf_zeropad(secret, prime_len);
5008 if (!secret) {
5009 wpa_printf(MSG_DEBUG, "OWE: Invalid peer DH public key");
5010 return -1;
5011 }
5012 wpa_hexdump_buf_key(MSG_DEBUG, "OWE: DH shared secret", secret);
5013
5014 /* prk = HKDF-extract(C | A | group, z) */
5015
5016 pub = crypto_ecdh_get_pubkey(sm->owe_ecdh, 0);
5017 if (!pub) {
5018 wpabuf_clear_free(secret);
5019 return -1;
5020 }
5021
5022 /* PMKID = Truncate-128(Hash(C | A)) */
5023 addr[0] = wpabuf_head(pub);
5024 len[0] = wpabuf_len(pub);
5025 addr[1] = elems.owe_dh + 2;
5026 len[1] = elems.owe_dh_len - 2;
5027 if (group == 19) {
5028 res = sha256_vector(2, addr, len, pmkid);
5029 hash_len = SHA256_MAC_LEN;
5030 } else if (group == 20) {
5031 res = sha384_vector(2, addr, len, pmkid);
5032 hash_len = SHA384_MAC_LEN;
5033 } else if (group == 21) {
5034 res = sha512_vector(2, addr, len, pmkid);
5035 hash_len = SHA512_MAC_LEN;
5036 } else {
5037 res = -1;
5038 hash_len = 0;
5039 }
5040 pub = wpabuf_zeropad(pub, prime_len);
5041 if (res < 0 || !pub) {
5042 wpabuf_free(pub);
5043 wpabuf_clear_free(secret);
5044 return -1;
5045 }
5046
5047 hkey = wpabuf_alloc(wpabuf_len(pub) + elems.owe_dh_len - 2 + 2);
5048 if (!hkey) {
5049 wpabuf_free(pub);
5050 wpabuf_clear_free(secret);
5051 return -1;
5052 }
5053
5054 wpabuf_put_buf(hkey, pub); /* C */
5055 wpabuf_free(pub);
5056 wpabuf_put_data(hkey, elems.owe_dh + 2, elems.owe_dh_len - 2); /* A */
5057 wpabuf_put_le16(hkey, sm->owe_group); /* group */
5058 if (group == 19)
5059 res = hmac_sha256(wpabuf_head(hkey), wpabuf_len(hkey),
5060 wpabuf_head(secret), wpabuf_len(secret), prk);
5061 else if (group == 20)
5062 res = hmac_sha384(wpabuf_head(hkey), wpabuf_len(hkey),
5063 wpabuf_head(secret), wpabuf_len(secret), prk);
5064 else if (group == 21)
5065 res = hmac_sha512(wpabuf_head(hkey), wpabuf_len(hkey),
5066 wpabuf_head(secret), wpabuf_len(secret), prk);
5067 wpabuf_clear_free(hkey);
5068 wpabuf_clear_free(secret);
5069 if (res < 0)
5070 return -1;
5071
5072 wpa_hexdump_key(MSG_DEBUG, "OWE: prk", prk, hash_len);
5073
5074 /* PMK = HKDF-expand(prk, "OWE Key Generation", n) */
5075
5076 if (group == 19)
5077 res = hmac_sha256_kdf(prk, hash_len, NULL, (const u8 *) info,
5078 os_strlen(info), sm->pmk, hash_len);
5079 else if (group == 20)
5080 res = hmac_sha384_kdf(prk, hash_len, NULL, (const u8 *) info,
5081 os_strlen(info), sm->pmk, hash_len);
5082 else if (group == 21)
5083 res = hmac_sha512_kdf(prk, hash_len, NULL, (const u8 *) info,
5084 os_strlen(info), sm->pmk, hash_len);
5085 forced_memzero(prk, SHA512_MAC_LEN);
5086 if (res < 0) {
5087 sm->pmk_len = 0;
5088 return -1;
5089 }
5090 sm->pmk_len = hash_len;
5091
5092 wpa_hexdump_key(MSG_DEBUG, "OWE: PMK", sm->pmk, sm->pmk_len);
5093 wpa_hexdump(MSG_DEBUG, "OWE: PMKID", pmkid, PMKID_LEN);
5094 pmksa_cache_add(sm->pmksa, sm->pmk, sm->pmk_len, pmkid, NULL, 0,
5095 bssid, sm->own_addr, sm->network_ctx, sm->key_mgmt,
5096 NULL);
5097
5098 return 0;
5099 }
5100
5101 #endif /* CONFIG_OWE */
5102
5103
wpa_sm_set_fils_cache_id(struct wpa_sm * sm,const u8 * fils_cache_id)5104 void wpa_sm_set_fils_cache_id(struct wpa_sm *sm, const u8 *fils_cache_id)
5105 {
5106 #ifdef CONFIG_FILS
5107 if (sm && fils_cache_id) {
5108 sm->fils_cache_id_set = 1;
5109 os_memcpy(sm->fils_cache_id, fils_cache_id, FILS_CACHE_ID_LEN);
5110 }
5111 #endif /* CONFIG_FILS */
5112 }
5113
5114
5115 #ifdef CONFIG_DPP2
wpa_sm_set_dpp_z(struct wpa_sm * sm,const struct wpabuf * z)5116 void wpa_sm_set_dpp_z(struct wpa_sm *sm, const struct wpabuf *z)
5117 {
5118 if (sm) {
5119 wpabuf_clear_free(sm->dpp_z);
5120 sm->dpp_z = z ? wpabuf_dup(z) : NULL;
5121 }
5122 }
5123 #endif /* CONFIG_DPP2 */
5124