1 /*
2 * PASN responder processing
3 *
4 * Copyright (C) 2019, Intel Corporation
5 * Copyright (C) 2022, Qualcomm Innovation Center, Inc.
6 *
7 * This software may be distributed under the terms of the BSD license.
8 * See README for more details.
9 */
10
11 #include "utils/includes.h"
12
13 #include "utils/common.h"
14 #include "common/wpa_common.h"
15 #include "common/sae.h"
16 #include "common/ieee802_11_common.h"
17 #include "common/ieee802_11_defs.h"
18 #include "crypto/sha384.h"
19 #include "crypto/sha256.h"
20 #include "crypto/random.h"
21 #include "crypto/crypto.h"
22 #include "ap/hostapd.h"
23 #include "ap/comeback_token.h"
24 #include "ap/ieee802_1x.h"
25 #include "ap/pmksa_cache_auth.h"
26 #include "pasn_common.h"
27
28 #ifdef CONFIG_PASN
29 #ifdef CONFIG_SAE
30
pasn_wd_handle_sae_commit(struct pasn_data * pasn,const u8 * own_addr,const u8 * peer_addr,struct wpabuf * wd)31 static int pasn_wd_handle_sae_commit(struct pasn_data *pasn,
32 const u8 *own_addr, const u8 *peer_addr,
33 struct wpabuf *wd)
34 {
35 const u8 *data;
36 size_t buf_len;
37 u16 res, alg, seq, status;
38 int groups[] = { pasn->group, 0 };
39 int ret;
40
41 if (!wd)
42 return -1;
43
44 data = wpabuf_head_u8(wd);
45 buf_len = wpabuf_len(wd);
46
47 if (buf_len < 6) {
48 wpa_printf(MSG_DEBUG, "PASN: SAE buffer too short. len=%zu",
49 buf_len);
50 return -1;
51 }
52
53 alg = WPA_GET_LE16(data);
54 seq = WPA_GET_LE16(data + 2);
55 status = WPA_GET_LE16(data + 4);
56
57 wpa_printf(MSG_DEBUG, "PASN: SAE commit: alg=%u, seq=%u, status=%u",
58 alg, seq, status);
59
60 if (alg != WLAN_AUTH_SAE || seq != 1 ||
61 status != WLAN_STATUS_SAE_HASH_TO_ELEMENT) {
62 wpa_printf(MSG_DEBUG, "PASN: Dropping peer SAE commit");
63 return -1;
64 }
65
66 sae_clear_data(&pasn->sae);
67 pasn->sae.state = SAE_NOTHING;
68
69 ret = sae_set_group(&pasn->sae, pasn->group);
70 if (ret) {
71 wpa_printf(MSG_DEBUG, "PASN: Failed to set SAE group");
72 return -1;
73 }
74
75 if (!pasn->password || !pasn->pt) {
76 wpa_printf(MSG_DEBUG, "PASN: No SAE PT found");
77 return -1;
78 }
79
80 ret = sae_prepare_commit_pt(&pasn->sae, pasn->pt, own_addr, peer_addr,
81 NULL, NULL);
82 if (ret) {
83 wpa_printf(MSG_DEBUG, "PASN: Failed to prepare SAE commit");
84 return -1;
85 }
86
87 res = sae_parse_commit(&pasn->sae, data + 6, buf_len - 6, NULL, 0,
88 groups, 0, NULL);
89 if (res != WLAN_STATUS_SUCCESS) {
90 wpa_printf(MSG_DEBUG, "PASN: Failed parsing SAE commit");
91 return -1;
92 }
93
94 /* Process the commit message and derive the PMK */
95 ret = sae_process_commit(&pasn->sae);
96 if (ret) {
97 wpa_printf(MSG_DEBUG, "SAE: Failed to process peer commit");
98 return -1;
99 }
100
101 pasn->sae.state = SAE_COMMITTED;
102
103 return 0;
104 }
105
106
pasn_wd_handle_sae_confirm(struct pasn_data * pasn,const u8 * peer_addr,struct wpabuf * wd)107 static int pasn_wd_handle_sae_confirm(struct pasn_data *pasn,
108 const u8 *peer_addr, struct wpabuf *wd)
109 {
110 const u8 *data;
111 size_t buf_len;
112 u16 res, alg, seq, status;
113
114 if (!wd)
115 return -1;
116
117 data = wpabuf_head_u8(wd);
118 buf_len = wpabuf_len(wd);
119
120 if (buf_len < 6) {
121 wpa_printf(MSG_DEBUG, "PASN: SAE buffer too short. len=%zu",
122 buf_len);
123 return -1;
124 }
125
126 alg = WPA_GET_LE16(data);
127 seq = WPA_GET_LE16(data + 2);
128 status = WPA_GET_LE16(data + 4);
129
130 wpa_printf(MSG_DEBUG, "PASN: SAE confirm: alg=%u, seq=%u, status=%u",
131 alg, seq, status);
132
133 if (alg != WLAN_AUTH_SAE || seq != 2 || status != WLAN_STATUS_SUCCESS) {
134 wpa_printf(MSG_DEBUG, "PASN: Dropping peer SAE confirm");
135 return -1;
136 }
137
138 res = sae_check_confirm(&pasn->sae, data + 6, buf_len - 6, NULL);
139 if (res != WLAN_STATUS_SUCCESS) {
140 wpa_printf(MSG_DEBUG, "PASN: SAE failed checking confirm");
141 return -1;
142 }
143
144 pasn->sae.state = SAE_ACCEPTED;
145
146 /*
147 * TODO: Based on on IEEE P802.11az/D2.6, the PMKSA derived with
148 * PASN/SAE should only be allowed with future PASN only. For now do not
149 * restrict this only for PASN.
150 */
151 if (pasn->disable_pmksa_caching)
152 return 0;
153
154 wpa_hexdump_key(MSG_DEBUG, "RSN: Cache PMK from SAE",
155 pasn->sae.pmk, pasn->sae.pmk_len);
156 if (!pasn->sae.akmp)
157 pasn->sae.akmp = WPA_KEY_MGMT_SAE;
158
159 pmksa_cache_auth_add(pasn->pmksa, pasn->sae.pmk, pasn->sae.pmk_len,
160 pasn->sae.pmkid, NULL, 0, pasn->own_addr,
161 peer_addr, 0, NULL, pasn->sae.akmp);
162 return 0;
163 }
164
165
pasn_get_sae_wd(struct pasn_data * pasn)166 static struct wpabuf * pasn_get_sae_wd(struct pasn_data *pasn)
167 {
168 struct wpabuf *buf = NULL;
169 u8 *len_ptr;
170 size_t len;
171
172 /* Need to add the entire Authentication frame body */
173 buf = wpabuf_alloc(8 + SAE_COMMIT_MAX_LEN + 8 + SAE_CONFIRM_MAX_LEN);
174 if (!buf) {
175 wpa_printf(MSG_DEBUG, "PASN: Failed to allocate SAE buffer");
176 return NULL;
177 }
178
179 /* Need to add the entire authentication frame body for the commit */
180 len_ptr = wpabuf_put(buf, 2);
181 wpabuf_put_le16(buf, WLAN_AUTH_SAE);
182 wpabuf_put_le16(buf, 1);
183 wpabuf_put_le16(buf, WLAN_STATUS_SAE_HASH_TO_ELEMENT);
184
185 /* Write the actual commit and update the length accordingly */
186 sae_write_commit(&pasn->sae, buf, NULL, 0);
187 len = wpabuf_len(buf);
188 WPA_PUT_LE16(len_ptr, len - 2);
189
190 /* Need to add the entire Authentication frame body for the confirm */
191 len_ptr = wpabuf_put(buf, 2);
192 wpabuf_put_le16(buf, WLAN_AUTH_SAE);
193 wpabuf_put_le16(buf, 2);
194 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
195
196 sae_write_confirm(&pasn->sae, buf);
197 WPA_PUT_LE16(len_ptr, wpabuf_len(buf) - len - 2);
198
199 pasn->sae.state = SAE_CONFIRMED;
200
201 return buf;
202 }
203
204 #endif /* CONFIG_SAE */
205
206
207 #ifdef CONFIG_FILS
208
pasn_get_fils_wd(struct pasn_data * pasn)209 static struct wpabuf * pasn_get_fils_wd(struct pasn_data *pasn)
210 {
211 struct pasn_fils *fils = &pasn->fils;
212 struct wpabuf *buf = NULL;
213
214 if (!fils->erp_resp) {
215 wpa_printf(MSG_DEBUG, "PASN: FILS: Missing erp_resp");
216 return NULL;
217 }
218
219 buf = wpabuf_alloc(1500);
220 if (!buf)
221 return NULL;
222
223 /* Add the authentication algorithm */
224 wpabuf_put_le16(buf, WLAN_AUTH_FILS_SK);
225
226 /* Authentication Transaction seq# */
227 wpabuf_put_le16(buf, 2);
228
229 /* Status Code */
230 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
231
232 /* Own RSNE */
233 wpa_pasn_add_rsne(buf, NULL, pasn->akmp, pasn->cipher);
234
235 /* FILS Nonce */
236 wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
237 wpabuf_put_u8(buf, 1 + FILS_NONCE_LEN);
238 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_NONCE);
239 wpabuf_put_data(buf, fils->anonce, FILS_NONCE_LEN);
240
241 /* FILS Session */
242 wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
243 wpabuf_put_u8(buf, 1 + FILS_SESSION_LEN);
244 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_SESSION);
245 wpabuf_put_data(buf, fils->session, FILS_SESSION_LEN);
246
247 /* Wrapped Data */
248 wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
249 wpabuf_put_u8(buf, 1 + wpabuf_len(fils->erp_resp));
250 wpabuf_put_u8(buf, WLAN_EID_EXT_WRAPPED_DATA);
251 wpabuf_put_buf(buf, fils->erp_resp);
252
253 return buf;
254 }
255
256 #endif /* CONFIG_FILS */
257
pasn_get_wrapped_data(struct pasn_data * pasn)258 static struct wpabuf * pasn_get_wrapped_data(struct pasn_data *pasn)
259 {
260 switch (pasn->akmp) {
261 case WPA_KEY_MGMT_PASN:
262 /* no wrapped data */
263 return NULL;
264 case WPA_KEY_MGMT_SAE:
265 #ifdef CONFIG_SAE
266 return pasn_get_sae_wd(pasn);
267 #else /* CONFIG_SAE */
268 wpa_printf(MSG_ERROR,
269 "PASN: SAE: Cannot derive wrapped data");
270 return NULL;
271 #endif /* CONFIG_SAE */
272 case WPA_KEY_MGMT_FILS_SHA256:
273 case WPA_KEY_MGMT_FILS_SHA384:
274 #ifdef CONFIG_FILS
275 return pasn_get_fils_wd(pasn);
276 #endif /* CONFIG_FILS */
277 /* fall through */
278 case WPA_KEY_MGMT_FT_PSK:
279 case WPA_KEY_MGMT_FT_IEEE8021X:
280 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
281 default:
282 wpa_printf(MSG_ERROR,
283 "PASN: TODO: Wrapped data for akmp=0x%x",
284 pasn->akmp);
285 return NULL;
286 }
287 }
288
289
290 static int
pasn_derive_keys(struct pasn_data * pasn,const u8 * own_addr,const u8 * peer_addr,const u8 * cached_pmk,size_t cached_pmk_len,struct wpa_pasn_params_data * pasn_data,struct wpabuf * wrapped_data,struct wpabuf * secret)291 pasn_derive_keys(struct pasn_data *pasn,
292 const u8 *own_addr, const u8 *peer_addr,
293 const u8 *cached_pmk, size_t cached_pmk_len,
294 struct wpa_pasn_params_data *pasn_data,
295 struct wpabuf *wrapped_data,
296 struct wpabuf *secret)
297 {
298 static const u8 pasn_default_pmk[] = {'P', 'M', 'K', 'z'};
299 u8 pmk[PMK_LEN_MAX];
300 u8 pmk_len;
301 int ret;
302
303 os_memset(pmk, 0, sizeof(pmk));
304 pmk_len = 0;
305
306 if (!cached_pmk || !cached_pmk_len)
307 wpa_printf(MSG_DEBUG, "PASN: No valid PMKSA entry");
308
309 if (pasn->akmp == WPA_KEY_MGMT_PASN) {
310 wpa_printf(MSG_DEBUG, "PASN: Using default PMK");
311
312 pmk_len = WPA_PASN_PMK_LEN;
313 os_memcpy(pmk, pasn_default_pmk, sizeof(pasn_default_pmk));
314 } else if (cached_pmk && cached_pmk_len) {
315 wpa_printf(MSG_DEBUG, "PASN: Using PMKSA entry");
316
317 pmk_len = cached_pmk_len;
318 os_memcpy(pmk, cached_pmk, cached_pmk_len);
319 } else {
320 switch (pasn->akmp) {
321 #ifdef CONFIG_SAE
322 case WPA_KEY_MGMT_SAE:
323 if (pasn->sae.state == SAE_COMMITTED) {
324 pmk_len = PMK_LEN;
325 os_memcpy(pmk, pasn->sae.pmk, PMK_LEN);
326 break;
327 }
328 #endif /* CONFIG_SAE */
329 /* fall through */
330 default:
331 /* TODO: Derive PMK based on wrapped data */
332 wpa_printf(MSG_DEBUG,
333 "PASN: Missing PMK derivation");
334 return -1;
335 }
336 }
337
338 ret = pasn_pmk_to_ptk(pmk, pmk_len, peer_addr, own_addr,
339 wpabuf_head(secret), wpabuf_len(secret),
340 &pasn->ptk, pasn->akmp,
341 pasn->cipher, pasn->kdk_len);
342 if (ret) {
343 wpa_printf(MSG_DEBUG, "PASN: Failed to derive PTK");
344 return -1;
345 }
346
347 if (pasn->secure_ltf) {
348 ret = wpa_ltf_keyseed(&pasn->ptk, pasn->akmp,
349 pasn->cipher);
350 if (ret) {
351 wpa_printf(MSG_DEBUG,
352 "PASN: Failed to derive LTF keyseed");
353 return -1;
354 }
355 }
356
357 wpa_printf(MSG_DEBUG, "PASN: PTK successfully derived");
358 return 0;
359 }
360
361
handle_auth_pasn_comeback(struct pasn_data * pasn,const u8 * own_addr,const u8 * peer_addr,u16 group)362 static void handle_auth_pasn_comeback(struct pasn_data *pasn,
363 const u8 *own_addr, const u8 *peer_addr,
364 u16 group)
365 {
366 struct wpabuf *buf, *comeback;
367 int ret;
368
369 wpa_printf(MSG_DEBUG,
370 "PASN: Building comeback frame 2. Comeback after=%u",
371 pasn->comeback_after);
372
373 buf = wpabuf_alloc(1500);
374 if (!buf)
375 return;
376
377 wpa_pasn_build_auth_header(buf, pasn->bssid, own_addr, peer_addr, 2,
378 WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY);
379
380 /*
381 * Do not include the group as a part of the token since it is not going
382 * to be used.
383 */
384 comeback = auth_build_token_req(&pasn->last_comeback_key_update,
385 pasn->comeback_key, pasn->comeback_idx,
386 pasn->comeback_pending_idx,
387 sizeof(u16) * COMEBACK_PENDING_IDX_SIZE,
388 0, peer_addr, 0);
389 if (!comeback) {
390 wpa_printf(MSG_DEBUG,
391 "PASN: Failed sending auth with comeback");
392 wpabuf_free(buf);
393 return;
394 }
395
396 wpa_pasn_add_parameter_ie(buf, group,
397 WPA_PASN_WRAPPED_DATA_NO,
398 NULL, 0, comeback,
399 pasn->comeback_after);
400 wpabuf_free(comeback);
401
402 wpa_printf(MSG_DEBUG,
403 "PASN: comeback: STA=" MACSTR, MAC2STR(peer_addr));
404
405 ret = pasn->send_mgmt(pasn->cb_ctx, wpabuf_head_u8(buf),
406 wpabuf_len(buf), 0, 0, 0);
407 if (ret)
408 wpa_printf(MSG_INFO, "PASN: Failed to send comeback frame 2");
409
410 wpabuf_free(buf);
411 }
412
413
handle_auth_pasn_resp(struct pasn_data * pasn,const u8 * own_addr,const u8 * peer_addr,struct rsn_pmksa_cache_entry * pmksa,u16 status)414 int handle_auth_pasn_resp(struct pasn_data *pasn, const u8 *own_addr,
415 const u8 *peer_addr,
416 struct rsn_pmksa_cache_entry *pmksa, u16 status)
417 {
418 struct wpabuf *buf, *pubkey = NULL, *wrapped_data_buf = NULL;
419 struct wpabuf *rsn_buf = NULL;
420 u8 mic[WPA_PASN_MAX_MIC_LEN];
421 u8 mic_len;
422 u8 *ptr;
423 const u8 *frame, *data, *rsn_ie, *rsnxe_ie;
424 u8 *data_buf = NULL;
425 size_t frame_len, data_len;
426 int ret;
427 const u8 *pmkid = NULL;
428
429 wpa_printf(MSG_DEBUG, "PASN: Building frame 2: status=%u", status);
430
431 buf = wpabuf_alloc(1500);
432 if (!buf)
433 goto fail;
434
435 wpa_pasn_build_auth_header(buf, pasn->bssid, own_addr, peer_addr, 2,
436 status);
437
438 if (status != WLAN_STATUS_SUCCESS)
439 goto done;
440
441 if (pmksa && pasn->custom_pmkid_valid)
442 pmkid = pasn->custom_pmkid;
443 else if (pmksa) {
444 pmkid = pmksa->pmkid;
445 #ifdef CONFIG_SAE
446 } else if (pasn->akmp == WPA_KEY_MGMT_SAE) {
447 wpa_printf(MSG_DEBUG, "PASN: Use SAE PMKID");
448 pmkid = pasn->sae.pmkid;
449 #endif /* CONFIG_SAE */
450 #ifdef CONFIG_FILS
451 } else if (pasn->akmp == WPA_KEY_MGMT_FILS_SHA256 ||
452 pasn->akmp == WPA_KEY_MGMT_FILS_SHA384) {
453 wpa_printf(MSG_DEBUG, "PASN: Use FILS ERP PMKID");
454 pmkid = pasn->fils.erp_pmkid;
455 #endif /* CONFIG_FILS */
456 }
457
458 if (wpa_pasn_add_rsne(buf, pmkid,
459 pasn->akmp, pasn->cipher) < 0)
460 goto fail;
461
462 /* No need to derive PMK if PMKSA is given */
463 if (!pmksa)
464 wrapped_data_buf = pasn_get_wrapped_data(pasn);
465 else
466 pasn->wrapped_data_format = WPA_PASN_WRAPPED_DATA_NO;
467
468 /* Get public key */
469 pubkey = crypto_ecdh_get_pubkey(pasn->ecdh, 0);
470 pubkey = wpabuf_zeropad(pubkey,
471 crypto_ecdh_prime_len(pasn->ecdh));
472 if (!pubkey) {
473 wpa_printf(MSG_DEBUG, "PASN: Failed to get pubkey");
474 goto fail;
475 }
476
477 wpa_pasn_add_parameter_ie(buf, pasn->group,
478 pasn->wrapped_data_format,
479 pubkey, true, NULL, 0);
480
481 if (wpa_pasn_add_wrapped_data(buf, wrapped_data_buf) < 0)
482 goto fail;
483
484 wpabuf_free(wrapped_data_buf);
485 wrapped_data_buf = NULL;
486 wpabuf_free(pubkey);
487 pubkey = NULL;
488
489 /* Add RSNXE if needed */
490 rsnxe_ie = pasn->rsnxe_ie;
491 if (rsnxe_ie)
492 wpabuf_put_data(buf, rsnxe_ie, 2 + rsnxe_ie[1]);
493
494 wpa_pasn_add_extra_ies(buf, pasn->extra_ies, pasn->extra_ies_len);
495
496 /* Add the mic */
497 mic_len = pasn_mic_len(pasn->akmp, pasn->cipher);
498 wpabuf_put_u8(buf, WLAN_EID_MIC);
499 wpabuf_put_u8(buf, mic_len);
500 ptr = wpabuf_put(buf, mic_len);
501
502 os_memset(ptr, 0, mic_len);
503
504 frame = wpabuf_head_u8(buf) + IEEE80211_HDRLEN;
505 frame_len = wpabuf_len(buf) - IEEE80211_HDRLEN;
506
507 if (pasn->rsn_ie && pasn->rsn_ie_len) {
508 rsn_ie = pasn->rsn_ie;
509 } else {
510 /*
511 * Note: when pasn->rsn_ie is NULL, it is likely that Beacon
512 * frame RSNE is not initialized. This is possible in case of
513 * PASN authentication used for Wi-Fi Aware for which Beacon
514 * frame RSNE and RSNXE are same as RSNE and RSNXE in the
515 * Authentication frame.
516 */
517 rsn_buf = wpabuf_alloc(500);
518 if (!rsn_buf)
519 goto fail;
520
521 if (wpa_pasn_add_rsne(rsn_buf, pmkid,
522 pasn->akmp, pasn->cipher) < 0)
523 goto fail;
524
525 rsn_ie = wpabuf_head_u8(rsn_buf);
526 }
527
528 /*
529 * Note: wpa_auth_get_wpa_ie() might return not only the RSNE but also
530 * MDE, etc. Thus, do not use the returned length but instead use the
531 * length specified in the IE header.
532 */
533 data_len = rsn_ie[1] + 2;
534 if (rsnxe_ie) {
535 data_buf = os_zalloc(rsn_ie[1] + 2 + rsnxe_ie[1] + 2);
536 if (!data_buf)
537 goto fail;
538
539 os_memcpy(data_buf, rsn_ie, rsn_ie[1] + 2);
540 os_memcpy(data_buf + rsn_ie[1] + 2, rsnxe_ie, rsnxe_ie[1] + 2);
541 data_len += rsnxe_ie[1] + 2;
542 data = data_buf;
543 } else {
544 data = rsn_ie;
545 }
546
547 ret = pasn_mic(pasn->ptk.kck, pasn->akmp, pasn->cipher,
548 own_addr, peer_addr, data, data_len,
549 frame, frame_len, mic);
550 os_free(data_buf);
551 if (ret) {
552 wpa_printf(MSG_DEBUG, "PASN: Frame 3: Failed MIC calculation");
553 goto fail;
554 }
555
556 #ifdef CONFIG_TESTING_OPTIONS
557 if (pasn->corrupt_mic) {
558 wpa_printf(MSG_DEBUG, "PASN: frame 2: Corrupt MIC");
559 mic[0] = ~mic[0];
560 }
561 #endif /* CONFIG_TESTING_OPTIONS */
562
563 os_memcpy(ptr, mic, mic_len);
564
565 done:
566 wpa_printf(MSG_DEBUG,
567 "PASN: Building frame 2: success; resp STA=" MACSTR,
568 MAC2STR(peer_addr));
569
570 ret = pasn->send_mgmt(pasn->cb_ctx, wpabuf_head_u8(buf),
571 wpabuf_len(buf), 0, 0, 0);
572 if (ret)
573 wpa_printf(MSG_INFO, "send_auth_reply: Send failed");
574
575 wpabuf_free(rsn_buf);
576 wpabuf_free(buf);
577 return ret;
578 fail:
579 wpabuf_free(wrapped_data_buf);
580 wpabuf_free(pubkey);
581 wpabuf_free(rsn_buf);
582 wpabuf_free(buf);
583 return -1;
584 }
585
586
handle_auth_pasn_1(struct pasn_data * pasn,const u8 * own_addr,const u8 * peer_addr,const struct ieee80211_mgmt * mgmt,size_t len)587 int handle_auth_pasn_1(struct pasn_data *pasn,
588 const u8 *own_addr, const u8 *peer_addr,
589 const struct ieee80211_mgmt *mgmt, size_t len)
590 {
591 struct ieee802_11_elems elems;
592 struct wpa_ie_data rsn_data;
593 struct wpa_pasn_params_data pasn_params;
594 struct rsn_pmksa_cache_entry *pmksa = NULL;
595 const u8 *cached_pmk = NULL;
596 size_t cached_pmk_len = 0;
597 struct wpabuf *wrapped_data = NULL, *secret = NULL;
598 const int *groups = pasn->pasn_groups;
599 static const int default_groups[] = { 19, 0 };
600 u16 status = WLAN_STATUS_SUCCESS;
601 int ret, inc_y;
602 bool derive_keys;
603 u32 i;
604
605 if (!groups)
606 groups = default_groups;
607
608 if (ieee802_11_parse_elems(mgmt->u.auth.variable,
609 len - offsetof(struct ieee80211_mgmt,
610 u.auth.variable),
611 &elems, 0) == ParseFailed) {
612 wpa_printf(MSG_DEBUG,
613 "PASN: Failed parsing Authentication frame");
614 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
615 goto send_resp;
616 }
617
618 if (!elems.rsn_ie) {
619 wpa_printf(MSG_DEBUG, "PASN: No RSNE");
620 status = WLAN_STATUS_INVALID_RSNIE;
621 goto send_resp;
622 }
623
624 ret = wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, elems.rsn_ie_len + 2,
625 &rsn_data);
626 if (ret) {
627 wpa_printf(MSG_DEBUG, "PASN: Failed parsing RSNE");
628 status = WLAN_STATUS_INVALID_RSNIE;
629 goto send_resp;
630 }
631
632 ret = wpa_pasn_validate_rsne(&rsn_data);
633 if (ret) {
634 wpa_printf(MSG_DEBUG, "PASN: Failed validating RSNE");
635 status = WLAN_STATUS_INVALID_RSNIE;
636 goto send_resp;
637 }
638
639 if (!(rsn_data.key_mgmt & pasn->wpa_key_mgmt) ||
640 !(rsn_data.pairwise_cipher & pasn->rsn_pairwise)) {
641 wpa_printf(MSG_DEBUG, "PASN: Mismatch in AKMP/cipher");
642 status = WLAN_STATUS_INVALID_RSNIE;
643 goto send_resp;
644 }
645
646 pasn->akmp = rsn_data.key_mgmt;
647 pasn->cipher = rsn_data.pairwise_cipher;
648
649 if (pasn->derive_kdk &&
650 ieee802_11_rsnx_capab_len(elems.rsnxe, elems.rsnxe_len,
651 WLAN_RSNX_CAPAB_SECURE_LTF))
652 pasn->secure_ltf = true;
653
654 if (pasn->derive_kdk)
655 pasn->kdk_len = WPA_KDK_MAX_LEN;
656 else
657 pasn->kdk_len = 0;
658
659 wpa_printf(MSG_DEBUG, "PASN: kdk_len=%zu", pasn->kdk_len);
660
661 if (!elems.pasn_params || !elems.pasn_params_len) {
662 wpa_printf(MSG_DEBUG,
663 "PASN: No PASN Parameters element found");
664 status = WLAN_STATUS_INVALID_PARAMETERS;
665 goto send_resp;
666 }
667
668 ret = wpa_pasn_parse_parameter_ie(elems.pasn_params - 3,
669 elems.pasn_params_len + 3,
670 false, &pasn_params);
671 if (ret) {
672 wpa_printf(MSG_DEBUG,
673 "PASN: Failed validation of PASN Parameters IE");
674 status = WLAN_STATUS_INVALID_PARAMETERS;
675 goto send_resp;
676 }
677
678 for (i = 0; groups[i] > 0 && groups[i] != pasn_params.group; i++)
679 ;
680
681 if (!pasn_params.group || groups[i] != pasn_params.group) {
682 wpa_printf(MSG_DEBUG, "PASN: Requested group=%hu not allowed",
683 pasn_params.group);
684 status = WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
685 goto send_resp;
686 }
687
688 if (!pasn_params.pubkey || !pasn_params.pubkey_len) {
689 wpa_printf(MSG_DEBUG, "PASN: Invalid public key");
690 status = WLAN_STATUS_INVALID_PARAMETERS;
691 goto send_resp;
692 }
693
694 if (pasn_params.comeback) {
695 wpa_printf(MSG_DEBUG, "PASN: Checking peer comeback token");
696
697 ret = check_comeback_token(pasn->comeback_key,
698 pasn->comeback_pending_idx,
699 peer_addr,
700 pasn_params.comeback,
701 pasn_params.comeback_len);
702
703 if (ret) {
704 wpa_printf(MSG_DEBUG, "PASN: Invalid comeback token");
705 status = WLAN_STATUS_INVALID_PARAMETERS;
706 goto send_resp;
707 }
708 } else if (pasn->use_anti_clogging) {
709 wpa_printf(MSG_DEBUG, "PASN: Respond with comeback");
710 handle_auth_pasn_comeback(pasn, own_addr, peer_addr,
711 pasn_params.group);
712 return -1;
713 }
714
715 pasn->ecdh = crypto_ecdh_init(pasn_params.group);
716 if (!pasn->ecdh) {
717 wpa_printf(MSG_DEBUG, "PASN: Failed to init ECDH");
718 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
719 goto send_resp;
720 }
721
722 pasn->group = pasn_params.group;
723
724 if (pasn_params.pubkey[0] == WPA_PASN_PUBKEY_UNCOMPRESSED) {
725 inc_y = 1;
726 } else if (pasn_params.pubkey[0] == WPA_PASN_PUBKEY_COMPRESSED_0 ||
727 pasn_params.pubkey[0] == WPA_PASN_PUBKEY_COMPRESSED_1) {
728 inc_y = 0;
729 } else {
730 wpa_printf(MSG_DEBUG,
731 "PASN: Invalid first octet in pubkey=0x%x",
732 pasn_params.pubkey[0]);
733 status = WLAN_STATUS_INVALID_PUBLIC_KEY;
734 goto send_resp;
735 }
736
737 secret = crypto_ecdh_set_peerkey(pasn->ecdh, inc_y,
738 pasn_params.pubkey + 1,
739 pasn_params.pubkey_len - 1);
740 if (!secret) {
741 wpa_printf(MSG_DEBUG, "PASN: Failed to derive shared secret");
742 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
743 goto send_resp;
744 }
745
746 if (!pasn->noauth && pasn->akmp == WPA_KEY_MGMT_PASN) {
747 wpa_printf(MSG_DEBUG, "PASN: Refuse PASN-UNAUTH");
748 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
749 goto send_resp;
750 }
751
752 derive_keys = true;
753 if (pasn_params.wrapped_data_format != WPA_PASN_WRAPPED_DATA_NO) {
754 wrapped_data = ieee802_11_defrag(&elems,
755 WLAN_EID_EXTENSION,
756 WLAN_EID_EXT_WRAPPED_DATA);
757 if (!wrapped_data) {
758 wpa_printf(MSG_DEBUG, "PASN: Missing wrapped data");
759 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
760 goto send_resp;
761 }
762
763 #ifdef CONFIG_SAE
764 if (pasn->akmp == WPA_KEY_MGMT_SAE) {
765 ret = pasn_wd_handle_sae_commit(pasn, own_addr,
766 peer_addr,
767 wrapped_data);
768 if (ret) {
769 wpa_printf(MSG_DEBUG,
770 "PASN: Failed processing SAE commit");
771 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
772 goto send_resp;
773 }
774 }
775 #endif /* CONFIG_SAE */
776 #ifdef CONFIG_FILS
777 if (pasn->akmp == WPA_KEY_MGMT_FILS_SHA256 ||
778 pasn->akmp == WPA_KEY_MGMT_FILS_SHA384) {
779 if (!pasn->fils_wd_valid) {
780 wpa_printf(MSG_DEBUG,
781 "PASN: Invalid FILS wrapped data");
782 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
783 goto send_resp;
784 }
785
786 wpa_printf(MSG_DEBUG,
787 "PASN: FILS: Pending AS response");
788
789 /*
790 * With PASN/FILS, keys can be derived only after a
791 * response from the AS is processed.
792 */
793 derive_keys = false;
794 }
795 #endif /* CONFIG_FILS */
796 }
797
798 pasn->wrapped_data_format = pasn_params.wrapped_data_format;
799
800 ret = pasn_auth_frame_hash(pasn->akmp, pasn->cipher,
801 ((const u8 *) mgmt) + IEEE80211_HDRLEN,
802 len - IEEE80211_HDRLEN, pasn->hash);
803 if (ret) {
804 wpa_printf(MSG_DEBUG, "PASN: Failed to compute hash");
805 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
806 goto send_resp;
807 }
808
809 if (!derive_keys) {
810 wpa_printf(MSG_DEBUG, "PASN: Storing secret");
811 pasn->secret = secret;
812 wpabuf_free(wrapped_data);
813 return 0;
814 }
815
816 if (rsn_data.num_pmkid) {
817 if (wpa_key_mgmt_ft(pasn->akmp)) {
818 #ifdef CONFIG_IEEE80211R_AP
819 wpa_printf(MSG_DEBUG, "PASN: FT: Fetch PMK-R1");
820
821 if (!pasn->pmk_r1_len) {
822 wpa_printf(MSG_DEBUG,
823 "PASN: FT: Failed getting PMK-R1");
824 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
825 goto send_resp;
826 }
827 cached_pmk = pasn->pmk_r1;
828 cached_pmk_len = pasn->pmk_r1_len;
829 #else /* CONFIG_IEEE80211R_AP */
830 wpa_printf(MSG_DEBUG, "PASN: FT: Not supported");
831 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
832 goto send_resp;
833 #endif /* CONFIG_IEEE80211R_AP */
834 } else {
835 wpa_printf(MSG_DEBUG, "PASN: Try to find PMKSA entry");
836
837 if (pasn->pmksa) {
838 const u8 *pmkid = NULL;
839
840 if (pasn->custom_pmkid_valid) {
841 ret = pasn->validate_custom_pmkid(
842 pasn->cb_ctx, peer_addr,
843 rsn_data.pmkid);
844 if (ret) {
845 wpa_printf(MSG_DEBUG,
846 "PASN: Failed custom PMKID validation");
847 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
848 goto send_resp;
849 }
850 } else {
851 pmkid = rsn_data.pmkid;
852 }
853
854 pmksa = pmksa_cache_auth_get(pasn->pmksa,
855 peer_addr,
856 pmkid);
857 if (pmksa) {
858 cached_pmk = pmksa->pmk;
859 cached_pmk_len = pmksa->pmk_len;
860 }
861 }
862 }
863 } else {
864 wpa_printf(MSG_DEBUG, "PASN: No PMKID specified");
865 }
866
867 ret = pasn_derive_keys(pasn, own_addr, peer_addr,
868 cached_pmk, cached_pmk_len,
869 &pasn_params, wrapped_data, secret);
870 if (ret) {
871 wpa_printf(MSG_DEBUG, "PASN: Failed to derive keys");
872 status = WLAN_STATUS_PASN_BASE_AKMP_FAILED;
873 goto send_resp;
874 }
875
876 ret = pasn_auth_frame_hash(pasn->akmp, pasn->cipher,
877 ((const u8 *) mgmt) + IEEE80211_HDRLEN,
878 len - IEEE80211_HDRLEN, pasn->hash);
879 if (ret) {
880 wpa_printf(MSG_DEBUG, "PASN: Failed to compute hash");
881 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
882 }
883
884 send_resp:
885 ret = handle_auth_pasn_resp(pasn, own_addr, peer_addr, pmksa, status);
886 if (ret) {
887 wpa_printf(MSG_DEBUG, "PASN: Failed to send response");
888 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
889 } else {
890 wpa_printf(MSG_DEBUG,
891 "PASN: Success handling transaction == 1");
892 }
893
894 wpabuf_free(secret);
895 wpabuf_free(wrapped_data);
896
897 if (status != WLAN_STATUS_SUCCESS)
898 return -1;
899
900 return 0;
901 }
902
903
handle_auth_pasn_3(struct pasn_data * pasn,const u8 * own_addr,const u8 * peer_addr,const struct ieee80211_mgmt * mgmt,size_t len)904 int handle_auth_pasn_3(struct pasn_data *pasn, const u8 *own_addr,
905 const u8 *peer_addr,
906 const struct ieee80211_mgmt *mgmt, size_t len)
907 {
908 struct ieee802_11_elems elems;
909 struct wpa_pasn_params_data pasn_params;
910 struct wpabuf *wrapped_data = NULL;
911 u8 mic[WPA_PASN_MAX_MIC_LEN], out_mic[WPA_PASN_MAX_MIC_LEN];
912 u8 mic_len;
913 int ret;
914 u8 *copy = NULL;
915 size_t copy_len, mic_offset;
916
917 if (ieee802_11_parse_elems(mgmt->u.auth.variable,
918 len - offsetof(struct ieee80211_mgmt,
919 u.auth.variable),
920 &elems, 0) == ParseFailed) {
921 wpa_printf(MSG_DEBUG,
922 "PASN: Failed parsing Authentication frame");
923 goto fail;
924 }
925
926 /* Check that the MIC IE exists. Save it and zero out the memory. */
927 mic_len = pasn_mic_len(pasn->akmp, pasn->cipher);
928 if (!elems.mic || elems.mic_len != mic_len) {
929 wpa_printf(MSG_DEBUG,
930 "PASN: Invalid MIC. Expecting len=%u", mic_len);
931 goto fail;
932 }
933 os_memcpy(mic, elems.mic, mic_len);
934
935 if (!elems.pasn_params || !elems.pasn_params_len) {
936 wpa_printf(MSG_DEBUG,
937 "PASN: No PASN Parameters element found");
938 goto fail;
939 }
940
941 ret = wpa_pasn_parse_parameter_ie(elems.pasn_params - 3,
942 elems.pasn_params_len + 3,
943 false, &pasn_params);
944 if (ret) {
945 wpa_printf(MSG_DEBUG,
946 "PASN: Failed validation of PASN Parameters IE");
947 goto fail;
948 }
949
950 if (pasn_params.pubkey || pasn_params.pubkey_len) {
951 wpa_printf(MSG_DEBUG,
952 "PASN: Public key should not be included");
953 goto fail;
954 }
955
956 /* Verify the MIC */
957 copy_len = len - offsetof(struct ieee80211_mgmt, u.auth);
958 mic_offset = elems.mic - (const u8 *) &mgmt->u.auth;
959 copy_len = len - offsetof(struct ieee80211_mgmt, u.auth);
960 if (mic_offset + mic_len > copy_len)
961 goto fail;
962 copy = os_memdup(&mgmt->u.auth, copy_len);
963 if (!copy)
964 goto fail;
965 os_memset(copy + mic_offset, 0, mic_len);
966 ret = pasn_mic(pasn->ptk.kck, pasn->akmp, pasn->cipher,
967 peer_addr, own_addr,
968 pasn->hash, mic_len * 2,
969 copy, copy_len, out_mic);
970 os_free(copy);
971 copy = NULL;
972
973 wpa_hexdump_key(MSG_DEBUG, "PASN: Frame MIC", mic, mic_len);
974 if (ret || os_memcmp(mic, out_mic, mic_len) != 0) {
975 wpa_printf(MSG_DEBUG, "PASN: Failed MIC verification");
976 goto fail;
977 }
978
979 if (pasn_params.wrapped_data_format != WPA_PASN_WRAPPED_DATA_NO) {
980 wrapped_data = ieee802_11_defrag(&elems,
981 WLAN_EID_EXTENSION,
982 WLAN_EID_EXT_WRAPPED_DATA);
983
984 if (!wrapped_data) {
985 wpa_printf(MSG_DEBUG, "PASN: Missing wrapped data");
986 goto fail;
987 }
988
989 #ifdef CONFIG_SAE
990 if (pasn->akmp == WPA_KEY_MGMT_SAE) {
991 ret = pasn_wd_handle_sae_confirm(pasn, peer_addr,
992 wrapped_data);
993 if (ret) {
994 wpa_printf(MSG_DEBUG,
995 "PASN: Failed processing SAE confirm");
996 wpabuf_free(wrapped_data);
997 goto fail;
998 }
999 }
1000 #endif /* CONFIG_SAE */
1001 #ifdef CONFIG_FILS
1002 if (pasn->akmp == WPA_KEY_MGMT_FILS_SHA256 ||
1003 pasn->akmp == WPA_KEY_MGMT_FILS_SHA384) {
1004 if (wrapped_data) {
1005 wpa_printf(MSG_DEBUG,
1006 "PASN: FILS: Ignore wrapped data");
1007 }
1008 }
1009 #endif /* CONFIG_FILS */
1010 wpabuf_free(wrapped_data);
1011 }
1012
1013 wpa_printf(MSG_INFO,
1014 "PASN: Success handling transaction == 3. Store PTK");
1015 return 0;
1016
1017 fail:
1018 os_free(copy);
1019 return -1;
1020 }
1021
1022 #endif /* CONFIG_PASN */
1023